My setup has frequent BSOD crashes, cause by the eGPU Thunderbolt disconnection.
Here’s some insight, analysed thanks to Claude :
BugCheck 0x18 REFERENCE_BY_POINTER caused by nvlddmkm.sys over-dereferencing a kernel object during PnP device event completion after Thunderbolt 4 eGPU micro-disconnections. The crash occurs in nt!ObfDereferenceObjectWithTag after nt!PnpCompleteDeviceEvent, with nvlddmkm.sys already unloaded at crash time. WER identifies nvlddmkm.sys as BrokenDriverName in all dumps.
DETAILS :
System Configuration
- Laptop: Lenovo ThinkPad (Tiger Lake-LP)
- OS: Windows 11 24H2, Build 26100.1 (ge_release), AMD64
- BIOS Revision: 1.81.0.0
- Integrated GPU: Intel Iris Xe Graphics (igdkmdn64.sys)
- eGPU: NVIDIA GeForce RTX 4060 Ti
- NVIDIA Driver: 32.0.15.9579 (April 3, 2026)
- eGPU Enclosure: TBX-750FA (vendor: TUL), 1000W PSU
- Thunderbolt Controller: Intel Tiger Lake-LP TB4 NHI #1 (PCI\VEN_8086&DEV_9A1D)
- Thunderbolt Driver: 1.41.1423.0 (WHQL, January 2024)
- Thunderbolt NVM Firmware: 30:0
- HVCI (Memory Integrity): Enabled (HalpHvciEnabled=1)
- Hyper-V: VBS active for HVCI, no VMs
- Peripherals: None connected to eGPU enclosure (USB, LAN, display all disconnected — only GPU card remains)
Crash Details (WinDbg !analyze -v)
Primary Crash — BugCheck 0x18 (June 19, 2026)
REFERENCE_BY_POINTER (18)
Arg1: 0000000000000000 (Object type)
Arg2: ffffd109ad544060 (Object being dereferenced)
Arg3: 0000000000000002 (Expected refcount)
Arg4: ffffffffffffffff (Actual refcount = -1, over-dereference)
Failure.Bucket: 0x18_OVER_DEREFERENCE_nt!ObfDereferenceObjectWithTag
Failure.Hash: {4139309c-4e9f-52f0-ac5e-4041e7a86a20}
STACK_TEXT:
nt!KeBugCheckEx
nt!ObfDereferenceObjectWithTag+0x7a <-- CRASH: refcount went to -1
nt!PnpCompleteDeviceEvent+0x94 <-- completing PnP device event
nt!PnpDeviceEventWorker+0x142 <-- PnP worker thread
nt!ExpWorkerThread+0x4bb
nt!PspSystemThreadStartup+0x5a
nt!KiStartSystemThread+0x34
PROCESS_NAME: System
SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+7a
IMAGE_NAME: ntkrnlmp.exe
Secondary Crash — BugCheck 0x7E (June 18, 2026)
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (0x1000007E)
Exception: STATUS_ACCESS_VIOLATION (0xC0000005)
Faulting address: ntoskrnl.exe+0x9C5A0E
BrokenDriverName: nvlddmkm.sys
nvlddmkm.sys: UNLOADED at crash time (present in unloaded drivers list)
Call stack: 100% ntoskrnl.exe
Crash Pattern
All crashes follow the same sequence:
- Thunderbolt micro-disconnection (2-3 seconds, no RTD3 involved)
- nhi Event 9003: “Thunderbolt device is disconnected” (TBX-750FA / TUL)
- No nhi Event 9007 (RTD3 entry) — this is NOT a power management issue
- nvlddmkm.sys unloads (along with GPU audio drivers: nvhda64v.sys, HDAudBus.sys, portcls.sys, ks.sys, drmk.sys)
- Kernel object reference corruption — nvlddmkm’s surprise removal handler does not properly balance object reference counts
- BSOD when ntoskrnl PnP subsystem accesses the corrupted object:
- 0x18 REFERENCE_BY_POINTER (most common — 20 occurrences)
- 0x7E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (1 occurrence)
- 0x0A IRQL_NOT_LESS_OR_EQUAL (1 occurrence)
Evidence
Thunderbolt Disconnect Statistics (nhi event log)
| Date | TB Disconnects (9003) | RTD3 Events (9007) | nvlddmkm EID:14 | BSOD |
|---|---|---|---|---|
| June 17 (before RTD3 fix) | 9+ cycles | 9+ | 1 | 1 (0x18) |
| June 18 (RTD3 disabled) | 5 micro-disconnects | 0 | 0 | 1 (0x7E) |
| June 19 (RTD3 disabled) | 16 micro-disconnects | 0 | 3 | 1 (0x18) |
Micro-disconnections are worsening (5 → 16 per day) despite RTD3 being disabled.
Unloaded Module Evidence (from triage dumps)
In both analyzed triage dumps (PAGEDU64 format), nvlddmkm.sys is:
- ABSENT from the loaded module list (282-284 modules)
- PRESENT in the unloaded drivers list (32 entries)
- Identified as BrokenDriverName by WER
Monthly Totals (May 18 - June 19, 2026)
- 21 BSODs (19× 0x18, 1× 0x7E, 1× 0x0A)
- 50 nvlddmkm Event ID 14 (GPU Reset Required)
- ~193+ LiveKernelEvents (0x1B0, failed GPU reset attempts)
- 2733+ nhi events (Thunderbolt state changes)
Mitigations Already Attempted
| # | Mitigation | Result |
|---|---|---|
| 1 | TdrDelay=60s, RmGpuPowerManagement=0 (registry) | No effect |
| 2 | Disable PCI Express Link State Power Management | No effect |
| 3 | Reinstall NVIDIA driver (3 different versions) | No effect |
| 4 | Disable Hyper-V (bcdedit) | No effect |
| 5 | Change eGPU PSU (1000W) | No effect |
| 6 | Disconnect all peripherals from eGPU enclosure | No effect |
| 7 | Update Thunderbolt driver → 1.41.1423.0 WHQL | No effect alone |
| 8 | Disable RTD3 on Thunderbolt controller | Eliminated RTD3-triggered disconnects, but micro-disconnects persist |
| 9 | Disable power management on all devices (CIM script) | Applied, micro-disconnects persist |
| 10 | Disable USB Selective Suspend | Applied, micro-disconnects persist |
Related Report
A very similar crash pattern was reported on NVIDIA Developer Forums on June 18, 2025:
- System: Dell Precision 5690, NVIDIA RTX 2000 Ada, Windows 11 24H2 (build 26100)
- Trigger: Disconnecting from docking station (Thunderbolt/USB-C)
- BugCheck: VIDEO_DXGKRNL_FATAL_ERROR (0x113, subtype 0x19 = UNEXPECTED_DEFERRED_DESTRUCTION)
- Failure bucket:
0x113_19_nvlddmkm!unknown_function - Stack:
nt!PnpDeviceEventWorker→nt!PnpSurpriseRemoveLockedDeviceNode→dxgkrnl!DpiFdoHandleSurpriseRemoval→nvlddmkm+0x1872f11 - Link: Nvlddmkm blue screen with stop code VIDEO_DXGKRNL_FATAL_ERROR (Windows 11 24H2)
Both cases share the same entry point (PnpDeviceEventWorker) and trigger (Thunderbolt/USB-C disconnect), but crash at different stages of the PnP processing.
Suspected Root Cause
nvlddmkm.sys does not properly handle Thunderbolt surprise removal. When the Thunderbolt link drops briefly (micro-disconnect, 2-3 seconds), the driver unloads but does not correctly balance kernel object reference counts. This leaves corrupted references that cause ntoskrnl to crash during PnP event completion (PnpCompleteDeviceEvent → ObfDereferenceObjectWithTag with refcount = -1).
Requested Action
- Investigate nvlddmkm.sys surprise removal handler for object reference count imbalance when Thunderbolt eGPU disconnects unexpectedly
- Test with RTX 4060 Ti in Thunderbolt 4 eGPU enclosure (TBX-750FA) on Windows 11 24H2
- Cross-reference with the Dell Precision 5690 case (same PnP crash path, different BugCheck)