[list=1]
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\Care030\Windows_NT6_BSOD_jcgriff2\022312-7285-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02a4b000 PsLoadedModuleList = 0xfffff800`02c90670
Debug session time: Thu Feb 23 14:15:01.496 2012 (UTC - 7:00)
System Uptime: 0 days 2:17:03.323
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff280092159b0, 1, fffff80002ad1a4c, 7}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+44711 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff280092159b0, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002ad1a4c, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000007, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cfa100
fffff280092159b0
FAULTING_IP:
nt!ObfDereferenceObject+2c
fffff800`02ad1a4c f0480fc11f lock xadd qword ptr [rdi],rbx
MM_INTERNAL_CODE: 7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: ]òÌ
CURRENT_IRQL: 0
TRAP_FRAME: fffff88008bf9160 -- (.trap 0xfffff88008bf9160)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=fffff280092159e0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ad1a4c rsp=fffff08008bf92f0 rbp=fffff88008bf9b60
r8=fffffa800a1fe530 r9=0000000000000007 r10=0000000000000000
r11=00000000000f0000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!ObfDereferenceObject+0x2c:
fffff800`02ad1a4c f0480fc11f lock xadd qword ptr [rdi],rbx ds:e780:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002a72347 to fffff80002ac7c40
STACK_TEXT:
fffff880`08bf8ff8 fffff800`02a72347 : 00000000`00000050 fffff280`092159b0 00000000`00000001 fffff880`08bf9160 : nt!KeBugCheckEx
fffff880`08bf9000 fffff800`02ac5d6e : 00000000`00000001 fffff280`092159b0 00000800`00000000 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x44711
fffff880`08bf9160 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+44711
fffff800`02a72347 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+44711
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x50_nt!_??_::FNODOBFM::_string_+44711
BUCKET_ID: X64_0x50_nt!_??_::FNODOBFM::_string_+44711
Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\Care030\Windows_NT6_BSOD_jcgriff2\022112-7207-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02a1c000 PsLoadedModuleList = 0xfffff800`02c61670
Debug session time: Tue Feb 21 15:40:50.273 2012 (UTC - 7:00)
System Uptime: 0 days 1:18:49.116
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff2800a1e8ef8, 1, fffff80002a9f8ae, 7}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!ExAcquireResourceSharedLite+4e )
Followup: MachineOwner
---------
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff2800a1e8ef8, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002a9f8ae, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000007, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ccb100
fffff2800a1e8ef8
FAULTING_IP:
nt!ExAcquireResourceSharedLite+4e
fffff800`02a9f8ae f0480fba696000 lock bts qword ptr [rcx+60h],0
MM_INTERNAL_CODE: 7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: ÞðÌ
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800333f7e0 -- (.trap 0xfffff8800333f7e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88001273088 rbx=0000000000000000 rcx=fffff2800a1e8e98
rdx=fffff8800333fb01 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002a9f8ae rsp=fffff8800333f970 rbp=0000000000000000
r8=0000000000000000 r9=fffffa8008f67980 r10=0000000000000000
r11=fffffa80094e6270 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl zr na po nc
nt!ExAcquireResourceSharedLite+0x4e:
fffff800`02a9f8ae f0480fba696000 lock bts qword ptr [rcx+60h],0 ds:0001:fffff280`0a1e8ef8=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002a43347 to fffff80002a98c40
STACK_TEXT:
fffff880`0333f678 fffff800`02a43347 : 00000000`00000050 fffff280`0a1e8ef8 00000000`00000001 fffff880`0333f7e0 : nt!KeBugCheckEx
fffff880`0333f680 fffff800`02a96d6e : 00000000`00000001 fffff280`0a1e8ef8 fffffa80`09014700 fffff280`0a1e8e98 : nt! ?? ::FNODOBFM::`string'+0x44711
fffff880`0333f7e0 fffff800`02a9f8ae : 00000000`00000001 fffffa80`09ec8f20 00000000`00000000 fffffa80`0a1e6e00 : nt!KiPageFault+0x16e
fffff880`0333f970 fffff880`012daa29 : fffff880`030a5100 fffff8a0`15c34140 00000000`00000702 fffff880`030a5180 : nt!ExAcquireResourceSharedLite+0x4e
fffff880`0333f9e0 fffff800`02adddec : fffffa80`0a14b010 00000000`00000000 fffffa80`08f67980 fffffa80`09ec8e00 : Ntfs!NtfsAcquireScbForLazyWrite+0x59
fffff880`0333fa10 fffff800`02ade938 : 00000000`00000000 fffff880`0333fb18 fffffa80`08f67980 fffff800`02c9a8d8 : nt!CcWriteBehind+0x3c
fffff880`0333fac0 fffff800`02aa3001 : fffffa80`06dbb7d0 fffff800`02d8f901 fffff800`02c9a8c0 00000000`00000000 : nt!CcWorkerThread+0x1c8
fffff880`0333fb70 fffff800`02d33fee : 00000000`00000000 fffffa80`06d44b60 00000000`00000080 fffffa80`06d1e6f0 : nt!ExpWorkerThread+0x111
fffff880`0333fc00 fffff800`02a8a5e6 : fffff880`03189180 fffffa80`06d44b60 fffff880`031940c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0333fc40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExAcquireResourceSharedLite+4e
fffff800`02a9f8ae f0480fba696000 lock bts qword ptr [rcx+60h],0
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!ExAcquireResourceSharedLite+4e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x50_nt!ExAcquireResourceSharedLite+4e
BUCKET_ID: X64_0x50_nt!ExAcquireResourceSharedLite+4e
Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\Care030\Windows_NT6_BSOD_jcgriff2\022112-7191-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02a0a000 PsLoadedModuleList = 0xfffff800`02c4f670
Debug session time: Tue Feb 21 14:21:31.291 2012 (UTC - 7:00)
System Uptime: 0 days 0:01:49.008
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 34, {50853, fffff88003354418, fffff88003353c70, fffff80002a36f69}
Probably caused by : ntkrnlmp.exe ( nt!RtlSubtreePredecessor+9 )
Followup: MachineOwner
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CACHE_MANAGER (34)
See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000050853
Arg2: fffff88003354418
Arg3: fffff88003353c70
Arg4: fffff80002a36f69
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88003354418 -- (.exr 0xfffff88003354418)
ExceptionAddress: fffff80002a36f69 (nt!RtlSubtreePredecessor+0x0000000000000009)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000080000000010
Attempt to read from address 0000080000000010
CONTEXT: fffff88003353c70 -- (.cxr 0xfffff88003353c70)
rax=0000080000000000 rbx=fffffa8007286918 rcx=fffff8a00a83cd68
rdx=fffffa8007286918 rsi=fffff8a00a83cd68 rdi=0000000000000000
rip=fffff80002a36f69 rsp=fffff88003354658 rbp=fffffa8007286918
r8=ffffffffffffffff r9=fffff880033546a8 r10=00000000000001c6
r11=fffff8a00a83cd68 r12=fffffa8007287bf0 r13=fffff8a00a83cd68
r14=fffff8a00a83cd68 r15=0000000000000001
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!RtlSubtreePredecessor+0x9:
fffff800`02a36f69 488b4810 mov rcx,qword ptr [rax+10h] ds:002b:00000800`00000010=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: ÞðÌ
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000080000000010
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb9100
0000080000000010
FOLLOWUP_IP:
nt!RtlSubtreePredecessor+9
fffff800`02a36f69 488b4810 mov rcx,qword ptr [rax+10h]
FAULTING_IP:
nt!RtlSubtreePredecessor+9
fffff800`02a36f69 488b4810 mov rcx,qword ptr [rax+10h]
BUGCHECK_STR: 0x34
LAST_CONTROL_TRANSFER: from fffff80002a6b4c4 to fffff80002a36f69
STACK_TEXT:
fffff880`03354658 fffff800`02a6b4c4 : fffffa80`07287bf0 00000000`00000000 fffffa80`093aec30 fffff880`01068aae : nt!RtlSubtreePredecessor+0x9
fffff880`03354660 fffff880`0106926f : ffffffff`ffffffff fffffa80`072868d8 fffffa80`072868c8 fffff8a0`0a83cd68 : nt!RtlDeleteNoSplay+0x7c
fffff880`03354690 fffff880`010664a0 : fffffa80`093aec30 fffffa80`07287bf0 fffffa80`075e4684 fffffa80`073f1010 : fltmgr!TreeUnlinkMulti+0xef
fffff880`033546e0 fffff880`01067329 : fffff880`03358000 00000000`00000002 00000000`00000000 00000000`00000000 : fltmgr!FltpPerformPreCallbacks+0x730
fffff880`033547e0 fffff880`010656c7 : fffffa80`071959c0 fffffa80`07519bc0 fffffa80`073bce80 00000000`00000000 : fltmgr!FltpPassThrough+0x2d9
fffff880`03354860 fffff800`02d8338e : fffffa80`07287bf0 fffffa80`074c1820 00000000`00000000 fffffa80`07519bc0 : fltmgr!FltpDispatch+0xb7
fffff880`033548c0 fffff800`02a90af4 : 00000000`00000000 fffffa80`07287bf0 fffffa80`06d318e0 fffffa80`06d6e7f0 : nt!IopDeleteFile+0x11e
fffff880`03354950 fffff800`02acbad8 : fffffa80`07287bf0 00000000`00000002 fffffa80`07287b00 fffffa80`07287b00 : nt!ObfDereferenceObject+0xd4
fffff880`033549b0 fffff800`02acc2fe : fffffa80`07287980 fffffa80`07287980 fffff880`03117180 fffffa80`07287b00 : nt!CcDeleteSharedCacheMap+0x224
fffff880`03354a10 fffff800`02acc938 : fffff800`02c88800 fffff880`03354b18 fffffa80`071ecb70 fffff800`02c888b8 : nt!CcWriteBehind+0x54e
fffff880`03354ac0 fffff800`02a91001 : fffffa80`06dbb7d0 fffff800`02d7d901 fffff800`02c888c0 fffff800`00000002 : nt!CcWorkerThread+0x1c8
fffff880`03354b70 fffff800`02d21fee : 00000000`00000000 fffffa80`06dc2040 00000000`00000080 fffffa80`06d1e6f0 : nt!ExpWorkerThread+0x111
fffff880`03354c00 fffff800`02a785e6 : fffff880`03189180 fffffa80`06dc2040 fffff880`031940c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03354c40 00000000`00000000 : fffff880`03355000 fffff880`0334f000 fffff880`033542f0 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!RtlSubtreePredecessor+9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff88003353c70 ; kb
FAILURE_BUCKET_ID: X64_0x34_nt!RtlSubtreePredecessor+9
BUCKET_ID: X64_0x34_nt!RtlSubtreePredecessor+9
Followup: MachineOwner
---------
[/list]