Hi. . .
Your SYSTEM Event Log shows four (4) 0xe6 bugcheck BSODs - one on 17 December; two on 18 December; one on 19 December 2018.
From SYSTEM EVTX Log -- Bottom-Up (↑) is in chronological order (most recent BSOD appears first):
[CODE]Event[351]:
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: [HI]2018-12-19T00:47:32.214[/HI]
Event ID: 1001
Level: Error
Description:
The computer has rebooted from a bugcheck. The bugcheck was:
[h32]0x000000e6[/h32] (0x0000000000000026, 0xffffb28939c672b0, 0x0000000000000000, 0x0000000000000006).
A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 669135ad-39ef-4cfc-8d7a-bdf39ebf506a.
Event[604]:
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: [HI]2018-12-18T22:56:52.160[/HI]
Event ID: 1001
Level: Error
Description:
The computer has rebooted from a bugcheck. The bugcheck was:
[h32]0x000000e6[/h32] (0x0000000000000026, 0xffffce8fd02ec060, 0x0000000000000000, 0x0000000000000006).
A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 1c0714e9-7069-4a17-8fe2-efa93cb5eeaf.
Event[681]:
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: [HI]2018-12-18T22:34:22.211[/HI]
Event ID: 1001
Level: Error
Description:
The computer has rebooted from a bugcheck. The bugcheck was:
[h32]0x000000e6[/h32] (0x0000000000000026, 0xffffb88f7cec6060, 0x0000000000000000, 0x0000000000000006).
A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: ae63919d-d2a2-43a1-aed1-d99fd27c5643.
Event[1203]:
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: [HI]2018-12-17T21:25:16.244[/HI]
Event ID: 1001
Level: Error
Description:
The computer has rebooted from a bugcheck. The bugcheck was:
[h32]0x000000e6[/h32] (0x0000000000000026, 0xffffa7882155f570, 0x0000000000000000, 0x0000000000000006).
A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 6f161568-bc45-4495-afdc-ac0d5112c904.
[/CODE]
Windows was installed the day before the first crash:
[CODE]Original Install Date: 12/16/2018, 5:29:40 AM[/CODE]
These are the last two SYSTEM EVTX (System Event Log) entries for 16 December. The first BSOD was on 17 Dec - 21:25:16 hours, meaning that your system ran without incident for about 40 hours - then the first BSOD hit -
[CODE]Event[1378]:
Log Name: System
Source: Microsoft-Windows-Kernel-Power
Date: [HI]2018-12-16T14:59:08.868[/HI]
Event ID: 107
Description:
[H32]The system has resumed from sleep.[/H32]
Event[1379]:
Log Name: System
Source: Microsoft-Windows-Kernel-Power
Date: [HI]2018-12-16T14:59:07.843[/HI]
Event ID: 42
Description:
[H32]The system is entering sleep.[/H32]
Sleep Reason: Application API
[/CODE]
According to those entries, the system slept for just over 1 second, which seems ridiculous.
Do you recall what you installed within those 40 hours?
One of the system reports indicates that 5 Windows Updates were installed.
This is the first entry for 17 Dec 2018 -
[CODE]Event[1377]:
Log Name: System
Source: EventLog
Date: [HI]2018-12-17T12:39:18.461[/HI]
Event ID: 6013
Description:
[h32]The system uptime is 85330 seconds[/h32].[/code]
If my math is correct, 85330 seconds = 23.7 hours. The first BSOD then hits ~9 hours later at 21:25:16.
From debugger.chm file (in the Windbg directory) - Info for a 0xe6 bugcheck BSOD -
Then it goes on to mention parm 1 (the first number inside the parenthesis) - yours is 0x26 - on all 4 dumps -
The problem is that there is no error 0x26 listed:
[HIDE][CODE]Parameter 1 Cause of Error and Debugger Message
0x00
This code can represent two kinds of errors:
1. The driver tried to flush too many bytes to the end of the map register file. The number of bytes permitted and the number of bytes attempted are displayed.
2. Windows has run out of contiguous map registers. The number of map registers needed and the largest block of contiguous map registers is displayed.
0x01
The performance counter has decreased. The old and new values of the counter are displayed.
0x02
The performance counter has increased too fast. The counter value is displayed in the debugger.
0x03
The driver freed too many DMA common buffers. Usually this means it freed the same buffer two times.
0x04
The driver freed too many DMA adapter channels. Usually this means it freed the same adapter channel two times.
0x05
The driver freed too many DMA map registers. Usually this means it freed the same map register two times. The number of active map registers is displayed.
0x06
The driver freed too many DMA scatter/gather lists. Usually this means it freed the same scatter/gather list two times. The number of lists allocated and the number of lists freed is displayed.
0x07
The driver tried to release the adapter without first freeing all its common buffers. The adapter address and the number of remaining buffers is displayed.
0x08
The driver tried to release the adapter without first freeing all adapter channels, common buffers, or scatter/gather lists. The adapter address and the number of remaining items is displayed.
0x09
The driver tried to release the adapter without first freeing all map registers. The adapter address and the number of remaining map registers is displayed.
0x0A
The driver tried to release the adapter without first freeing all its scatter/gather lists. The adapter address and the number of remaining scatter/gather lists is displayed.
0x0B
HV_TOO_MANY_ADAPTER_CHANNELSThe driver has allocated too many adapter channels at the same time. . (Only one adapter channel is permitted per adapter.)
0x0C
The driver tried to allocate too many map registers at the same time. The number requested and the number allowed are displayed.
0x0D
The driver did not flush its adapter buffers. The number of bytes that the driver tried to map and the maximum number of bytes allowed are displayed.
0x0E
The driver tried a DMA transfer without locking the buffer. The buffer in question was in paged memory. The address of the MDL is displayed.
0x0F
The driver or the hardware wrote outside its allocated DMA buffer. The nature of the error (overrun or underrun) is displayed, as well as the relevant addresses.
0x10
The driver tried to free its map registers while some were still mapped. The number of map registers still mapped is displayed.
0x11
The driver has too many outstanding reference counts for the adapter. The number of reference counts and the adapter address are displayed.
0x13
The driver called a DMA routine at an improper IRQL. The required IRQL and the actual IRQL are displayed.
0x14
The driver called a DMA routine at an improper IRQL. The required IRQL and the actual IRQL are displayed.
0x15
The driver tried to allocate too many map registers. The number requested and the number allowed are displayed.
0x16
The driver tried to flush a buffer that is not mapped. The address of the buffer is displayed.
0x18
The driver tried a DMA operation by using an adapter that was already released and no longer exists. The adapter address is displayed.
0x19
The driver passed a null DMA_ADAPTER value to a HAL routine.
0x1B
The driver passed an address and MDL to a HAL routine. However, this address is not within the bounds of this MDL. The address passed and the address of the MDL are displayed.
0x1D
The driver tried to map an address range that was already mapped. The address range and the current mapping for that range are displayed.
0x1E
The driver called HalGetAdapter. This function is obsolete -- you must use IoGetDmaAdapter instead.
0x1F
HV_BAD_MDLThe driver referenced an invalid system address -- either before the first MDL, or after the end of the first MDL, or by using a transfer length that is longer than the MDL buffer and crosses a page boundary within the MDL. . Either the invalid address and the first MDL address, or the MDL address and the extra transfer length are displayed.
0x20
The driver tried to flush a map register that hasn't been mapped. The map register base, flushing address, and MDL are displayed.
0x21
The driver tried to map a zero-length buffer for transfer.
[/CODE] [/HIDE]
I agree with you that it's strange that you encountered 0xe6 BSODs while Driver Verifier was off.
I would suggest that you try running Driver Verifier and see what Driver Verifier flags, if anything.
Follow this for D/V - Driver Verifier - BSOD related - Windows 10, 8.1, 8, 7 + Vista
Also, if there really are no minidumps on your system (c:\windows\minidump), change SYSTEM crash settings to produce them. I think the selection in W10 is "normal mode" (not sure - currently on W8.1 here). I also believe that if you set it to "full kernel dump" it will also produce a minidump. There also may be a "minidump" setting.
Regards. . .
jcgriff2
p.s. I see that the dump at Dropbox is NOT zipped. If zipped, it would probably end up around 10-20% of its current 1.2 GB size.
Copy it from \windows to Documents or Desktop
RIGHT-click on it; select "Send to compressed file"
The zip file will be in the same directory that you copied the file to.
You cannot zip it while it resides in \windows. Permission setting issues.
