Code:
-
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [E:\BSODDmpFiles\Reminisce\Windows_NT6_BSOD_jcgriff2\021012-14523-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0300a000 PsLoadedModuleList = 0xfffff800`0324f670
Debug session time: Fri Feb 10 01:05:42.993 2012 (GMT-7)
System Uptime: 0 days 0:11:56.663
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff880010e83d1, fffff880082e5fb0, 0}
Probably caused by : hardware ( fltmgr!FltpAllocateIrpCtrl+a1 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff880010e83d1, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff880082e5fb0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
fltmgr!FltpAllocateIrpCtrl+a1
fffff880`010e83d1 8729 xchg ebp,dword ptr [rcx]
CONTEXT: fffff880082e5fb0 -- (.cxr 0xfffff880082e5fb0)
rax=0000000000000011 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000002 rsi=fffffa800380b340 rdi=0000000000000002
rip=fffff880010e83d1 rsp=fffff880082e6990 rbp=fffff880082e69c0
r8=0000000000000000 r9=fffff880082e6a60 r10=fffffa8004938010
r11=0000000000120089 r12=0000000000000002 r13=000000000ddf5580
r14=0000000000010000 r15=fffff880082e6a60
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
fltmgr!FltpAllocateIrpCtrl+0xa1:
fffff880`010e83d1 8729 xchg ebp,dword ptr [rcx] ds:002b:00000000`00000000=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: javaw.exe
CURRENT_IRQL: 0
MISALIGNED_IP:
fltmgr!FltpAllocateIrpCtrl+a1
fffff880`010e83d1 8729 xchg ebp,dword ptr [rcx]
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff880010e83d1
STACK_TEXT:
fffff880`082e6990 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : fltmgr!FltpAllocateIrpCtrl+0xa1
FOLLOWUP_IP:
fltmgr!FltpAllocateIrpCtrl+a1
fffff880`010e83d1 8729 xchg ebp,dword ptr [rcx]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: fltmgr!FltpAllocateIrpCtrl+a1
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .cxr 0xfffff880082e5fb0 ; kb
MODULE_NAME: hardware
FAILURE_BUCKET_ID: X64_IP_MISALIGNED
BUCKET_ID: X64_IP_MISALIGNED
Followup: MachineOwner
---------
-
Loading Dump File [E:\BSODDmpFiles\Reminisce\Windows_NT6_BSOD_jcgriff2\021012-14289-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03067000 PsLoadedModuleList = 0xfffff800`032ac670
Debug session time: Fri Feb 10 00:34:47.872 2012 (GMT-7)
System Uptime: 0 days 0:04:02.542
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7F, {8, 80050031, 6f8, fffff800030e69a0}
Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff800030e69a0
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: XSplit.Core.ex
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff800030e31e9 to fffff800030e3c40
STACK_TEXT:
fffff880`02fdbce8 fffff800`030e31e9 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`02fdbcf0 fffff800`030e16b2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`02fdbe30 fffff800`030e69a0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`0957a1b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SwapContext_PatchXRstor+0xbe
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiDoubleFaultAbort+b2
fffff800`030e16b2 90 nop
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiDoubleFaultAbort+b2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x7f_8_nt!KiDoubleFaultAbort+b2
BUCKET_ID: X64_0x7f_8_nt!KiDoubleFaultAbort+b2
Followup: MachineOwner
---------
-
Loading Dump File [E:\BSODDmpFiles\Reminisce\Windows_NT6_BSOD_jcgriff2\021012-16364-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03066000 PsLoadedModuleList = 0xfffff800`032ab670
Debug session time: Fri Feb 10 00:25:33.014 2012 (GMT-7)
System Uptime: 0 days 0:20:41.700
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {8, 2, 1, fffff800030ed6a1}
Probably caused by : hardware ( ndis!ndisReceiveWorkerThread+d0 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800030ed6a1, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003315100
0000000000000008
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeInterlockedClearProcessorAffinityEx+51
fffff800`030ed6a1 0000 add byte ptr [rax],al
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff88007cab860 -- (.trap 0xfffff88007cab860)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000008 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030ed6a1 rsp=fffff88007cab9f8 rbp=fffff88007608db0
r8=fffffa80075300e8 r9=0000000000000008 r10=fffffffffffffff7
r11=0000000000000100 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeInterlockedClearProcessorAffinityEx+0x51:
fffff800`030ed6a1 0000 add byte ptr [rax],al ds:0020:00000000`00000008=??
Resetting default scope
MISALIGNED_IP:
nt!KeInterlockedClearProcessorAffinityEx+51
fffff800`030ed6a1 0000 add byte ptr [rax],al
LAST_CONTROL_TRANSFER: from fffff800030e21e9 to fffff800030e2c40
STACK_TEXT:
fffff880`07cab718 fffff800`030e21e9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`07cab720 fffff800`030e0e60 : fffffa80`0800c030 fffff880`014bd2f7 00000000`00000000 fffff880`02fd5180 : nt!KiBugCheckDispatch+0x69
fffff880`07cab860 fffff800`030ed6a1 : fffff800`030e5895 00000000`00000003 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
fffff880`07cab9f8 fffff800`030e5895 : 00000000`00000003 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeInterlockedClearProcessorAffinityEx+0x51
fffff880`07caba00 fffff800`030e54da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SwapContext_PatchXSave+0x94
fffff880`07caba40 fffff800`030e7f32 : fffff880`07cabc80 fffffa80`09d5a060 00000004`00000008 00040006`00000007 : nt!KiSwapContext+0x7a
fffff880`07cabb80 fffff800`030ea74f : 00000000`00000002 00000000`00000003 00000000`00000000 00000000`00000003 : nt!KiCommitThreadWait+0x1d2
fffff880`07cabc10 fffff880`014f5e50 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`086f1f00 : nt!KeWaitForSingleObject+0x19f
fffff880`07cabcb0 fffff800`0337dfee : 00000000`0b0ced82 fffffa80`09d5a060 00000000`00000080 fffffa80`09d5a060 : ndis!ndisReceiveWorkerThread+0xd0
fffff880`07cabd40 fffff800`030d45e6 : fffff880`02fd5180 fffffa80`09d5a060 fffff880`02fdffc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`07cabd80 00000000`00000000 : fffff880`07cac000 fffff880`07ca6000 fffff880`07caba00 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
ndis!ndisReceiveWorkerThread+d0
fffff880`014f5e50 440f20c5 mov rbp,cr8
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: ndis!ndisReceiveWorkerThread+d0
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: hardware
FAILURE_BUCKET_ID: X64_IP_MISALIGNED
BUCKET_ID: X64_IP_MISALIGNED
Followup: MachineOwner
---------
-
Loading Dump File [E:\BSODDmpFiles\Reminisce\Windows_NT6_BSOD_jcgriff2\021012-20670-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03049000 PsLoadedModuleList = 0xfffff800`0328e670
Debug session time: Fri Feb 10 00:03:05.144 2012 (GMT-7)
System Uptime: 0 days 2:25:33.814
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {0, b, 8, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 000000000000000b, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032f8100
0000000000000000
CURRENT_IRQL: b
FAULTING_IP:
+0
00000000`00000000 ?? ???
PROCESS_NAME: javaw.exe
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
TRAP_FRAME: fffff8800a0eb7c0 -- (.trap 0xfffff8800a0eb7c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88011c850f0 rbx=0000000000000000 rcx=fffff88011c850f0
rdx=0000000080000208 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000000 rsp=fffff8800a0eb958 rbp=fffffa80088f8000
r8=0000000000000000 r9=0000000000000000 r10=0000000000800002
r11=0000000000000008 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
00000000`00000000 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800030c51e9 to fffff800030c5c40
FAILED_INSTRUCTION_ADDRESS:
+0
00000000`00000000 ?? ???
STACK_TEXT:
fffff880`0a0eb678 fffff800`030c51e9 : 00000000`0000000a 00000000`00000000 00000000`0000000b 00000000`00000008 : nt!KeBugCheckEx
fffff880`0a0eb680 fffff800`030c3e60 : fffffa80`08c8d000 fffffa80`0892a000 fffff880`0a0eb9f0 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0a0eb7c0 00000000`00000000 : fffffa80`0803e000 00000000`00000000 00000000`00000000 fffff880`11192987 : nt!KiPageFault+0x260
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiPageFault+260
fffff800`030c3e60 440f20c0 mov rax,cr8
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiPageFault+260
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0xD1_CODE_AV_NULL_IP_nt!KiPageFault+260
BUCKET_ID: X64_0xD1_CODE_AV_NULL_IP_nt!KiPageFault+260
Followup: MachineOwner
---------
-
Loading Dump File [E:\BSODDmpFiles\Reminisce\Windows_NT6_BSOD_jcgriff2\020912-15132-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03057000 PsLoadedModuleList = 0xfffff800`0329c670
Debug session time: Thu Feb 9 19:24:23.635 2012 (GMT-7)
System Uptime: 0 days 0:00:14.868
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff800030da8a1, 0, 1}
Probably caused by : hardware ( nt!ExAcquireResourceSharedLite+41 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800030da8a1, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000001, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExAcquireResourceSharedLite+41
fffff800`030da8a1 2588010000 and eax,188h
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000001
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003306100
0000000000000001
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88002a641a0 -- (.trap 0xfffff88002a641a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80092c1b60 rbx=0000000000000000 rcx=fffffa8009274f90
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030da8a1 rsp=fffff88002a64330 rbp=0000000000000001
r8=fffff88002a644d0 r9=fffffa80067eda50 r10=002d006200630038
r11=fffff88002a644f0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!ExAcquireResourceSharedLite+0x41:
fffff800`030da8a1 2588010000 and eax,188h
Resetting default scope
LOCK_ADDRESS: fffff800032d2b80 -- (!locks fffff800032d2b80)
Resource @ nt!PiEngineLock (0xfffff800032d2b80) Available
WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.
WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.
1 total locks
PNP_TRIAGE:
Lock address : 0xfffff800032d2b80
Thread Count : 0
Thread address: 0x0000000000000000
Thread wait : 0x0
MISALIGNED_IP:
nt!ExAcquireResourceSharedLite+41
fffff800`030da8a1 2588010000 and eax,188h
LAST_CONTROL_TRANSFER: from fffff8000311f588 to fffff800030d3c40
STACK_TEXT:
fffff880`02a63918 fffff800`0311f588 : 00000000`0000001e ffffffff`c0000005 fffff800`030da8a1 00000000`00000000 : nt!KeBugCheckEx
fffff880`02a63920 fffff800`030d32c2 : fffff880`02a640f8 fffffa80`09274f90 fffff880`02a641a0 fffff880`02a64400 : nt! ?? ::FNODOBFM::`string'+0x4977d
fffff880`02a63fc0 fffff800`030d1e3a : 00000000`00000000 00000000`00000001 fffff880`02a64200 fffffa80`09274f90 : nt!KiExceptionDispatch+0xc2
fffff880`02a641a0 fffff800`030da8a1 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`02a64490 : nt!KiPageFault+0x23a
fffff880`02a64330 fffff800`033cdc2a : fffff8a0`00035dc0 fffff8a0`01220060 00000000`00000001 fffffa80`067eda50 : nt!ExAcquireResourceSharedLite+0x41
fffff880`02a643a0 fffff800`033ce396 : fffff880`02a64500 fffffa80`092c1b60 fffff8a0`01220060 00000000`000000ba : nt!SeQueryInformationToken+0x3a
fffff880`02a64430 fffff800`033cfa56 : ffffffff`800003f4 fffffa80`09361b10 fffff880`02a64590 fffffa80`067eda50 : nt!ObpLookupObjectName+0xe6
fffff880`02a64520 fffff800`033a32bc : 00000000`00000003 00000000`00000000 00000000`00000000 00000000`00000200 : nt!ObOpenObjectByName+0x306
fffff880`02a645f0 fffff800`033ae392 : fffff880`02a649d8 00000000`00020019 fffff880`02a64940 fffff880`00000000 : nt!CmOpenKey+0x28a
fffff880`02a64740 fffff800`030d2ed3 : fffffa80`00000000 fffff8a0`0148ba90 00000000`00000200 fffff880`02a649c4 : nt!NtOpenKey+0x12
fffff880`02a64780 fffff800`030cf470 : fffff800`03342e58 00000000`8000001a 00000000`00000200 00000000`00000002 : nt!KiSystemServiceCopyEnd+0x13
fffff880`02a64918 fffff800`03342e58 : 00000000`8000001a 00000000`00000200 00000000`00000002 fffff8a0`0148ba90 : nt!KiServiceLinkage
fffff880`02a64920 fffff800`0333fa15 : 00000000`000000ba fffff8a0`0148ba90 00000000`00000000 fffff8a0`0149b1bc : nt!IopOpenRegistryKeyEx+0x38
fffff880`02a64980 fffff800`033402a1 : 00000000`00000002 00000000`00000000 fffff880`00000000 00000000`00000001 : nt!IopGetDeviceInterfaces+0x289
fffff880`02a64af0 fffff800`0333f56d : 00000000`00000002 00000000`00000000 00000000`00000000 fffff8a0`0148b0a0 : nt!PiGetInterfaceDeviceList+0x41
fffff880`02a64b50 fffff800`033986dc : fffff8a0`0148b0a0 fffff800`0000091a fffff880`02a64c01 fffff800`0359eda0 : nt!PiControlGetInterfaceDeviceList+0x111
fffff880`02a64bd0 fffff800`030d2ed3 : fffffa80`092c1b60 00000000`0151f240 fffff880`02a64ca0 00000000`0151f2d4 : nt!NtPlugPlayControl+0x100
fffff880`02a64c20 00000000`7739236a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0151f208 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7739236a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExAcquireResourceSharedLite+41
fffff800`030da8a1 2588010000 and eax,188h
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!ExAcquireResourceSharedLite+41
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: hardware
FAILURE_BUCKET_ID: X64_IP_MISALIGNED
BUCKET_ID: X64_IP_MISALIGNED
Followup: MachineOwner
---------
-
Loading Dump File [E:\BSODDmpFiles\Reminisce\Windows_NT6_BSOD_jcgriff2\020912-18252-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03062000 PsLoadedModuleList = 0xfffff800`032a7670
Debug session time: Thu Feb 9 14:20:53.159 2012 (GMT-7)
System Uptime: 0 days 0:01:27.392
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 101, {21, 0, fffff880009b2180, 4}
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CLOCK_WATCHDOG_TIMEOUT (101)
An expected clock interrupt was not received on a secondary processor in an
MP system within the allocated interval. This indicates that the specified
processor is hung and not processing interrupts.
Arguments:
Arg1: 0000000000000021, Clock interrupt time out interval in nominal clock ticks.
Arg2: 0000000000000000, 0.
Arg3: fffff880009b2180, The PRCB address of the hung processor.
Arg4: 0000000000000004, 0.
Debugging Details:
------------------
BUGCHECK_STR: CLOCK_WATCHDOG_TIMEOUT_6_PROC
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: d
STACK_TEXT:
fffff880`03353528 fffff800`031368c9 : 00000000`00000101 00000000`00000021 00000000`00000000 fffff880`009b2180 : nt!KeBugCheckEx
fffff880`03353530 fffff800`030e9497 : 00000000`00000000 fffff800`00000004 00000000`00002711 fffffa80`069c3670 : nt! ?? ::FNODOBFM::`string'+0x4e2e
fffff880`033535c0 fffff800`03023895 : fffff800`03049460 fffff880`03353770 fffff800`03049460 fffffa80`00000000 : nt!KeUpdateSystemTime+0x377
fffff880`033536c0 fffff800`030db173 : 00000000`fea37ba3 fffff800`03254e80 00000000`00000103 fffffa80`08d72060 : hal!HalpHpetClockInterrupt+0x8d
fffff880`033536f0 fffff800`030e4792 : fffff800`03254e80 fffffa80`00000001 00000000`00000000 fffff880`03353978 : nt!KiInterruptDispatchNoLock+0x163
fffff880`03353880 fffff800`031237ac : fffff880`03353c58 00000000`00000000 00000000`00000000 fffff800`03121d9d : nt!KeFlushMultipleRangeTb+0x252
fffff880`03353950 fffff800`031205e1 : fffffa80`0680b040 00000000`00000000 fffff880`03353c58 00000000`00000000 : nt!MmSetAddressRangeModified+0x2b0
fffff880`03353a50 fffff800`03123f76 : fffffa80`08115908 00000000`00000001 fffffa80`00000001 fffffa80`00001000 : nt!CcFlushCache+0x561
fffff880`03353b50 fffff800`03124938 : fffffa80`00000000 fffff880`03353c58 fffffa80`09371ea0 00000000`000007ff : nt!CcWriteBehind+0x1c6
fffff880`03353c00 fffff800`030e9001 : fffffa80`067ef190 fffff800`033d5901 fffff800`032e08c0 fffffa80`00000002 : nt!CcWorkerThread+0x1c8
fffff880`03353cb0 fffff800`03379fee : 00000000`00000000 fffffa80`0680b040 00000000`00000080 fffffa80`0670b5f0 : nt!ExpWorkerThread+0x111
fffff880`03353d40 fffff800`030d05e6 : fffff880`03288180 fffffa80`0680b040 fffff880`03293040 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03353d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
SYMBOL_NAME: ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
FAILURE_BUCKET_ID: X64_CLOCK_WATCHDOG_TIMEOUT_6_PROC_ANALYSIS_INCONCLUSIVE
BUCKET_ID: X64_CLOCK_WATCHDOG_TIMEOUT_6_PROC_ANALYSIS_INCONCLUSIVE
Followup: MachineOwner
---------
-
Loading Dump File [E:\BSODDmpFiles\Reminisce\Windows_NT6_BSOD_jcgriff2\020912-17721-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03060000 PsLoadedModuleList = 0xfffff800`032a5670
Debug session time: Thu Feb 9 10:52:23.049 2012 (GMT-7)
System Uptime: 0 days 0:00:32.922
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff88007fae758, fffff88007fadfb0, fffff8800129808f}
Probably caused by : Ntfs.sys ( Ntfs!NtfsOpenExistingPrefixFcb+1df )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88007fae758
Arg3: fffff88007fadfb0
Arg4: fffff8800129808f
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88007fae758 -- (.exr 0xfffff88007fae758)
ExceptionAddress: fffff8800129808f (Ntfs!NtfsOpenExistingPrefixFcb+0x00000000000001df)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 00000000000000f8
Attempt to read from address 00000000000000f8
CONTEXT: fffff88007fadfb0 -- (.cxr 0xfffff88007fadfb0)
rax=0000000000000002 rbx=fffff8a0075cda08 rcx=fffffa8009184710
rdx=0000000000000000 rsi=0000000000000000 rdi=fffff88007c0d3b0
rip=fffff8800129808f rsp=fffff88007fae990 rbp=0000000000000000
r8=fffff8a0075cda08 r9=0000000000000034 r10=fffffa8009184710
r11=0000000000000000 r12=0000000000000080 r13=fffff88007faeca0
r14=fffffa8009184710 r15=0000000000000034
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
Ntfs!NtfsOpenExistingPrefixFcb+0x1df:
fffff880`0129808f 488b9424f8000000 mov rdx,qword ptr [rsp+0F8h] ss:0018:fffff880`07faea88=fffffa8009b6c6a0
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 00000000000000f8
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000330f100
00000000000000f8
FOLLOWUP_IP:
Ntfs!NtfsOpenExistingPrefixFcb+1df
fffff880`0129808f 488b9424f8000000 mov rdx,qword ptr [rsp+0F8h]
FAULTING_IP:
Ntfs!NtfsOpenExistingPrefixFcb+1df
fffff880`0129808f 488b9424f8000000 mov rdx,qword ptr [rsp+0F8h]
BUGCHECK_STR: 0x24
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from fffff880012a8166 to fffff8800129808f
STACK_TEXT:
fffff880`07fae990 fffff880`012a8166 : fffffa80`09184710 fffffa80`09b6c6a0 fffff8a0`075cda08 00000000`00000701 : Ntfs!NtfsOpenExistingPrefixFcb+0x1df
fffff880`07faea80 fffff880`012a5911 : fffffa80`09184710 fffffa80`09b6c6a0 fffff880`07faec50 fffff880`07faeca0 : Ntfs!NtfsFindStartingNode+0x5e6
fffff880`07faeb50 fffff880`0120ea3d : fffffa80`09184710 fffffa80`09b6c6a0 fffff880`07c0d3b0 fffffa80`08bf9300 : Ntfs!NtfsCommonCreate+0x3e1
fffff880`07faed30 fffff800`030d4757 : fffff880`07c0d320 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`07faed60 fffff800`030d4711 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27
fffff880`07c0d1f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsOpenExistingPrefixFcb+1df
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
STACK_COMMAND: .cxr 0xfffff88007fadfb0 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsOpenExistingPrefixFcb+1df
BUCKET_ID: X64_0x24_Ntfs!NtfsOpenExistingPrefixFcb+1df
Followup: MachineOwner
---------