New
#1
BSOD after presumably after Install of Fonts package using GPO
Hi,
I have been deploying out fonts to our Windows 7 machines to Install a new font via MSI software roll out and registry setting via GPO:
HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Fonts\(Font name)
Since the Install we have noticed a few machines BSOD with:
STOP: 0x0000008E
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
From a minidump:
Microsoft (R) Windows Debugger Version 6.2.8229.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [\\LON-7-L-266\c$\Windows\Minidump\012314-17004-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.17273.x86fre.win7_gdr.130318-1532
Machine Name:
Kernel base = 0x83012000 PsLoadedModuleList = 0x8315a810
Debug session time: Thu Jan 23 10:30:10.492 2014 (UTC + 0:00)
System Uptime: 0 days 1:34:23.192
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
..........
TRIAGER: Could not open triage file : C:\Program Files\Windows Kits\8.0\Debuggers\x86\triage\oca.ini, error 2
TRIAGER: Could not open triage file : C:\Program Files\Windows Kits\8.0\Debuggers\x86\winxp\triage.ini, error 2
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 95f9dd71, 9bddbb98, 0}
TRIAGER: Could not open triage file : C:\Program Files\Windows Kits\8.0\Debuggers\x86\triage\modclass.ini, error 2
Probably caused by : win32k.sys ( win32k!HmgLockEx+67 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 95f9dd71, The address that the exception occurred at
Arg3: 9bddbb98, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
TRIAGER: Could not open triage file : C:\Program Files\Windows Kits\8.0\Debuggers\x86\triage\modclass.ini, error 2
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
win32k!HmgLockEx+67
95f9dd71 0fb74f08 movzx ecx,word ptr [edi+8]
TRAP_FRAME: 9bddbb98 -- (.trap 0xffffffff9bddbb98)
ErrCode = 00000000
eax=86291030 ebx=00000000 ecx=ffbbf000 edx=000011dc esi=ff800000 edi=00000000
eip=95f9dd71 esp=9bddbc0c ebp=9bddbc30 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
win32k!HmgLockEx+0x67:
95f9dd71 0fb74f08 movzx ecx,word ptr [edi+8] ds:0023:00000008=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: dwm.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 95f9f4ef to 95f9dd71
STACK_TEXT:
9bddbc30 95f9f4ef 00000000 95f53734 ff33a290 win32k!HmgLockEx+0x67
9bddbc44 95f4ead2 00000000 00000000 ff33a290 win32k!HmgLock+0x7
9bddbc70 95fa1590 8a1219ad 8a1219ad ff33a290 win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+0x27
9bddbc88 95f4f0ce ff33a290 00000001 00000000 win32k!bhLSurfDestroyLogicalSurfaceObject+0x31
9bddbcac 95f53b56 ffb86748 00000000 0dd345eb win32k!GreSfmCloseCompositorRef+0x8b
9bddbd1c 830546da 8a1219ad 00000008 00000000 win32k!NtGdiHLSurfSetInformation+0x110
9bddbd1c 775d6194 8a1219ad 00000008 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
00fbf920 00000000 00000000 00000000 00000000 0x775d6194
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!HmgLockEx+67
95f9dd71 0fb74f08 movzx ecx,word ptr [edi+8]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: win32k!HmgLockEx+67
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 51301c3d
FAILURE_BUCKET_ID: 0x8E_win32k!HmgLockEx+67
BUCKET_ID: 0x8E_win32k!HmgLockEx+67
Followup: MachineOwner
---------
Quote