*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {1, 2, 0, fffff80002ee1803}
Probably caused by : win32k.sys ( win32k!GreReleaseHmgrSemaphore+29 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000001, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ee1803, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030f70e0
0000000000000001
CURRENT_IRQL: 2
FAULTING_IP:
nt!IopCompleteRequest+ae3
fffff800`02ee1803 488b09 mov rcx,qword ptr [rcx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: AtBroker.exe
IRP_ADDRESS: ffffffffffffff89
TRAP_FRAME: fffff8800290d170 -- (.trap 0xfffff8800290d170)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800290d418 rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ee1803 rsp=fffff8800290d300 rbp=fffff8800290d450
r8=fffffa800632e780 r9=fffff8800290d400 r10=0000000000000002
r11=fffffa8005d83b20 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe cy
nt!IopCompleteRequest+0xae3:
fffff800`02ee1803 488b09 mov rcx,qword ptr [rcx] ds:d3a0:00000000`00000001=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ebdae9 to fffff80002ebe580
STACK_TEXT:
fffff880`0290d028 fffff800`02ebdae9 : 00000000`0000000a 00000000`00000001 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0290d030 fffff800`02ebc760 : 00000000`00000000 00000000`00000001 fffffa80`0472a800 fffffa80`0642f930 : nt!KiBugCheckDispatch+0x69
fffff880`0290d170 fffff800`02ee1803 : 00000000`00000000 fffff880`00dd59e2 fffffa80`0451c1a0 00000000`00000000 : nt!KiPageFault+0x260
fffff880`0290d300 fffff800`02e9958f : 00000000`00000001 00000000`00000001 fffff880`009e7100 fffffa80`00000000 : nt!IopCompleteRequest+0xae3
fffff880`0290d3d0 fffff800`02e99957 : 00000000`00000680 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`0290d450 fffff800`02eca33a : fffff960`00266c29 00000000`00000001 fffffa80`059353e0 00000000`00000000 : nt!KiApcInterrupt+0xd7
fffff880`0290d5e8 fffff960`00266c29 : 00000000`00000001 fffffa80`059353e0 00000000`00000000 fffff900`c0083010 : nt!ExReleaseResourceAndLeaveCriticalRegion+0x2a
fffff880`0290d5f0 fffff960`001a3e4b : 00000000`00000680 fffff880`0290d7c0 00000000`070101ba fffff960`001a43a9 : win32k!GreReleaseHmgrSemaphore+0x29
fffff880`0290d620 fffff960`00301bbc : 00000000`00000000 00000000`00000000 fffff900`c0202970 00000000`00000000 : win32k!HmgDecProcessHandleCount+0x6b
fffff880`0290d650 fffff960`001a78f9 : fffff900`c0202970 00000000`00000001 00000000`000001ba fffff900`c32fc010 : win32k!ENTRYOBJ::vFree+0x38
fffff880`0290d680 fffff960`001a783f : 00000000`070101ba 00000000`00000000 00000000`00000000 fffff960`001a74e7 : win32k!HmgFree+0x71
fffff880`0290d6f0 fffff960`002dbe50 : 00000000`00000000 00000000`00000004 00000000`00000000 00000000`070101ba : win32k!XDCOBJ::bDeleteDC+0x197
fffff880`0290d740 fffff960`001a7642 : fffff880`0290d7c0 00000000`00000000 fffff900`00000001 fffff960`001ade42 : win32k!bDeleteDCInternalWorker+0x20c
fffff880`0290d7a0 fffff960`001ad482 : 00000000`070101ba fffff880`0290dc1f 00000000`00000680 00000000`ffffffff : win32k!bDeleteDCInternal+0x56
fffff880`0290d7f0 fffff960`001a4c00 : 00000000`00000680 fffff880`0290dc00 fffff900`c0806760 fffff900`00000000 : win32k!NtGdiCloseProcess+0xee
fffff880`0290d850 fffff960`001a4337 : fffffa80`05ca5500 fffff880`0290dc20 00000000`00000000 fffff8a0`00094490 : win32k!GdiProcessCallout+0x200
fffff880`0290d8d0 fffff800`031a3455 : fffffa80`05ca5560 00000000`00000000 00000000`00000000 fffffa80`0648bb60 : win32k!W32pProcessCallout+0x6b
fffff880`0290d900 fffff800`0317c0ed : 00000000`00000001 fffff800`031bcc01 fffffa80`78457300 00000000`00000000 : nt!PspExitThread+0x561
fffff880`0290d9c0 fffff800`02e996a3 : fffffa80`06440001 fffffa80`06248710 00000000`00000000 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`0290d9f0 fffff800`02e99af0 : 00000000`00279710 fffff880`0290da70 fffff800`0317c1fc 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`0290da70 fffff800`02ebd877 : fffffa80`0649a350 0000007f`fffffff8 00000000`00000001 00000980`00000000 : nt!KiInitiateUserApc+0x70
fffff880`0290dbb0 00000000`772b008a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`01eff318 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x772b008a
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!GreReleaseHmgrSemaphore+29
fffff960`00266c29 ff1569a81100 call qword ptr [win32k!_imp_PsLeavePriorityRegion (fffff960`00381498)]
SYMBOL_STACK_INDEX: 7
SYMBOL_NAME: win32k!GreReleaseHmgrSemaphore+29
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4cbe5d3e
FAILURE_BUCKET_ID: X64_0xA_win32k!GreReleaseHmgrSemaphore+29
BUCKET_ID: X64_0xA_win32k!GreReleaseHmgrSemaphore+29
Followup: MachineOwner