Nonpaged Pool Leak - NDnd Tag - Windows 8.1 64-bit

Question

I have a huge memory leak with the tag "NDnd", which eventually occupies my whole ram (8GB).

Findstr shows me, that hiberfil.sys, pagefile.sys, swapfile.sys or ndis.sys could be the problem.

I'm pretty sure it is ndis.sys, since the nonpaged pool gets bigger with any kind of network activity. How do I fix this leak?

I have a Windows 8.1 Pro 64-bit system, if it helps.

score 0 · Answer 1 · answered Jul 12 '17 at 02:24

0

possibly relevant:

July 11, 2017—KB4025339 (OS Build 14393.1480)

Addressed issue with memory leaks in the nonpaged pool with the "NDnd" tag, which causes the OS to crash.

https://support.microsoft.com/en-au/help/4025339/windows-10-update-kb4025339

answered Jul 12 '17 at 02:24

CoderBrien

139
1
4

score 0 · Answer 2 · answered Nov 20 '13 at 17:12

0

You must use xperf to trace what causes the usage. Install the WPT, open a cmd.exe as admin and run this:

xperf -on PROC_THREAD+LOADER+POOL -stackwalk PoolAlloc+PoolFree+PoolAllocSession+PoolFreeSession -BufferSize 1024 -MinBuffers 256 -MaxBuffers 256 -MaxFile 256 -FileMode Circular && timeout -1 && xperf -d pool.etl

capture 30s of the grow. Open the ETL with WPA.exe, add the Pool graphs to the analysis pane.

Put the pooltag column at first place and add the stack column. Now load the symbols inside WPA.exe and expand the stack of the NDnD tag. Now find other 3rd party drivers which use this tag. Look for driver updates

answered Nov 20 '13 at 17:12

magicandre1981

97,301
30
179
245

same result as before. drivers are up to date. – A2Vini Nov 20 '13 at 23:24
which driver caused the NDnd tag usage? – magicandre1981 Nov 21 '13 at 04:33
I reinstalled the drivers for my wireless chip on a hunch and it seems to have fixed the problem... Thanks for you help! – A2Vini Nov 21 '13 at 08:39
2

@A2Vini you still haven't wrote which driver is the cause. – magicandre1981 Nov 21 '13 at 17:58

Nonpaged Pool Leak - NDnd Tag - Windows 8.1 64-bit

2 Answers2

Linked