Debugging Blue Screen of Death (BSOD) Driver Conflicts

A Blue Screen of Death (BSOD) is the Windows kernel’s emergency halt mechanism. When kernel-mode code encounters an unrecoverable exception, the operating system stops execution to prevent memory corruption or hardware damage.

For engineers and system administrators, these errors are not random glitches. They are diagnostic signatures. In this protocol, we will focus on resolving driver conflicts (like DRIVER_IRQL_NOT_LESS_OR_EQUAL or SYSTEM_THREAD_EXCEPTION_NOT_HANDLED) using professional debugging tools.

---

1. Locating and Retrieving Memory Dumps

When Windows crashes, it writes state information to a dump file. By default, Windows is configured to write a Minidump (a small physical dump containing registers, processor state, and loaded drivers list) or a Kernel Memory Dump (larger, containing the kernel space memory).

Search these paths on the affected system root:

• Minidump Directory: C:\Windows\Minidump\ (typically named MiniMMDDYY-XX.dmp)
• Full Kernel Dump: C:\Windows\MEMORY.DMP

[!IMPORTANT] If no dump files exist, verify that your paging file is active on the boot drive and that Windows is configured to write dumps. Go to sysdm.cpl > Advanced > Startup and Recovery Settings and select Write debugging information to Small memory dump.

---

2. Analyzing Dump Files with WinDbg

To trace the specific driver module triggering the crash, we utilize the Microsoft Windows Debugger (WinDbg).

Setting Up symbols

WinDbg requires access to official Microsoft Symbol Files (.pdb) to map binary memory offsets to human-readable function names:

1. Open WinDbg.
2. Go to File > Settings > Debugging settings.
3. Set the Symbol path to:

   srv*https://msdl.microsoft.com/download/symbols

Loading and Running the Analysis

Open the .dmp file in WinDbg (Ctrl + O) and locate the Command prompt window inside the GUI. Run the primary analysis command:

!analyze -v

This runs the automated debugger heuristics. The output will isolate key parameters:

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable address at too high an IRQL.
Arguments:
Arg1: 0000000000000028, referenced address
Arg2: 0000000000000002, IRQL (Interrupt Request Level)
Arg3: 0000000000000000, bitfield
Arg4: fffff80455d312a0, address which referenced memory
...
MODULE_NAME: nvlddmkm
IMAGE_NAME: nvlddmkm.sys
FAILURE_BUCKET_ID: AV_nvlddmkm!unknown_function

In the output block above, IMAGE_NAME tells us the driver binary responsible.

Common Conflict-Prone Drivers

Image Name	Component / Device	Common Solution
nvlddmkm.sys	NVIDIA Graphics Driver	Run Display Driver Uninstaller (DDU) and clean install WHQL drivers.
amdkmdag.sys	AMD Radeon Graphics	Run DDU and install clean AMD Software drivers.
rtwlane.sys	Realtek Wireless LAN	Download OEM adapter package, purge network stack in Device Manager.
ntoskrnl.exe	Windows Kernel Core	Usually a false positive. Memory instability or disk sector corruption is triggering a crash here. Run MemTest86.

---

3. Isolating Drivers with Driver Verifier

If crashes are intermittent and no single driver is blamed in standard minidumps, use the built-in Driver Verifier to stress-test third-party drivers.

[!WARNING] Driver Verifier can trigger a boot loop if it catches a buggy startup driver. Make sure you have a system restore point or know how to enter Safe Mode to disable Verifier via Command Prompt.

1. Open Command Prompt as Administrator and type:

   verifier

2. Choose Create custom settings (for code developers).
3. Check these tests:
   • I/O Verification
   • Force IRQL Checking
   • Pool Tracking
   • Deadlock Detection
4. Choose Select driver names from a list and check all non-Microsoft drivers.
5. Reboot the system.

If a driver violates kernel rules, Windows will instantly BSOD. Note the driver name and error code. To disable Verifier after finding the bug:

verifier /reset

---

4. Remediation: Purging in Safe Mode

Once the culprit driver is isolated (e.g., nvlddmkm.sys), boot into Safe Mode to remove the software lock:

1. Hold Shift while clicking Restart in the Start Menu.
2. Go to Troubleshoot > Advanced Options > Startup Settings > Restart.
3. Press 4 or F4 to enable Safe Mode.

Once booted into Safe Mode, purge the drivers:

Graphics Driver Clean Up

For GPUs, run Display Driver Uninstaller (DDU) to wipe registry entries, scheduled tasks, and local system files that manual uninstallers leave behind.

Manual Driver Purging

For non-graphics drivers, use the Command Line to list and clean up third-party drivers:

# List all OEM (third-party) drivers registered in the driver store
pnputil /enum-drivers

# Locate the published name (e.g., oem32.inf) and delete it
pnputil /delete-driver oem32.inf /uninstall /force

Reboot into normal mode and download the latest stable, WHQL-certified driver package directly from the hardware vendor.