Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_MiniDumpBRANDELH.zip\062010-30607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02855000 PsLoadedModuleList = 0xfffff800`02a92e50
Debug session time: Sun Jun 20 10:16:56.137 2010 (UTC - 7:00)
System Uptime: 0 days 0:17:27.698
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 116, {fffffa800547a010, fffff880065b3c48, 0, 2}
Unable to load image \SystemRoot\system32\DRIVERS\atikmpag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmpag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
Probably caused by : atikmpag.sys ( atikmpag+6c48 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
VIDEO_TDR_FAILURE (116)
Attempt to reset the display driver and recover from timeout failed.
Arguments:
Arg1: fffffa800547a010, Optional pointer to internal TDR recovery context (TDR_RECOVERY_CONTEXT).
Arg2: fffff880065b3c48, The pointer into responsible device driver module (e.g. owner tag).
Arg3: 0000000000000000, Optional error code (NTSTATUS) of the last failed operation.
Arg4: 0000000000000002, Optional internal context dependent data.
Debugging Details:
------------------
FAULTING_IP:
atikmpag+6c48
fffff880`065b3c48 4883ec28 sub rsp,28h
DEFAULT_BUCKET_ID: GRAPHICS_DRIVER_TDR_FAULT
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x116
PROCESS_NAME: System
CURRENT_IRQL: 0
STACK_TEXT:
fffff880`0244e9c8 fffff880`03e5ccbc : 00000000`00000116 fffffa80`0547a010 fffff880`065b3c48 00000000`00000000 : nt!KeBugCheckEx
fffff880`0244e9d0 fffff880`03e5c9c6 : fffff880`065b3c48 fffffa80`0547a010 fffffa80`0547cd50 fffffa80`03a02410 : dxgkrnl!TdrBugcheckOnTimeout+0xec
fffff880`0244ea10 fffff880`04548f07 : fffffa80`0547a010 00000000`00000000 fffffa80`0547cd50 fffffa80`03a02410 : dxgkrnl!TdrIsRecoveryRequired+0x1a2
fffff880`0244ea40 fffff880`04572b75 : 00000000`ffffffff 00000000`0001032a 00000000`00000000 00000000`00000002 : dxgmms1!VidSchiReportHwHang+0x40b
fffff880`0244eb20 fffff880`045712bb : 00000000`00000102 00000000`00000000 00000000`0001032a 00000000`00000000 : dxgmms1!VidSchiCheckHwProgress+0x71
fffff880`0244eb50 fffff880`045442c6 : ffffffff`ff676980 fffffa80`03a02410 00000000`00000000 00000000`00000000 : dxgmms1!VidSchiWaitForSchedulerEvents+0x1fb
fffff880`0244ebf0 fffff880`04570e7a : 00000000`00000000 00000000`0000000f 00000000`00000080 fffffa80`05e39c68 : dxgmms1!VidSchiScheduleCommandToRun+0x1da
fffff880`0244ed00 fffff800`02b6a166 : fffff880`08b13c90 fffffa80`04a37370 fffffa80`039cd040 fffff800`028bed87 : dxgmms1!VidSchiWorkerThread+0xba
fffff880`0244ed40 fffff800`028a5486 : fffff800`02a3fe80 fffffa80`04a37370 fffffa80`04238040 fffff880`01237a90 : nt!PspSystemThreadStartup+0x5a
fffff880`0244ed80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
atikmpag+6c48
fffff880`065b3c48 4883ec28 sub rsp,28h
SYMBOL_NAME: atikmpag+6c48
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: atikmpag
IMAGE_NAME: atikmpag.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4bfe9d00
FAILURE_BUCKET_ID: X64_0x116_IMAGE_atikmpag.sys
BUCKET_ID: X64_0x116_IMAGE_atikmpag.sys
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_MiniDumpBRANDELH.zip\062510-29640-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a02000 PsLoadedModuleList = 0xfffff800`02c3fe50
Debug session time: Fri Jun 25 11:49:02.297 2010 (UTC - 7:00)
System Uptime: 0 days 0:10:50.858
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff68400037e00, 0, fffff80002b79235, 5}
Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiEmptyWorkingSet+1c5 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff68400037e00, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002b79235, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002caa0e0
fffff68400037e00
FAULTING_IP:
nt!MiEmptyWorkingSet+1c5
fffff800`02b79235 488b02 mov rax,qword ptr [rdx]
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: avguard.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88005c894b0 -- (.trap 0xfffff88005c894b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000098000000000 rbx=0000000000000000 rcx=0000000400037e06
rdx=fffff68400037e00 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002b79235 rsp=fffff88005c89640 rbp=000000000000000d
r8=0000000fffffffff r9=0000000000000001 r10=0000000000000000
r11=0000000000000013 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!MiEmptyWorkingSet+0x1c5:
fffff800`02b79235 488b02 mov rax,qword ptr [rdx] ds:4c46:fffff684`00037e00=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002af1801 to fffff80002a72600
STACK_TEXT:
fffff880`05c89348 fffff800`02af1801 : 00000000`00000050 fffff684`00037e00 00000000`00000000 fffff880`05c894b0 : nt!KeBugCheckEx
fffff880`05c89350 fffff800`02a706ee : 00000000`00000000 ffffffff`ffffffff 00000000`76041000 00000000`03e90000 : nt! ?? ::FNODOBFM::`string'+0x40ecb
fffff880`05c894b0 fffff800`02b79235 : fffffa80`05c64a88 fffff880`05c89660 00000000`00000000 fffffa80`00000013 : nt!KiPageFault+0x16e
fffff880`05c89640 fffff800`02cba49d : fffffa80`05d46b60 00000000`00000001 ffffffff`ffffffff 00000000`000000c8 : nt!MiEmptyWorkingSet+0x1c5
fffff880`05c896f0 fffff800`02ec47ad : 00000000`00000001 fffff8a0`01776d50 00000000`00000000 00000000`00000000 : nt!MmAdjustWorkingSetSizeEx+0xad
fffff880`05c89780 fffff800`02dcc22b : 00000000`00000008 00000000`00000000 00000000`00000001 00000000`0173e6b0 : nt!PspSetQuotaLimits+0x32d
fffff880`05c898d0 fffff800`02a71853 : fffffa80`05d46b60 fffff880`05c89ca0 00000000`7efa1000 00000000`7efa1000 : nt! ?? ::NNGAKEGL::`string'+0x49e50
fffff880`05c89c20 00000000`77aeff1a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0173e678 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77aeff1a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiEmptyWorkingSet+1c5
fffff800`02b79235 488b02 mov rax,qword ptr [rdx]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiEmptyWorkingSet+1c5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x50_nt!MiEmptyWorkingSet+1c5
BUCKET_ID: X64_0x50_nt!MiEmptyWorkingSet+1c5
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_MiniDumpBRANDELH.zip\062510-26410-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02818000 PsLoadedModuleList = 0xfffff800`02a55e50
Debug session time: Thu Jun 24 18:46:23.388 2010 (UTC - 7:00)
System Uptime: 0 days 0:02:31.902
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41790, fffffa8001904280, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8001904280
Arg3: 000000000000ffff
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41790
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: SearchIndexer.
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800028fbede to fffff80002888600
STACK_TEXT:
fffff880`087bc6e8 fffff800`028fbede : 00000000`0000001a 00000000`00041790 fffffa80`01904280 00000000`0000ffff : nt!KeBugCheckEx
fffff880`087bc6f0 fffff800`0285bb3b : ffffffff`00000000 00000000`0439ffff fffffa80`00000000 fffffa80`0639a060 : nt! ?? ::FNODOBFM::`string'+0x33946
fffff880`087bc8b0 fffff800`02b6ec4f : fffff8a0`02124660 fffff880`087bcc20 00000000`00000000 fffffa80`0639a060 : nt!MmCleanProcessAddressSpace+0x62f
fffff880`087bc900 fffff800`02b474d1 : 00000000`000000ff 00000000`00000801 000007ff`fffa0000 fffffa80`05e57720 : nt!PspExitThread+0x92f
fffff880`087bc9c0 fffff800`028650e3 : 00000000`00000001 00000000`00000000 fffff880`00961000 fffff880`010bd711 : nt!PsExitSpecialApc+0x1d
fffff880`087bc9f0 fffff800`02865520 : 00000000`0456a930 fffff880`087bca70 fffff800`02b475dc 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`087bca70 fffff800`028878f7 : fffffa80`0639a060 00000000`0456a818 fffff880`087bcbc8 00000000`0099fe68 : nt!KiInitiateUserApc+0x70
fffff880`087bcbb0 00000000`7728046a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0456a7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7728046a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+33946
fffff800`028fbede cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+33946
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb
FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33946
BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33946
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_MiniDumpBRANDELH.zip\062510-26410-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02818000 PsLoadedModuleList = 0xfffff800`02a55e50
Debug session time: Thu Jun 24 18:46:23.388 2010 (UTC - 7:00)
System Uptime: 0 days 0:02:31.902
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41790, fffffa8001904280, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8001904280
Arg3: 000000000000ffff
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41790
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: SearchIndexer.
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800028fbede to fffff80002888600
STACK_TEXT:
fffff880`087bc6e8 fffff800`028fbede : 00000000`0000001a 00000000`00041790 fffffa80`01904280 00000000`0000ffff : nt!KeBugCheckEx
fffff880`087bc6f0 fffff800`0285bb3b : ffffffff`00000000 00000000`0439ffff fffffa80`00000000 fffffa80`0639a060 : nt! ?? ::FNODOBFM::`string'+0x33946
fffff880`087bc8b0 fffff800`02b6ec4f : fffff8a0`02124660 fffff880`087bcc20 00000000`00000000 fffffa80`0639a060 : nt!MmCleanProcessAddressSpace+0x62f
fffff880`087bc900 fffff800`02b474d1 : 00000000`000000ff 00000000`00000801 000007ff`fffa0000 fffffa80`05e57720 : nt!PspExitThread+0x92f
fffff880`087bc9c0 fffff800`028650e3 : 00000000`00000001 00000000`00000000 fffff880`00961000 fffff880`010bd711 : nt!PsExitSpecialApc+0x1d
fffff880`087bc9f0 fffff800`02865520 : 00000000`0456a930 fffff880`087bca70 fffff800`02b475dc 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`087bca70 fffff800`028878f7 : fffffa80`0639a060 00000000`0456a818 fffff880`087bcbc8 00000000`0099fe68 : nt!KiInitiateUserApc+0x70
fffff880`087bcbb0 00000000`7728046a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0456a7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7728046a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+33946
fffff800`028fbede cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+33946
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb
FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33946
BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33946
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_MiniDumpBRANDELH.zip\062210-37861-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02865000 PsLoadedModuleList = 0xfffff800`02aa2e50
Debug session time: Mon Jun 21 22:31:39.542 2010 (UTC - 7:00)
System Uptime: 0 days 22:02:15.103
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff880085aeeb8, fffff880085ae720, fffff880013046c5}
Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteInternalAttributeStream+c5 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880085aeeb8
Arg3: fffff880085ae720
Arg4: fffff880013046c5
Debugging Details:
------------------
EXCEPTION_RECORD: fffff880085aeeb8 -- (.exr 0xfffff880085aeeb8)
ExceptionAddress: fffff880013046c5 (Ntfs!NtfsDeleteInternalAttributeStream+0x00000000000000c5)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 000020000000005a
Attempt to write to address 000020000000005a
CONTEXT: fffff880085ae720 -- (.cxr 0xfffff880085ae720)
rax=0000000000000001 rbx=fffff8a007fc3140 rcx=fffffa8004bbd880
rdx=0000000000000000 rsi=0000200000000000 rdi=0000000000000000
rip=fffff880013046c5 rsp=fffff880085af0f0 rbp=fffff880085af980
r8=0000000000000000 r9=0000000000000000 r10=fffffa8004bbd180
r11=fffff880085af730 r12=fffff880085af700 r13=0000000000000000
r14=0000000000000702 r15=fffff8a002ae0390
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
Ntfs!NtfsDeleteInternalAttributeStream+0xc5:
fffff880`013046c5 66897e5a mov word ptr [rsi+5Ah],di ds:002b:00002000`0000005a=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 000020000000005a
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002b0d0e0
000020000000005a
FOLLOWUP_IP:
Ntfs!NtfsDeleteInternalAttributeStream+c5
fffff880`013046c5 66897e5a mov word ptr [rsi+5Ah],di
FAULTING_IP:
Ntfs!NtfsDeleteInternalAttributeStream+c5
fffff880`013046c5 66897e5a mov word ptr [rsi+5Ah],di
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff880012e6d88 to fffff880013046c5
STACK_TEXT:
fffff880`085af0f0 fffff880`012e6d88 : fffff8a0`07fc3010 fffff880`085af980 fffff8a0`07fc3140 fffffa80`04713070 : Ntfs!NtfsDeleteInternalAttributeStream+0xc5
fffff880`085af140 fffff880`01255aa9 : fffffa80`06305bd0 00000000`00000000 fffff880`085af690 fffff880`0859e000 : Ntfs!NtfsCommonCleanup+0x758
fffff880`085af550 fffff800`028e4d4a : fffff880`085af690 00000000`00000000 fffff880`085af668 00000000`00000000 : Ntfs!NtfsCommonCleanupCallout+0x19
fffff880`085af580 fffff880`01255662 : fffff880`01255a90 fffff880`085af690 fffff880`085af900 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xda
fffff880`085af660 fffff880`012f7244 : fffff880`085af730 fffff880`085af730 fffff880`085af730 fffff880`085af748 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffff880`085af6d0 fffff880`0116323f : fffff880`085af730 fffffa80`06305bd0 fffffa80`06305fb8 fffffa80`053c61e0 : Ntfs!NtfsFsdCleanup+0x144
fffff880`085af940 fffff880`011616df : fffffa80`049a9de0 00000000`00000000 00000000`00000000 fffffa80`06305bd0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`085af9d0 fffff800`02bec9af : fffffa80`06305bd0 fffffa80`05ca4b30 00000000`00000000 fffffa80`04713070 : fltmgr!FltpDispatch+0xcf
fffff880`085afa30 fffff800`02bd2604 : 00000000`00000000 fffffa80`05ca4b30 00000001`00060001 fffff880`085afad8 : nt!IopCloseFile+0x11f
fffff880`085afac0 fffff800`02bec4a1 : fffffa80`05ca4b30 fffffa80`00000001 fffff8a0`0113b4e0 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
fffff880`085afb40 fffff800`02bec3b4 : 00000000`00001208 fffffa80`05ca4b30 fffff8a0`0113b4e0 00000000`00001208 : nt!ObpCloseHandleTableEntry+0xb1
fffff880`085afbd0 fffff800`028d4853 : fffffa80`03d84470 fffff880`085afca0 00000000`06b6ec30 fffffa80`0617d640 : nt!ObpCloseHandle+0x94
fffff880`085afc20 00000000`7707ffaa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`06b6ea88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7707ffaa
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsDeleteInternalAttributeStream+c5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff880085ae720 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteInternalAttributeStream+c5
BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteInternalAttributeStream+c5
Followup: MachineOwner
---------
~Lordbob