Firefox and Wordpad cause BSoDs with win32.sys

shernren · 08 Nov 2009

Hi guys, about two or three days ago Firefox and Wordpad started causing my computer to BSoD. Whenever starting Firefox (whether 3.5.5 stable or 3.6 beta, both clean installs) the browser would run for a few seconds and even load pages successfully but then consistently cause a "bad pool header" BSoD. Same thing with Wordpad - it runs for a few seconds and then brings the system down. See attached minidumps.

I don't recall doing anything unusual or new to my computer to cause these things to start happening, for the first few days of using Windows 7 my Firefox ran without problems (although no idea whether Wordpad was ok or not). Most other programs run ok including games, MS Office, and Chrome. Using BlueScreenView on my minidump shows that halmacpi.dll, ntkrnlpa.exe and win32k.sys may be at fault but I'm stuck there.

I'm using a Windows 7 Professional custom installed over Vista Ultimate, both 32-bit, used Laplink software to transfer all my programs and settings. Hardware is a standard Inspiron 9300 other than having 2GB + 1GB of RAM (but have replicated the errors with either RAM stick taken out so it's probably not that).

Any advice would be appreciated. Thanks!

H2SO4 · 08 Nov 2009

Very interesting. The OS is crashing while attempting to work with a particular TrueType font object (a specific font), and I suspect that's the link betweeen Wordpad and FF - they're both simply using the same font and thereby indirectly triggering the crash.

What's not obvious is whether the font definition is itself damaged, or whether the memory being used to store that font is being overrun by a bug in another driver - you've got some relatively old ones on there:

start end module name
8983d000 89aaef00 LV302V32 Sun Jul 27 01:05:07 2008 (488B3D23)
89bdb000 89bf3c80 ewusbmdm Tue Jul 31 17:47:28 2007 (46AEE910)
8e207000 8e309000 VSTDPV3 Thu Oct 16 11:32:04 2008 (48F68B84)
8e309000 8e3be000 VSTCNXT3 Thu Oct 16 11:29:13 2008 (48F68AD9)
8e614000 8e894000 NETw2v32 Wed Mar 07 13:08:44 2007 (45EE1EAC)
8e89f000 8e8e1a00 STAC97 Fri Mar 11 09:56:01 2005 (4230D081)
8e95e000 8e9a3000 VSTICH3 Wed Jun 21 03:40:16 2006 (44983300)
8e9a3000 8e9d0000 Apfiltr Fri Mar 14 23:23:10 2008 (47DA6E2E)
8ec00000 8ec11000 bcm4sbxp Tue Nov 21 23:25:43 2006 (4562F047)
8f551000 8f559900 LVUSBSta Sun Jul 27 00:59:36 2008 (488B3BD8)

You really ought to update as many of those drivers as possible, and remove/uninstall whichever ones you don't really need. Even if it doesn't by itself fix this problem, and it might, a driver update effort will prevent many future headaches.

Suggestions:

1) Do a bit of experimentation in Wordpad to see whether you're able to trigger the crash by using a particular favorite font. Unfortunately, I can't seem to tell which font we're talking about from the crash dumps.

2) On an elevated (run as admin) CMD prompt, issue this command:

VERIFIER /FLAGS 1 /ALL

Then reboot and upload any subsequent minidumps. After that command, the OS will more closely scrutinise driver memory-handling activity, which may pick up another driver mangling the memory which backs the font. (When this is all done, remember to run VERIFIER /RESET to get back to default settings.)

shernren · 08 Nov 2009

Wow, that's one of the more bizarre reasons for a system crash I've seen.

I've tracked the offending font down: it's "Mathematica5", as evidenced by it causing both MS Word and Mathematica 7 (which I just installed before the weekend started) to crash. It's a bit strange for that to be the bad font because I don't see any obvious interactions between it and Firefox / Wordpad.

Now I'll see if I can shunt over into safe mode and replace that font. In the mean time, more minidumps for you to look at (with all flags set on the verifier) to see if there's any more helpful details.

Attachment: Attachment 35639

shernren · 08 Nov 2009

So I pulled the mathematica5 font off the web, installed it, and one crash later (because installing it to the hard drive wouldn't change the broken version in RAM, right?) everything's working fine.

Much thanks! :) How do I mark this "fixed"?

H2SO4 · 08 Nov 2009

shernren said:

Wow, that's one of the more bizarre reasons for a system crash I've seen.

Yeah, it made me chuckle, although it's not quite as uncommon as one might think.

shernren said:

I've tracked the offending font down: it's "Mathematica5", as evidenced by it causing both MS Word and Mathematica 7 (which I just installed before the weekend started) to crash. It's a bit strange for that to be the bad font because I don't see any obvious interactions between it and Firefox / Wordpad.

It's good that you remember which font you'd installed recently :)

Fonts are ultimately just specific patterns in memory. The "rendering" done by the Win32 subsystem in order to draw a particular font on a device context corresponding to the screen or a printer is done down in kernel-mode by the unimaginatively named win32k.sys (Win32 subsystem "kernel" driver).

Wild memory reading/writing due to corrupted data causes an app-specific crash when it happens up in user-mode, but it's absolutely lethal to the entire OS when it occurs in kernel-mode (it usually leads to a BSOD). Hence, a bad font definition (a "bug" in the font) can easily take out the entire OS. Weird, huh? Most people would assume that the choice of what's in their freeware font packs hardly matters at all.

Wordpad and FF may not even be "using" the bad font in the sense that they're actively writing crud on screen in that font. It may be enough just to merely enumerate the list of fonts available, perhaps for that pretty drop-down list which shows you all the fonts on the system.

shernren said:

Now I'll see if I can shunt over into safe mode and replace that font. In the mean time, more minidumps for you to look at (with all flags set on the verifier) to see if there's any more helpful details.

With verifier enabled, the crash stack looks exactly the same before, except now the presence of the additional verifier checks virtually proves that the font itself is mangled:

ChildEBP RetAddr
bb5a4a8c 82b46f90 nt!ExFreePoolWithTag+0x1b1 // BOOM! Crash!
bb5a4aa0 9655c189 nt!VerifierExFreePoolWithTag+0x30 // additional checking due to (driver) verifier
bb5a4ab4 9663e832 win32k!EngFreeMem+0x1f // free memory associated with font
bb5a4acc 9663e7d3 win32k!ttfdCloseFontContext+0x51 // done with the font object
bb5a4adc 9663e873 win32k!ttfdDestroyFont+0x16
bb5a4ae8 96635501 win32k!ttfdSemDestroyFont+0x18
bb5a4b20 96635554 win32k!PDEVOBJ:

estroyFont+0x67 // website interprets method syntax as a smilie. Ironic.
bb5a4b50 965a0d1e win32k!RFONTOBJ::vDeleteRFONT+0x33
bb5a4b94 965a2d15 win32k!RFONTOBJ::bMakeInactiveHelper+0x25a
bb5a4bf0 965cba77 win32k!RFONTOBJ::vMakeInactive+0x72
bb5a4c70 965cbd74 win32k!RFONTOBJ::bInit+0xe3
bb5a4c88 9656b38f win32k!RFONTOBJ::vInit+0x16
bb5a4ca4 9656afd4 win32k!ulGetFontData2+0x17
bb5a4cd0 9656ac5a win32k!ulGetFontData+0x48
bb5a4d18 8285942a win32k!NtGdiGetFontData+0x5a
bb5a4d18 77c364f4 nt!KiFastCallEntry+0x12a

Just remember to run VERIFIER /RESET now.

shernren · 08 Nov 2009

H2SO4 said:

Just remember to run VERIFIER /RESET now.

Oops, I forgot to do that!

Again, thanks for your help :)

Itham · 12 Feb 2010

Hi:

Im having the same issue in my case I used BlueScreenView to detect de the cause and the systems put in Red the following things: win32k.sys ntoskrnl.exe are the most common. But the first error points dxgkrnl.sys also when all started.

My problem happens when I start Mozilla Firefox or any other web browsor outside Internet explorer that is the only one that not cause the crash. Another weird thing is that I also get the BSOD when i look for files with the windows searcher, because whenever i try to use it to search for mathpass (the key of mathematica 7.0) the crash also happens. I unisntalled firefox and tried another browser but the same thing happens.

Well the last thing i remember i did before the crashes started was to uninstall mathematica 6.0 then deleting the folder from aplications data (i dont remember the location) and after that i turned off my computer then the issues started.
I always get the same BOSD:

Bad pool header

so i hope you can help me; or just know if the only solution is to format my computer.

Thanks in advance.

zigzag3143 · 12 Feb 2010

Itham said:

Hi:

Im having the same issue in my case I used BlueScreenView to detect de the cause and the systems put in Red the following things: win32k.sys ntoskrnl.exe are the most common. But the first error points dxgkrnl.sys also when all started.

My problem happens when I start Mozilla Firefox or any other web browsor outside Internet explorer that is the only one that not cause the crash. Another weird thing is that I also get the BSOD when i look for files with the windows searcher, because whenever i try to use it to search for mathpass (the key of mathematica 7.0) the crash also happens. I unisntalled firefox and tried another browser but the same thing happens.

Well the last thing i remember i did before the crashes started was to uninstall mathematica 6.0 then deleting the folder from aplications data (i dont remember the location) and after that i turned off my computer then the issues started.
I always get the same BOSD:

Bad pool header

so i hope you can help me; or just know if the only solution is to format my computer.

Thanks in advance.

Hi and welcome

Blue screen view often gives incomplete or inaccurate results. Bad pool header is a device driver.

I would
run a system file check since a lot of the causes are win 7 files.
to do that type cmd in search>right click and run as admin>sfc /scannow
let us know the report at the end as you may have to run it more than once
download memtestx86 and run for 5 passes

If you are overclocking STOP

Let us know if yoou need help

Ken

Code:

021110-27955-01.dmp    2/11/2010 8:09:03 PM    BAD_POOL_HEADER    0x00000019    00000000`00000003    fffff880`021cf1e0    fffff880`021cf1e0    fffff880`ffff0000    win32k.sys    win32k.sys+250082                    x64        C:\Users\K\Desktop\New folder\021110-27955-01.dmp    2    15    7600    
021110-27627-01.dmp    2/11/2010 9:04:33 PM    BAD_POOL_HEADER    0x00000019    00000000`00000003    fffff880`021c1410    fffff880`021c1410    fffff880`73666e74    win32k.sys    win32k.sys+64c69                    x64        C:\Users\K\Desktop\New folder\021110-27627-01.dmp    2    15    7600    
021110-26192-01.dmp    2/11/2010 9:01:29 PM    BAD_POOL_HEADER    0x00000019    00000000`00000003    fffff880`021db410    fffff880`021db410    fffff880`73666e74    win32k.sys    win32k.sys+64c69                    x64        C:\Users\K\Desktop\New folder\021110-26192-01.dmp    2    15    7600    
021110-23150-01.dmp    2/11/2010 3:25:12 PM    BAD_POOL_HEADER    0x00000019    00000000`00000003    fffff880`021d6410    fffff880`021d6410    fffff880`73666e74    win32k.sys    win32k.sys+64c69                    x64        C:\Users\K\Desktop\New folder\021110-23150-01.dmp    2    15    7600    
021110-20077-01.dmp    2/11/2010 8:32:30 PM    BAD_POOL_HEADER    0x00000019    00000000`00000003    fffff880`021e7410    fffff880`021e7410    fffff880`73666e74    win32k.sys    win32k.sys+64c69                    x64        C:\Users\K\Desktop\New folder\021110-20077-01.dmp    2    15    7600    
021010-32791-01.dmp    2/10/2010 7:39:56 PM    BAD_POOL_HEADER    0x00000019    00000000`00000003    fffff880`021cf1e0    fffff880`73666e74    fffff880`ffff0000    win32k.sys    win32k.sys+250082                    x64        C:\Users\K\Desktop\New folder\021010-32791-01.dmp    2    15    7600    
021010-29983-01.dmp    2/10/2010 7:35:26 PM    BAD_POOL_HEADER    0x00000019    00000000`00000003    fffff880`021cf1e0    fffff880`73666e74    fffff880`ffff0000    dxgkrnl.sys    dxgkrnl.sys+313f                    x64        C:\Users\K\Desktop\New folder\021010-29983-01.dmp    2    15    7600    
021010-25521-01.dmp    2/10/2010 10:59:54 PM    BAD_POOL_HEADER    0x00000019    00000000`00000003    fffff880`036f91e0    fffff880`036f91e0    fffff880`ffff0000    win32k.sys    win32k.sys+5ef37                    x64        C:\Users\K\Desktop\New folder\021010-25521-01.dmp    2    15    7600    
021010-19032-01.dmp    2/10/2010 8:02:28 PM    BAD_POOL_HEADER    0x00000019    00000000`00000003    fffff880`021e11e0    fffff880`73666e74    fffff880`ffff0000    ntoskrnl.exe    ntoskrnl.exe+71f00                    x64        C:\Users\K\Desktop\New folder\021010-19032-01.dmp    2    15    7600    
021010-18470-01.dmp    2/10/2010 9:16:42 PM    BAD_POOL_HEADER    0x00000019    00000000`00000003    fffff880`021e81e0    fffff880`73666e74    fffff880`ffff0000    ntoskrnl.exe    ntoskrnl.exe+71f00                    x64        C:\Users\K\Desktop\New folder\021010-18470-01.dmp    2    15    7600

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\New folder\021110-26192-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c4e000 PsLoadedModuleList = 0xfffff800`02e8be50
Debug session time: Thu Feb 11 21:59:41.986 2010 (GMT-5)
System Uptime: 0 days 0:23:05.921
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffff880021db410, fffff880021db410, fffff88073666e74}

Probably caused by : Pool_Corruption ( nt!ExFreePool+536 )

Followup: Pool_corruption
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffff880021db410, the pool entry being checked.
Arg3: fffff880021db410, the read back flink freelist value (should be the same as 2).
Arg4: fffff88073666e74, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


BUGCHECK_STR:  0x19_3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002df1d6f to fffff80002cbff00

STACK_TEXT:  
fffff880`08798dc8 fffff800`02df1d6f : 00000000`00000019 00000000`00000003 fffff880`021db410 fffff880`021db410 : nt!KeBugCheckEx
fffff880`08798dd0 fffff960`00078487 : 00000000`00000000 00000000`00000100 00000000`00000000 fffff900`00000000 : nt!ExFreePool+0x536
fffff880`08798ec0 fffff960`000710b3 : 00000000`00000100 00000000`00000000 00000000`00000352 fffff900`c1cf0010 : win32k!EngAllocMem+0x47
fffff880`08798ef0 fffff960`00070e90 : 00000000`00000000 fffff900`c074dd08 00000000`00000000 fffff960`00031c98 : win32k!EngComputeGlyphSet+0x93
fffff880`08798f40 fffff960`00070dc0 : 00000000`00000010 fffff900`c074dd08 fffff900`c074dd08 fffff880`08799050 : win32k!pgsetComputeSymbolCP+0x30
fffff880`08798f90 fffff960`00031e37 : fffff900`c074dd08 00000000`00b24234 fffff880`08799050 00000000`00b2400c : win32k!cjComputeGLYPHSET_TEMPLATE+0x40
fffff880`08798fe0 fffff960`0002916b : fffff900`c074dcb0 00000000`00000001 00000000`00000001 00000000`00000000 : win32k!bLoadGlyphSet+0x15f
fffff880`08799010 fffff960`0002930a : fffff900`c074dcb0 fffff900`00000001 fffff900`c074dcb0 fffff960`00196450 : win32k!bReloadGlyphSet+0x24b
fffff880`087996d0 fffff960`00029262 : 00000000`00000000 fffff900`c074dcb0 fffff900`00000001 fffff900`c1d404b4 : win32k!ttfdQueryFontTree+0x66
fffff880`08799720 fffff960`00074807 : fffff960`00029208 fffff900`c074c3d0 00000000`00000001 00000000`00000000 : win32k!ttfdSemQueryFontTree+0x5a
fffff880`08799760 fffff960`000746b3 : fffff880`08799870 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!PDEVOBJ::QueryFontTree+0x63
fffff880`087997e0 fffff960`00030076 : fffff900`c008a010 00000000`00000000 00000000`00000002 00000000`00000000 : win32k!PFEOBJ::pfdg+0xa3
fffff880`08799840 fffff960`00088e08 : fffff900`c1d403a0 fffff880`08799ad0 fffff880`087999d0 fffff880`08799b20 : win32k!RFONTOBJ::bRealizeFont+0x46
fffff880`08799960 fffff960`0005a87d : 00000000`10010000 fffff900`00000000 00000c67`00000000 00000000`00000002 : win32k!RFONTOBJ::bInit+0x548
fffff880`08799a80 fffff960`0005a813 : fffff900`c0081000 fffff880`08799ca0 00000000`322f534f 000007fe`fae543ee : win32k!ulGetFontData2+0x31
fffff880`08799af0 fffff960`0005a729 : 00000000`ffffffff 00000000`ffffffff fffffa80`0572be60 fffff960`000d4ace : win32k!ulGetFontData+0x7f
fffff880`08799b40 fffff800`02cbf153 : 00000000`1c010c67 00000000`00000000 00000000`079df428 00000000`00000000 : win32k!NtGdiGetFontData+0x8d
fffff880`08799bb0 000007fe`fdf57f9a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`079df408 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fdf57f9a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExFreePool+536
fffff800`02df1d6f cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExFreePool+536

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0x19_3_nt!ExFreePool+536

BUCKET_ID:  X64_0x19_3_nt!ExFreePool+536

Followup: Pool_corruption
---------

Itham · 15 Feb 2010

Well looking on some pages i actually found that the problem was for using mathematica 7.0 and mozilla 3.xx so every time i could try to use that browser or anything else outside IE it would crash so i had to reinstall windows.

Well at least that was my case.

rdragon · 07 Jun 2010

Thanks people. I had exactly the same problem. Mathematica 7 had installed a font called Mathematica5 which caused BSoD's. After deleting the font everything works fine again!