Sbs2003 Sp1 Bsod

[dusanp]

Can someone please, help me to decipher following dmp?
I'm receiving BSOD for two of my Citrix Farm member servers.
dmp files for both of them are very simmilar.

Here is the one:
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Dumps\Mini031708-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_sp1_qfe.050909-1525
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Mon Mar 17 18:35:04.645 2008 (GMT+1)
System Uptime: 3 days 3:29:26.038
Loading Kernel Symbols
........................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck AB, {2, b000, 0, 1}



Probably caused by : memory_corruption ( nt!MiCheckSessionPoolAllocations+107 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload. This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 00000002, session ID
Arg2: 0000b000, number of paged pool bytes that are leaking
Arg3: 00000000, number of nonpaged pool bytes that are leaking
Arg4: 00000001, total number of paged and nonpaged allocations that are leaking.
nonpaged allocations are in the upper half of this word,
paged allocations are in the lower half of this word.

Debugging Details:
------------------




CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0xAB

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8092ed5d to 808275a7

STACK_TEXT:
b0bdfc24 8092ed5d 000000ab 00000002 0000b000 nt!KeBugCheckEx+0x1b
b0bdfc68 809ab017 8814e0e8 8814e0e8 00000000 nt!MiCheckSessionPoolAllocations+0x107
b0bdfce8 8084c2f3 8814e0e8 00000000 8a5b7020 nt!MiDereferenceSessionFinal+0x183
b0bdfd04 8094b84b 8814e0e8 8a5b7020 8a5b7260 nt!MmCleanProcessAddressSpace+0x6b
b0bdfd8c 8094b99f 00000000 00000000 8a5b7020 nt!PspExitThread+0x5f1
b0bdfda4 80948ed2 8a5b7020 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b
b0bdfddc 8088d632 bf92b980 882b2998 00000000 nt!PspSystemThreadStartup+0x3c
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiCheckSessionPoolAllocations+107
8092ed5d 5f pop edi

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiCheckSessionPoolAllocations+107

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 43222873

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xAB_nt!MiCheckSessionPoolAllocations+107

BUCKET_ID: 0xAB_nt!MiCheckSessionPoolAllocations+107

Followup: MachineOwner
---------


Thanks for your help,

 

[peterdiva]

This looks to be the same crash. http://support.citrix.com/article/CTX107896

 

[dusanp]

Thanks, I will have a look at it.