2

I have a huge memory leak with the tag "NDnd", which eventually occupies my whole ram (8GB).

Findstr shows me, that hiberfil.sys, pagefile.sys, swapfile.sys or ndis.sys could be the problem.

I'm pretty sure it is ndis.sys, since the nonpaged pool gets bigger with any kind of network activity. How do I fix this leak?

I have a Windows 8.1 Pro 64-bit system, if it helps.

2 Answers 2

0

You must use xperf to trace what causes the usage. Install the WPT, open a cmd.exe as admin and run this:

xperf -on PROC_THREAD+LOADER+POOL -stackwalk PoolAlloc+PoolFree+PoolAllocSession+PoolFreeSession -BufferSize 1024 -MinBuffers 256 -MaxBuffers 256 -MaxFile 256 -FileMode Circular && timeout -1 && xperf -d pool.etl

capture 30s of the grow. Open the ETL with WPA.exe, add the Pool graphs to the analysis pane.

Put the pooltag column at first place and add the stack column. Now load the symbols inside WPA.exe and expand the stack of the NDnD tag. Now find other 3rd party drivers which use this tag. Look for driver updates

4
  • same result as before. drivers are up to date.
    – A2Vini
    Nov 20, 2013 at 23:24
  • which driver caused the NDnd tag usage? Nov 21, 2013 at 4:33
  • I reinstalled the drivers for my wireless chip on a hunch and it seems to have fixed the problem... Thanks for you help!
    – A2Vini
    Nov 21, 2013 at 8:39
  • 2
    @A2Vini you still haven't wrote which driver is the cause. Nov 21, 2013 at 17:58
0

possibly relevant:

July 11, 2017—KB4025339 (OS Build 14393.1480)

Addressed issue with memory leaks in the nonpaged pool with the "NDnd" tag, which causes the OS to crash.

https://support.microsoft.com/en-au/help/4025339/windows-10-update-kb4025339

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .