Windows – Nonpaged Pool Leak – NDnd Tag – Windows 8.1 64-bit

memorymemory leakswindows 8.1

I have a huge memory leak with the tag "NDnd", which eventually occupies my whole ram (8GB).

Findstr shows me, that hiberfil.sys, pagefile.sys, swapfile.sys or ndis.sys could be the problem.

I'm pretty sure it is ndis.sys, since the nonpaged pool gets bigger with any kind of network activity.
How do I fix this leak?

I have a Windows 8.1 Pro 64-bit system, if it helps.

Best Answer

You must use xperf to trace what causes the usage. Install the WPT, open a cmd.exe as admin and run this:

xperf -on PROC_THREAD+LOADER+POOL -stackwalk PoolAlloc+PoolFree+PoolAllocSession+PoolFreeSession -BufferSize 1024 -MinBuffers 256 -MaxBuffers 256 -MaxFile 256 -FileMode Circular && timeout -1 && xperf -d pool.etl

capture 30s of the grow. Open the ETL with WPA.exe, add the Pool graphs to the analysis pane.

Put the pooltag column at first place and add the stack column. Now load the symbols inside WPA.exe and expand the stack of the NDnD tag. Now find other 3rd party drivers which use this tag. Look for driver updates

Related Solutions

Macos – How to diagnose ballooning OS X kernel_task and wired memory usage

To investigate why the kernel uses more memory than usual, you can use different tools.

Run Activity Monitor to check which processes using the most of memory, so it's either a kernel_task, not any other task using more memory than usual (then consider killing it).
Run in Terminal vm_stat 1 to see real-time memory statistics and if your memory is really increasing every second.
Run fs_usage (as root) tool to monitor system calls and page faults in real-time.
To check the sum of dirty/anonymous allocations of multiple processes run in Terminal:
```
sudo footprint -all -categories -swapped -collapseSharing
```
It would gathers memory information such as how much it was swapped (per user or kernel memory).
Further more, if you think it's kernel which is using most memory, try zprint tool:
```
sudo zprint -t -s | head -n20
```
It will show the information about kernel zones

If you'd like to force disk cache to be purged (to free up some memory), you may try:

sync && sudo purge

Windows 8.1 – Non paged Pool – ATI 6950 Memory Leak

Okay, I've sorted this for myself now. It is not a solution but more of a fix. I've noticed that if I run BF4.exe in compatibility mode with Windows 8 I don't get these memory leaks.

So if you're experiencing this as well, try the following.

Go to C:\Program Files (x86)\Origin Games\Battlefield 4
Right click BF4.exe (or BF4_x85.exe of you run it in 32-bit)
Select the Compatibility menu
Check "Run this program in compatibility mode for: " and Select Windows 8.

Press OK and try it out. Hope that this sorts it for some people as well.

Best Answer

Related Solutions

Macos – How to diagnose ballooning OS X kernel_task and wired memory usage

Windows 8.1 – Non paged Pool – ATI 6950 Memory Leak

Related Question