Code:
1.
BugCheck 10D, {4, 0, fffff8800241d4de, fffffa800b127df0}
Unable to load image \SystemRoot\system32\DRIVERS\athurx.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for athurx.sys
*** ERROR: Module load completed but symbols could not be loaded for athurx.sys
Probably caused by : athurx.sys ( athurx+94de )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
WDF_VIOLATION (10d)
The Kernel-Mode Driver Framework was notified that Windows detected an error
in a framework-based driver. In general, the dump file will yield additional
information about the driver that caused this bug check.
Arguments:
Arg1: 0000000000000004, A NULL parameter was passed to a function that required a non-
NULL value. Use the "ln" debugger command with the value of
Parameter 3 as its argument to determine the function which
requires a non-NULL parameter.
Arg2: 0000000000000000, Reserved.
Arg3: fffff8800241d4de, The caller's address.
Arg4: fffffa800b127df0, Reserved.
Debugging Details:
------------------
BUGCHECK_STR: 0x10D_4
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff88000efa2f7 to fffff80003090c40
STACK_TEXT:
fffff880`06923608 fffff880`00efa2f7 : 00000000`0000010d 00000000`00000004 00000000`00000000 fffff880`0241d4de : nt!KeBugCheckEx
fffff880`06923610 fffff880`00ec5434 : 00000000`00000000 00000000`00000000 0000057f`f4624302 fffff880`00ef3bf5 : Wdf01000!FxVerifierNullBugCheck+0x53
fffff880`06923650 fffff880`0241d4de : fffffa80`0b9dcc00 fffffa80`0ba75b60 fffffa80`06d0c740 fffff880`025cb140 : Wdf01000!imp_WdfMemoryCopyFromBuffer+0xa8
fffff880`069236b0 fffffa80`0b9dcc00 : fffffa80`0ba75b60 fffffa80`06d0c740 fffff880`025cb140 00000000`0000fa80 : athurx+0x94de
fffff880`069236b8 fffffa80`0ba75b60 : fffffa80`06d0c740 fffff880`025cb140 00000000`0000fa80 fffffa80`0b9dbc20 : 0xfffffa80`0b9dcc00
fffff880`069236c0 fffffa80`06d0c740 : fffff880`025cb140 00000000`0000fa80 fffffa80`0b9dbc20 fffffa80`0ba75b60 : 0xfffffa80`0ba75b60
fffff880`069236c8 fffff880`025cb140 : 00000000`0000fa80 fffffa80`0b9dbc20 fffffa80`0ba75b60 fffff880`024169b6 : 0xfffffa80`06d0c740
fffff880`069236d0 00000000`0000fa80 : fffffa80`0b9dbc20 fffffa80`0ba75b60 fffff880`024169b6 0000057f`f4623458 : athurx+0x1b7140
fffff880`069236d8 fffffa80`0b9dbc20 : fffffa80`0ba75b60 fffff880`024169b6 0000057f`f4623458 00000000`00000000 : 0xfa80
fffff880`069236e0 fffffa80`0ba75b60 : fffff880`024169b6 0000057f`f4623458 00000000`00000000 00000000`00000000 : 0xfffffa80`0b9dbc20
fffff880`069236e8 fffff880`024169b6 : 0000057f`f4623458 00000000`00000000 00000000`00000000 00000000`0000fa80 : 0xfffffa80`0ba75b60
fffff880`069236f0 0000057f`f4623458 : 00000000`00000000 00000000`00000000 00000000`0000fa80 fffffa80`0ba75b60 : athurx+0x29b6
fffff880`069236f8 00000000`00000000 : 00000000`00000000 00000000`0000fa80 fffffa80`0ba75b60 fffff800`030934da : 0x57f`f4623458
STACK_COMMAND: kb
FOLLOWUP_IP:
athurx+94de
fffff880`0241d4de 4883c438 add rsp,38h
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: athurx+94de
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: athurx
IMAGE_NAME: athurx.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c501c23
FAILURE_BUCKET_ID: X64_0x10D_4_athurx+94de
BUCKET_ID: X64_0x10D_4_athurx+94de
Followup: MachineOwner
---------
2.
BugCheck 4E, {99, 183019, 0, 182f99}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000183019, page frame number
Arg3: 0000000000000000, current page state
Arg4: 0000000000182f99, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: bf3.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80003159d7c to fffff800030d0c40
STACK_TEXT:
fffff880`0f156e18 fffff800`03159d7c : 00000000`0000004e 00000000`00000099 00000000`00183019 00000000`00000000 : nt!KeBugCheckEx
fffff880`0f156e20 fffff800`030786e2 : 00000000`00000000 fffff680`0060fb98 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`0f156e60 fffff800`030a14b3 : fffffa80`0cfbda80 fffff700`00031b4c 0000007f`fffffff8 fffff8a0`11f03468 : nt! ?? ::FNODOBFM::`string'+0x333ca
fffff880`0f156ef0 fffff800`030a2596 : fffffa80`0cfbda80 fffffa80`00000007 fffff880`0002d995 fffff800`00000006 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`0f1577a0 fffff800`033a6b1a : fffff8a0`12aab060 fffff880`0f157ae0 00000000`00000000 fffffa80`0da46300 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0f1577f0 fffff800`0338a09d : 00000000`c0000005 00000000`c0000001 00000000`da0f1000 fffffa80`0d581060 : nt!PspExitThread+0x56a
fffff880`0f1578f0 fffff800`030c43fa : 00000000`00000100 fffffa80`0da463c0 00000000`00000001 fffff800`030d613d : nt!PsExitSpecialApc+0x1d
fffff880`0f157920 fffff800`030c4740 : 00000000`00000246 fffff880`0f1579a0 fffff800`0338a010 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`0f1579a0 fffff800`030cff77 : fffffa80`0da46300 00000000`00000878 00000000`00000000 fffffa80`0d845270 : nt!KiInitiateUserApc+0x70
fffff880`0f157ae0 00000000`74e32e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`1e67f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74e32e09
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`03159d7c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
3.
BugCheck 4E, {99, 9591d, 1, 9581d}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000009591d, page frame number
Arg3: 0000000000000001, current page state
Arg4: 000000000009581d, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: bf3.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80003161d7c to fffff800030d8c40
STACK_TEXT:
fffff880`0ea05e18 fffff800`03161d7c : 00000000`0000004e 00000000`00000099 00000000`0009591d 00000000`00000001 : nt!KeBugCheckEx
fffff880`0ea05e20 fffff800`030806e2 : 00000000`00000000 fffff680`00081238 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`0ea05e60 fffff800`030a94b3 : fffffa80`0d903b30 fffff700`00041d64 0000007f`fffffff8 fffff8a0`0f5de410 : nt! ?? ::FNODOBFM::`string'+0x333ca
fffff880`0ea05ef0 fffff800`030aa596 : fffffa80`0d903b30 fffffa80`0000000b fffff880`0003daeb fffff800`00000006 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`0ea067a0 fffff800`033aeb1a : fffff8a0`13590a90 fffff880`0ea06ae0 00000000`00000000 fffffa80`0e0e1b60 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0ea067f0 fffff800`0339209d : 00000000`c0000005 00000000`c0000001 00000000`e4bc4000 fffffa80`0d980b60 : nt!PspExitThread+0x56a
fffff880`0ea068f0 fffff800`030cc3fa : 00000000`00000100 fffffa80`0e0e1c20 00000000`00000001 fffff800`030de13d : nt!PsExitSpecialApc+0x1d
fffff880`0ea06920 fffff800`030cc740 : 00000000`00000246 fffff880`0ea069a0 fffff800`03392010 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`0ea069a0 fffff800`030d7f77 : fffffa80`0e0e1b60 00000000`00000428 00000000`00000000 fffffa80`0df1e4e0 : nt!KiInitiateUserApc+0x70
fffff880`0ea06ae0 00000000`75132e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0715f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75132e09
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`03161d7c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
4.
BugCheck 4E, {99, 1d3256, 2, 1cc32a}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000001d3256, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000001cc32a, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: bf3.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80003123d7c to fffff8000309ac40
STACK_TEXT:
fffff880`0c118e18 fffff800`03123d7c : 00000000`0000004e 00000000`00000099 00000000`001d3256 00000000`00000002 : nt!KeBugCheckEx
fffff880`0c118e20 fffff800`030426d0 : 00000000`00000000 fffff680`0011d330 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`0c118e60 fffff800`0306b4b3 : fffffa80`0d7e9b30 fffff700`00058e46 0000007f`fffffff8 fffff8a0`003b55b8 : nt! ?? ::FNODOBFM::`string'+0x333b8
fffff880`0c118ef0 fffff800`0306c596 : fffffa80`0d7e9b30 fffffa80`00000007 fffff880`000532cd fffff800`00000006 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`0c1197a0 fffff800`03370b1a : fffff8a0`13307060 fffff880`0c119ae0 00000000`00000000 fffffa80`06ddab60 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0c1197f0 fffff800`0335409d : 00000000`c0000005 00000000`c0000001 00000000`e4bc4000 fffffa80`0709e8c0 : nt!PspExitThread+0x56a
fffff880`0c1198f0 fffff800`0308e3fa : 00000000`00000100 fffffa80`06ddac20 00000000`00000001 fffff800`030a013d : nt!PsExitSpecialApc+0x1d
fffff880`0c119920 fffff800`0308e740 : 00000000`00000246 fffff880`0c1199a0 fffff800`03354010 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`0c1199a0 fffff800`03099f77 : fffffa80`06ddab60 00000000`00000430 00000000`00000000 fffffa80`0dab4fe0 : nt!KiInitiateUserApc+0x70
fffff880`0c119ae0 00000000`75162e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`05f0f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75162e09
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`03123d7c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
5.
BugCheck 4E, {99, 2044aa, 2, 1296a9}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000002044aa, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000001296a9, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: bf3.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff8000315fd7c to fffff800030d6c40
STACK_TEXT:
fffff880`12ade3d8 fffff800`0315fd7c : 00000000`0000004e 00000000`00000099 00000000`002044aa 00000000`00000002 : nt!KeBugCheckEx
fffff880`12ade3e0 fffff800`0307e6d0 : 00000000`00000000 fffff680`0014b1a0 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`12ade420 fffff800`030a74b3 : fffffa80`0e7e2b30 fffff700`00047f37 0000007f`fffffff8 fffff8a0`124c3200 : nt! ?? ::FNODOBFM::`string'+0x333b8
fffff880`12ade4b0 fffff800`030a8596 : fffffa80`0e7e2b30 fffffa80`00000006 fffff880`00043d32 fffff800`00000006 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`12aded60 fffff800`033acb1a : fffff8a0`140025c0 fffff880`12adf0a0 00000000`00000000 fffffa80`0d721b60 : nt!MmCleanProcessAddressSpace+0x96
fffff880`12adedb0 fffff800`0339009d : 00000000`cfffffff 00000000`00000001 00000000`fffdb000 fffffa80`0e471510 : nt!PspExitThread+0x56a
fffff880`12adeeb0 fffff800`030ca3fa : 00000246`0018002b 00000000`00000000 00000008`00000002 fffff880`03789180 : nt!PsExitSpecialApc+0x1d
fffff880`12adeee0 fffff800`030ca740 : 00000000`0008e800 fffff880`12adef60 fffff800`03390010 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`12adef60 fffff800`030d5f77 : fffffa80`0d721b60 00000000`fffdb000 00000000`00000020 00000000`76537bbb : nt!KiInitiateUserApc+0x70
fffff880`12adf0a0 00000000`77161206 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0008e750 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77161206
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`0315fd7c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
6.
BugCheck 3B, {c0000005, fffff880041a447f, fffff880118d6c00, 0}
Probably caused by : dxgmms1.sys ( dxgmms1!VIDMM_DEVICE::RemoveCommitment+8f )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff880041a447f, Address of the instruction which caused the bugcheck
Arg3: fffff880118d6c00, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
dxgmms1!VIDMM_DEVICE::RemoveCommitment+8f
fffff880`041a447f 48833cc100 cmp qword ptr [rcx+rax*8],0
CONTEXT: fffff880118d6c00 -- (.cxr 0xfffff880118d6c00)
rax=0000000000000000 rbx=fffff8a0117d6500 rcx=0000000000000000
rdx=fffffa800d5155f0 rsi=fffffa800d5155a0 rdi=fffffa800bafdaa0
rip=fffff880041a447f rsp=fffff880118d75e8 rbp=0000000000000000
r8=000000000002c000 r9=fffff8a001fbe400 r10=fffff8a013cef010
r11=fffff8a01251bf80 r12=0000000000000000 r13=0000000000000000
r14=fffffa800bd1a000 r15=fffff880118d7988
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
dxgmms1!VIDMM_DEVICE::RemoveCommitment+0x8f:
fffff880`041a447f 48833cc100 cmp qword ptr [rcx+rax*8],0 ds:002b:00000000`00000000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: bf3.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff880041a447f
STACK_TEXT:
fffff880`118d75e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : dxgmms1!VIDMM_DEVICE::RemoveCommitment+0x8f
FOLLOWUP_IP:
dxgmms1!VIDMM_DEVICE::RemoveCommitment+8f
fffff880`041a447f 48833cc100 cmp qword ptr [rcx+rax*8],0
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: dxgmms1!VIDMM_DEVICE::RemoveCommitment+8f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: dxgmms1
IMAGE_NAME: dxgmms1.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce799c1
STACK_COMMAND: .cxr 0xfffff880118d6c00 ; kb
FAILURE_BUCKET_ID: X64_0x3B_dxgmms1!VIDMM_DEVICE::RemoveCommitment+8f
BUCKET_ID: X64_0x3B_dxgmms1!VIDMM_DEVICE::RemoveCommitment+8f
Followup: MachineOwner
---------
7.
BugCheck 1E, {0, 0, 0, 0}
Unable to load image \SystemRoot\system32\DRIVERS\athurx.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for athurx.sys
*** ERROR: Module load completed but symbols could not be loaded for athurx.sys
Probably caused by : athurx.sys ( athurx+9875 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.
FAULTING_IP:
+6236333665353838
00000000`00000000 ?? ???
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0
BUGCHECK_STR: 0x1E_0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
EXCEPTION_RECORD: fffff80000b9c368 -- (.exr 0xfffff80000b9c368)
ExceptionAddress: fffff88000ed991b (Wdf01000!WPP_IFR_SF_sq+0x00000000000000ef)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
TRAP_FRAME: fffff80000b9c410 -- (.trap 0xfffff80000b9c410)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffffffffffffff
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000ed991b rsp=fffff80000b9c5a0 rbp=fffff88000f3c8c4
r8=000000000000000b r9=000000000000000e r10=0000000000000000
r11=fffff88000f45310 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
Wdf01000!WPP_IFR_SF_sq+0xef:
fffff880`00ed991b f2ae repne scas byte ptr [rdi]
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800030cc5fe to fffff800030d4c10
STACK_TEXT:
fffff800`00b9b448 fffff800`030cc5fe : 00000000`00000000 00000000`00000000 fffff800`00b9bbc0 fffff800`03100830 : nt!KeBugCheck
fffff800`00b9b450 fffff800`031004fd : fffff800`032de71c fffff800`0321bc30 fffff800`03058000 fffff800`00b9c368 : nt!KiKernelCalloutExceptionHandler+0xe
fffff800`00b9b480 fffff800`030ff2d5 : fffff800`0321f0fc fffff800`00b9b4f8 fffff800`00b9c368 fffff800`03058000 : nt!RtlpExecuteHandlerForException+0xd
fffff800`00b9b4b0 fffff800`03110361 : fffff800`00b9c368 fffff800`00b9bbc0 fffff800`00000000 002c002c`0317086c : nt!RtlDispatchException+0x415
fffff800`00b9bb90 fffff800`030d42c2 : fffff800`00b9c368 002c002c`0317086c fffff800`00b9c410 00000000`00000005 : nt!KiDispatchException+0x135
fffff800`00b9c230 fffff800`030d2bca : fffffa80`0bbc7010 00000000`00000000 fffffa80`0ce1ef40 fffff880`0596f74d : nt!KiExceptionDispatch+0xc2
fffff800`00b9c410 fffff880`00ed991b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff800`00b9c5a0 fffff880`00f119cc : fffffa80`0bc76ad0 00000000`00000000 fffffa80`0aa69a90 fffff880`0597311b : Wdf01000!WPP_IFR_SF_sq+0xef
fffff800`00b9c620 fffff880`06a0a875 : fffffa80`0c641d50 fffffa80`0c641f48 fffffa80`0c641f48 fffff880`0596e75c : Wdf01000!imp_WdfObjectGetTypedContextWorker+0xa4
fffff800`00b9c670 fffffa80`0c641d50 : fffffa80`0c641f48 fffffa80`0c641f48 fffff880`0596e75c fffffa80`0d688978 : athurx+0x9875
fffff800`00b9c678 fffffa80`0c641f48 : fffffa80`0c641f48 fffff880`0596e75c fffffa80`0d688978 fffff880`06a0a28a : 0xfffffa80`0c641d50
fffff800`00b9c680 fffffa80`0c641f48 : fffff880`0596e75c fffffa80`0d688978 fffff880`06a0a28a 0000057f`f4389358 : 0xfffffa80`0c641f48
fffff800`00b9c688 fffff880`0596e75c : fffffa80`0d688978 fffff880`06a0a28a 0000057f`f4389358 fffff880`06bba190 : 0xfffffa80`0c641f48
fffff800`00b9c690 fffff880`0596d376 : fffffa80`0d688970 fffffa80`0c667230 fffffa80`0d688970 fffffa80`0bbd8000 : dxgmms1!VidSchiFreeQueuePacket+0xa4
fffff800`00b9c6e0 0000057f`f5596568 : fffffa80`0bc7cef8 0000057f`f4389358 fffffa80`0aa69a90 fffff880`00ec230f : dxgmms1!VidSchiProcessCompletedQueuePacketInternal+0x44e
fffff800`00b9c7a0 fffffa80`0bc7cef8 : 0000057f`f4389358 fffffa80`0aa69a90 fffff880`00ec230f 00000000`00000000 : 0x57f`f5596568
fffff800`00b9c7a8 0000057f`f4389358 : fffffa80`0aa69a90 fffff880`00ec230f 00000000`00000000 00000000`00000000 : 0xfffffa80`0bc7cef8
fffff800`00b9c7b0 fffffa80`0aa69a90 : fffff880`00ec230f 00000000`00000000 00000000`00000000 00000000`00000003 : 0x57f`f4389358
fffff800`00b9c7b8 fffff880`00ec230f : 00000000`00000000 00000000`00000000 00000000`00000003 fffffa80`0bbd8da0 : 0xfffffa80`0aa69a90
fffff800`00b9c7c0 fffff880`00ec2c9b : fffffa80`0aa69a90 fffffa80`0aa69a90 fffffa80`0aa69aa0 fffffa80`0aaaec01 : Wdf01000!FxIoTarget::RemoveCompletedRequestLocked+0xb7
fffff800`00b9c810 fffff880`00ec2dc4 : fffffa80`0bbcc002 fffff880`0596bc57 00000000`00000000 00000000`00000000 : Wdf01000!FxIoTarget::RequestCompletionRoutine+0x1cb
fffff800`00b9c880 fffff800`030c1485 : 00000000`00000000 fffffa80`0bbc77b8 fffffa80`0d77c000 fffff800`03203fbd : Wdf01000!FxIoTarget::_RequestCompletionRoutine+0x3c
fffff800`00b9c8b0 fffff800`030d8021 : fffffa80`0aaaef2b 00000000`00000000 00000000`00000000 00000000`00000050 : nt!IopUnloadSafeCompletion+0x55
fffff800`00b9c8f0 fffff880`10358631 : fffffa80`0ac19050 fffffa80`0bc7cf00 00000000`00000000 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff800`00b9c9e0 fffff880`10358b0f : fffffa80`0d86e702 fffffa80`0aaaec60 00000000`ffffffff fffffa80`0ac19eb0 : USBPORT!USBPORT_Core_iCompleteDoneTransfer+0xa15
fffff800`00b9cac0 fffff880`1035666f : fffffa80`0ac19eb0 fffffa80`0ac191a0 fffffa80`0ac1a050 00000000`00000000 : USBPORT!USBPORT_Core_iIrpCsqCompleteDoneTransfer+0x3a7
fffff800`00b9cb20 fffff880`10347f89 : fffffa80`0ac19050 00000000`00000000 fffffa80`0ac19e02 fffffa80`0ac19eb0 : USBPORT!USBPORT_Core_UsbIocDpc_Worker+0xf3
fffff800`00b9cb60 fffff800`030e00ac : fffff800`0324ae80 fffffa80`0ac19eb0 fffffa80`0ac19ec8 00000000`00000000 : USBPORT!USBPORT_Xdpc_Worker+0x1d9
fffff800`00b9cb90 fffff800`030cc96a : fffff800`0324ae80 fffff800`03258cc0 00000000`00000000 fffff880`10347db0 : nt!KiRetireDpcList+0x1bc
fffff800`00b9cc40 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cc00 00000000`00000000 : nt!KiIdleLoop+0x5a
STACK_COMMAND: kb
FOLLOWUP_IP:
athurx+9875
fffff880`06a0a875 ?? ???
SYMBOL_STACK_INDEX: 9
SYMBOL_NAME: athurx+9875
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: athurx
IMAGE_NAME: athurx.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c501c23
FAILURE_BUCKET_ID: X64_0x1E_0_athurx+9875
BUCKET_ID: X64_0x1E_0_athurx+9875
Followup: MachineOwner
---------
8.
BugCheck A, {31400000010, 2, 1, fffff8000304e258}
Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+124c20 )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000031400000010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000304e258, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b9100
0000031400000010
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeWaitForGate+d8
fffff800`0304e258 488930 mov qword ptr [rax],rsi
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: bf3.exe
TRAP_FRAME: fffff8800d5de380 -- (.trap 0xfffff8800d5de380)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000031400000010 rbx=0000000000000000 rcx=fffffa800ae1b610
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000304e258 rsp=fffff8800d5de510 rbp=0000000000000000
r8=0000000000000000 r9=fffff8800d5ded20 r10=00000000003c0000
r11=fffffa800b996ac0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeWaitForGate+0xd8:
fffff800`0304e258 488930 mov qword ptr [rax],rsi ds:3d40:00000314`00000010=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800030861e9 to fffff80003086c40
STACK_TEXT:
fffff880`0d5de238 fffff800`030861e9 : 00000000`0000000a 00000314`00000010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0d5de240 fffff800`03084e60 : 00000001`28800000 fffff880`0d5de3b0 00000000`00000000 fffffa80`0d58eb60 : nt!KiBugCheckDispatch+0x69
fffff880`0d5de380 fffff800`0304e258 : fffffa80`0d58eb60 00000000`00000000 fffffa80`0d58ec68 fffffa80`0bca5000 : nt!KiPageFault+0x260
fffff880`0d5de510 fffff800`0305713d : fffffa80`0ae1b5f0 00000000`00000000 fffffa80`0bca5000 fffff880`0f57653f : nt!KeWaitForGate+0xd8
fffff880`0d5de560 fffff800`0309d778 : 00000000`00000000 fffffa80`0bca5000 00000000`00001f74 000000ff`78091628 : nt!KiAcquireGuardedMutex+0x45
fffff880`0d5de590 fffff880`0f56cc20 : 00000000`00000003 00000000`ff010000 00000000`4d8a0000 00000000`00000000 : nt!KeAcquireGuardedMutex+0x38
fffff880`0d5de5c0 00000000`00000003 : 00000000`ff010000 00000000`4d8a0000 00000000`00000000 00000000`5fcc0000 : nvlddmkm+0x124c20
fffff880`0d5de5c8 00000000`ff010000 : 00000000`4d8a0000 00000000`00000000 00000000`5fcc0000 00000000`00000040 : 0x3
fffff880`0d5de5d0 00000000`4d8a0000 : 00000000`00000000 00000000`5fcc0000 00000000`00000040 fffffa80`0bca5000 : 0xff010000
fffff880`0d5de5d8 00000000`00000000 : 00000000`5fcc0000 00000000`00000040 fffffa80`0bca5000 fffff880`0f56a048 : 0x4d8a0000
STACK_COMMAND: kb
FOLLOWUP_IP:
nvlddmkm+124c20
fffff880`0f56cc20 ?? ???
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: nvlddmkm+124c20
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nvlddmkm
IMAGE_NAME: nvlddmkm.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4eece814
FAILURE_BUCKET_ID: X64_0xA_nvlddmkm+124c20
BUCKET_ID: X64_0xA_nvlddmkm+124c20
Followup: MachineOwner
---------
9.
BugCheck 1E, {ffffffffc0000005, fffff8000313b9b4, 0, 20}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+d3f4 )
Followup: MachineOwner
---------
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8000313b9b4, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000020, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt! ?? ::FNODOBFM::`string'+d3f4
fffff800`0313b9b4 488b5120 mov rdx,qword ptr [rcx+20h]
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000020
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003313100
0000000000000020
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800f4ac960 -- (.trap 0xfffff8800f4ac960)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000002e002e rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000313b9b4 rsp=fffff8800f4acaf0 rbp=fffff8a0118232e1
r8=fffff8a0001079b8 r9=000000000000fffe r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt! ?? ::FNODOBFM::`string'+0xd3f4:
fffff800`0313b9b4 488b5120 mov rdx,qword ptr [rcx+20h] ds:4010:00000000`00000020=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000312c588 to fffff800030e0c40
STACK_TEXT:
fffff880`0f4ac0d8 fffff800`0312c588 : 00000000`0000001e ffffffff`c0000005 fffff800`0313b9b4 00000000`00000000 : nt!KeBugCheckEx
fffff880`0f4ac0e0 fffff800`030e02c2 : fffff880`0f4ac8b8 00000000`00000000 fffff880`0f4ac960 fffffa80`0d483b60 : nt! ?? ::FNODOBFM::`string'+0x4977d
fffff880`0f4ac780 fffff800`030dee3a : 00000000`00000000 00000000`00000020 fffff8a0`10cfd900 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`0f4ac960 fffff800`0313b9b4 : 00000000`00f8000e fffff800`033ae26d 00000000`00000010 00000000`00000246 : nt!KiPageFault+0x23a
fffff880`0f4acaf0 fffff800`033ae6e3 : 00000000`0146e690 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0xd3f4
fffff880`0f4acb20 fffff800`033aeb75 : fffff880`0f4acca0 fffff880`00000001 fffff880`0f4ad0b8 fffff880`0f4ad0b0 : nt!CmpKcbCacheLookup+0xa53
fffff880`0f4acc10 fffff800`033ab224 : fffff8a0`0bd8d880 fffff880`0f4ad0b0 fffff880`0f4ad100 fffff880`0f4ad0e0 : nt!CmpBuildHashStackAndLookupCache+0x335
fffff880`0f4acff0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CmpParseKey+0x294
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+d3f4
fffff800`0313b9b4 488b5120 mov rdx,qword ptr [rcx+20h]
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+d3f4
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1E_c0000005_nt!_??_::FNODOBFM::_string_+d3f4
BUCKET_ID: X64_0x1E_c0000005_nt!_??_::FNODOBFM::_string_+d3f4
Followup: MachineOwner
---------
10.
BugCheck 1E, {ffffffffc0000005, fffff8000313b9b4, 0, 20}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+d3f4 )
Followup: MachineOwner
---------
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8000313b9b4, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000020, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt! ?? ::FNODOBFM::`string'+d3f4
fffff800`0313b9b4 488b5120 mov rdx,qword ptr [rcx+20h]
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000020
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003313100
0000000000000020
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800f4ac960 -- (.trap 0xfffff8800f4ac960)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000002e002e rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000313b9b4 rsp=fffff8800f4acaf0 rbp=fffff8a0118232e1
r8=fffff8a0001079b8 r9=000000000000fffe r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt! ?? ::FNODOBFM::`string'+0xd3f4:
fffff800`0313b9b4 488b5120 mov rdx,qword ptr [rcx+20h] ds:4010:00000000`00000020=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000312c588 to fffff800030e0c40
STACK_TEXT:
fffff880`0f4ac0d8 fffff800`0312c588 : 00000000`0000001e ffffffff`c0000005 fffff800`0313b9b4 00000000`00000000 : nt!KeBugCheckEx
fffff880`0f4ac0e0 fffff800`030e02c2 : fffff880`0f4ac8b8 00000000`00000000 fffff880`0f4ac960 fffffa80`0d483b60 : nt! ?? ::FNODOBFM::`string'+0x4977d
fffff880`0f4ac780 fffff800`030dee3a : 00000000`00000000 00000000`00000020 fffff8a0`10cfd900 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`0f4ac960 fffff800`0313b9b4 : 00000000`00f8000e fffff800`033ae26d 00000000`00000010 00000000`00000246 : nt!KiPageFault+0x23a
fffff880`0f4acaf0 fffff800`033ae6e3 : 00000000`0146e690 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0xd3f4
fffff880`0f4acb20 fffff800`033aeb75 : fffff880`0f4acca0 fffff880`00000001 fffff880`0f4ad0b8 fffff880`0f4ad0b0 : nt!CmpKcbCacheLookup+0xa53
fffff880`0f4acc10 fffff800`033ab224 : fffff8a0`0bd8d880 fffff880`0f4ad0b0 fffff880`0f4ad100 fffff880`0f4ad0e0 : nt!CmpBuildHashStackAndLookupCache+0x335
fffff880`0f4acff0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CmpParseKey+0x294
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+d3f4
fffff800`0313b9b4 488b5120 mov rdx,qword ptr [rcx+20h]
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+d3f4
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1E_c0000005_nt!_??_::FNODOBFM::_string_+d3f4
BUCKET_ID: X64_0x1E_c0000005_nt!_??_::FNODOBFM::_string_+d3f4
Followup: MachineOwner
---------
11.
BugCheck 3B, {c0000005, fffff80003121afc, fffff88006a7ee50, 0}
Probably caused by : memory_corruption ( nt!MiCaptureProtectionFromProto+1c )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80003121afc, Address of the instruction which caused the bugcheck
Arg3: fffff88006a7ee50, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MiCaptureProtectionFromProto+1c
fffff800`03121afc 488b01 mov rax,qword ptr [rcx]
CONTEXT: fffff88006a7ee50 -- (.cxr 0xfffff88006a7ee50)
rax=0000000000000011 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff88006a7f988 rsi=fffffa800dd99ec8 rdi=fffffa800d52a460
rip=fffff80003121afc rsp=fffff88006a7f830 rbp=0000000000000001
r8=00000000000c6000 r9=fffffa800dd99b30 r10=0000000000000000
r11=0000000000000000 r12=0000000000000011 r13=fffff88006a7f980
r14=fffff68000000628 r15=00000000000c5000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!MiCaptureProtectionFromProto+0x1c:
fffff800`03121afc 488b01 mov rax,qword ptr [rcx] ds:002b:00000000`00000000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: bf3.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80003121afc
STACK_TEXT:
fffff880`06a7f830 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiCaptureProtectionFromProto+0x1c
FOLLOWUP_IP:
nt!MiCaptureProtectionFromProto+1c
fffff800`03121afc 488b01 mov rax,qword ptr [rcx]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiCaptureProtectionFromProto+1c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff88006a7ee50 ; kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x3B_nt!MiCaptureProtectionFromProto+1c
BUCKET_ID: X64_0x3B_nt!MiCaptureProtectionFromProto+1c
Followup: MachineOwner
---------
Your first blue screen is due to Atheros AR9271 Wireless Network Adapter, update the driver. (If you need help, just ask)