BAD_POOL_HEADER 0x19 apparently caused by win32k.sys and ntkrnlpa.exe

EmperorPear · 07 Sep 2013

Hello, guys. I'd gladly introduce myself but I can do that later, currently i'm being plagued by BSOD-s every time i start up my computer normally( Safe mode works fine but it too can crash, Clean boots are fails.). It doesn't take much time for it to go do a certain scrambled look for a few seconds and then quickly going to the loveable Blue screen of Death
It all started on 4. September 2013 and it won't simply piss off, for some time the bootup was extremely slow but it was handled. When in safe mode it usually won't crash, but when i do some shit with files it crashes.
What i currently did was:
Switch to fail-safe settings on BIOS
Scan C: with MSE (Found a few viruses)
Made a backup (Had a lot of Safe mode crashes)
Hopelessly try to fix this but to no avail
Also, be sure to check all the minidumps from 4th september and onwards. The sooner the better!

-Pear

Arc · 07 Sep 2013

Hi EmperorPear.

Your crash dumps are not showing any finite probable cause.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If memtest comes free from errors, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any. Post it following the Blue Screen of Death (BSOD) Posting Instructions.
_______________________________________________________
BSOD ANALYSIS:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, ff48c000, ff48c1e8, 4a3d0000}

Probably caused by : win32k.sys ( win32k!EngFreeMem+1f )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: ff48c000, The pool entry we were looking for within the page.
Arg3: ff48c1e8, The next pool entry.
Arg4: 4a3d0000, (reserved)

Debugging Details:
------------------


BUGCHECK_STR:  0x19_20

POOL_ADDRESS: GetPointerFromAddress: unable to read from 82f7484c
Unable to read MiSystemVaType memory at 82f53e20
 ff48c000 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 9cc1b5b3 to 82f2bc6b

STACK_TEXT:  
b66d8448 9cc1b5b3 ff48c008 00000000 fdf381a4 nt!ExFreePoolWithTag+0x1b1
b66d845c 9cbe1039 ff48c018 b66d8a0c 00000001 win32k!EngFreeMem+0x1f
b66d8470 9cbe952e fdf38178 01c804a6 b66d8990 win32k!bLoadGlyphSet+0xb6
b66d8a30 9cbe3ada fdf38178 00000001 2ab74ba0 win32k!bReloadGlyphSet+0x1fd
b66d8a74 9cbe6829 00000000 fdf38178 00000001 win32k!ttfdQueryFontTree+0x4e
b66d8a98 9cbe8fe6 00000000 fdf38450 00000001 win32k!ttfdSemQueryFontTree+0x33
b66d8ad8 9cbfd7a6 00000000 fdf38450 00000001 win32k!PDEVOBJ::QueryFontTree+0x36
b66d8b14 9cbfb08e b66d8cc4 b66d8bc8 9cc59335 win32k!PFEOBJ::pfdg+0x7a
b66d8bc4 9cc77583 b66d8cc4 b66d8c68 fdf0b6d0 win32k!RFONTOBJ::bRealizeFont+0x1c
b66d8c70 9cc777be fdf0b5b8 00000000 00000002 win32k!RFONTOBJ::bInit+0x2e3
b66d8c88 9cc130a7 b66d8cc4 00000000 00000002 win32k!RFONTOBJ::vInit+0x16
b66d8ca4 9cc13087 00000000 66637474 00000000 win32k!ulGetFontData2+0x17
b66d8cd0 9cc13144 09010409 66637474 00000000 win32k!ulGetFontData+0x48
b66d8d18 82e488c6 09010409 66637474 00000000 win32k!NtGdiGetFontData+0x2d
b66d8d18 776970f4 09010409 66637474 00000000 nt!KiSystemServicePostCall
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f0db50 00000000 00000000 00000000 00000000 0x776970f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!EngFreeMem+1f
9cc1b5b3 5e              pop     esi

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  win32k!EngFreeMem+1f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  51aeaad0

FAILURE_BUCKET_ID:  0x19_20_win32k!EngFreeMem+1f

BUCKET_ID:  0x19_20_win32k!EngFreeMem+1f

Followup: MachineOwner
---------

EmperorPear · 08 Sep 2013

Thanks for the help Arc, but the problem was fixed by a nice Clean Install of Windows 7.

Arc · 08 Sep 2013

Clean reinstall is always the easier option, when the issue is driver/ software related :)