*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {7, 109b, 1, fffff8a011b42310}
GetPointerFromAddress: unable to read from fffff80003510100
GetUlongFromAddress: unable to read from fffff800035101c0
Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+2722b )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 000000000000109b, (reserved)
Arg3: 0000000000000001, Memory contents of the pool block
Arg4: fffff8a011b42310, Address of the block of pool being deallocated
Debugging Details:
------------------
POOL_ADDRESS: fffff8a011b42310 Paged pool
FREED_POOL_TAG: ObSc
BUGCHECK_STR: 0xc2_7_ObSc
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
LAST_CONTROL_TRANSFER: from fffff8000340bbe9 to fffff800032d8bc0
STACK_TEXT:
fffff880`0ad8b768 fffff800`0340bbe9 : 00000000`000000c2 00000000`00000007 00000000`0000109b 00000000`00000001 : nt!KeBugCheckEx
fffff880`0ad8b770 fffff800`035f9b0d : 00000000`000000d0 fffff8a0`02a14970 fffff8a0`63416553 fffff8a0`05c80a00 : nt!ExDeferredFreePool+0x1201
fffff880`0ad8b820 fffff800`035ac9c5 : fffff8a0`05c80a00 fffffa80`09ade100 fffff8a0`00000004 fffff8a0`11b42310 : nt! ?? ::NNGAKEGL::`string'+0x2722b
fffff880`0ad8b8e0 fffff800`0359e4c7 : fffff8a0`131b7cc0 fffffa80`09977b00 fffffa80`09ade140 00000000`00000090 : nt!SeCopyClientToken+0xa1
fffff880`0ad8b970 fffff800`035acfbb : 00000000`00000000 ffffffff`ffffffff ffffffff`ffffffff fffffa80`09977b30 : nt!SepCreateClientSecurity+0xb7
fffff880`0ad8b9a0 fffff800`035780e1 : 00000000`068ee720 00000000`00000001 fffff880`0ad8ba88 fffff880`0ad8baf8 : nt!AlpcpCreateSecurityContext+0xe7
fffff880`0ad8ba40 fffff800`032d7e53 : fffffa80`0a50bb50 00000000`00000000 00000000`015a2418 00000000`00000000 : nt!NtAlpcCreateSecurityContext+0x130
fffff880`0ad8bae0 00000000`77291a4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`068ee588 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77291a4a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::NNGAKEGL::`string'+2722b
fffff800`035f9b0d 90 nop
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+2722b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 531590fb
IMAGE_VERSION: 6.1.7601.18409
FAILURE_BUCKET_ID: X64_0xc2_7_ObSc_nt!_??_::NNGAKEGL::_string_+2722b
BUCKET_ID: X64_0xc2_7_ObSc_nt!_??_::NNGAKEGL::_string_+2722b
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0xc2_7_obsc_nt!_??_::nngakegl::_string_+2722b
FAILURE_ID_HASH: {534460b3-f174-ff7b-26b7-248edd6e931b}
Followup: MachineOwner
---------