Code:
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\antpman\Ants Report\Windows_NT6_BSOD_jcgriff2\121711-27003-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03608000 PsLoadedModuleList = 0xfffff800`0384d670
Debug session time: Sat Dec 17 18:07:27.729 2011 (UTC - 7:00)
System Uptime: 1 days 3:58:52.430
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
..........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck DE, {2, fffff8a012a06810, fffff8a015d8be11, 4d7888c0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2d8a1 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
POOL_CORRUPTION_IN_FILE_AREA (de)
A driver corrupted pool memory used for holding pages destined for disk.
This was discovered by the memory manager when dereferencing the file.
Arguments:
Arg1: 0000000000000002
Arg2: fffff8a012a06810
Arg3: fffff8a015d8be11
Arg4: 000000004d7888c0
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xDE
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff8000363b4bd to fffff80003684c40
STACK_TEXT:
fffff880`0317e2d8 fffff800`0363b4bd : 00000000`000000de 00000000`00000002 fffff8a0`12a06810 fffff8a0`15d8be11 : nt!KeBugCheckEx
fffff880`0317e2e0 fffff800`03653532 : 00000000`00000000 fffffa80`0a3f9300 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x2d8a1
fffff880`0317e3d0 fffff880`012879ef : fffffa80`05a13608 fffffa80`0b311e40 00000000`00000000 fffffa80`00000000 : nt!CcPurgeCacheSection+0x172
fffff880`0317e440 fffff880`012b584e : fffffa80`0b311e40 fffff8a0`10fccc70 00000000`00000000 fffff8a0`10fccc01 : Ntfs!NtfsFlushAndPurgeScb+0x1bd
fffff880`0317e4d0 fffff880`012a3fe5 : fffffa80`0b311e40 fffffa80`057b5f20 fffffa80`0638a180 fffff8a0`10fcced8 : Ntfs!NtfsOpenAttribute+0x80e
fffff880`0317e5e0 fffff880`0129fe3b : fffff880`0bfa04a0 fffffa80`0b311e40 fffff8a0`10fcced8 fffff8a0`00000054 : Ntfs!NtfsOpenExistingAttr+0x145
fffff880`0317e6a0 fffff880`012a309f : fffffa80`0b311e40 fffffa80`057b5c10 fffff8a0`10fcced8 fffff880`00000054 : Ntfs!NtfsOpenAttributeInExistingFile+0x5ab
fffff880`0317e830 fffff880`012b3166 : fffffa80`0b311e40 fffffa80`057b5c10 fffff8a0`10fcced8 fffffa80`0692d001 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
fffff880`0317e920 fffff880`012b0911 : fffffa80`0b311e40 fffffa80`057b5c10 fffff880`0317eaf0 fffff880`0317eb40 : Ntfs!NtfsFindStartingNode+0x5e6
fffff880`0317e9f0 fffff880`0120e945 : fffffa80`0b311e40 fffffa80`057b5c10 fffff880`0bfa04a0 fffff800`0368cf00 : Ntfs!NtfsCommonCreate+0x3e1
fffff880`0317ebd0 fffff800`0368f001 : fffff800`03825200 fffff800`0397b900 fffffa80`0524e700 fffffa80`00000000 : Ntfs!NtfsFspDispatch+0x26d
fffff880`0317ecb0 fffff800`0391ffee : 00000000`00000000 fffffa80`0524e7c0 00000000`00000080 fffffa80`05189b30 : nt!ExpWorkerThread+0x111
fffff880`0317ed40 fffff800`036765e6 : fffff880`02f63180 fffffa80`0524e7c0 fffff880`02f6dfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0317ed80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+2d8a1
fffff800`0363b4bd cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+2d8a1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0xDE_nt!_??_::FNODOBFM::_string_+2d8a1
BUCKET_ID: X64_0xDE_nt!_??_::FNODOBFM::_string_+2d8a1
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\antpman\Ants Report\Windows_NT6_BSOD_jcgriff2\121811-41589-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03652000 PsLoadedModuleList = 0xfffff800`03897670
Debug session time: Sat Dec 17 19:45:18.208 2011 (UTC - 7:00)
System Uptime: 0 days 1:36:24.284
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, bc40e, 0, 8848e}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000bc40e, page frame number
Arg3: 0000000000000000, current page state
Arg4: 000000000008848e, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80003757d7c to fffff800036cec40
STACK_TEXT:
fffff880`03316818 fffff800`03757d7c : 00000000`0000004e 00000000`00000099 00000000`000bc40e 00000000`00000000 : nt!KeBugCheckEx
fffff880`03316820 fffff800`0367e442 : ffffffff`ffffffff 00000000`00000001 ffffffff`ffffffff 00000000`00000000 : nt!MiBadShareCount+0x4c
fffff880`03316860 fffff800`037d069a : fffff800`039045c0 fffff880`03316a70 00000000`00000000 fffff800`0000000f : nt! ?? ::FNODOBFM::`string'+0x21513
fffff880`03316a50 fffff800`0374a977 : fffffa80`05216040 fffff880`00000001 00000000`00000000 fffffa80`05189b30 : nt!MiEmptyWorkingSet+0x24a
fffff880`03316b00 fffff800`036b9826 : 00000000`0000169a 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4d602
fffff880`03316b80 fffff800`036b9c48 : 00000000`00000008 fffff880`03316c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03316bd0 fffff800`03969fee : fffffa80`05216040 00000000`00000080 fffffa80`05189b30 00000000`00000001 : nt!KeBalanceSetManager+0x138
fffff880`03316d40 fffff800`036c05e6 : fffff880`02f64180 fffffa80`05216040 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03316d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`03757d7c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\antpman\Ants Report\Windows_NT6_BSOD_jcgriff2\121911-26036-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03612000 PsLoadedModuleList = 0xfffff800`03857670
Debug session time: Mon Dec 19 06:37:55.796 2011 (UTC - 7:00)
System Uptime: 0 days 0:00:12.497
Loading Kernel Symbols
...............................................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {3, fffffa80051774d0, 0, fffffa80051774d0}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+a53 )
Followup: Pool_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffffa80051774d0, the pool entry being checked.
Arg3: 0000000000000000, the read back flink freelist value (should be the same as 2).
Arg4: fffffa80051774d0, the read back blink freelist value (should be the same as 2).
Debugging Details:
------------------
BUGCHECK_STR: 0x19_3
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800037bc4b3 to fffff8000368ec40
STACK_TEXT:
fffff880`009a86e8 fffff800`037bc4b3 : 00000000`00000019 00000000`00000003 fffffa80`051774d0 00000000`00000000 : nt!KeBugCheckEx
fffff880`009a86f0 fffff880`00c0e0e5 : fffff8a0`00000001 00000000`0038334d fffff8a0`002f2000 fffff800`00000000 : nt!ExDeferredFreePool+0xa53
fffff880`009a87e0 fffff880`00c0de16 : 00000000`00000000 fffff8a0`002b53b0 00000000`00000000 00000000`00000000 : CI!I_ParseCatalog+0x61
fffff880`009a8970 fffff880`00c0d387 : 00000000`0038334d fffff8a0`002b53b0 00000000`000c0000 ffffffff`80000148 : CI!I_MapCatalog+0x19e
fffff880`009a8a20 fffff880`00c0b9cd : fffff880`009a8c70 ffffffff`00000001 00000000`00000000 fffff880`00000000 : CI!I_FindFileOrHeaderHashInCatalogs+0xab
fffff880`009a8ac0 fffff880`00c0c381 : fffffa80`0601d790 fffff880`009a8c70 00000000`00008004 00000000`00000000 : CI!CipFindFileHash+0xf9
fffff880`009a8b90 fffff880`00c0afbb : 00000000`00000001 fffff880`009a8e50 fffff880`009a8e50 00000000`00000000 : CI!CipValidateFileHash+0x311
fffff880`009a8d00 fffff800`038fba44 : 00000000`0000002a 00000000`000fffff fffffa80`0601d790 00000000`00000000 : CI!CiValidateImageHeader+0x213
fffff880`009a8de0 fffff800`038fb84a : 00000000`00000000 00000000`00000080 fffffa80`051894d0 00000000`00000000 : nt!SeValidateImageHeader+0x58
fffff880`009a8e20 fffff800`0398c086 : fffffa80`0601d790 fffffa80`051894d0 00000000`00000001 00000000`0000002a : nt!MiValidateImageHeader+0x21a
fffff880`009a8ef0 fffff800`0396a596 : fffff880`009a9140 fffff880`009a9260 fffff880`009a93f8 00000000`00000001 : nt!MmCreateSection+0x966
fffff880`009a90f0 fffff800`0368ded3 : fffffa80`051f6040 fffff880`009a9398 fffff880`009a9188 00000000`00000000 : nt!NtCreateSection+0x171
fffff880`009a9170 fffff800`0368a470 : fffff800`03a66c26 00000000`00000000 fffff8a0`004f66e0 00000000`20206f49 : nt!KiSystemServiceCopyEnd+0x13
fffff880`009a9378 fffff800`03a66c26 : 00000000`00000000 fffff8a0`004f66e0 00000000`20206f49 fffffa80`052550c0 : nt!KiServiceLinkage
fffff880`009a9380 fffff800`03a66fec : ffffffff`80000140 fffffa80`00100000 fffffa80`052550c0 00000000`00000000 : nt!MmCheckSystemImage+0x96
fffff880`009a94b0 fffff800`03a67207 : ffffffff`80000140 fffff800`00000001 00000000`00000000 00000000`00000000 : nt!MiCreateSectionForDriver+0xcc
fffff880`009a9560 fffff800`03a72dfd : 00000000`00000000 00000000`00000000 fffffa80`051f6040 00000000`00000000 : nt!MiObtainSectionForDriver+0xd7
fffff880`009a95c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmLoadSystemImage+0x23d
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExDeferredFreePool+a53
fffff800`037bc4b3 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExDeferredFreePool+a53
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
FAILURE_BUCKET_ID: X64_0x19_3_nt!ExDeferredFreePool+a53
BUCKET_ID: X64_0x19_3_nt!ExDeferredFreePool+a53
Followup: Pool_corruption
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\antpman\Ants Report\Windows_NT6_BSOD_jcgriff2\122011-25006-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03606000 PsLoadedModuleList = 0xfffff800`0384b670
Debug session time: Tue Dec 20 00:53:57.698 2011 (UTC - 7:00)
System Uptime: 0 days 10:05:16.400
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffff6800027baf0, 0, 0, fffff8000366d27b}
Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+1d1 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff6800027baf0, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000366d27b, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800038b5100
fffff6800027baf0
CURRENT_IRQL: 0
FAULTING_IP:
nt!MiAgeWorkingSet+1d1
fffff800`0366d27b 488b19 mov rbx,qword ptr [rcx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: sidebar.exe
TRAP_FRAME: fffff880033167c0 -- (.trap 0xfffff880033167c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000007ffffffff8 rbx=0000000000000000 rcx=fffff6800027baf0
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000366d27b rsp=fffff88003316950 rbp=000000000027baf0
r8=0000000000000001 r9=fffffa8006f50ec8 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!MiAgeWorkingSet+0x1d1:
fffff800`0366d27b 488b19 mov rbx,qword ptr [rcx] ds:0488:fffff680`0027baf0=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800036821e9 to fffff80003682c40
STACK_TEXT:
fffff880`03316678 fffff800`036821e9 : 00000000`0000000a fffff680`0027baf0 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`03316680 fffff800`03680e60 : 00000000`00000000 fffff680`0027baf0 00000000`00001000 00000980`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`033167c0 fffff800`0366d27b : 00000003`00000000 d2200000`c24a1867 00000000`00000000 00000000`00003d22 : nt!KiPageFault+0x260
fffff880`03316950 fffff800`036feac5 : fffffa80`06f50ec8 fffff880`00000001 00000000`00000001 fffff880`03316bb0 : nt!MiAgeWorkingSet+0x1d1
fffff880`03316b00 fffff800`0366d826 : 00000000`000068f4 00000000`00000000 fffffa80`00000000 00000000`00000008 : nt! ?? ::FNODOBFM::`string'+0x4d786
fffff880`03316b80 fffff800`0366dcd3 : 00000000`00000008 fffff880`03316c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03316bd0 fffff800`0391dfee : fffffa80`05206040 00000000`00000080 fffffa80`05189b30 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`03316d40 fffff800`036745e6 : fffff880`02f63180 fffffa80`05206040 fffff880`02f6dfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03316d80 00000000`00000000 : fffff880`03317000 fffff880`03311000 fffff880`03316830 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiAgeWorkingSet+1d1
fffff800`0366d27b 488b19 mov rbx,qword ptr [rcx]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiAgeWorkingSet+1d1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xA_nt!MiAgeWorkingSet+1d1
BUCKET_ID: X64_0xA_nt!MiAgeWorkingSet+1d1
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\antpman\Ants Report\Windows_NT6_BSOD_jcgriff2\122011-26067-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03655000 PsLoadedModuleList = 0xfffff800`0389a670
Debug session time: Tue Dec 20 02:21:49.699 2011 (UTC - 7:00)
System Uptime: 0 days 1:26:26.400
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff68000dfab70, 0, fffff800036bc27b, 2}
Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+1d1 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff68000dfab70, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800036bc27b, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003904100
fffff68000dfab70
FAULTING_IP:
nt!MiAgeWorkingSet+1d1
fffff800`036bc27b 488b19 mov rbx,qword ptr [rcx]
MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: WLIDSVC.EXE
CURRENT_IRQL: 0
TRAP_FRAME: fffff880033167c0 -- (.trap 0xfffff880033167c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000007ffffffff8 rbx=0000000000000000 rcx=fffff68000dfab70
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800036bc27b rsp=fffff88003316950 rbp=0000000000dfab76
r8=0000000000000001 r9=fffffa800a4d3ec8 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
nt!MiAgeWorkingSet+0x1d1:
fffff800`036bc27b 488b19 mov rbx,qword ptr [rcx] ds:fffff680`00dfab70=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000367c3f0 to fffff800036d1c40
STACK_TEXT:
fffff880`03316658 fffff800`0367c3f0 : 00000000`00000050 fffff680`00dfab70 00000000`00000000 fffff880`033167c0 : nt!KeBugCheckEx
fffff880`03316660 fffff800`036cfd6e : 00000000`00000000 fffff680`00dfab70 00000000`00001000 00000980`00000000 : nt! ?? ::FNODOBFM::`string'+0x447c6
fffff880`033167c0 fffff800`036bc27b : 00000003`00000000 a6d00000`cd887867 00000000`00000000 00000000`00000a6d : nt!KiPageFault+0x16e
fffff880`03316950 fffff800`0374dac5 : fffffa80`0a4d3ec8 fffff880`00000001 00000000`00000001 fffff880`03316bb0 : nt!MiAgeWorkingSet+0x1d1
fffff880`03316b00 fffff800`036bc826 : 00000000`00001442 00000000`00000000 fffffa80`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x4d786
fffff880`03316b80 fffff800`036bccd3 : 00000000`00000008 fffff880`03316c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03316bd0 fffff800`0396cfee : fffffa80`05216040 00000000`00000080 fffffa80`05189b30 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`03316d40 fffff800`036c35e6 : fffff880`02f64180 fffffa80`05216040 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03316d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiAgeWorkingSet+1d1
fffff800`036bc27b 488b19 mov rbx,qword ptr [rcx]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiAgeWorkingSet+1d1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x50_nt!MiAgeWorkingSet+1d1
BUCKET_ID: X64_0x50_nt!MiAgeWorkingSet+1d1
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\antpman\Ants Report\Windows_NT6_BSOD_jcgriff2\122011-28610-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03652000 PsLoadedModuleList = 0xfffff800`03897670
Debug session time: Tue Dec 20 21:18:08.353 2011 (UTC - 7:00)
System Uptime: 0 days 5:01:44.038
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41284, 350001, 0, fffff70001080000}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4ac3 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: 0000000000350001
Arg3: 0000000000000000
Arg4: fffff70001080000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41284
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800037265a7 to fffff800036cec40
STACK_TEXT:
fffff880`078a8988 fffff800`037265a7 : 00000000`0000001a 00000000`00041284 00000000`00350001 00000000`00000000 : nt!KeBugCheckEx
fffff880`078a8990 fffff800`0366a464 : 00000000`06000001 fffffa80`09c3d420 fffffa80`000000b0 fffff880`00000000 : nt! ?? ::FNODOBFM::`string'+0x4ac3
fffff880`078a89d0 fffff800`039a9a38 : 00000000`00000000 00000000`00000001 fffffa80`09c40180 00020bea`00020410 : nt!MiGetWorkingSetInfoList+0x5a4
fffff880`078a8ac0 fffff800`036cded3 : 00000000`0000016c fffffa80`0a1ee060 00000000`00000000 00000000`0020e6e8 : nt!NtQueryVirtualMemory+0x696
fffff880`078a8bb0 00000000`77aa154a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0020e6c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77aa154a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4ac3
fffff800`037265a7 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4ac3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4ac3
BUCKET_ID: X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4ac3
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\antpman\Ants Report\Windows_NT6_BSOD_jcgriff2\123011-31715-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03651000 PsLoadedModuleList = 0xfffff800`03896670
Debug session time: Fri Dec 30 15:43:25.846 2011 (UTC - 7:00)
System Uptime: 2 days 4:38:55.547
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41284, 2d3a9001, 4e6f, fffff70001080000}
Unable to load image \SystemRoot\System32\win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : win32k.sys ( win32k+c6644 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: 000000002d3a9001
Arg3: 0000000000004e6f
Arg4: fffff70001080000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41284
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: sidebar.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800037255a7 to fffff800036cdc40
STACK_TEXT:
fffff880`0a38ee48 fffff800`037255a7 : 00000000`0000001a 00000000`00041284 00000000`2d3a9001 00000000`00004e6f : nt!KeBugCheckEx
fffff880`0a38ee50 fffff800`036ffc80 : fffff700`01080000 e6f00001`7dcf4867 ffffffff`ffffffff fffff800`037fc1de : nt! ?? ::FNODOBFM::`string'+0x4ac3
fffff880`0a38ee90 fffff800`036bb0ff : fffffa80`00000000 00000000`2d3adfff 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x4e8
fffff880`0a38f050 fffff800`036cced3 : ffffffff`ffffffff fffff880`0a38f320 fffff880`0a38f388 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`0a38f150 fffff800`036c9470 : fffff960`00106644 00000000`00000001 00000000`00000000 fffff900`c2487cc0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0a38f2e8 fffff960`00106644 : 00000000`00000001 00000000`00000000 fffff900`c2487cc0 00000000`00000000 : nt!KiServiceLinkage
fffff880`0a38f2f0 00000000`00000001 : 00000000`00000000 fffff900`c2487cc0 00000000`00000000 fffffa80`06872305 : win32k+0xc6644
fffff880`0a38f2f8 00000000`00000000 : fffff900`c2487cc0 00000000`00000000 fffffa80`06872305 ffffffff`ffffffff : 0x1
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k+c6644
fffff960`00106644 ?? ???
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: win32k+c6644
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
FAILURE_BUCKET_ID: X64_0x1a_41284_win32k+c6644
BUCKET_ID: X64_0x1a_41284_win32k+c6644
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\antpman\Ants Report\Windows_NT6_BSOD_jcgriff2\010212-25147-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03662000 PsLoadedModuleList = 0xfffff800`038a7670
Debug session time: Mon Jan 2 00:36:18.050 2012 (UTC - 7:00)
System Uptime: 2 days 8:51:26.110
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
............................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 19eaa6, 2, 19ea99}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000019eaa6, page frame number
Arg3: 0000000000000002, current page state
Arg4: 000000000019ea99, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: audiodg.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80003767d7c to fffff800036dec40
STACK_TEXT:
fffff880`0a038638 fffff800`03767d7c : 00000000`0000004e 00000000`00000099 00000000`0019eaa6 00000000`00000002 : nt!KeBugCheckEx
fffff880`0a038640 fffff800`036863d7 : 00000000`00000000 fffff680`0033e800 1d900001`97e65005 00000000`00000011 : nt!MiBadShareCount+0x4c
fffff880`0a038680 fffff800`03710bb7 : 00000003`00000000 fffff680`0033ef28 fffffa80`0bd6c060 c2c00000`b7b42867 : nt! ?? ::FNODOBFM::`string'+0x3309d
fffff880`0a038830 fffff800`03712569 : 00000000`00000000 00000000`67fb4fff 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x41f
fffff880`0a0389f0 fffff800`039f6221 : fffffa80`06e7fba0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0a038b10 fffff800`039f6623 : 0000007f`00000000 00000000`67c00000 fffffa80`00000001 fffffa80`056add50 : nt!MiUnmapViewOfSection+0x1b1
fffff880`0a038bd0 fffff800`036dded3 : 00000000`00000008 00000000`67ca0114 fffffa80`0bd6c060 00000000`00000000 : nt!NtUnmapViewOfSection+0x5f
fffff880`0a038c20 00000000`775c15ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0014f7c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x775c15ba
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`03767d7c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\antpman\Ants Report\Windows_NT6_BSOD_jcgriff2\010312-27970-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03659000 PsLoadedModuleList = 0xfffff800`0389e670
Debug session time: Tue Jan 3 08:39:24.926 2012 (UTC - 7:00)
System Uptime: 1 days 8:01:39.001
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
.......................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800789c868, fffff8800789c0c0, fffff800036e7600}
Probably caused by : Ntfs.sys ( Ntfs!NtfsCreateScb+f9 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800789c868
Arg3: fffff8800789c0c0
Arg4: fffff800036e7600
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800789c868 -- (.exr 0xfffff8800789c868)
ExceptionAddress: fffff800036e7600 (nt!ExIsResourceAcquiredExclusiveLite)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8800789c0c0 -- (.cxr 0xfffff8800789c0c0)
rax=fffff8a0078cd670 rbx=fffff8a0038cd7a0 rcx=0075004d002e00ad
rdx=0000000000000000 rsi=fffff8a0038cd670 rdi=fffff8800789cbb0
rip=fffff800036e7600 rsp=fffff8800789caa8 rbp=fffffa8005ae9ce0
r8=fffffa800918e958 r9=fffff8800789d150 r10=fffffa8005ae9ce0
r11=0000000000000000 r12=fffff8a0038cd6a0 r13=fffff8800789d150
r14=0000000000000080 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!ExIsResourceAcquiredExclusiveLite:
fffff800`036e7600 f6411a80 test byte ptr [rcx+1Ah],80h ds:002b:0075004d`002e00c7=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: sidebar.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003908100
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsCreateScb+f9
fffff880`012a4c69 84c0 test al,al
FAULTING_IP:
nt!ExIsResourceAcquiredExclusiveLite+0
fffff800`036e7600 f6411a80 test byte ptr [rcx+1Ah],80h
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff880012a4c69 to fffff800036e7600
STACK_TEXT:
fffff880`0789caa8 fffff880`012a4c69 : fffff880`0789d420 fffff980`109800b0 fffff980`10980120 fffff980`10980178 : nt!ExIsResourceAcquiredExclusiveLite
fffff880`0789cab0 fffff880`01299323 : fffffa80`05ae9ce0 fffff8a0`038cd670 fffff880`0789d420 00000000`00000000 : Ntfs!NtfsCreateScb+0xf9
fffff880`0789cb70 fffff880`01299055 : fffff880`0789d3b0 00000000`00000000 00000000`00000002 00000000`0721a800 : Ntfs!NtfsBreakBatchOplock+0x93
fffff880`0789cbf0 fffff880`01294e3b : fffff880`0789d3b0 fffffa80`05ae9ce0 fffff8a0`038cda08 fffff8a0`000000ce : Ntfs!NtfsOpenExistingAttr+0x1b5
fffff880`0789ccb0 fffff880`0129809f : fffffa80`05ae9ce0 fffffa80`0a47ec10 fffff8a0`038cda08 fffff880`000000ce : Ntfs!NtfsOpenAttributeInExistingFile+0x5ab
fffff880`0789ce40 fffff880`012a8166 : fffffa80`05ae9ce0 fffffa80`0a47ec10 fffff8a0`038cda08 00000000`00000701 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
fffff880`0789cf30 fffff880`012a5911 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsFindStartingNode+0x5e6
fffff880`0789d000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreate+0x3e1
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: Ntfs!NtfsCreateScb+f9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
STACK_COMMAND: .cxr 0xfffff8800789c0c0 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsCreateScb+f9
BUCKET_ID: X64_0x24_Ntfs!NtfsCreateScb+f9
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\antpman\Ants Report\Windows_NT6_BSOD_jcgriff2\010312-29109-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03616000 PsLoadedModuleList = 0xfffff800`0385b670
Debug session time: Tue Jan 3 08:41:51.482 2012 (UTC - 7:00)
System Uptime: 0 days 0:01:02.183
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff88007dd0258, fffff88007dcfab0, fffff8800126cb38}
Probably caused by : Ntfs.sys ( Ntfs!TxfProcessTxfFcbCleanupListInternal+48 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88007dd0258
Arg3: fffff88007dcfab0
Arg4: fffff8800126cb38
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88007dd0258 -- (.exr 0xfffff88007dd0258)
ExceptionAddress: fffff8800126cb38 (Ntfs!TxfProcessTxfFcbCleanupListInternal+0x0000000000000048)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000004000000
Attempt to read from address 0000000004000000
CONTEXT: fffff88007dcfab0 -- (.cxr 0xfffff88007dcfab0)
rax=0000000000000001 rbx=0000000004000000 rcx=0000000003ffffc8
rdx=fffffa800a326000 rsi=fffff88007dd0810 rdi=fffff88007dd06d0
rip=fffff8800126cb38 rsp=fffff88007dd0490 rbp=fffff88007dd0800
r8=0000000000000001 r9=0000000000000000 r10=0000000000000001
r11=fffff88007dd0630 r12=0000000000000001 r13=0000000000000000
r14=0000000000000001 r15=0000000000000000
iopl=0 nv up ei pl nz na po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010207
Ntfs!TxfProcessTxfFcbCleanupListInternal+0x48:
fffff880`0126cb38 488b1b mov rbx,qword ptr [rbx] ds:002b:00000000`04000000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: DataProxy.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000004000000
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800038c5100
0000000004000000
FOLLOWUP_IP:
Ntfs!TxfProcessTxfFcbCleanupListInternal+48
fffff880`0126cb38 488b1b mov rbx,qword ptr [rbx]
FAULTING_IP:
Ntfs!TxfProcessTxfFcbCleanupListInternal+48
fffff880`0126cb38 488b1b mov rbx,qword ptr [rbx]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff8800126c4d0 to fffff8800126cb38
STACK_TEXT:
fffff880`07dd0490 fffff880`0126c4d0 : 00000000`000da400 fffff880`07dd06d0 fffff880`07dd0830 fffffa80`0a66e410 : Ntfs!TxfProcessTxfFcbCleanupListInternal+0x48
fffff880`07dd04d0 fffff880`012744bf : fffff8a0`02372408 00000000`00000000 fffff8a0`023725b0 00000000`00000000 : Ntfs!TxfProcessTxfFcbCleanupList+0x20
fffff880`07dd0500 fffff880`0125ba68 : fffff880`07dd06d0 fffffa80`0a66e410 fffff880`07dd0801 fffffa80`0a2b6701 : Ntfs! ?? ::FNODOBFM::`string'+0x7a7f
fffff880`07dd06a0 fffff880`0104ebcf : fffffa80`0a66e7b0 fffffa80`0a66e410 fffffa80`0a2b67b0 00000000`00000000 : Ntfs!NtfsFsdRead+0x1b8
fffff880`07dd08b0 fffff880`0104d6df : fffffa80`06161de0 fffffa80`0a326001 fffffa80`06161d00 fffffa80`0a66e410 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`07dd0940 fffff800`036babc5 : fffffa80`0a66e430 fffffa80`0a4ef070 fffffa80`0690e4b0 00000000`00c9b680 : fltmgr!FltpDispatch+0xcf
fffff880`07dd09a0 fffff800`036ba699 : 00000000`00000001 00000000`00000001 fffffa80`0690e3f0 00000000`00000000 : nt!IoPageRead+0x255
fffff880`07dd0a30 fffff800`036a102a : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000000`00000000 : nt!MiIssueHardFault+0x255
fffff880`07dd0ac0 fffff800`03690d6e : 00000000`00000008 00000000`00c9b680 00000000`00000001 00000000`00000000 : nt!MmAccessFault+0x146a
fffff880`07dd0c20 00000000`00c9b680 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0014f4e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xc9b680
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!TxfProcessTxfFcbCleanupListInternal+48
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
STACK_COMMAND: .cxr 0xfffff88007dcfab0 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!TxfProcessTxfFcbCleanupListInternal+48
BUCKET_ID: X64_0x24_Ntfs!TxfProcessTxfFcbCleanupListInternal+48
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\antpman\Ants Report\Windows_NT6_BSOD_jcgriff2\010312-28392-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03668000 PsLoadedModuleList = 0xfffff800`038ad670
Debug session time: Tue Jan 3 08:44:51.551 2012 (UTC - 7:00)
System Uptime: 0 days 0:01:43.252
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41790, fffffa8002650740, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+36024 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8002650740
Arg3: 000000000000ffff
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41790
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: runonce.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80003754150 to fffff800036e4c40
STACK_TEXT:
fffff880`098bb888 fffff800`03754150 : 00000000`0000001a 00000000`00041790 fffffa80`02650740 00000000`0000ffff : nt!KeBugCheckEx
fffff880`098bb890 fffff800`036b6b79 : ffffffff`00000000 00000000`0022ffff fffffa80`00000000 fffffa80`0a753060 : nt! ?? ::FNODOBFM::`string'+0x36024
fffff880`098bba50 fffff800`039bab1a : fffff8a0`02b31a50 00000000`00000001 00000000`00000000 fffffa80`0a753060 : nt!MmCleanProcessAddressSpace+0x679
fffff880`098bbaa0 fffff800`0399c48c : 00000000`c0000017 00000000`00000001 00000000`7efdb000 00000000`00000000 : nt!PspExitThread+0x56a
fffff880`098bbba0 fffff800`036e3ed3 : fffffa80`0a7fa060 00000000`c0000017 fffffa80`0a753060 00000000`7efdf000 : nt!NtTerminateProcess+0x138
fffff880`098bbc20 00000000`771a15da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0022f718 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771a15da
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+36024
fffff800`03754150 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+36024
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024
BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\antpman\Ants Report\Windows_NT6_BSOD_jcgriff2\010312-25740-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03617000 PsLoadedModuleList = 0xfffff800`0385c670
Debug session time: Tue Jan 3 08:48:53.893 2012 (UTC - 7:00)
System Uptime: 0 days 0:00:28.984
Loading Kernel Symbols
...............................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck FE, {5, fffffa80069aa1a0, 80862939, fffffa8009233258}
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: usbport!_DEVICE_EXTENSION ***
*** ***
*************************************************************************
Probably caused by : usbuhci.sys ( usbuhci!UhciPollAsyncEndpoint+b3 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BUGCODE_USB_DRIVER (fe)
USB Driver bugcheck, first parameter is USB bugcheck code.
Arguments:
Arg1: 0000000000000005, USBBUGCODE_INVALID_PHYSICAL_ADDRESS The host controller is
using a physical memory address that was not allocated by
the USBport driver.
Arg2: fffffa80069aa1a0, Device extension pointer of the host controller
Arg3: 0000000080862939, PCI Vendor,Product id for the controller
Arg4: fffffa8009233258, Pointer to Endpoint data structure
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: usbport!_DEVICE_EXTENSION ***
*** ***
*************************************************************************
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xFE
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff8800fdc8f7e to fffff80003693c40
STACK_TEXT:
fffff880`009b0d08 fffff880`0fdc8f7e : 00000000`000000fe 00000000`00000005 fffffa80`069aa1a0 00000000`80862939 : nt!KeBugCheckEx
fffff880`009b0d10 fffff880`03fb529b : 00000000`00000002 fffffa80`09233010 fffffa80`09233258 fffffa80`09233318 : USBPORT!USBPORTSVC_MapHwPhysicalToVirtual+0x18a
fffff880`009b0d50 fffff880`03fb22d6 : 00000000`00000002 fffffa80`09233010 00000000`00000000 fffffa80`069aa1a0 : usbuhci!UhciPollAsyncEndpoint+0xb3
fffff880`009b0db0 fffff880`0fd9ce8b : fffffa80`069aa1a0 00000000`00000002 00000000`00000000 00000000`00000000 : usbuhci!UhciPollEndpoint+0x1a
fffff880`009b0de0 fffff880`0fda19d1 : 00000000`00000000 00000000`00000004 fffffa80`09233010 fffffa80`069aa050 : USBPORT!MPf_PollEndpoint+0x9b
fffff880`009b0e10 fffff880`0fdad077 : fffffa80`069aa1a0 00000000`00000000 fffffa80`0000000e 00000000`00000000 : USBPORT!USBPORT_iSetGlobalEndpointStateTx+0x7c1
fffff880`009b0e70 fffff880`0fd9df89 : fffffa80`069aa050 00000000`00000000 fffffa80`069aaa02 fffffa80`069aaa18 : USBPORT!USBPORT_Core_UsbHcIntDpc_Worker+0x1c3
fffff880`009b0ed0 fffff800`0369f0ac : fffff880`02fd5180 fffffa80`069aaa18 fffffa80`069aaa30 00000000`0000fffe : USBPORT!USBPORT_Xdpc_Worker+0x1d9
fffff880`009b0f00 fffff800`03696765 : 00000000`00000000 fffffa80`091e5480 00000000`00000000 fffff880`0fd9ddb0 : nt!KiRetireDpcList+0x1bc
fffff880`009b0fb0 fffff800`0369657c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KyRetireDpcList+0x5
fffff880`0394a340 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue
STACK_COMMAND: kb
FOLLOWUP_IP:
usbuhci!UhciPollAsyncEndpoint+b3
fffff880`03fb529b 488bf8 mov rdi,rax
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: usbuhci!UhciPollAsyncEndpoint+b3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: usbuhci
IMAGE_NAME: usbuhci.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d8c0bff
FAILURE_BUCKET_ID: X64_0xFE_INVALID_PHYSICAL_ADDR_usbuhci!UhciPollAsyncEndpoint+b3
BUCKET_ID: X64_0xFE_INVALID_PHYSICAL_ADDR_usbuhci!UhciPollAsyncEndpoint+b3
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\antpman\Ants Report\Windows_NT6_BSOD_jcgriff2\010312-25662-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03607000 PsLoadedModuleList = 0xfffff800`0384c670
Debug session time: Tue Jan 3 08:51:41.047 2012 (UTC - 7:00)
System Uptime: 0 days 0:01:33.107
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41790, fffffa80026417d0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+36024 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa80026417d0
Arg3: 000000000000ffff
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41790
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: Create Synchro
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800036f3150 to fffff80003683c40
STACK_TEXT:
fffff880`09dc1828 fffff800`036f3150 : 00000000`0000001a 00000000`00041790 fffffa80`026417d0 00000000`0000ffff : nt!KeBugCheckEx
fffff880`09dc1830 fffff800`036b7569 : 00000000`00000000 00000000`07178fff fffffa80`00000000 fffff880`00961000 : nt! ?? ::FNODOBFM::`string'+0x36024
fffff880`09dc19f0 fffff800`0399b221 : fffffa80`0a619c20 00000000`00000000 fffffa80`08c15f90 fffffa80`08c15f90 : nt!MiRemoveMappedView+0xd9
fffff880`09dc1b10 fffff800`0399b623 : 0000007f`00000000 00000000`05cd0000 fffffa80`00000001 00000000`0021e401 : nt!MiUnmapViewOfSection+0x1b1
fffff880`09dc1bd0 fffff800`03682ed3 : 00000000`00000000 00000000`07159a9c fffffa80`0a29b2a0 00000000`000005e2 : nt!NtUnmapViewOfSection+0x5f
fffff880`09dc1c20 00000000`77ba15ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0021db38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77ba15ba
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+36024
fffff800`036f3150 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+36024
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024
BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\antpman\Ants Report\Windows_NT6_BSOD_jcgriff2\010312-27300-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0364a000 PsLoadedModuleList = 0xfffff800`0388f670
Debug session time: Tue Jan 3 18:14:54.634 2012 (UTC - 7:00)
System Uptime: 0 days 0:41:46.694
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 12c2c9, 2, 12c2c8}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000012c2c9, page frame number
Arg3: 0000000000000002, current page state
Arg4: 000000000012c2c8, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: iTunesHelper.e
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff8000374fd7c to fffff800036c6c40
STACK_TEXT:
fffff880`03316818 fffff800`0374fd7c : 00000000`0000004e 00000000`00000099 00000000`0012c2c9 00000000`00000002 : nt!KeBugCheckEx
fffff880`03316820 fffff800`03676442 : ffffffff`ffffffff 00000000`00000001 ffffffff`ffffffff 00000000`00000000 : nt!MiBadShareCount+0x4c
fffff880`03316860 fffff800`037c869a : fffffa80`09cd6ec8 fffff880`03316a70 00000000`00000001 fffffa80`00000007 : nt! ?? ::FNODOBFM::`string'+0x21513
fffff880`03316a50 fffff800`03742977 : fffffa80`05228040 fffff880`00000001 00000000`00000000 fffff880`02f647f0 : nt!MiEmptyWorkingSet+0x24a
fffff880`03316b00 fffff800`036b1826 : 00000000`000009cc 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4d602
fffff880`03316b80 fffff800`036b1c48 : 00000000`00000008 fffff880`03316c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03316bd0 fffff800`03961fee : fffffa80`05228040 00000000`00000080 fffffa80`05189b30 00000000`00000001 : nt!KeBalanceSetManager+0x138
fffff880`03316d40 fffff800`036b85e6 : fffff880`02f64180 fffffa80`05228040 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03316d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`0374fd7c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
Please update the following drivers through their manufacturer sites. To find the manufacturer and driver information,