Code:
-
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [K:\BSODDmpFiles\HelpComputer\Windows_NT6_BSOD_jcgriff2\012712-14102-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0300d000 PsLoadedModuleList = 0xfffff800`03252670
Debug session time: Fri Jan 27 18:24:34.368 2012 (GMT-7)
System Uptime: 0 days 1:40:55.960
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff800031b8dd3, fffff880031c48b8, fffff880031c4110}
Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+43 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800031b8dd3, The address that the exception occurred at
Arg3: fffff880031c48b8, Exception Record Address
Arg4: fffff880031c4110, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExFreePoolWithTag+43
fffff800`031b8dd3 418b45f0 mov eax,dword ptr [r13-10h]
EXCEPTION_RECORD: fffff880031c48b8 -- (.exr 0xfffff880031c48b8)
ExceptionAddress: fffff800031b8dd3 (nt!ExFreePoolWithTag+0x0000000000000043)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff880031c4110 -- (.cxr 0xfffff880031c4110)
rax=0000000000000000 rbx=fffff8a00b8b2380 rcx=02000000fffffffe
rdx=0000000000000000 rsi=0000000000000000 rdi=02000000ffffffff
rip=fffff800031b8dd3 rsp=fffff880031c4af0 rbp=00000000ffffffff
r8=fffffa800621b040 r9=fffff880031c4c01 r10=fffff8000300d000
r11=fffff880031c4b50 r12=0000000000000000 r13=02000000fffffffe
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!ExFreePoolWithTag+0x43:
fffff800`031b8dd3 418b45f0 mov eax,dword ptr [r13-10h] ds:002b:02000000`ffffffee=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032bc100
ffffffffffffffff
FOLLOWUP_IP:
nt!ExFreePoolWithTag+43
fffff800`031b8dd3 418b45f0 mov eax,dword ptr [r13-10h]
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from fffff800033bb661 to fffff800031b8dd3
STACK_TEXT:
fffff880`031c4af0 fffff800`033bb661 : 00000000`00000000 fffff800`03049b6a fffff880`02f64180 fffff800`0328a700 : nt!ExFreePoolWithTag+0x43
fffff880`031c4ba0 fffff800`0336f66f : fffff8a0`0b8b2380 fffff880`031c4c44 00000000`00000004 00000000`00000001 : nt! ?? ::NNGAKEGL::`string'+0xf471
fffff880`031c4bd0 fffff800`032de90e : fffff8a0`0b8b2380 fffffa80`0621b040 fffff880`031c4ca4 00000000`00000000 : nt!CmpCleanUpKcbCacheWithLock+0x2b
fffff880`031c4c00 fffff800`03094001 : fffff800`032de5d4 fffff800`0322a2b8 fffffa80`0621b040 00000000`00000000 : nt!CmpDelayCloseWorker+0x33a
fffff880`031c4cb0 fffff800`03324fee : 00000000`00000000 fffffa80`0621b040 00000000`00000080 fffffa80`0610a040 : nt!ExpWorkerThread+0x111
fffff880`031c4d40 fffff800`0307b5e6 : fffff880`02f64180 fffffa80`0621b040 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`031c4d80 00000000`00000000 : fffff880`031c5000 fffff880`031bf000 fffff880`031c4970 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExFreePoolWithTag+43
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff880031c4110 ; kb
FAILURE_BUCKET_ID: X64_0x7E_nt!ExFreePoolWithTag+43
BUCKET_ID: X64_0x7E_nt!ExFreePoolWithTag+43
Followup: MachineOwner
---------
-
Loading Dump File [K:\BSODDmpFiles\HelpComputer\Windows_NT6_BSOD_jcgriff2\012712-16754-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03017000 PsLoadedModuleList = 0xfffff800`0325c670
Debug session time: Fri Jan 27 16:41:15.800 2012 (GMT-7)
System Uptime: 0 days 3:21:02.002
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff8000307fcc1, 0, ffffffffffffffff}
Probably caused by : ntkrnlmp.exe ( nt!NtWaitForWorkViaWorkerFactory+410 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8000307fcc1, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!NtWaitForWorkViaWorkerFactory+410
fffff800`0307fcc1 c3 ret
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c6100
ffffffffffffffff
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: services.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800030df588 to fffff80003093c40
STACK_TEXT:
fffff880`091861f8 fffff800`030df588 : 00000000`0000001e ffffffff`c0000005 fffff800`0307fcc1 00000000`00000000 : nt!KeBugCheckEx
fffff880`09186200 fffff800`030932c2 : fffff880`091869d8 fffffa80`0916cb60 fffff880`09186a80 00000000`776f45c0 : nt! ?? ::FNODOBFM::`string'+0x4977d
fffff880`091868a0 fffff800`03091bca : fffff880`09186ca0 fffff800`0337c647 fffff8a0`00000000 00000000`00000001 : nt!KiExceptionDispatch+0xc2
fffff880`09186a80 fffff800`0307fcc1 : ffdff800`03092ed3 fffffa80`0916cb60 00000000`776f45c0 00000000`00000102 : nt!KiGeneralProtectionFault+0x10a
fffff880`09186c18 ffdff800`03092ed3 : fffffa80`0916cb60 00000000`776f45c0 00000000`00000102 00000000`00000000 : nt!NtWaitForWorkViaWorkerFactory+0x410
fffff880`09186c20 fffffa80`0916cb60 : 00000000`776f45c0 00000000`00000102 00000000`00000000 00000000`00000000 : 0xffdff800`03092ed3
fffff880`09186c28 00000000`776f45c0 : 00000000`00000102 00000000`00000000 00000000`00000000 00001f80`02010000 : 0xfffffa80`0916cb60
fffff880`09186c30 00000000`00000102 : 00000000`00000000 00000000`00000000 00001f80`02010000 00000000`00000000 : 0x776f45c0
fffff880`09186c38 00000000`00000000 : 00000000`00000000 00001f80`02010000 00000000`00000000 00000000`7760fbc0 : 0x102
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!NtWaitForWorkViaWorkerFactory+410
fffff800`0307fcc1 c3 ret
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!NtWaitForWorkViaWorkerFactory+410
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1E_nt!NtWaitForWorkViaWorkerFactory+410
BUCKET_ID: X64_0x1E_nt!NtWaitForWorkViaWorkerFactory+410
Followup: MachineOwner
---------
-
Loading Dump File [K:\BSODDmpFiles\HelpComputer\Windows_NT6_BSOD_jcgriff2\012112-16052-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0301e000 PsLoadedModuleList = 0xfffff800`03263670
Debug session time: Sat Jan 21 13:29:10.151 2012 (GMT-7)
System Uptime: 0 days 3:24:39.743
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {22, 200000000000000, 0, 0}
GetPointerFromAddress: unable to read from fffff800032cd100
GetUlongFromAddress: unable to read from fffff8000323ba18
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+72d6 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000022,
Arg2: 0200000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
GetUlongFromAddress: unable to read from fffff8000323ba18
BUGCHECK_STR: 0x19_22
POOL_ADDRESS: 0200000000000000
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff800030274ce to fffff8000309ac40
STACK_TEXT:
fffff880`031a8a88 fffff800`030274ce : 00000000`00000019 00000000`00000022 02000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`031a8a90 fffff800`031ca1fa : 00000000`00000000 fffff880`031a8be0 fffff880`031a8b60 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x72d6
fffff880`031a8b20 fffff800`033cb75a : 00000000`00000000 00000000`00000004 00000000`00000004 00000000`00000000 : nt!ExFreePoolWithTag+0x46a
fffff880`031a8bd0 fffff800`032ef972 : fffff8a0`119f9948 fffff880`031a8c44 00000000`00000004 fffff880`0161ebb4 : nt! ?? ::NNGAKEGL::`string'+0xbe1a
fffff880`031a8c00 fffff800`030a5001 : fffff800`032ef5d4 fffff800`0323b2b8 fffffa80`061b0040 00000000`00000000 : nt!CmpDelayCloseWorker+0x39e
fffff880`031a8cb0 fffff800`03335fee : 00000000`00000000 fffffa80`061b0040 00000000`00000080 fffffa80`06101040 : nt!ExpWorkerThread+0x111
fffff880`031a8d40 fffff800`0308c5e6 : fffff880`02f64180 fffffa80`061b0040 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`031a8d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+72d6
fffff800`030274ce cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+72d6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x19_22_nt!_??_::FNODOBFM::_string_+72d6
BUCKET_ID: X64_0x19_22_nt!_??_::FNODOBFM::_string_+72d6
Followup: MachineOwner
---------
-
Loading Dump File [K:\BSODDmpFiles\HelpComputer\Windows_NT6_BSOD_jcgriff2\012012-19390-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03065000 PsLoadedModuleList = 0xfffff800`032aa670
Debug session time: Fri Jan 20 20:08:54.533 2012 (GMT-7)
System Uptime: 0 days 9:13:45.735
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41790, fffffa80034847a0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+36024 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa80034847a0
Arg3: 000000000000ffff
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41790
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: audiodg.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80003151150 to fffff800030e1c40
STACK_TEXT:
fffff880`095bb768 fffff800`03151150 : 00000000`0000001a 00000000`00041790 fffffa80`034847a0 00000000`0000ffff : nt!KeBugCheckEx
fffff880`095bb770 fffff800`03115569 : fffffa80`00000000 000007fe`fd286fff 00000000`00000000 fffffa80`07a72648 : nt! ?? ::FNODOBFM::`string'+0x36024
fffff880`095bb930 fffff800`030b3728 : ffffffff`ffffffff 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`095bba50 fffff800`033b7b1a : fffff8a0`1118b940 00000000`00000001 00000000`00000000 fffffa80`09d58840 : nt!MmCleanProcessAddressSpace+0x228
fffff880`095bbaa0 fffff800`0339948c : 00000000`c000004b 00000000`00000001 000007ff`fffde000 00000000`00000000 : nt!PspExitThread+0x56a
fffff880`095bbba0 fffff800`030e0ed3 : fffffa80`09e97a10 fffff880`c000004b fffffa80`09d58840 00000000`00000001 : nt!NtTerminateProcess+0x138
fffff880`095bbc20 00000000`775915da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000df5e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x775915da
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+36024
fffff800`03151150 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+36024
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024
BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024
Followup: MachineOwner
---------
-
Loading Dump File [K:\BSODDmpFiles\HelpComputer\Windows_NT6_BSOD_jcgriff2\011712-26317-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03053000 PsLoadedModuleList = 0xfffff800`03298670
Debug session time: Tue Jan 17 19:08:50.752 2012 (GMT-7)
System Uptime: 0 days 9:10:18.344
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff88006c595f9, fffff88009755ec0, 0}
Probably caused by : dxgkrnl.sys ( dxgkrnl!DXGDEVICE::DestroyAllocation+2a5 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff88006c595f9, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88009755ec0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
dxgkrnl!DXGDEVICE::DestroyAllocation+2a5
fffff880`06c595f9 f6400401 test byte ptr [rax+4],1
CONTEXT: fffff88009755ec0 -- (.cxr 0xfffff88009755ec0)
rax=0200000000000000 rbx=fffff8a011898b00 rcx=0000000000000020
rdx=0000000000000062 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88006c595f9 rsp=fffff880097568a0 rbp=fffff88009756ca0
r8=fffff8a00f400000 r9=000000007c90a025 r10=fffff8a00ce06000
r11=fffff8a00f400000 r12=fffff8a01191e000 r13=fffff8a011898b40
r14=0000000000000003 r15=ffffffffc000000d
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
dxgkrnl!DXGDEVICE::DestroyAllocation+0x2a5:
fffff880`06c595f9 f6400401 test byte ptr [rax+4],1 ds:002b:02000000`00000004=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: iexplore.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff88006c595f9
STACK_TEXT:
fffff880`097568a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : dxgkrnl!DXGDEVICE::DestroyAllocation+0x2a5
FOLLOWUP_IP:
dxgkrnl!DXGDEVICE::DestroyAllocation+2a5
fffff880`06c595f9 f6400401 test byte ptr [rax+4],1
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: dxgkrnl!DXGDEVICE::DestroyAllocation+2a5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: dxgkrnl
IMAGE_NAME: dxgkrnl.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce799fa
STACK_COMMAND: .cxr 0xfffff88009755ec0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_dxgkrnl!DXGDEVICE::DestroyAllocation+2a5
BUCKET_ID: X64_0x3B_dxgkrnl!DXGDEVICE::DestroyAllocation+2a5
Followup: MachineOwner
---------
-
Loading Dump File [K:\BSODDmpFiles\HelpComputer\Windows_NT6_BSOD_jcgriff2\011712-19000-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03066000 PsLoadedModuleList = 0xfffff800`032ab670
Debug session time: Mon Jan 16 21:08:42.927 2012 (GMT-7)
System Uptime: 0 days 12:59:31.519
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800318c5c8, fffff8800318be20, fffff800030c74db}
Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteScb+108 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800318c5c8
Arg3: fffff8800318be20
Arg4: fffff800030c74db
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800318c5c8 -- (.exr 0xfffff8800318c5c8)
ExceptionAddress: fffff800030c74db (nt!RtlDeleteNoSplay+0x0000000000000093)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8800318be20 -- (.cxr 0xfffff8800318be20)
rax=fffff8a010781b58 rbx=fffffa8006443fa0 rcx=0200000000000000
rdx=fffffa8006443fa0 rsi=ffffffffffffffff rdi=0000000000000000
rip=fffff800030c74db rsp=fffff8800318c800 rbp=fffffa8006443fa0
r8=ffffffffffffffff r9=ffffffffffffffff r10=fffff8a00b130010
r11=fffff8a010781b58 r12=0000000000000705 r13=0000000000000000
r14=fffffa8006443f58 r15=fffff8a00b1303a8
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!RtlDeleteNoSplay+0x93:
fffff800`030c74db 488909 mov qword ptr [rcx],rcx ds:002b:02000000`00000000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003315100
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsDeleteScb+108
fffff880`01295bac 488b03 mov rax,qword ptr [rbx]
FAULTING_IP:
nt!RtlDeleteNoSplay+93
fffff800`030c74db 488909 mov qword ptr [rcx],rcx
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff88001025633 to fffff800030c74db
STACK_TEXT:
fffff880`0318c800 fffff880`01025633 : 00000000`00000000 00000000`000007ff fffff8a0`02bd2548 fffff880`010232c8 : nt!RtlDeleteNoSplay+0x93
fffff880`0318c830 fffff880`010232c8 : fffff8a0`037eaa08 00000000`00008000 fffffa80`071fc668 fffffa80`09aed6c0 : fltmgr!TreeUnlinkNoBalance+0x13
fffff880`0318c860 fffff880`0104114c : fffff8a0`0b8c7200 00000000`00000040 00000000`00000000 fffff880`0318c9e1 : fltmgr!TreeUnlinkMulti+0x148
fffff880`0318c8b0 fffff880`01043311 : fffffa80`071fc010 00000000`00000130 fffff8a0`0b130140 00000000`00000000 : fltmgr!FltpDeleteContextList+0x3c
fffff880`0318c8e0 fffff880`010433fb : fffffa80`071fc010 fffff8a0`0b1303a8 fffffa80`071fc010 fffff8a0`037ea670 : fltmgr!CleanupStreamListCtrl+0x21
fffff880`0318c920 fffff800`0339b90e : 00000000`00000001 fffff880`012961b3 fffff8a0`037ea670 00000000`00000000 : fltmgr!DeleteStreamListCtrlCallback+0x6b
fffff880`0318c950 fffff880`01295bac : fffff8a0`0b130140 fffffa80`061e8040 fffff880`0318ca28 00000000`00000706 : nt!FsRtlTeardownPerStreamContexts+0xe2
fffff880`0318c9a0 fffff880`0129acc1 : 00000000`01000000 00000000`00000000 fffff800`03283200 00000000`00000001 : Ntfs!NtfsDeleteScb+0x108
fffff880`0318c9e0 fffff880`0121385c : fffff8a0`0b130040 fffff8a0`0b130140 fffff800`03283200 fffff880`0318cb52 : Ntfs!NtfsRemoveScb+0x61
fffff880`0318ca20 fffff880`0129864c : fffff8a0`0b130010 fffff800`03283260 fffff880`0318cb52 fffffa80`0a1e7640 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`0318ca50 fffff880`0121a0e2 : fffffa80`0a1e7640 fffffa80`0a1e7640 fffff8a0`0b130010 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xdc
fffff880`0318cad0 fffff880`012a8193 : fffffa80`0a1e7640 fffff800`03283260 fffff8a0`0b130010 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`0318cb10 fffff880`01297357 : fffffa80`0a1e7640 fffff8a0`0b130140 fffff8a0`0b130010 fffffa80`07203180 : Ntfs!NtfsCommonClose+0x353
fffff880`0318cbe0 fffff800`030ed001 : 00000000`00000000 fffff800`033d9900 fffff800`032e4801 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`0318ccb0 fffff800`0337dfee : 00000000`00000000 fffffa80`061e8040 00000000`00000080 fffffa80`06101040 : nt!ExpWorkerThread+0x111
fffff880`0318cd40 fffff800`030d45e6 : fffff880`02f64180 fffffa80`061e8040 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0318cd80 00000000`00000000 : fffff880`0318d000 fffff880`03187000 fffff880`0318c9e0 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 7
SYMBOL_NAME: Ntfs!NtfsDeleteScb+108
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
STACK_COMMAND: .cxr 0xfffff8800318be20 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteScb+108
BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteScb+108
Followup: MachineOwner
---------