BSOD unknown origin, error 0x0000004e

dlwoodward · 11 Jan 2012

I've been getting the BSOD sporadically for quite some time now and I am finally fed up.

Here is the STOP error information:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 1033

Additional information about the problem:
BCCode: 4e
BCP1: 0000000000000007
BCP2: 000000000021DD10
BCP3: 0000000000000001
BCP4: 0000000000000000
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\011112-30654-01.dmp
C:\Users\Dustin\AppData\Local\Temp\WER-54600-0.sysdata.xml

I've attached the dump file referenced above.

Here are some details on my machine:
Gateway DX4300
AMD Phenom(tm) II X4 810 Processor 2.60 GHz
8GB RAM
Windows 7 - 64-bit, full-retail
Hardware purchased in 2010, Windows 7 upgrade occurred early 2011

Not sure what the cause is, any help is greatly appreciated.

Also, there are a ton of files in my minidump in addition to the one attached, is this normal?

thanks in advance,
Dustin

dlwoodward · 11 Jan 2012

I've updated my thread to include the files requested in BSOD requirements page.

dlwoodward · 11 Jan 2012

I apologize for not adhering to the protocol for BSOD posts. Hope all of my updates have provided you with the necessary information.

Thanks again for your help.

dlwoodward · 11 Jan 2012

Are there any particular reasons why I am not getting any replies?

writhziden · 12 Jan 2012

There are many reasons you may not get replies. The crashes and debugging forums are the busiest on SevenForums, and they are not always monitored 24/7. Additionally, sometimes if you respond to your own post multiple times, those monitoring see the reply count and may assume another helpful user has posted a response. We apologize for not noticing your issue sooner. I will analyze your dumps now and give an analysis at the end.

Code:


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\dlwoodward\Windows_NT6_BSOD_jcgriff2\120611-46753-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03053000 PsLoadedModuleList = 0xfffff800`03298670
Debug session time: Mon Dec  5 22:47:22.586 2011 (UTC - 7:00)
System Uptime: 3 days 16:16:56.000
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
....................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {7, 21d5ce, 1, 0}

Unable to load image \SystemRoot\system32\DRIVERS\mcdbus.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mcdbus.sys
*** ERROR: Module load completed but symbols could not be loaded for mcdbus.sys
Probably caused by : mcdbus.sys ( mcdbus+368fe )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000007, A driver has unlocked a page more times than it locked it
Arg2: 000000000021d5ce, page frame number
Arg3: 0000000000000001, current share count
Arg4: 0000000000000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000312f108 to fffff800030cfc40

STACK_TEXT:  
fffff880`033af668 fffff800`0312f108 : 00000000`0000004e 00000000`00000007 00000000`0021d5ce 00000000`00000001 : nt!KeBugCheckEx
fffff880`033af670 fffff800`03140856 : fffffa80`09472030 fffff880`012d6f4b 00000000`00000000 fffffa80`08be6b08 : nt! ?? ::FNODOBFM::`string'+0x175b6
fffff880`033af6b0 fffff800`030d2e48 : fffffa80`08df000c 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x37875
fffff880`033af740 fffff880`04e368fe : fffffa80`08b64c30 fffffa80`08be6b00 00000000`6264636d 00000000`00000000 : nt!IopfCompleteRequest+0x168
fffff880`033af830 fffffa80`08b64c30 : fffffa80`08be6b00 00000000`6264636d 00000000`00000000 fffffa80`0947de10 : mcdbus+0x368fe
fffff880`033af838 fffffa80`08be6b00 : 00000000`6264636d 00000000`00000000 fffffa80`0947de10 fffffa80`0947dee0 : 0xfffffa80`08b64c30
fffff880`033af840 00000000`6264636d : 00000000`00000000 fffffa80`0947de10 fffffa80`0947dee0 fffffa80`093cec40 : 0xfffffa80`08be6b00
fffff880`033af848 00000000`00000000 : fffffa80`0947de10 fffffa80`0947dee0 fffffa80`093cec40 fffffa80`0bfc52a0 : 0x6264636d


STACK_COMMAND:  kb

FOLLOWUP_IP: 
mcdbus+368fe
fffff880`04e368fe ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  mcdbus+368fe

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mcdbus

IMAGE_NAME:  mcdbus.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49a3cd1f

FAILURE_BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\dlwoodward\Windows_NT6_BSOD_jcgriff2\120611-32463-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03018000 PsLoadedModuleList = 0xfffff800`0325d670
Debug session time: Tue Dec  6 12:52:49.252 2011 (UTC - 7:00)
System Uptime: 0 days 14:04:05.000
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {7, 21cec3, 1, 0}

Unable to load image \SystemRoot\system32\DRIVERS\mcdbus.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mcdbus.sys
*** ERROR: Module load completed but symbols could not be loaded for mcdbus.sys
Probably caused by : mcdbus.sys ( mcdbus+368fe )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000007, A driver has unlocked a page more times than it locked it
Arg2: 000000000021cec3, page frame number
Arg3: 0000000000000001, current share count
Arg4: 0000000000000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800030f4108 to fffff80003094c40

STACK_TEXT:  
fffff880`033cb668 fffff800`030f4108 : 00000000`0000004e 00000000`00000007 00000000`0021cec3 00000000`00000001 : nt!KeBugCheckEx
fffff880`033cb670 fffff800`03105856 : fffffa80`0982b030 fffff880`010cbf4b 00000000`00000000 fffffa80`098b2098 : nt! ?? ::FNODOBFM::`string'+0x175b6
fffff880`033cb6b0 fffff800`03097e48 : fffffa80`08bd000c 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x37875
fffff880`033cb740 fffff880`0509c8fe : fffffa80`098061b0 fffffa80`098b2000 00000000`00000000 00000000`00000000 : nt!IopfCompleteRequest+0x168
fffff880`033cb830 fffffa80`098061b0 : fffffa80`098b2000 00000000`00000000 00000000`00000000 fffffa80`08bd0e10 : mcdbus+0x368fe
fffff880`033cb838 fffffa80`098b2000 : 00000000`00000000 00000000`00000000 fffffa80`08bd0e10 fffffa80`08bd0ee0 : 0xfffffa80`098061b0
fffff880`033cb840 00000000`00000000 : 00000000`00000000 fffffa80`08bd0e10 fffffa80`08bd0ee0 fffffa80`098c3ec0 : 0xfffffa80`098b2000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
mcdbus+368fe
fffff880`0509c8fe ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  mcdbus+368fe

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mcdbus

IMAGE_NAME:  mcdbus.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49a3cd1f

FAILURE_BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\dlwoodward\Windows_NT6_BSOD_jcgriff2\121411-42354-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03054000 PsLoadedModuleList = 0xfffff800`03299670
Debug session time: Tue Dec 13 22:34:20.473 2011 (UTC - 7:00)
System Uptime: 7 days 9:40:45.000
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {7, 21d358, 1, 0}

Unable to load image \SystemRoot\system32\DRIVERS\mcdbus.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mcdbus.sys
*** ERROR: Module load completed but symbols could not be loaded for mcdbus.sys
Probably caused by : mcdbus.sys ( mcdbus+368fe )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000007, A driver has unlocked a page more times than it locked it
Arg2: 000000000021d358, page frame number
Arg3: 0000000000000001, current share count
Arg4: 0000000000000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80003130108 to fffff800030d0c40

STACK_TEXT:  
fffff880`031bd668 fffff800`03130108 : 00000000`0000004e 00000000`00000007 00000000`0021d358 00000000`00000001 : nt!KeBugCheckEx
fffff880`031bd670 fffff800`03141856 : fffffa80`09aec030 fffff880`011c1f4b 00000000`00000000 fffffa80`0955a8b8 : nt! ?? ::FNODOBFM::`string'+0x175b6
fffff880`031bd6b0 fffff800`030d3e48 : fffffa80`0955000c 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x37875
fffff880`031bd740 fffff880`044508fe : fffffa80`09518ec0 fffffa80`0955a800 00000000`6264636d 00000000`00000000 : nt!IopfCompleteRequest+0x168
fffff880`031bd830 fffffa80`09518ec0 : fffffa80`0955a800 00000000`6264636d 00000000`00000000 fffffa80`0955ae10 : mcdbus+0x368fe
fffff880`031bd838 fffffa80`0955a800 : 00000000`6264636d 00000000`00000000 fffffa80`0955ae10 fffffa80`0955aee0 : 0xfffffa80`09518ec0
fffff880`031bd840 00000000`6264636d : 00000000`00000000 fffffa80`0955ae10 fffffa80`0955aee0 fffffa80`09558a40 : 0xfffffa80`0955a800
fffff880`031bd848 00000000`00000000 : fffffa80`0955ae10 fffffa80`0955aee0 fffffa80`09558a40 fffffa80`0d3d8650 : 0x6264636d


STACK_COMMAND:  kb

FOLLOWUP_IP: 
mcdbus+368fe
fffff880`044508fe ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  mcdbus+368fe

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mcdbus

IMAGE_NAME:  mcdbus.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49a3cd1f

FAILURE_BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\dlwoodward\Windows_NT6_BSOD_jcgriff2\121411-28672-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03005000 PsLoadedModuleList = 0xfffff800`0324a670
Debug session time: Wed Dec 14 07:48:47.650 2011 (UTC - 7:00)
System Uptime: 0 days 9:13:11.008
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {7, 21dd79, 1, 0}

Unable to load image \SystemRoot\system32\DRIVERS\mcdbus.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mcdbus.sys
*** ERROR: Module load completed but symbols could not be loaded for mcdbus.sys
Probably caused by : mcdbus.sys ( mcdbus+368fe )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000007, A driver has unlocked a page more times than it locked it
Arg2: 000000000021dd79, page frame number
Arg3: 0000000000000001, current share count
Arg4: 0000000000000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800030e1108 to fffff80003081c40

STACK_TEXT:  
fffff880`033b6668 fffff800`030e1108 : 00000000`0000004e 00000000`00000007 00000000`0021dd79 00000000`00000001 : nt!KeBugCheckEx
fffff880`033b6670 fffff800`030f2856 : fffffa80`09484030 fffff880`010cbf4b 00000000`00000000 fffffa80`08b6f578 : nt! ?? ::FNODOBFM::`string'+0x175b6
fffff880`033b66b0 fffff800`03084e48 : fffffa80`076f000c 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x37875
fffff880`033b6740 fffff880`0474b8fe : fffffa80`08b3a8d0 fffffa80`08b6f500 00000000`00000000 00000000`00000000 : nt!IopfCompleteRequest+0x168
fffff880`033b6830 fffffa80`08b3a8d0 : fffffa80`08b6f500 00000000`00000000 00000000`00000000 fffffa80`08b75310 : mcdbus+0x368fe
fffff880`033b6838 fffffa80`08b6f500 : 00000000`00000000 00000000`00000000 fffffa80`08b75310 fffffa80`08b753e0 : 0xfffffa80`08b3a8d0
fffff880`033b6840 00000000`00000000 : 00000000`00000000 fffffa80`08b75310 fffffa80`08b753e0 fffffa80`08b79780 : 0xfffffa80`08b6f500


STACK_COMMAND:  kb

FOLLOWUP_IP: 
mcdbus+368fe
fffff880`0474b8fe ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  mcdbus+368fe

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mcdbus

IMAGE_NAME:  mcdbus.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49a3cd1f

FAILURE_BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\dlwoodward\Windows_NT6_BSOD_jcgriff2\121811-41387-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0305e000 PsLoadedModuleList = 0xfffff800`032a3670
Debug session time: Sun Dec 18 00:11:12.264 2011 (UTC - 7:00)
System Uptime: 1 days 17:40:44.012
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {7, 21d10b, 1, 0}

Unable to load image \SystemRoot\system32\DRIVERS\mcdbus.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mcdbus.sys
*** ERROR: Module load completed but symbols could not be loaded for mcdbus.sys
Probably caused by : mcdbus.sys ( mcdbus+368fe )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000007, A driver has unlocked a page more times than it locked it
Arg2: 000000000021d10b, page frame number
Arg3: 0000000000000001, current share count
Arg4: 0000000000000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000313a108 to fffff800030dac40

STACK_TEXT:  
fffff880`033cb668 fffff800`0313a108 : 00000000`0000004e 00000000`00000007 00000000`0021d10b 00000000`00000001 : nt!KeBugCheckEx
fffff880`033cb670 fffff800`0314b856 : fffffa80`09b64030 fffff880`0119ff4b 00000000`00000000 fffffa80`09bc8b68 : nt! ?? ::FNODOBFM::`string'+0x175b6
fffff880`033cb6b0 fffff800`030dde48 : fffffa80`09bc000c 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x37875
fffff880`033cb740 fffff880`046728fe : fffffa80`09b4a430 fffffa80`09bc8b00 00000000`6264636d 00000000`00000000 : nt!IopfCompleteRequest+0x168
fffff880`033cb830 fffffa80`09b4a430 : fffffa80`09bc8b00 00000000`6264636d 00000000`00000000 fffffa80`09bc9e10 : mcdbus+0x368fe
fffff880`033cb838 fffffa80`09bc8b00 : 00000000`6264636d 00000000`00000000 fffffa80`09bc9e10 fffffa80`09bc9ee0 : 0xfffffa80`09b4a430
fffff880`033cb840 00000000`6264636d : 00000000`00000000 fffffa80`09bc9e10 fffffa80`09bc9ee0 fffffa80`0970b740 : 0xfffffa80`09bc8b00
fffff880`033cb848 00000000`00000000 : fffffa80`09bc9e10 fffffa80`09bc9ee0 fffffa80`0970b740 fffffa80`09d34110 : 0x6264636d


STACK_COMMAND:  kb

FOLLOWUP_IP: 
mcdbus+368fe
fffff880`046728fe ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  mcdbus+368fe

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mcdbus

IMAGE_NAME:  mcdbus.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49a3cd1f

FAILURE_BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\dlwoodward\Windows_NT6_BSOD_jcgriff2\121811-24944-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0300e000 PsLoadedModuleList = 0xfffff800`03253670
Debug session time: Sun Dec 18 05:39:21.267 2011 (UTC - 7:00)
System Uptime: 0 days 5:26:53.015
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {7, 21d0c6, 1, 0}

Unable to load image \SystemRoot\system32\DRIVERS\mcdbus.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mcdbus.sys
*** ERROR: Module load completed but symbols could not be loaded for mcdbus.sys
Probably caused by : mcdbus.sys ( mcdbus+368fe )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000007, A driver has unlocked a page more times than it locked it
Arg2: 000000000021d0c6, page frame number
Arg3: 0000000000000001, current share count
Arg4: 0000000000000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800030ea108 to fffff8000308ac40

STACK_TEXT:  
fffff880`033bd668 fffff800`030ea108 : 00000000`0000004e 00000000`00000007 00000000`0021d0c6 00000000`00000001 : nt!KeBugCheckEx
fffff880`033bd670 fffff800`030fb856 : fffffa80`099fa030 fffff880`01155f4b 00000000`00000000 fffffa80`096c5eb8 : nt! ?? ::FNODOBFM::`string'+0x175b6
fffff880`033bd6b0 fffff800`0308de48 : fffffa80`08c0000c 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x37875
fffff880`033bd740 fffff880`046f18fe : fffffa80`08b7a470 fffffa80`096c5e00 00000000`6264636d 00000000`00000000 : nt!IopfCompleteRequest+0x168
fffff880`033bd830 fffffa80`08b7a470 : fffffa80`096c5e00 00000000`6264636d 00000000`00000000 fffffa80`096c1910 : mcdbus+0x368fe
fffff880`033bd838 fffffa80`096c5e00 : 00000000`6264636d 00000000`00000000 fffffa80`096c1910 fffffa80`096c19e0 : 0xfffffa80`08b7a470
fffff880`033bd840 00000000`6264636d : 00000000`00000000 fffffa80`096c1910 fffffa80`096c19e0 fffffa80`096c6dc0 : 0xfffffa80`096c5e00
fffff880`033bd848 00000000`00000000 : fffffa80`096c1910 fffffa80`096c19e0 fffffa80`096c6dc0 fffffa80`089702b0 : 0x6264636d


STACK_COMMAND:  kb

FOLLOWUP_IP: 
mcdbus+368fe
fffff880`046f18fe ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  mcdbus+368fe

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mcdbus

IMAGE_NAME:  mcdbus.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49a3cd1f

FAILURE_BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\dlwoodward\Windows_NT6_BSOD_jcgriff2\122111-41543-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03066000 PsLoadedModuleList = 0xfffff800`032ab670
Debug session time: Wed Dec 21 04:02:09.254 2011 (UTC - 7:00)
System Uptime: 2 days 22:21:36.002
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {7, 21cd2c, 1, 0}

Unable to load image \SystemRoot\system32\DRIVERS\mcdbus.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mcdbus.sys
*** ERROR: Module load completed but symbols could not be loaded for mcdbus.sys
Probably caused by : mcdbus.sys ( mcdbus+368fe )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000007, A driver has unlocked a page more times than it locked it
Arg2: 000000000021cd2c, page frame number
Arg3: 0000000000000001, current share count
Arg4: 0000000000000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80003142108 to fffff800030e2c40

STACK_TEXT:  
fffff880`033bd668 fffff800`03142108 : 00000000`0000004e 00000000`00000007 00000000`0021cd2c 00000000`00000001 : nt!KeBugCheckEx
fffff880`033bd670 fffff800`03153856 : fffffa80`09ac2030 fffff880`01002f4b 00000000`00000000 fffffa80`09b27eb8 : nt! ?? ::FNODOBFM::`string'+0x175b6
fffff880`033bd6b0 fffff800`030e5e48 : fffffa80`08d3000c 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x37875
fffff880`033bd740 fffff880`054718fe : fffffa80`09a99ae0 fffffa80`09b27e00 00000000`6264636d 00000000`00000000 : nt!IopfCompleteRequest+0x168
fffff880`033bd830 fffffa80`09a99ae0 : fffffa80`09b27e00 00000000`6264636d 00000000`00000000 fffffa80`09b28ab0 : mcdbus+0x368fe
fffff880`033bd838 fffffa80`09b27e00 : 00000000`6264636d 00000000`00000000 fffffa80`09b28ab0 fffffa80`09b28b80 : 0xfffffa80`09a99ae0
fffff880`033bd840 00000000`6264636d : 00000000`00000000 fffffa80`09b28ab0 fffffa80`09b28b80 fffffa80`09b2cfc0 : 0xfffffa80`09b27e00
fffff880`033bd848 00000000`00000000 : fffffa80`09b28ab0 fffffa80`09b28b80 fffffa80`09b2cfc0 fffffa80`0b494770 : 0x6264636d


STACK_COMMAND:  kb

FOLLOWUP_IP: 
mcdbus+368fe
fffff880`054718fe ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  mcdbus+368fe

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mcdbus

IMAGE_NAME:  mcdbus.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49a3cd1f

FAILURE_BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\dlwoodward\Windows_NT6_BSOD_jcgriff2\010912-58079-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03005000 PsLoadedModuleList = 0xfffff800`0324a670
Debug session time: Mon Jan  9 13:41:13.932 2012 (UTC - 7:00)
System Uptime: 19 days 9:38:03.708
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
.........................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000EA, {fffffa800a07eb60, 0, 0, 0}

*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
Probably caused by : dxgkrnl.sys ( dxgkrnl!TdrTimedOperationBugcheckOnTimeout+37 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

THREAD_STUCK_IN_DEVICE_DRIVER_M (100000ea)
The device driver is spinning in an infinite loop, most likely waiting for
hardware to become idle. This usually indicates problem with the hardware
itself or with the device driver programming the hardware incorrectly.
If the kernel debugger is connected and running when watchdog detects a
timeout condition then DbgBreakPoint() will be called instead of KeBugCheckEx()
and detailed message including bugcheck arguments will be printed to the
debugger. This way we can identify an offending thread, set breakpoints in it,
and hit go to return to the spinning code to debug it further. Because
KeBugCheckEx() is not called the .bugcheck directive will not return bugcheck
information in this case. The arguments are already printed out to the kernel
debugger. You can also retrieve them from a global variable via
"dd watchdog!g_WdBugCheckData l5" (use dq on NT64).
On MP machines it is possible to hit a timeout when the spinning thread is
interrupted by hardware interrupt and ISR or DPC routine is running at the time
of the bugcheck (this is because the timeout's work item can be delivered and
handled on the second CPU and the same time). If this is the case you will have
to look deeper at the offending thread's stack (e.g. using dds) to determine
spinning code which caused the timeout to occur.
Arguments:
Arg1: fffffa800a07eb60, Pointer to a stuck thread object.  Do .thread then kb on it to find
	the hung location.
Arg2: 0000000000000000, Pointer to a DEFERRED_WATCHDOG object.
Arg3: 0000000000000000, Pointer to offending driver name.
Arg4: 0000000000000000, Number of times "intercepted" bugcheck 0xEA was hit (see notes).

Debugging Details:
------------------


FAULTING_THREAD:  fffffa800a07eb60

DEFAULT_BUCKET_ID:  GRAPHICS_DRIVER_FAULT

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0xEA

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff88004659f63 to fffff80003081c40

STACK_TEXT:  
fffff880`02ad8158 fffff880`04659f63 : 00000000`000000ea fffffa80`0a07eb60 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`02ad8160 fffff880`0465a112 : fffff880`02ad8230 fffff880`0432a5a7 fffff880`02ad8230 00000000`00000246 : dxgkrnl!TdrTimedOperationBugcheckOnTimeout+0x37
fffff880`02ad81d0 fffff880`0406d032 : 00000000`00000000 fffff880`0432a58c fffff880`02ad8370 00000000`01c9c380 : dxgkrnl!TdrTimedOperationDelay+0xbe
fffff880`02ad8210 00000000`00000000 : fffff880`0432a58c fffff880`02ad8370 00000000`01c9c380 00000000`00000028 : atikmdag+0x31032


STACK_COMMAND:  .thread 0xfffffa800a07eb60 ; kb

FOLLOWUP_IP: 
dxgkrnl!TdrTimedOperationBugcheckOnTimeout+37
fffff880`04659f63 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  dxgkrnl!TdrTimedOperationBugcheckOnTimeout+37

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: dxgkrnl

IMAGE_NAME:  dxgkrnl.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce799fa

FAILURE_BUCKET_ID:  X64_0xEA_IMAGE_dxgkrnl.sys

BUCKET_ID:  X64_0xEA_IMAGE_dxgkrnl.sys

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\dlwoodward\Windows_NT6_BSOD_jcgriff2\011112-30654-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03010000 PsLoadedModuleList = 0xfffff800`03255670
Debug session time: Wed Jan 11 07:58:54.253 2012 (UTC - 7:00)
System Uptime: 0 days 6:36:01.001
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {7, 21dd10, 1, 0}

Unable to load image \SystemRoot\system32\DRIVERS\mcdbus.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mcdbus.sys
*** ERROR: Module load completed but symbols could not be loaded for mcdbus.sys
Probably caused by : mcdbus.sys ( mcdbus+368fe )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000007, A driver has unlocked a page more times than it locked it
Arg2: 000000000021dd10, page frame number
Arg3: 0000000000000001, current share count
Arg4: 0000000000000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800030ec108 to fffff8000308cc40

STACK_TEXT:  
fffff880`031a1668 fffff800`030ec108 : 00000000`0000004e 00000000`00000007 00000000`0021dd10 00000000`00000001 : nt!KeBugCheckEx
fffff880`031a1670 fffff800`030fd856 : fffffa80`099ff030 fffff880`0115bf4b 00000000`00000000 fffffa80`08b0a428 : nt! ?? ::FNODOBFM::`string'+0x175b6
fffff880`031a16b0 fffff800`0308fe48 : fffffa80`08bf000c 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x37875
fffff880`031a1740 fffff880`051128fe : fffffa80`08b376b0 fffffa80`08b0a400 00000000`6264636d 00000000`00000000 : nt!IopfCompleteRequest+0x168
fffff880`031a1830 fffffa80`08b376b0 : fffffa80`08b0a400 00000000`6264636d 00000000`00000000 fffffa80`08b12530 : mcdbus+0x368fe
fffff880`031a1838 fffffa80`08b0a400 : 00000000`6264636d 00000000`00000000 fffffa80`08b12530 fffffa80`08b12600 : 0xfffffa80`08b376b0
fffff880`031a1840 00000000`6264636d : 00000000`00000000 fffffa80`08b12530 fffffa80`08b12600 fffffa80`08b10440 : 0xfffffa80`08b0a400
fffff880`031a1848 00000000`00000000 : fffffa80`08b12530 fffffa80`08b12600 fffffa80`08b10440 fffffa80`0c10f2c0 : 0x6264636d


STACK_COMMAND:  kb

FOLLOWUP_IP: 
mcdbus+368fe
fffff880`051128fe ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  mcdbus+368fe

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mcdbus

IMAGE_NAME:  mcdbus.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49a3cd1f

FAILURE_BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

BUCKET_ID:  X64_0x4E_7_mcdbus+368fe

Followup: MachineOwner
---------

All but one of the .dmp files points to mcdbus.sys which is MagicISO SCSI Host Controller driver. I would uninstall MagicISO and install the latest version.

Also, update the following drivers with the help of Installing and updating drivers in 7,
Driver Reference Table - sysnative.com - MVP,
and Drivers and Downloads to use as references for finding drivers and updating them.

Code:

LVUSBS64	fffff880`051dd000	fffff880`051e9980	Sat Feb 03 11:05:16 2007 (45c4cedc)	0001bba8		LVUSBS64.sys
adfs	fffff880`06e9f000	fffff880`06eb7000	Thu Jun 26 14:52:37 2008 (48640195)	00024203		adfs.SYS
mcdbus	fffff880`050dc000	fffff880`05118880	Tue Feb 24 03:34:07 2009 (49a3cd1f)	00041e84	None	mcdbus.sys
glancedrv	fffff880`04410000	fffff880`0441c000	Mon Apr 20 12:07:22 2009 (49ecb9da)	00018d95		glancedrv.sys
AtiPcie	fffff880`01680000	fffff880`01688000	Tue May 05 09:00:22 2009 (4a005486)	000134c7		AtiPcie.sys
GEARAspiWDM	fffff880`041da000	fffff880`041e7000	Mon May 18 06:17:04 2009 (4a1151c0)	000159b4		GEARAspiWDM.sys
AtiHdmi	fffff880`05000000	fffff880`05020000	Fri Jun 05 02:31:42 2009 (4a28d7ee)	0002234f		AtiHdmi.sys
atikmdag	fffff880`04866000	fffff880`04e7d000	Thu Jul 02 11:45:07 2009 (4a4cf223)	005c2509		atikmdag.sys

dlwoodward · 29 Jan 2012

Finally saw the follow up. Uninstalled MagicISO and updated the other drivers.

Thanks for the response and hopefully this will solve my issues!

Cheers!

writhziden · 30 Jan 2012

You're welcome. Good luck!