But when I remote to this PC using UltraVNC Viewer, UtraVNC Server (winvnc.exe) caused Windows BSOD / bugcheck then auto restart.
The BSOD only happened when UltraVNC remote session is active.
Symptoms:
1. BSOD only happened when this PC receiving remote session using UltraVNC, not when using Teamviewer/Anydesk/Others
2. BSOD timing is not fixed, sometimes every other minutes, sometimes every other hours, sometimes every other days.
3. Tested on different newly installed Windows 10 20H2 / 21H1 / LTSC 2019 (same hardware)
4. Tested on different Intel display driver version
5. Tested on different UltraVNC versions: 1.3.x / 1.4.x / 1.6.x
6. Use Windbg to analyzed memory dump file, shows "winvnc.exe" is the caused, result of windbg analysis below:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c0029100, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of
status)
Arg4: 818a9f43, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 13593
Key : Analysis.Elapsed.mSec
Value: 13646
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 21109
Key : Analysis.Init.Elapsed.mSec
Value: 52618
Key : Analysis.Memory.CommitPeak.Mb
Value: 66
Key : Analysis.Version.DbgEng
Value: 10.0.27871.1001
Key : Analysis.Version.Description
Value: 10.2505.01.02 x86fre
Key : Analysis.Version.Ext
Value: 1.2505.1.2
Key : Bugcheck.Code.LegacyAPI
Value: 0xa
Key : Bugcheck.Code.TargetModel
Value: 0xa
Key : Failure.Bucket
Value: AV_dxgmms1!VIDMM_SEGMENT::SafeProbeAndLockPages
Key : Failure.Hash
Value: {ef2979ff-e4ab-9457-2244-340982265f57}
Key : WER.OS.Branch
Value: rs5_release
Key : WER.OS.Version
Value: 10.0.17763.1
BUGCHECK_CODE: a
BUGCHECK_P1: ffffffffc0029100
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: ffffffff818a9f43
FILE_IN_CAB: 073025-3515-01.dmp
FAULTING_THREAD: ffffffff85ba3040
READ_ADDRESS: c0029100
BLACKBOXBSD: 1 (!blackboxbsd)
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: winvnc.exe
TRAP_FRAME: b24c2ee4 -- (.trap 0xffffffffb24c2ee4)
ErrCode = 00000000
eax=c0029100 ebx=b9b2623c ecx=00000001 edx=00000041 esi=b24c2fd0 edi=00000000
eip=818a9f43 esp=b24c2f58 ebp=b24c2f98 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MiLockPageLeafPageTable+0x313:
818a9f43 8b08 mov ecx,dword ptr [eax] ds
c0029100=????????Resetting default scope
STACK_TEXT:
b24c2e40 8197d899 0000000a c0029100 00000002 nt!KiBugCheck2
<Intermediate frames may have been skipped due to lack of complete unwind>
b24c2e40 818a9f43 (T) 0000000a c0029100 00000002 nt!KiTrap0E+0x3a9
<Intermediate frames may have been skipped due to lack of complete unwind>
b24c2f98 818aa5a7 (T) 8aff5ca8 05220000 00402000 nt!MiLockPageLeafPageTable+0x313
b24c3038 818ad343 00000001 b24c30a0 94ce626b nt!MiProbeAndLockPages+0x277
b24c3044 94ce626b c7f81000 00000000 00000002 nt!MmProbeAndLockPages+0x23
b24c30a0 94ce92db 00402000 00000002 00000000 dxgmms1!VIDMM_SEGMENT::SafeProbeAndLockPages+0x1db
b24c33f0 8f68b9e0 c18b11a8 00b70000 00000007 dxgmms1!VIDMM_GLOBAL::ReferenceDmaBuffer+0xcab
b24c3a0c 8f7b6927 b24c3b9c b24c3ac4 b24c3b2c dxgkrnl!DXGCONTEXT::Render+0x730
b24c3d08 81976eff 0bf1f0d0 0bf1f0ac 773e2230 dxgkrnl!DxgkRender+0x82c
<Intermediate frames may have been skipped due to lack of complete unwind>
b24c3d08 773e2230 (T) 0bf1f0d0 0bf1f0ac 773e2230 nt!KiSystemServicePostCall
WARNING: Frame IP not in any known module. Following frames may be wrong.
<Intermediate frames may have been skipped due to lack of complete unwind>
0bf1f0ac 00000000 (T) 00000000 00000000 00000000 0x773e2230
SYMBOL_NAME: dxgmms1!VIDMM_SEGMENT::SafeProbeAndLockPages+1db
MODULE_NAME: dxgmms1
IMAGE_NAME: dxgmms1.sys
IMAGE_VERSION: 10.0.17763.7420
STACK_COMMAND: .process /r /p 0xffffffffb9b26040; .thread 0xffffffff85ba3040 ; kb
BUCKET_ID_FUNC_OFFSET: 1db
FAILURE_BUCKET_ID: AV_dxgmms1!VIDMM_SEGMENT::SafeProbeAndLockPages
OS_VERSION: 10.0.17763.1
BUILDLAB_STR: rs5_release
OSPLATFORM_TYPE: x86
OSNAME: Windows 10
FAILURE_ID_HASH: {ef2979ff-e4ab-9457-2244-340982265f57}
Followup: MachineOwner
---------
Hope UltraVNC team can help
Thanks