Hello, it has been some weeks now and my HP 250 G2 laptop is suffering BSODs of Reference by Pointer. I'm on x64 with 16 GB RAM. This is the link to the minidump: https://www.dropbox.com/s/ugc2zpo41up9tj4/Minidumps.zip?dl=0

These crashes were related to memory corruption (probably caused by a driver). 

Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier first.  You do not need to run memtest yet unless verifier does not find the cause, or you want to.


If you are over-clocking anything reset to default before running these tests. In other words STOP!!!  If you do not know what this means you probably are not

1-Driver verifier (for complete directions see our wiki here)
2-Memtest. (You can read more about running memtest here)

Hi Mohamed ElGohary,

According to one of the dmp files you have uploaded, this issue is related to afd.sys. It is Microsoft Windows Ancillary function driver for Winsock file. So the issue may be related to the NIC driver. We could try to update or reinstall the network adapter driver from the device manager. It is recommended to download the driver from the device manufacturer website, we could try different versions.
Here is the analysis result for reference:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 18, {0, ffffe000a640e200, 2, ffffffffffffffff}

Probably caused by : afd.sys ( afd!AfdFreeEndpointResources+6c34 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffffe000a640e200, Object whose reference count is being lowered
Arg3: 0000000000000002, Reserved
Arg4: ffffffffffffffff, Reserved
 The reference count of an object is illegal for the current state of the object.
 Each time a driver uses a pointer to an object the driver calls a kernel routine
 to increment the reference count of the object. When the driver is done with the
 pointer the driver calls another kernel routine to decrement the reference count.
 Drivers must match calls to the increment and decrement routines. This bugcheck
 can occur because an object's reference count goes to zero while there are still
 open handles to the object, in which case the fourth parameter indicates the number
 of opened handles. It may also occur when the objects reference count drops below zero
 whether or not there are open handles to the object, and in that case the fourth parameter
 contains the actual value of the pointer references count.

Debugging Details:
------------------

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0x18

PROCESS_NAME:  System

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER:  from fffff803a4b8a683 to fffff803a4b66ca0

STACK_TEXT: 
ffffd000`270e36d8 fffff803`a4b8a683 : 00000000`00000018 00000000`00000000 ffffe000`a640e200 00000000`00000002 : nt!KeBugCheckEx
ffffd000`270e36e0 fffff803`a4e3d1d5 : ffffe000`9af3e840 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x134c3
ffffd000`270e3720 fffff803`a4b724b3 : 00000000`00000000 00000000`0000afd1 fffff803`a4cc8240 00000000`00005030 : nt!NtClose+0x205
ffffd000`270e3840 fffff803`a4b6a900 : fffff800`9b8355e4 ffffe000`a5ea2360 00000000`0000afd1 00000000`00000005 : nt!KiSystemServiceCopyEnd+0x13
ffffd000`270e39d8 fffff800`9b8355e4 : ffffe000`a5ea2360 00000000`0000afd1 00000000`00000005 00000000`00000005 : nt!KiServiceLinkage
ffffd000`270e39e0 fffff800`9b837ee0 : ffffe000`a5ea2360 00000000`00000000 ffffe000`a558a180 00000000`00000000 : afd!AfdFreeEndpointResources+0x6c34
ffffd000`270e3a80 fffff800`9b802027 : ffffe000`a5ea2490 fffff800`9b827700 ffffe000`a558a040 fffff803`a4ac6c59 : afd!AfdFreeEndpointTditl+0x20
ffffd000`270e3ab0 fffff803`a4ac33ac : ffffe000`9f3f7e50 ffffe000`9f3f7080 00000000`00000000 ffffe000`a254e050 : afd!AfdDoWork+0x77
ffffd000`270e3ae0 fffff803`a4ac36bc : fffff803`a4b24f90 fffff803`a4ac332c ffffe000`9f3f7080 fffff803`a4cc8340 : nt!IopProcessWorkItem+0x80
ffffd000`270e3b50 fffff803`a4b1636c : ffffe000`a5f80370 ffffe000`a558a040 00000000`00000080 ffffe000`a558a040 : nt!ExpWorkerThread+0x28c
ffffd000`270e3c00 fffff803`a4b6d2c6 : ffffd001`e0ddc180 ffffe000`a558a040 ffffe000`9af5d040 ffffc000`dc497ed0 : nt!PspSystemThreadStartup+0x58
ffffd000`270e3c60 00000000`00000000 : ffffd000`270e4000 ffffd000`270de000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND:  kb

FOLLOWUP_IP:
afd!AfdFreeEndpointResources+6c34
fffff800`9b8355e4 488b8300010000  mov     rax,qword ptr [rbx+100h]

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  afd!AfdFreeEndpointResources+6c34

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: afd

IMAGE_NAME:  afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5387f4e5

IMAGE_VERSION:  6.3.9600.17194

BUCKET_ID_FUNC_OFFSET:  6c34

FAILURE_BUCKET_ID:  0x18_OVER_DEREFERENCE_afd!AfdFreeEndpointResources

BUCKET_ID:  0x18_OVER_DEREFERENCE_afd!AfdFreeEndpointResources

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x18_over_dereference_afd!afdfreeendpointresources

FAILURE_ID_HASH:  {998108e8-bfdc-06ae-8a25-7e8e223214bd}

Followup: MachineOwner
---------

2: kd> lmvm afd
start             end                 module name
fffff800`9b800000 fffff800`9b892000   afd        (pdb symbols)          c:\symbols\afd.pdb\573AECD2398440D5AF663DECF64B2AF72\afd.pdb
    Loaded symbol image file: afd.sys
    Mapped memory image file: c:\symbols\afd.sys\5387F4E592000\afd.sys
    Image path: \SystemRoot\system32\drivers\afd.sys
    Image name: afd.sys
    Timestamp:        Fri May 30 11:03:01 2014 (5387F4E5)
    CheckSum:         000970DE
    ImageSize:        00092000
    File version:     6.3.9600.17194
    Product version:  6.3.9600.17194
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft Windows Operating System
    InternalName:     afd.sys
    OriginalFilename: afd.sys
    ProductVersion:   6.3.9600.17194
    FileVersion:      6.3.9600.17194 (winblue_gdr.140529-1934)
    FileDescription:  Ancillary Function Driver for WinSock
    LegalCopyright:   Microsoft Corporation. All rights reserved.

Best regards

I forgot to mention that my drive is whole encrypted by BitLocker. When I did the Driver versifier test a BSOD (PAGE_FAULT_IN_NONPAGED_AREA) appeared before even startup. I will try to backup and decrypt the whole drive, scan for bad sectors and try again.

Thank you very much, I uninstalled all my network drives and download their manufacturer's drivers. Will report if anything happens again.