[list=1][*]
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\Kingston\BSODDmpFiles\Sunner\031512-23181-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e1e000 PsLoadedModuleList = 0xfffff800`03063670
Debug session time: Wed Mar 14 19:50:29.387 2012 (UTC - 6:00)
System Uptime: 0 days 3:15:20.324
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C5, {8, 2, 1, fffff80002fc9617}
Unable to load image \SystemRoot\system32\DRIVERS\iaStor.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for iaStor.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStor.sys
Probably caused by : iaStor.sys ( iaStor+25fd8 )
Followup: MachineOwner
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff80002fc9617, address which referenced memory
Debugging Details:
------------------
BUGCHECK_STR: 0xC5_2
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExAllocatePoolWithTag+537
fffff800`02fc9617 48895808 mov qword ptr [rax+8],rbx
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: rundll32.exe
TRAP_FRAME: fffff880079ba080 -- (.trap 0xfffff880079ba080)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8009a8cde0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002fc9617 rsp=fffff880079ba210 rbp=0000000000001000
r8=0000000000000000 r9=fffff800030254e0 r10=fffff80003025348
r11=0000fffffffff000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!ExAllocatePoolWithTag+0x537:
fffff800`02fc9617 48895808 mov qword ptr [rax+8],rbx ds:0008:00000000`00000008=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002e9a1e9 to fffff80002e9ac40
STACK_TEXT:
fffff880`079b9f38 fffff800`02e9a1e9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`079b9f40 fffff800`02e98e60 : 00000000`0000b000 00000001`4005007f fffff880`0328c8e4 fffff800`030254e0 : nt!KiBugCheckDispatch+0x69
fffff880`079ba080 fffff800`02fc9617 : 00000000`0000bb20 00000000`00000020 fffff800`0304af40 00000000`00010000 : nt!KiPageFault+0x260
fffff880`079ba210 fffff880`01280fd8 : fffffa80`00000000 fffffa80`063b1a40 fffffa80`05d7cec0 00000000`00000000 : nt!ExAllocatePoolWithTag+0x537
fffff880`079ba300 fffffa80`00000000 : fffffa80`063b1a40 fffffa80`05d7cec0 00000000`00000000 fffffa80`00000001 : iaStor+0x25fd8
fffff880`079ba308 fffffa80`063b1a40 : fffffa80`05d7cec0 00000000`00000000 fffffa80`00000001 fffffa80`0a467e10 : 0xfffffa80`00000000
fffff880`079ba310 fffffa80`05d7cec0 : 00000000`00000000 fffffa80`00000001 fffffa80`0a467e10 fffffa80`00000000 : 0xfffffa80`063b1a40
fffff880`079ba318 00000000`00000000 : fffffa80`00000001 fffffa80`0a467e10 fffffa80`00000000 fffffa80`00000020 : 0xfffffa80`05d7cec0
STACK_COMMAND: kb
FOLLOWUP_IP:
iaStor+25fd8
fffff880`01280fd8 ?? ???
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: iaStor+25fd8
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: iaStor
IMAGE_NAME: iaStor.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ac65b7a
FAILURE_BUCKET_ID: X64_0xC5_2_iaStor+25fd8
BUCKET_ID: X64_0xC5_2_iaStor+25fd8
Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\Sunner\031112-22682-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e0e000 PsLoadedModuleList = 0xfffff800`03053670
Debug session time: Sat Mar 10 19:57:22.333 2012 (UTC - 6:00)
System Uptime: 6 days 16:56:47.967
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
..............................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C5, {8, 2, 1, fffff80002fb9617}
Probably caused by : NETIO.SYS ( NETIO!WfpAllocFromNPagedLookasideList+47 )
Followup: MachineOwner
---------
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff80002fb9617, address which referenced memory
Debugging Details:
------------------
BUGCHECK_STR: 0xC5_2
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExAllocatePoolWithTag+537
fffff800`02fb9617 48895808 mov qword ptr [rax+8],rbx
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
TRAP_FRAME: fffff880032ae7e0 -- (.trap 0xfffff880032ae7e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80093caa20
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002fb9617 rsp=fffff880032ae970 rbp=0000000000001000
r8=0000000000000000 r9=fffff800030154e0 r10=fffff80003015348
r11=fffff880032aed30 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!ExAllocatePoolWithTag+0x537:
fffff800`02fb9617 48895808 mov qword ptr [rax+8],rbx ds:e928:00000000`00000008=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002e8a1e9 to fffff80002e8ac40
STACK_TEXT:
fffff880`032ae698 fffff800`02e8a1e9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`032ae6a0 fffff800`02e88e60 : fffff880`032ae818 fffff880`032ae810 00020000`00020001 fffff800`030154e0 : nt!KiBugCheckDispatch+0x69
fffff880`032ae7e0 fffff800`02fb9617 : 00000000`00000001 fffff880`032aed00 00000000`00000001 fffff880`0100afa8 : nt!KiPageFault+0x260
fffff880`032ae970 fffff880`0100aa77 : fffffa80`00000000 fffff880`032aead0 fffff880`032aebd8 00000000`00000000 : nt!ExAllocatePoolWithTag+0x537
fffff880`032aea60 fffff880`01005646 : 00000000`00000000 fffffa80`0584fee0 fffff880`032aebd8 fffffa80`0ae6ddd0 : NETIO!WfpAllocFromNPagedLookasideList+0x47
fffff880`032aea90 fffff880`0100b11d : fffffa80`00000000 fffffa80`0b2070e0 fffffa80`0a471420 fffffa80`094e1a96 : NETIO!InsertFilterToMatchBuf+0xe6
fffff880`032aead0 fffff880`0100a94a : 5a22fa8e`00000001 00000000`00000000 00000000`00000000 fffffa80`0584fee0 : NETIO!IndexListEnum+0xe3
fffff880`032aeb40 fffff880`0100acdb : fffff880`032aefe8 fffff880`032aee50 00000000`00020003 00000000`00000001 : NETIO!FeEnumLayer+0xaa
fffff880`032aeba0 fffff880`0100b71d : fffffa80`0914e8c0 fffffa80`057cb7b0 fffffa80`0a458080 00000000`0000002c : NETIO!KfdGetLayerActionFromEnumTemplate+0x8b
fffff880`032aec50 fffff880`018a6e77 : 00000000`00000000 00000000`00000015 fffff880`032aefe8 00000010`00000036 : NETIO!KfdCheckAndCacheAcceptBypass+0x2d
fffff880`032aec90 fffff880`018a45ed : 00000000`00000000 00000000`00000000 fffffa80`05c119e0 00000000`00000000 : tcpip!CheckAcceptBypass+0x377
fffff880`032aeef0 fffff880`018a36fc : 00000000`00000000 fffffa80`0000002c 00000000`00000000 fffffa80`09426c80 : tcpip!WfpAleAuthorizeReceive+0x17d
fffff880`032af1d0 fffff880`018d99de : 00000000`00000000 fffff880`032af6b8 fffff880`032af640 00000000`00000011 : tcpip!WfpAleConnectAcceptIndicate+0x29c
fffff880`032af2c0 fffff880`018da619 : 00000000`00000000 00000000`00000000 00000000`0000eb14 00000000`00000000 : tcpip!ProcessALEForTransportPacket+0x5fe
fffff880`032af530 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpProcessInTransportStackIndication+0x7c9
STACK_COMMAND: kb
FOLLOWUP_IP:
NETIO!WfpAllocFromNPagedLookasideList+47
fffff880`0100aa77 ebd5 jmp NETIO!WfpAllocFromNPagedLookasideList+0x1e (fffff880`0100aa4e)
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: NETIO!WfpAllocFromNPagedLookasideList+47
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: NETIO
IMAGE_NAME: NETIO.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce79381
FAILURE_BUCKET_ID: X64_0xC5_2_NETIO!WfpAllocFromNPagedLookasideList+47
BUCKET_ID: X64_0xC5_2_NETIO!WfpAllocFromNPagedLookasideList+47
Followup: MachineOwner
---------
[/list]