Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [G:\100910-24585-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e17000 PsLoadedModuleList = 0xfffff800`03054e50
Debug session time: Sat Oct 9 19:46:38.016 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:10.826
Loading Kernel Symbols
..................................................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C0000221, {fffff8a00015c2d0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!ExpSystemErrorHandler2+5ff )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Unknown bugcheck code (c0000221)
Unknown bugcheck description
Arguments:
Arg1: fffff8a00015c2d0
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0xc0000221
ERROR_CODE: (NTSTATUS) 0xc0000221 - {
EXCEPTION_CODE: (NTSTATUS) 0xc0000221 - {
EXCEPTION_PARAMETER1: fffff8a00015c2d0
EXCEPTION_PARAMETER2: 0000000000000000
EXCEPTION_PARAMETER3: 0000000000000000
EXCEPTION_PARAMETER4: 0
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800030d509f to fffff80002e87740
STACK_TEXT:
fffff880`009a91e8 fffff800`030d509f : 00000000`0000004c 00000000`c0000221 fffff880`009a9288 fffffa80`04944820 : nt!KeBugCheckEx
fffff880`009a91f0 fffff800`02ed1ec4 : 7ff00000`00000000 00000000`00000000 00000000`00000000 fffff700`01080000 : nt!ExpSystemErrorHandler2+0x5ff
fffff880`009a9420 fffff800`032b7961 : 00000000`c0000221 00000000`00000001 00000000`00000001 00000000`00140000 : nt!ExpSystemErrorHandler+0xd4
fffff880`009a9460 fffff800`032b7d66 : fffffa80`c0000221 00000000`00000001 fffffa80`00000001 00000000`00140000 : nt!ExpRaiseHardError+0xe1
fffff880`009a9790 fffff800`032b9216 : fffff8a0`c0000221 00000000`00000001 00000000`00000001 fffff880`009a9988 : nt!ExRaiseHardError+0x1d6
fffff880`009a9890 fffff800`032cc41f : 00000000`c0000221 00000000`08000000 fffff800`03352828 ffffffff`800000b8 : nt!NtRaiseHardError+0x1e4
fffff880`009a9930 fffff800`032cc779 : 00000000`002a0028 00000000`00000000 00000000`00000001 fffff800`03382bc0 : nt!PspLocateSystemDll+0xbf
fffff880`009a9a00 fffff800`033b5b3d : fffff800`00812800 00000000`00000002 00000000`00000000 fffff800`03001e80 : nt!PsLocateSystemDlls+0x69
fffff880`009a9a40 fffff800`033b8cec : 00000000`00000000 00000000`00000010 ffffffff`80000028 fffff800`00812800 : nt!IoInitSystem+0x85d
fffff880`009a9b40 fffff800`033098c9 : 00000000`00000000 fffffa80`039eab60 00000000`00000080 fffffa80`039ea040 : nt!Phase1InitializationDiscard+0x129c
fffff880`009a9d10 fffff800`0312bc06 : 00000000`00000000 00000000`00000080 00000000`00000000 fffff800`02e65c19 : nt!Phase1Initialization+0x9
fffff880`009a9d40 fffff800`02e65c26 : fffff800`03001e80 fffffa80`039eab60 fffff800`0300fc40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a93f0 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExpSystemErrorHandler2+5ff
fffff800`030d509f cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExpSystemErrorHandler2+5ff
FOLLOWUP_NAME: MachineOwner
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0xc0000221_nt!ExpSystemErrorHandler2+5ff
BUCKET_ID: X64_0xc0000221_nt!ExpSystemErrorHandler2+5ff
Followup: MachineOwner
------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [G:\101510-21247-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0224b000 PsLoadedModuleList = 0xfffff800`02488e50
Debug session time: Fri Oct 15 03:51:55.948 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:12.698
Loading Kernel Symbols
...............................................................
.....
Loading User Symbols
Loading unloaded module list
.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {3, fffff8000244aab0, fffff8000244aab1, fffff8000244aab0}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+a56 )
Followup: Pool_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffff8000244aab0, the pool entry being checked.
Arg3: fffff8000244aab1, the read back flink freelist value (should be the same as 2).
Arg4: fffff8000244aab0, the read back blink freelist value (should be the same as 2).
Debugging Details:
------------------
BUGCHECK_STR: 0x19_3
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
DEVICE_OBJECT: fffffa800500f3f8
DRIVER_OBJECT: 0000000000100040
LAST_CONTROL_TRANSFER: from fffff800023eed6f to fffff800022bb740
STACK_TEXT:
fffff880`02116138 fffff800`023eed6f : 00000000`00000019 00000000`00000003 fffff800`0244aab0 fffff800`0244aab1 : nt!KeBugCheckEx
fffff880`02116140 fffff800`022e8438 : 00000028`00000000 fffffa80`03ab4040 00020000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0xa56
fffff880`02116230 fffff800`022e7e8b : fffff8a0`04612108 00000000`04612108 00000000`00000002 00000000`ffffff70 : nt!CcAllocateInitializeMbcb+0x18
fffff880`02116260 fffff800`022e773e : 00000000`00000048 fffff880`02116340 fffff880`00000004 fffff880`02116338 : nt!CcSetDirtyInMask+0x39b
fffff880`02116300 fffff800`022e7434 : fffffa80`04f428e0 fffff880`02117bf0 fffff880`02116440 00000000`00000000 : nt!CcMapAndCopyInToCache+0x27e
fffff880`021163f0 fffff880`01232f40 : 00000000`00000000 fffff880`02116670 fffffa80`04f04570 fffff880`02116600 : nt!CcCopyWrite+0x194
fffff880`02116480 fffff880`01237413 : fffffa80`04f04570 fffffa80`0500f010 fffff880`02116600 fffff880`02116600 : Ntfs!NtfsCommonWrite+0xda0
fffff880`02116640 fffff880`0109223f : fffffa80`0500f3b0 fffffa80`0500f010 fffffa80`04ea16f0 00000000`00000001 : Ntfs!NtfsFsdWrite+0x1c3
fffff880`02116700 fffff880`010906df : fffffa80`049aea30 00000000`00000001 fffffa80`049aea00 fffffa80`0500f010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`02116790 fffff800`025d1ca9 : 00000000`00000001 fffffa80`050174b0 00000000`00000001 fffffa80`0500f010 : fltmgr!FltpDispatch+0xcf
fffff880`021167f0 fffff800`025d2a43 : fffffa80`0500f3f8 00000000`00000000 fffffa80`050174b0 fffffa80`05017524 : nt!IopSynchronousServiceTail+0xf9
fffff880`02116860 fffff800`022ba993 : ffffffff`80000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x7e2
fffff880`02116960 fffff800`022b6f30 : fffff800`02633e38 fffff8a0`00244a60 fffff800`00000030 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
fffff880`02116b68 fffff800`02633e38 : fffff8a0`00244a60 fffff800`00000030 00000000`00000000 fffffa80`03a738e0 : nt!KiServiceLinkage
fffff880`02116b70 fffff800`0260efe3 : 00000000`00000000 fffffa80`00000018 00000000`00000032 00000000`0000000c : nt!EtwpRealtimeRestoreState+0x1b8
fffff880`02116c50 fffff800`025ad477 : fffffa80`03a73701 fffffa80`03a73780 00000000`00000001 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x43526
fffff880`02116cc0 fffff800`0255fc06 : 00000000`00000000 fffffa80`03ab4040 00000000`00000080 fffffa80`03a0f840 : nt!EtwpLogger+0x197
fffff880`02116d40 fffff800`02299c26 : fffff880`01e5d180 fffffa80`03ab4040 fffffa80`03a2a680 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02116d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExDeferredFreePool+a56
fffff800`023eed6f cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExDeferredFreePool+a56
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
FAILURE_BUCKET_ID: X64_0x19_3_nt!ExDeferredFreePool+a56
BUCKET_ID: X64_0x19_3_nt!ExDeferredFreePool+a56
Followup: Pool_corruption
---------
------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [G:\100410-30357-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02217000 PsLoadedModuleList = 0xfffff800`02454e50
Debug session time: Mon Oct 4 13:15:37.164 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:15.038
Loading Kernel Symbols
..........................................................
Loading User Symbols
Loading unloaded module list
.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 12233d, 1, ffffffffffffffff}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000012233d, page frame number
Arg3: 0000000000000001, current page state
Arg4: ffffffffffffffff, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff8000231738c to fffff80002287740
STACK_TEXT:
fffff880`02746238 fffff800`0231738c : 00000000`0000004e 00000000`00000099 00000000`0012233d 00000000`00000001 : nt!KeBugCheckEx
fffff880`02746240 fffff800`02220373 : 00000000`00000000 ffffffff`ffffffff 00000000`00000000 fffff800`02413b40 : nt!MiBadShareCount+0x4c
fffff880`02746280 fffff800`0227cd49 : 00000000`00000000 00000000`00001dc7 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4784e
fffff880`027463e0 fffff800`023b834f : 00000000`0332a000 fffff880`02746b20 fffff880`027465d0 00000000`00000000 : nt!MiFreePagedPoolPages+0x129
fffff880`02746530 fffff800`023bc87c : 00000000`00000000 fffff880`02746700 fffff880`02746670 00000000`00000001 : nt!MiFreePoolPages+0x343
fffff880`02746640 fffff800`0250ffc4 : 00000000`00000000 00000000`00000007 fffff880`20204d43 00000000`00000001 : nt!ExFreePoolWithTag+0x7cc
fffff880`027466f0 fffff800`0250bb43 : fffff8a0`00001000 fffff880`0332a000 fffff8a0`40000009 00000000`0332a000 : nt!HvpReadFileImageAndBuildMap+0x1b4
fffff880`027467a0 fffff800`0250b772 : 00000000`03340000 fffff8a0`005e1000 01cb63ac`9070f1ce fffff8a0`005dc010 : nt!HvLoadHive+0xd7
fffff880`02746800 fffff800`025081f2 : 00000000`00000000 00000000`00000002 fffff8a0`005dcbb8 00000000`00000001 : nt!HvInitializeHive+0x262
fffff880`02746860 fffff800`02508d89 : fffff880`02746a00 fffff880`02746b20 ffffffff`800001e0 fffff880`02746ac8 : nt!CmpInitializeHive+0x4a6
fffff880`02746950 fffff800`02705bed : 00000000`00000000 fffff800`00000200 fffff880`02746ae0 fffff800`024010eb : nt!CmpInitHiveFromFile+0x249
fffff880`02746a70 fffff800`0252bc06 : 00000000`02743656 fffffa80`04fae660 00000000`00000080 fffffa80`03a0f840 : nt!CmpLoadHiveThread+0x14d
fffff880`02746d40 fffff800`02265c26 : fffff800`02401e80 fffffa80`04fae660 fffffa80`03a17680 fffff880`01221a90 : nt!PspSystemThreadStartup+0x5a
fffff880`02746d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`0231738c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [G:\100410-24398-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e4f000 PsLoadedModuleList = 0xfffff800`0308ce50
Debug session time: Mon Oct 4 13:30:03.551 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:25.002
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {8d, 126a3c, 410001, fffff68000000003}
Probably caused by : memory_corruption ( nt!MmZeroPageThread+90c )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 000000000000008d,
Arg2: 0000000000126a3c
Arg3: 0000000000410001
Arg4: fffff68000000003
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_8d
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80002f0687d to fffff80002ebf740
STACK_TEXT:
fffff880`009a9c08 fffff800`02f0687d : 00000000`0000004e 00000000`0000008d 00000000`00126a3c 00000000`00410001 : nt!KeBugCheckEx
fffff880`009a9c10 fffff800`03163c06 : fffffa80`039dbb60 00000000`00000080 fffffa80`039db040 fffff800`02e9dc19 : nt!MmZeroPageThread+0x90c
fffff880`009a9d40 fffff800`02e9dc26 : fffff800`03039e80 fffffa80`039dbb60 fffff800`03047c40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MmZeroPageThread+90c
fffff800`02f0687d cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MmZeroPageThread+90c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_8d_nt!MmZeroPageThread+90c
BUCKET_ID: X64_0x4E_8d_nt!MmZeroPageThread+90c
Followup: MachineOwner
---------
------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [G:\091310-14632-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0220b000 PsLoadedModuleList = 0xfffff800`02448e50
Debug session time: Tue Sep 14 08:16:14.916 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:13.790
Loading Kernel Symbols
...............................................
Loading User Symbols
Loading unloaded module list
.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C0000221, {fffff8a0000942d0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!ExpSystemErrorHandler2+5ff )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Unknown bugcheck code (c0000221)
Unknown bugcheck description
Arguments:
Arg1: fffff8a0000942d0
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0xc0000221
ERROR_CODE: (NTSTATUS) 0xc0000221 - {
EXCEPTION_CODE: (NTSTATUS) 0xc0000221 - {
EXCEPTION_PARAMETER1: fffff8a0000942d0
EXCEPTION_PARAMETER2: 0000000000000000
EXCEPTION_PARAMETER3: 0000000000000000
EXCEPTION_PARAMETER4: 0
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800024c909f to fffff8000227b740
STACK_TEXT:
fffff880`009a91e8 fffff800`024c909f : 00000000`0000004c 00000000`c0000221 fffff880`009a9288 fffffa80`048eeee0 : nt!KeBugCheckEx
fffff880`009a91f0 fffff800`022c5ec4 : 7ff00000`00000000 00000000`00000000 00000000`00000000 fffff700`01080000 : nt!ExpSystemErrorHandler2+0x5ff
fffff880`009a9420 fffff800`026ab961 : 00000000`c0000221 00000000`00000001 00000000`00000001 00000000`00320000 : nt!ExpSystemErrorHandler+0xd4
fffff880`009a9460 fffff800`026abd66 : fffffa80`c0000221 00000000`00000001 fffffa80`00000001 00000000`00320000 : nt!ExpRaiseHardError+0xe1
fffff880`009a9790 fffff800`026ad216 : 00000000`c0000221 00000000`00000001 00000000`00000001 fffff880`009a9988 : nt!ExRaiseHardError+0x1d6
fffff880`009a9890 fffff800`026c041f : 00000000`c0000221 00000000`08000000 fffff800`02746828 ffffffff`80000078 : nt!NtRaiseHardError+0x1e4
fffff880`009a9930 fffff800`026c0779 : 00000000`002a0028 00000000`00000000 00000000`00000001 fffff800`02776bc0 : nt!PspLocateSystemDll+0xbf
fffff880`009a9a00 fffff800`027a9b3d : fffff800`00812800 00000000`00000002 00000000`00000000 fffff800`023f5e80 : nt!PsLocateSystemDlls+0x69
fffff880`009a9a40 fffff800`027accec : fffff800`0081bc82 fffff800`00000010 ffffffff`80000028 fffff800`00812800 : nt!IoInitSystem+0x85d
fffff880`009a9b40 fffff800`026fd8c9 : 00000000`00000000 fffffa80`03a0f460 00000000`00000080 fffffa80`03a0f9e0 : nt!Phase1InitializationDiscard+0x129c
fffff880`009a9d10 fffff800`0251fc06 : 00000000`00000000 00000000`00000080 00000000`00000000 fffff800`02259c19 : nt!Phase1Initialization+0x9
fffff880`009a9d40 fffff800`02259c26 : fffff800`023f5e80 fffffa80`03a0f460 fffff800`02403c40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a93f0 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExpSystemErrorHandler2+5ff
fffff800`024c909f cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExpSystemErrorHandler2+5ff
FOLLOWUP_NAME: MachineOwner
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0xc0000221_nt!ExpSystemErrorHandler2+5ff
BUCKET_ID: X64_0xc0000221_nt!ExpSystemErrorHandler2+5ff
Followup: MachineOwner
---------
------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [G:\092810-28860-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e0f000 PsLoadedModuleList = 0xfffff800`0304ce50
Debug session time: Wed Sep 29 04:37:49.371 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:23.822
Loading Kernel Symbols
...............................................................
................................................................
...
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff88005ca6746, fffff880031a8a08, fffff880031a8270}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88005ca6746, The address that the exception occurred at
Arg3: fffff880031a8a08, Exception Record Address
Arg4: fffff880031a8270, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
usbhub!UsbhHubWorker+6a
fffff880`05ca6746 ff1574890300 call qword ptr [usbhub!_imp_KeAcquireSpinLockRaiseToDpc (fffff880`05cdf0c0)]
EXCEPTION_RECORD: fffff880031a8a08 -- (.exr 0xfffff880031a8a08)
ExceptionAddress: fffff88005ca6746 (usbhub!UsbhHubWorker+0x000000000000006a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff880031a8270 -- (.cxr 0xfffff880031a8270)
rax=0000000000000000 rbx=fffffa80061411a0 rcx=fffffa8006141c88
rdx=0000000000000001 rsi=fffffa8006141050 rdi=fffffa80063c6150
rip=fffff88005ca6746 rsp=fffff880031a8c40 rbp=fffff800030245f8
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=fffff88002f63180 r12=fffffa80063ff160 r13=0000000000000001
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
usbhub!UsbhHubWorker+0x6a:
fffff880`05ca6746 ff1574890300 call qword ptr [usbhub!_imp_KeAcquireSpinLockRaiseToDpc (fffff880`05cdf0c0)] ds:002b:fffff880`05cdf0c0=000000000004d658
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b70e0
ffffffffffffffff
FOLLOWUP_IP:
usbhub!UsbhHubWorker+6a
fffff880`05ca6746 ff1574890300 call qword ptr [usbhub!_imp_KeAcquireSpinLockRaiseToDpc (fffff880`05cdf0c0)]
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from fffff8000317bc43 to fffff88005ca6746
STACK_TEXT:
fffff880`031a8c40 fffff800`0317bc43 : fffffa80`06141050 fffffa80`039e0680 fffffa80`0489a820 fffffa80`039e0680 : usbhub!UsbhHubWorker+0x6a
fffff880`031a8c80 fffff800`02e8c961 : fffff800`03024500 fffff800`0317bc20 fffffa80`039e0680 00000000`00000000 : nt!IopProcessWorkItem+0x23
fffff880`031a8cb0 fffff800`03123c06 : 006c0073`0078002f fffffa80`039e0680 00000000`00000080 fffffa80`039cc040 : nt!ExpWorkerThread+0x111
fffff880`031a8d40 fffff800`02e5dc26 : fffff880`02f63180 fffffa80`039e0680 fffff880`02f6dfc0 006f0069`00740063 : nt!PspSystemThreadStartup+0x5a
fffff880`031a8d80 00000000`00000000 : fffff880`031a9000 fffff880`031a3000 fffff880`031a89f0 00000000`00000000 : nt!KxStartSystemThread+0x16
CHKIMG_EXTENSION: !chkimg -lo 50 -d !usbhub
fffff88005ca6248 - usbhub!UsbhInitialize+280
[ e0:e1 ]
1 error : !usbhub (fffff88005ca6248)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
STACK_COMMAND: .cxr 0xfffff880031a8270 ; kb
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [G:\091510-17784-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e57000 PsLoadedModuleList = 0xfffff800`03094e50
Debug session time: Wed Sep 15 17:12:16.178 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:17.004
Loading Kernel Symbols
...............................................................
.........................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck F4, {3, fffffa80050ee040, fffffa80050ee320, fffff800031d25d0}
Probably caused by : smss.exe
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa80050ee040, Terminating object
Arg3: fffffa80050ee320, Process image file name
Arg4: fffff800031d25d0, Explanatory message (ascii)
Debugging Details:
------------------
PROCESS_OBJECT: fffffa80050ee040
IMAGE_NAME: smss.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: smss
FAULTING_MODULE: 0000000000000000
PROCESS_NAME: smss.exe
EXCEPTION_RECORD: fffff880043d9a00 -- (.exr 0xfffff880043d9a00)
ExceptionAddress: 0000000077a33382
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 000000000173f76c
Attempt to read from address 000000000173f76c
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 000000000173f76c
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030ff0e0
000000000173f76c
FOLLOWUP_IP:
+6238323438396435
00000000`77a33382 ?? ???
FAULTING_IP:
+6238323438396435
00000000`77a33382 ?? ???
FAILED_INSTRUCTION_ADDRESS:
+6238323438396435
00000000`77a33382 ?? ???
BUGCHECK_STR: 0xF4_C0000005
STACK_TEXT:
fffff880`043d8b68 fffff800`03253652 : 00000000`000000f4 00000000`00000003 fffffa80`050ee040 fffffa80`050ee320 : nt!KeBugCheckEx
fffff880`043d8b70 fffff800`031fc3e3 : ffffffff`ffffffff fffffa80`05889b60 fffffa80`050ee040 fffffa80`050ee040 : nt!PspCatchCriticalBreak+0x92
fffff880`043d8bb0 fffff800`0318480c : ffffffff`ffffffff 00000000`00000001 fffffa80`050ee040 fffff800`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17946
fffff880`043d8c00 fffff800`02ec6993 : fffffa80`050ee040 fffff880`c0000005 ffffe690`c9b2e89d fffffa80`05889b60 : nt!NtTerminateProcess+0x20c
fffff880`043d8c80 fffff800`02ec2f30 : fffff800`02f01dbc fffff880`043d9a00 fffff880`043d9350 fffff880`043d9c20 : nt!KiSystemServiceCopyEnd+0x13
fffff880`043d8e18 fffff800`02f01dbc : fffff880`043d9a00 fffff880`043d9350 fffff880`043d9c20 00000000`00000002 : nt!KiServiceLinkage
fffff880`043d8e20 fffff800`02fcb459 : fffff880`043d9a00 fffff880`043d9a00 fffff880`043d9c20 fffff880`043d94e0 : nt!KiDispatchException+0x53b
fffff880`043d94b0 fffff800`02ec93fb : fffff880`043d9a00 fffffa80`05889b60 00000000`00000000 fffff880`043d9bc0 : nt!KiRaiseException+0x1b9
fffff880`043d9ae0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtRaiseException+0x7b
STACK_COMMAND: kb
FOLLOWUP_NAME: MachineOwner
FAILURE_BUCKET_ID: X64_0xF4_C0000005_IMAGE_smss.exe
BUCKET_ID: X64_0xF4_C0000005_IMAGE_smss.exe
Followup: MachineOwner
---------
------------------------------------------------------
------------------------------------------------------
------------------------------------------------------
------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [G:\092510-13540-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e12000 PsLoadedModuleList = 0xfffff800`0304fe50
Debug session time: Sat Sep 25 20:33:52.782 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:11.233
Loading Kernel Symbols
...............................................................
...............
Loading User Symbols
Loading unloaded module list
.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffa800b400000, 0, fffff88003eac0c8, 2}
Unable to load image \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100924.001\IDSvia64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for IDSvia64.sys
*** ERROR: Module load completed but symbols could not be loaded for IDSvia64.sys
Could not read faulting driver name
Probably caused by : IDSvia64.sys ( IDSvia64+3b0c8 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa800b400000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88003eac0c8, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
OVERLAPPED_MODULE: Address regions for 'Ironx64' and 'netbt.sys' overlap
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030ba0e0
fffffa800b400000
FAULTING_IP:
IDSvia64+3b0c8
fffff880`03eac0c8 418a440804 mov al,byte ptr [r8+rcx+4]
MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: System
CURRENT_IRQL: 0
TRAP_FRAME: fffff880031a8840 -- (.trap 0xfffff880031a8840)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80054a1738
rdx=fffffa800523e030 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88003eac0c8 rsp=fffff880031a89d0 rbp=0000000000000002
r8=0000000005f5e8c4 r9=00000000ff4b4a48 r10=0000000000000028
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe cy
IDSvia64+0x3b0c8:
fffff880`03eac0c8 418a440804 mov al,byte ptr [r8+rcx+4] ds:fee8:fffffa80`0b400000=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002f018f2 to fffff80002e82740
STACK_TEXT:
fffff880`031a86d8 fffff800`02f018f2 : 00000000`00000050 fffffa80`0b400000 00000000`00000000 fffff880`031a8840 : nt!KeBugCheckEx
fffff880`031a86e0 fffff800`02e8082e : 00000000`00000000 00000000`00012730 fffffa80`0510f700 00000000`00000004 : nt! ?? ::FNODOBFM::`string'+0x40ec0
fffff880`031a8840 fffff880`03eac0c8 : 00000000`00000000 fffffa80`0510f810 fffffa80`0510f190 fffffa80`0523e040 : nt!KiPageFault+0x16e
fffff880`031a89d0 00000000`00000000 : fffffa80`0510f810 fffffa80`0510f190 fffffa80`0523e040 00000000`00000000 : IDSvia64+0x3b0c8
STACK_COMMAND: kb
FOLLOWUP_IP:
IDSvia64+3b0c8
fffff880`03eac0c8 418a440804 mov al,byte ptr [r8+rcx+4]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: IDSvia64+3b0c8
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: IDSvia64
IMAGE_NAME: IDSvia64.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4bfe2836
FAILURE_BUCKET_ID: X64_0x50_IDSvia64+3b0c8
BUCKET_ID: X64_0x50_IDSvia64+3b0c8
start end module name
fffff880`03e71000 fffff880`03ee7000 IDSvia64 T (no symbols)
Loaded symbol image file: IDSvia64.sys
Image path: \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100924.001\IDSvia64.sys
Image name: IDSvia64.sys
Timestamp: Thu May 27 11:07:18 2010 (4BFE2836)
CheckSum: 000757E9
ImageSize: 00076000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [G:\102110-15662-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e58000 PsLoadedModuleList = 0xfffff800`03095e50
Debug session time: Fri Oct 22 06:52:50.262 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:12.963
Loading Kernel Symbols
..................................................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {3, fffff8a000c69340, fffff8a000c69340, 40fffff8a000c693}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+c7b )
Followup: Pool_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffff8a000c69340, the pool entry being checked.
Arg3: fffff8a000c69340, the read back flink freelist value (should be the same as 2).
Arg4: 40fffff8a000c693, the read back blink freelist value (should be the same as 2).
Debugging Details:
------------------
BUGCHECK_STR: 0x19_3
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002ffb10b to fffff80002ec8740
STACK_TEXT:
fffff880`009a8608 fffff800`02ffb10b : 00000000`00000019 00000000`00000003 fffff8a0`00c69340 fffff8a0`00c69340 : nt!KeBugCheckEx
fffff880`009a8610 fffff800`02ffd4c1 : fffff8a0`00c7f970 fffff8a0`00c7f000 fffff880`009a8820 00000000`00173a0a : nt!ExDeferredFreePool+0xc7b
fffff880`009a86a0 fffff880`00d33f08 : 00000000`00000000 00000000`00173a0c 00000000`72634943 00000000`00000004 : nt!ExFreePoolWithTag+0x411
fffff880`009a8750 fffff880`00d338e0 : 00000000`00000000 00000000`00000007 fffff8a0`00c755e0 fffff8a0`00aa0b48 : CI!I_MinCryptGetCertificateEKUs+0x188
fffff880`009a87c0 fffff880`00d34f60 : 00000000`00174a64 00000000`00000000 00000000`000001af fffff8a0`00c786b0 : CI!MinCryptVerifyCertificateWithPolicy+0x214
fffff880`009a8960 fffff880`00d31179 : fffff8a0`00000001 00000000`00004e75 00000000`00173259 00000000`000007ff : CI!MinCrypK_VerifySignedDataKModeEx+0x2d4
fffff880`009a8ac0 fffff880`00d30e0a : 00000000`00000000 fffff8a0`00aa0ad8 00000000`00000000 00000000`00000000 : CI!I_ParseCatalog+0x101
fffff880`009a8c50 fffff880`00d31578 : fffff880`00004e75 fffff8a0`00aa0ad8 00000000`00170000 ffffffff`80000080 : CI!I_MapCatalog+0x19e
fffff880`009a8d00 fffff880`00d303dd : ffffffff`80000070 00000000`c0000428 fffff880`009a91d8 00000000`00000000 : CI!I_ReloadCatalogs+0x2cc
fffff880`009a8ea0 fffff880`00d2e9cd : fffff880`009a90f0 00000000`00000001 fffff880`00000000 00000000`00000000 : CI!I_FindFileOrHeaderHashInCatalogs+0x101
fffff880`009a8f40 fffff880`00d2f381 : fffffa80`04de1930 fffff880`009a90f0 00000000`00008004 00000000`00000000 : CI!CipFindFileHash+0xf9
fffff880`009a9010 fffff880`00d2dfbb : 00000000`00000001 fffff880`009a92d0 fffff880`009a92d0 00000000`00000000 : CI!CipValidateFileHash+0x311
fffff880`009a9180 fffff800`0313368e : 00000000`000001ab 00000000`000fffff fffffa80`04de1930 00000000`00000000 : CI!CiValidateImageHeader+0x213
fffff880`009a9260 fffff800`0313357c : 00000000`00000001 00000000`01000000 fffffa80`04e00c60 00000000`00000000 : nt!SeValidateImageHeader+0x2e
fffff880`009a92a0 fffff800`031c3d95 : fffffa80`04de1930 fffffa80`04e00c60 00000000`00000001 00000000`000001ab : nt!MiValidateImageHeader+0xa4
fffff880`009a9360 fffff800`031b9013 : fffff880`009a95c0 00000000`00000000 fffff880`009a9878 00000000`00000001 : nt!MmCreateSection+0x8c9
fffff880`009a9570 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateSection+0x162
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExDeferredFreePool+c7b
fffff800`02ffb10b cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExDeferredFreePool+c7b
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
FAILURE_BUCKET_ID: X64_0x19_3_nt!ExDeferredFreePool+c7b
BUCKET_ID: X64_0x19_3_nt!ExDeferredFreePool+c7b
Followup: Pool_corruption
---------
start end module name
fffff800`00bb3000 fffff800`00bbd000 kdcom kdcom.dll Tue Jul 14 04:31:07 2009 (4A5BDFDB)
fffff800`02e0f000 fffff800`033eb000 nt ntkrnlmp.exe Sat Jun 19 07:16:41 2010 (4C1C44A9)
fffff800`033eb000 fffff800`03434000 hal hal.dll Tue Jul 14 04:27:36 2009 (4A5BDF08)
fffff880`00c00000 fffff880`00ca4000 Wdf01000 Wdf01000.sys Tue Jul 14 02:22:07 2009 (4A5BC19F)
fffff880`00ca4000 fffff880`00cb3000 WDFLDR WDFLDR.SYS Tue Jul 14 02:19:54 2009 (4A5BC11A)
fffff880`00cbd000 fffff880`00cca000 mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Tue Jul 14 04:29:09 2009 (4A5BDF65)
fffff880`00cca000 fffff880`00cde000 PSHED PSHED.dll Tue Jul 14 04:32:23 2009 (4A5BE027)
fffff880`00cde000 fffff880`00d3c000 CLFS CLFS.SYS Tue Jul 14 02:19:57 2009 (4A5BC11D)
fffff880`00d3c000 fffff880`00dfc000 CI CI.dll Tue Jul 14 04:32:13 2009 (4A5BE01D)
fffff880`00e00000 fffff880`00e14000 SRTSPX64 SRTSPX64.SYS Thu Feb 25 01:59:48 2010 (4B85BD74)
fffff880`00e37000 fffff880`00e8e000 ACPI ACPI.sys Tue Jul 14 02:19:34 2009 (4A5BC106)
fffff880`00e8e000 fffff880`00e97000 WMILIB WMILIB.SYS Tue Jul 14 02:19:51 2009 (4A5BC117)
fffff880`00e97000 fffff880`00ea1000 msisadrv msisadrv.sys Tue Jul 14 02:19:26 2009 (4A5BC0FE)
fffff880`00ea1000 fffff880`00ed4000 pci pci.sys Tue Jul 14 02:19:51 2009 (4A5BC117)
fffff880`00ed4000 fffff880`00ee1000 vdrvroot vdrvroot.sys Tue Jul 14 03:01:31 2009 (4A5BCADB)
fffff880`00ee1000 fffff880`00ef6000 partmgr partmgr.sys Tue Jul 14 02:19:58 2009 (4A5BC11E)
fffff880`00ef6000 fffff880`00f0b000 volmgr volmgr.sys Tue Jul 14 02:19:57 2009 (4A5BC11D)
fffff880`00f0b000 fffff880`00f67000 volmgrx volmgrx.sys Tue Jul 14 02:20:33 2009 (4A5BC141)
fffff880`00f67000 fffff880`00f6e000 pciide pciide.sys Tue Jul 14 02:19:49 2009 (4A5BC115)
fffff880`00f6e000 fffff880`00f7e000 PCIIDEX PCIIDEX.SYS Tue Jul 14 02:19:48 2009 (4A5BC114)
fffff880`00f7e000 fffff880`00f98000 mountmgr mountmgr.sys Tue Jul 14 02:19:54 2009 (4A5BC11A)
fffff880`00f98000 fffff880`00fa1000 atapi atapi.sys Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`00fa1000 fffff880`00fcb000 ataport ataport.SYS Tue Jul 14 02:19:52 2009 (4A5BC118)
fffff880`00fcb000 fffff880`00fd6000 amdxata amdxata.sys Tue May 19 20:56:59 2009 (4A12F2EB)
fffff880`00fd6000 fffff880`00ffd000 Ironx64 Ironx64.SYS Wed Apr 28 03:48:23 2010 (4BD785D7)
fffff880`01000000 fffff880`0102a000 cdrom cdrom.sys Tue Jul 14 02:19:54 2009 (4A5BC11A)
fffff880`0102a000 fffff880`01035000 Msfs Msfs.SYS Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`01035000 fffff880`01046000 Npfs Npfs.SYS Tue Jul 14 02:19:48 2009 (4A5BC114)
fffff880`01046000 fffff880`01064000 tdx tdx.sys Tue Jul 14 02:21:15 2009 (4A5BC16B)
fffff880`01064000 fffff880`01071000 TDI TDI.SYS Tue Jul 14 02:21:18 2009 (4A5BC16E)
fffff880`01071000 fffff880`010bd000 fltmgr fltmgr.sys Tue Jul 14 02:19:59 2009 (4A5BC11F)
fffff880`010bd000 fffff880`0112b000 SYMDS64 SYMDS64.SYS Tue Aug 18 02:35:30 2009 (4A89E942)
fffff880`0112b000 fffff880`0113f000 fileinfo fileinfo.sys Tue Jul 14 02:34:25 2009 (4A5BC481)
fffff880`0113f000 fffff880`0117a000 SYMEFA64 SYMEFA64.SYS Thu Apr 22 00:47:39 2010 (4BCF727B)
fffff880`0117a000 fffff880`011d8000 msrpc msrpc.sys Tue Jul 14 02:21:32 2009 (4A5BC17C)
fffff880`011d8000 fffff880`011f3000 wanarp wanarp.sys Tue Jul 14 03:10:21 2009 (4A5BCCED)
fffff880`01200000 fffff880`01225000 VIDEOPRT VIDEOPRT.SYS Tue Jul 14 02:38:51 2009 (4A5BC58B)
fffff880`01229000 fffff880`013cc000 Ntfs Ntfs.sys Tue Jul 14 02:20:47 2009 (4A5BC14F)
fffff880`013cc000 fffff880`013e6000 ksecdd ksecdd.sys Tue Jul 14 02:20:54 2009 (4A5BC156)
fffff880`013e6000 fffff880`013f6000 watchdog watchdog.sys Tue Jul 14 02:37:35 2009 (4A5BC53F)
fffff880`013f6000 fffff880`013ff000 rdprefmp rdprefmp.sys Tue Jul 14 03:16:35 2009 (4A5BCE63)
fffff880`01400000 fffff880`01430000 CLASSPNP CLASSPNP.SYS Tue Jul 14 02:19:58 2009 (4A5BC11E)
fffff880`01430000 fffff880`0143e000 crashdmp crashdmp.sys Tue Jul 14 03:01:01 2009 (4A5BCABD)
fffff880`0143e000 fffff880`0144a000 dump_dumpata dump_dumpata.sys Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`0144a000 fffff880`01453000 dump_atapi dump_atapi.sys Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`01453000 fffff880`01466000 dump_dumpfve dump_dumpfve.sys Tue Jul 14 02:21:51 2009 (4A5BC18F)
fffff880`01466000 fffff880`0146f000 Null Null.SYS Tue Jul 14 02:19:37 2009 (4A5BC109)
fffff880`0146f000 fffff880`01476000 Beep Beep.SYS Tue Jul 14 03:00:13 2009 (4A5BCA8D)
fffff880`01476000 fffff880`0147f000 rdpencdd rdpencdd.sys Tue Jul 14 03:16:34 2009 (4A5BCE62)
fffff880`01481000 fffff880`014f4000 cng cng.sys Tue Jul 14 02:49:40 2009 (4A5BC814)
fffff880`014f4000 fffff880`01505000 pcw pcw.sys Tue Jul 14 02:19:27 2009 (4A5BC0FF)
fffff880`01505000 fffff880`0150f000 Fs_Rec Fs_Rec.sys Tue Jul 14 02:19:45 2009 (4A5BC111)
fffff880`0150f000 fffff880`0155b000 volsnap volsnap.sys Tue Jul 14 02:20:08 2009 (4A5BC128)
fffff880`0155b000 fffff880`01595000 rdyboost rdyboost.sys Tue Jul 14 02:34:34 2009 (4A5BC48A)
fffff880`01595000 fffff880`015cf000 fvevol fvevol.sys Tue Jul 14 02:22:15 2009 (4A5BC1A7)
fffff880`015cf000 fffff880`015e5000 disk disk.sys Tue Jul 14 02:19:57 2009 (4A5BC11D)
fffff880`015e5000 fffff880`015f3000 vga vga.sys Tue Jul 14 02:38:47 2009 (4A5BC587)
fffff880`015f3000 fffff880`015fc000 RDPCDD RDPCDD.sys Tue Jul 14 03:16:34 2009 (4A5BCE62)
fffff880`01600000 fffff880`01660000 NETIO NETIO.SYS Tue Jul 14 02:21:46 2009 (4A5BC18A)
fffff880`01660000 fffff880`0168b000 ksecpkg ksecpkg.sys Fri Dec 11 08:03:32 2009 (4B21E0B4)
fffff880`0168b000 fffff880`016d5000 fwpkclnt fwpkclnt.sys Tue Jul 14 02:21:08 2009 (4A5BC164)
fffff880`016d5000 fffff880`016e5000 vmstorfl vmstorfl.sys Tue Jul 14 02:42:54 2009 (4A5BC67E)
fffff880`016e5000 fffff880`016ed000 spldr spldr.sys Mon May 11 19:56:27 2009 (4A0858BB)
fffff880`016ee000 fffff880`017e0000 ndis ndis.sys Tue Jul 14 02:21:40 2009 (4A5BC184)
fffff880`017e0000 fffff880`017f2000 mup mup.sys Tue Jul 14 02:23:45 2009 (4A5BC201)
fffff880`017f2000 fffff880`017fb000 hwpolicy hwpolicy.sys Tue Jul 14 02:19:22 2009 (4A5BC0FA)
fffff880`01800000 fffff880`019fd000 tcpip tcpip.sys Mon Jun 14 06:39:04 2010 (4C15A458)
fffff880`02c00000 fffff880`02c45000 netbt netbt.sys Tue Jul 14 02:21:28 2009 (4A5BC178)
fffff880`02c45000 fffff880`02c4e000 wfplwf wfplwf.sys Tue Jul 14 03:09:26 2009 (4A5BCCB6)
fffff880`02c4e000 fffff880`02c74000 pacer pacer.sys Tue Jul 14 03:09:41 2009 (4A5BCCC5)
fffff880`02c74000 fffff880`02c83000 netbios netbios.sys Tue Jul 14 03:09:26 2009 (4A5BCCB6)
fffff880`02c93000 fffff880`02d09000 SYMTDIV SYMTDIV.SYS Tue May 04 07:38:27 2010 (4BDFA4C3)
fffff880`02d09000 fffff880`02d3f000 SYMEVENT64x86 SYMEVENT64x86.SYS Fri Aug 14 01:28:21 2009 (4A849385)
fffff880`02d3f000 fffff880`02dc9000 afd afd.sys Tue Jul 14 02:21:40 2009 (4A5BC184)
fffff880`02dc9000 fffff880`02de6000 serial serial.sys Tue Jul 14 03:00:40 2009 (4A5BCAA8)
fffff880`02de6000 fffff880`02dfa000 termdd termdd.sys Tue Jul 14 03:16:36 2009 (4A5BCE64)
fffff880`03e00000 fffff880`03e43000 ks ks.sys Tue Jul 14 03:00:31 2009 (4A5BCA9F)
fffff880`03e43000 fffff880`03e55000 umbus umbus.sys Tue Jul 14 03:06:56 2009 (4A5BCC20)
fffff880`03e78000 fffff880`03ec9000 rdbss rdbss.sys Tue Jul 14 02:24:09 2009 (4A5BC219)
fffff880`03ec9000 fffff880`03ed5000 nsiproxy nsiproxy.sys Tue Jul 14 02:21:02 2009 (4A5BC15E)
fffff880`03ed5000 fffff880`03ee0000 mssmbios mssmbios.sys Tue Jul 14 02:31:10 2009 (4A5BC3BE)
fffff880`03ee0000 fffff880`03f56000 IDSvia64 IDSvia64.sys Thu May 27 11:07:18 2010 (4BFE2836)
fffff880`03f56000 fffff880`03fcc000 eeCtrl64 eeCtrl64.sys Sat May 22 00:44:45 2010 (4BF6FECD)
fffff880`03fcc000 fffff880`03fdb000 discache discache.sys Tue Jul 14 02:37:18 2009 (4A5BC52E)
fffff880`03fdb000 fffff880`03fea000 mouclass mouclass.sys Tue Jul 14 02:19:50 2009 (4A5BC116)
fffff880`04000000 fffff880`04021000 raspptp raspptp.sys Tue Jul 14 03:10:18 2009 (4A5BCCEA)
fffff880`04027000 fffff880`040aa000 csc csc.sys Tue Jul 14 02:24:26 2009 (4A5BC22A)
fffff880`040aa000 fffff880`040c8000 dfsc dfsc.sys Tue Jul 14 02:23:44 2009 (4A5BC200)
fffff880`040c8000 fffff880`04164000 ccHPx64 ccHPx64.sys Fri Feb 05 23:05:45 2010 (4B6C8829)
fffff880`04164000 fffff880`04175000 blbdrive blbdrive.sys Tue Jul 14 02:35:59 2009 (4A5BC4DF)
fffff880`04175000 fffff880`04199000 rasl2tp rasl2tp.sys Tue Jul 14 03:10:11 2009 (4A5BCCE3)
fffff880`04199000 fffff880`041c8000 ndiswan ndiswan.sys Tue Jul 14 03:10:11 2009 (4A5BCCE3)
fffff880`041c8000 fffff880`041e3000 raspppoe raspppoe.sys Tue Jul 14 03:10:17 2009 (4A5BCCE9)
fffff880`041e3000 fffff880`041fd000 rassstp rassstp.sys Tue Jul 14 03:10:25 2009 (4A5BCCF1)
fffff880`04200000 fffff880`0424a000 atikmpag atikmpag.sys Thu Aug 26 04:20:56 2010 (4C75C178)
fffff880`0424a000 fffff880`042a0000 USBPORT USBPORT.SYS Tue Jul 14 03:06:31 2009 (4A5BCC07)
fffff880`042a0000 fffff880`042af000 kbdclass kbdclass.sys Tue Jul 14 02:19:50 2009 (4A5BC116)
fffff880`042b3000 fffff880`043a0000 BHDrvx64 BHDrvx64.sys Sat Aug 28 01:11:09 2010 (4C7837FD)
fffff880`043a0000 fffff880`043c6000 tunnel tunnel.sys Tue Jul 14 03:09:37 2009 (4A5BCCC1)
fffff880`043c6000 fffff880`043db000 amdppm amdppm.sys Tue Jul 14 02:19:25 2009 (4A5BC0FD)
fffff880`043db000 fffff880`043f1000 AgileVpn AgileVpn.sys Tue Jul 14 03:10:24 2009 (4A5BCCF0)
fffff880`043f1000 fffff880`043fc000 rdpbus rdpbus.sys Tue Jul 14 03:17:46 2009 (4A5BCEAA)
fffff880`04400000 fffff880`0440c000 serenum serenum.sys Tue Jul 14 03:00:33 2009 (4A5BCAA1)
fffff880`0440c000 fffff880`0440d480 swenum swenum.sys Tue Jul 14 03:00:18 2009 (4A5BCA92)
fffff880`0440e000 fffff880`04502000 dxgkrnl dxgkrnl.sys Fri Oct 02 04:00:14 2009 (4AC5509E)
fffff880`04502000 fffff880`04548000 dxgmms1 dxgmms1.sys Tue Jul 14 02:38:32 2009 (4A5BC578)
fffff880`04548000 fffff880`0456c000 HDAudBus HDAudBus.sys Tue Jul 14 03:06:13 2009 (4A5BCBF5)
fffff880`0456c000 fffff880`045c2000 Rt64win7 Rt64win7.sys Wed Jun 23 12:10:45 2010 (4C21CF95)
fffff880`045c2000 fffff880`045cf000 GEARAspiWDM GEARAspiWDM.sys Mon May 18 15:17:04 2009 (4A1151C0)
fffff880`045cf000 fffff880`045da000 usbohci usbohci.sys Tue Jul 14 03:06:30 2009 (4A5BCC06)
fffff880`045da000 fffff880`045eb000 usbehci usbehci.sys Tue Jul 14 03:06:30 2009 (4A5BCC06)
fffff880`045eb000 fffff880`045f8000 fdc fdc.sys Tue Jul 14 03:00:54 2009 (4A5BCAB6)
fffff880`04800000 fffff880`04fbb000 atikmdag atikmdag.sys Thu Aug 26 04:47:22 2010 (4C75C7AA)
fffff880`04fbb000 fffff880`04fd8000 parport parport.sys Tue Jul 14 03:00:40 2009 (4A5BCAA8)
fffff880`04fd8000 fffff880`04fe1000 wmiacpi wmiacpi.sys Tue Jul 14 02:31:02 2009 (4A5BC3B6)
fffff880`04fe1000 fffff880`04ff1000 CompositeBus CompositeBus.sys Tue Jul 14 03:00:33 2009 (4A5BCAA1)
fffff880`04ff1000 fffff880`04ffd000 ndistapi ndistapi.sys Tue Jul 14 03:10:00 2009 (4A5BCCD8)
fffff880`05c00000 fffff880`05c1d000 usbccgp usbccgp.sys Tue Jul 14 03:06:45 2009 (4A5BCC15)
fffff880`05c1d000 fffff880`05c1ef00 USBD USBD.SYS Tue Jul 14 03:06:23 2009 (4A5BCBFF)
fffff880`05c1f000 fffff880`05c2d000 hidusb hidusb.sys Tue Jul 14 03:06:22 2009 (4A5BCBFE)
fffff880`05c2d000 fffff880`05c46000 HIDCLASS HIDCLASS.SYS Tue Jul 14 03:06:21 2009 (4A5BCBFD)
fffff880`05c46000 fffff880`05c4e080 HIDPARSE HIDPARSE.SYS Tue Jul 14 03:06:17 2009 (4A5BCBF9)
fffff880`05c4f000 fffff880`05c5d000 kbdhid kbdhid.sys Tue Jul 14 03:00:20 2009 (4A5BCA94)
fffff880`05ca0000 fffff880`05cfa000 usbhub usbhub.sys Tue Jul 14 03:07:09 2009 (4A5BCC2D)
fffff880`05cfa000 fffff880`05d05000 flpydisk flpydisk.sys Tue Jul 14 03:00:54 2009 (4A5BCAB6)
fffff880`05d05000 fffff880`05d1a000 NDProxy NDProxy.SYS Tue Jul 14 03:10:05 2009 (4A5BCCDD)
fffff880`05d1a000 fffff880`05d3a000 AtihdW76 AtihdW76.sys Mon Aug 16 13:41:02 2010 (4C6915BE)
fffff880`05d3a000 fffff880`05d77000 portcls portcls.sys Tue Jul 14 03:06:27 2009 (4A5BCC03)
fffff880`05d77000 fffff880`05d99000 drmk drmk.sys Tue Jul 14 04:01:25 2009 (4A5BD8E5)
fffff880`05d99000 fffff880`05d9e200 ksthunk ksthunk.sys Tue Jul 14 03:00:19 2009 (4A5BCA93)
fffff880`05d9f000 fffff880`05dfb000 HdAudio HdAudio.sys Tue Jul 14 03:06:59 2009 (4A5BCC23)