Windows 2016 rebooting randomly bugcheck dump file

0

Windows 2016 server reboots randomly, about once a week. Any ideas? here is the memory dump log

  Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8003470adbb, The address that the exception occurred at
Arg3: ffffbb01cfaea978, Exception Record Address
Arg4: ffffbb01cfaea1c0, Context Record Address

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : AV.Fault
    Value: Read

    Key  : Analysis.CPU.Sec
    Value: 2

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on PIT--INSP2350

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 7

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 5959

    Key  : Analysis.System
    Value: CreateObject


BUGCHECK_CODE:  7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8003470adbb

BUGCHECK_P3: ffffbb01cfaea978

BUGCHECK_P4: ffffbb01cfaea1c0

EXCEPTION_RECORD:  ffffbb01cfaea978 -- (.exr 0xffffbb01cfaea978)
ExceptionAddress: fffff8003470adbb (nt!IofCallDriver+0x000000000000004b)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000001693e8e0e0
Attempt to read from address 0000001693e8e0e0

CONTEXT:  ffffbb01cfaea1c0 -- (.cxr 0xffffbb01cfaea1c0)
rax=000000000000000e rbx=ffffbb01cfaeaec0 rcx=ffffee0f6bc30380
rdx=ffffee0f6a218350 rsi=0000000000000000 rdi=ffffee0f69ec8e30
rip=fffff8003470adbb rsp=ffffbb01cfaeabb8 rbp=ffffbb01cfaeaf09
 r8=0000001693e8e000  r9=000000000000000e r10=0000000000000801
r11=0000000000000001 r12=0000000000000000 r13=0000000000000001
r14=ffffe607df42dba8 r15=ffffbb01cfaeafc0
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!IofCallDriver+0x4b:
fffff800`3470adbb 49ff64c070      jmp     qword ptr [r8+rax*8+70h] ds:002b:00000016`93e8e0e0=????????????????
Resetting default scope

PROCESS_NAME:  System

READ_ADDRESS:  0000001693e8e0e0 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000001693e8e0e0

EXCEPTION_STR:  0xc0000005

STACK_TEXT:  
ffffbb01`cfaeabb8 fffff803`ece220b7 : 00000025`36886000 ffffee0f`6ae91f48 ffffee0f`00001000 fffff803`ec876406 : nt!IofCallDriver+0x4b
ffffbb01`cfaeabc0 fffff803`ece21ce6 : 00000000`e4067200 ffffee0f`6ae50c80 ffffee0f`6a931180 fffff803`ece2edd8 : volsnap!VspQueryDeviceNameFromTarget+0x93
ffffbb01`cfaeae60 fffff803`ece222fb : ffffa989`a2084c00 ffffa214`138f3a53 ffffee0f`6a931180 ffffe607`e3ef7060 : volsnap!VspQueryVolumeName+0x3a
ffffbb01`cfaeaf70 fffff803`ece48dec : ffffe607`df42dd58 00000000`00000000 ffffe607`e4966500 ffffee0f`00000000 : volsnap!VspDiagTrace+0x197
ffffbb01`cfaeb1b0 fffff800`34711979 : ffffbb01`cc3f7000 ffffe607`e384e040 ffffee0f`5de69bd8 ffffbb01`cc3f7180 : volsnap!VspAdjustBitmap+0x14c
ffffbb01`cfaeb4c0 fffff800`346b7005 : ffffe607`e384e040 00000000`00000080 ffffe607`dd6a5700 ffffe607`e384e040 : nt!ExpWorkerThread+0xe9
ffffbb01`cfaeb550 fffff800`347f5c26 : ffffbb01`cca40180 ffffe607`e384e040 fffff800`346b6fc4 01d6e58c`f6fafad4 : nt!PspSystemThreadStartup+0x41
ffffbb01`cfaeb5a0 00000000`00000000 : ffffbb01`cfaec000 ffffbb01`cfae5000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_NAME:  volsnap!VspQueryDeviceNameFromTarget+93

MODULE_NAME: volsnap

IMAGE_NAME:  volsnap.sys

STACK_COMMAND:  .cxr 0xffffbb01cfaea1c0 ; kb

BUCKET_ID_FUNC_OFFSET:  93

FAILURE_BUCKET_ID:  AV_volsnap!VspQueryDeviceNameFromTarget

OS_VERSION:  10.0.14393.2906

BUILDLAB_STR:  rs1_release_inmarket

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {40b2573f-4bcd-bc2a-f3e0-c5323781fec6}

Followup:     MachineOwner
---------

24: kd> .exr 0xffffbb01cfaea978
ExceptionAddress: fffff8003470adbb (nt!IofCallDriver+0x000000000000004b)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000001693e8e0e0
Attempt to read from address 0000001693e8e0e0
windows
memory
dump
bsod
asked on Server Fault Jan 11, 2021 by DGlv1 • edited Jan 11, 2021 by Michael Hampton

1 Answer

0

Experience the very same issue lately, BSOD on Windows Server 2016,

  • SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e),
  • at IofCallDriver,
  • in volsnap

And this four times in about four weeks.

Some say: Change HKLM\SYSTEM\CurrentControlSet\Services\VSS\Diag from Default to Disabled, and reboot afterwards.

Hope helps. Will have this posting updated, if or if not.

answered on Server Fault Jan 15, 2021 by springfeld • edited Jan 15, 2021 by Dave M

User contributions licensed under CC BY-SA 3.0