Windbg BSOD analysis needed

Status
Not open for further replies.
O

okozar

Posts: 6   +0
Hi, I've this somewhat older batch of computer parts sitting around for a while and I finally got around to slapping them and a couple new ones together for a stronger (secondary) computer. At the same time I decided to make the move for my new computer and this older newer one to Vista X64 Ultimate

The Computer has all the vista updates..
All clocks are stock
x2 4200
x1800xt 512
1 GB PC 3200 Kingston Hyper-x (2x512mb) (Ya I know for Vista this badly needs to move to two
DFI Lanparty NF4 UT-D Mobo

I slapped this together on the 17th (last Tuesday night) and have since received
NINE! BSOD :(

Anyway here they are, I've read 80% of Blue Screens are caused by drivers so I guess I find it alarming that as far as I can tell these are mostly program, not driver related. The first one clearly appears to be the Hard drive as far as I can tell, but it doesn't concern me since it's A) Brand new and B) only occurred once.


17A
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904aa, fffffa600179d6e8, fffffa600179d0c0, fffffa60011109bc}

Probably caused by : Ntfs.sys ( Ntfs!EfsCleanup+4c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904aa
Arg2: fffffa600179d6e8
Arg3: fffffa600179d0c0
Arg4: fffffa60011109bc

Debugging Details:
------------------


EXCEPTION_RECORD: fffffa600179d6e8 -- (.exr 0xfffffa600179d6e8)
ExceptionAddress: fffffa60011109bc (Ntfs!EfsCleanup+0x000000000000004c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 000000000030e000
Attempt to write to address 000000000030e000

CONTEXT: fffffa600179d0c0 -- (.cxr 0xfffffa600179d0c0)
rax=0000000000000000 rbx=0000000000300000 rcx=000000004c5828f9
rdx=0000000000300000 rsi=fffff88000aaed68 rdi=000000000030e000
rip=fffffa60011109bc rsp=fffffa600179d920 rbp=fffffa8001d23180
r8=0000000000000004 r9=0000000000000019 r10=ffffffffffee4bc0
r11=00000000000007ff r12=0000000000000000 r13=0000000000000000
r14=fffffa8002d29cc0 r15=fffffa8001d23180
iopl=0 nv up ei pl nz ac pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010212
Ntfs!EfsCleanup+0x4c:
fffffa60`011109bc f3aa rep stos byte ptr [rdi]
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a30080
000000000030e000

BUGCHECK_STR: 0x24

EXCEPTION_DOESNOT_MATCH_CODE: This indicates a hardware error.
Instruction at fffffa60011109bc does not read/write to 000000000030e000

LAST_CONTROL_TRANSFER: from fffffa60010fa4e9 to fffffa60011109bc

STACK_TEXT:
fffffa60`0179d920 fffffa60`010fa4e9 : fffffa60`0179d9e8 00000000`00000703 00000000`00000018 fffff880`6f66744e : Ntfs!EfsCleanup+0x4c
fffffa60`0179d950 fffffa60`0100d579 : 00000000`00000000 00000000`00000001 00000000`00000000 fffff880`00aaeaa0 : Ntfs! ?? ::NNGAKEGL::`string'+0x47fd
fffffa60`0179d990 fffffa60`0100d9d3 : 00000000`00000000 fffff880`00aaebd0 fffff880`00aaeaa0 fffffa60`0179da88 : Ntfs!NtfsPrepareFcbForRemoval+0x89
fffffa60`0179d9e0 fffffa60`010bd6d8 : fffffa80`02d29cc0 fffffa80`01d23180 fffff880`07607010 fffff880`07607448 : Ntfs!NtfsTeardownFromLcb+0x393
fffffa60`0179da80 fffffa60`01014b92 : fffffa80`02d29cc0 fffffa60`0179dc70 00000000`00000000 fffff880`07607010 : Ntfs!NtfsTeardownStructures+0xd8
fffffa60`0179db10 fffffa60`010c8e18 : fffffa60`0179dc70 fffff800`019998a0 fffff880`07607010 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffffa60`0179db50 fffffa60`010b1e0e : fffffa80`02d29cc0 fffff880`07607140 fffff880`07607010 fffffa80`01d23180 : Ntfs!NtfsCommonClose+0x348
fffffa60`0179dc20 fffff800`01869066 : 00000000`00000000 fffff800`01a05800 fffff800`01999801 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15e
fffffa60`0179dcf0 fffff800`01a7fde3 : fffffa60`01062ee8 00000000`004e0046 fffffa80`00c81720 00000000`00000080 : nt!ExpWorkerThread+0x11a
fffffa60`0179dd50 fffff800`01896536 : fffffa60`005ec180 fffffa80`00c81720 fffffa60`005f5d40 00000000`00000001 : nt!PspSystemThreadStartup+0x57
fffffa60`0179dd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


FOLLOWUP_IP:
Ntfs!EfsCleanup+4c
fffffa60`011109bc f3aa rep stos byte ptr [rdi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: Ntfs!EfsCleanup+4c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 479190d1

STACK_COMMAND: .cxr 0xfffffa600179d0c0 ; kb

FAILURE_BUCKET_ID: X64_0x24_CODE_ADDRESS_MISMATCH_Ntfs!EfsCleanup+4c

BUCKET_ID: X64_0x24_CODE_ADDRESS_MISMATCH_Ntfs!EfsCleanup+4c

Followup: MachineOwner
---------
 
18A
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {4, c, 0, fffff80001868f3e}

Probably caused by : fileinfo.sys ( fileinfo!FIPfInterfaceOpen+803 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000004, memory referenced
Arg2: 000000000000000c, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80001868f3e, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a31080
0000000000000004

CURRENT_IRQL: c

FAULTING_IP:
nt!ExpReleaseResourceForThreadLite+16e
fffff800`01868f3e 8b4e04 mov ecx,dword ptr [rsi+4]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: svchost.exe

TRAP_FRAME: fffffa600643ac40 -- (.trap 0xfffffa600643ac40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80001a33440 rbx=01c8d1c91abb2851 rcx=fffff8000197ccf0
rdx=0000000000000000 rsi=fffffa8001250210 rdi=0000000000000000
rip=fffff80001868f3e rsp=fffffa600643add0 rbp=0000000000000000
r8=0000000000000000 r9=01c8d1c91abb2801 r10=0000000000000070
r11=0000000000008000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!ExpReleaseResourceForThreadLite+0x16e:
fffff800`01868f3e 8b4e04 mov ecx,dword ptr [rsi+4] ds:0008:fffffa80`01250214=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff8000185d12e to fffff8000185d390

STACK_TEXT:
fffffa60`0643aaf8 fffff800`0185d12e : 00000000`0000000a 00000000`00000004 00000000`0000000c 00000000`00000000 : nt!KeBugCheckEx
fffffa60`0643ab00 fffff800`0185c00b : 00000000`00000000 fffffa80`01638db0 fffffa80`01638e00 fffffa80`01334860 : nt!KiBugCheckDispatch+0x6e
fffffa60`0643ac40 fffff800`01868f3e : fffffa80`01f29010 00000000`00000000 01c85bd8`33275f11 01c85bd8`33275f11 : nt!KiPageFault+0x20b
fffffa60`0643add0 fffffa60`01016c05 : fffffa60`0643afa0 00000000`00000000 fffffa60`0643af00 fffffa60`00a0a2ee : nt!ExpReleaseResourceForThreadLite+0x16e
fffffa60`0643ae50 fffffa60`01018c04 : fffffa80`0159f470 00000000`00000000 fffffa80`03d27760 00000000`00000001 : Ntfs!NtfsCleanupIrpContext+0x3d5
fffffa60`0643aea0 fffffa60`010cea8a : fffffa80`0159f470 fffffa80`0159f470 00000000`00000000 fffffa80`0159f400 : Ntfs!NtfsExtendedCompleteRequest+0xd4
fffffa60`0643aee0 fffffa60`01017a46 : fffffa80`0159f470 fffffa80`03d27760 fffffa80`02b29401 fffffa80`01250200 : Ntfs!NtfsCommonSetInformation+0xe40
fffffa60`0643afc0 fffffa60`00a07e17 : 00000000`00000801 fffffa80`03d27760 fffffa80`00ceba01 fffffa80`01d15180 : Ntfs!NtfsFsdSetInformation+0x316
fffffa60`0643b070 fffffa60`00a070dd : fffffa80`00d02440 fffffa80`03d27760 fffffa80`01f2a400 00000000`00000000 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x227
fffffa60`0643b0e0 fffff800`01aac8df : 00000000`00000028 fffffa80`01250260 00000000`00000028 fffffa80`00ceba00 : fltmgr!FltpDispatch+0xcd
fffffa60`0643b140 fffff800`0185ce33 : ffffffff`80000978 fffffa80`03d89060 fffffa60`0643b498 fffffa60`00000028 : nt!NtSetInformationFile+0x5fb
fffffa60`0643b270 fffff800`0185d340 : fffffa60`00a57353 00000000`00000000 00000000`00000000 fffffa80`02b299a0 : nt!KiSystemServiceCopyEnd+0x13
fffffa60`0643b478 fffffa60`00a57353 : 00000000`00000000 00000000`00000000 fffffa80`02b299a0 00000000`00000000 : nt!KiServiceLinkage
fffffa60`0643b480 fffff800`01b62097 : fffffa80`00c86501 fffff800`01864f01 00000000`00000000 fffffa80`02b299a0 : fileinfo!FIPfInterfaceOpen+0x803
fffffa60`0643b600 fffff800`01c0a907 : 00000000`00000020 ffffffff`ffe91ca0 fffffa60`0643b718 fffffa80`00000000 : nt!PfpOpenHandleCreate+0x117
fffffa60`0643b6d0 fffff800`01c0cc26 : 00000000`00000000 fffff880`09140178 fffff880`0913e000 fffffa60`00000060 : nt!PfpFileBuildReadSupport+0xe7
fffffa60`0643b7c0 fffff800`01c36609 : fffff880`00000000 00000000`00000005 00000000`000000af 00000000`00000000 : nt!PfpPrefetchFilesTrickle+0x126
fffffa60`0643b8c0 fffff800`01c368c2 : 00000000`00000000 fffffa60`0643bca0 fffffa60`0643ba08 fffff880`0913e001 : nt!PfpPrefetchRequestPerform+0x2f9
fffffa60`0643b960 fffff800`01c36b26 : fffffa60`0643ba08 00000000`00000001 fffffa80`039d0930 00000000`00000000 : nt!PfpPrefetchRequest+0x171
fffffa60`0643b9d0 fffff800`01c49258 : 00000000`00000000 00000000`00000004 fffffa80`00d35000 00000000`00000001 : nt!PfSetSuperfetchInformation+0x1a5
fffffa60`0643bab0 fffff800`0185ce33 : fffffa80`03d89060 00000000`00000000 00000000`00000001 00000000`05195e50 : nt!NtSetSystemInformation+0x8fb
fffffa60`0643bc20 00000000`777770ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0343f7b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777770ea


STACK_COMMAND: kb

FOLLOWUP_IP:
fileinfo!FIPfInterfaceOpen+803
fffffa60`00a57353 8a8c2488010000 mov cl,byte ptr [rsp+188h]

SYMBOL_STACK_INDEX: d

SYMBOL_NAME: fileinfo!FIPfInterfaceOpen+803

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: fileinfo

IMAGE_NAME: fileinfo.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47919323

FAILURE_BUCKET_ID: X64_0xA_fileinfo!FIPfInterfaceOpen+803

BUCKET_ID: X64_0xA_fileinfo!FIPfInterfaceOpen+803

Followup: MachineOwner
---------
 
18B
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80001db338a, 1, 38}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29317 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80001db338a, The address that the exception occurred at
Arg3: 0000000000000001, Parameter 0 of the exception
Arg4: 0000000000000038, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
+fffff80001db338a
fffff800`01db338a ?? ???

EXCEPTION_PARAMETER1: 0000000000000001

EXCEPTION_PARAMETER2: 0000000000000038

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a80080
0000000000000038

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x1E

PROCESS_NAME: hl2.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffffa6005dc79a0 -- (.trap 0xfffffa6005dc79a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=00000000000007ff rsi=fffff800019cb680 rdi=0000000000000000
rip=fffff80001db338a rsp=fffffa6005dc7b30 rbp=fffffa80036e1440
r8=0000000000000000 r9=0000000000007e00 r10=0000000000000008
r11=fffffa8000fc1794 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
fffff800`01db338a ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80001885e67 to fffff800018ac390

STACK_TEXT:
fffffa60`05dc71b8 fffff800`01885e67 : 00000000`0000001e ffffffff`c0000005 fffff800`01db338a 00000000`00000001 : nt!KeBugCheckEx
fffffa60`05dc71c0 fffff800`018ac1e9 : fffffa60`05dc78f8 00000000`00000000 fffffa60`05dc79a0 fffffa80`03f83ca8 : nt! ?? ::FNODOBFM::`string'+0x29317
fffffa60`05dc77c0 fffff800`018aafe5 : 00000000`00000001 fffffa60`0300c743 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xa9
fffffa60`05dc79a0 fffff800`01db338a : 00000000`00000468 00000000`00400000 00000000`00000000 00000000`00000008 : nt!KiPageFault+0x1e5
fffffa60`05dc7b30 00000000`00000468 : 00000000`00400000 00000000`00000000 00000000`00000008 fffff800`019cb680 :
fffffa60`05dc7b98 00000000`00000000 : 00000000`00000000 fffffa60`05dc7ca0 fffffa80`036e1440 fffff800`01b27e38 : 0x1
fffffa60`05dc7ba0 00000000`00000000 : fffffa60`05dc7ca0 fffffa80`036e1440 fffff800`01b27e38 00000000`00000000 : 0x0
fffffa60`05dc7ba8 fffffa60`05dc7ca0 : fffffa80`036e1440 fffff800`01b27e38 00000000`00000000 fffff800`00000006 : 0x0
fffffa60`05dc7bb0 fffffa80`036e1440 : fffff800`01b27e38 00000000`00000000 fffff800`00000006 00000000`00000001 : 0xfffffa60`05dc7ca0
fffffa60`05dc7bb8 fffff800`01b27e38 : 00000000`00000000 fffff800`00000006 00000000`00000001 fffffa60`05dc7c00 : 0xfffffa80`036e1440
fffffa60`05dc7bc0 fffff800`018abe33 : fffffa80`03f83bb0 00000000`00000000 00000000`00000000 fffffa80`036e1440 : nt!NtWaitForSingleObject+0x98
fffffa60`05dc7c20 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+29317
fffff800`01885e67 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+29317

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 479192b7

FAILURE_BUCKET_ID: X64_0x1E_W_nt!_??_::FNODOBFM::_string_+29317

BUCKET_ID: X64_0x1E_W_nt!_??_::FNODOBFM::_string_+29317

Followup: MachineOwner
---------


19A
...
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {22, d00000, 0, 0}

Probably caused by : win32k.sys ( win32k!UserDeleteW32Thread+6c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000022,
Arg2: 0000000000d00000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR: 0x19_22

POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a48080
0000000000d00000

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: RivaTuner.exe

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from fffff800018c3635 to fffff80001874390

STACK_TEXT:
fffffa60`06af4908 fffff800`018c3635 : 00000000`00000019 00000000`00000022 00000000`00d00000 00000000`00000000 : nt!KeBugCheckEx
fffffa60`06af4910 fffff800`0195307b : fffff800`0181f000 00000000`00000000 fffff800`019b2160 fffff800`0187bfa9 : nt! ?? ::FNODOBFM::`string'+0x37e6
fffffa60`06af4970 fffff960`00109da0 : fffffa80`018ba810 fffffa80`00c79930 fffffa80`00000000 fffffa80`016059e0 : nt!ExFreePoolWithTag+0x4bb
fffffa60`06af4a20 fffff960`00108bad : fffffa80`016059e0 fffffa80`044e6660 fffffa80`016059e0 fffff900`c08bfc60 : win32k!UserDeleteW32Thread+0x6c
fffffa60`06af4a50 fffff960`00104e90 : fffffa80`04527830 fffffa80`016059e0 00000000`00000000 00000000`00000000 : win32k!DereferenceW32Thread+0x15
fffffa60`06af4a80 fffff800`01b1c877 : fffffa80`04527830 00000000`00000000 00000000`00000000 fffffa80`016059e0 : win32k!W32pThreadCallout+0x94
fffffa60`06af4ab0 fffff800`01b1cd3d : 00000000`00000000 fffffa80`01605901 00000000`00000000 00000000`00000000 : nt!PspExitThread+0x523
fffffa60`06af4b70 fffff800`01ad3c7a : 00000000`00000000 00000000`0000000c 00000000`7efdd000 fffff880`0000000c : nt!PspTerminateThreadByPointer+0x4d
fffffa60`06af4bc0 fffff800`01873e33 : fffffa80`018ba810 fffffa80`016059e0 fffffa60`06af4ca0 00000000`7efdd000 : nt!NtTerminateProcess+0xfa
fffffa60`06af4c20 00000000`77765d3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0007e598 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77765d3a


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!UserDeleteW32Thread+6c
fffff960`00109da0 488b8bb0000000 mov rcx,qword ptr [rbx+0B0h]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: win32k!UserDeleteW32Thread+6c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47c78e35

FAILURE_BUCKET_ID: X64_0x19_22_win32k!UserDeleteW32Thread+6c

BUCKET_ID: X64_0x19_22_win32k!UserDeleteW32Thread+6c

Followup: MachineOwner
 
19B
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa8004fc5ad0, 0, fffff8000194dc03, 0}


Could not read faulting driver name
Probably caused by : dxgkrnl.sys ( dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa8004fc5ad0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8000194dc03, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a43080
fffffa8004fc5ad0

FAULTING_IP:
nt!ExFreePoolWithTag+43
fffff800`0194dc03 418b45f0 mov eax,dword ptr [r13-10h]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: 3DMark06.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffffa6007ded5e0 -- (.trap 0xfffffa6007ded5e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=fffff88000000174 rcx=fffffa8004fc5ae0
rdx=0000000000000000 rsi=fffffa8004326500 rdi=000000006d4d6956
rip=fffff8000194dc03 rsp=fffffa6007ded770 rbp=0000000000000000
r8=0000000000000003 r9=0000000000000175 r10=00000000005b5ac0
r11=fffffa6007ded800 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!ExFreePoolWithTag+0x43:
fffff800`0194dc03 418b45f0 mov eax,dword ptr [r13-10h] ds:ffffffff`fffffff0=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff8000187e371 to fffff8000186f390

STACK_TEXT:
fffffa60`07ded4e8 fffff800`0187e371 : 00000000`00000050 fffffa80`04fc5ad0 00000000`00000000 fffffa60`07ded5e0 : nt!KeBugCheckEx
fffffa60`07ded4f0 fffff800`0186df19 : 00000000`00000000 fffff800`01874f8a fffffa80`0423ba00 fffffa80`04b4f5c0 : nt!MmAccessFault+0x1371
fffffa60`07ded5e0 fffff800`0194dc03 : fffff880`07fb3010 00000000`00000001 fffff880`05f173d0 fffffa60`028c4ce3 : nt!KiPageFault+0x119
fffffa60`07ded770 fffffa60`028c0515 : 00000000`00000000 00000000`00000000 fffff880`07fb3010 00000000`00000000 : nt!ExFreePoolWithTag+0x43
fffffa60`07ded820 fffffa60`028c02c4 : 00000000`00000000 fffffa60`00000000 00000000`00000001 00000000`00000000 : dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+0x215
fffffa60`07ded8f0 fffffa60`02844f29 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : dxgkrnl!VIDMM_GLOBAL::CloseAllocation+0x44
fffffa60`07ded920 fffffa60`02848e07 : 00000000`00000000 fffff880`07f1b1d0 00000000`00000000 00000000`00000000 : dxgkrnl!DXGDEVICE::DestroyAllocations+0x41d
fffffa60`07deda10 fffffa60`0284b235 : fffff880`06e20000 fffffa60`07dedb30 fffff880`06e20001 fffffa60`07dedc01 : dxgkrnl!DXGDEVICE::DestroyAllocation+0x3e3
fffffa60`07dedab0 fffff960`00262516 : fffffa60`00000000 fffffa80`01887a70 00000000`7efda000 00000000`00000020 : dxgkrnl!DxgkDestroyAllocation+0x8dd
fffffa60`07dedbf0 fffff800`0186ee33 : fffffa80`01887a70 00000000`00000000 00000000`00000000 fffffa80`0283c4b0 : win32k!NtGdiDdDDIDestroyAllocation+0x12
fffffa60`07dedc20 00000000`75d2b5ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`035de7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75d2b5ca


STACK_COMMAND: kb

FOLLOWUP_IP:
dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215
fffffa60`028c0515 488b4b20 mov rcx,qword ptr [rbx+20h]

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: dxgkrnl

IMAGE_NAME: dxgkrnl.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 479193e6

FAILURE_BUCKET_ID: X64_0x50_dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215

BUCKET_ID: X64_0x50_dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215

Followup: MachineOwner



19C
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff88007d0a0b0, 0, fffff80001b0b093, 2}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!CmpCacheLookup+193 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff88007d0a0b0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80001b0b093, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a70080
fffff88007d0a0b0

FAULTING_IP:
nt!CmpCacheLookup+193
fffff800`01b0b093 3819 cmp byte ptr [rcx],bl

MM_INTERNAL_CODE: 2

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: AirPlusCFG.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffffa6005069060 -- (.trap 0xfffffa6005069060)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000091ec4f9a rbx=fffffa6005069db0 rcx=fffff88007d0a0b0
rdx=0000000010650760 rsi=0006010704020503 rdi=fffffa6005069678
rip=fffff80001b0b093 rsp=fffffa60050691f0 rbp=fffffa60050693c0
r8=00000000de532e42 r9=0000000000000008 r10=0000000000000000
r11=fffffa60050691e0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!CmpCacheLookup+0x193:
fffff800`01b0b093 3819 cmp byte ptr [rcx],bl ds:8060:fffff880`07d0a0b0=??
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800018aa534 to fffff8000189c390

STACK_TEXT:
fffffa60`05068f68 fffff800`018aa534 : 00000000`00000050 fffff880`07d0a0b0 00000000`00000000 fffffa60`05069060 : nt!KeBugCheckEx
fffffa60`05068f70 fffff800`0189af19 : 00000000`00000000 fffff880`057c0a58 00000000`10650700 00000000`00000000 : nt!MmAccessFault+0x534
fffffa60`05069060 fffff800`01b0b093 : fffffa60`05069750 fffffa60`05069330 fffffa60`05069840 fffffa60`05069768 : nt!KiPageFault+0x119
fffffa60`050691f0 fffff800`01b0bcc5 : fffffa60`05069330 fffffa60`00000007 fffffa60`05069770 fffffa60`05069750 : nt!CmpCacheLookup+0x193
fffffa60`050692d0 fffff800`01b0c69a : fffffa60`05069b70 fffffa60`05069750 fffffa60`05069740 fffffa60`05069758 : nt!CmpBuildHashStackAndLookupCache+0x276
fffffa60`05069670 fffff800`01b1d999 : 00000000`00000040 00000000`00000104 fffffa80`012a8b10 fffff880`069b6601 : nt!CmpParseKey+0x20a
fffffa60`05069910 fffff800`01b21884 : 00000000`00000000 fffffa80`04bffa01 00000000`00000040 fffffa80`00c70080 : nt!ObpLookupObjectName+0x5eb
fffffa60`05069a20 fffff800`01b0786f : fffffa80`00020019 00000000`75f53300 fffffa80`04c13001 00000000`00020006 : nt!ObOpenObjectByName+0x2f4
fffffa60`05069af0 fffff800`0189be33 : 00000000`005fe828 00000000`00020019 00000000`005fe8d0 00000000`00000000 : nt!CmOpenKey+0x25d
fffffa60`05069c20 00000000`77c75b9a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`005fc108 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c75b9a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CmpCacheLookup+193
fffff800`01b0b093 3819 cmp byte ptr [rcx],bl

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!CmpCacheLookup+193

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 479192b7

FAILURE_BUCKET_ID: X64_0x50_nt!CmpCacheLookup+193

BUCKET_ID: X64_0x50_nt!CmpCacheLookup+193

Followup: MachineOwner
--------
 
20A
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff960001a5fdb, fffffa6005b5d760, 0}

Probably caused by : win32k.sys ( win32k!NextTopWindow+193 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff960001a5fdb, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa6005b5d760, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
win32k!NextTopWindow+193
fffff960`001a5fdb 488b4110 mov rax,qword ptr [rcx+10h]

CONTEXT: fffffa6005b5d760 -- (.cxr 0xfffffa6005b5d760)
rax=fffffa8004924e60 rbx=fffff900c0c7f3d0 rcx=ff7ec9a0ff7ec9a0
rdx=fffff900c0c00a60 rsi=fffff900c0c16d60 rdi=fffff900c0c25be0
rip=fffff960001a5fdb rsp=fffffa6005b5dfc0 rbp=fffff900c0c7f3d0
r8=0000000000000000 r9=fffff900c2e2b160 r10=fffff900c0c7f3d0
r11=fffff900c0c0f290 r12=0000000000000001 r13=0000000000000002
r14=fffff900c2e2b160 r15=0000000000000001
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
win32k!NextTopWindow+0x193:
fffff960`001a5fdb 488b4110 mov rax,qword ptr [rcx+10h] ds:002b:ff7ec9a0`ff7ec9b0=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: speedfan.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff96000175f2e to fffff960001a5fdb

STACK_TEXT:
fffffa60`05b5dfc0 fffff960`00175f2e : fffff900`c0c7f3d0 fffff900`c0c7f3d0 00000000`00000002 fffff900`c2e2b160 : win32k!NextTopWindow+0x193
fffffa60`05b5e000 fffff960`0016488b : fffff900`c0c7f3d0 00000000`00000018 00000000`00000083 00000000`00000000 : win32k!xxxActivateWindow+0x122
fffffa60`05b5e060 fffff960`00183c63 : 00000000`00000001 fffff900`c0c7f3d0 fffff900`c0c7f3d0 00000000`00000000 : win32k!xxxShowWindow+0x41b
fffffa60`05b5e0d0 fffff960`001923cc : 00000000`00000001 fffff900`c0c7f3d0 00000000`00000018 fffff800`01cc8911 : win32k!xxxRealDefWindowProc+0x5b7
fffffa60`05b5e220 fffff960`00166567 : fffff900`c0c7f3d0 00000000`00000001 00000000`0000029e fffff900`c0c7f3d0 : win32k!xxxWrapRealDefWindowProc+0x3c
fffffa60`05b5e250 fffff960`001917d8 : 00000000`00040454 00000000`0000029e fffffa60`05b5e5d0 00000000`00000000 : win32k!NtUserfnNCDESTROY+0x27
fffffa60`05b5e290 fffff800`01a5ae33 : fffffa80`01263bb0 fffffa60`05b5e3f0 00000000`0007d588 fffffa60`05b5e318 : win32k!NtUserMessageCall+0x130
fffffa60`05b5e300 00000000`75209fea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0007d568 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75209fea


FOLLOWUP_IP:
win32k!NextTopWindow+193
fffff960`001a5fdb 488b4110 mov rax,qword ptr [rcx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!NextTopWindow+193

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47c78e35

STACK_COMMAND: .cxr 0xfffffa6005b5d760 ; kb

FAILURE_BUCKET_ID: X64_0x3B_win32k!NextTopWindow+193

BUCKET_ID: X64_0x3B_win32k!NextTopWindow+193

Followup: MachineOwner
---------


20B
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 1386af, 0, 0}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4b )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000001386af, page frame number
Arg3: 0000000000000000, current page state
Arg4: 0000000000000000, 0

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: windbg.exe

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from fffff80001ad43db to fffff80001a5d390

STACK_TEXT:
fffffa60`06cc8778 fffff800`01ad43db : 00000000`0000004e 00000000`00000099 00000000`001386af 00000000`00000000 : nt!KeBugCheckEx
fffffa60`06cc8780 fffff800`01a999a5 : fffff6fb`7dbed000 fffffa80`00a3f2f0 00000000`00000002 fffff6fb`7da00000 : nt!MiBadShareCount+0x4b
fffffa60`06cc87c0 fffff800`01a91a65 : 00000000`00000008 00000000`002a0000 00000000`00000000 fffff800`01bce850 : nt!MiDeletePageTableHierarchy+0x245
fffffa60`06cc88d0 fffff800`01a41696 : fffff6fb`7dbed011 00000000`0029ffff fffffa80`00000000 fffffa80`00000000 : nt!MiDeleteVirtualAddresses+0x736
fffffa60`06cc8a60 fffff800`01d0584c : fffff880`06ee4ab0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCleanProcessAddressSpace+0x6ae
fffffa60`06cc8ab0 fffff800`01d05d3d : 00000000`00000000 fffffa80`04fb7b01 000007ff`fffda000 00000000`00000000 : nt!PspExitThread+0x4f8
fffffa60`06cc8b70 fffff800`01cbcc7a : 00000000`00000000 00000000`0000000c 00000000`00000000 fffff880`0000000c : nt!PspTerminateThreadByPointer+0x4d
fffffa60`06cc8bc0 fffff800`01a5ce33 : fffffa80`01417040 fffffa80`04fb7bb0 fffffa60`06cc8ca0 00000000`00000000 : nt!NtTerminateProcess+0xfa
fffffa60`06cc8c20 00000000`77cb5d3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`043ff838 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77cb5d3a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiBadShareCount+4b
fffff800`01ad43db cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiBadShareCount+4b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 479192b7

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4b

BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4b

Followup: MachineOwner
---------
 
20C
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80001a5f316, fffffa6005183eb0, 0}

Probably caused by : afd.sys ( afd! ?? ::GFJBLGFE::`string'+33e4 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80001a5f316, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa6005183eb0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!RtlpInterlockedPushEntrySList+26
fffff800`01a5f316 4c8902 mov qword ptr [rdx],r8

CONTEXT: fffffa6005183eb0 -- (.cxr 0xfffffa6005183eb0)
rax=0000000000000000 rbx=0000000000ec0000 rcx=fffffa80041863d0
rdx=0000000000ec0000 rsi=fffffa80041873d0 rdi=fffffa800143aae0
rip=fffff80001a5f316 rsp=fffffa6005184718 rbp=fffffa6000f5d220
r8=0000000000000000 r9=00001d8000000000 r10=0000000000000000
r11=00000000000007ff r12=fffffa8001804650 r13=fffffa80026fc700
r14=fffffa80042ae9a0 r15=fffffa8001804670
iopl=0 nv up ei pl zr ac po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010256
nt!RtlpInterlockedPushEntrySList+0x26:
fffff800`01a5f316 4c8902 mov qword ptr [rdx],r8 ds:002b:00000000`00ec0000=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: WoW-1.12.x-to-2

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffffa600424eaf5 to fffff80001a5f316

STACK_TEXT:
fffffa60`05184718 fffffa60`0424eaf5 : 00000000`00ec0000 fffffa80`042ae9a0 fffffa80`026fc700 fffffa80`0156d010 : nt!RtlpInterlockedPushEntrySList+0x26
fffffa60`05184720 fffffa60`04209192 : 00000000`00000000 fffffa80`0143aae0 00000000`00000000 fffffa80`45656c41 : afd! ?? ::GFJBLGFE::`string'+0x33e4
fffffa60`05184760 fffffa60`00e62d86 : fffffa80`01306010 00000000`00000000 fffffa80`0272bc10 fffffa80`0263a010 : afd!AfdFreeConnectionEx+0x22
fffffa60`05184790 fffffa60`00e70ed8 : fffffa80`01306010 00000000`00000000 00000000`00000000 fffff800`01a93700 : tcpip!TcpCleanupTcbWorkQueueRoutine+0xd6
fffffa60`051847d0 fffffa60`00e713c8 : 00000000`00000000 fffffa60`0425a0be fffffa80`01306010 fffffa80`0159e102 : tcpip!TcpCloseTcbOlmNotifyTerminateComplete+0x78
fffffa60`05184870 fffffa60`00e713e9 : fffffa80`03ea4200 fffffa80`0143aae0 00000004`1000000e 80000000`00000000 : tcpip!TcpCloseTcb+0x78
fffffa60`051848d0 fffffa60`0423e01a : fffff800`01b81b00 fffff800`01b1fde9 fffff800`01b81b80 fffffa80`026fc710 : tcpip!TcpTlConnectionCloseEndpoint+0x9
fffffa60`05184900 fffffa60`0422c8f0 : fffffa80`0263a010 00000000`00000001 00000000`00000000 80000000`00000000 : afd!AfdCloseConnection+0x7a
fffffa60`05184940 fffffa60`0423c498 : 00000000`00000000 fffffa80`042ae9a0 fffffa80`026fc710 00000000`00000001 : afd!AfdCloseCore+0x180
fffffa60`051849d0 fffff800`01cda53e : fffffa80`01572cd0 fffffa80`01572cd0 00000000`00000004 fffffa60`05184a70 : afd!AfdDispatch+0x78
fffffa60`05184a10 fffff800`01a64e93 : 00000000`00000000 fffffa80`01572cd0 fffffa80`01572ca0 fffffa60`005ec180 : nt!IopDeleteFile+0x17e
fffffa60`05184aa0 fffff800`01cdbc5e : fffff880`07209510 fffffa80`00000001 fffffa80`0272bc10 00000000`00000002 : nt!ObfDereferenceObject+0x103
fffffa60`05184b30 fffff800`01cdbe04 : fffff880`07a829b0 fffff880`07a82900 00000000`00000001 00000000`00000544 : nt!ObpCloseHandleTableEntry+0xce
fffffa60`05184bd0 fffff800`01a5ce33 : fffffa80`026fc710 fffffa60`05184ca0 00000000`7efaf000 fffffa80`04231420 : nt!ObpCloseHandle+0x94
fffffa60`05184c20 00000000`76f95b6a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0060e848 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f95b6a


FOLLOWUP_IP:
afd! ?? ::GFJBLGFE::`string'+33e4
fffffa60`0424eaf5 90 nop

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: afd! ?? ::GFJBLGFE::`string'+33e4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: afd

IMAGE_NAME: afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47919ad7

STACK_COMMAND: .cxr 0xfffffa6005183eb0 ; kb

FAILURE_BUCKET_ID: X64_0x3B_afd!_??_::GFJBLGFE::_string_+33e4

BUCKET_ID: X64_0x3B_afd!_??_::GFJBLGFE::_string_+33e4

Followup: MachineOwner
---------
 
Status
Not open for further replies.

Similar threads

R
Windows 2008 R2 BSOD
Replies
1
Views
2K
Cycloid Torus
Cycloid Torus
P
BSoD upon non safe mode booting
Replies
2
Views
2K
patricia016
P
MacunRc
BSOD bad pool caller (c2) Windows10
Replies
6
Views
4K
Tmagic650
Tmagic650

Latest posts

Back