System Restarts with more than 8GB RAM

sunofcain · 28 Dec 2010

system randomly restarts sometimes sitting idle when i install more than 8GB of identical RAM. have tried many different memory settings/voltages/disable ahci and more in the BIOS to no avail... have gotten three different types of crash dumps. please see below:

CRASH DUMP #1:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\122810-20467-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c09000 PsLoadedModuleList = 0xfffff800`02e46e50
Debug session time: Tue Dec 28 09:02:20.924 2010 (UTC - 8:00)
System Uptime: 0 days 0:06:32.375
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002c7d597, fffff88007dc5020, 0}

Probably caused by : ntkrnlmp.exe ( nt!PspReturnQuota+47 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002c7d597, Address of the instruction which caused the bugcheck
Arg3: fffff88007dc5020, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!PspReturnQuota+47
fffff800`02c7d597 488b5d00 mov rbx,qword ptr [rbp]

CONTEXT: fffff88007dc5020 -- (.cxr 0xfffff88007dc5020)
rax=fffff80002e28a00 rbx=fffff8a0085ee030 rcx=b6fff80002e07a80
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000048
rip=fffff80002c7d597 rsp=fffff88007dc59f0 rbp=b6fff80002e07b00
r8=0000000000000001 r9=0000000000000048 r10=0000000000000001
r11=fffffa800cb4c420 r12=0000000000000001 r13=0000000000000080
r14=0000000000000005 r15=b6fff80002e07a80
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!PspReturnQuota+0x47:
fffff800`02c7d597 488b5d00 mov rbx,qword ptr [rbp] ss:0018:b6fff800`02e07b00=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff80002f75852 to fffff80002c7d597

STACK_TEXT:
fffff880`07dc59f0 fffff800`02f75852 : fffff8a0`085ee030 fffff8a0`085ee010 00000000`00000400 fffff800`02f41377 : nt!PspReturnQuota+0x47
fffff880`07dc5a50 fffff800`02c7e8bc : b6fff800`02e07a80 00000000`00000000 fffffa80`0f514b30 fffffa80`0ca15f30 : nt!ObpFreeObject+0x1e2
fffff880`07dc5aa0 fffff800`02f8f514 : fffffa80`0f514b30 00000000`00000000 fffffa80`0f6d2b60 00000000`00000000 : nt!ObfDereferenceObject+0xdc
fffff880`07dc5b00 fffff800`02f8f414 : 00000000`0000158c fffffa80`0f514b30 fffff8a0`01d1f0c0 00000000`0000158c : nt!ObpCloseHandleTableEntry+0xc4
fffff880`07dc5b90 fffff800`02c78993 : fffffa80`0f6d2b60 fffff880`07dc5c60 00000000`00000000 fffffa80`0cc071b0 : nt!ObpCloseHandle+0x94
fffff880`07dc5be0 00000000`7773fe4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0499f528 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7773fe4a

FOLLOWUP_IP:
nt!PspReturnQuota+47
fffff800`02c7d597 488b5d00 mov rbx,qword ptr [rbp]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!PspReturnQuota+47

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9

STACK_COMMAND: .cxr 0xfffff88007dc5020 ; kb

FAILURE_BUCKET_ID: X64_0x3B_nt!PspReturnQuota+47

BUCKET_ID: X64_0x3B_nt!PspReturnQuota+47

Followup: MachineOwner
---------

CRASH DUMP #2:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\122810-27175-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*DownstreamStore*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c5b000 PsLoadedModuleList = 0xfffff800`02e98e50
Debug session time: Tue Dec 28 10:31:31.093 2010 (UTC - 8:00)
System Uptime: 0 days 0:12:44.934
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {403, fffff68000014458, a7f000001891c867, fffffe8000014458}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3c8 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff68000014458
Arg3: a7f000001891c867
Arg4: fffffe8000014458

Debugging Details:
------------------

BUGCHECK_STR: 0x1a_403

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: sidebar.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff80002d3d6c8 to fffff80002ccb740

STACK_TEXT:
fffff880`08aefc68 fffff800`02d3d6c8 : 00000000`0000001a 00000000`00000403 fffff680`00014458 a7f00000`1891c867 : nt!KeBugCheckEx
fffff880`08aefc70 fffff800`02cfc381 : 00000000`00000000 fffff680`000144a8 fffffa80`0f652550 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x31ef2
fffff880`08aefe20 fffff800`02d0d0da : 00000000`00000000 00000000`02895fff fffffa80`00000000 fffffa80`0f652550 : nt!MiDeleteVirtualAddresses+0x408
fffff880`08aeffe0 fffff800`02cca993 : ffffffff`ffffffff fffff880`08af02a0 fffff880`08af0308 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`08af00d0 fffff800`02cc6f30 : fffff960`000c53d0 00000000`00000001 fffff900`c0107010 fffff900`c242d010 : nt!KiSystemServiceCopyEnd+0x13
fffff880`08af0268 fffff960`000c53d0 : 00000000`00000001 fffff900`c0107010 fffff900`c242d010 00000000`00000000 : nt!KiServiceLinkage
fffff880`08af0270 fffff960`000c5720 : 00000000`00000000 fffff880`00000000 fffff900`c242d010 fffff960`00000000 : win32k!SURFACE::bDeleteSurface+0x3c8
fffff880`08af03c0 fffff960`0008650d : 00000000`4305174e fffff900`c242d010 00000000`4305174e 00000000`05df0340 : win32k!bDeleteSurface+0x34
fffff880`08af03f0 fffff800`02cca993 : fffffa80`0ffb1060 fffff880`00000000 fffff900`00000002 fffff960`00000002 : win32k!NtGdiDeleteObjectApp+0xd5
fffff880`08af0420 000007fe`ffd9118a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0322af18 fffff800`02cc3080 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`ffd9118a
fffff880`08af0840 fffff900`00000003 : 00000000`00000000 fffffa80`00000000 fffffa80`0ffb1420 7ff00000`00000000 : nt!KiCallUserMode
fffff880`08af0848 00000000`00000000 : fffffa80`00000000 fffffa80`0ffb1420 7ff00000`00000000 fffff880`08af0d70 : 0xfffff900`00000003

STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SURFACE::bDeleteSurface+3c8
fffff960`000c53d0 e9b0010000 jmp win32k!SURFACE::bDeleteSurface+0x57d (fffff960`000c5585)

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: win32k!SURFACE::bDeleteSurface+3c8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4cbe5d3e

FAILURE_BUCKET_ID: X64_0x1a_403_win32k!SURFACE::bDeleteSurface+3c8

BUCKET_ID: X64_0x1a_403_win32k!SURFACE::bDeleteSurface+3c8

Followup: MachineOwner
---------

CRASH DUMP #3:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\122810-18220-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*DownstreamStore*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c55000 PsLoadedModuleList = 0xfffff800`02e92e50
Debug session time: Tue Dec 28 10:50:00.568 2010 (UTC - 8:00)
System Uptime: 0 days 0:16:34.550
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffffa80099cc680, fffffa80099cc680, a6fffa80099cc680}

Unable to load image eamon.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for eamon.sys
*** ERROR: Module load completed but symbols could not be loaded for eamon.sys
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+a56 )

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffffa80099cc680, the pool entry being checked.
Arg3: fffffa80099cc680, the read back flink freelist value (should be the same as 2).
Arg4: a6fffa80099cc680, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------

BUGCHECK_STR: 0x19_3

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: DkService.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff80002df8d6f to fffff80002cc5740

STACK_TEXT:
fffff880`021f5038 fffff800`02df8d6f : 00000000`00000019 00000000`00000003 fffffa80`099cc680 fffffa80`099cc680 : nt!KeBugCheckEx
fffff880`021f5040 fffff880`011c8235 : 00000000`00000001 00000000`0000001f fffffa80`0acf0190 fffff880`00000000 : nt!ExDeferredFreePool+0xa56
fffff880`021f5130 fffff880`011c9361 : fffffa80`00000026 00000000`00000081 00000000`00000020 00000000`00000000 : fltmgr!FltpExpandShortNames+0x365
fffff880`021f5190 fffff880`011c913e : fffffa80`0acf0190 fffff880`011c0000 00000000`00000000 00000000`00000000 : fltmgr!FltpGetNormalizedFileNameWorker+0xc1
fffff880`021f51d0 fffff880`011aa54b : fffffa80`0a869000 00000000`00000000 fffffa80`0cc51ae0 fffff880`021f6000 : fltmgr!FltpCreateFileNameInformation+0xee
fffff880`021f5230 fffff880`011b5ad4 : 00000000`00008000 fffffa80`0cc51ae0 00000000`00000000 00000000`00000401 : fltmgr!FltpGetFileNameInformation+0x26b
fffff880`021f52b0 fffff880`0100936b : fffffa80`0acf0190 fffff8a0`11343940 00000000`00000001 fffff880`021f53e0 : fltmgr!FltGetFileNameInformation+0x184
fffff880`021f5340 fffff880`01007bdb : fffff140`22670186 00000000`00000001 00000000`00000000 00000000`0000771c : fileinfo!FIStreamGetInfo+0x11f
fffff880`021f53c0 fffff880`011a8242 : 00000000`00000000 fffff8a0`11343940 fffffa80`0d6b0c38 00000000`00000000 : fileinfo!FIPostCreateCallback+0x1c7
fffff880`021f5450 fffff880`011a738b : fffffa80`0abc0030 fffffa80`0cd01160 fffffa80`0abbda80 fffffa80`0abbdca0 : fltmgr!FltpPerformPostCallbacks+0x392
fffff880`021f5520 fffff880`011c62b9 : fffffa80`0d6b0850 fffffa80`0abbc010 fffffa80`0d6b0800 fffffa80`0a982950 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x39b
fffff880`021f55b0 fffff880`02a4d3c2 : fffffa80`0bfe2200 fffffa80`0bfe2400 fffffa80`656e6f4e 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`021f5660 fffffa80`0bfe2200 : fffffa80`0bfe2400 fffffa80`656e6f4e 00000000`00000000 fffffa80`0d74ac30 : eamon+0x63c2
fffff880`021f5668 fffffa80`0bfe2400 : fffffa80`656e6f4e 00000000`00000000 fffffa80`0d74ac30 00000000`00000000 : 0xfffffa80`0bfe2200
fffff880`021f5670 fffffa80`656e6f4e : 00000000`00000000 fffffa80`0d74ac30 00000000`00000000 00000000`00000000 : 0xfffffa80`0bfe2400
fffff880`021f5678 00000000`00000000 : fffffa80`0d74ac30 00000000`00000000 00000000`00000000 fffff800`00000030 : 0xfffffa80`656e6f4e

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+a56
fffff800`02df8d6f cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExDeferredFreePool+a56

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: X64_0x19_3_nt!ExDeferredFreePool+a56

BUCKET_ID: X64_0x19_3_nt!ExDeferredFreePool+a56

Followup: Pool_corruption
---------

any help greatly appreciated!

zigzag3143 · 28 Dec 2010

sunofcain said:

system randomly restarts sometimes sitting idle when i install more than 8GB of identical RAM. have tried many different memory settings/voltages/disable ahci and more in the BIOS to no avail... have gotten three different types of crash dumps. please see below:

CRASH DUMP #1:

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\122810-20467-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c09000 PsLoadedModuleList = 0xfffff800`02e46e50
Debug session time: Tue Dec 28 09:02:20.924 2010 (UTC - 8:00)
System Uptime: 0 days 0:06:32.375
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002c7d597, fffff88007dc5020, 0}

Probably caused by : ntkrnlmp.exe ( nt!PspReturnQuota+47 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002c7d597, Address of the instruction which caused the bugcheck
Arg3: fffff88007dc5020, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!PspReturnQuota+47
fffff800`02c7d597 488b5d00        mov     rbx,qword ptr [rbp]

CONTEXT:  fffff88007dc5020 -- (.cxr 0xfffff88007dc5020)
rax=fffff80002e28a00 rbx=fffff8a0085ee030 rcx=b6fff80002e07a80
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000048
rip=fffff80002c7d597 rsp=fffff88007dc59f0 rbp=b6fff80002e07b00
 r8=0000000000000001  r9=0000000000000048 r10=0000000000000001
r11=fffffa800cb4c420 r12=0000000000000001 r13=0000000000000080
r14=0000000000000005 r15=b6fff80002e07a80
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!PspReturnQuota+0x47:
fffff800`02c7d597 488b5d00        mov     rbx,qword ptr [rbp] ss:0018:b6fff800`02e07b00=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f75852 to fffff80002c7d597

STACK_TEXT:  
fffff880`07dc59f0 fffff800`02f75852 : fffff8a0`085ee030 fffff8a0`085ee010 00000000`00000400 fffff800`02f41377 : nt!PspReturnQuota+0x47
fffff880`07dc5a50 fffff800`02c7e8bc : b6fff800`02e07a80 00000000`00000000 fffffa80`0f514b30 fffffa80`0ca15f30 : nt!ObpFreeObject+0x1e2
fffff880`07dc5aa0 fffff800`02f8f514 : fffffa80`0f514b30 00000000`00000000 fffffa80`0f6d2b60 00000000`00000000 : nt!ObfDereferenceObject+0xdc
fffff880`07dc5b00 fffff800`02f8f414 : 00000000`0000158c fffffa80`0f514b30 fffff8a0`01d1f0c0 00000000`0000158c : nt!ObpCloseHandleTableEntry+0xc4
fffff880`07dc5b90 fffff800`02c78993 : fffffa80`0f6d2b60 fffff880`07dc5c60 00000000`00000000 fffffa80`0cc071b0 : nt!ObpCloseHandle+0x94
fffff880`07dc5be0 00000000`7773fe4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0499f528 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7773fe4a


FOLLOWUP_IP: 
nt!PspReturnQuota+47
fffff800`02c7d597 488b5d00        mov     rbx,qword ptr [rbp]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!PspReturnQuota+47

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

STACK_COMMAND:  .cxr 0xfffff88007dc5020 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!PspReturnQuota+47

BUCKET_ID:  X64_0x3B_nt!PspReturnQuota+47

Followup: MachineOwner
---------

CRASH DUMP #2:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\122810-27175-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*DownstreamStore*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c5b000 PsLoadedModuleList = 0xfffff800`02e98e50
Debug session time: Tue Dec 28 10:31:31.093 2010 (UTC - 8:00)
System Uptime: 0 days 0:12:44.934
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {403, fffff68000014458, a7f000001891c867, fffffe8000014458}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3c8 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff68000014458
Arg3: a7f000001891c867
Arg4: fffffe8000014458

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_403

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  sidebar.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002d3d6c8 to fffff80002ccb740

STACK_TEXT:  
fffff880`08aefc68 fffff800`02d3d6c8 : 00000000`0000001a 00000000`00000403 fffff680`00014458 a7f00000`1891c867 : nt!KeBugCheckEx
fffff880`08aefc70 fffff800`02cfc381 : 00000000`00000000 fffff680`000144a8 fffffa80`0f652550 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x31ef2
fffff880`08aefe20 fffff800`02d0d0da : 00000000`00000000 00000000`02895fff fffffa80`00000000 fffffa80`0f652550 : nt!MiDeleteVirtualAddresses+0x408
fffff880`08aeffe0 fffff800`02cca993 : ffffffff`ffffffff fffff880`08af02a0 fffff880`08af0308 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`08af00d0 fffff800`02cc6f30 : fffff960`000c53d0 00000000`00000001 fffff900`c0107010 fffff900`c242d010 : nt!KiSystemServiceCopyEnd+0x13
fffff880`08af0268 fffff960`000c53d0 : 00000000`00000001 fffff900`c0107010 fffff900`c242d010 00000000`00000000 : nt!KiServiceLinkage
fffff880`08af0270 fffff960`000c5720 : 00000000`00000000 fffff880`00000000 fffff900`c242d010 fffff960`00000000 : win32k!SURFACE::bDeleteSurface+0x3c8
fffff880`08af03c0 fffff960`0008650d : 00000000`4305174e fffff900`c242d010 00000000`4305174e 00000000`05df0340 : win32k!bDeleteSurface+0x34
fffff880`08af03f0 fffff800`02cca993 : fffffa80`0ffb1060 fffff880`00000000 fffff900`00000002 fffff960`00000002 : win32k!NtGdiDeleteObjectApp+0xd5
fffff880`08af0420 000007fe`ffd9118a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0322af18 fffff800`02cc3080 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`ffd9118a
fffff880`08af0840 fffff900`00000003 : 00000000`00000000 fffffa80`00000000 fffffa80`0ffb1420 7ff00000`00000000 : nt!KiCallUserMode
fffff880`08af0848 00000000`00000000 : fffffa80`00000000 fffffa80`0ffb1420 7ff00000`00000000 fffff880`08af0d70 : 0xfffff900`00000003


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!SURFACE::bDeleteSurface+3c8
fffff960`000c53d0 e9b0010000      jmp     win32k!SURFACE::bDeleteSurface+0x57d (fffff960`000c5585)

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  win32k!SURFACE::bDeleteSurface+3c8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4cbe5d3e

FAILURE_BUCKET_ID:  X64_0x1a_403_win32k!SURFACE::bDeleteSurface+3c8

BUCKET_ID:  X64_0x1a_403_win32k!SURFACE::bDeleteSurface+3c8

Followup: MachineOwner
---------

CRASH DUMP #3:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\122810-18220-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*DownstreamStore*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c55000 PsLoadedModuleList = 0xfffff800`02e92e50
Debug session time: Tue Dec 28 10:50:00.568 2010 (UTC - 8:00)
System Uptime: 0 days 0:16:34.550
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffffa80099cc680, fffffa80099cc680, a6fffa80099cc680}

Unable to load image eamon.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for eamon.sys
*** ERROR: Module load completed but symbols could not be loaded for eamon.sys
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+a56 )

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffffa80099cc680, the pool entry being checked.
Arg3: fffffa80099cc680, the read back flink freelist value (should be the same as 2).
Arg4: a6fffa80099cc680, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


BUGCHECK_STR:  0x19_3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  DkService.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002df8d6f to fffff80002cc5740

STACK_TEXT:  
fffff880`021f5038 fffff800`02df8d6f : 00000000`00000019 00000000`00000003 fffffa80`099cc680 fffffa80`099cc680 : nt!KeBugCheckEx
fffff880`021f5040 fffff880`011c8235 : 00000000`00000001 00000000`0000001f fffffa80`0acf0190 fffff880`00000000 : nt!ExDeferredFreePool+0xa56
fffff880`021f5130 fffff880`011c9361 : fffffa80`00000026 00000000`00000081 00000000`00000020 00000000`00000000 : fltmgr!FltpExpandShortNames+0x365
fffff880`021f5190 fffff880`011c913e : fffffa80`0acf0190 fffff880`011c0000 00000000`00000000 00000000`00000000 : fltmgr!FltpGetNormalizedFileNameWorker+0xc1
fffff880`021f51d0 fffff880`011aa54b : fffffa80`0a869000 00000000`00000000 fffffa80`0cc51ae0 fffff880`021f6000 : fltmgr!FltpCreateFileNameInformation+0xee
fffff880`021f5230 fffff880`011b5ad4 : 00000000`00008000 fffffa80`0cc51ae0 00000000`00000000 00000000`00000401 : fltmgr!FltpGetFileNameInformation+0x26b
fffff880`021f52b0 fffff880`0100936b : fffffa80`0acf0190 fffff8a0`11343940 00000000`00000001 fffff880`021f53e0 : fltmgr!FltGetFileNameInformation+0x184
fffff880`021f5340 fffff880`01007bdb : fffff140`22670186 00000000`00000001 00000000`00000000 00000000`0000771c : fileinfo!FIStreamGetInfo+0x11f
fffff880`021f53c0 fffff880`011a8242 : 00000000`00000000 fffff8a0`11343940 fffffa80`0d6b0c38 00000000`00000000 : fileinfo!FIPostCreateCallback+0x1c7
fffff880`021f5450 fffff880`011a738b : fffffa80`0abc0030 fffffa80`0cd01160 fffffa80`0abbda80 fffffa80`0abbdca0 : fltmgr!FltpPerformPostCallbacks+0x392
fffff880`021f5520 fffff880`011c62b9 : fffffa80`0d6b0850 fffffa80`0abbc010 fffffa80`0d6b0800 fffffa80`0a982950 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x39b
fffff880`021f55b0 fffff880`02a4d3c2 : fffffa80`0bfe2200 fffffa80`0bfe2400 fffffa80`656e6f4e 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`021f5660 fffffa80`0bfe2200 : fffffa80`0bfe2400 fffffa80`656e6f4e 00000000`00000000 fffffa80`0d74ac30 : eamon+0x63c2
fffff880`021f5668 fffffa80`0bfe2400 : fffffa80`656e6f4e 00000000`00000000 fffffa80`0d74ac30 00000000`00000000 : 0xfffffa80`0bfe2200
fffff880`021f5670 fffffa80`656e6f4e : 00000000`00000000 fffffa80`0d74ac30 00000000`00000000 00000000`00000000 : 0xfffffa80`0bfe2400
fffff880`021f5678 00000000`00000000 : fffffa80`0d74ac30 00000000`00000000 00000000`00000000 fffff800`00000030 : 0xfffffa80`656e6f4e


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExDeferredFreePool+a56
fffff800`02df8d6f cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExDeferredFreePool+a56

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0x19_3_nt!ExDeferredFreePool+a56

BUCKET_ID:  X64_0x19_3_nt!ExDeferredFreePool+a56

Followup: Pool_corruption
---------

any help greatly appreciated!

First we need the actual DMP files

These all are memory exceptions caused by an as yet un-named driver.

Run memtest and then driver verifier

Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes.

Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot. Test the sticks individually, and if you find a good one, test it in all slots.

Driver verifier

Beyond that, please run Verifier with these settings:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
NOTE: You can use Low Resource Simulation if you'd like. From my limited experimentation it makes the BSOD's come faster.
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

If that doesn't work, post back and we'll have to see about fixing the registry entry off-line:

Code:

Delete these registry keys (works in XP, Vista, Win7):
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDrivers
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDriverLevel

Using Driver Verifier to identify issues with Windows drivers for advanced users

Ken J

sunofcain · 28 Dec 2010

ok, i have run memtest previously several times with no errors so i went ahead and used the verifier, although i'm not positive it recorded anything. attached are the three minidumps i recorded...

sunofcain · 29 Dec 2010

ok, so system started freezing up this morning with only 8GB... here's the dumps from those freezes... also have a call in to corsair for tech support - any help greatly appreciated...