bcmwl63a.sys Blue Screen crash
After Windows 10 Updates, my notebook often crashed when opening its lid. When waking up from computer sleep, it frequently crashed with a blue screen. The crash did not occur if I'd disconnected network before going into sleep. Interestingly the issue did not occur at home. The problem only occurred when using the notebook at public places such as Starbucks.
During blue screen, the dump content is stored in paging file and the computer is restarted. Once restarted, a dump in paging file is copied over to a mini dump file in "C:\Windows\minidump" folder.
To check the dump file, I copied the dump file (.dmp) to C:\Temp folder since opening the dump file from "C:\Windows\minidump" folder will throw "access denied" error. And then I opened the dump file with "WinDbg (x64)" and ran "!analyze -v" command.
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8014ba6fed9, The address that the exception occurred at
Arg3: ffffce82deaff038, Exception Record Address
Arg4: ffffce82deafe880, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for bcmwl63a.sys
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullPtr
Key : AV.Fault
Value: Read
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: Apple Inc.
SYSTEM_PRODUCT_NAME: MacBookAir7,2
SYSTEM_SKU: System SKU#
SYSTEM_VERSION: 1.0
BIOS_VENDOR: Apple Inc.
BIOS_VERSION: 186.0.0.0.0
BIOS_DATE: 04/11/2019
BASEBOARD_MANUFACTURER: Apple Inc.
BASEBOARD_PRODUCT: Mac-937CB26E2E02BB01
BASEBOARD_VERSION: MacBookAir7,2
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8014ba6fed9
BUGCHECK_P3: ffffce82deaff038
BUGCHECK_P4: ffffce82deafe880
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
FAULTING_IP:
bcmwl63a+3fed9
fffff801`4ba6fed9 488b09 mov rcx,qword ptr [rcx]
EXCEPTION_RECORD: ffffce82deaff038 -- (.exr 0xffffce82deaff038)
ExceptionAddress: fffff8014ba6fed9 (bcmwl63a+0x000000000003fed9)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000
CONTEXT: ffffce82deafe880 -- (.cxr 0xffffce82deafe880)
rax=ffff93a4fe660ce0 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000004 rsi=0000000000000004 rdi=ffff8489c30d9000
rip=fffff8014ba6fed9 rsp=ffffce82deaff270 rbp=ffffce82deaff309
r8=ffffffffffffffff r9=8101010101010100 r10=8101010100fefcfe
r11=ffff8489d12449fe r12=fffff8014bda8e60 r13=ffff8489c30d9000
r14=0000000000000000 r15=ffff8489c318dd30
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00050282
bcmwl63a+0x3fed9:
fffff801`4ba6fed9 488b09 mov rcx,qword ptr [rcx] ds:002b:00000000`00000000=????????????????
Resetting default scope
CPU_COUNT: 4
CPU_MHZ: 640
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 3d
CPU_STEPPING: 4
CPU_MICROCODE: 6,3d,4,0 (F,M,S,R) SIG: 2B'00000000 (cache) 2B'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: NULL_DEREFERENCE
PROCESS_NAME: System
CURRENT_IRQL: 0
FOLLOWUP_IP:
bcmwl63a+3fed9
fffff801`4ba6fed9 488b09 mov rcx,qword ptr [rcx]
BUGCHECK_STR: AV
READ_ADDRESS: fffff8013e1733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
0000000000000000
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
ANALYSIS_SESSION_HOST: DESKTOP-K99TLAS
ANALYSIS_SESSION_TIME: 01-01-2020 22:42:28.0707
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff80100000000 to fffff8014ba6fed9
STACK_TEXT:
ffffce82`deaff270 fffff801`00000000 : 00000000`00000001 00000000`00000000 ffffce82`00000000 00000000`00000000 : bcmwl63a+0x3fed9
ffffce82`deaff278 00000000`00000001 : 00000000`00000000 ffffce82`00000000 00000000`00000000 fffff801`00000000 : 0xfffff801`00000000
ffffce82`deaff280 00000000`00000000 : ffffce82`00000000 00000000`00000000 fffff801`00000000 ffff93a4`fe660c01 : 0x1
THREAD_SHA1_HASH_MOD_FUNC: 771f6d087a9c6ce64ae42b0a5e4b863cbdc86972
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: a1102c939fa8292dade1cd4ea21501d78f576ea4
THREAD_SHA1_HASH_MOD: 771f6d087a9c6ce64ae42b0a5e4b863cbdc86972
FAULT_INSTR_CODE: 44098b48
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: bcmwl63a+3fed9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: bcmwl63a
IMAGE_NAME: bcmwl63a.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5d9fd1ea
STACK_COMMAND: .cxr 0xffffce82deafe880 ; kb
BUCKET_ID_FUNC_OFFSET: 3fed9
FAILURE_BUCKET_ID: AV_bcmwl63a!unknown_function
BUCKET_ID: AV_bcmwl63a!unknown_function
PRIMARY_PROBLEM_CLASS: AV_bcmwl63a!unknown_function
TARGET_TIME: 2020-01-01T22:19:01.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 07:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 902c
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_bcmwl63a!unknown_function
FAILURE_ID_HASH: {923870c9-9263-9e30-c5a3-4f73aa64fade}
Followup: MachineOwner
---------
0: kd> k
# Child-SP RetAddr Call Site
00 ffffce82`deafe018 fffff801`3dddade4 nt!KeBugCheckEx
01 ffffce82`deafe020 fffff801`3dd9c55c nt!PspSystemThreadStartup$filt$0+0x44
02 ffffce82`deafe060 fffff801`3ddca312 nt!_C_specific_handler+0xac
03 ffffce82`deafe0d0 fffff801`3dcc2fa5 nt!RtlpExecuteHandlerForException+0x12
04 ffffce82`deafe100 fffff801`3dcc753e nt!RtlDispatchException+0x4a5
05 ffffce82`deafe850 fffff801`3ddd341d nt!KiDispatchException+0x16e
06 ffffce82`deafef00 fffff801`3ddcf605 nt!KiExceptionDispatch+0x11d
07 ffffce82`deaff0e0 fffff801`4ba6fed9 nt!KiPageFault+0x445
08 ffffce82`deaff270 fffff801`00000000 bcmwl63a+0x3fed9
09 ffffce82`deaff278 00000000`00000001 0xfffff801`00000000
0a ffffce82`deaff280 00000000`00000000 0x1
So basically it is Access Violation from bcmwl63a.sys (Broadcom 802.11ac Network Adapter). One of major causes of blue screen is because of 3rd party drivers.
I went to Control Panel => Device Manager => Network adapters => Broadcom 802.11ac Network Adapter
=> Properties => Driver.
The driver date (of bcmwl63a.sys) was 10/14/2019. I clicked "Roll Back Driver" button and rolled back to 4/20/2018 driver.
After rolled back, the issue was fixed.