TechSpot

Bad_pool_caller (c2)

By catherinesc
Oct 6, 2008
  1. My XP machine has been rebooting itself after recovering from a serious error. I am never using the machine when this happens. Because several of us use the machine I don't really have a time of reference for when it started, but suspect it started with my new monitor. I believe I had to install new drivers.
    Can someone help me read this to see if I am even close?
    Thanks!

    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp2_gdr.070227-2254
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
    Debug session time: Sat Oct 4 13:02:33.855 2008 (GMT-7)
    System Uptime: 4 days 9:59:49.142
    Loading Kernel Symbols
    ....................................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ..................................................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C2, {7, cd4, 4100602, e32db3b8}

    Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+2a3 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    BAD_POOL_CALLER (c2)
    The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
    Arguments:
    Arg1: 00000007, Attempt to free pool which was already freed
    Arg2: 00000cd4, (reserved)
    Arg3: 04100602, Memory contents of the pool block
    Arg4: e32db3b8, Address of the block of pool being deallocated

    Debugging Details:
    ------------------


    POOL_ADDRESS: e32db3b8

    FREED_POOL_TAG: IoNm

    BUGCHECK_STR: 0xc2_7_IoNm

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: explorer.exe

    LAST_CONTROL_TRANSFER: from 8054a583 to 804f9deb

    STACK_TEXT:
    ab1832c8 8054a583 000000c2 00000007 00000cd4 nt!KeBugCheckEx+0x1b
    ab183318 80582037 e32db3b8 00000000 8a9c18e8 nt!ExFreePoolWithTag+0x2a3
    ab183400 805bddc0 8a9c1900 00000000 89dfda28 nt!IopParseDevice+0xadb
    ab183478 805ba448 00000000 ab1834b8 00000040 nt!ObpLookupObjectName+0x53c
    ab1834cc 80574ec1 00000000 00000000 00000001 nt!ObOpenObjectByName+0xea
    ab183548 80575838 00fde984 00100020 00fde93c nt!IopCreateFile+0x407
    ab1835a4 80578ff7 00fde984 00100020 00fde93c nt!IoCreateFile+0x8e
    ab1835e4 8054086c 00fde984 00100020 00fde93c nt!NtOpenFile+0x27
    ab1835e4 7c90eb94 00fde984 00100020 00fde93c nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00fdebd0 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!ExFreePoolWithTag+2a3
    8054a583 8b45f8 mov eax,dword ptr [ebp-8]

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: nt!ExFreePoolWithTag+2a3

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrpamp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

    FAILURE_BUCKET_ID: 0xc2_7_IoNm_nt!ExFreePoolWithTag+2a3

    BUCKET_ID: 0xc2_7_IoNm_nt!ExFreePoolWithTag+2a3

    Followup: MachineOwner
    ---------

    0: kd> !amalyze -v
    No export amalyze found
     
  2. Achilles_ny

    Achilles_ny TS Rookie

    You're on the right track. It's likely a driver issue; hit F8 just after the BIOS loads to enter Safe Mode, inside Device Manager, you should be able to uninstall the errant driver.
     
  3. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    0C2 errors are caused either by a faulty driver or buggy software. In what you posted it cited the driver ntkrpamp.exe which is a core Windows driver which you definitely don't want to delete.

    So...

    1. Run chkdsk in your Run option in your start-up menu.

    2. Run vieus/malware scan; could be with that you might have picked something up because several of you use it.

    * Let us know of the results.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...