Windows 10 blue screens after multiple component upgrades. Please help me isolate the cause, cant understand the WinDbg analysis.

[aaa tech]

Hello. I recently upgraded multiple components in my desktop and I started getting blue screens (Windows 10 pro). The blue screens occur completely randomly regardless if the system is under load or idle. I believe the cause is the motherboard but my tests are coming out weird. I ran a WinDbg analysis on the most recent blue screen, will paste the output at the bottom, I'm having trouble understanding it.

 

Previous system:

• Ryzen 7 2700x (changed)
• 32gb Corsair RAM (changed)
• RTX 3070 (changed)

• Gigabyte X470 Aorus Gaming 5 Wifi Motherboard (Bios revision F31, changed)

• 750w G.Skill power supply (changed)

• Samsung 970 Evo 1TB Boot Drive (unchanged)

• Multiple hard drives (unchanged)

New System:

• Ryzen 9 5950x
• 64GB G.Skill RAM (4 16gb modules. This should be the maximum my motherboard supports)
• RTX 3080ti
• Motherboard unchanged however bios was upgraded to F62d to support the new CPU
• 1000w EVGA power supply
• Nothing else changed

 

I initially suspected the RAM. I was thinking if it was the CPU or GPU it would likely occur under load and its unlikely to be the motherboard because thats never given me issues. Between 4 brand new sticks of RAM maybe I have a dead stick. I ran a RAM test and it came back clean. I'm thinking rule out the PSU bc if it was that then the system wouldnt blue screen, it would just turn off. I then tested the GPU so I ran it on another system which had no issues under load (crypto mining) for 48 hours. Now I'm thinking maybe its the motherboard as a result of the BIOS upgrade. As mentioned I ran a WinDbg analysis but I am having a hard time understanding the output. Please let me know what you guys think. Thank you.

 

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80284bb19c5, The address that the exception occurred at
Arg3: ffffb20a15c0eb58, Exception Record Address
Arg4: ffffb20a15c0e390, Context Record Address

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

    Key  : AV.Dereference
    Value: NullPtr

    Key  : AV.Fault
    Value: Write

    Key  : Analysis.CPU.mSec
    Value: 3984

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 31435

    Key  : Analysis.Init.CPU.mSec
    Value: 2577

    Key  : Analysis.Init.Elapsed.mSec
    Value: 30186

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 92

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


BUGCHECK_CODE:  7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff80284bb19c5

BUGCHECK_P3: ffffb20a15c0eb58

BUGCHECK_P4: ffffb20a15c0e390

EXCEPTION_RECORD:  ffffb20a15c0eb58 -- (.exr 0xffffb20a15c0eb58)
ExceptionAddress: fffff80284bb19c5 (Ntfs!NtfsGrowLengthInCachedLcn+0x00000000000001d9)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000000
Attempt to write to address 0000000000000000

CONTEXT:  ffffb20a15c0e390 -- (.cxr 0xffffb20a15c0e390)
rax=0000000000000000 rbx=000000000000fffd rcx=ffffa10120802928
rdx=0000000000000000 rsi=ffffa10120802928 rdi=000000000000ffff
rip=fffff80284bb19c5 rsp=ffffb20a15c0ed90 rbp=ffffb20a15c0edc8
 r8=00000000000090f6  r9=0000000000000000 r10=0000000000000000
r11=ffffa10120924930 r12=0000000000000000 r13=0000000000000001
r14=ffffa10104e9ffb8 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050246
Ntfs!NtfsGrowLengthInCachedLcn+0x1d9:
fffff802`84bb19c5 66013a          add     word ptr [rdx],di ds:002b:00000000`00000000=????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

WRITE_ADDRESS: fffff80281afb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 0000000000000000

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000000

EXCEPTION_STR:  0xc0000005

STACK_TEXT:  
ffffb20a`15c0ed90 fffff802`84aa9bc0     : 00000000`00003fff ffffa101`2080fffe ffffa101`20800000 00000000`0000fffd : Ntfs!NtfsGrowLengthInCachedLcn+0x1d9
ffffb20a`15c0ee10 fffff802`84aa9a41     : ffffd802`0a7bd4f8 ffffa101`10fef050 ffffd802`0a7bd4f8 00000000`04e9ff01 : Ntfs!NtfsInsertCachedLcn+0x15c
ffffb20a`15c0eec0 fffff802`84bb16b3     : ffffd802`0a7bd4f8 00000000`00000000 ffffa101`10fef050 00000000`00000000 : Ntfs!NtfsInsertCachedRunInTier+0x55
ffffb20a`15c0ef60 fffff802`84c21614     : 00000000`00000000 00000000`079d0000 00000000`06dc79d0 00000000`00000001 : Ntfs!NtfsAddCachedRun+0x12b
ffffb20a`15c0efe0 fffff802`84c20ca9     : ffffd802`132d3180 ffffd802`132d3180 00000000`00000000 00000000`00000001 : Ntfs!NtfsScanEntireBitmap+0x2e4
ffffb20a`15c0f420 fffff802`84c29674     : ffffd802`0a7bd4f8 ffffd802`132d3180 ffffd802`132d3250 00000000`00000000 : Ntfs!NtfsInitializeClusterAllocation+0x9d
ffffb20a`15c0f4a0 fffff802`84bf0f23     : 00000000`00000000 55555555`55555555 00000000`47479100 ffffb781`47484840 : Ntfs!NtfsMountVolume+0x1f44
ffffb20a`15c0f910 fffff802`84ac522b     : ffffd802`0a7bd4f8 fffff802`84ac4be0 00000000`00000000 ffffd802`0a7bd4f8 : Ntfs!NtfsCommonFileSystemControl+0xcf
ffffb20a`15c0f9e0 fffff802`810b85f5     : ffffd802`137d0040 ffffd802`137d0040 ffffd801`f25bcab0 ffffd801`00000000 : Ntfs!NtfsFspDispatch+0x64b
ffffb20a`15c0fb30 fffff802`81155935     : ffffd802`137d0040 00000000`00000080 ffffd801`f2488040 000004d0`00000001 : nt!ExpWorkerThread+0x105
ffffb20a`15c0fbd0 fffff802`811fe728     : ffffb781`46eb7180 ffffd802`137d0040 fffff802`811558e0 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffb20a`15c0fc20 00000000`00000000     : ffffb20a`15c10000 ffffb20a`15c09000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME:  Ntfs!NtfsGrowLengthInCachedLcn+1d9

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

IMAGE_VERSION:  10.0.19041.1173

STACK_COMMAND:  .cxr 0xffffb20a15c0e390 ; kb

BUCKET_ID_FUNC_OFFSET:  1d9

FAILURE_BUCKET_ID:  AV_Ntfs!NtfsGrowLengthInCachedLcn

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {602f589d-be00-d85d-d320-b798065ca38d}

Followup:     MachineOwner
---------

0: kd> !blackboxbsd
Stream size mismatch (expected = 192, read = 176)
0: kd> !blackboxntfs

NTFS Blackbox Data

0 Slow I/O Timeout Records Found
0 Oplock Break Timeout Records Found
0: kd> !blackboxpnp
    PnpActivityId      : {00000000-0000-0000-0000-000000000000}
    PnpActivityTime    : 132864030747402101
    PnpEventInformation: 3
    PnpEventInProgress : 0
    PnpProblemCode     : 24
    PnpVetoType        : 0
    DeviceId           : STORAGE\Volume\{6772de12-1a3b-11ec-9416-00e04c6816e4}#0000000001600000

 

 

[Slayerking92]

Did you try a fresh install of windows?

 

[aaa tech]

5 minutes ago, Slayerking92 said:

Did you try a fresh install of windows?

 

Hmm. I can try putting a clean drive and seeing if it blue screens but I very much doubt it is windows. It started happening hours after the hardware upgrade and I've never had a blue screen prior on this system for years.

[Radium_Angel]

upload the mini crash dump files here, I can deconstruct them and determine what's going on.

The more files you can attach to your post (not in-line, but as attachments) they better I can be at determining what's going on

[aaa tech]

1 hour ago, Radium_Angel said:

upload the mini crash dump files here, I can deconstruct them and determine what's going on.

The more files you can attach to your post (not in-line, but as attachments) they better I can be at determining what's going on

This is what I have.

011022-13078-01.dmp 011022-13109-01.dmp 011122-15515-01.dmp 011022-11015-01.dmp

[Radium_Angel]

50 minutes ago, aaa tech said:

This is what I have.

011022-13078-01.dmp 3.14 MB · 0 downloads 011022-13109-01.dmp 4.09 MB · 0 downloads 011122-15515-01.dmp 5.72 MB · 0 downloads 011022-11015-01.dmp 2.35 MB · 0 downloads

Thanks, let me look them over and figure things out

[Radium_Angel]

Okay, what I'm going to do is post the relevant parts of the crash dump files, and then post my thoughts at the end

___

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s

SYMBOL_NAME:  Ntfs!NtfsGrowLengthInCachedLcn+1d9

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

IMAGE_VERSION:  10.0.19041.1173

STACK_COMMAND:  .cxr 0xffffe00e68d71390 ; kb

BUCKET_ID_FUNC_OFFSET:  1d9

FAILURE_BUCKET_ID:  AV_Ntfs!NtfsGrowLengthInCachedLcn
____

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
Same basic details

___

Ditto

___

Ditto.

 

 

Okay, we have four identical crash dumps. That is a good thing actually, makes it easier to determine root cause. They all point to a bad drive somewhere (NTFS, your file system can't expand or write to a drive)

I'd start by checking your drive(s) for errors, or remove all but the boot drive and see what happens.

 

[SamClan]

3 hours ago, aaa tech said:

ello. I recently upgraded multiple components in my desktop and I started getting blue screens (Windows 10 pro).

 

3 hours ago, Slayerking92 said:

Did you try a fresh install of windows?

 

Please reinstall your system you changed major components.  

 

3 hours ago, aaa tech said:

I can try putting a clean drive and seeing if it blue screen

please do so

[aaa tech]

16 minutes ago, Radium_Angel said:

Thanks, let me look them over and figure things out

 

1 hour ago, Radium_Angel said:

Okay, what I'm going to do is post the relevant parts of the crash dump files, and then post my thoughts at the end

___

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s

SYMBOL_NAME:  Ntfs!NtfsGrowLengthInCachedLcn+1d9

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

IMAGE_VERSION:  10.0.19041.1173

STACK_COMMAND:  .cxr 0xffffe00e68d71390 ; kb

BUCKET_ID_FUNC_OFFSET:  1d9

FAILURE_BUCKET_ID:  AV_Ntfs!NtfsGrowLengthInCachedLcn
____

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
Same basic details

___

Ditto

___

Ditto.

 

 

Okay, we have four identical crash dumps. That is a good thing actually, makes it easier to determine root cause. They all point to a bad drive somewhere (NTFS, your file system can't expand or write to a drive)

I'd start by checking your drive(s) for errors, or remove all but the boot drive and see what happens.

 

Really? Wow thats weird. All my drives are registering as being in good health according to crystal disk info.  The boot drive (nvme ssd) is reporting 92% good health and the remaining drives are generic mechanicals with nothing bad being reported. You think it could potentially be a mounted network drive or a corrupted flash drive? I have 2 servers mounted to the desktop and if I'm being honest I probably set something up incorrectly.

[Radium_Angel]

31 minutes ago, aaa tech said:

 

Really? Wow thats weird. All my drives are registering as being in good health according to crystal disk info.  The boot drive (nvme ssd) is reporting 92% good health and the remaining drives are generic mechanicals with nothing bad being reported. You think it could potentially be a mounted network drive or a corrupted flash drive? I have 2 servers mounted to the desktop and if I'm being honest I probably set something up incorrectly.

It's certainly possible, which is why I suggested only having 1 installed right now (the boot drive) as we try to troubleshoot things.

TBH, and others will almost certainly differ with me (which is fine) I am not impressed with Crystal Disk Info's accuracy on drive health. I prefer DiskGenius, though I admit fully the UI is cluttered.

 

It's also possible that having an old install transferred over, is causing issues, though it shouldn't, Microsoft has made great leaps in terms to re-using existing installs on new hardware, but I can't rule that out. You've changed a great deal all at once, and it makes troubleshooting tricky.

[aaa tech]

1 hour ago, Radium_Angel said:

It's certainly possible, which is why I suggested only having 1 installed right now (the boot drive) as we try to troubleshoot things.

TBH, and others will almost certainly differ with me (which is fine) I am not impressed with Crystal Disk Info's accuracy on drive health. I prefer DiskGenius, though I admit fully the UI is cluttered.

 

It's also possible that having an old install transferred over, is causing issues, though it shouldn't, Microsoft has made great leaps in terms to re-using existing installs on new hardware, but I can't rule that out. You've changed a great deal all at once, and it makes troubleshooting tricky.

Gotcha. Will investigate from here. Thank you so much for your assistance!