Bugcheck Analysis
Below is the Bugcheck analysis. It's pointing to ntkrnlmp.exe. What does this mean?
Loading Dump File [C:\WINDOWS\Minidump\Mini112006-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*
http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Mon Nov 20 23:22:09.921 2006 (GMT+0)
System Uptime: 0 days 3:38:47.634
Loading Kernel Symbols
...........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {7, cd4, 2130002, 853fab70}
Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+2c1 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 00000cd4, (reserved)
Arg3: 02130002, Memory contents of the pool block
Arg4: 853fab70, Address of the block of pool being deallocated
Debugging Details:
------------------
POOL_ADDRESS: 853fab70
FREED_POOL_TAG: File
BUGCHECK_STR: 0xc2_7_File
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 80550fc5 to 805371aa
STACK_TEXT:
f7c96cd4 80550fc5 000000c2 00000007 00000cd4 nt!KeBugCheckEx+0x1b
f7c96d24 8057c322 853fab70 00000000 861b5458 nt!ExFreePoolWithTag+0x2c1
f7c96d4c 8056c797 00000000 861b5470 00000001 nt!ObpFreeObject+0x142
f7c96d64 8057f04c 861b5470 00000001 80567c20 nt!ObpRemoveObjectRoutine+0xe7
f7c96d7c 804e23b5 00000000 00000000 867c3d20 nt!ObpProcessRemoveObjectQueue+0x36
f7c96dac 80574128 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
f7c96ddc 804efc81 804e22f1 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExFreePoolWithTag+2c1
80550fc5 83f801 cmp eax,1
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 42250f77
SYMBOL_NAME: nt!ExFreePoolWithTag+2c1
FAILURE_BUCKET_ID: 0xc2_7_File_nt!ExFreePoolWithTag+2c1
BUCKET_ID: 0xc2_7_File_nt!ExFreePoolWithTag+2c1
Followup: MachineOwner
---------