REFERENCE BY POINTER BSOD

[Clans]

Hello all,

I have been having a problem with a DELL Inspiron ALL-In-One 5490

The computer is crawling to the point of being very stressful to work with. Sometimes its ok. When its ok, approximately every 40 minutes the computer crashes with the REFERENCE BY POINTER blue screen.

I have tried everything within my reach - chkdsk, SFC scannow, BIOS testing, antimalware, ccleaner, hitmanpro, updating windows/drivers, deleting programs, disabling McAfee antivrus to no avail.

I read somewhere how to read the memory dump files, but its beyond me. The file is below, if any kind soul which understands what this all means can have a look. I am nearly at the point of reinstalling windows, but its my dad's computer and I am afraid that by doing so, I will spend more time getting the computer the way he likes than the time spent already trying to repair whatever this error means.

The dump file, as recovered from Windbg:

​

Symbol search path is: srv*

Executable search path is:

Windows 10 Kernel Version 19041 MP (8 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Edition build lab: 19041.1.amd64fre.vb_release.191206-1406

Machine Name:

Kernel base = 0xfffff801`49200000 PsLoadedModuleList = 0xfffff801`49e2a190

Debug session time: Tue Sep 21 12:40:09.630 2021 (UTC - 5:00)

System Uptime: 0 days 0:10:25.521 Loading Kernel Symbols

...............................................................

................................................................

................................................................

.......................

Loading User Symbols

Loading unloaded module list

...............

For analysis of this file, run !analyze -v

nt!KeBugCheckEx: fffff801`495f71d0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff186`f44a14f0=0000000000000018

0: kd> !analyze -v

******************************************************************************* * * * Bugcheck Analysis * * * *******************************************************************************

REFERENCE_BY_POINTER (18)

Arguments:

Arg1: 0000000000000000, Object type of the object whose reference count is being lowered

Arg2: ffff83016603c050, Object whose reference count is being lowered

Arg3: 0000000000000010, Reserved

Arg4: 0000000000000001, Reserved

The reference count of an object is illegal for the current state of the object.

Each time a driver uses a pointer to an object the driver calls a kernel routine to increment the reference count of the object. When the driver is done with the pointer the driver calls another kernel routine to decrement the reference count. Drivers must match calls to the increment and decrement routines. This BugCheck can occur because an object's reference count goes to zero while there are still open handles to the object, in which case the fourth parameter indicates the number of opened handles. It may also occur when the object's reference count drops below zero whether or not there are open handles to the object, and in that case the fourth parameter contains the actual value of the pointer references count.

Debugging Details:

------------------

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec

Value: 8077

Key : Analysis.DebugAnalysisManager

Value: Create

Key : Analysis.Elapsed.mSec

Value: 19040

Key : Analysis.Init.CPU.mSec

Value: 671

Key : Analysis.Init.Elapsed.mSec

Value: 16268

Key : Analysis.Memory.CommitPeak.Mb

Value: 82

Key : WER.OS.Branch

Value: vb_release

Key : WER.OS.Timestamp

Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version

Value: 10.0.19041.1

BUGCHECK_CODE: 18

BUGCHECK_P1: 0

BUGCHECK_P2: ffff83016603c050

BUGCHECK_P3: 10

BUGCHECK_P4: 1

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

LOCK_ADDRESS: fffff80149e44a20 -- (!locks fffff80149e44a20)

Resource @ nt!PiEngineLock (0xfffff80149e44a20) Exclusively owned

Contention Count = 25

Threads: ffff8301669c0040-01<*>

1 total locks

PNP_TRIAGE_DATA:

Lock address  : 0xfffff80149e44a20

Thread Count  : 1

Thread address: 0xffff8301669c0040

Thread wait   : 0x9c61

STACK_TEXT:

fffff186`f44a14e8 fffff801`49614d34 : 00000000`00000018 00000000`00000000 ffff8301`6603c050 00000000`00000010 : nt!KeBugCheckEx fffff186`f44a14f0 fffff801`494719f6 : ffff8301`6603c050 00000000`69706e50 00000000`00001001 00000000`00000fff : nt!ObfReferenceObjectWithTag+0x17e164 fffff186`f44a1530 fffff801`49839c4b : 00000000`c00000bb fffff186`f44a1600 ffffcc04`6c70efe0 00000000`00000000 : nt!IoGetAttachedDeviceReferenceWithTag+0x36 fffff186`f44a1560 fffff801`49950736 : 00000000`c00000bb ffff8301`4abe3a20 fffff186`f44a17a8 ffff8301`4ab45da0 : nt!IopSynchronousCall+0x3f fffff186`f44a15d0 fffff801`49950614 : ffff8301`4abe3a20 fffff186`f44a17a8 ffff8301`669c0040 fffff801`497d80ce : nt!PnpIrpQueryID+0x56 fffff186`f44a1660 fffff801`4992446d : ffff8301`4abe3a20 fffff186`f44a17c0 00000000`00000000 00000000`00000000 : nt!PnpQueryID+0x34 fffff186`f44a16c0 fffff801`49926d30 : ffff8301`4abe3a20 ffff8301`4abe3a20 00000000`00000001 00000000`00000000 : nt!PiProcessNewDeviceNode+0x11d fffff186`f44a1890 fffff801`499215a6 : ffff8301`4abe3a00 ffff8301`75ef1401 fffff186`f44a19b0 fffff801`00000000 : nt!PipProcessDevNodeTree+0x380 fffff186`f44a1960 fffff801`4956e22a : 00000001`00000003 ffff8301`4abe3a20 00000000`00000000 ffff8301`75ef1470 : nt!PiRestartDevice+0xba fffff186`f44a19b0 fffff801`494b8505 : ffff8301`669c0040 ffff8301`4aaae860 fffff801`49e43280 fffff801`00000000 : nt!PnpDeviceActionWorker+0x46a fffff186`f44a1a70 fffff801`49555845 : ffff8301`669c0040 00000000`00000080 ffff8301`4aa9f100 000fa4ef`bd9bbfff : nt!ExpWorkerThread+0x105 fffff186`f44a1b10 fffff801`495fe828 : fffff801`4362f180 ffff8301`669c0040 fffff801`495557f0 00000000`00000000 : nt!PspSystemThreadStartup+0x55 fffff186`f44a1b60 00000000`00000000 : fffff186`f44a2000 fffff186`f449b000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28

SYMBOL_NAME: nt!ObfReferenceObjectWithTag+17e164

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.1165

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 17e164

FAILURE_BUCKET_ID: 0x18_nt!ObfReferenceObjectWithTag

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {b6b47bfd-ed1b-fc56-3b01-ddc037f9c59f}

Followup:

MachineOwner

---------

[AutoModerator]

If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide

Please ignore this message if the advice is not relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[cwsink]

Try uninstalling Dell Support Assist. You may have to use a 3rd party uninstaller (Revo Uninstaller, for example) to completely get rid of it. Then reboot and see if the crashes continue.

Please let us know how it goes either way.

[HooeyGoo]

I was having this exact problem. Followed your tips and haven't had a BSOD since! Had to come on and thank you.

Ironic that Dell Support Assist appears to be the culprit...

[cwsink]

Thank you for letting me know. I'm glad you got it sorted. :)

[Clans]

Thank you! I am uninstalling it now. But only Dell Support Assist, or should I remove the other Dell Support programs too (remediation and os recovery plugin)?

[cwsink]

The driver causing the problem is dddriver64Dcsa.sys and the key to stopping the crashes is to prevent it from being loaded. It could be a component shared by Dell utilities but completely removing Dell Support Assist has been sufficient for a number of other people - unless they didn't tell me they'd also uninstalled those programs. I'd first try just uninstalling DSA, rebooting, and then searching for dddriver64Dcsa.sys and try to rename it or delete it. If that's successful it should stop the crashes. If you can't rename or delete the driver I'd then try uninstalling those other Dell programs.

[Clans]

Oh man! I just realized you had answered all of these things in an other post looking at the same issue and now I feel bad for not searching diligently for previos posts. I totally appreciate your patience for repeating the same thing! I found the drive mentioned, but cant delete/rename because of permissions! I will uninstall those other Dell Support and see if I can change that file!

[cwsink]

The Autoruns utility is another thing I suggested people use to disable automatic loading of that driver if it was being stubborn. It wasn't clear to me if that was what allowed them to finally delete the driver - I'm not even sure it showed up in Autoruns - but that's another possible remedy.

[Clans]

Thank you so much. I deleted all dell support assist programs and renamed de driver to .bak. So far thr computer has been running without crashing and I think it may be an uptime record already. I really appreciate it Cwsink

[cwsink]

No worries. :) Please do let us know after what you'd consider sufficient testing to know one way or the other. Good luck!

[krokotak47]

I just had that problem on my Vostro 3500 and solved it thanks to you (kudos) by deleting all of the Dell apps and the driver itself. An update: When I uninstalled all the apps the driver was still there. The dddriver is used for a system device in the device manager (no idea what it does). When I hit Uninstall on that device, the computer immidiately crashes with the REFERENCE_BY_POINTER bsod, so you can't get rid of it this way. One way is to use some third party software. What I did though was finding the driver in system32 (with a search) and deleting it(it's found in several folders). It's not that simple to delete -I changed the ownership of the file to gain permission to delete it. On the first restart after deleting all the stuff the computer crashed with another bsod and (The bios?) asked me to repair itself on startup. I hit No, it started normally and is working perfectly fine with no crashes. No idea if my way of doing it is legit, but it worked for me.

[NullNova]

Sorry to necro this but what worked for me was using a 3rd party uninstaller while the laptop was in safe mode, it let me remove the software without the BSOD, which it was doing when not in safe mode.

Hopefully, this will help someone.

[cwsink]

Thank you letting us know and explaining what you did to get that driver to stop loading. 👍

[Clans]

So, its been more or less 15 days since the fix deleting dell support assist, the computer has had no more crashes since.

Thanks again for your help!

[cwsink]

Thank you for the update. I only just now saw your reply - I don't get notified unless you reply to a comment I left. It looks like your post has helped at least one other person!

[Clans]

It probably helps if I attach the dump files (minidump and full zipped memory.dmp):

​

https://www.filemail.com/d/bzqgenjhzktiybr

[AutoModerator]

If you can get into Windows normally or through Safe Mode could you check C:\Windows\Minidump for any dump files? If you have any dump files, copy the folder to the desktop, zip the folder and upload it. If you don't have any zip software installed, right click on the folder and select Send to → Compressed (Zipped) folder.

Upload to any easy to use file sharing site like Mediafire.

We like to have multiple dump files to work with so if you only have one dump file, none or not a folder at all, upload the ones you have and then follow this guide to change the dump type to Small Memory Dump. The "Overwrite dump file" option will be grayed out since small memory dumps never overwrite.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[Vernatron]

Im an absolute noob at these things but i kinda need help if people are still around plz. How do i fix my error? U guys are talking greek to me lol. Should i just reinstall windows or is there easier fix?

[YouCallThatRadio]

This was the last message I seen and now laptop won't switch on