BSOD - DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) - WDF01000.SYS

[Benjamin Smith]

My Lenovo T520 laptop has been locking up and restarting on its own every 30 minutes or so for several days now. When I get a BSOD it indicates DRIVER_IRQL_NOT_LESS_OR_EQUAL with a D1 and shows that WDF01000.SYS was the module name.

One thing I have observed: Once this error has occurred BSOD quits creating dump files. I have to run CHKDSK /F/R in order to get a dump the next time the error happens.

I am out of my league at this point but this is my work PC and I need to make it reliable again. Thanks for any help anyone might provide.

I have also attached the dump file.

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {ffffffffffffffa4, 2, 1, fffff88000eb3227}
Probably caused by : Wdf01000.sys ( Wdf01000!FxRequest:eekRequest+ab )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffffffffffffa4, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff88000eb3227, address which referenced memory
Debugging Details:
------------------

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80005eb6100
ffffffffffffffa4
CURRENT_IRQL: 2
FAULTING_IP:
Wdf01000!FxRequest:eekRequest+ab
fffff880`00eb3227 f044014b0c lock add dword ptr [rbx+0Ch],r9d
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: dwm.exe
TRAP_FRAME: fffff80000ba0710 -- (.trap 0xfffff80000ba0710)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80000ba0928 rbx=0000000000000000 rcx=fffffa800a9fe928
rdx=fffffa800f911eb8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000eb3227 rsp=fffff80000ba08a0 rbp=fffff80000ba0902
r8=0000000000000000 r9=0000000000000001 r10=0000000000000001
r11=fffffa800f9e5a78 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
Wdf01000!FxRequest:eekRequest+0xab:
fffff880`00eb3227 f044014b0c lock add dword ptr [rbx+0Ch],r9d ds:b880:00000000`0000000c=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80005c78fe9 to fffff80005c79a40
STACK_TEXT:
fffff800`00ba05c8 fffff800`05c78fe9 : 00000000`0000000a ffffffff`ffffffa4 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`00ba05d0 fffff800`05c77c60 : 00000000`00000000 00000000`0000000f 00000000`00000000 ffffffff`ffffff98 : nt!KiBugCheckDispatch+0x69
fffff800`00ba0710 fffff880`00eb3227 : fffffa80`0f5c3d10 00000000`00000000 00000000`00000000 fffff880`00e4512b : nt!KiPageFault+0x260
fffff800`00ba08a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Wdf01000!FxRequest:eekRequest+0xab

STACK_COMMAND: kb
FOLLOWUP_IP:
Wdf01000!FxRequest:eekRequest+ab
fffff880`00eb3227 f044014b0c lock add dword ptr [rbx+0Ch],r9d
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: Wdf01000!FxRequest:eekRequest+ab
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Wdf01000
IMAGE_NAME: Wdf01000.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 51c51641
FAILURE_BUCKET_ID: X64_0xD1_Wdf01000!FxRequest:eekRequest+ab
BUCKET_ID: X64_0xD1_Wdf01000!FxRequest:eekRequest+ab
Followup: MachineOwner
---------

 

[jefboyardee]

I used to get those, can't remember how I got them or how I got rid of them, but I'm sure the answer is hiding here somewhere.

 

[Benjamin Smith]

Thank you for your response. As a matter of fact, I was an early adopter of Google. However, nothing I have found there has helped me much in this case. Google is a generalist and lacks the skill and knowledge to read the nuances of a Windows mini-dump. I am hoping that someone with that specific skill might help me out.

 

[Computer tech]

Hello Benjamin,
Did you use any external hard drive?
Or any WD hard disk drive?

 

[Shintaro]

Hi,

Wdf01000.sys is a Microsoft Kernel Mode driver. Unlikely that it would be that.

Looking at the stack it appears that a Intel driver was to blame.

00 fffff800`00ba05c8 fffff800`05c78fe9 nt!KeBugCheckEx
01 fffff800`00ba05d0 fffff800`05c77c60 nt!KiBugCheckDispatch+0x69
02 fffff800`00ba0710 fffff880`00eb3227 nt!KiPageFault+0x260
03 fffff800`00ba08a0 fffff880`00ebb1d2 Wdf01000!FxRequest::PeekRequest+0xab
04 fffff800`00ba08e0 fffff880`00ea8e43 Wdf01000!FxIoQueue::PeekRequest+0x122
05 fffff800`00ba0960 fffff880`05c0e817 Wdf01000!imp_WdfIoQueueFindRequest+0x2c3
06 fffff800`00ba0a00 00000000`00000000 TeeDriverx64+0xe817

Have a look HERE on the Intel site. They have an automated scan for driver updates.

Hope this helps.