BSOD win32k.sys debug references csrss.exe process

Wackin04 · 07 Dec 2012

Hi All,

I have a brand new build that worked fine, stress testing and all, until the IT company for the business I built it for got it attached to the network and installed a bunch of printers, etc. (the computer is at a printing company). I went in shortly after they left and received a blue screen within a few minutes just by opening Firefox and trying to browse to a website. It blue screens even in Safe Mode. It always does it when I'm doing something with a program (i.e. trying to just open Calculator, or getting Firefox open and then BSOD after a random amount of time surfing the web, but within a few minutes). I was able to navigate around in Windows Explorer for a while and move the dump files to a flash drive so I could bring them home. I have 8 dump files but I'll only post the debug from the first and last for you.

System specs (everything stock speed/settings, except all Windows OS stuff is updated, no additional software or tweaked settings except what the IT company did):

Core i7 3770k
Hyper212 Plus CPU Cooler
Kingston HyperX 3k 120GB SSD
XFX Double D Black Edition Radeon 7770 GHz Edition
ASRock Z77 Extreme 4 Mobo
Rosewill HIVE Series 650W PSU
G.Skill Ripjaws X Series 16GB (2x8GB) DDR3 2133
Samsung SS-224BB SATA Optical Drive
Windows 7 Pro SP1 (Fully Updated)

First MiniDump Data:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [H:\Minidump\120712-12916-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff800`02e5c000 PsLoadedModuleList = 0xfffff800`030a0670
Debug session time: Fri Dec 7 12:20:51.595 2012 (UTC - 6:00)
System Uptime: 0 days 0:29:09.492
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff900c1cb5000, 1, fffff960000c23b4, 0}

Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!sfac_GetLongGlyphIDs+84 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c1cb5000, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff960000c23b4, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------

Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310a100
GetUlongFromAddress: unable to read from fffff8000310a1c0
fffff900c1cb5000

FAULTING_IP:
win32k!sfac_GetLongGlyphIDs+84
fffff960`000c23b4 44891e mov dword ptr [rsi],r11d

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffff880086fbb40 -- (.trap 0xfffff880086fbb40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=00000000015c0908
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960000c23b4 rsp=fffff880086fbcd0 rbp=0000000000001566
r8=00000000015c099c r9=00000000015c0916 r10=0000000000001566
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
win32k!sfac_GetLongGlyphIDs+0x84:
fffff960`000c23b4 44891e mov dword ptr [rsi],r11d ds:00000000`00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002e82eec to fffff80002edafc0

STACK_TEXT:
fffff880`086fb9d8 fffff800`02e82eec : 00000000`00000050 fffff900`c1cb5000 00000000`00000001 fffff880`086fbb40 : nt!KeBugCheckEx
fffff880`086fb9e0 fffff800`02ed90ee : 00000000`00000001 fffff900`c1cb5000 00000000`00000000 00000000`00001ade : nt! ?? ::FNODOBFM::`string'+0x4514f
fffff880`086fbb40 fffff960`000c23b4 : 00000000`00001ade fffff900`c1cb5000 00000000`0000ffff fffff960`000c1d28 : nt!KiPageFault+0x16e
fffff880`086fbcd0 fffff960`000c22fb : fffff960`000c2754 00000000`00000f02 00000000`0000037d 00000000`00002142 : win32k!sfac_GetLongGlyphIDs+0x84
fffff880`086fbd20 fffff960`000c222a : 00000000`015c07c0 00000000`00002142 00000000`00001268 00000000`00001268 : win32k!sfac_GetWinNTGlyphIDs+0xbb
fffff880`086fbd90 fffff960`000c2102 : 00000000`00000000 00000000`00000000 00000000`015c8fa6 00000000`00001288 : win32k!fs_WinNTGetGlyphIDs+0x6a
fffff880`086fbde0 fffff960`000c1e60 : 00000000`015c8fa6 fffff880`086fbf20 00000000`00003043 00000000`015c0f02 : win32k!cjComputeGLYPHSET_MSFT_UNICODE+0x252
fffff880`086fbea0 fffff960`000b9183 : fffff900`c0744cc0 00000000`00000001 00000000`00000001 00000000`00000000 : win32k!bLoadGlyphSet+0xf8
fffff880`086fbed0 fffff960`000b9322 : fffff900`c0744cc0 fffff900`00000001 fffff900`c0744cc0 fffff960`0022b5f4 : win32k!bReloadGlyphSet+0x24b
fffff880`086fc590 fffff960`000b927a : 00000000`00000000 fffff900`c0744cc0 fffff900`00000001 fffff900`c1c9a124 : win32k!ttfdQueryFontTree+0x66
fffff880`086fc5e0 fffff960`00105fa7 : fffff960`000b9220 fffff900`c0744030 00000000`00000001 00000000`00000000 : win32k!ttfdSemQueryFontTree+0x5a
fffff880`086fc620 fffff960`00105e53 : fffff880`086fc730 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!PDEVOBJ::QueryFontTree+0x63
fffff880`086fc6a0 fffff960`000c00b2 : fffff900`c008a010 00000000`00000000 00000000`00000002 00000000`00000000 : win32k!PFEOBJ:

fdg+0xa3
fffff880`086fc700 fffff960`0011a5ec : fffff900`c1c9a010 fffff880`086fc990 fffff880`086fc890 fffff880`086fc9e0 : win32k!RFONTOBJ::bRealizeFont+0x46
fffff880`086fc820 fffff960`000eb095 : 00000000`10018000 fffff900`00000000 0000072a`00000000 0031892c`00000002 : win32k!RFONTOBJ::bInit+0x548
fffff880`086fc940 fffff960`000eb02b : 00000000`00000000 fffff880`086fcb60 00000000`322f534f 003189a8`00000000 : win32k!ulGetFontData2+0x31
fffff880`086fc9b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!ulGetFontData+0x7f

STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!sfac_GetLongGlyphIDs+84
fffff960`000c23b4 44891e mov dword ptr [rsi],r11d

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: win32k!sfac_GetLongGlyphIDs+84

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5080499a

FAILURE_BUCKET_ID: X64_0x50_win32k!sfac_GetLongGlyphIDs+84

BUCKET_ID: X64_0x50_win32k!sfac_GetLongGlyphIDs+84

Followup: MachineOwner
---------

Last Minidump

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [H:\Minidump\120712-12230-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff800`02e15000 PsLoadedModuleList = 0xfffff800`03059670
Debug session time: Fri Dec 7 12:58:14.497 2012 (UTC - 6:00)
System Uptime: 0 days 0:00:43.049
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff900c210a000, 1, fffff960000523b4, 0}

Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!sfac_GetLongGlyphIDs+84 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c210a000, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff960000523b4, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------

Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c3100
GetUlongFromAddress: unable to read from fffff800030c31c0
fffff900c210a000

FAULTING_IP:
win32k!sfac_GetLongGlyphIDs+84
fffff960`000523b4 44891e mov dword ptr [rsi],r11d

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffff8800aa83c20 -- (.trap 0xfffff8800aa83c20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000bf102a
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960000523b4 rsp=fffff8800aa83db0 rbp=0000000000005b11
r8=0000000000bf10b6 r9=0000000000bf1046 r10=0000000000005b11
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy
win32k!sfac_GetLongGlyphIDs+0x84:
fffff960`000523b4 44891e mov dword ptr [rsi],r11d ds:00000000`00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002e3beec to fffff80002e93fc0

STACK_TEXT:
fffff880`0aa83ab8 fffff800`02e3beec : 00000000`00000050 fffff900`c210a000 00000000`00000001 fffff880`0aa83c20 : nt!KeBugCheckEx
fffff880`0aa83ac0 fffff800`02e920ee : 00000000`00000001 fffff900`c210a000 00000000`00000000 00000000`00000c38 : nt! ?? ::FNODOBFM::`string'+0x4514f
fffff880`0aa83c20 fffff960`000523b4 : 00000000`00000c38 fffff900`c210a000 00000000`0000ffff fffff960`00051d28 : nt!KiPageFault+0x16e
fffff880`0aa83db0 fffff960`000522fb : fffff960`00052754 00000000`00001521 00000000`000002c5 00000000`00005228 : win32k!sfac_GetLongGlyphIDs+0x84
fffff880`0aa83e00 fffff960`0005222a : 00000000`00bf079c 00000000`00005228 00000000`00002abc 00000000`00002abc : win32k!sfac_GetWinNTGlyphIDs+0xbb
fffff880`0aa83e70 fffff960`00052102 : 00000000`00000000 00000000`00000000 00000000`00bf4026 00000000`00002adc : win32k!fs_WinNTGetGlyphIDs+0x6a
fffff880`0aa83ec0 fffff960`00051e60 : 00000000`00bf4026 fffff880`0aa84000 00000000`00006748 00000000`00bf1521 : win32k!cjComputeGLYPHSET_MSFT_UNICODE+0x252
fffff880`0aa83f80 fffff960`00049183 : fffff900`c07284b0 00000000`00000001 00000000`00000001 00000000`00000000 : win32k!bLoadGlyphSet+0xf8
fffff880`0aa83fb0 fffff960`00049322 : fffff900`c07284b0 fffff900`00000001 fffff900`c07284b0 fffff960`001bb5f4 : win32k!bReloadGlyphSet+0x24b
fffff880`0aa84670 fffff960`0004927a : 00000000`00000000 fffff900`c07284b0 fffff900`00000001 fffff900`c20924b4 : win32k!ttfdQueryFontTree+0x66
fffff880`0aa846c0 fffff960`00095fa7 : fffff960`00049220 fffff900`c07287f0 00000000`00000001 00000000`00000000 : win32k!ttfdSemQueryFontTree+0x5a
fffff880`0aa84700 fffff960`00095e53 : fffff880`0aa84810 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!PDEVOBJ::QueryFontTree+0x63
fffff880`0aa84780 fffff960`000500b2 : fffff900`c008a010 00000000`00000000 00000000`00000002 00000000`00000000 : win32k!PFEOBJ:

fdg+0xa3
fffff880`0aa847e0 fffff960`000aa5ec : fffff900`c20923a0 fffff880`0aa84a70 fffff880`0aa84970 fffff880`0aa84a40 : win32k!RFONTOBJ::bRealizeFont+0x46
fffff880`0aa84900 fffff960`0004c05c : 00000000`10018000 fffff900`00000000 00000000`00000000 00000000`00000002 : win32k!RFONTOBJ::bInit+0x548
fffff880`0aa84a20 fffff960`00056f2f : 00000000`00000000 fffff960`00056f10 00000000`00000000 00000000`00000000 : win32k!GreGetTextMetricsW+0x4c
fffff880`0aa84a60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtGdiGetTextMetricsW+0x1f

STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!sfac_GetLongGlyphIDs+84
fffff960`000523b4 44891e mov dword ptr [rsi],r11d

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: win32k!sfac_GetLongGlyphIDs+84

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5080499a

FAILURE_BUCKET_ID: X64_0x50_win32k!sfac_GetLongGlyphIDs+84

BUCKET_ID: X64_0x50_win32k!sfac_GetLongGlyphIDs+84

Followup: MachineOwner
---------

I've attached a .zip of all 8 MiniDumps. Thanks for the help!

Arc · 08 Dec 2012

Welcome aboard.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff900c1cb5000, 1, fffff960000c23b4, 0}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!sfac_GetLongGlyphIDs+84 )

Followup: MachineOwner
---------

Your crash dumps are not showing any finite probable cause. In such a situation, it is better to enable Driver Verifier to monitor the drivers.

Driver Verifier - Enable and Disable

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Let us know the results, with the subsequent crash dumps, if any, following the Blue Screen of Death (BSOD) Posting Instructions .