MiniDump texts comparison. Memory perhaps

[crystalfat]

Hi guys, i have a problem with a computer sporadically rebooting.

The errors are different in the event viewer, however i took two of the minidumps to compare, it seems as though both problems occur around a certain memory block, can anyone shed any light on this for me please.

thanks in advance

chris

minidump1

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80573e2a, The address that the exception occurred at
Arg3: eb8b3a98, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!RtlpCoalesceFreeBlocks+2cd
80573e2a 8b12 mov edx,dword ptr [edx]

TRAP_FRAME: eb8b3a98 -- (.trap ffffffffeb8b3a98)
.trap ffffffffeb8b3a98
ErrCode = 00000000
eax=000002b5 ebx=bc630000 ecx=bc640500 edx=00000000 esi=bc6404f8 edi=bc6404f0
eip=80573e2a esp=eb8b3b0c ebp=eb8b3b18 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!RtlpCoalesceFreeBlocks+0x2cd:
80573e2a 8b12 mov edx,dword ptr [edx] ds:0023:00000000=????????
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: fmstart.exe

LAST_CONTROL_TRANSFER: from 80573f28 to 80573e2a

STACK_TEXT:
eb8b3b18 80573f28 bc630000 bc6404f0 eb8b3b80 nt!RtlpCoalesceFreeBlocks+0x2cd
eb8b3ba0 bf80cc0e bc630000 00000000 bc6404f8 nt!RtlFreeHeap+0xa1
eb8b3bb4 bf81fb6d bc630000 bc6404f8 eb8b3be0 win32k!Win32HeapFree+0x13
eb8b3bc4 bf81fc34 82833b68 bc6404f8 e11c6648 win32k!ClassFree+0x1e
eb8b3be0 bf8c0919 e11c6648 829f23b8 e11bc110 win32k!DestroyClass+0xb2
eb8b3bf4 bf8209ea e11c65c0 828547d8 00000000 win32k!DestroyProcessesClasses+0x2b
eb8b3c1c bf819e30 00000001 eb8b3c44 bf819ef4 win32k!xxxDestroyThreadInfo+0x21d
eb8b3c28 bf819ef4 828547d8 00000001 00000000 win32k!UserThreadCallout+0x4b
eb8b3c44 8056a0cf 828547d8 00000001 828545d0 win32k!W32pThreadCallout+0x3d
eb8b3cf0 80584c64 40010004 eb8b3d4c 804e60e9 nt!PspExitThread+0x40b
eb8b3cfc 804e60e9 828545d0 eb8b3d48 eb8b3d3c nt!PsExitSpecialApc+0x22
eb8b3d4c 804de855 00000001 00000000 eb8b3d64 nt!KiDeliverApc+0x1af
eb8b3d4c 7c90eb94 00000001 00000000 eb8b3d64 nt!KiServiceExit+0x58
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012fe94 00000000 00000000 00000000 00000000 0x7c90eb94





Minidump 2:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8054b02d, The address that the exception occurred at
Arg3: eb903844, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExAllocatePoolWithTag+66c
8054b02d 8b08 mov ecx,dword ptr [eax]

TRAP_FRAME: eb903844 -- (.trap ffffffffeb903844)
.trap ffffffffeb903844
ErrCode = 00000000
eax=0481023d ebx=82bef028 ecx=82bf1098 edx=00000001 esi=82bef410 edi=000001ff
eip=8054b02d esp=eb9038b8 ebp=eb90390c iopl=0 ov up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010a87
nt!ExAllocatePoolWithTag+0x66c:
8054b02d 8b08 mov ecx,dword ptr [eax] ds:0023:0481023d=????????
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from 805647f7 to 8054b02d

STACK_TEXT:
eb90390c 805647f7 00000001 00000001 e56b6f54 nt!ExAllocatePoolWithTag+0x66c
eb903930 8056495d 829da2c8 00000000 00000000 nt!ObpAllocateObject+0xc8
eb903964 80575aed 00000000 82bed238 eb9039d8 nt!ObCreateObject+0x12a
eb9039a8 80578cab e2193030 eb9039d8 7ffde200 nt!SepDuplicateToken+0xff
eb903a60 804de7ec fffffffe 00020008 00000001 nt!NtOpenThreadTokenEx+0x17f
eb903a60 804dd0f5 fffffffe 00020008 00000001 nt!KiFastCallEntry+0xf8
eb903aec 805812b8 fffffffe 00020008 00000001 nt!ZwOpenThreadTokenEx+0x11
eb903b7c 80581231 eb903ba8 80580df2 00f2fde6 nt!RtlFormatCurrentUserKeyPath+0x2f
eb903bb4 80580c6d 02000000 eb903c0c 00000000 nt!RtlOpenCurrentUser+0x13
eb903d14 80580dd7 80580df2 00f2fde6 00000001 nt!ExpGetCurrentUserUILanguage+0x2d
eb903d58 804de7ec 00f2fde6 00f2fe80 7c90eb94 nt!NtQueryDefaultUILanguage+0x49
eb903d58 7c90eb94 00f2fde6 00f2fe80 7c90eb94 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f2fe80 00000000 00000000 00000000 00000000 0x7c90eb94

 

[howard_hopkinso]

Hello and welcome to Techspot.

It is possible you have a ram problem.

Go and read this thread HERE and see if it helps you to identify the culprit.

If it doesn`t, attach 5 or 6 of your latest minidumps here.

Regards Howard :wave: :wave:

 

[crystalfat]

More dumps

Seems to pass all tests, cheers for that, here are some more dumps.


BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: e2bd5938, The pool entry we were looking for within the page.
Arg3: e2bd5980, The next pool entry.
Arg4: 1c090205, (reserved)

Debugging Details:
------------------


BUGCHECK_STR: 0x19_20

POOL_ADDRESS: e2bd5938

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: Skype.exe

LAST_CONTROL_TRANSFER: from 8054b941 to 8053354e

STACK_TEXT:
eb72e4bc 8054b941 00000019 00000020 e2bd5938 nt!KeBugCheckEx+0x1b
eb72e50c f7b52b97 e2bd5940 00000000 00000000 nt!ExFreePoolWithTag+0x2be
eb72e520 f7b5402a e2bd5940 eb72e620 827b2bc8 Npfs!NpFreeClientSecurityContext+0x31
eb72e564 f7b51c49 e2e10fb0 00000001 02d51b80 Npfs!NpWriteDataQueue+0x15a
eb72e608 f7b52322 82933610 82522988 eb72e620 Npfs!NpTransceive+0x161
eb72e62c f7b523e1 82933610 82522988 827b2dd8 Npfs!NpCommonFileSystemControl+0x1e0
eb72e644 804e37f7 82933610 82522988 806ee2d0 Npfs!NpFsdFileSystemControl+0x19
eb72e654 8056a148 825229f8 82463c00 82522988 nt!IopfCallDriver+0x31
eb72e668 8057ad03 82933610 82522988 82463c00 nt!IopSynchronousServiceTail+0x60
eb72e710 8057ad43 00000840 00000195 00000000 nt!IopXxxControlFile+0x611
eb72e744 804de7ec 00000840 00000195 00000000 nt!NtFsControlFile+0x2a
eb72e744 7c90eb94 00000840 00000195 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012c4ec 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
Npfs!NpFreeClientSecurityContext+31
f7b52b97 5e pop esi

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: Npfs!NpFreeClientSecurityContext+31

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Npfs

IMAGE_NAME: Npfs.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b86

FAILURE_BUCKET_ID: 0x19_20_Npfs!NpFreeClientSecurityContext+31

BUCKET_ID: 0x19_20_Npfs!NpFreeClientSecurityContext+31





dump 4


PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 00000000, page frame number
Arg3: 00000000, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x4E

PROCESS_NAME: explorer.exe

LAST_CONTROL_TRANSFER: from 80520b02 to 8053354e

STACK_TEXT:
ebe7f6c4 80520b02 0000004e 00000099 00000000 nt!KeBugCheckEx+0x1b
ebe7f6f8 805846bf 00580119 8286fda0 003ffffc nt!MiDeleteValidAddress+0x123
ebe7f718 804ff36f 8286fda0 8286fed8 8286fda0 nt!MiDeleteAddressesInWorkingSet+0x65
ebe7f750 805849a3 0086fda0 82ab7990 82ab7bd8 nt!MmCleanProcessAddressSpace+0x18f
ebe7f7f8 8057b746 c0000005 82ab7990 00000000 nt!PspExitThread+0x680
ebe7f818 80584828 82ab7990 c0000005 ebe7f854 nt!PspTerminateThreadByPointer+0x52
ebe7f844 804de7ec 00000000 c0000005 00f4ffa0 nt!NtTerminateProcess+0x118
ebe7f844 7c90eb94 00000000 c0000005 00f4ffa0 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f4ffa0 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiDeleteValidAddress+123
80520b02 00ff add bh,bh

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45e54711

SYMBOL_NAME: nt!MiDeleteValidAddress+123

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x4E_nt!MiDeleteValidAddress+123

BUCKET_ID: 0x4E_nt!MiDeleteValidAddress+123

Followup: MachineOwner
---------


dump 5


PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: f000ef5d, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: bf8016da, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: f000ef5d

FAULTING_IP:
win32k!SetWakeBit+28
bf8016da 66095806 or word ptr [eax+6],bx

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from bf801232 to bf8016da

STACK_TEXT:
ef00faac bf801232 00000000 00000010 804dcbe4 win32k!SetWakeBit+0x28
ef00fad4 bf88dba7 00000022 006dfff4 bf801077 win32k!TimersProc+0xeb
ef00fd30 bf8725df ef01f490 00000002 ef00fd54 win32k!RawInputThread+0x634
ef00fd40 bf80109a ef01f490 ef00fd64 006dfff4 win32k!xxxCreateSystemThreads+0x60
ef00fd54 804de7ec 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23
ef00fd54 7c90eb94 00000000 00000022 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SetWakeBit+28
bf8016da 66095806 or word ptr [eax+6],bx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!SetWakeBit+28

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 45f013f6

FAILURE_BUCKET_ID: 0x50_W_win32k!SetWakeBit+28

BUCKET_ID: 0x50_W_win32k!SetWakeBit+28


dump 6


*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80573e2a, The address that the exception occurred at
Arg3: eb8b3a98, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!RtlpCoalesceFreeBlocks+2cd
80573e2a 8b12 mov edx,dword ptr [edx]

TRAP_FRAME: eb8b3a98 -- (.trap ffffffffeb8b3a98)
.trap ffffffffeb8b3a98
ErrCode = 00000000
eax=000002b5 ebx=bc630000 ecx=bc640500 edx=00000000 esi=bc6404f8 edi=bc6404f0
eip=80573e2a esp=eb8b3b0c ebp=eb8b3b18 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!RtlpCoalesceFreeBlocks+0x2cd:
80573e2a 8b12 mov edx,dword ptr [edx] ds:0023:00000000=????????
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: fmstart.exe

LAST_CONTROL_TRANSFER: from 80573f28 to 80573e2a

STACK_TEXT:
eb8b3b18 80573f28 bc630000 bc6404f0 eb8b3b80 nt!RtlpCoalesceFreeBlocks+0x2cd
eb8b3ba0 bf80cc0e bc630000 00000000 bc6404f8 nt!RtlFreeHeap+0xa1
eb8b3bb4 bf81fb6d bc630000 bc6404f8 eb8b3be0 win32k!Win32HeapFree+0x13
eb8b3bc4 bf81fc34 82833b68 bc6404f8 e11c6648 win32k!ClassFree+0x1e
eb8b3be0 bf8c0919 e11c6648 829f23b8 e11bc110 win32k!DestroyClass+0xb2
eb8b3bf4 bf8209ea e11c65c0 828547d8 00000000 win32k!DestroyProcessesClasses+0x2b
eb8b3c1c bf819e30 00000001 eb8b3c44 bf819ef4 win32k!xxxDestroyThreadInfo+0x21d
eb8b3c28 bf819ef4 828547d8 00000001 00000000 win32k!UserThreadCallout+0x4b
eb8b3c44 8056a0cf 828547d8 00000001 828545d0 win32k!W32pThreadCallout+0x3d
eb8b3cf0 80584c64 40010004 eb8b3d4c 804e60e9 nt!PspExitThread+0x40b
eb8b3cfc 804e60e9 828545d0 eb8b3d48 eb8b3d3c nt!PsExitSpecialApc+0x22
eb8b3d4c 804de855 00000001 00000000 eb8b3d64 nt!KiDeliverApc+0x1af
eb8b3d4c 7c90eb94 00000001 00000000 eb8b3d64 nt!KiServiceExit+0x58
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012fe94 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!Win32HeapFree+13
bf80cc0e 0fb6c0 movzx eax,al

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: win32k!Win32HeapFree+13

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 45f013f6

FAILURE_BUCKET_ID: 0x8E_win32k!Win32HeapFree+13

BUCKET_ID: 0x8E_win32k!Win32HeapFree+13

Followup: MachineOwner

 

[Route44]

Your fourth dump still points to Memory Corruption. How long did you run Memtest for, i.e. number of passes?