Sunday, June 23, 2013

Another 9F example!

I run into 0x9F: DRIVER_POWER_STATE_FAILURE a fair bit. I figured I'd share another example just to show how simple they can be, and how nothing really changes in regards to troubleshooting them if the fault isn't obvious.

Not going to share an entire dump, just quick & easy troubleshooting for a quick & easy bugcheck:

BugCheck 9F, {3, 86404030, 83135ae0, 85b49570}
Probably caused by : pci.sys
As you can see, this specific dump was faulting pci.sys. You can pretty much bet your life that this is not the cause, so let's go ahead and see what else we can find. As you know (and if you don't already, please visit my earlier 9F blog post that goes into detail) to get more details on what specifically caused the crash. You're going to want to locate the address of the blocked IRP. In this case, for this specific dump, the address for the blocked IRP was the 3rd parameter which is 85b49570.

Once you have located the blocked IRP address, run an !irp address here. So, for example, for this specific dump we would run:

!irp 85b49570
 Now we get the following:

 0: kd> !irp 85b49570
Irp is active with 4 stacks 3 is current (= 0x85b49628)
No Mdl: No System Buffer: Thread 00000000: Irp stack trace.
cmd flg cl Device File Completion-Context
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
>[ 16, 2] 0 e1 8674c028 00000000 83331d5d-885bc728 Success Error Cancel pending
Unable to load image \SystemRoot\system32\DRIVERS\Rt86win7.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for Rt86win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt86win7.sys
I have bolded what's important here, which is that it Rt86win7.sys was the loaded driver at the time that was the true fault. The > indicates that the specific driver was loaded at the time of the crash.

Rt86win7.sys is a Realtek NIC driver, therefore I instructed the user to visit Realtek's website and update his / her network drivers.

That's about it : )


  1. Hi Thank you for this post, first of all i would like to thank you as your post's are really helpful.

    The thing that i would like to point out to you is i have a similar issue but unfortunately am not able get my head around it as cause the *.sys is not being depicted in KB. Sending over the dmp file analysis.

    A driver has failed to complete a power IRP within a specific time.
    Arg1: 0000000000000004, The power transition timed out waiting to synchronize with the Pnp
    Arg2: 0000000000000258, Timeout in seconds.
    Arg3: 0000000000000000, The thread currently holding on to the Pnp lock.
    Arg4: ffffd001d841b980, nt!TRIAGE_9F_PNP on Win7 and higher

    ffffd001`d841b948 fffff802`c8059eda : 00000000`0000009f 00000000`00000004 00000000`00000258 00000000`00000000 : nt!KeBugCheckEx
    ffffd001`d841b950 fffff802`c82082b2 : ffffe001`00000000 ffffd001`00000000 ffffe001`09ba0300 ffffd001`00000000 : nt!PnpBugcheckPowerTimeout+0x6a
    ffffd001`d841b9b0 fffff802`c7ef5b68 : 00000000`00000002 00000000`0026a65d 00000000`00000000 00000000`00000000 : nt!PopBuildDeviceNotifyListWatchdog+0x16
    ffffd001`d841b9e0 fffff802`c7fd58ea : ffffd001`d83ef180 ffffd001`d83ef180 ffffd001`d83fb4c0 ffffe001`08f0e080 : nt!KiRetireDpcList+0x4f8
    ffffd001`d841bc60 00000000`00000000 : ffffd001`d841c000 ffffd001`d8416000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a

    kd> dt ffffd001d841b980
    Symbol not found at address ffffd001d841b980.
    1: kd> !irp ffffd001d841b980
    IRP signature does not match, probably not an IRP. Use any flag to force.

    kd> !poaction
    Error reading PopAction

    Allocated power irps (PopIrpList - fffff802c813d450)
    Error resolving nt!_LIST_ENTRY...

    Irp worker threads (PopIrpThreadList - fffff802c813c700)
    Error resolving nt!_LIST_ENTRY...

    Error resolving nt!_POP_CURRENT_BROADCAST...

    1: kd> !wdfkd
    No export wdfkd found
    1: kd> !stacks
    Proc.Thread .Thread Ticks ThreadState Blocker
    Unable to get value of PsActiveProcessHead.Flink

    Threads Processed: 0
    1: kd> dt nt!TRIAGE_9F_PNP on Win7 and higher
    dtx is unsupported for this scenario. It only recognizes dtx [] [] with -a, -h, and -r. Reverting to dt.
    Symbol nt!TRIAGE_9F_PNP not found.
    1: kd> dt nt!TRIAGE_9F_PNP ffffd001d841b980
    Symbol nt!TRIAGE_9F_PNP not found.

    Could you possibly help please !!