Completely Random BSOD Stop 4E usually around 24-48 hours

[Modifyinc]

My PC keeps randomly getting a BSOD Stop 4E. It's usually happens between 24 and 48 hours.

The bugcheck was: 0x0000004e (0x000000000000009a, 0x0000000000125860, 0x0000000000000006, 0x0000000000000002)

 

I keep this PC on 24/7 and this issue has just started around the end of December 2020.

I have ran all of Dell's tests and they have all passed.

I have ran Windows Memory tester for around 8 hrs with no issues found.

I have ran sfc /scannow and the DISM Repair, and neither found any issues or corruption.

I have ran chkdsk /f and chkdsk /r with no problems found.

 

The other day it was really bad, it would BSOD with the same error every 5 minutes. As soon as I would reboot it, I only had a few minutes to do anything before it would BSOD. I finally was able to boot it in Safemode, and everything was good.

After that, the PC has been stable for a week now, though I'm still concerned it could happen again as I have no ideal what was causing it.

 

Here are my WinDBG results. Notice it says the Image_File: memory_corruption, yet I ran the memory tester for over 8 hrs with no errors found.

 

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*https://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*https://msdl.microsoft.com/download/symbols
Symbol search path is: srv*https://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 10 Kernel Version 19041 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff800`19800000 PsLoadedModuleList = 0xfffff800`1a42a2b0
Debug session time: Mon Jan 11 08:53:44.829 2021 (UTC - 5:00)
System Uptime: 0 days 0:03:20.593
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...........
Loading User Symbols

Loading unloaded module list
.........
For analysis of this file, run !analyze -v
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 000000000000009a, 
Arg2: 0000000000125860
Arg3: 0000000000000006
Arg4: 0000000000000002

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 2

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on SERVER

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 3

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 87

    Key  : Analysis.System
    Value: CreateObject


BUGCHECK_CODE:  4e

BUGCHECK_P1: 9a

BUGCHECK_P2: 125860

BUGCHECK_P3: 6

BUGCHECK_P4: 2

PROCESS_NAME:  System

STACK_TEXT:  
fffff58d`6e8a53b8 fffff800`19c61127 : 00000000`0000004e 00000000`0000009a 00000000`00125860 00000000`00000006 : nt!KeBugCheckEx
fffff58d`6e8a53c0 fffff800`19af1f2e : ffff89c5`03344fa0 fffff58d`6e8a5530 00000000`00000002 ffff89c4`00000000 : nt!MiDeleteNonPagedPoolPte+0x16f0c7
fffff58d`6e8a5430 fffff800`19aac256 : ffff8a06`6d084700 fffff800`2ad382b9 ffff8a06`64769f60 fffff800`29650871 : nt!MiClearNonPagedPtes+0x162
fffff58d`6e8a5660 fffff800`19aac07a : 00000000`00000000 fffff58d`6e8a57d1 ffffffff`ffffffc0 00000000`00004000 : nt!MmFreePoolMemory+0x1aa
fffff58d`6e8a56e0 fffff800`19aab5c6 : ffffb701`f1502180 fffff800`19bfc992 000fa4ef`bd9bbfff 00000000`00000001 : nt!RtlpHpEnvFreeVA+0x12
fffff58d`6e8a5710 fffff800`19ab0d33 : 00000000`00000000 fffff800`19bfc506 00000000`00000000 00000000`00000000 : nt!RtlpHpFreeVA+0x3a
fffff58d`6e8a5750 fffff800`19ab09de : 00000000`00000000 00000000`ffffffc0 00000000`00000000 00000000`ffffffb5 : nt!RtlpHpSegMgrCommit+0x1e3
fffff58d`6e8a5820 fffff800`19ab2e01 : 00000000`00000001 ffff8a06`689016a0 00000000`00000000 fffff800`00000040 : nt!RtlpHpSegPageRangeCommit+0x1ee
fffff58d`6e8a58c0 fffff800`19b5dd4d : ffff8a06`689016a0 00000000`00000076 ffff8a06`689016a0 ffff8a06`4c600340 : nt!RtlpHpSegPageRangeCoalesce+0x1b1
fffff58d`6e8a5940 fffff800`19b5dbe0 : ffff8a06`4c600000 ffff8a06`4c600000 00000000`00000000 ffff8a06`4c600280 : nt!RtlpHpSegContextCompact+0x13d
fffff58d`6e8a59b0 fffff800`19aac637 : 00000000`00000001 ffff8a06`4c600000 ffff8a06`00000000 ffff8a06`00000000 : nt!RtlpHpHeapCompact+0x84
fffff58d`6e8a59e0 fffff800`19a25975 : 00000000`00000001 fffff800`23d162e0 ffff8a06`00000000 00000000`00000000 : nt!ExpHpCompactionRoutine+0x207
fffff58d`6e8a5a70 fffff800`19b17e25 : ffff8a06`4e780040 00000000`00000080 ffff8a06`4cac7080 000fa4ef`bd9bbfff : nt!ExpWorkerThread+0x105
fffff58d`6e8a5b10 fffff800`19bfcdd8 : ffffb701`f1396180 ffff8a06`4e780040 fffff800`19b17dd0 00230031`00300032 : nt!PspSystemThreadStartup+0x55
fffff58d`6e8a5b60 00000000`00000000 : fffff58d`6e8a6000 fffff58d`6e89f000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME:  nt!MiDeleteNonPagedPoolPte+16f0c7

MODULE_NAME: nt

STACK_COMMAND:  .thread ; .cxr ; kb

IMAGE_NAME:  memory_corruption

BUCKET_ID_FUNC_OFFSET:  16f0c7

FAILURE_BUCKET_ID:  0x4E_9a_nt!MiDeleteNonPagedPoolPte

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {aec87dc6-8e5e-ffb2-0aed-142948a6cbb3}

Followup:     MachineOwner
---------

 

Windows 10 x64 Original OS

Dell Inspiron 3670

All current Windows updates

All current Dell driver's updates

 

 

Zip Files Attached:

SysnativeFileCollectionApp.zip

Report Files.zip

 

 

 

 

[Radium_Angel]

4 minutes ago, Modifyinc said:

Windows Memory tester

Worthless.

Use MemTest86 to find bad RAM.

[Modifyinc]

20 hours ago, Radium_Angel said:

Worthless.

Use MemTest86 to find bad RAM.

I don't know if I'd call it worthless, maybe borderline worthless. I just used it because it was convenient at the time and I was curious if it might actually find something.

Anyhow, testing it now with Memtest86. It's been running for almost 4 hours now and has yet to find any errors. I will let it run for a few more hours, though at this point I really don't think it's memory related.

 

Any other suggestions?

[Radium_Angel]

2 minutes ago, Modifyinc said:

I don't know if I'd call it worthless, maybe borderline worthless. I just used it because it was convenient at the time and I was curious if it might actually find something.

Anyhow, testing it now with Memtest86. It's been running for almost 4 hours now and has yet to find any errors. I will let it run for a few more hours, though at this point I really don't think it's memory related.

 

Any other suggestions?

If you can, post all your crash dumps here, I'll look through them and see if anything jumps out

[Modifyinc]

22 hours ago, Radium_Angel said:

If you can, post all your crash dumps here, I'll look through them and see if anything jumps out

Everything should be in the SysnativeFileCollectionApp.zip I attached to my original post, but here are the individual mini dumps if that helps.

 

It hasn't crashed for a week now, then I ran EaseUS Todo Backup just a few minutes ago to backup the system before I try the driver verifier, and within 2 mins, I had the same BSOD. So I'm thinking it might have something to do with EaseUS Backup, though nothing in the dumps seem to suggest that, at least from what I can tell.

 

I tested EaseUS again just now, but this time I only backed up just a folder of data, and it completed without issue. So, I tried the system backup again and sure enough, it did the same BSOD, again!

 

The minidump for the first BSOD using EaseUS today is included. It is dated 1/20/21.

 

Thanks again for offering to check into it.

 

Minidumps.zip

[Radium_Angel]

20 minutes ago, Modifyinc said:

Everything should be in the SysnativeFileCollectionApp.zip I attached to my original post, but here are the individual mini dumps if that helps.

 

It hasn't crashed for a week now, then I ran EaseUS Todo Backup just a few minutes ago to backup the system before I try the driver verifier, and within 2 mins, I had the same BSOD. So I'm thinking it might have something to do with EaseUS Backup, though nothing in the dumps seem to suggest that, at least from what I can tell.

 

I tested EaseUS again just now, but this time I only backed up just a folder of data, and it completed without issue. So, I tried the system backup again and sure enough, it did the same BSOD, again!

 

The minidump for the first BSOD using EaseUS today is included. It is dated 1/20/21.

 

Thanks again for offering to check into it.

 

Minidumps.zip 550.17 kB · 0 downloads

Sure, I use EaseUS todo backup without issue, but lets see what the files have to say. I'll post a detailed breakdown here and we can discuss further.

[Radium_Angel]

Ok, here is what I'm seeing:

 

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

 

 

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
 

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

 

IMAGE_NAME:  memory_corruption

BUCKET_ID_FUNC_OFFSET:  16f0c7

FAILURE_BUCKET_ID:  0x4E_9a_nt!MiDeleteNonPagedPoolPte

BUCKET_ID:  0x4E_9a_nt!MiDeleteNonPagedPoolPte

PRIMARY_PROBLEM_CLASS:  0x4E_9a_nt!MiDeleteNonPagedPoolPte
 

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
 

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  LARGE

STACK_COMMAND:  .thread ; .cxr ; kb

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_LARGE

BUCKET_ID:  MEMORY_CORRUPTION_LARGE

PRIMARY_PROBLEM_CLASS:  MEMORY_CORRUPTION_LARGE
 

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
 

IMAGE_NAME:  memory_corruption

BUCKET_ID_FUNC_OFFSET:  16f0c7

FAILURE_BUCKET_ID:  0x4E_9a_nt!MiDeleteNonPagedPoolPte

BUCKET_ID:  0x4E_9a_nt!MiDeleteNonPagedPoolPte

PRIMARY_PROBLEM_CLASS:  0x4E_9a_nt!MiDeleteNonPagedPoolPte
_________________________________________________________________________________

 

Ok, the good thing is, identical crashes across all dumps, so it's very likely it's due to a single point. Most likely you have a rogue driver causing this. The fun part will be tracking it down.

 

So for starters, I'd update every single driver in your system, where possible (chipset, NIC, wifi, GFX, BIOS) and see how it goes.

If the EaseUS backup is triggering this, try another backup solution, there seem to be millions out there....

 

[Modifyinc]

13 minutes ago, Radium_Angel said:

Ok, here is what I'm seeing:

 

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

 

 

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
 

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

 

IMAGE_NAME:  memory_corruption

BUCKET_ID_FUNC_OFFSET:  16f0c7

FAILURE_BUCKET_ID:  0x4E_9a_nt!MiDeleteNonPagedPoolPte

BUCKET_ID:  0x4E_9a_nt!MiDeleteNonPagedPoolPte

PRIMARY_PROBLEM_CLASS:  0x4E_9a_nt!MiDeleteNonPagedPoolPte
 

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
 

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  LARGE

STACK_COMMAND:  .thread ; .cxr ; kb

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_LARGE

BUCKET_ID:  MEMORY_CORRUPTION_LARGE

PRIMARY_PROBLEM_CLASS:  MEMORY_CORRUPTION_LARGE
 

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
 

IMAGE_NAME:  memory_corruption

BUCKET_ID_FUNC_OFFSET:  16f0c7

FAILURE_BUCKET_ID:  0x4E_9a_nt!MiDeleteNonPagedPoolPte

BUCKET_ID:  0x4E_9a_nt!MiDeleteNonPagedPoolPte

PRIMARY_PROBLEM_CLASS:  0x4E_9a_nt!MiDeleteNonPagedPoolPte
_________________________________________________________________________________

 

Ok, the good thing is, identical crashes across all dumps, so it's very likely it's due to a single point. Most likely you have a rogue driver causing this. The fun part will be tracking it down.

 

So for starters, I'd update every single driver in your system, where possible (chipset, NIC, wifi, GFX, BIOS) and see how it goes.

If the EaseUS backup is triggering this, try another backup solution, there seem to be millions out there....

 

It's strange though that EaseUS is causing it to happen now, because I have it set to backup weekly, and looking at my logs, all of the backups have been successful. The only two that showed failed are the ones I tried to manually run today, which resulted in the same BSOD.

 

I have all the latest drivers from Dell and Windows, but I will look for drivers directly from the manufacturers' websites.

 

I'll install another backup program so I can backup my system, because I'm really wanting to run the driver verifier. I'm hoping it it may shed some light on what driver may be the culprit.

 

[Radium_Angel]

7 minutes ago, Modifyinc said:

driver verifier

Start with that, it may help pinpoint which driver is misbehaving.

[Radium_Angel]

9 minutes ago, Modifyinc said:

It's strange though that EaseUS is causing it to happen now, because I have it set to backup weekly, and looking at my logs, all of the backups have been successful. The only two that showed failed are the ones I tried to manually run today, which resulted in the same BSOD.

 

I have all the latest drivers from Dell and Windows, but I will look for drivers directly from the manufacturers' websites.

 

I'll install another backup program so I can backup my system, because I'm really wanting to run the driver verifier. I'm hoping it it may shed some light on what driver may be the culprit.

 

A thought occurred to me, does EaseUS wake your system up to run backups? I'm wondering if it's a mobo issue waking up from sleep...

[Modifyinc]

Just now, Radium_Angel said:

A thought occurred to me, does EaseUS wake your system up to run backups? I'm wondering if it's a mobo issue waking up from sleep...

No, because I have the system set to never sleep. But good call as sleep is known to cause strange issues at times. Actually, I think it's more the waking up that causes most issues.