BSOD : 0X000000D1 - IRQ_NOT_LESS_OR_EQUAL - Minidumps

[Capac]

Hey, have been getting the same crahs all over again, daily.... 0X000000D1.
Tried to analyze the dmp files myself but ran into an issue when my symbol files were not installed properly.

Machine : Dell Latitude D610 - Windows XP SP1

Could someone pls have a look into these dump files and try to pinpoint the src of these crashes? thnx much!

 

[altheman]

5 crashes at "asnttdi.sys" with a bugcheck of D1. AFAIK, this is part of the Aventail VPN Software.

The Stop 0xD1 messages indicates that the system attempted to access pageable memory using a kernel process IRQL that was too high. Drivers that have used improper addresses typically cause this error.

Possible Resolutions:

Stop 0xD1 messages can occur after installing faulty drivers or system services. If a driver is listed by name, disable, remove, or roll back that driver to confirm that this resolves the error. If so, contact the manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, DVD playback, and CD mastering tools

If you have Aventail VPN software installed, you should upgrade to the latest version, or inform your company that this is causing problems for you.

 

[Capac]

thnx

thnx altheman!

btw: managed to get my windows debugger to load the files...only question is...Is it always safe to assume that what's referenced in the section : IMAGE_NAME: asnttdi.sys that this is the faulty driver?? (cause I noticed vsdatant.sys (zonealarm) and b57xp32.sys (broadcom nic driver) were loaded too)

Thnks for yr help!



kd> .symfix c:\symbols
kd> .reload
Loading Kernel Symbols
.........................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 7ffd9000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 7ffd9000, address which referenced memory

Debugging Details:
------------------

Unable to load image asnttdi.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for asnttdi.sys
*** ERROR: Module load completed but symbols could not be loaded for asnttdi.sys
*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys
*** WARNING: Unable to verify timestamp for b57xp32.sys
*** ERROR: Module load completed but symbols could not be loaded for b57xp32.sys

READ_ADDRESS: 7ffd9000

CURRENT_IRQL: 2

FAULTING_IP:
+7ffd9000
7ffd9000 ?? ???

PROCESS_NAME: Idle

CUSTOMER_CRASH_COUNT: 9

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 804ddb88 to 8052b591

FAILED_INSTRUCTION_ADDRESS:
+7ffd9000
7ffd9000 ?? ???

STACK_TEXT:
805421ec 804ddb88 0000000a 7ffd9000 00000002 nt!KeBugCheckEx+0x19
805421ec 7ffd9000 0000000a 7ffd9000 00000002 nt!KiTrap0E+0x219
WARNING: Frame IP not in any known module. Following frames may be wrong.
80542278 aadbb689 00000000 c000023f 855860e8 0x7ffd9000
80542290 aae01bbd 855a8d30 c000023f 855860e8 asnttdi+0x2689
805422b8 aae01cb2 02001304 00002afd 0101a8c0 tcpip!UDPStatus+0xf8
80542310 aadf468b 8585fcc8 7b53a234 0101a8c0 tcpip!ICMPRcv+0x323
8054235c aadf4302 aadf83ff 8585fcc8 00000000 tcpip!DeliverToUser+0xf9
80542404 aadf43ba 8585fcc8 860ae22c 00000045 tcpip!IPRcvPacket+0x5cd
80542444 aadf3b8d 00000000 860b8378 860ae20a tcpip!ARPRcvIndicationNew+0x143
80542480 aad6260b 85849148 00000000 862d7130 tcpip!ARPRcvPacket+0x66
805424f8 f6b8ac0b 00099d9c 80542534 00000001 vsdatant+0x1160b
80542528 aad6260b 010a7478 860b8378 86339ad8 psched!ClReceivePacket+0xf9
805425a0 f71d5c00 857d90a8 80542750 00000001 vsdatant+0x1160b
805428e8 f71e73c3 00000001 00000084 86121000 b57xp32+0x5c00
00000000 00000000 00000000 00000000 00000000 b57xp32+0x173c3


STACK_COMMAND: kb

FOLLOWUP_IP:
asnttdi+2689
aadbb689 ?? ???

FAULTING_SOURCE_CODE:


SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: asnttdi+2689

MODULE_NAME: asnttdi

IMAGE_NAME: asnttdi.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 43062953

FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_asnttdi+2689

BUCKET_ID: 0xD1_CODE_AV_BAD_IP_asnttdi+2689

Followup: MachineOwner

 

[altheman]

Most likely it was caused by the named file, but there is the possiblilty that the VPN Software is conflicting with ZA. Update ZA to the latest version, a new one was released a few days ago, and also update your NIC driver.

 

[Tedster]

all minidumps point to asnttdi.sys - this is your vpn software. If you are using a firewall, you may have a conflict. otherwise remove or upgrade this software.