## **COMPLETE CRASH ANALYSIS - 7 BSODs in 14 Days**

---

## **SYSTEM SPECIFICATIONS**

**Hardware:**
- **CPU:** AMD Ryzen 5 3600 6-Core Processor
- **Motherboard:** ASUS TUF Gaming B550M-PLUS
- **BIOS:** American Megatrends Inc. version 3607 (dated 22/03/2024)
- **RAM:** 2x8GB Corsair Vengeance RGB CMW16GX4M2C3200C16 @ 3200MHz
  - Module 1: DIMM_A2 - 8GB
  - Module 2: DIMM_B2 - 8GB
- **Storage:**
  - Samsung SSD 980 1TB (Status: OK)
  - Force MP510 480GB SSD (Status: OK)
  - Toshiba 3TB HDD (Status: OK)
  - Kingston 960GB SSD (Status: OK)
- **GPU:** NVIDIA (specific model unspecified)

**Software:**
- **OS:** Windows 11 Enterprise Insider Preview Build 26200 (Canary Channel)
- **Installation history:** 16-year-old installation (originally Windows 7, upgraded through multiple versions)

**System Configuration:**
- HPET was enabled (`useplatformclock Yes`) initially
- Changed: `bcdedit /set disabledynamictick yes` (successful)
- Attempted: `bcdedit /deletevalue useplatformclock` (failed - element not found)

**Relevant Context:**
- User has another PC with identical Windows build and BIOS version that runs without issues
- Software uninstalled during troubleshooting: EL Display Hub

---

## **DETAILED CRASH ANALYSIS**

### **CRASH #1**
**File:** 021126-7062-01.dmp
**Date:** Feb 11, 2026, 21:55:39
**Uptime:** 7 hours 35 minutes 40 seconds

**Bugcheck:** `IRQL_NOT_LESS_OR_EQUAL (0xA)`
- **Arg1:** `0xffffe403907c02f4` (memory referenced)
- **Arg2:** `0xff` (IRQL level)
- **Arg3:** `0x0` (read operation)
- **Arg4:** `0xfffff8038564d293` (faulting address)

**Technical Details:**
- **Faulting Process:** `EL_Display_ser`
- **Faulting Function:** `nt!KeAccumulateTicks+0x43`
- **Faulting IP:** `fffff8038564d293` (Paged code)
- **Read Address:** `0xffffe403907c02f4` (Nonpaged pool - inaccessible)
- **Failure Bucket:** `AV_nt!KeAccumulateTicks`
- **Failure Hash:** `{bdd44265-f411-b02a-f0e6-95fb2512e2b8}`

**Stack Trace:**
```
nt!KeBugCheckEx
nt!KeAccumulateTicks+0x59c
nt!KiUpdateRunTime+0x9b
nt!KiUpdateTime+0x380
nt!KeClockInterruptNotify+0x28a
nt!KiCallInterruptServiceRoutine+0x32c
nt!KiInterruptDispatchNoLockNoEtw+0x3c
nt!KiIpiStallOnPacketTargetsPrcb+0x2c
nt!KeFlushProcessWriteBuffers+0x10f
nt!ExpGetProcessInformation+0x1c1
nt!ExpQuerySystemInformation+0xdb2
nt!NtQuerySystemInformation+0x91
nt!KiSystemServiceCopyEnd+0x25
```

---

### **CRASH #2**
**File:** 021926-30734-01.dmp
**Date:** Feb 19, 2026, 18:25:18
**Uptime:** 5 hours 52 minutes 54 seconds

**Bugcheck:** `IRQL_NOT_LESS_OR_EQUAL (0xA)`
- **Arg1:** `0xffffd406f77bc2f4` (memory referenced)
- **Arg2:** `0xff` (IRQL level)
- **Arg3:** `0x0` (read operation)
- **Arg4:** `0xfffff80485847fb3` (faulting address)

**Technical Details:**
- **Faulting Process:** `NVDisplay.Cont` (NVIDIA Display Container)
- **Faulting Function:** `nt!KeAccumulateTicks+0x43`
- **Faulting IP:** `fffff80485847fb3` (Paged code)
- **Read Address:** `0xffffd406f77bc2f4` (Nonpaged pool - inaccessible)
- **Failure Bucket:** `AV_nt!KeAccumulateTicks`
- **Failure Hash:** `{bdd44265-f411-b02a-f0e6-95fb2512e2b8}` *(IDENTICAL to Crash #1)*

**Stack Trace:**
```
nt!KeBugCheckEx
nt!KeAccumulateTicks+0x59c
nt!KiUpdateRunTime+0x9b
nt!KiUpdateTime+0x380
nt!KeClockInterruptNotify+0x28a
nt!KiCallInterruptServiceRoutine+0x32c
nt!KiInterruptDispatchNoLockNoEtw+0x3c
nt!KiIpiWaitForRequestBarrier+0x2c
nt!MiFlushTbList+0x81f
nt!MiFlushTbAsNeeded+0x246
nt!MiLinkPoolCommitChain+0x63
nt!MiCommitPoolMemory+0x1a3
[...memory allocation chain...]
dxgkrnl!DxgkEscape+0x3ac
nt!KiSystemServiceCopyEnd+0x25
```

---

### **CRASH #3**
**File:** 022326-30546-01.dmp
**Date:** Feb 23, 2026, 16:32:36
**Uptime:** 1 hour 53 minutes 55 seconds

**Bugcheck:** `SYSTEM_SERVICE_EXCEPTION (0x3B)`
- **Arg1:** `0xc0000005` (STATUS_ACCESS_VIOLATION)
- **Arg2:** `0xfffff80292643bc3` (instruction address)
- **Arg3:** `0xffff928d29c67e50` (context record address)
- **Arg4:** `0x0`

**Technical Details:**
- **Faulting Process:** `csrss.exe`
- **Faulting Function:** `win32kfull!CoalescableDueTime+0x83`
- **Faulting IP:** `fffff80292643bc3` (Paged code)
- **Failure Bucket:** `AV_win32kfull!CoalescableDueTime`
- **Failure Hash:** `{36d8c050-53ef-fceb-6b2c-75ac02716f1b}`

**Context Registers:**
```
rax=fffff80279ed612e rbx=ffffda80a4c977c0 rcx=01a8e80008379d15
rdx=000000007fe90463 rsi=ffffda80a4c74448 rdi=0000000000000200
rip=fffff80292643bc3 rsp=ffff928d29c68880 rbp=0000000000000020
```

**Faulting Instruction:**
```
win32kfull!CoalescableDueTime+0x83:
mov eax,dword ptr [rcx+408h]
```
Attempted to access `[rcx+408h]` where `rcx=0x01a8e80008379d15` (corrupted/invalid pointer)

**Stack Trace:**
```
win32kfull!CoalescableDueTime+0x83
win32kfull!xxxTimersProc+0x20c
win32kfull!RawInputThread+0xbdd
win32kbase!xxxCreateSystemThreads+0x14b
win32kbase!NtUserCreateSystemThreads+0x5b
win32k!NtUserCreateSystemThreads+0x2e
nt!KiSystemServiceCopyEnd+0x25
```

---

### **CRASH #4**
**File:** 022426-31328-01.dmp
**Date:** Feb 24, 2026, 19:52:27
**Uptime:** 2 hours 25 minutes 31 seconds

**Bugcheck:** `KERNEL_SECURITY_CHECK_FAILURE (0x139)`
- **Arg1:** `0x3` (LIST_ENTRY corrupted - double remove)
- **Arg2:** `0xffffb68cff4066c0` (trap frame address)
- **Arg3:** `0xffffb68cff406618` (exception record address)
- **Arg4:** `0x0`

**Technical Details:**
- **Faulting Process:** `Zoom.exe`
- **Faulting Function:** `nt!KiInsertTimerTable+0xe7`
- **Faulting IP:** `fffff802b20dd7b7`
- **FailFast Type:** `CORRUPT_LIST_ENTRY` (Subcode 3)
- **Exception Code:** `0xc0000409` (STATUS_STACK_BUFFER_OVERRUN)
- **Failure Bucket:** `0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiInsertTimerTable`
- **Failure Hash:** `{f89e8bcc-9d62-a3aa-7602-6fa1ac774850}`

**Trap Frame Registers:**
```
rax=ffffa18e758c71a0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffa18e746f01a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff802b20dd7b7 rsp=ffffb68cff406850 rbp=0000000000000000
r8=00000014546c11f2  r9=000000000000001b
```

**Faulting Instruction:**
```
nt!KiInsertTimerTable+0xe7:
int 29h  (Software interrupt - security check triggered)
```

**Stack Trace:**
```
nt!KeBugCheckEx
nt!KiBugCheckDispatch+0x69
nt!KiFastFailDispatch+0xb2
nt!KiRaiseSecurityCheckFailure+0x368
nt!KiInsertTimerTable+0xe7
nt!KiCommitThreadWait+0x353
nt!KeWaitForSingleObject+0x859
nt!ObWaitForSingleObject+0xbf
nt!NtWaitForSingleObject+0x6a
nt!KiSystemServiceCopyEnd+0x25
```

---

### **CRASH #5**
**File:** 022426-30265-01.dmp
**Date:** Feb 24, 2026, 20:01:25
**Uptime:** 8 minutes 38 seconds ⚠️

**Bugcheck:** `IRQL_NOT_LESS_OR_EQUAL (0xA)`
- **Arg1:** `0x54` (memory referenced - near-NULL)
- **Arg2:** `0x2` (IRQL level)
- **Arg3:** `0x0` (read operation)
- **Arg4:** `0xfffff800ab052262` (faulting address)

**Technical Details:**
- **Faulting Process:** `Zoom.exe`
- **Faulting Function:** `nt!KiSwapThread+0x52`
- **Faulting IP:** `fffff800ab052262` (Paged code)
- **Read Address:** `0x0000000000000054` (near-NULL pointer)
- **Failure Bucket:** `AV_nt!KiSwapThread`
- **Failure Hash:** `{3a5eca23-a992-0c0e-a0ce-d48add0d8eda}`

**Faulting Instruction:**
```
nt!KiSwapThread+0x52:
mov ecx,dword ptr [r15+54h]
```

**Stack Trace:** (Corrupted - minimal information available)
```
0x0
0x2
[Stack corrupted beyond this point]
```

---

### **CRASH #6**
**File:** 022426-30953-01.dmp
**Date:** Feb 24, 2026, 20:53:50
**Uptime:** 52 minutes 6 seconds

**Bugcheck:** `IRQL_NOT_LESS_OR_EQUAL (0xA)`
- **Arg1:** `0x83d8` (memory referenced)
- **Arg2:** `0x2` (IRQL level)
- **Arg3:** `0x0` (read operation)
- **Arg4:** `0xfffff801743dab1f` (faulting address)

**Technical Details:**
- **Faulting Process:** `aomhost64.exe` (AOMedia Host - AV1 codecs)
- **Faulting Function:** `nt!KiStartReadyQueueEnumeratorForRescheduleContext+0x1cf`
- **Faulting IP:** `fffff801743dab1f` (Paged code)
- **Read Address:** `0x00000000000083d8`
- **Failure Bucket:** `AV_nt!KiStartReadyQueueEnumeratorForRescheduleContext`
- **Failure Hash:** `{f7c1e764-4304-dcdc-00c9-26a83244df9a}`

**Faulting Instruction:**
```
nt!KiStartReadyQueueEnumeratorForRescheduleContext+0x1cf:
mov ecx,dword ptr [rax+83D8h]
```

**Stack Trace:** (Corrupted)
```
0xffffffff`fffff800
0xffff9301`39151180
0xffffe409`f07ec040
[Stack corrupted beyond this point]
```

---

### **CRASH #7**
**File:** 022526-30234-01.dmp
**Date:** Feb 25, 2026, 01:07:17 (Early morning)
**Uptime:** 2 hours 1 minute 8 seconds
**System State:** **IDLE** ⚠️

**Bugcheck:** `IRQL_NOT_LESS_OR_EQUAL (0xA)`
- **Arg1:** `0x0` (NULL pointer - write attempt to address 0)
- **Arg2:** `0xff` (IRQL level)
- **Arg3:** `0xf` (WRITE operation + execute bit)
- **Arg4:** `0xfffff801bb7bbbd0` (faulting address)

**Technical Details:**
- **Faulting Process:** `System` (kernel itself)
- **Faulting Function:** `nt!KiGetNextTimerExpirationDueTime+0x2a0`
- **Faulting IP:** `fffff801bb7bbbd0` (Paged code)
- **Write Address:** `0x0000000000000000` (absolute NULL pointer)
- **Failure Bucket:** `AV_nt!KiGetNextTimerExpirationDueTime`
- **Failure Hash:** `{fb98d682-2f5f-b11b-1a7d-94cf0bd39105}`

**Faulting Instruction:**
```
nt!KiGetNextTimerExpirationDueTime+0x2a0:
mov qword ptr [rax],rdi
```
Attempted to write to `[rax]` where `rax=0x0000000000000000`

**Stack Trace (Idle Loop):**
```
nt!KeBugCheckEx
nt!KiBugCheckDispatch+0x69
nt!KiPageFault+0x468
nt!KiGetNextTimerExpirationDueTime+0x2a0
nt!KeEstimateClockTickDuration+0x19b
nt!PpmEstimateIdleDuration+0xe7
nt!PpmComputeIdleDurationHint+0x81
nt!PpmIdleSelectStates+0x18a
nt!PoIdle+0x135
nt!KiIdleLoop+0x54
```

**Critical Context:** CPU entered idle state, attempted to calculate sleep duration, needed to query timer table for next timer expiration, encountered NULL pointer in timer table.

---

## **PATTERN ANALYSIS**

### **Temporal Pattern:**
| Crash | Date | Uptime | Days Since Previous |
|-------|------|--------|-------------------|
| #1 | Feb 11 | 7h 35m | - |
| #2 | Feb 19 | 5h 52m | 8 days |
| #3 | Feb 23 | 1h 53m | 4 days |
| #4 | Feb 24 | 2h 25m | 1 day |
| #5 | Feb 24 | **8 min** | Same day |
| #6 | Feb 24 | 52 min | Same day |
| #7 | Feb 25 | 2h 1m | During idle |

**Observation:** Exponentially accelerating frequency. Uptime decreased from 7+ hours to 8 minutes.

### **Functional Pattern:**
All crashes involve kernel **TIMING/SCHEDULING** subsystem:

| Crash | Primary Function | Subsystem |
|-------|-----------------|-----------|
| #1 | KeAccumulateTicks | Timers |
| #2 | KeAccumulateTicks | Timers |
| #3 | CoalescableDueTime | Timers |
| #4 | KiInsertTimerTable | Timers |
| #5 | KiSwapThread | Scheduler |
| #6 | KiStartReadyQueue | Scheduler |
| #7 | KiGetNextTimerExpirationDueTime | **Timers (during IDLE)** |

### **Error Type Distribution:**
- **5 crashes:** IRQL_NOT_LESS_OR_EQUAL (0xA)
- **1 crash:** SYSTEM_SERVICE_EXCEPTION (0x3B)
- **1 crash:** KERNEL_SECURITY_CHECK_FAILURE (0x139)

### **Memory Access Pattern:**
All involve invalid memory access:
- NULL or near-NULL pointers (#5: 0x54, #7: 0x00)
- Corrupted pointers with impossible values (#3: 0x01a8e80008379d15)
- Corrupted data structures (#4: LIST_ENTRY double-remove detection)

### **Unique Failure Hashes:**
- `{bdd44265-f411-b02a-f0e6-95fb2512e2b8}` - Crashes #1 and #2 (identical)
- `{36d8c050-53ef-fceb-6b2c-75ac02716f1b}` - Crash #3
- `{f89e8bcc-9d62-a3aa-7602-6fa1ac774850}` - Crash #4
- `{3a5eca23-a992-0c0e-a0ce-d48add0d8eda}` - Crash #5
- `{f7c1e764-4304-dcdc-00c9-26a83244df9a}` - Crash #6
- `{fb98d682-2f5f-b11b-1a7d-94cf0bd39105}` - Crash #7

### **Process Distribution:**
- EL_Display_ser (Crash #1)
- NVDisplay.Cont (Crash #2)
- csrss.exe (Crash #3)
- Zoom.exe (Crashes #4, #5)
- aomhost64.exe (Crash #6)
- System/Kernel (Crash #7)

### **Additional Technical Details:**
- All crashes show `Image Version: 10.0.26100.7824` or `10.0.26100.7623`
- KASLR (Kernel Address Space Layout Randomization) active - kernel base address varies between crashes
- All dumps show `BIOS Revision: 5.17.0.0`
- Dump attributes consistent: `0x21008` (Kernel Generated Triage Dump)

---

## **CONFIGURATION CHANGES MADE**

**System modifications attempted:**
1. Uninstalled EL Display Hub software (after Crash #1)
2. Executed `bcdedit /set disabledynamictick yes` (successful)
3. Attempted `bcdedit /deletevalue useplatformclock` (failed - element not found)

**Result:** Crash #7 occurred after configuration changes, indicating changes did not resolve the issue.

---

## **COMPARATIVE CONTEXT**

User reports:
- Second PC with identical Windows build (26200) and BIOS version runs without crashes
- Same hardware configuration (unspecified which components match)
- 16-year-old Windows installation upgraded from Windows 7

---

**Note:** This analysis contains only factual data extracted from crash dumps and system information. No personal identifying information, locations, or sensitive data included.