So heres my deal. I got a Win2k Server (all updates), and have a PhatNoise USB 1 HD (10 gigs of music), and after installing Kensington Bluetooth USB thing, and only immediately afterwards, when USB drive is ejected, system goes to a memory dump. 0x000000c2 and some other crap so tried the MS Debugger see what file is killing me.
So heres my Kernel Debugger output for the memory.dmp file... I dont get most of it, and Im sure that most people wont, so please forward to whoever knows how to handle this...
Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.
C:\Documents and Settings\Damian>i386kd -y c:\winnt\symbols -z c:\winnt\memory.d
mp
Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [c:\winnt\memory.dmp]
Kernel Complete Dump File: Full address space is available
Symbol search path is: c:\winnt\symbols
Executable search path is:
*** WARNING: symbols timestamp is wrong 0x4344ec59 0x427b58bb for ntoskrnl.exe
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Kernel base = 0x80400000 PsLoadedModuleList = 0x80481580
Debug session time: Tue Jan 17 09:35:07.467 2006 (GMT-8)
System Uptime: 0 days 0:04:57.213
*** WARNING: symbols timestamp is wrong 0x4344ec59 0x427b58bb for ntoskrnl.exe
Loading Kernel Symbols
................................................................................
..............................
Loading unloaded module list
.............
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {40, 0, 80000000, 0}
Probably caused by : ntoskrnl.exe ( nt!pIoQueryBusDescription+12e )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQ
L level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000040, Attempt to free usermode address to kernel pool
Arg2: 00000000, Starting address
Arg3: 80000000, Start of system address space
Arg4: 00000000, 0
Debugging Details:
------------------
FAULTING_IP:
nt!pIoQueryBusDescription+12e
804a602a c20400 ret 0x4
BUGCHECK_STR: 0xc2_40
DEFAULT_BUCKET_ID: DRIVER_FAULT
LAST_CONTROL_TRANSFER: from 8046ac4d to 8046bb4b
STACK_TEXT:
eb4c7ba0 8046ac4d 00000000 8046aae4 e47dfea8 nt!MiFreePoolPages+0x139
eb4c7bcc 8046aaef 00000000 00000000 eb28c8da nt!ExFreePoolWithTag+0x19b
eb4c7c0c 804a602a eb4c7c7c e47dfea8 805322da nt!ExFreePoolWithTag+0x3d
eb4c7cb4 8050d3b8 804019d8 851e5a30 00000000 nt!pIoQueryBusDescription+0x12e
eb4c7d78 80416bfa 85152ca8 00000000 00000000 nt!PiProcessQueryRemoveAndEject+0x9
50
eb4c7da8 80454ab2 85152ca8 00000000 00000000 nt!ExpWorkerThread+0xae
eb4c7ddc 804692a2 80416b4c 80000001 00000000 nt!PsGetVersion+0x40
eb4c7df0 00000000 00000000 00000000 00000000 nt!RtlCompareMemory+0x22
FOLLOWUP_IP:
nt!pIoQueryBusDescription+12e
804a602a c20400 ret 0x4
SYMBOL_STACK_INDEX: 3
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!pIoQueryBusDescription+12e
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4344ec59
STACK_COMMAND: kb
FAILURE_BUCKET_ID: 0xc2_40_nt!pIoQueryBusDescription+12e
BUCKET_ID: 0xc2_40_nt!pIoQueryBusDescription+12e
Followup: MachineOwner
---------
kd>
So heres my Kernel Debugger output for the memory.dmp file... I dont get most of it, and Im sure that most people wont, so please forward to whoever knows how to handle this...
Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.
C:\Documents and Settings\Damian>i386kd -y c:\winnt\symbols -z c:\winnt\memory.d
mp
Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [c:\winnt\memory.dmp]
Kernel Complete Dump File: Full address space is available
Symbol search path is: c:\winnt\symbols
Executable search path is:
*** WARNING: symbols timestamp is wrong 0x4344ec59 0x427b58bb for ntoskrnl.exe
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Kernel base = 0x80400000 PsLoadedModuleList = 0x80481580
Debug session time: Tue Jan 17 09:35:07.467 2006 (GMT-8)
System Uptime: 0 days 0:04:57.213
*** WARNING: symbols timestamp is wrong 0x4344ec59 0x427b58bb for ntoskrnl.exe
Loading Kernel Symbols
................................................................................
..............................
Loading unloaded module list
.............
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {40, 0, 80000000, 0}
Probably caused by : ntoskrnl.exe ( nt!pIoQueryBusDescription+12e )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQ
L level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000040, Attempt to free usermode address to kernel pool
Arg2: 00000000, Starting address
Arg3: 80000000, Start of system address space
Arg4: 00000000, 0
Debugging Details:
------------------
FAULTING_IP:
nt!pIoQueryBusDescription+12e
804a602a c20400 ret 0x4
BUGCHECK_STR: 0xc2_40
DEFAULT_BUCKET_ID: DRIVER_FAULT
LAST_CONTROL_TRANSFER: from 8046ac4d to 8046bb4b
STACK_TEXT:
eb4c7ba0 8046ac4d 00000000 8046aae4 e47dfea8 nt!MiFreePoolPages+0x139
eb4c7bcc 8046aaef 00000000 00000000 eb28c8da nt!ExFreePoolWithTag+0x19b
eb4c7c0c 804a602a eb4c7c7c e47dfea8 805322da nt!ExFreePoolWithTag+0x3d
eb4c7cb4 8050d3b8 804019d8 851e5a30 00000000 nt!pIoQueryBusDescription+0x12e
eb4c7d78 80416bfa 85152ca8 00000000 00000000 nt!PiProcessQueryRemoveAndEject+0x9
50
eb4c7da8 80454ab2 85152ca8 00000000 00000000 nt!ExpWorkerThread+0xae
eb4c7ddc 804692a2 80416b4c 80000001 00000000 nt!PsGetVersion+0x40
eb4c7df0 00000000 00000000 00000000 00000000 nt!RtlCompareMemory+0x22
FOLLOWUP_IP:
nt!pIoQueryBusDescription+12e
804a602a c20400 ret 0x4
SYMBOL_STACK_INDEX: 3
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!pIoQueryBusDescription+12e
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4344ec59
STACK_COMMAND: kb
FAILURE_BUCKET_ID: 0xc2_40_nt!pIoQueryBusDescription+12e
BUCKET_ID: 0xc2_40_nt!pIoQueryBusDescription+12e
Followup: MachineOwner
---------
kd>