Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\K\Desktop\032010-19110-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*F:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`0300e000 PsLoadedModuleList = 0xfffff800`0324be50
Debug session time: Sat Mar 20 18:52:56.890 2010 (GMT-4)
System Uptime: 0 days 4:01:16.107
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffffa804d9298d0, 2, 0, fffff8000306feeb}
Probably caused by : memory_corruption ( nt!MiResolveMappedFileFault+8b )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa804d9298d0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000306feeb, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b60e0
fffffa804d9298d0
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiResolveMappedFileFault+8b
fffff800`0306feeb 4d8b11 mov r10,qword ptr [r9]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: svchost.exe
TRAP_FRAME: fffff8800cf34350 -- (.trap 0xfffff8800cf34350)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff98019fa9000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000020 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800033835f1 rsp=fffff8800cf344e0 rbp=fffff8800cf34960
r8=0000000000000012 r9=0000000000000000 r10=00000000fffffff9
r11=0000000000829000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
nt!CcMapData+0x111:
fffff800`033835f1 0fb600 movzx eax,byte ptr [rax] ds:8d08:fffff980`19fa9000=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000307f469 to fffff8000307ff00
STACK_TEXT:
fffff880`0cf33bf8 fffff800`0307f469 : 00000000`0000000a fffffa80`4d9298d0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0cf33c00 fffff800`0307e0e0 : fffff880`0cf33d40 fa804d92`98d004c0 00000000`00000000 fffff880`01d8dd5a : nt!KiBugCheckDispatch+0x69
fffff880`0cf33d40 fffff800`0306feeb : 00000000`00001000 00000000`00002001 00000000`00000000 fffff880`0cf33f08 : nt!KiPageFault+0x260
fffff880`0cf33ed0 fffff800`030a660d : fa804d92`98d004c0 f8a00037`21480400 fffff8a0`00372148 00000000`00000000 : nt!MiResolveMappedFileFault+0x8b
fffff880`0cf34040 fffff800`0309bd9e : 00000000`00000000 fffff980`19fa9000 fffff6fc`c00cfd48 fffff800`0320ae00 : nt!MiResolveProtoPteFault+0x48d
fffff880`0cf340e0 fffff800`0309a4d1 : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 3ff00000`4aa5a921 : nt!MiDispatchFault+0x1de
fffff880`0cf341f0 fffff800`0307dfee : 00000000`00000000 00000000`0000000e 00000000`00000000 00000000`00000001 : nt!MmAccessFault+0x8f1
fffff880`0cf34350 fffff800`033835f1 : 00000000`08800000 00000000`08829000 fffff880`0cf345a8 fffff880`0cf345a0 : nt!KiPageFault+0x16e
fffff880`0cf344e0 fffff880`01eed522 : 00030000`00017000 fffffa80`03cdb0c0 00000000`00000000 fffffa80`0000000e : nt!CcMapData+0x111
fffff880`0cf345a0 fffff880`01f7f8c3 : fffffa80`04576010 fffffa80`05a70180 fffff880`0cf34710 00000000`08829000 : Ntfs!NtfsReadMftRecord+0xb2
fffff880`0cf34650 fffff880`01f8a9a7 : fffffa80`04576010 fffffa80`05a70180 00000000`00000101 fffff880`0cf34728 : Ntfs!NtfsTryOpenFcb+0x133
fffff880`0cf346f0 fffff880`01f8db0e : fffffa80`04576010 fffffa80`05a70180 fffffa80`07528f00 fffff880`01d85600 : Ntfs!NtfsIterateMft+0x147
fffff880`0cf34790 fffff880`01f3276a : fffffa80`04576010 fffff8a0`0a1de390 fffffa80`05a70180 fffffa80`059418e0 : Ntfs!NtfsEnumerateUsnData+0x22e
fffff880`0cf34840 fffff880`01eeb2ed : fffffa80`04576010 00000000`00000000 fffff880`0cf34960 00000000`00000000 : Ntfs! ?? ::NNGAKEGL::`string'+0x1ccfd
fffff880`0cf34880 fffff880`01d8123f : fffff880`0cf349d0 fffffa80`0472d6b0 fffff880`0cf34901 fffffa80`04576010 : Ntfs!NtfsFsdFileSystemControl+0x13d
fffff880`0cf34920 fffff880`01da091e : fffffa80`05926b60 fffffa80`041de070 fffffa80`05926b00 fffffa80`0472d6b0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0cf349b0 fffff800`033983a7 : fffffa80`041de070 fffff880`0cf34ca0 fffffa80`0472da98 fffffa80`0472d6b0 : fltmgr!FltpFsControl+0xee
fffff880`0cf34a10 fffff800`0336198a : fffffa80`04210b30 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`0cf34b40 fffff800`0307f153 : fffffa80`04210b30 00000000`00000001 fffffa80`077c0790 fffff800`03393094 : nt!NtFsControlFile+0x56
fffff880`0cf34bb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiResolveMappedFileFault+8b
fffff800`0306feeb 4d8b11 mov r10,qword ptr [r9]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiResolveMappedFileFault+8b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xA_nt!MiResolveMappedFileFault+8b
BUCKET_ID: X64_0xA_nt!MiResolveMappedFileFault+8b
Followup: MachineOwner
---------