My work computer recently hanged when shutting down to sleep mode.
When booting the computer the next day I realized that it had eventually crashed.
This happened again after disabling hyper-threading, so I decided to investigate.
Checked Event Viewer and found:
Log Name: System Source: Microsoft-Windows-WER-SystemErrorReporting Event ID: 1001 Task Category: None Level: Error Keywords: Classic Description: The computer has rebooted from a bugcheck. The bugcheck was: 0x0000009f (0x0000000000000003, 0xfffffa800cd5e060, 0xfffff80000b9a3d8, 0xfffffa802e232590). A dump was saved in: C:\Windows\MEMORY.DMP.
Searched online for BSOD 0x0000009f and found:
Examined the memory dump with WinDbg (x64).
Checked for details about the crash with:
!analyze -v
Part of the result:
DRIVER_POWER_STATE_FAILURE (9f) A driver has failed to complete a power IRP within a specific time. Arguments: Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time Arg2: fffffa800cd5e060, Physical Device Object of the stack Arg3: fffff80000b9a3d8, nt!TRIAGE_9F_POWER on Win7 and higher, otherwise the Functional Device Object of the stack Arg4: fffffa802e232590, The blocked IRP FAILURE_BUCKET_ID: X64_0x9F_3_POWER_DOWN_Rt64win7_IMAGE_pci.sys BUCKET_ID: X64_0x9F_3_POWER_DOWN_Rt64win7_IMAGE_pci.sys FAILURE_ID_HASH_STRING: km:x64_0x9f_3_power_down_rt64win7_image_pci.sys
Checked for information about the I/O request packet with:
!irp fffffa802e232590
Result:
Irp is active with 5 stacks 4 is current (= 0xfffffa802e232738) No Mdl: No System Buffer: Thread 00000000: Irp stack trace. cmd flg cl Device File Completion-Context [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 >[ 16, 2] 0 e1 fffffa800da84050 00000000 fffff800032ca230-fffffa800eb3bb50 Success Error Cancel pending *** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys \Driver\RTL8167 nt!PopSystemIrpCompletion Args: 00015400 00000000 00000005 00000003 [ 0, 0] 0 0 00000000 00000000 00000000-fffffa800eb3bb50 Args: 00000000 00000000 00000000 00000000
Examined available information about Rt64win7 with:
lmvm Rt64win7
Result:
start end module name fffff880`05c3a000 fffff880`05d39000 Rt64win7 (no symbols) Loaded symbol image file: Rt64win7.sys Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys Image name: Rt64win7.sys Timestamp: Fri Oct 07 11:27:12 2016 (57F76A70) CheckSum: 0010CDA5 ImageSize: 000FF000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Found the driver file in Windows explorer under:
C:\Windows\system32\DRIVERS\Rt64win7.sys
Then checked Properties. The details view confirmed that the driver was for the Realtek network interface card, version: 7.103.1007.2016.
Decided to look for a newer driver from Realtek.
Found, downloaded and installed the current latest version 7.109.
Unfortunately this was not the solution, the problems continued.
However, later on I discovered that adjusting power options seemed effective.