Thanks for the files, and what AV are you running?
Code:
BugCheck 19, {20, e116f000, e116f340, c680400}
GetUlongFromAddress: unable to read from 805589f0
Probably caused by : ntkrnlpa.exe ( nt!ExFreePoolWithTag+2a0 )
Code:
Usual causes: Device driver
This bugcheck indicates that a pool header size has become corrupt, the pool header contains information such as the size of allocation by the Memory Manager and any associated pool tags.
Code:
kd> !pool e116f000
Pool page e116f000 region is Unknown
*e116f000 size: 340 previous size: 0 (Allocated) *Ntff
Pooltag Ntff : FCB_DATA, Binary : ntfs.sys
e116f340 doesn't look like a valid small pool allocation, checking to see
if the entire page is actually part of a large page allocation...
GetUlongFromAddress: unable to read from 8055c7f0
e116f340 is not a valid small pool allocation, checking large pool...
unable to get pool big page table - either wrong symbols or pool tagging is disabled
e116f340 is freed (or corrupt) pool
Bad previous allocation size @e116f340, last size was 68
***
*** An error (or corruption) in the pool was detected;
*** Pool Region unknown (0xFFFFFFFFE116F340)
Code:
kd> !poolval e116f000
Pool page e116f000 region is Unknown
Validating Pool headers for pool page: e116f000
Pool page [ e116f000 ] is __inVALID.
Analyzing linked list...
[ e116f340 ]: invalid previous size [ 0x48 ] should be [ 0x68 ]
Scanning for single bit errors...
[ e116f340 ]: previous size [ 0x48 ] should be [ 0x68 ]
Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours: