Code:
-
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\fyrspray\Windows_NT6_BSOD_jcgriff2\012012-25162-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03008000 PsLoadedModuleList = 0xfffff800`0324d670
Debug session time: Fri Jan 20 18:05:08.191 2012 (UTC - 7:00)
System Uptime: 0 days 0:05:49.721
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff68e858c0a08, 0, fffff800030a1f61, 5}
Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiDispatchFault+d1 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff68e858c0a08, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800030a1f61, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b7100
fffff68e858c0a08
FAULTING_IP:
nt!MiDispatchFault+d1
fffff800`030a1f61 4b8b1c1c mov rbx,qword ptr [r12+r11]
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff880078f3820 -- (.trap 0xfffff880078f3820)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=1d0b18141de80d66 rbx=0000000000000000 rcx=0000000000000002
rdx=00000000ffffffff rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030a1f61 rsp=fffff880078f39b0 rbp=fffff68000385628
r8=00001d0b18141de8 r9=0000000000000000 r10=0000000fffffffff
r11=fffff68000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!MiDispatchFault+0xd1:
fffff800`030a1f61 4b8b1c1c mov rbx,qword ptr [r12+r11] ds:3a08:fffff680`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000302f3bf to fffff80003084c40
STACK_TEXT:
fffff880`078f36b8 fffff800`0302f3bf : 00000000`00000050 fffff68e`858c0a08 00000000`00000000 fffff880`078f3820 : nt!KeBugCheckEx
fffff880`078f36c0 fffff800`03082d6e : 00000000`00000000 fffff68e`858c0a08 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x44791
fffff880`078f3820 fffff800`030a1f61 : 00000000`00000001 fffff680`00385628 fffff880`078f3c20 fffff6fb`40001c28 : nt!KiPageFault+0x16e
fffff880`078f39b0 fffff800`03091f19 : 00000000`00000000 00000000`70ac5038 00000000`00000000 fffff800`00000000 : nt!MiDispatchFault+0xd1
fffff880`078f3ac0 fffff800`03082d6e : 00000000`00000000 00000000`70ac5038 00000000`03fcd601 00000000`0000000e : nt!MmAccessFault+0x359
fffff880`078f3c20 00000000`77768dc4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`03fcd430 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77768dc4
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiDispatchFault+d1
fffff800`030a1f61 4b8b1c1c mov rbx,qword ptr [r12+r11]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiDispatchFault+d1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x50_nt!MiDispatchFault+d1
BUCKET_ID: X64_0x50_nt!MiDispatchFault+d1
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\fyrspray\Windows_NT6_BSOD_jcgriff2\012012-20202-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0300f000 PsLoadedModuleList = 0xfffff800`03254670
Debug session time: Fri Jan 20 17:48:35.535 2012 (UTC - 7:00)
System Uptime: 0 days 0:06:56.065
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
..................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {31, fffffa8007817e20, fffff8800647a000, fffff8a003b96150}
Unable to load image aswSnx.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSnx.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswSnx.SYS
Probably caused by : aswSnx.SYS ( aswSnx+1c2c4 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000031, The subtype of the bugcheck.
Arg2: fffffa8007817e20
Arg3: fffff8800647a000
Arg4: fffff8a003b96150
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_31
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800032e8b25 to fffff8000308bc40
STACK_TEXT:
fffff880`0363bde8 fffff800`032e8b25 : 00000000`0000001a 00000000`00000031 fffffa80`07817e20 fffff880`0647a000 : nt!KeBugCheckEx
fffff880`0363bdf0 fffff800`03363c37 : fffffa80`00000000 fffffa80`07634b60 00000000`000010ce fffff8a0`03b4d000 : nt! ?? ::NNGAKEGL::`string'+0x7271
fffff880`0363be50 fffff800`030bb6eb : ffffffff`ffffffff fffff880`0363bfc0 00000000`00026000 fffff800`030b3b00 : nt!MiRelocateImagePfn+0xf7
fffff880`0363beb0 fffff800`03026b64 : fffffa80`07614d90 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiWaitForInPageComplete+0x7ef
fffff880`0363bf90 fffff800`032e5e7a : 00000000`00000000 fffffa80`071b7610 00000000`00000001 fffffa80`071b7610 : nt!MiPfCompletePrefetchIos+0x54
fffff880`0363bfc0 fffff800`034e904d : 00000000`000000a8 00000000`000002ec fffffa80`071b7610 fffff880`0363c088 : nt!MmPrefetchPages+0x13a
fffff880`0363c020 fffff800`034f106e : fffff8a0`00000000 fffff8a0`000002b0 fffff8a0`000000bb 00000000`00000000 : nt!PfpPrefetchFilesTrickle+0x21d
fffff880`0363c120 fffff800`034f1c07 : 00000000`00000000 fffff880`0363cca0 fffff880`0363c318 fffff8a0`0288e060 : nt!PfpPrefetchRequestPerform+0x30e
fffff880`0363c270 fffff800`034fe1de : fffff880`0363c318 00000000`00000001 fffffa80`06e9d2e0 00000000`00000000 : nt!PfpPrefetchRequest+0x176
fffff880`0363c2e0 fffff800`03502a0a : 00000000`00000000 00000000`0000004f 00000000`00000000 fffff8a0`02685d01 : nt!PfSetSuperfetchInformation+0x1ad
fffff880`0363c3c0 fffff880`043132c4 : 00000000`00000000 00000000`02cdf8f0 fffff8a0`03428360 fffff800`031bafbd : nt!NtSetSystemInformation+0xc8d
fffff880`0363c530 00000000`00000000 : 00000000`02cdf8f0 fffff8a0`03428360 fffff800`031bafbd fffffa80`07c28b40 : aswSnx+0x1c2c4
STACK_COMMAND: kb
FOLLOWUP_IP:
aswSnx+1c2c4
fffff880`043132c4 ?? ???
SYMBOL_STACK_INDEX: b
SYMBOL_NAME: aswSnx+1c2c4
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: aswSnx
IMAGE_NAME: aswSnx.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4ed3cabd
FAILURE_BUCKET_ID: X64_0x1a_31_aswSnx+1c2c4
BUCKET_ID: X64_0x1a_31_aswSnx+1c2c4
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\fyrspray\Windows_NT6_BSOD_jcgriff2\012012-22885-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0300b000 PsLoadedModuleList = 0xfffff800`03250670
Debug session time: Fri Jan 20 17:25:11.278 2012 (UTC - 7:00)
System Uptime: 0 days 0:01:20.808
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
..................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff96000085feb, fffff880057822b0, 0}
Probably caused by : win32k.sys ( win32k!FHOBJ::pbktSearch+d3 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000085feb, Address of the instruction which caused the bugcheck
Arg3: fffff880057822b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
win32k!FHOBJ::pbktSearch+d3
fffff960`00085feb 66413b00 cmp ax,word ptr [r8]
CONTEXT: fffff880057822b0 -- (.cxr 0xfffff880057822b0)
rax=000000000000004d rbx=fffff88005782cd0 rcx=fffff900c00ca0e0
rdx=0003000300030002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000085feb rsp=fffff88005782c98 rbp=0000000000000000
r8=000300030003003e r9=0000000000000000 r10=0000000000000000
r11=fffff900c00ca0e0 r12=0000000000000000 r13=fffff900c00ca0e0
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
win32k!FHOBJ::pbktSearch+0xd3:
fffff960`00085feb 66413b00 cmp ax,word ptr [r8] ds:002b:00030003`0003003e=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff96000086af9 to fffff96000085feb
STACK_TEXT:
fffff880`05782c98 fffff960`00086af9 : fffff880`05782db0 00000000`00000000 00000000`00000000 fffff960`000861b9 : win32k!FHOBJ::pbktSearch+0xd3
fffff880`05782ca0 fffff960`00086878 : fffff880`05783001 fffff880`05020202 fffff880`00000001 fffff880`05783580 : win32k!MAPPER::bFoundExactMatch+0x109
fffff880`05782d50 fffff960`0008a62a : 00000000`00000001 fffff880`05783070 fffff900`c00ca010 fffff960`000c98ef : win32k!ppfeGetAMatch+0x1e8
fffff880`05782f20 fffff960`00089a40 : 00000000`00000006 fffff880`05783580 fffff880`05783100 fffff880`05783058 : win32k!LFONTOBJ::ppfeMapFont+0x326
fffff880`05782fe0 fffff960`00042b89 : fffff880`00000000 fffff900`c00ca010 fffffa80`00000000 fffff880`00000002 : win32k!RFONTOBJ::bInit+0x2cc
fffff880`05783100 fffff960`00042337 : fffff900`00000000 00000000`00000003 00000000`00000002 00000000`00000000 : win32k!GreExtTextOutWLocked+0x7e5
fffff880`05783520 fffff960`0004221d : 00000000`01010051 00000000`00000000 00000000`00000002 fffff960`00042020 : win32k!GreExtTextOutWInternal+0x10f
fffff880`057835d0 fffff960`00035d9b : 00000000`01010051 fffff880`05783670 00000000`018a0038 fffff960`0008c2fc : win32k!GreExtTextOutW+0x3d
fffff880`05783630 fffff960`0004c9da : 00000000`01010051 00000000`00000001 00000000`00000001 fffff960`000d0072 : win32k!DrawIt+0xd7
fffff880`05783690 fffff960`00047640 : 00000000`05050027 00000000`000001f8 00000000`00000000 fffff900`c00c2010 : win32k!DrawFrameControl+0x324
fffff880`057837b0 fffff960`00103e67 : 00000000`00000000 fffffa80`05b13a80 fffff900`c0091a80 fffffa80`05b29de0 : win32k!CreateBitmapStrip+0x308
fffff880`05783810 fffff960`0010437c : 00000000`00000040 fffffa80`05b13a80 00000000`00000000 00000000`00000000 : win32k!xxxResetDisplayDevice+0x2a3
fffff880`057839b0 fffff960`001044c2 : fffffa80`05b13a80 00000000`00000000 00000000`00000000 00000000`00000001 : win32k!xxxInternalUserChangeDisplaySettings+0x440
fffff880`05783a70 fffff960`00101936 : 00000000`00000000 00000000`00000000 00013afc`81a100b6 00000000`00000040 : win32k!xxxUserChangeDisplaySettings+0x92
fffff880`05783b60 fffff960`00101b3f : 00000000`00000000 00000000`00000001 00000000`00000005 fffff800`030917f3 : win32k!xxxRemoteSetDisconnectDisplayMode+0x42
fffff880`05783ba0 fffff960`000e539a : 00000000`00000000 fffffa80`05b4ab60 fffff880`05783ca0 00000000`002c0000 : win32k!xxxRemoteDisconnect+0x1cb
fffff880`05783bf0 fffff800`03086ed3 : fffffa80`05b4ab60 00000000`00000005 00000000`00000020 00000000`00000000 : win32k!NtUserCallNoParam+0x36
fffff880`05783c20 000007fe`fdc21eea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0071f7a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fdc21eea
FOLLOWUP_IP:
win32k!FHOBJ::pbktSearch+d3
fffff960`00085feb 66413b00 cmp ax,word ptr [r8]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: win32k!FHOBJ::pbktSearch+d3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ecdcd5a
STACK_COMMAND: .cxr 0xfffff880057822b0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_win32k!FHOBJ::pbktSearch+d3
BUCKET_ID: X64_0x3B_win32k!FHOBJ::pbktSearch+d3
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\fyrspray\Windows_NT6_BSOD_jcgriff2\012012-19406-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03018000 PsLoadedModuleList = 0xfffff800`0325d670
Debug session time: Fri Jan 20 06:56:56.527 2012 (UTC - 7:00)
System Uptime: 0 days 0:00:23.056
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
..................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff88002a11c88, fffff88002a114e0, fffff800031c4b05}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+249 )
Followup: Pool_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88002a11c88
Arg3: fffff88002a114e0
Arg4: fffff800031c4b05
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88002a11c88 -- (.exr 0xfffff88002a11c88)
ExceptionAddress: fffff800031c4b05 (nt!ExDeferredFreePool+0x0000000000000249)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88002a114e0 -- (.cxr 0xfffff88002a114e0)
rax=0064007200610048 rbx=0000000000000003 rcx=fffffa8003c643a0
rdx=fffff8a00129e4f0 rsi=0000000000000000 rdi=fffff8a00127e740
rip=fffff800031c4b05 rsp=fffff88002a11ec0 rbp=0000000000000000
r8=8db28e7c8c9e8e92 r9=fffff8a00129f450 r10=0000000000000001
r11=fffff8a00129f460 r12=fffffa8003c64140 r13=0000000000000000
r14=000000000000000f r15=0000000000000001
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!ExDeferredFreePool+0x249:
fffff800`031c4b05 4c395808 cmp qword ptr [rax+8],r11 ds:002b:00640072`00610050=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: LogonUI.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c7100
ffffffffffffffff
FOLLOWUP_IP:
nt!ExDeferredFreePool+249
fffff800`031c4b05 4c395808 cmp qword ptr [rax+8],r11
FAULTING_IP:
nt!ExDeferredFreePool+249
fffff800`031c4b05 4c395808 cmp qword ptr [rax+8],r11
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff800031c41a1 to fffff800031c4b05
STACK_TEXT:
fffff880`02a11ec0 fffff800`031c41a1 : fffffa80`04d3c180 fffff8a0`0129f110 fffffa80`04d3c180 fffff880`014d667f : nt!ExDeferredFreePool+0x249
fffff880`02a11f50 fffff880`014d086d : fffff8a0`0129f120 fffff880`02a123b0 fffff880`4146744e fffffa80`05a58560 : nt!ExFreePoolWithTag+0x411
fffff880`02a12000 fffff880`01437a3d : fffffa80`05a58560 fffffa80`07316ab0 fffff880`02a123b0 fffff880`02a12200 : Ntfs!NtfsCommonCreate+0x2336
fffff880`02a121e0 fffff800`030a1618 : fffff880`02a12320 fffffa80`07317340 00000000`00000002 00000000`00310037 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`02a12210 fffff880`014381bf : fffff880`01437a20 fffff880`01437020 fffff880`02a12300 fffff880`014d8f00 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`02a122f0 fffff880`014d199c : 00000000`00000000 00000000`00000000 fffff880`02a12540 fffffa80`07316ab0 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`02a12350 fffff880`01321bcf : fffffa80`04d3c030 fffffa80`07316ab0 00000000`00000000 fffffa80`04fa6040 : Ntfs!NtfsFsdCreate+0x1ac
fffff880`02a12500 fffff880`013412b9 : fffffa80`07316ab0 fffffa80`05107800 fffffa80`07316a00 fffffa80`04fa6040 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`02a12590 fffff800`03392f95 : 00000000`00000045 fffffa80`06fcbcc8 fffff880`02a129e0 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`02a12640 fffff800`0338f838 : fffffa80`04c3f060 fffff800`00000000 fffffa80`06fcbb10 00000000`00000101 : nt!IopParseDevice+0x5a5
fffff880`02a127d0 fffff800`03390a56 : 00000000`00000000 fffffa80`06fcbb10 fffffa80`07314210 fffffa80`03d20660 : nt!ObpLookupObjectName+0x588
fffff880`02a128c0 fffff800`033709d6 : 00000000`00000000 00000000`000bd390 fffffa80`06f73b01 fffff800`03390c81 : nt!ObOpenObjectByName+0x306
fffff880`02a12990 fffff800`03093ed3 : 00000000`00000008 00000000`76e9c42b fffffa80`072fa060 00000000`002d0b3c : nt!NtQueryAttributesFile+0x145
fffff880`02a12c20 00000000`76ea16ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000bd358 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76ea16ea
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExDeferredFreePool+249
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .cxr 0xfffff88002a114e0 ; kb
FAILURE_BUCKET_ID: X64_0x24_nt!ExDeferredFreePool+249
BUCKET_ID: X64_0x24_nt!ExDeferredFreePool+249
Followup: Pool_corruption
---------