Hello - I have a citrix server (PS 4.0 enterprise) running windows
2003 SP1. This system has all of a sudden started rebooting on it's
own... Originally, the reboot was blaming UPHClean, so i uninstalled
it and it still is rebooting randomly... I cannot pinpoint the reboot
- it seems to happen when someone either logs off a session in citrix,
or opens a session... I cannot pinpoint exactly what's going on to
make the reboot occur... I have replaced all the memory in the system with brand new memory sticks... this is the most recent bug check (any help
would be GREATLY appreciated - let me know if you need more info too):
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffd88f8, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8089b522, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: fffd88f8
FAULTING_IP:
nt!ExFreePoolWithTag+28b
8089b522 668b4602 mov ax,word ptr [esi+2]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 4
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: winlogon.exe
CURRENT_IRQL: 1
TRAP_FRAME: b894c994 -- (.trap ffffffffb894c994)
ErrCode = 00000000
eax=fffd8800 ebx=fffd88fe ecx=00200000 edx=fffd88fe esi=fffd88f6 edi=00000000
eip=8089b522 esp=b894ca08 ebp=b894ca54 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ExFreePoolWithTag+0x28b:
8089b522 668b4602 mov ax,word ptr [esi+2] ds:0023:fffd88f8=????
Resetting default scope
LAST_CONTROL_TRANSFER: from 808689ee to 8087b6be
STACK_TEXT:
b894c92c 808689ee 00000050 fffd88f8 00000000 nt!KeBugCheckEx+0x1b
b894c97c 80837d0a 00000000 fffd88f8 00000000 nt!MmAccessFault+0x813
b894c97c 8089b522 00000000 fffd88f8 00000000 nt!KiTrap0E+0xdc
b894ca54 8093aeba fffd88fe 00000000 3b9aca07 nt!ExFreePoolWithTag+0x28b
b894ca70 8091a265 e4388d28 fb96fe53 b894ca90 nt!CmpCleanUpKcbValueCache+0x51
b894ca80 80915549 e4388d28 00000000 b894cab0 nt!CmpCleanUpKcbCacheWithLock+0x15
b894ca90 8093d625 e4388d28 00000000 c0000034 nt!CmpDereferenceKeyControlBlockWithLock+0x4d
b894cab0 8093dc32 e4388d28 00000000 e4413f50 nt!CmpDereferenceKeyControlBlock+0xa7
b894cb90 80936848 e4388d28 00000000 89cfd538 nt!CmpParseKey+0x807
b894cc10 80936aa5 000003c8 b894cc50 00000040 nt!ObpLookupObjectName+0x11f
b894cc64 8093e1d2 00000000 8a780de8 8a330301 nt!ObOpenObjectByName+0xea
b894cd50 80834d3f 012cf6e0 00020019 012cf624 nt!NtOpenKey+0x1ad
b894cd50 7c82ed54 012cf6e0 00020019 012cf624 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
012cf664 00000000 00000000 00000000 00000000 0x7c82ed54
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExFreePoolWithTag+28b
8089b522 668b4602 mov ax,word ptr [esi+2]
SYMBOL_STACK_INDEX: 3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 42435e60
SYMBOL_NAME: nt!ExFreePoolWithTag+28b
FAILURE_BUCKET_ID: 0x50_nt!ExFreePoolWithTag+28b
BUCKET_ID: 0x50_nt!ExFreePoolWithTag+28b
Followup: MachineOwner
2003 SP1. This system has all of a sudden started rebooting on it's
own... Originally, the reboot was blaming UPHClean, so i uninstalled
it and it still is rebooting randomly... I cannot pinpoint the reboot
- it seems to happen when someone either logs off a session in citrix,
or opens a session... I cannot pinpoint exactly what's going on to
make the reboot occur... I have replaced all the memory in the system with brand new memory sticks... this is the most recent bug check (any help
would be GREATLY appreciated - let me know if you need more info too):
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffd88f8, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8089b522, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: fffd88f8
FAULTING_IP:
nt!ExFreePoolWithTag+28b
8089b522 668b4602 mov ax,word ptr [esi+2]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 4
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: winlogon.exe
CURRENT_IRQL: 1
TRAP_FRAME: b894c994 -- (.trap ffffffffb894c994)
ErrCode = 00000000
eax=fffd8800 ebx=fffd88fe ecx=00200000 edx=fffd88fe esi=fffd88f6 edi=00000000
eip=8089b522 esp=b894ca08 ebp=b894ca54 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ExFreePoolWithTag+0x28b:
8089b522 668b4602 mov ax,word ptr [esi+2] ds:0023:fffd88f8=????
Resetting default scope
LAST_CONTROL_TRANSFER: from 808689ee to 8087b6be
STACK_TEXT:
b894c92c 808689ee 00000050 fffd88f8 00000000 nt!KeBugCheckEx+0x1b
b894c97c 80837d0a 00000000 fffd88f8 00000000 nt!MmAccessFault+0x813
b894c97c 8089b522 00000000 fffd88f8 00000000 nt!KiTrap0E+0xdc
b894ca54 8093aeba fffd88fe 00000000 3b9aca07 nt!ExFreePoolWithTag+0x28b
b894ca70 8091a265 e4388d28 fb96fe53 b894ca90 nt!CmpCleanUpKcbValueCache+0x51
b894ca80 80915549 e4388d28 00000000 b894cab0 nt!CmpCleanUpKcbCacheWithLock+0x15
b894ca90 8093d625 e4388d28 00000000 c0000034 nt!CmpDereferenceKeyControlBlockWithLock+0x4d
b894cab0 8093dc32 e4388d28 00000000 e4413f50 nt!CmpDereferenceKeyControlBlock+0xa7
b894cb90 80936848 e4388d28 00000000 89cfd538 nt!CmpParseKey+0x807
b894cc10 80936aa5 000003c8 b894cc50 00000040 nt!ObpLookupObjectName+0x11f
b894cc64 8093e1d2 00000000 8a780de8 8a330301 nt!ObOpenObjectByName+0xea
b894cd50 80834d3f 012cf6e0 00020019 012cf624 nt!NtOpenKey+0x1ad
b894cd50 7c82ed54 012cf6e0 00020019 012cf624 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
012cf664 00000000 00000000 00000000 00000000 0x7c82ed54
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExFreePoolWithTag+28b
8089b522 668b4602 mov ax,word ptr [esi+2]
SYMBOL_STACK_INDEX: 3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 42435e60
SYMBOL_NAME: nt!ExFreePoolWithTag+28b
FAILURE_BUCKET_ID: 0x50_nt!ExFreePoolWithTag+28b
BUCKET_ID: 0x50_nt!ExFreePoolWithTag+28b
Followup: MachineOwner
