TechSpot

Windbg BSOD analysis needed

By okozar
Jun 21, 2008
  1. Hi, I've this somewhat older batch of computer parts sitting around for a while and I finally got around to slapping them and a couple new ones together for a stronger (secondary) computer. At the same time I decided to make the move for my new computer and this older newer one to Vista X64 Ultimate

    The Computer has all the vista updates..
    All clocks are stock
    x2 4200
    x1800xt 512
    1 GB PC 3200 Kingston Hyper-x (2x512mb) (Ya I know for Vista this badly needs to move to two
    DFI Lanparty NF4 UT-D Mobo

    I slapped this together on the 17th (last Tuesday night) and have since received
    NINE! BSOD :(

    Anyway here they are, I've read 80% of Blue Screens are caused by drivers so I guess I find it alarming that as far as I can tell these are mostly program, not driver related. The first one clearly appears to be the Hard drive as far as I can tell, but it doesn't concern me since it's A) Brand new and B) only occurred once.


    17A
    ....
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 24, {1904aa, fffffa600179d6e8, fffffa600179d0c0, fffffa60011109bc}

    Probably caused by : Ntfs.sys ( Ntfs!EfsCleanup+4c )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
    Arguments:
    Arg1: 00000000001904aa
    Arg2: fffffa600179d6e8
    Arg3: fffffa600179d0c0
    Arg4: fffffa60011109bc

    Debugging Details:
    ------------------


    EXCEPTION_RECORD: fffffa600179d6e8 -- (.exr 0xfffffa600179d6e8)
    ExceptionAddress: fffffa60011109bc (Ntfs!EfsCleanup+0x000000000000004c)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 0000000000000001
    Parameter[1]: 000000000030e000
    Attempt to write to address 000000000030e000

    CONTEXT: fffffa600179d0c0 -- (.cxr 0xfffffa600179d0c0)
    rax=0000000000000000 rbx=0000000000300000 rcx=000000004c5828f9
    rdx=0000000000300000 rsi=fffff88000aaed68 rdi=000000000030e000
    rip=fffffa60011109bc rsp=fffffa600179d920 rbp=fffffa8001d23180
    r8=0000000000000004 r9=0000000000000019 r10=ffffffffffee4bc0
    r11=00000000000007ff r12=0000000000000000 r13=0000000000000000
    r14=fffffa8002d29cc0 r15=fffffa8001d23180
    iopl=0 nv up ei pl nz ac pe nc
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010212
    Ntfs!EfsCleanup+0x4c:
    fffffa60`011109bc f3aa rep stos byte ptr [rdi]
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    PROCESS_NAME: System

    CURRENT_IRQL: 0

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a30080
    000000000030e000

    BUGCHECK_STR: 0x24

    EXCEPTION_DOESNOT_MATCH_CODE: This indicates a hardware error.
    Instruction at fffffa60011109bc does not read/write to 000000000030e000

    LAST_CONTROL_TRANSFER: from fffffa60010fa4e9 to fffffa60011109bc

    STACK_TEXT:
    fffffa60`0179d920 fffffa60`010fa4e9 : fffffa60`0179d9e8 00000000`00000703 00000000`00000018 fffff880`6f66744e : Ntfs!EfsCleanup+0x4c
    fffffa60`0179d950 fffffa60`0100d579 : 00000000`00000000 00000000`00000001 00000000`00000000 fffff880`00aaeaa0 : Ntfs! ?? ::NNGAKEGL::`string'+0x47fd
    fffffa60`0179d990 fffffa60`0100d9d3 : 00000000`00000000 fffff880`00aaebd0 fffff880`00aaeaa0 fffffa60`0179da88 : Ntfs!NtfsPrepareFcbForRemoval+0x89
    fffffa60`0179d9e0 fffffa60`010bd6d8 : fffffa80`02d29cc0 fffffa80`01d23180 fffff880`07607010 fffff880`07607448 : Ntfs!NtfsTeardownFromLcb+0x393
    fffffa60`0179da80 fffffa60`01014b92 : fffffa80`02d29cc0 fffffa60`0179dc70 00000000`00000000 fffff880`07607010 : Ntfs!NtfsTeardownStructures+0xd8
    fffffa60`0179db10 fffffa60`010c8e18 : fffffa60`0179dc70 fffff800`019998a0 fffff880`07607010 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
    fffffa60`0179db50 fffffa60`010b1e0e : fffffa80`02d29cc0 fffff880`07607140 fffff880`07607010 fffffa80`01d23180 : Ntfs!NtfsCommonClose+0x348
    fffffa60`0179dc20 fffff800`01869066 : 00000000`00000000 fffff800`01a05800 fffff800`01999801 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15e
    fffffa60`0179dcf0 fffff800`01a7fde3 : fffffa60`01062ee8 00000000`004e0046 fffffa80`00c81720 00000000`00000080 : nt!ExpWorkerThread+0x11a
    fffffa60`0179dd50 fffff800`01896536 : fffffa60`005ec180 fffffa80`00c81720 fffffa60`005f5d40 00000000`00000001 : nt!PspSystemThreadStartup+0x57
    fffffa60`0179dd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


    FOLLOWUP_IP:
    Ntfs!EfsCleanup+4c
    fffffa60`011109bc f3aa rep stos byte ptr [rdi]

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: Ntfs!EfsCleanup+4c

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: Ntfs

    IMAGE_NAME: Ntfs.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 479190d1

    STACK_COMMAND: .cxr 0xfffffa600179d0c0 ; kb

    FAILURE_BUCKET_ID: X64_0x24_CODE_ADDRESS_MISMATCH_Ntfs!EfsCleanup+4c

    BUCKET_ID: X64_0x24_CODE_ADDRESS_MISMATCH_Ntfs!EfsCleanup+4c

    Followup: MachineOwner
    ---------
     
  2. okozar

    okozar TS Rookie Topic Starter

    18A
    ....
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck A, {4, c, 0, fffff80001868f3e}

    Probably caused by : fileinfo.sys ( fileinfo!FIPfInterfaceOpen+803 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 0000000000000004, memory referenced
    Arg2: 000000000000000c, IRQL
    Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff80001868f3e, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a31080
    0000000000000004

    CURRENT_IRQL: c

    FAULTING_IP:
    nt!ExpReleaseResourceForThreadLite+16e
    fffff800`01868f3e 8b4e04 mov ecx,dword ptr [rsi+4]

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0xA

    PROCESS_NAME: svchost.exe

    TRAP_FRAME: fffffa600643ac40 -- (.trap 0xfffffa600643ac40)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffff80001a33440 rbx=01c8d1c91abb2851 rcx=fffff8000197ccf0
    rdx=0000000000000000 rsi=fffffa8001250210 rdi=0000000000000000
    rip=fffff80001868f3e rsp=fffffa600643add0 rbp=0000000000000000
    r8=0000000000000000 r9=01c8d1c91abb2801 r10=0000000000000070
    r11=0000000000008000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei pl zr na po nc
    nt!ExpReleaseResourceForThreadLite+0x16e:
    fffff800`01868f3e 8b4e04 mov ecx,dword ptr [rsi+4] ds:0008:fffffa80`01250214=????????
    Resetting default scope

    LAST_CONTROL_TRANSFER: from fffff8000185d12e to fffff8000185d390

    STACK_TEXT:
    fffffa60`0643aaf8 fffff800`0185d12e : 00000000`0000000a 00000000`00000004 00000000`0000000c 00000000`00000000 : nt!KeBugCheckEx
    fffffa60`0643ab00 fffff800`0185c00b : 00000000`00000000 fffffa80`01638db0 fffffa80`01638e00 fffffa80`01334860 : nt!KiBugCheckDispatch+0x6e
    fffffa60`0643ac40 fffff800`01868f3e : fffffa80`01f29010 00000000`00000000 01c85bd8`33275f11 01c85bd8`33275f11 : nt!KiPageFault+0x20b
    fffffa60`0643add0 fffffa60`01016c05 : fffffa60`0643afa0 00000000`00000000 fffffa60`0643af00 fffffa60`00a0a2ee : nt!ExpReleaseResourceForThreadLite+0x16e
    fffffa60`0643ae50 fffffa60`01018c04 : fffffa80`0159f470 00000000`00000000 fffffa80`03d27760 00000000`00000001 : Ntfs!NtfsCleanupIrpContext+0x3d5
    fffffa60`0643aea0 fffffa60`010cea8a : fffffa80`0159f470 fffffa80`0159f470 00000000`00000000 fffffa80`0159f400 : Ntfs!NtfsExtendedCompleteRequest+0xd4
    fffffa60`0643aee0 fffffa60`01017a46 : fffffa80`0159f470 fffffa80`03d27760 fffffa80`02b29401 fffffa80`01250200 : Ntfs!NtfsCommonSetInformation+0xe40
    fffffa60`0643afc0 fffffa60`00a07e17 : 00000000`00000801 fffffa80`03d27760 fffffa80`00ceba01 fffffa80`01d15180 : Ntfs!NtfsFsdSetInformation+0x316
    fffffa60`0643b070 fffffa60`00a070dd : fffffa80`00d02440 fffffa80`03d27760 fffffa80`01f2a400 00000000`00000000 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x227
    fffffa60`0643b0e0 fffff800`01aac8df : 00000000`00000028 fffffa80`01250260 00000000`00000028 fffffa80`00ceba00 : fltmgr!FltpDispatch+0xcd
    fffffa60`0643b140 fffff800`0185ce33 : ffffffff`80000978 fffffa80`03d89060 fffffa60`0643b498 fffffa60`00000028 : nt!NtSetInformationFile+0x5fb
    fffffa60`0643b270 fffff800`0185d340 : fffffa60`00a57353 00000000`00000000 00000000`00000000 fffffa80`02b299a0 : nt!KiSystemServiceCopyEnd+0x13
    fffffa60`0643b478 fffffa60`00a57353 : 00000000`00000000 00000000`00000000 fffffa80`02b299a0 00000000`00000000 : nt!KiServiceLinkage
    fffffa60`0643b480 fffff800`01b62097 : fffffa80`00c86501 fffff800`01864f01 00000000`00000000 fffffa80`02b299a0 : fileinfo!FIPfInterfaceOpen+0x803
    fffffa60`0643b600 fffff800`01c0a907 : 00000000`00000020 ffffffff`ffe91ca0 fffffa60`0643b718 fffffa80`00000000 : nt!PfpOpenHandleCreate+0x117
    fffffa60`0643b6d0 fffff800`01c0cc26 : 00000000`00000000 fffff880`09140178 fffff880`0913e000 fffffa60`00000060 : nt!PfpFileBuildReadSupport+0xe7
    fffffa60`0643b7c0 fffff800`01c36609 : fffff880`00000000 00000000`00000005 00000000`000000af 00000000`00000000 : nt!PfpPrefetchFilesTrickle+0x126
    fffffa60`0643b8c0 fffff800`01c368c2 : 00000000`00000000 fffffa60`0643bca0 fffffa60`0643ba08 fffff880`0913e001 : nt!PfpPrefetchRequestPerform+0x2f9
    fffffa60`0643b960 fffff800`01c36b26 : fffffa60`0643ba08 00000000`00000001 fffffa80`039d0930 00000000`00000000 : nt!PfpPrefetchRequest+0x171
    fffffa60`0643b9d0 fffff800`01c49258 : 00000000`00000000 00000000`00000004 fffffa80`00d35000 00000000`00000001 : nt!PfSetSuperfetchInformation+0x1a5
    fffffa60`0643bab0 fffff800`0185ce33 : fffffa80`03d89060 00000000`00000000 00000000`00000001 00000000`05195e50 : nt!NtSetSystemInformation+0x8fb
    fffffa60`0643bc20 00000000`777770ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0343f7b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777770ea


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    fileinfo!FIPfInterfaceOpen+803
    fffffa60`00a57353 8a8c2488010000 mov cl,byte ptr [rsp+188h]

    SYMBOL_STACK_INDEX: d

    SYMBOL_NAME: fileinfo!FIPfInterfaceOpen+803

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: fileinfo

    IMAGE_NAME: fileinfo.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 47919323

    FAILURE_BUCKET_ID: X64_0xA_fileinfo!FIPfInterfaceOpen+803

    BUCKET_ID: X64_0xA_fileinfo!FIPfInterfaceOpen+803

    Followup: MachineOwner
    ---------
     
  3. okozar

    okozar TS Rookie Topic Starter

    18B
    ....
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1E, {ffffffffc0000005, fffff80001db338a, 1, 38}

    Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29317 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff80001db338a, The address that the exception occurred at
    Arg3: 0000000000000001, Parameter 0 of the exception
    Arg4: 0000000000000038, Parameter 1 of the exception

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP:
    +fffff80001db338a
    fffff800`01db338a ?? ???

    EXCEPTION_PARAMETER1: 0000000000000001

    EXCEPTION_PARAMETER2: 0000000000000038

    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a80080
    0000000000000038

    CUSTOMER_CRASH_COUNT: 2

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0x1E

    PROCESS_NAME: hl2.exe

    CURRENT_IRQL: 0

    TRAP_FRAME: fffffa6005dc79a0 -- (.trap 0xfffffa6005dc79a0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
    rdx=00000000000007ff rsi=fffff800019cb680 rdi=0000000000000000
    rip=fffff80001db338a rsp=fffffa6005dc7b30 rbp=fffffa80036e1440
    r8=0000000000000000 r9=0000000000007e00 r10=0000000000000008
    r11=fffffa8000fc1794 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei ng nz na po nc
    fffff800`01db338a ?? ???
    Resetting default scope

    LAST_CONTROL_TRANSFER: from fffff80001885e67 to fffff800018ac390

    STACK_TEXT:
    fffffa60`05dc71b8 fffff800`01885e67 : 00000000`0000001e ffffffff`c0000005 fffff800`01db338a 00000000`00000001 : nt!KeBugCheckEx
    fffffa60`05dc71c0 fffff800`018ac1e9 : fffffa60`05dc78f8 00000000`00000000 fffffa60`05dc79a0 fffffa80`03f83ca8 : nt! ?? ::FNODOBFM::`string'+0x29317
    fffffa60`05dc77c0 fffff800`018aafe5 : 00000000`00000001 fffffa60`0300c743 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xa9
    fffffa60`05dc79a0 fffff800`01db338a : 00000000`00000468 00000000`00400000 00000000`00000000 00000000`00000008 : nt!KiPageFault+0x1e5
    fffffa60`05dc7b30 00000000`00000468 : 00000000`00400000 00000000`00000000 00000000`00000008 fffff800`019cb680 :
    fffffa60`05dc7b98 00000000`00000000 : 00000000`00000000 fffffa60`05dc7ca0 fffffa80`036e1440 fffff800`01b27e38 : 0x1
    fffffa60`05dc7ba0 00000000`00000000 : fffffa60`05dc7ca0 fffffa80`036e1440 fffff800`01b27e38 00000000`00000000 : 0x0
    fffffa60`05dc7ba8 fffffa60`05dc7ca0 : fffffa80`036e1440 fffff800`01b27e38 00000000`00000000 fffff800`00000006 : 0x0
    fffffa60`05dc7bb0 fffffa80`036e1440 : fffff800`01b27e38 00000000`00000000 fffff800`00000006 00000000`00000001 : 0xfffffa60`05dc7ca0
    fffffa60`05dc7bb8 fffff800`01b27e38 : 00000000`00000000 fffff800`00000006 00000000`00000001 fffffa60`05dc7c00 : 0xfffffa80`036e1440
    fffffa60`05dc7bc0 fffff800`018abe33 : fffffa80`03f83bb0 00000000`00000000 00000000`00000000 fffffa80`036e1440 : nt!NtWaitForSingleObject+0x98
    fffffa60`05dc7c20 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt! ?? ::FNODOBFM::`string'+29317
    fffff800`01885e67 cc int 3

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+29317

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 479192b7

    FAILURE_BUCKET_ID: X64_0x1E_W_nt!_??_::FNODOBFM::_string_+29317

    BUCKET_ID: X64_0x1E_W_nt!_??_::FNODOBFM::_string_+29317

    Followup: MachineOwner
    ---------



    19A
    ...
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 19, {22, d00000, 0, 0}

    Probably caused by : win32k.sys ( win32k!UserDeleteW32Thread+6c )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    BAD_POOL_HEADER (19)
    The pool is already corrupt at the time of the current request.
    This may or may not be due to the caller.
    The internal pool links must be walked to figure out a possible cause of
    the problem, and then special pool applied to the suspect tags or the driver
    verifier to a suspect driver.
    Arguments:
    Arg1: 0000000000000022,
    Arg2: 0000000000d00000
    Arg3: 0000000000000000
    Arg4: 0000000000000000

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x19_22

    POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a48080
    0000000000d00000

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    PROCESS_NAME: RivaTuner.exe

    CURRENT_IRQL: 2

    LAST_CONTROL_TRANSFER: from fffff800018c3635 to fffff80001874390

    STACK_TEXT:
    fffffa60`06af4908 fffff800`018c3635 : 00000000`00000019 00000000`00000022 00000000`00d00000 00000000`00000000 : nt!KeBugCheckEx
    fffffa60`06af4910 fffff800`0195307b : fffff800`0181f000 00000000`00000000 fffff800`019b2160 fffff800`0187bfa9 : nt! ?? ::FNODOBFM::`string'+0x37e6
    fffffa60`06af4970 fffff960`00109da0 : fffffa80`018ba810 fffffa80`00c79930 fffffa80`00000000 fffffa80`016059e0 : nt!ExFreePoolWithTag+0x4bb
    fffffa60`06af4a20 fffff960`00108bad : fffffa80`016059e0 fffffa80`044e6660 fffffa80`016059e0 fffff900`c08bfc60 : win32k!UserDeleteW32Thread+0x6c
    fffffa60`06af4a50 fffff960`00104e90 : fffffa80`04527830 fffffa80`016059e0 00000000`00000000 00000000`00000000 : win32k!DereferenceW32Thread+0x15
    fffffa60`06af4a80 fffff800`01b1c877 : fffffa80`04527830 00000000`00000000 00000000`00000000 fffffa80`016059e0 : win32k!W32pThreadCallout+0x94
    fffffa60`06af4ab0 fffff800`01b1cd3d : 00000000`00000000 fffffa80`01605901 00000000`00000000 00000000`00000000 : nt!PspExitThread+0x523
    fffffa60`06af4b70 fffff800`01ad3c7a : 00000000`00000000 00000000`0000000c 00000000`7efdd000 fffff880`0000000c : nt!PspTerminateThreadByPointer+0x4d
    fffffa60`06af4bc0 fffff800`01873e33 : fffffa80`018ba810 fffffa80`016059e0 fffffa60`06af4ca0 00000000`7efdd000 : nt!NtTerminateProcess+0xfa
    fffffa60`06af4c20 00000000`77765d3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0007e598 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77765d3a


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    win32k!UserDeleteW32Thread+6c
    fffff960`00109da0 488b8bb0000000 mov rcx,qword ptr [rbx+0B0h]

    SYMBOL_STACK_INDEX: 3

    SYMBOL_NAME: win32k!UserDeleteW32Thread+6c

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME: win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 47c78e35

    FAILURE_BUCKET_ID: X64_0x19_22_win32k!UserDeleteW32Thread+6c

    BUCKET_ID: X64_0x19_22_win32k!UserDeleteW32Thread+6c

    Followup: MachineOwner
     
  4. okozar

    okozar TS Rookie Topic Starter

    19B
    ....
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {fffffa8004fc5ad0, 0, fffff8000194dc03, 0}


    Could not read faulting driver name
    Probably caused by : dxgkrnl.sys ( dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffffa8004fc5ad0, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff8000194dc03, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 0000000000000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a43080
    fffffa8004fc5ad0

    FAULTING_IP:
    nt!ExFreePoolWithTag+43
    fffff800`0194dc03 418b45f0 mov eax,dword ptr [r13-10h]

    MM_INTERNAL_CODE: 0

    CUSTOMER_CRASH_COUNT: 2

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0x50

    PROCESS_NAME: 3DMark06.exe

    CURRENT_IRQL: 0

    TRAP_FRAME: fffffa6007ded5e0 -- (.trap 0xfffffa6007ded5e0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=fffff88000000174 rcx=fffffa8004fc5ae0
    rdx=0000000000000000 rsi=fffffa8004326500 rdi=000000006d4d6956
    rip=fffff8000194dc03 rsp=fffffa6007ded770 rbp=0000000000000000
    r8=0000000000000003 r9=0000000000000175 r10=00000000005b5ac0
    r11=fffffa6007ded800 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei pl nz na pe nc
    nt!ExFreePoolWithTag+0x43:
    fffff800`0194dc03 418b45f0 mov eax,dword ptr [r13-10h] ds:ffffffff`fffffff0=????????
    Resetting default scope

    LAST_CONTROL_TRANSFER: from fffff8000187e371 to fffff8000186f390

    STACK_TEXT:
    fffffa60`07ded4e8 fffff800`0187e371 : 00000000`00000050 fffffa80`04fc5ad0 00000000`00000000 fffffa60`07ded5e0 : nt!KeBugCheckEx
    fffffa60`07ded4f0 fffff800`0186df19 : 00000000`00000000 fffff800`01874f8a fffffa80`0423ba00 fffffa80`04b4f5c0 : nt!MmAccessFault+0x1371
    fffffa60`07ded5e0 fffff800`0194dc03 : fffff880`07fb3010 00000000`00000001 fffff880`05f173d0 fffffa60`028c4ce3 : nt!KiPageFault+0x119
    fffffa60`07ded770 fffffa60`028c0515 : 00000000`00000000 00000000`00000000 fffff880`07fb3010 00000000`00000000 : nt!ExFreePoolWithTag+0x43
    fffffa60`07ded820 fffffa60`028c02c4 : 00000000`00000000 fffffa60`00000000 00000000`00000001 00000000`00000000 : dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+0x215
    fffffa60`07ded8f0 fffffa60`02844f29 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : dxgkrnl!VIDMM_GLOBAL::CloseAllocation+0x44
    fffffa60`07ded920 fffffa60`02848e07 : 00000000`00000000 fffff880`07f1b1d0 00000000`00000000 00000000`00000000 : dxgkrnl!DXGDEVICE::DestroyAllocations+0x41d
    fffffa60`07deda10 fffffa60`0284b235 : fffff880`06e20000 fffffa60`07dedb30 fffff880`06e20001 fffffa60`07dedc01 : dxgkrnl!DXGDEVICE::DestroyAllocation+0x3e3
    fffffa60`07dedab0 fffff960`00262516 : fffffa60`00000000 fffffa80`01887a70 00000000`7efda000 00000000`00000020 : dxgkrnl!DxgkDestroyAllocation+0x8dd
    fffffa60`07dedbf0 fffff800`0186ee33 : fffffa80`01887a70 00000000`00000000 00000000`00000000 fffffa80`0283c4b0 : win32k!NtGdiDdDDIDestroyAllocation+0x12
    fffffa60`07dedc20 00000000`75d2b5ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`035de7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75d2b5ca


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215
    fffffa60`028c0515 488b4b20 mov rcx,qword ptr [rbx+20h]

    SYMBOL_STACK_INDEX: 4

    SYMBOL_NAME: dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: dxgkrnl

    IMAGE_NAME: dxgkrnl.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 479193e6

    FAILURE_BUCKET_ID: X64_0x50_dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215

    BUCKET_ID: X64_0x50_dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215

    Followup: MachineOwner



    19C
    ....
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {fffff88007d0a0b0, 0, fffff80001b0b093, 2}


    Could not read faulting driver name
    Probably caused by : ntkrnlmp.exe ( nt!CmpCacheLookup+193 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffff88007d0a0b0, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff80001b0b093, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 0000000000000002, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a70080
    fffff88007d0a0b0

    FAULTING_IP:
    nt!CmpCacheLookup+193
    fffff800`01b0b093 3819 cmp byte ptr [rcx],bl

    MM_INTERNAL_CODE: 2

    CUSTOMER_CRASH_COUNT: 3

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0x50

    PROCESS_NAME: AirPlusCFG.exe

    CURRENT_IRQL: 0

    TRAP_FRAME: fffffa6005069060 -- (.trap 0xfffffa6005069060)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000091ec4f9a rbx=fffffa6005069db0 rcx=fffff88007d0a0b0
    rdx=0000000010650760 rsi=0006010704020503 rdi=fffffa6005069678
    rip=fffff80001b0b093 rsp=fffffa60050691f0 rbp=fffffa60050693c0
    r8=00000000de532e42 r9=0000000000000008 r10=0000000000000000
    r11=fffffa60050691e0 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei pl zr na po nc
    nt!CmpCacheLookup+0x193:
    fffff800`01b0b093 3819 cmp byte ptr [rcx],bl ds:8060:fffff880`07d0a0b0=??
    Resetting default scope

    LAST_CONTROL_TRANSFER: from fffff800018aa534 to fffff8000189c390

    STACK_TEXT:
    fffffa60`05068f68 fffff800`018aa534 : 00000000`00000050 fffff880`07d0a0b0 00000000`00000000 fffffa60`05069060 : nt!KeBugCheckEx
    fffffa60`05068f70 fffff800`0189af19 : 00000000`00000000 fffff880`057c0a58 00000000`10650700 00000000`00000000 : nt!MmAccessFault+0x534
    fffffa60`05069060 fffff800`01b0b093 : fffffa60`05069750 fffffa60`05069330 fffffa60`05069840 fffffa60`05069768 : nt!KiPageFault+0x119
    fffffa60`050691f0 fffff800`01b0bcc5 : fffffa60`05069330 fffffa60`00000007 fffffa60`05069770 fffffa60`05069750 : nt!CmpCacheLookup+0x193
    fffffa60`050692d0 fffff800`01b0c69a : fffffa60`05069b70 fffffa60`05069750 fffffa60`05069740 fffffa60`05069758 : nt!CmpBuildHashStackAndLookupCache+0x276
    fffffa60`05069670 fffff800`01b1d999 : 00000000`00000040 00000000`00000104 fffffa80`012a8b10 fffff880`069b6601 : nt!CmpParseKey+0x20a
    fffffa60`05069910 fffff800`01b21884 : 00000000`00000000 fffffa80`04bffa01 00000000`00000040 fffffa80`00c70080 : nt!ObpLookupObjectName+0x5eb
    fffffa60`05069a20 fffff800`01b0786f : fffffa80`00020019 00000000`75f53300 fffffa80`04c13001 00000000`00020006 : nt!ObOpenObjectByName+0x2f4
    fffffa60`05069af0 fffff800`0189be33 : 00000000`005fe828 00000000`00020019 00000000`005fe8d0 00000000`00000000 : nt!CmOpenKey+0x25d
    fffffa60`05069c20 00000000`77c75b9a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`005fc108 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c75b9a


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!CmpCacheLookup+193
    fffff800`01b0b093 3819 cmp byte ptr [rcx],bl

    SYMBOL_STACK_INDEX: 3

    SYMBOL_NAME: nt!CmpCacheLookup+193

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 479192b7

    FAILURE_BUCKET_ID: X64_0x50_nt!CmpCacheLookup+193

    BUCKET_ID: X64_0x50_nt!CmpCacheLookup+193

    Followup: MachineOwner
    --------
     
  5. okozar

    okozar TS Rookie Topic Starter

    20A
    ....
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 3B, {c0000005, fffff960001a5fdb, fffffa6005b5d760, 0}

    Probably caused by : win32k.sys ( win32k!NextTopWindow+193 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff960001a5fdb, Address of the exception record for the exception that caused the bugcheck
    Arg3: fffffa6005b5d760, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP:
    win32k!NextTopWindow+193
    fffff960`001a5fdb 488b4110 mov rax,qword ptr [rcx+10h]

    CONTEXT: fffffa6005b5d760 -- (.cxr 0xfffffa6005b5d760)
    rax=fffffa8004924e60 rbx=fffff900c0c7f3d0 rcx=ff7ec9a0ff7ec9a0
    rdx=fffff900c0c00a60 rsi=fffff900c0c16d60 rdi=fffff900c0c25be0
    rip=fffff960001a5fdb rsp=fffffa6005b5dfc0 rbp=fffff900c0c7f3d0
    r8=0000000000000000 r9=fffff900c2e2b160 r10=fffff900c0c7f3d0
    r11=fffff900c0c0f290 r12=0000000000000001 r13=0000000000000002
    r14=fffff900c2e2b160 r15=0000000000000001
    iopl=0 nv up ei ng nz na po nc
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
    win32k!NextTopWindow+0x193:
    fffff960`001a5fdb 488b4110 mov rax,qword ptr [rcx+10h] ds:002b:ff7ec9a0`ff7ec9b0=????????????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0x3B

    PROCESS_NAME: speedfan.exe

    CURRENT_IRQL: 0

    LAST_CONTROL_TRANSFER: from fffff96000175f2e to fffff960001a5fdb

    STACK_TEXT:
    fffffa60`05b5dfc0 fffff960`00175f2e : fffff900`c0c7f3d0 fffff900`c0c7f3d0 00000000`00000002 fffff900`c2e2b160 : win32k!NextTopWindow+0x193
    fffffa60`05b5e000 fffff960`0016488b : fffff900`c0c7f3d0 00000000`00000018 00000000`00000083 00000000`00000000 : win32k!xxxActivateWindow+0x122
    fffffa60`05b5e060 fffff960`00183c63 : 00000000`00000001 fffff900`c0c7f3d0 fffff900`c0c7f3d0 00000000`00000000 : win32k!xxxShowWindow+0x41b
    fffffa60`05b5e0d0 fffff960`001923cc : 00000000`00000001 fffff900`c0c7f3d0 00000000`00000018 fffff800`01cc8911 : win32k!xxxRealDefWindowProc+0x5b7
    fffffa60`05b5e220 fffff960`00166567 : fffff900`c0c7f3d0 00000000`00000001 00000000`0000029e fffff900`c0c7f3d0 : win32k!xxxWrapRealDefWindowProc+0x3c
    fffffa60`05b5e250 fffff960`001917d8 : 00000000`00040454 00000000`0000029e fffffa60`05b5e5d0 00000000`00000000 : win32k!NtUserfnNCDESTROY+0x27
    fffffa60`05b5e290 fffff800`01a5ae33 : fffffa80`01263bb0 fffffa60`05b5e3f0 00000000`0007d588 fffffa60`05b5e318 : win32k!NtUserMessageCall+0x130
    fffffa60`05b5e300 00000000`75209fea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0007d568 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75209fea


    FOLLOWUP_IP:
    win32k!NextTopWindow+193
    fffff960`001a5fdb 488b4110 mov rax,qword ptr [rcx+10h]

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: win32k!NextTopWindow+193

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME: win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 47c78e35

    STACK_COMMAND: .cxr 0xfffffa6005b5d760 ; kb

    FAILURE_BUCKET_ID: X64_0x3B_win32k!NextTopWindow+193

    BUCKET_ID: X64_0x3B_win32k!NextTopWindow+193

    Followup: MachineOwner
    ---------


    20B
    ....
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {99, 1386af, 0, 0}

    Probably caused by : memory_corruption ( nt!MiBadShareCount+4b )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc). If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 0000000000000099, A PTE or PFN is corrupt
    Arg2: 00000000001386af, page frame number
    Arg3: 0000000000000000, current page state
    Arg4: 0000000000000000, 0

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x4E_99

    CUSTOMER_CRASH_COUNT: 2

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    PROCESS_NAME: windbg.exe

    CURRENT_IRQL: 2

    LAST_CONTROL_TRANSFER: from fffff80001ad43db to fffff80001a5d390

    STACK_TEXT:
    fffffa60`06cc8778 fffff800`01ad43db : 00000000`0000004e 00000000`00000099 00000000`001386af 00000000`00000000 : nt!KeBugCheckEx
    fffffa60`06cc8780 fffff800`01a999a5 : fffff6fb`7dbed000 fffffa80`00a3f2f0 00000000`00000002 fffff6fb`7da00000 : nt!MiBadShareCount+0x4b
    fffffa60`06cc87c0 fffff800`01a91a65 : 00000000`00000008 00000000`002a0000 00000000`00000000 fffff800`01bce850 : nt!MiDeletePageTableHierarchy+0x245
    fffffa60`06cc88d0 fffff800`01a41696 : fffff6fb`7dbed011 00000000`0029ffff fffffa80`00000000 fffffa80`00000000 : nt!MiDeleteVirtualAddresses+0x736
    fffffa60`06cc8a60 fffff800`01d0584c : fffff880`06ee4ab0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCleanProcessAddressSpace+0x6ae
    fffffa60`06cc8ab0 fffff800`01d05d3d : 00000000`00000000 fffffa80`04fb7b01 000007ff`fffda000 00000000`00000000 : nt!PspExitThread+0x4f8
    fffffa60`06cc8b70 fffff800`01cbcc7a : 00000000`00000000 00000000`0000000c 00000000`00000000 fffff880`0000000c : nt!PspTerminateThreadByPointer+0x4d
    fffffa60`06cc8bc0 fffff800`01a5ce33 : fffffa80`01417040 fffffa80`04fb7bb0 fffffa60`06cc8ca0 00000000`00000000 : nt!NtTerminateProcess+0xfa
    fffffa60`06cc8c20 00000000`77cb5d3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`043ff838 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77cb5d3a


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!MiBadShareCount+4b
    fffff800`01ad43db cc int 3

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: nt!MiBadShareCount+4b

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP: 479192b7

    IMAGE_NAME: memory_corruption

    FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4b

    BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4b

    Followup: MachineOwner
    ---------
     
  6. okozar

    okozar TS Rookie Topic Starter

    20C
    ....
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 3B, {c0000005, fffff80001a5f316, fffffa6005183eb0, 0}

    Probably caused by : afd.sys ( afd! ?? ::GFJBLGFE::`string'+33e4 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff80001a5f316, Address of the exception record for the exception that caused the bugcheck
    Arg3: fffffa6005183eb0, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP:
    nt!RtlpInterlockedPushEntrySList+26
    fffff800`01a5f316 4c8902 mov qword ptr [rdx],r8

    CONTEXT: fffffa6005183eb0 -- (.cxr 0xfffffa6005183eb0)
    rax=0000000000000000 rbx=0000000000ec0000 rcx=fffffa80041863d0
    rdx=0000000000ec0000 rsi=fffffa80041873d0 rdi=fffffa800143aae0
    rip=fffff80001a5f316 rsp=fffffa6005184718 rbp=fffffa6000f5d220
    r8=0000000000000000 r9=00001d8000000000 r10=0000000000000000
    r11=00000000000007ff r12=fffffa8001804650 r13=fffffa80026fc700
    r14=fffffa80042ae9a0 r15=fffffa8001804670
    iopl=0 nv up ei pl zr ac po nc
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010256
    nt!RtlpInterlockedPushEntrySList+0x26:
    fffff800`01a5f316 4c8902 mov qword ptr [rdx],r8 ds:002b:00000000`00ec0000=????????????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 3

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0x3B

    PROCESS_NAME: WoW-1.12.x-to-2

    CURRENT_IRQL: 0

    LAST_CONTROL_TRANSFER: from fffffa600424eaf5 to fffff80001a5f316

    STACK_TEXT:
    fffffa60`05184718 fffffa60`0424eaf5 : 00000000`00ec0000 fffffa80`042ae9a0 fffffa80`026fc700 fffffa80`0156d010 : nt!RtlpInterlockedPushEntrySList+0x26
    fffffa60`05184720 fffffa60`04209192 : 00000000`00000000 fffffa80`0143aae0 00000000`00000000 fffffa80`45656c41 : afd! ?? ::GFJBLGFE::`string'+0x33e4
    fffffa60`05184760 fffffa60`00e62d86 : fffffa80`01306010 00000000`00000000 fffffa80`0272bc10 fffffa80`0263a010 : afd!AfdFreeConnectionEx+0x22
    fffffa60`05184790 fffffa60`00e70ed8 : fffffa80`01306010 00000000`00000000 00000000`00000000 fffff800`01a93700 : tcpip!TcpCleanupTcbWorkQueueRoutine+0xd6
    fffffa60`051847d0 fffffa60`00e713c8 : 00000000`00000000 fffffa60`0425a0be fffffa80`01306010 fffffa80`0159e102 : tcpip!TcpCloseTcbOlmNotifyTerminateComplete+0x78
    fffffa60`05184870 fffffa60`00e713e9 : fffffa80`03ea4200 fffffa80`0143aae0 00000004`1000000e 80000000`00000000 : tcpip!TcpCloseTcb+0x78
    fffffa60`051848d0 fffffa60`0423e01a : fffff800`01b81b00 fffff800`01b1fde9 fffff800`01b81b80 fffffa80`026fc710 : tcpip!TcpTlConnectionCloseEndpoint+0x9
    fffffa60`05184900 fffffa60`0422c8f0 : fffffa80`0263a010 00000000`00000001 00000000`00000000 80000000`00000000 : afd!AfdCloseConnection+0x7a
    fffffa60`05184940 fffffa60`0423c498 : 00000000`00000000 fffffa80`042ae9a0 fffffa80`026fc710 00000000`00000001 : afd!AfdCloseCore+0x180
    fffffa60`051849d0 fffff800`01cda53e : fffffa80`01572cd0 fffffa80`01572cd0 00000000`00000004 fffffa60`05184a70 : afd!AfdDispatch+0x78
    fffffa60`05184a10 fffff800`01a64e93 : 00000000`00000000 fffffa80`01572cd0 fffffa80`01572ca0 fffffa60`005ec180 : nt!IopDeleteFile+0x17e
    fffffa60`05184aa0 fffff800`01cdbc5e : fffff880`07209510 fffffa80`00000001 fffffa80`0272bc10 00000000`00000002 : nt!ObfDereferenceObject+0x103
    fffffa60`05184b30 fffff800`01cdbe04 : fffff880`07a829b0 fffff880`07a82900 00000000`00000001 00000000`00000544 : nt!ObpCloseHandleTableEntry+0xce
    fffffa60`05184bd0 fffff800`01a5ce33 : fffffa80`026fc710 fffffa60`05184ca0 00000000`7efaf000 fffffa80`04231420 : nt!ObpCloseHandle+0x94
    fffffa60`05184c20 00000000`76f95b6a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0060e848 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f95b6a


    FOLLOWUP_IP:
    afd! ?? ::GFJBLGFE::`string'+33e4
    fffffa60`0424eaf5 90 nop

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: afd! ?? ::GFJBLGFE::`string'+33e4

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: afd

    IMAGE_NAME: afd.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 47919ad7

    STACK_COMMAND: .cxr 0xfffffa6005183eb0 ; kb

    FAILURE_BUCKET_ID: X64_0x3B_afd!_??_::GFJBLGFE::_string_+33e4

    BUCKET_ID: X64_0x3B_afd!_??_::GFJBLGFE::_string_+33e4

    Followup: MachineOwner
    ---------
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...