Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\111810-16785-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82808000 PsLoadedModuleList = 0x82950810
Debug session time: Thu Nov 18 06:37:05.490 2010 (GMT-5)
System Uptime: 0 days 0:00:17.550
Loading Kernel Symbols
.
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
..............................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {c0000a78, 0, 0, 828a83e0}
Probably caused by : memory_corruption ( nt!MiDeleteAddressesInWorkingSet+1ad )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c0000a78, memory referenced
Arg2: 00000000, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 828a83e0, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from 82970718
Unable to read MiSystemVaType memory at 82950160
c0000a78
CURRENT_IRQL: 0
FAULTING_IP:
nt!MiDeleteAddressesInWorkingSet+1ad
828a83e0 8b0e mov ecx,dword ptr [esi]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: lsm.exe
TRAP_FRAME: 92cf6294 -- (.trap 0xffffffff92cf6294)
ErrCode = 00000000
eax=00000014 ebx=874da628 ecx=c0802d58 edx=c0802d58 esi=c0000a78 edi=c0802000
eip=828a83e0 esp=92cf6308 ebp=92cf6764 iopl=0 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010287
nt!MiDeleteAddressesInWorkingSet+0x1ad:
828a83e0 8b0e mov ecx,dword ptr [esi] ds:0023:c0000a78=????????
Resetting default scope
EXCEPTION_RECORD: 92cf6ce0 -- (.exr 0xffffffff92cf6ce0)
ExceptionAddress: 776aa9e1
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 0014f3b0
Attempt to read from address 0014f3b0
LAST_CONTROL_TRANSFER: from 828a83e0 to 8284e82b
STACK_TEXT:
92cf6294 828a83e0 badb0d00 c0802d58 92cf6314 nt!KiTrap0E+0x2cf
92cf6764 828ad0a8 874da438 874da438 00000000 nt!MiDeleteAddressesInWorkingSet+0x1ad
92cf6794 82a50dae 8efae30e 00000000 874db538 nt!MmCleanProcessAddressSpace+0x8c
92cf6808 82a69dc7 00000000 92cf6840 92cf68c0 nt!PspExitThread+0x683
92cf6830 8284b44a ffffffff c0000005 92cf6cc4 nt!NtTerminateProcess+0x1fa
92cf6830 8284a6ad ffffffff c0000005 92cf6cc4 nt!KiFastCallEntry+0x12a
92cf68b0 828c566f ffffffff c0000005 0001003f nt!ZwTerminateProcess+0x11
92cf6cc4 8284c036 92cf6ce0 00000000 92cf6d34 nt!KiDispatchException+0x497
92cf6d2c 8284bfea 0014f3b4 776aa9e1 badb0d00 nt!CommonDispatchException+0x4a
92cf6d34 776aa9e1 badb0d00 000376b0 00000000 nt!Kei386EoiHelper+0x192
WARNING: Frame IP not in any known module. Following frames may be wrong.
92cf6d38 badb0d00 000376b0 00000000 00000000 0x776aa9e1
92cf6d3c 000376b0 00000000 00000000 00000000 0xbadb0d00
92cf6d40 00000000 00000000 00000000 00000000 0x376b0
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiDeleteAddressesInWorkingSet+1ad
828a83e0 8b0e mov ecx,dword ptr [esi]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiDeleteAddressesInWorkingSet+1ad
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c3fac
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0xA_nt!MiDeleteAddressesInWorkingSet+1ad
BUCKET_ID: 0xA_nt!MiDeleteAddressesInWorkingSet+1ad
Followup: MachineOwner
---------
