Windows 7: BSOD ( driver has overrun a stack-based buffer )

Uncle Seamus · 14 Mar 2010

Hello everyone,

the title is pretty much all the info I can give you...I get a BSOD with the above stated explanation
I have a crahdump, but I can't seem to upload it
I'll try later

Thanks in advance for your time

Uncle Seamus · 14 Mar 2010

I see now that my crashdump is bigger than 8MB, even ater it has been rar'ed...
anyone knows how to upload it?

**Capt.Jack Sparrow** · 14 Mar 2010

Quote: Originally Posted by Uncle Seamus

I see now that my crashdump is bigger than 8MB, even ater it has been rar'ed...
anyone knows how to upload it?

Hello,

Its actually read the Memory Dump which used to be huge. I will show you how to set the Minidump so we have have a look at it

Click Start, point to Settings, and then click Control Panel.
Double-click System.
Click the Advanced tab, and then click Settings under Startup and Recovery.
In the Write debugging information list, click Small memory dump (64k).

Once its setup wait for the crash once you get the crash check under C:\Windows\Minidump folder

Hope this helps,
Captain

Uncle Seamus · 14 Mar 2010

alright, I'll get back at you after the next crash

Uncle Seamus · 15 Mar 2010

computer has been stable for over a day now,
might have been an isolated issue

Uncle Seamus · 22 Mar 2010

alright, had a BSOD again, but I don't know if it's related to the previous bsod
I have attached a minidump

Uncle Seamus · 23 Mar 2010

and yet another bsod (more than 1 actually)

**Capt.Jack Sparrow** · 23 Mar 2010

Quote: Originally Posted by Uncle Seamus

and yet another bsod (more than 1 actually)

Hello,

I suspect is your Memory that has caused the probem. Not very clear though. Lets do the basics. Uninstall any third party Antivirus / Firewall. If your Overclocking please stop. Check for any update for your BIOS.

Quote:

Run the Memory Diagnostic & HD Diagnostic

Also i would recommend to run System Integrity Checker
Start > Run > CMD >Right Click and Run as administrator > SFC/ SCANNOW

Bugcheck Analysis

Code:

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000406f8
Arg4: fffff80002d6be43
 
2: kd> .cxr 0xfffff880042d0140
rax=fffff880042d0b54 rbx=fffff8a000ce9970 rcx=fffff880042d0b88
rdx=0000000000000000 rsi=0000000000000080 rdi=0000000000000000
rip=fffff80001e8ffa2 rsp=fffff880042d0b20 rbp=0000000000000010
 r8=fffff880042d0b60  r9=0000000000000000 r10=0000010110000000
r11=fffffa8005930b60 r12=0000000000000001 r13=0000000000000000
r14=fffffa8005907dc0 r15=fffff880042d0d70
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!SepMandatorySubProcessToken+0x8e:
fffff800`01e8ffa2 498bce          mov     rcx,r14
2: kd> k
  *** Stack trace for last set context - .thread/.cxr resets it
Child-SP          RetAddr           Call Site
fffff880`042d0b20 fffff800`0216e243 nt!SepMandatorySubProcessToken+0x8e
fffff880`042d0c40 fffff800`0216f79a nt!SeSubProcessToken+0xc3
fffff880`042d0d10 fffff800`0216da90 nt!PspInitializeProcessSecurity+0x6a
fffff880`042d0d70 00000000`00000000 nt!PspAllocateProcess+0x564

Hope this helps,
Captain

Uncle Seamus · 23 Mar 2010

doing the requested check-ups
I'll also run memtest

Uncle Seamus · 23 Mar 2010

I have ran sfc/scannow and the program said some corrupted files have been found, but they haven't all been repaired
I've added the log...is there a way for me to repair those files?