[list=1]
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\malignant\Windows_NT6_BSOD_jcgriff2\010912-27393-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c5d000 PsLoadedModuleList = 0xfffff800`02ea2670
Debug session time: Mon Jan 9 15:35:56.150 2012 (UTC - 7:00)
System Uptime: 0 days 1:08:46.586
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {20, fffffa8001f8dc80, fffffa8001f8dc80, 40016c4}
GetPointerFromAddress: unable to read from fffff80002f0c100
GetUlongFromAddress: unable to read from fffff80002e7aa18
Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+12698 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffffa8001f8dc80, The pool entry we were looking for within the page.
Arg3: fffffa8001f8dc80, The next pool entry.
Arg4: 00000000040016c4, (reserved)
Debugging Details:
------------------
GetUlongFromAddress: unable to read from fffff80002e7aa18
BUGCHECK_STR: 0x19_20
POOL_ADDRESS: fffffa8001f8dc80
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: Steam.exe
CURRENT_IRQL: 1
LAST_CONTROL_TRANSFER: from fffff80002e07cae to fffff80002cd9c40
STACK_TEXT:
fffff880`02a59108 fffff800`02e07cae : 00000000`00000019 00000000`00000020 fffffa80`01f8dc80 fffffa80`01f8dc80 : nt!KeBugCheckEx
fffff880`02a59110 fffff800`0300e5a8 : fffff800`02e83bb0 fffff880`02a59220 fffff800`20776152 00000000`00000000 : nt!ExDeferredFreePool+0x12da
fffff880`02a591c0 fffff800`02dd7214 : fffffa80`00000000 fffffa80`074b6c70 00000000`00000001 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x12698
fffff880`02a591f0 fffff800`0301c2d2 : 00000000`00000001 fffffa80`074b6c70 fffffa80`07b144d8 00000000`00000000 : nt!RawCheckForDeleteVolume+0xa4
fffff880`02a59220 fffff800`02f45e80 : fffffa80`04462640 fffff800`02ed9980 fffffa80`07b144d8 fffffa80`07b143c0 : nt! ?? ::NNGAKEGL::`string'+0x30ec2
fffff880`02a59250 fffff800`02f45438 : fffff880`02a593a8 fffffa80`04462640 fffffa80`07b143c0 fffffa80`04462640 : nt!RawMountVolume+0x30
fffff880`02a59310 fffff800`02f45143 : fffffa80`04462640 00000000`00000000 00000000`00000000 00000000`00000000 : nt!RawFileSystemControl+0x30
fffff880`02a59340 fffff880`00dcd50c : fffffa80`04462640 fffffa80`05637d60 00000000`00000000 fffffa80`04469a20 : nt!RawDispatch+0x13b
fffff880`02a593a0 fffff880`00dc8971 : fffffa80`044698d0 fffff800`02ed9980 fffffa80`03b62c90 fffffa80`05637d60 : fltmgr!FltpFsControlMountVolume+0x28c
fffff880`02a59470 fffff800`02f43eb7 : fffffa80`044698d0 00000000`00000001 fffffa80`044698d0 fffffa80`07b143c0 : fltmgr!FltpFsControl+0x101
fffff880`02a594d0 fffff800`02cc9097 : fffff880`02a597f0 fffff880`02a59701 fffffa80`06257200 00000000`00000700 : nt!IopMountVolume+0x28f
fffff880`02a59590 fffff800`02fd8206 : 00000000`00000065 00000000`00000000 fffff880`02a597f0 fffff880`02a59650 : nt!IopCheckVpbMounted+0x1b7
fffff880`02a59600 fffff800`02fd4838 : fffffa80`06257280 00000000`00000000 fffffa80`070adb10 00000000`00000001 : nt!IopParseDevice+0x816
fffff880`02a59790 fffff800`02fd5a56 : 00000000`00000000 fffffa80`070adb10 00000000`00000005 fffffa80`03a50260 : nt!ObpLookupObjectName+0x588
fffff880`02a59880 fffff800`02fb59d6 : fffff680`0007c370 00000000`0008e308 fffffa80`013a6b01 00000000`00001247 : nt!ObOpenObjectByName+0x306
fffff880`02a59950 fffff800`02cd8ed3 : 00000000`00000001 00000000`0f86e42a fffffa80`0786b060 00000000`038c0000 : nt!NtQueryAttributesFile+0x145
fffff880`02a59be0 00000000`778916ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008e2c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x778916ea
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::NNGAKEGL::`string'+12698
fffff800`0300e5a8 4883a3a800000000 and qword ptr [rbx+0A8h],0
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+12698
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x19_20_nt!_??_::NNGAKEGL::_string_+12698
BUCKET_ID: X64_0x19_20_nt!_??_::NNGAKEGL::_string_+12698
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\malignant\Windows_NT6_BSOD_jcgriff2\011012-35630-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c07000 PsLoadedModuleList = 0xfffff800`02e4c670
Debug session time: Tue Jan 10 06:28:57.609 2012 (UTC - 7:00)
System Uptime: 0 days 14:25:21.045
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002c7bb65, fffff88007a31f90, 0}
Probably caused by : ntkrnlmp.exe ( nt!ExpInterlockedPopEntrySListFault16+0 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002c7bb65, Address of the instruction which caused the bugcheck
Arg3: fffff88007a31f90, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`02c7bb65 498b08 mov rcx,qword ptr [r8]
CONTEXT: fffff88007a31f90 -- (.cxr 0xfffff88007a31f90)
rax=0000001971c3ffff rbx=0000000000000008 rcx=fffff80002dfa940
rdx=ddf0d84802afc612 rsi=0000000000000007 rdi=0000000000000008
rip=fffff80002c7bb65 rsp=fffff88007a32970 rbp=fffff80002dfa940
r8=ddf0d84802afc611 r9=fffff80002c07000 r10=fffff80002dfa940
r11=00000000001fffff r12=fffff80002e0e340 r13=0000000000000000
r14=0000000000000002 r15=0000000070617350
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!ExpInterlockedPopEntrySListFault16:
fffff800`02c7bb65 498b08 mov rcx,qword ptr [r8] ds:002b:ddf0d848`02afc611=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: CCC.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002c7bb65
STACK_TEXT:
fffff880`07a32970 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExpInterlockedPopEntrySListFault16
FOLLOWUP_IP:
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`02c7bb65 498b08 mov rcx,qword ptr [r8]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExpInterlockedPopEntrySListFault16+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff88007a31f90 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!ExpInterlockedPopEntrySListFault16+0
BUCKET_ID: X64_0x3B_nt!ExpInterlockedPopEntrySListFault16+0
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\malignant\Windows_NT6_BSOD_jcgriff2\011012-28360-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c55000 PsLoadedModuleList = 0xfffff800`02e9a670
Debug session time: Tue Jan 10 13:41:17.572 2012 (UTC - 7:00)
System Uptime: 0 days 2:57:16.883
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002cc9b65, fffff88008f57f90, 0}
Probably caused by : ntkrnlmp.exe ( nt!ExpInterlockedPopEntrySListFault16+0 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002cc9b65, Address of the instruction which caused the bugcheck
Arg3: fffff88008f57f90, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`02cc9b65 498b08 mov rcx,qword ptr [r8]
CONTEXT: fffff88008f57f90 -- (.cxr 0xfffff88008f57f90)
rax=00000000d3f9ffff rbx=0000000000000008 rcx=fffff80002e48940
rdx=0217059b0216059c rsi=0000000000000007 rdi=0000000000000008
rip=fffff80002cc9b65 rsp=fffff88008f58970 rbp=fffff80002e48940
r8=0217059b0216059b r9=fffff80002c55000 r10=fffff80002e48940
r11=00000000001fffff r12=fffff80002e5c340 r13=0000000000000000
r14=0000000000000002 r15=0000000070617350
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!ExpInterlockedPopEntrySListFault16:
fffff800`02cc9b65 498b08 mov rcx,qword ptr [r8] ds:002b:0217059b`0216059b=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: CCC.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002cc9b65
STACK_TEXT:
fffff880`08f58970 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExpInterlockedPopEntrySListFault16
FOLLOWUP_IP:
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`02cc9b65 498b08 mov rcx,qword ptr [r8]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExpInterlockedPopEntrySListFault16+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff88008f57f90 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!ExpInterlockedPopEntrySListFault16+0
BUCKET_ID: X64_0x3B_nt!ExpInterlockedPopEntrySListFault16+0
Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\malignant\Windows_NT6_BSOD_jcgriff2\011012-27534-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c5d000 PsLoadedModuleList = 0xfffff800`02ea2670
Debug session time: Tue Jan 10 20:17:58.558 2012 (UTC - 7:00)
System Uptime: 0 days 1:25:23.994
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff80002cd1b65, fffff880033748a8, fffff88003374100}
Probably caused by : ntkrnlmp.exe ( nt!ExpInterlockedPopEntrySListFault16+0 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002cd1b65, The address that the exception occurred at
Arg3: fffff880033748a8, Exception Record Address
Arg4: fffff88003374100, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`02cd1b65 498b08 mov rcx,qword ptr [r8]
EXCEPTION_RECORD: fffff880033748a8 -- (.exr 0xfffff880033748a8)
ExceptionAddress: fffff80002cd1b65 (nt!ExpInterlockedPopEntrySListFault16)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88003374100 -- (.cxr 0xfffff88003374100)
rax=00000000a545ffff rbx=fffff88003374c30 rcx=fffff80002e50940
rdx=0282c30202d3c430 rsi=0000000000000007 rdi=0000000000000000
rip=fffff80002cd1b65 rsp=fffff88003374ae0 rbp=fffff80002e50940
r8=0282c30202d3c42f r9=fffff80002c5d000 r10=fffff80002e50940
r11=fffffa80039fd040 r12=fffff80002e64340 r13=0000000000000000
r14=0000000000000002 r15=000000006f706d55
iopl=0 nv up ei pl nz ac pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010212
nt!ExpInterlockedPopEntrySListFault16:
fffff800`02cd1b65 498b08 mov rcx,qword ptr [r8] ds:002b:0282c302`02d3c42f=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f0c100
ffffffffffffffff
FOLLOWUP_IP:
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`02cd1b65 498b08 mov rcx,qword ptr [r8]
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from fffff80002e081de to fffff80002cd1b65
STACK_TEXT:
fffff880`03374ae0 fffff800`02e081de : fffffa80`07d3d7e0 fffffa80`06ca7b30 00000000`00000000 00000000`00000002 : nt!ExpInterlockedPopEntrySListFault16
fffff880`03374af0 fffff800`02c9c73a : 00000000`00000000 fffff880`03374c30 00000000`6f706d55 00000000`000007ff : nt!ExAllocatePoolWithTag+0xfe
fffff880`03374be0 fffff800`02f74fee : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PopUmpoMessageThread+0xce
fffff880`03374d00 fffff800`02ccb5e6 : fffff800`02e4fe80 fffffa80`039fd040 fffffa80`039eeb60 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03374d40 00000000`00000000 : fffff880`03375000 fffff880`0336f000 fffff880`03374630 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExpInterlockedPopEntrySListFault16+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff88003374100 ; kb
FAILURE_BUCKET_ID: X64_0x7E_nt!ExpInterlockedPopEntrySListFault16+0
BUCKET_ID: X64_0x7E_nt!ExpInterlockedPopEntrySListFault16+0
Followup: MachineOwner
---------
[/list]