XP machines are randomly rebooting

[chris0277]

Hello I was wondering if anyone could help. I have a few machines that are rebooting randomly. I was able to decipher the mini dump but I still can't figure out what is going on. any help would be appreciated.






Loading Dump File [C:\Documents and Settings\cballard\Desktop\Mini122910-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
Debug session time: Wed Dec 29 14:37:55.462 2010 (UTC - 5:00)
System Uptime: 0 days 2:35:49.265
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
.............................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, cd4, 0, 864b5cc0}

GetUlongFromAddress: unable to read from 805637f0
GetUlongFromAddress: unable to read from 805637f0
Probably caused by : ntoskrnl.exe ( nt!KeContextToKframes+1eb )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 00000cd4, (reserved)
Arg3: 00000000, Memory contents of the pool block
Arg4: 864b5cc0, Address of the block of pool being deallocated

Debugging Details:
------------------

GetUlongFromAddress: unable to read from 805637f0
GetUlongFromAddress: unable to read from 805637f0

POOL_ADDRESS: 864b5cc0

BUGCHECK_STR: 0xc2_7

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 80544b06 to 804f8cc5

STACK_TEXT:
f7932d0c 80544b06 000000c2 00000007 00000cd4 nt!KeContextToKframes+0x1eb
f7932d5c 805080f9 864b5cc0 00000000 805586d4 nt!VfBuildMdlFromScatterGatherList+0xa0
f7932d8c 8050965e e1d15168 00000000 86fc2288 nt!MmGetSessionById+0x4d
f7932dac 805c61e0 00000000 00000000 00000000 nt!MiIsPhysicalMemoryAddress+0x42
f7932ddc 80541e12 805095c0 00000000 00000000 nt!IopCmResourcesToIoResources+0x25
f7932df8 00000000 00000000 00000000 00001f80 nt!RtlpTraceDatabaseInternalAdd+0xc0


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KeContextToKframes+1eb
804f8cc5 5d pop ebp

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KeContextToKframes+1eb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4bd6e0e9

FAILURE_BUCKET_ID: 0xc2_7_nt!KeContextToKframes+1eb

BUCKET_ID: 0xc2_7_nt!KeContextToKframes+1eb

Followup: MachineOwner
---------