kbdclass.sys causing crashing

MisterCrow

MisterCrow

Active member
Hi,

Have started getting a crash that seems to be getting more frequent. Basically I'll be playing a game ("Hunt: Showdown") and the screen will go black and nothing is responsive. From what I can make out, it seems to always be related to the kbdclass.sys file, bug check code 0x000000d1 (address in stack kbdclass.sys+2f92). Although I don't see a BSOD screen, I can see that using "BlueScreenView" the bug check string is DRIVER_NOT_LESS_OR_EQUAL. Event ID is 1001 in event viewer "The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0xffffc5104d0e261c, 0x0000000000000002, 0x0000000000000000, 0xfffff804907e2f92). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: e3ae45c7-cf80-4faa-9ae7-d68bf5c2d4a8."

I think the problem is a driver, but I can't figure out which one. Annoying because I have all the PCS drivers installed and later ones too where applicable.

Crash only ever seems to happen when I'm in a game (Hunt: Showdown).

I have no external keyboard connected to my system, I have all drivers up-to-date (even the latest version of Clevo Control Centre. I have a Logitech G203 mouse connected but have uninstalled the Logitech software (as I read somewhere this can cause problems). No other peripherals attached.

I have uploaded the memory.dmp file - here.

I've done a sfc /scannow and it's not returned any problems.

My system specs are:

Chassis & Display
Nova Series: 15.6" Matte Full HD 144Hz 72% NTSC LED Widescreen (1920x1080)
Processor (CPU)
AMD Ryzen 5 3600 Six Core CPU (3.6GHz-4.2GHz/36MB CACHE/AM4)
Memory (RAM)
16GB Corsair 2666MHz SODIMM DDR4 (2 x 8GB)
Graphics Card
NVIDIA® GeForce® RTX 2060 - 6.0GB GDDR6 Video RAM - DirectX® 12.1
1st M.2 SSD Drive
1TB PCS PCIe M.2 SSD (2000 MB/R, 1100 MB/W)
Memory Card Reader
Integrated Micro-SD Memory Card Reader
AC Adaptor
1 x 230W AC Adaptor
Power Cable
1 x 1 Metre UK Power Cable (Kettle Lead)
Battery
Nova Series Detachable 4 Cell Lithium Ion Battery
Thermal Paste
STANDARD THERMAL PASTE FOR SUFFICIENT COOLING
Sound Card
2 Channel High Def. Audio + SoundBlaster™ Cinema
Wireless Network Card
GIGABIT LAN & WIRELESS INTEL® Wi-Fi 6 AX200 (2.4 Gbps) + BT 5.0
USB/Thunderbolt Options
1 x USB 3.2 PORT (Type C) + 2 x USB 3.2 PORTS + 1 x USB 2.0 PORT
Keyboard Language
15" NOVA SERIES UK KEYBOARD
Operating System
NO OPERATING SYSTEM REQUIRED
Operating System Language
United Kingdom - English Language
Windows Recovery Media
NO RECOVERY MEDIA REQUIRED
Office Software
FREE 30 Day Trial of Microsoft 365® (Operating System Required)
Anti-Virus
NO ANTI-VIRUS SOFTWARE
Browser
Google Chrome™
Keyboard & Mouse
INTEGRATED 2 BUTTON TOUCHPAD MOUSE
Webcam
INTEGRATED 1MP HD WEBCAM
Warranty
3 Year Silver Warranty (1 Year Collect & Return, 1 Year Parts, 3 Year Labour)
Delivery
STANDARD INSURED DELIVERY TO UK MAINLAND (MON-FRI)
Build Time
Standard Build - Approximately 12 to 14 working days
Welcome Book
PCSpecialist Welcome Book - United Kingdom & Republic of Ireland

If anyone could analyse the minidump files (saved here - https://www.dropbox.com/s/z4rj1wrb8eamry4/minidump.zip?dl=1), I'd be much appreciated, as the crash has been happening on and off since I bought the laptop only around 5 months ago. I can upload the full memory.dmp file if needed, but it's pretty massive, so will take a while.

Thanks
 
SpyderTracks

SpyderTracks

We love you Ukraine
The PCS drivers will be very outdated.

When installing windows you need to allow windows update to install all drivers where possible, then just manually install nvidia graphics and clevo control center.

In this instance, as a quick hopeful fix, try installing the AMD driver manager, and seeing if it's the chipset driver or any others that need updating:

AMD Drivers and Support for Radeon, Radeon Pro, FirePro, APU, CPU, Ryzen, desktops, laptops

Also make sure GPU drivers are up to date through GeForce Experience, and do a custom install and DON'T install the HDAudio component.
 
MisterCrow

MisterCrow

Active member
Thanks :)

I've downloaded and run the file as suggested. I think it's installed some stuff, so hopefully that was the problem. I've now uninstalled the Nvidia HD Audio components too.

I'll post back if the crash happens again.
 
SpyderTracks

SpyderTracks

We love you Ukraine
AntBow said:
Thanks :)

I've downloaded and run the file as suggested. I think it's installed some stuff, so hopefully that was the problem. I've now uninstalled the Nvidia HD Audio components too.

I'll post back if the crash happens again.
Click to expand...
Fingers crossed, keep us posted.

If that doesn’t work, our guy @ubuysa is a wizard with analysing dump files, he’ll be on early tomorrow morning.
 
ubuysa

ubuysa

The BSOD Doctor
Not installing the AMD Ryzen chipset drivers is almost certainly going to be the problem. Nevertheless I've looked at your three minidumps - because I can't help myself! :)

All three minidumps are identical, they are DRIVER_IRQL_NOT_LESS_OR_EQUAL stop codes pointing to the kbdclass.sys driver (as you noted). The thread stack traces are also identical, they show a page fault during the kbdclass!memcpy+0x92 function (92 bytes into the start of the function) and that's why there's a BSOD (drivers run in kernel mode and can't take page faults). The memory the function is accessing is allocated from the NonPagedPool, which is as it should be, but the memory it's trying to reference is invalid (not allocated at all) - and that's why there's a page fault. This is most likely the result of the missing chipset drivers, it's unlikely to be the keyboard driver kbdclas.sys itself because that's a Microsoft driver, but it could also be the thread that called the driver failing to properly specify the buffer parameters. The thread in control was part of the HuntGame.exe process, so the game might possibly be suspect - assuming the AMD chipset drivers haven't fixed it of course (which I would think they have)? :)
 
ubuysa

ubuysa

The BSOD Doctor
AntBow said:
Thanks Ubuysa. I agree - I think I must not have installed the chipset drivers properly. I've installed them now, so I'll see how I get on and report back if the problem persists :)
Click to expand...
Please do. :)

One thing to check if this does happen again is to open RegEdit, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318} and check that the UpperFilters key has kbdclass as the first entry (or only entry of course).

Also make sure that you're setup to take kernel dumps: enter sysdm.cpl into the Run command box, click the Advanced tab, then click the bottom of the three Settings buttons (in the Start-up and Recovery section). Ensure that the 'Write Debugging Information pulldown menu is set to 'Automatic Memory Dump' - this is a better option than selecting Kernel Dump because it gives Windows more leeway in managing the size of the paging file (kernel dumps are written in the first instance to the paging file).

Ensure that the 'Overwrite any existing file' checkbox IS checked (otherwise no additional dump will be written if C:\Windows\Memory.dmp exists). If it does BSOD copy C:\Windows\Memory.dmp to somewhere else (anywhere will do) to preserve it if there is another BSOD.

I would uncheck the 'Automatically Restart' checkbox so that a BSOD causes an actual halt giving you time to note the stop code etc. Personally I hate it when the system auto restarts whilst I'm trying to read the BSOD screen...

Then click the topmost of the three Settings buttons ('Performance' on the Advanced tab), then click the Advanced tab in there and then click the Change button. Ensure that the 'Automatically manage paging file size for all drives is checked'. This will allow Windows to set a system managed paging file on the system drive. If you absolutely must set a paging file size manually, note that it MUST be on the system drive if you want to be able to capture kernel dumps and it MUST be big enough to hold the dump (kernel dumps are generally a shade under 2GB in size). TBH there is zero advantage these days in setting a manual paging file size.
 
MisterCrow

MisterCrow

Active member
Unfortunately the crash has just happened again. A quick look using bluescreenview shows the same culprid again (kbdclass.sys). I've noticed the crashing doesn't even show a BSOD, the screen just goes black.

The Upperfilters key reads HKKbdFltr kbdclass, and I've done the other bits that you've said Ubuysa.

So it seems the chipset drivers being installed has unfortunately not solved the problem :(

Running out of things to try, and the crash is pretty infrequent, making testing very challenging. Could it be a hardware issue?
 
ubuysa

ubuysa

The BSOD Doctor
AntBow said:
In case it's useful, I've uploaded the latest minidump Here.
Click to expand...
I'm pretty sure this is a Hotkey (Control Center) problem. The stop code is the classic IRQL_NOT_LESS_OR_EQUAL and that one is always a driver error (I can explain why if you want to know).

The initial automatic dump analysis identified kbdclass.sys as the failing module, but I think it's wrong (as it often is). In the stack trace of the active thread (of HuntGame.exe) we see HKKbdFltr.sys called immediately prior to kbdclass.sys - which is what we'd expect, the HKKbdFltr.sys filter driver precedes the standard keyboard driver kbdclass.sys to modify the actions of the keyboard driver is specific ways - and immediately following the kbdclass.sys call is a page fault, that's why you got the BSOD. In this case the memory referenced by kbdclass.sys was not allocated (as it absolutely should have been).

I am quite certain that the problem here is not kbdclass.sys but the filter driver HKKbdFltr.sys that precedes it. The most probable scenario is that HKKbdFltr.sys passed some pointer to a data buffer to kbdclass.sys which was either invalid or where the buffer had not been properly allocated.

You could try seeing whether there is an updated version of Control Center or even try uninstalling the exiting Control Center and reinstalling it to be sure it's installed properly.

Alternatively, I don't know what modifications Hotkey might be making to the keyboard driver but I would guess it's to implement specific hotkeys for certain shortcuts etc.?? If you can do without those shortcuts you might try removing the HKKbdFltr.sys filter, to do that open the Registry Editor and navigate to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318}. Right-click on that key in the left-hand pane and select Export to save a copy of the key before we mess with it.

In the right-hand pane the UpperFilter key should contain the value HKKbdFltr kbdclass - if it contains something else then post a screenshot and do nothing. If it does contain HKKbdFltr kbdclass then modify the key and delete HKKbdFltr so that the only value there is kbdclass. Reboot and then see what differences you have in keyboard operation, you may be missing some hotkey shortcuts that you had before and if you need them then you'll have to restore HKKbdFlrt to that registry key again.
 
Last edited:
MisterCrow

MisterCrow

Active member
ubuysa said:
I'm pretty sure this is a Hotkey (Control Center) problem. The stop code is the classic IRQL_NOT_LESS_OR_EQUAL and that one is always a driver error (I can explain why if you want to know).

The initial automatic dump analysis identified kbdclass.sys as the failing module, but I think it's wrong (as it often is). In the stack trace of the active thread (of HuntGame.exe) we see HKKbdFltr.sys called immediately prior to kbdclass.sys - which is what we'd expect, the HKKbdFltr.sys filter driver precedes the standard keyboard driver kbdclass.sys to modify the actions of the keyboard driver is specific ways - and immediately following the kbdclass.sys call is a page fault, that's why you got the BSOD. In this case the memory referenced by kbdclass.sys was not allocated (as it absolutely should have been).

I am quite certain that the problem here is not kbdclass.sys but the filter driver HKKbdFltr.sys that precedes it. The most probable scenario is that HKKbdFltr.sys passed some pointer to a data buffer to kbdclass.sys which was either invalid or where the buffer had not been properly allocated.

I don't know what modifications Hotkey might be making to the keyboard driver but I would guess it's to implement specific hotkeys for certain shortcuts etc.?? If you can do without those shortcuts you might try removing the HKKbdFltr.sys filter, to do that open the Registry Editor and navigate to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96b-e325-11ce-bfc1-08002be10318}. Right-click on that key in the left-hand pane and select Export to save a copy of the key before we mess with it.

In the right-hand pane the UpperFilter key should contain the value HKKbdFltr kbdclass - if it contains something else then post a screenshot and do nothing. If it does contain HKKbdFltr kbdclass then modify the key and delete HKKbdFltr so that the only value there is kbdclass. Reboot and then see what differences you have in keyboard operation, you may be missing some hotkey shortcuts that you had before and if you need them then you'll have to restore HKKbdFlrt to that registry key again.
Click to expand...
Thanks Ubuysa. My initial thought months ago when this started happening, was that it was something to do with Clevo Control Center.

Indeed HKKbdFltr and kbdclass were both under that registry key as you described, so I've removed the HKKbdFltr entry and restarted the machine. The FN + F(X) keys still work as desired, so I appear not to have lost any functionality (at least none that I can notice anyway).

FYI I'm running Clevo Control Center v3.00, which I believe is the latest version available from the Clevo website. In the past I did try various other versions, but the crash was still occurring.

Once again, I'll see how I get on and post back if the crash happens again. Unfortunately it's pretty infrequent, so may be a while!

Thanks for your help with this, really appreciate it :)
 
D

dmigowski

New member
I created this account just to say "Thank you great guy Ubuysa!"! Removing the keyboard filter helped me so much, too, and I got that BSOD for three weeks now multiple times a day.

I should note I have a competitor model (Schenker XMG Apex 15), which is also based on the Clevo barebone and comes with a similar configuration, so search engines can find this :).
 
Last edited:
MisterCrow

MisterCrow

Active member
dmigowski said:
I created this account just to say "Thank you great guy Ubuysa!"! Removing the keyboard filter helped me so much, too, and I got that BSOD for three weeks now multiple times a day.

I should note I have a competitor model, which is also based on the Clevo barebone and comes with a similar configuration, so search engines can find this :).
Click to expand...

That's great! So far, so good for me too, but need a while longer testing yet!

I second that too - Ubuysa you're a real star, thanks so much for your help :)
 
F

facuxz

New member
ubuysa said:
Even a stopped clock is right twice a day.... ;)
Click to expand...
UBUYSA how are you? i hope fine.
I'm searching for a master of windows like you xD.
Actually i have this problem with this game(HUNT:SHOWDOWN), BSOD... but there is no minidump file. Event viewer just say that could not create any dump file. It pop's the BOSD and instantly restart's my PC.

I don't know what to do
 
F

facuxz

New member
facuxz said:
UBUYSA how are you? i hope fine.
I'm searching for a master of windows like you xD.
Actually i have this problem with this game(HUNT:SHOWDOWN), BSOD... but there is no minidump file. Event viewer just say that could not create any dump file. It pop's the BOSD and instantly restart's my PC.

I don't know what to do
Click to expand...
Bad new's... i just disabled the "reset after system failure" option and i got WHEA_UNCORRECTABLE_ERROR.
I think it's a RAM problem
 
You must log in or register to reply here.
Top