0

I have a Windows 8.1 desktop machine that is mostly very stable, but recently I started playing Skyrim again and I'm getting blue screens. Sometimes they happen as quickly as 5 minutes in, other times after an hour or so playing. I have previously played Skyrim on this machine with a different O/S, and it's only playing Skyrim that causes BSODs (other games might, but I don't own any others), so I suspect it's the combination of Win8.1 and my hardware.

I've used BlueScreenView to look at the dumps. They all look like this:

enter image description here

Here is the output of !analyze -v in windbg:

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.  This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned.  This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 064d0606000c271a, Actual security check cookie from the stack
Arg2: 0000446666e92e93, Expected security check cookie
Arg3: ffffbb999916d16c, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------


DEFAULT_BUCKET_ID:  GS_FALSE_POSITIVE_MISSING_GSFRAME

SECURITY_COOKIE:  Expected 0000446666e92e93 found 064d0606000c271a

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0xF7

PROCESS_NAME:  TESV.exe

CURRENT_IRQL:  0

LOCK_ADDRESS:  fffff80399745360 -- (!locks fffff80399745360)

Resource @ nt!PiEngineLock (0xfffff80399745360)    Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE: 
    Lock address  : 0xfffff80399745360
    Thread Count  : 0
    Thread address: 0x0000000000000000
    Thread wait   : 0x0

LAST_CONTROL_TRANSFER:  from fffff8039962d441 to fffff803995c3ca0

STACK_TEXT:  
ffffd000`2961ffb8 fffff803`9962d441 : 00000000`000000f7 064d0606`000c271a 00004466`66e92e93 ffffbb99`9916d16c : nt!KeBugCheckEx
ffffd000`2961ffc0 fffff803`9981991f : ffffc000`00000001 ffffd000`296203c0 ffffd000`296206e0 00000000`000f003f : nt!_report_gsfailure+0x25
ffffd000`29620000 fffff803`99816cae : ffffffff`ffffffff 62633134`37386365 ffffffff`ffffffff ffffffff`ffffffff : nt!CmOpenKey+0x34f
ffffd000`296201b0 fffff803`995cf4b3 : 00001225`00000000 00000000`00000001 fffff803`9945ae00 fffff803`995c5aa8 : nt!NtOpenKey+0x12
ffffd000`296201f0 fffff803`995c7900 : fffff803`99842507 ffffd000`29620430 ffffd000`29620760 ffffc000`0eabda8a : nt!KiSystemServiceCopyEnd+0x13
ffffd000`29620388 fffff803`99842507 : ffffd000`29620430 ffffd000`29620760 ffffc000`0eabda8a 00000000`000000ab : nt!KiServiceLinkage
ffffd000`29620390 fffff803`99842452 : 00000000`00000000 ffffffff`80000044 ffffc000`0008ed60 ffffd000`29620760 : nt!RegRtlOpenKeyTransacted+0xa7
ffffd000`29620420 fffff803`9984ab23 : ffffffff`80000044 00000000`00000000 ffffc000`0008ed60 00000000`00000000 : nt!SysCtxRegOpenKey+0x3a
ffffd000`29620460 fffff803`9984a9ad : 00000000`00000040 ffffd000`29620591 00000000`00000004 00000000`00000000 : nt!CmOpenCommonClassRegKeyWorker+0x123
ffffd000`296204d0 fffff803`9984d002 : 00000000`00000000 fffff803`997454e0 ffffe000`00000042 00000000`00000060 : nt!CmOpenCommonClassRegKey+0xf5
ffffd000`296205e0 fffff803`9984e14f : 00000000`00000002 00000000`00000000 ffffd000`29620730 00000000`00000000 : nt!CmOpenInterfaceClassRegKey+0x3a
ffffd000`29620630 fffff803`9984fad5 : 00000000`00000001 ffffd000`29620a48 00000000`00000000 ffffd000`29620878 : nt!IopGetDeviceInterfaces+0xe7
ffffd000`29620800 fffff803`99843b47 : e00002ad`d720d08b 00000000`00000000 ffffe000`00e1c990 00000000`00000003 : nt!PiCMGetDeviceInterfaceList+0xed
ffffd000`29620900 fffff803`99843ae9 : 00000000`00000000 ffffe000`02add750 ffffd000`29620c00 fffff803`00000000 : nt!PiCMFastIoDeviceDispatch+0x53
ffffd000`29620950 fffff803`99820f97 : ffffe000`02add750 00000000`00000000 00000000`00000910 00000000`000008a0 : nt!PiDaFastIoDispatch+0x65
ffffd000`296209b0 fffff803`99821d7a : ffffd000`00000000 ffffe000`00e1c9c0 00000000`00000001 00000000`00000000 : nt!IopXxxControlFile+0x3f7
ffffd000`29620b60 fffff803`995cf4b3 : ffffd000`29620c50 00000000`00000000 00000000`001f0000 00000000`00000001 : nt!NtDeviceIoControlFile+0x56
ffffd000`29620bd0 00000000`77d52772 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`3308f128 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77d52772


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!_report_gsfailure+25
fffff803`9962d441 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!_report_gsfailure+25

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  52718d9c

BUCKET_ID_FUNC_OFFSET:  25

FAILURE_BUCKET_ID:  0xF7_MISSING_GSFRAME_nt!_report_gsfailure

BUCKET_ID:  0xF7_MISSING_GSFRAME_nt!_report_gsfailure

Followup: MachineOwner
---------

I have uploaded a HWInfo report here.

I have upgraded my BIOS to the latest version. This seemed to reduce the frequency of the BSODs, but I still get them eventually. My video drivers are also up to date. I also ran a virus check (using Defender, aka Security Essentials) and it found one possible threat and cleaned it.

Can anyone offer me any advice to resolve this?

  • we need the dmp files to see more details. Upload them, please. – magicandre1981 Apr 1 '14 at 18:13
  • what is this TESV.exe? – magicandre1981 Apr 2 '14 at 4:22
  • @magicandre: that's Skyrim's executable. – me-- Apr 2 '14 at 7:02
1

This is, most likely, caused by a bug in a driver. It triggers a buffer overflow, which is a security issue as it tries to use more allocated memory than it should. This can lead to some serious instability and, thus, the system shutdowns itself to prevent that.

Since it's only occurring while playing, I'd suggest upgrading you graphic drivers and see if the issue is still present.

If not, then you'll have to open your dumpfile as it'll tell you which driver is causing this issue, as ntoskrnl.exe (mentioned in your screenshot) is unlikely to be the cause.
Look for lines that contain BUCKET_ID: 0xF7_MISSING_GSFRAME to begin with.

Also, if you never had this issue before on this specific system (read: no drivers upgrades), I'd suggest checking your system for potential threats (malwares, virii...) as a safety precaution.

  • Thanks. I have already updated BIOS and video drivers and am still getting BSODs. Please see the crash dump analysis I just added to my question. – me-- Apr 2 '14 at 0:27
  • You said you played that game before, was it on the same system? And what changed between? Also, let's rule one more thing: some AMD CPUs were known to have issues with RAM set to run at speed higher than 1333Mhz, can you try slowing down yours? – shroom Apr 2 '14 at 23:11
  • Exactly the same system apart from Win8.1 instead of Win7. Also, I may have some differences in my Skyrim mods. I think I'll try disabling all mods and see if I still get BSODs. – me-- Apr 3 '14 at 0:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.