*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C5, {4441, 2, 0, fffff800035f7dd3}
*** WARNING: Unable to verify timestamp for VBoxNetFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for VBoxNetFlt.sys
Probably caused by : VBoxNetFlt.sys ( VBoxNetFlt+307e )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000000000004441, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800035f7dd3, address which referenced memory
Debugging Details:
------------------
BUGCHECK_STR: 0xC5_2
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExFreePoolWithTag+43
fffff800`035f7dd3 418b45f0 mov eax,dword ptr [r13-10h]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: System
TAG_NOT_DEFINED_c000000f: FFFFF80000BA2FB0
TRAP_FRAME: fffff80000b9c610 -- (.trap 0xfffff80000b9c610)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000004451
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800035f7dd3 rsp=fffff80000b9c7a0 rbp=fffffa800f8f00b0
r8=0000000000000000 r9=0000000000000000 r10=fffffa800f8f0020
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!ExFreePoolWithTag+0x43:
fffff800`035f7dd3 418b45f0 mov eax,dword ptr [r13-10h] ds:ffffffff`fffffff0=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800034cb569 to fffff800034cbfc0
STACK_TEXT:
fffff800`00b9c4c8 fffff800`034cb569 : 00000000`0000000a 00000000`00004441 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9c4d0 fffff800`034ca1e0 : 00000000`00000103 fffffa80`0ef3c6e0 fffffa80`0ef06000 fffffa80`0e46b170 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c610 fffff800`035f7dd3 : fffffa80`0f8f00b0 fffffa80`0dfbe1a0 fffffa80`0e5fd8d0 fffff880`07588f4e : nt!KiPageFault+0x260
fffff800`00b9c7a0 fffff880`01454845 : 00000000`00000000 00000000`00000000 fffffa80`0f8f5670 00000000`00004451 : nt!ExFreePoolWithTag+0x43
fffff800`00b9c850 fffff880`0742707e : fffffa80`0f8f00b0 fffffa80`0e46d8f0 00000000`00000000 fffffa80`0dce01a0 : ndis!NdisFreeMemory+0x15
fffff800`00b9c880 fffffa80`0f8f00b0 : fffffa80`0e46d8f0 00000000`00000000 fffffa80`0dce01a0 00000000`00000000 : VBoxNetFlt+0x307e
fffff800`00b9c888 fffffa80`0e46d8f0 : 00000000`00000000 fffffa80`0dce01a0 00000000`00000000 fffff880`0150e64e : 0xfffffa80`0f8f00b0
fffff800`00b9c890 00000000`00000000 : fffffa80`0dce01a0 00000000`00000000 fffff880`0150e64e fffffa80`0f8f5600 : 0xfffffa80`0e46d8f0
STACK_COMMAND: kb
FOLLOWUP_IP:
VBoxNetFlt+307e
fffff880`0742707e ?? ???
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: VBoxNetFlt+307e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: VBoxNetFlt
IMAGE_NAME: VBoxNetFlt.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 508ac17d
FAILURE_BUCKET_ID: X64_0xC5_2_VBoxNetFlt+307e
BUCKET_ID: X64_0xC5_2_VBoxNetFlt+307e
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000000000004441, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800035f7dd3, address which referenced memory
Debugging Details:
------------------
BUGCHECK_STR: 0xC5_2
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExFreePoolWithTag+43
fffff800`035f7dd3 418b45f0 mov eax,dword ptr [r13-10h]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: System
TAG_NOT_DEFINED_c000000f: FFFFF80000BA2FB0
TRAP_FRAME: fffff80000b9c610 -- (.trap 0xfffff80000b9c610)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000004451
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800035f7dd3 rsp=fffff80000b9c7a0 rbp=fffffa800f8f00b0
r8=0000000000000000 r9=0000000000000000 r10=fffffa800f8f0020
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!ExFreePoolWithTag+0x43:
fffff800`035f7dd3 418b45f0 mov eax,dword ptr [r13-10h] ds:ffffffff`fffffff0=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800034cb569 to fffff800034cbfc0
STACK_TEXT:
fffff800`00b9c4c8 fffff800`034cb569 : 00000000`0000000a 00000000`00004441 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9c4d0 fffff800`034ca1e0 : 00000000`00000103 fffffa80`0ef3c6e0 fffffa80`0ef06000 fffffa80`0e46b170 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c610 fffff800`035f7dd3 : fffffa80`0f8f00b0 fffffa80`0dfbe1a0 fffffa80`0e5fd8d0 fffff880`07588f4e : nt!KiPageFault+0x260
fffff800`00b9c7a0 fffff880`01454845 : 00000000`00000000 00000000`00000000 fffffa80`0f8f5670 00000000`00004451 : nt!ExFreePoolWithTag+0x43
fffff800`00b9c850 fffff880`0742707e : fffffa80`0f8f00b0 fffffa80`0e46d8f0 00000000`00000000 fffffa80`0dce01a0 : ndis!NdisFreeMemory+0x15
fffff800`00b9c880 fffffa80`0f8f00b0 : fffffa80`0e46d8f0 00000000`00000000 fffffa80`0dce01a0 00000000`00000000 : VBoxNetFlt+0x307e
fffff800`00b9c888 fffffa80`0e46d8f0 : 00000000`00000000 fffffa80`0dce01a0 00000000`00000000 fffff880`0150e64e : 0xfffffa80`0f8f00b0
fffff800`00b9c890 00000000`00000000 : fffffa80`0dce01a0 00000000`00000000 fffff880`0150e64e fffffa80`0f8f5600 : 0xfffffa80`0e46d8f0
STACK_COMMAND: kb
FOLLOWUP_IP:
VBoxNetFlt+307e
fffff880`0742707e ?? ???
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: VBoxNetFlt+307e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: VBoxNetFlt
IMAGE_NAME: VBoxNetFlt.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 508ac17d
FAILURE_BUCKET_ID: X64_0xC5_2_VBoxNetFlt+307e
BUCKET_ID: X64_0xC5_2_VBoxNetFlt+307e
Followup: MachineOwner
---------
