Problem Description
While I was watching a video on my notebook Windows 10 Version 2004 today, I opened a second video on my extended monitor and my notebook ran immediately into a bluescreen (BSOD).
The following message was shown :
Your device ran into a problem and needs to restart. We're just collecting some error info, and then we'll restart for you. 80% complete Stop code: MEMORY MANAGEMENT
Root Cause Analysis
Once my notebook has been restarted I have taken a look into the Application Event Logs to figure out if there are some additional information. There were only two Events which told my that there was a bluescreen and that Windows has created a LiveKernelEvent. These two Events aren’t really useful to figure out the root cause of a bluescreen.
Log Name: Application Source: Windows Error Reporting Date: 6/19/2020 2:24:41 AM Event ID: 1001 Task Category: None Level: Information Keywords: Classic User: N/A Computer: ThinkPadXY Description: Fault bucket , type 0 Event Name: LiveKernelEvent Response: Not available Cab Id: 0 Log Name: Application Source: Windows Error Reporting Date: 6/19/2020 2:24:41 AM Event ID: 1001 Task Category: None Level: Information Keywords: Classic User: N/A Computer: ThinkPadXY Description: Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0
Afterwards I copied the Memory Dump from C:\Windows\Memory.dmp to my desktop and downloaded the NEW WinDbg Debugger which is still in Preview Mode. The NEW “WinDbg Preview” can be downloaded from Microsoft Store. The good thing of the NEW “WinDbg Preview” is that you don’t need to set the Symbol Path manually and create a folder for it. It is doing everything automatically.
Download WinDbg Preview
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools
I ran the installed “NEW WinDbg Preview” and opened the Memeory Dump by clicking on File > Open Dump File as shown below and proceeed as follows :
1. Click on File.
2. Click on Open Dump File and select your \Memory.DMP file path.
3. Once you select the \Memory.DMP file, WinDbg Debugger will begin to download the related Symbols (*.PDB Files) which are required to analyze the dump file. It will say Busy so you need to wait. Afterwards, I clicked on the “!Analyze -v” command on the right command pane for automatic Bugcheck Analysis.
4. As we can see in the Stack Trace part of the below automatic Bugcheck Analsysis the first 3 rows which are orange marked, nt!KeBugCheckEx, nt!MmAccessFault, nt!KiPageFault belongs to Windows. Basically Windows is running intentionally into bluescreen to prevent memory (file) corruption. This is a security measure.
Based on experience I can say that in most of such bluescreen incidents the component before Windows “nt.sys” is the faulty component. In our case its the red marked component which is “igdkmd64.sys“. Because its doing something afterwards Windows is running intentionally into a bluescreen.
To figure out to which Vendor this component belongs, please proceed as follows :
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000061941, The subtype of the bugcheck.
Arg2: ffffa9813ab64000
Arg3: 0000000000000009
Arg4: ffff908610cd67d0
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 3
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on THINKPADXY
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 7
Key : Analysis.Memory.CommitPeak.Mb
Value: 66
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 61941
BUGCHECK_P2: ffffa9813ab64000
BUGCHECK_P3: 9
BUGCHECK_P4: ffff908610cd67d0
PROCESS_NAME: System
STACK_TEXT:
ffff9086`10cd6628 fffff802`36201fae : 00000000`0000001a 00000000`00061941 ffffa981`3ab64000 00000000`00000009 : nt!KeBugCheckEx
ffff9086`10cd6630 fffff802`361ebb1e : ffffba5d`2e953020 ffffba5d`2e974a98 ffffba54`c09d5b20 fffff802`3611ceb8 : nt!MmAccessFault+0x1ef6ce
ffff9086`10cd67d0 fffff802`44f0cb42 : 00000000`00000000 ffffbc06`00000001 00000000`00000000 00008004`00000006 : nt!KiPageFault+0x35e
ffff9086`10cd6960 fffff802`4502edc0 : 00000000`00001000 ffffbc06`865d8011 ff2b2b2b`ff2b2b2b ffffe60f`bec02000 : igdkmd64+0x32cb42
ffff9086`10cd6a80 fffff802`4502ea0b : ffff9086`10cd6f80 00000000`00000001 ffff9086`10cd6f20 00000000`00000000 : igdkmd64+0x44edc0
ffff9086`10cd6af0 fffff802`4502e02e : ffffe60f`b9962000 00000000`00002000 00008004`0015f000 fffff802`44e9a636 : igdkmd64+0x44ea0b
ffff9086`10cd6e70 fffff802`44f4c93a : 00008004`0015f000 ffffbc06`865d3ea8 ffff9086`10cd7140 ffffbc06`865d7ff1 : igdkmd64+0x44e02e
ffff9086`10cd6ed0 fffff802`44f4bc6f : 00000000`00000000 00000000`00000000 ffff9086`10cd7159 ffffbc06`865a4ef3 : igdkmd64+0x36c93a
ffff9086`10cd70f0 fffff802`44f474a1 : 00000000`00000000 ffffbc06`865a4e27 ffffbc06`865d3c40 ffffbc06`865d3dc8 : igdkmd64+0x36bc6f
ffff9086`10cd71b0 fffff802`44ef1ee1 : 00000000`00000000 ffffe60f`b9962000 00000000`00000000 00000000`00000001 : igdkmd64+0x3674a1
ffff9086`10cd7290 fffff802`44c1abb0 : 00000000`0000006a ffff9086`00000007 ffffbc06`865a4e27 ffffe60f`b9962000 : igdkmd64+0x311ee1
ffff9086`10cd7360 fffff802`3f81b9c7 : ffffe60f`00000000 ffffe60f`bbf36000 ffff9086`00000109 fffff802`41fb0fbf : igdkmd64+0x3abb0
ffff9086`10cd7490 fffff802`3f85fb2f : ffffbc06`972f33b0 ffffbc06`972f33b0 ffffbc06`972f33b0 ffffe60f`bbf36000 : dxgkrnl!TdrIsEnabled+0x9aa57
ffff9086`10cd7540 fffff802`449e0582 : ffffe60f`bbf5e000 00000000`00000001 ffffe60f`c4213010 ffffe60f`bbf5e000 : dxgkrnl!TdrCollectDbgInfoStage1+0x38f
ffff9086`10cd7680 fffff802`44a81bc5 : ffffe60f`bbf5e000 00000000`00000000 ffffe60f`bbf56000 ffffe60f`bbf5e001 : dxgmms2!VidSchiResetEngine+0x312
ffff9086`10cd7830 fffff802`44a550f7 : ffffe60f`bbf56000 00000000`00000001 00000000`00000000 00000000`00000000 : dxgmms2!VidSchiResetEngines+0xb1
ffff9086`10cd7880 fffff802`44a2b562 : ffff9086`10cd7901 00000000`0005bc73 00000000`00989680 00000000`00000001 : dxgmms2!VidSchiCheckHwProgress+0x29b67
ffff9086`10cd78f0 fffff802`449bab5a : ffffe60f`c4e138a0 ffffe60f`bbf56000 ffff9086`10cd7a19 00000000`00989680 : dxgmms2!VidSchiWaitForSchedulerEvents+0x372
ffff9086`10cd79c0 fffff802`44a38a45 : ffffe60f`c4520800 ffffe60f`bbf56000 ffffe60f`c45208a0 ffffe60f`be9022b0 : dxgmms2!VidSchiScheduleCommandToRun+0x2ca
ffff9086`10cd7a80 fffff802`44a389fa : ffffe60f`bbf56400 fffff802`44a38930 ffffe60f`bbf56000 fffff802`339ed100 : dxgmms2!VidSchiRun_PriorityTable+0x35
ffff9086`10cd7ad0 fffff802`36146715 : ffffe60f`bb9aa3c0 fffff802`00000001 ffffe60f`bbf56000 000fa46f`b19bbfff : dxgmms2!VidSchiWorkerThread+0xca
ffff9086`10cd7b10 fffff802`361e5078 : fffff802`339ed180 ffffe60f`bb9aa3c0 fffff802`361466c0 5f000000`21000000 : nt!PspSystemThreadStartup+0x55
ffff9086`10cd7b60 00000000`00000000 : ffff9086`10cd8000 ffff9086`10cd1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
MODULE_NAME: hardware
IMAGE_NAME: hardware_ram
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: 0x1a_61941_PAGE_TABLE_RESERVED_BITS_SET_IMAGE_hardware_ram
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {c6e5c6cf-692e-7852-5dc5-b74944540fc0}
Followup: MachineOwner
5. To list the loaded and unloaded modules at the time of the crash you need to type the command “lmi“. Afterwards you need to search for the problematic module which is “igdkmd64” in our case and click on the hyperlink.
As we can see below from the Debugger output below the “igdkmd64.sys” belongs to “Intel HD Graphics Drivers for Windows(R)“. At that point remember what I did before running into the bluescreen. I opened a second video on my extended monitor. Does the component which we found match with my action ? Definetely yes. There is no doubt that this module caused the bluescreen on my notebook. If there would be no match between the component and my action I would further investigate into the dump analysis. At this point we found the problematic component but what to do now ?
1: kd> lmDvmigdkmd64
Browse full module list
start end module name
fffff802`44be0000 fffff802`46343000 igdkmd64 (no symbols)
Loaded symbol image file: igdkmd64.sys
Image path: \SystemRoot\System32\DriverStore\FileRepository\igdlh64.inf_amd64_9c76e19aa26b9a09\igdkmd64.sys
Image name: igdkmd64.sys
Browse all global symbols functions data
Timestamp: Wed Jan 22 11:58:42 2020 (5E280EC2)
CheckSum: 0176F290
ImageSize: 01763000
File version: 26.20.100.7812
Product version: 26.20.100.7812
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.4 Driver
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Intel Corporation
ProductName: Intel HD Graphics Drivers for Windows(R)
InternalName: igdkmd64.sys
OriginalFilename: igdkmd64.sys
ProductVersion: 26.20.100.7812
FileVersion: 26.20.100.7812
FileDescription: Intel Graphics Kernel Mode Driver
LegalCopyright: Copyright (c) 1998-2018 Intel Corporation.
Solution
At this point if this problem reoccurs too much on your PC or Notebook you should contact your Vendor to get an updated Version of the “Intel HD Graphics Drivers for Windows(R)“. If you are already up to date and your Vendor doesn’t provide you an updated or fixed Version of the “Intel HD Graphics Drivers for Windows(R)” you can downgrade your driver. This will definetely fix your problem. Basically delete the driver from Device Management and let Windows pick an Inbox Driver automatically.
Good luck !