Thank you - now that we have a full dump and exception record, we can actually see what's happening, sort of:
Code:
// The exception record, including parameters:
0: kd> .exr 0xfffff8800c739b78
ExceptionAddress: 00000000778d9c12
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 0000000000000000
Parameter[1]: 00000000773b8af4
Parameter[2]: 00000000c000000e
Inpage operation failed at 00000000773b8af4, due to I/O error 00000000c000000e
// That error code is not good:
0: kd> !error 00000000c000000e
Error code: (NTSTATUS) 0xc000000e (3221225486) - A device which does not exist was specified.
// The device was supposed to be here - is it an I/O device, or is it a driver???
0: kd> dc 773b8af4 L1
00000000`773b8af4 ???????? ????
// Here's the thread that appears to have triggered the crash, walking the LPC pipes backwards from the CSRSS thread:
0: kd> !alpc /m 0xfffff8a00a0e9320
Message @ fffff8a00a0e9320
MessageID : 0x0434 (1076)
CallbackID : 0x4772F (292655)
SequenceNumber : 0x00001A57 (6743)
Type : LPC_ERROR_EVENT
DataLength : 0x0048 (72)
TotalLength : 0x0070 (112)
Canceled : No
Release : No
ReplyWaitReply : No
Continuation : Yes
OwnerPort : fffffa8011294e60 [ALPC_CONNECTION_PORT]
WaitingThread : fffffa8011fea460
QueueType : ALPC_MSGQUEUE_PENDING
QueuePort : fffffa8011294e60 [ALPC_CONNECTION_PORT]
QueuePortOwnerProcess : fffffa80114b6510 (csrss.exe)
ServerThread : fffffa800fab2060
QuotaCharged : No
CancelQueuePort : 0000000000000000
CancelSequencePort : 0000000000000000
CancelSequenceNumber : 0x00000000 (0)
ClientContext : 0000000000000000
ServerContext : 0000000000000000
PortContext : 0000000000000000
CancelPortContext : 0000000000000000
SecurityData : 0000000000000000
View : 0000000000000000
0: kd> !thread fffffa8011fea460
THREAD fffffa8011fea460 Cid 0d98.0da8 Teb: 000000007efad000 Win32Thread: 0000000000000000 WAIT: (WrLpcReply) UserMode Non-Alertable
fffffa8011fea820 Semaphore Limit 0x1
Waiting for reply to ALPC Message fffff8a00a0e9320 : queued at port fffffa8011294e60 : owned by process fffffa80114b6510
Not impersonating
DeviceMap fffff8a001742620
Owning Process fffffa8011feeb30 Image: GoogleCrashHandler.exe
Attached Process N/A Image: N/A
Wait Start TickCount 296533 Ticks: 961 (0:00:00:14.991)
Context Switch Count 5
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x0000000073fe2fb1
Stack Init fffff8800b27cdb0 Current fffff8800b27c240
Base fffff8800b27d000 Limit fffff8800b277000 Call 0
Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
fffff880`0b27c280 fffff800`036e2f32 : fffff8a0`06165ae4 fffffa80`11fea460 00000004`00000000 00000000`00000010 : nt!KiSwapContext+0x7a
fffff880`0b27c3c0 fffff800`036e574f : fffff880`009ce180 00000000`00000005 00000000`00000000 fffff800`036e3fda : nt!KiCommitThreadWait+0x1d2
fffff880`0b27c450 fffff800`036ffcef : 00000000`00000001 00000000`00000011 00000000`00000001 00000000`00000000 : nt!KeWaitForSingleObject+0x19f
fffff880`0b27c4f0 fffff800`039ede76 : fffffa80`0fab2168 fffffa80`11fea820 00000000`00000001 00000000`00000000 : nt!AlpcpSignalAndWait+0x8f
fffff880`0b27c5a0 fffff800`039ed570 : 00000000`00000000 fffff880`0b27cca0 00000000`00000000 fffff880`0b27c600 : nt!AlpcpReceiveSynchronousReply+0x46
fffff880`0b27c600 fffff800`039f145d : fffffa80`11294e60 fffffa80`00020002 fffff880`0b27c820 00000000`00000000 : nt!AlpcpProcessSynchronousRequest+0x33d
fffff880`0b27c740 fffff800`03ace889 : fffffa80`11294e60 fffff800`039b3266 fffffa80`11fea460 00000000`00000000 : nt!LpcpRequestWaitReplyPort+0x9c
fffff880`0b27c7a0 fffff800`03b0d482 : 00000000`00000000 fffff880`0b27cca0 00000000`d0000144 00000000`00000000 : nt!LpcRequestWaitReplyPortEx+0x29
fffff880`0b27c7e0 fffff800`03b0f023 : 00000000`d0000144 fffff800`00000004 fffffa80`00000000 fffff880`0b27cb58 : nt!ExpRaiseHardError+0x2c2
fffff880`0b27cb10 fffff800`036dced3 : fffffa80`11fea460 00000000`00000001 00000000`0059e758 fffff800`039d54f4 : nt!NtRaiseHardError+0x1a1
fffff880`0b27cbb0 00000000`7790264a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0b27cc20)
00000000`0059e738 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7790264a
// The owning thread in csrss.exe for this LPC message queue:
0: kd> !thread fffffa8011fea460
THREAD fffffa8011fea460 Cid 0d98.0da8 Teb: 000000007efad000 Win32Thread: 0000000000000000 WAIT: (WrLpcReply) UserMode Non-Alertable
fffffa8011fea820 Semaphore Limit 0x1
Waiting for reply to ALPC Message fffff8a00a0e9320 : queued at port fffffa8011294e60 : owned by process fffffa80114b6510
Not impersonating
DeviceMap fffff8a001742620
Owning Process fffffa8011feeb30 Image: GoogleCrashHandler.exe
Attached Process N/A Image: N/A
Wait Start TickCount 296533 Ticks: 961 (0:00:00:14.991)
Context Switch Count 5
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x0000000073fe2fb1
Stack Init fffff8800b27cdb0 Current fffff8800b27c240
Base fffff8800b27d000 Limit fffff8800b277000 Call 0
Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
fffff880`0b27c280 fffff800`036e2f32 : fffff8a0`06165ae4 fffffa80`11fea460 00000004`00000000 00000000`00000010 : nt!KiSwapContext+0x7a
fffff880`0b27c3c0 fffff800`036e574f : fffff880`009ce180 00000000`00000005 00000000`00000000 fffff800`036e3fda : nt!KiCommitThreadWait+0x1d2
fffff880`0b27c450 fffff800`036ffcef : 00000000`00000001 00000000`00000011 00000000`00000001 00000000`00000000 : nt!KeWaitForSingleObject+0x19f
fffff880`0b27c4f0 fffff800`039ede76 : fffffa80`0fab2168 fffffa80`11fea820 00000000`00000001 00000000`00000000 : nt!AlpcpSignalAndWait+0x8f
fffff880`0b27c5a0 fffff800`039ed570 : 00000000`00000000 fffff880`0b27cca0 00000000`00000000 fffff880`0b27c600 : nt!AlpcpReceiveSynchronousReply+0x46
fffff880`0b27c600 fffff800`039f145d : fffffa80`11294e60 fffffa80`00020002 fffff880`0b27c820 00000000`00000000 : nt!AlpcpProcessSynchronousRequest+0x33d
fffff880`0b27c740 fffff800`03ace889 : fffffa80`11294e60 fffff800`039b3266 fffffa80`11fea460 00000000`00000000 : nt!LpcpRequestWaitReplyPort+0x9c
fffff880`0b27c7a0 fffff800`03b0d482 : 00000000`00000000 fffff880`0b27cca0 00000000`d0000144 00000000`00000000 : nt!LpcRequestWaitReplyPortEx+0x29
fffff880`0b27c7e0 fffff800`03b0f023 : 00000000`d0000144 fffff800`00000004 fffffa80`00000000 fffff880`0b27cb58 : nt!ExpRaiseHardError+0x2c2
fffff880`0b27cb10 fffff800`036dced3 : fffffa80`11fea460 00000000`00000001 00000000`0059e758 fffff800`039d54f4 : nt!NtRaiseHardError+0x1a1
fffff880`0b27cbb0 00000000`7790264a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0b27cc20)
00000000`0059e738 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7790264a
// This thread has a bad instruction pointer, for some reason:
0: kd> .trap fffff880`0b27cc20
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=00000000004538c0 rsi=0000000000000000 rdi=0000000000000000
rip=000000007790264a rsp=000000000059e738 rbp=000000000263f3d0
r8=000000000000ffff r9=0000000000000000 r10=0000000000000046
r11=00000000004538c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
0033:00000000`7790264a ?? ???
0: kd> dc 000000007790264a L1
00000000`7790264a ???????? ????
This is very odd indeed. Unfortunately, the memory.dmp file uploaded is a kernel-only dump, and not a full dump, so I cannot see what's in user mode. I'm not even sure that I could tell from that what caused it, but it might help. However, from experience, I can make a few educated guesses - there are active IRPs to the USB stack and the USB stack. There are active irps to a set of Logitech drivers and Toshiba drivers on both, active (less than 500 ms) right before the time of the crash:
Code:
0: kd> lmvm LG*
start end module name
fffff880`04e33000 fffff880`04e36d80 LGBusEnum (deferred)
Image path: \SystemRoot\system32\drivers\LGBusEnum.sys
Image name: LGBusEnum.sys
Timestamp: Mon Nov 23 20:36:48 2009 (4B0B38B0)
CheckSum: 0000B99B
ImageSize: 00003D80
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
fffff880`0a8e5000 fffff880`0a8e7480 LGVirHid (no symbols)
Loaded symbol image file: LGVirHid.sys
Image path: \SystemRoot\system32\drivers\LGVirHid.sys
Image name: LGVirHid.sys
Timestamp: Mon Nov 23 20:36:48 2009 (4B0B38B0)
CheckSum: 00012CDE
ImageSize: 00002480
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> lmvm tos*
start end module name
fffff880`03379000 fffff880`0338ba00 tosrfcom (deferred)
Image path: \SystemRoot\System32\Drivers\tosrfcom.sys
Image name: tosrfcom.sys
Timestamp: Tue Jul 28 06:18:20 2009 (4A6ED06C)
CheckSum: 0002003E
ImageSize: 00012A00
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
fffff880`05755000 fffff880`05787700 tosrfbd (deferred)
Image path: \SystemRoot\system32\DRIVERS\tosrfbd.sys
Image name: tosrfbd.sys
Timestamp: Thu Sep 24 00:57:27 2009 (4ABAFC37)
CheckSum: 0003856C
ImageSize: 00032700
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
fffff880`057cc000 fffff880`057e1b00 Tosrfhid (deferred)
Image path: \SystemRoot\system32\DRIVERS\Tosrfhid.sys
Image name: Tosrfhid.sys
Timestamp: Tue May 19 21:23:51 2009 (4A135BA7)
CheckSum: 0001BEE4
ImageSize: 00015B00
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
fffff880`06a2d000 fffff880`06a3e000 tosporte (no symbols)
Loaded symbol image file: tosporte.sys
Image path: \SystemRoot\system32\DRIVERS\tosporte.sys
Image name: tosporte.sys
Timestamp: Tue Jun 16 06:48:47 2009 (4A37788F)
CheckSum: 00010EA3
ImageSize: 00011000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
fffff880`06be6000 fffff880`06bf3000 tosrfusb (deferred)
Image path: \SystemRoot\system32\DRIVERS\tosrfusb.sys
Image name: tosrfusb.sys
Timestamp: Fri Sep 11 05:37:18 2009 (4AAA1A4E)
CheckSum: 00016638
ImageSize: 0000D000
File version: 6.0.2111.0
Product version: 6.0.0.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: TOSHIBA CORPORATION
ProductName: Bluetooth Stack for Windows by TOSHIBA
InternalName: TOSRFUSB.SYS
OriginalFilename: TOSRFUSB.SYS
ProductVersion: 6, 0, 0, 0
FileVersion: 6, 0, 2111, 0
PrivateBuild: 6, 0, 2111, 0
SpecialBuild: 6, 0, 2111, 0
FileDescription: Bluetooth USB Miniport Driver
LegalCopyright: Copyright (C)1998-2009, TOSHIBA CORPORATION
LegalTrademarks: Copyright (C)1998-2009, TOSHIBA CORPORATION
Comments: Copyright (C)1998-2009, TOSHIBA CORPORATION
I am going to strongly suggest looking for updates to these devices, or disabling and removing as a test. Update first, though (all drivers if possible, but at the very least these), and see what happens.