regular old dan
New member
- Local time
- 4:45 PM
- Messages
- 3
Hi all, I unfortunately can't run any 3rd party software or upload raw data from the PCs in question, but we're seeing a large number of BSODs at work and all have a similar signature to this - a double fault when the kernel thread looks like it overruns the 24kb available, and almost all that is being used by win32k.sys apparently recursing. Why on earth win32k seems to be going through the same functions over and over, I have no idea, but here it's using 23088 bytes of kernel stack.
I realize there's probably no way anyone can tell why win32k is doing this since we don't have the code/symbols to see the messages it's sending, I was more curious as to whether anyone's seen something like this before. I realize the sk.sys and mcafee drivers are in the trace, however they're using a tiny amount of stack space compared to win32k. I have other examples where the call stack is win32k -> ProcessMouseInput -> Intel gfx driver -> double fault, again with win32k using 16-20 kbytes of kernel stack.
This is the output of windbg kf, !analyze -v, !stackusage. I can run any other commands you'd like as long as the output can be sanitized, i.e. doesn't show raw memory values.
I realize there's probably no way anyone can tell why win32k is doing this since we don't have the code/symbols to see the messages it's sending, I was more curious as to whether anyone's seen something like this before. I realize the sk.sys and mcafee drivers are in the trace, however they're using a tiny amount of stack space compared to win32k. I have other examples where the call stack is win32k -> ProcessMouseInput -> Intel gfx driver -> double fault, again with win32k using 16-20 kbytes of kernel stack.
This is the output of windbg kf, !analyze -v, !stackusage. I can run any other commands you'd like as long as the output can be sanitized, i.e. doesn't show raw memory values.
Code:
Microsoft (R) Windows Debugger Version 10.0.17763.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\dumps\10_24_Dumps\123-WS-DD36K2W.dmp]
Kernel Complete Dump File: Full address space is available
Symbol search path is: srv*
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.24231.amd64fre.win7sp1_ldr.180810-0600
Machine Name:
Kernel base = 0xfffff800`0344f000 PsLoadedModuleList = 0xfffff800`03689c90
Debug session time: Wed Oct 24 10:54:07.022 2018 (UTC - 5:00)
System Uptime: 0 days 16:22:04.499
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
.........................
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7F, {8, 80050031, 406f8, fffff88004afe4ec}
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
*** ERROR: Module load completed but symbols could not be loaded for mfeaack.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for sk.sys
Probably caused by : win32k.sys
Followup: MachineOwner
---------
Processing initial command 'kF; !analyze -v; !stackusage'
0: kd> kF; !analyze -v; !stackusage
# Memory Child-SP RetAddr Call Site
00 fffff800`04b49d08 fffff800`034f0d69 nt!KeBugCheckEx
01 8 fffff800`04b49d10 fffff800`034ed84b nt!KiBugCheckDispatch+0x69
02 140 fffff800`04b49e50 fffff880`04afe4ec nt!KiDoubleFaultAbort+0x28b
03 fd8861a0 fffff880`023cfff0 fffff880`04b03f24 atikmdag+0xd64ec
04 80 fffff880`023d0070 fffff880`04b0432e atikmdag+0xdbf24
05 90 fffff880`023d0100 fffff880`04b0a2d6 atikmdag+0xdc32e
06 90 fffff880`023d0190 fffff880`04afcd98 atikmdag+0xe22d6
07 80 fffff880`023d0210 fffff880`04a70cc7 atikmdag+0xd4d98
08 30 fffff880`023d0240 fffff880`041b64a9 atikmdag+0x48cc7
09 30 fffff880`023d0270 fffff800`034e3608 atikmpag+0x54a9
0a 30 fffff880`023d02a0 fffff800`03488788 nt!KiInterruptDispatch+0xb8
0b 190 fffff880`023d0430 fffff880`05e2c303 nt!KeAcquireSpinLockRaiseToDpc+0x28
0c 50 fffff880`023d0480 fffff880`05e53be7 mfeaack+0x2c303
0d 30 fffff880`023d04b0 fffff880`05e53d78 mfeaack+0x53be7
0e 30 fffff880`023d04e0 fffff880`05e54b36 mfeaack+0x53d78
0f 40 fffff880`023d0520 fffff880`05e563c1 mfeaack+0x54b36
10 240 fffff880`023d0760 fffff880`05e4ee21 mfeaack+0x563c1
11 140 fffff880`023d08a0 fffff880`05e4f2bf mfeaack+0x4ee21
12 b0 fffff880`023d0950 fffff880`05e34785 mfeaack+0x4f2bf
13 70 fffff880`023d09c0 fffff880`05e3587c mfeaack+0x34785
14 70 fffff880`023d0a30 fffff880`05e35de4 mfeaack+0x3587c
15 50 fffff880`023d0a80 fffff880`05e1d58d mfeaack+0x35de4
16 e0 fffff880`023d0b60 fffff880`05e25a99 mfeaack+0x1d58d
17 80 fffff880`023d0be0 fffff880`01678939 mfeaack+0x25a99
18 190 fffff880`023d0d70 fffff880`0167978e mfehidk+0x48939
19 30 fffff880`023d0da0 fffff800`0382be76 mfehidk+0x4978e
1a 30 fffff880`023d0dd0 fffff800`0382c37f nt!ObpCallPreOperationCallbacks+0x196
1b 80 fffff880`023d0e50 fffff800`037c7a3f nt!ObpPreInterceptHandleCreate+0xaf
1c 80 fffff880`023d0ed0 fffff800`0374b801 nt! ?? ::NNGAKEGL::`string'+0x1b81f
1d 110 fffff880`023d0fe0 fffff800`0375e000 nt!ObOpenObjectByPointerWithTag+0x109
1e 220 fffff880`023d1200 fffff880`00f5bfd3 nt!ObOpenObjectByPointer+0x30
1f 50 fffff880`023d1250 fffff880`00f5c1b6 sk+0x68fd3
20 80 fffff880`023d12d0 fffff880`00f53931 sk+0x691b6
21 30 fffff880`023d1300 fffff880`00f537d2 sk+0x60931
22 70 fffff880`023d1370 fffff880`00f529f4 sk+0x607d2
23 130 fffff880`023d14a0 fffff880`00f249c0 sk+0x5f9f4
24 120 fffff880`023d15c0 fffff880`00f23f74 sk+0x319c0
25 e0 fffff880`023d16a0 fffff880`00ef5a1a sk+0x30f74
26 160 fffff880`023d1800 fffff880`00f30ae7 sk+0x2a1a
27 60 fffff880`023d1860 fffff880`00f31b95 sk+0x3dae7
28 d0 fffff880`023d1930 fffff880`00f51511 sk+0x3eb95
29 40 fffff880`023d1970 fffff800`0373c928 sk+0x5e511
2a 30 fffff880`023d19a0 fffff800`034f09d3 nt!NtReadFile+0x718
2b 130 fffff880`023d1ad0 fffff800`034e61b0 nt!KiSystemServiceCopyEnd+0x13
2c 208 fffff880`023d1cd8 fffff960`001cb943 nt!KiServiceLinkage
2d 8 fffff880`023d1ce0 fffff960`0016d0b0 win32k!StartDeviceRead+0x1df
2e 60 fffff880`023d1d40 fffff800`0347c5bd win32k!InputApc+0x84
2f 30 fffff880`023d1d70 fffff800`0348813d nt!KiDeliverApc+0x21d
30 80 fffff880`023d1df0 fffff800`0349ae42 nt!KiCommitThreadWait+0x3dd
31 90 fffff880`023d1e80 fffff960`0013ef77 nt!KeWaitForMultipleObjects+0x272
32 2c0 fffff880`023d2140 fffff960`0013f039 win32k!xxxRealSleepThread+0x2ab
33 c0 fffff880`023d2200 fffff960`000f52d3 win32k!xxxSleepThread+0x59
34 30 fffff880`023d2230 fffff960`0013df9e win32k!xxxInterSendMsgEx+0x112a
35 110 fffff880`023d2340 fffff960`0011db46 win32k!xxxSendMessageTimeout+0x1de
36 b0 fffff880`023d23f0 fffff960`000fea2e win32k!xxxRealDefWindowProc+0x14c9
37 210 fffff880`023d2600 fffff960`000feb3a win32k!xxxDefWindowProc+0x15e
38 50 fffff880`023d2650 fffff960`000feaa5 win32k!xxxDesktopWndProcWorker+0x7a
39 180 fffff880`023d27d0 fffff960`0013e035 win32k!xxxDesktopWndProc+0x55
3a 30 fffff880`023d2800 fffff960`0011dd76 win32k!xxxSendMessageTimeout+0x275
3b b0 fffff880`023d28b0 fffff960`000fea2e win32k!xxxRealDefWindowProc+0x16f9
3c 210 fffff880`023d2ac0 fffff960`000feb3a win32k!xxxDefWindowProc+0x15e
3d 50 fffff880`023d2b10 fffff960`000feaa5 win32k!xxxDesktopWndProcWorker+0x7a
3e 180 fffff880`023d2c90 fffff960`000f3fd7 win32k!xxxDesktopWndProc+0x55
3f 30 fffff880`023d2cc0 fffff960`0013ed7f win32k!xxxReceiveMessage+0x6cb
40 f0 fffff880`023d2db0 fffff960`0013f039 win32k!xxxRealSleepThread+0xb3
41 c0 fffff880`023d2e70 fffff960`000f52d3 win32k!xxxSleepThread+0x59
42 30 fffff880`023d2ea0 fffff960`0013df9e win32k!xxxInterSendMsgEx+0x112a
43 110 fffff880`023d2fb0 fffff960`0011db46 win32k!xxxSendMessageTimeout+0x1de
44 b0 fffff880`023d3060 fffff960`000fea2e win32k!xxxRealDefWindowProc+0x14c9
45 210 fffff880`023d3270 fffff960`000feb3a win32k!xxxDefWindowProc+0x15e
46 50 fffff880`023d32c0 fffff960`000feaa5 win32k!xxxDesktopWndProcWorker+0x7a
47 180 fffff880`023d3440 fffff960`0013e035 win32k!xxxDesktopWndProc+0x55
48 30 fffff880`023d3470 fffff960`0011dd76 win32k!xxxSendMessageTimeout+0x275
49 b0 fffff880`023d3520 fffff960`000fea2e win32k!xxxRealDefWindowProc+0x16f9
4a 210 fffff880`023d3730 fffff960`000feb3a win32k!xxxDefWindowProc+0x15e
4b 50 fffff880`023d3780 fffff960`000feaa5 win32k!xxxDesktopWndProcWorker+0x7a
4c 180 fffff880`023d3900 fffff960`000f3fd7 win32k!xxxDesktopWndProc+0x55
4d 30 fffff880`023d3930 fffff960`0013ed7f win32k!xxxReceiveMessage+0x6cb
4e f0 fffff880`023d3a20 fffff960`0013f039 win32k!xxxRealSleepThread+0xb3
4f c0 fffff880`023d3ae0 fffff960`000f52d3 win32k!xxxSleepThread+0x59
50 30 fffff880`023d3b10 fffff960`0013df9e win32k!xxxInterSendMsgEx+0x112a
51 110 fffff880`023d3c20 fffff960`0011db46 win32k!xxxSendMessageTimeout+0x1de
52 b0 fffff880`023d3cd0 fffff960`000fea2e win32k!xxxRealDefWindowProc+0x14c9
53 210 fffff880`023d3ee0 fffff960`000feb3a win32k!xxxDefWindowProc+0x15e
54 50 fffff880`023d3f30 fffff960`000feaa5 win32k!xxxDesktopWndProcWorker+0x7a
55 180 fffff880`023d40b0 fffff960`0013e035 win32k!xxxDesktopWndProc+0x55
56 30 fffff880`023d40e0 fffff960`0011dd76 win32k!xxxSendMessageTimeout+0x275
57 b0 fffff880`023d4190 fffff960`000fea2e win32k!xxxRealDefWindowProc+0x16f9
58 210 fffff880`023d43a0 fffff960`000feb3a win32k!xxxDefWindowProc+0x15e
59 50 fffff880`023d43f0 fffff960`000feaa5 win32k!xxxDesktopWndProcWorker+0x7a
5a 180 fffff880`023d4570 fffff960`000f3fd7 win32k!xxxDesktopWndProc+0x55
5b 30 fffff880`023d45a0 fffff960`0013ed7f win32k!xxxReceiveMessage+0x6cb
5c f0 fffff880`023d4690 fffff960`0013f039 win32k!xxxRealSleepThread+0xb3
5d c0 fffff880`023d4750 fffff960`000f52d3 win32k!xxxSleepThread+0x59
5e 30 fffff880`023d4780 fffff960`0013df9e win32k!xxxInterSendMsgEx+0x112a
5f 110 fffff880`023d4890 fffff960`0011db46 win32k!xxxSendMessageTimeout+0x1de
60 b0 fffff880`023d4940 fffff960`000fea2e win32k!xxxRealDefWindowProc+0x14c9
61 210 fffff880`023d4b50 fffff960`000feb3a win32k!xxxDefWindowProc+0x15e
62 50 fffff880`023d4ba0 fffff960`000feaa5 win32k!xxxDesktopWndProcWorker+0x7a
63 180 fffff880`023d4d20 fffff960`0013e035 win32k!xxxDesktopWndProc+0x55
64 30 fffff880`023d4d50 fffff960`0011dd76 win32k!xxxSendMessageTimeout+0x275
65 b0 fffff880`023d4e00 fffff960`000fea2e win32k!xxxRealDefWindowProc+0x16f9
66 210 fffff880`023d5010 fffff960`000feb3a win32k!xxxDefWindowProc+0x15e
67 50 fffff880`023d5060 fffff960`000feaa5 win32k!xxxDesktopWndProcWorker+0x7a
68 180 fffff880`023d51e0 fffff960`000f3fd7 win32k!xxxDesktopWndProc+0x55
69 30 fffff880`023d5210 fffff960`0013ed7f win32k!xxxReceiveMessage+0x6cb
6a f0 fffff880`023d5300 fffff960`0013f039 win32k!xxxRealSleepThread+0xb3
6b c0 fffff880`023d53c0 fffff960`000f52d3 win32k!xxxSleepThread+0x59
6c 30 fffff880`023d53f0 fffff960`0013df9e win32k!xxxInterSendMsgEx+0x112a
6d 110 fffff880`023d5500 fffff960`0011db46 win32k!xxxSendMessageTimeout+0x1de
6e b0 fffff880`023d55b0 fffff960`000fea2e win32k!xxxRealDefWindowProc+0x14c9
6f 210 fffff880`023d57c0 fffff960`000feb3a win32k!xxxDefWindowProc+0x15e
70 50 fffff880`023d5810 fffff960`000feaa5 win32k!xxxDesktopWndProcWorker+0x7a
71 180 fffff880`023d5990 fffff960`0013e035 win32k!xxxDesktopWndProc+0x55
72 30 fffff880`023d59c0 fffff960`0011dd76 win32k!xxxSendMessageTimeout+0x275
73 b0 fffff880`023d5a70 fffff960`000fea2e win32k!xxxRealDefWindowProc+0x16f9
74 210 fffff880`023d5c80 fffff960`000feb3a win32k!xxxDefWindowProc+0x15e
75 50 fffff880`023d5cd0 fffff960`000feaa5 win32k!xxxDesktopWndProcWorker+0x7a
76 180 fffff880`023d5e50 fffff960`000f3fd7 win32k!xxxDesktopWndProc+0x55
77 30 fffff880`023d5e80 fffff960`0013ed7f win32k!xxxReceiveMessage+0x6cb
78 f0 fffff880`023d5f70 fffff960`0013f039 win32k!xxxRealSleepThread+0xb3
79 c0 fffff880`023d6030 fffff960`000f52d3 win32k!xxxSleepThread+0x59
7a 30 fffff880`023d6060 fffff960`0013df9e win32k!xxxInterSendMsgEx+0x112a
7b 110 fffff880`023d6170 fffff960`0011db46 win32k!xxxSendMessageTimeout+0x1de
7c b0 fffff880`023d6220 fffff960`000fea2e win32k!xxxRealDefWindowProc+0x14c9
7d 210 fffff880`023d6430 fffff960`000feb3a win32k!xxxDefWindowProc+0x15e
7e 50 fffff880`023d6480 fffff960`000feaa5 win32k!xxxDesktopWndProcWorker+0x7a
7f 180 fffff880`023d6600 fffff960`0013e035 win32k!xxxDesktopWndProc+0x55
80 30 fffff880`023d6630 fffff960`0011dd76 win32k!xxxSendMessageTimeout+0x275
81 b0 fffff880`023d66e0 fffff960`000fea2e win32k!xxxRealDefWindowProc+0x16f9
82 210 fffff880`023d68f0 fffff960`000feb3a win32k!xxxDefWindowProc+0x15e
83 50 fffff880`023d6940 fffff960`000feaa5 win32k!xxxDesktopWndProcWorker+0x7a
84 180 fffff880`023d6ac0 fffff960`000f3fd7 win32k!xxxDesktopWndProc+0x55
85 30 fffff880`023d6af0 fffff960`0013ed7f win32k!xxxReceiveMessage+0x6cb
86 f0 fffff880`023d6be0 fffff960`0013f039 win32k!xxxRealSleepThread+0xb3
87 c0 fffff880`023d6ca0 fffff960`000f52d3 win32k!xxxSleepThread+0x59
88 30 fffff880`023d6cd0 fffff960`0013df9e win32k!xxxInterSendMsgEx+0x112a
89 110 fffff880`023d6de0 fffff960`0011db46 win32k!xxxSendMessageTimeout+0x1de
8a b0 fffff880`023d6e90 fffff960`000fea2e win32k!xxxRealDefWindowProc+0x14c9
8b 210 fffff880`023d70a0 fffff960`000feb3a win32k!xxxDefWindowProc+0x15e
8c 50 fffff880`023d70f0 fffff960`000feaa5 win32k!xxxDesktopWndProcWorker+0x7a
8d 180 fffff880`023d7270 fffff960`0013e035 win32k!xxxDesktopWndProc+0x55
8e 30 fffff880`023d72a0 fffff960`0011dd76 win32k!xxxSendMessageTimeout+0x275
8f b0 fffff880`023d7350 fffff960`000fea2e win32k!xxxRealDefWindowProc+0x16f9
90 210 fffff880`023d7560 fffff960`000feb3a win32k!xxxDefWindowProc+0x15e
91 50 fffff880`023d75b0 fffff960`000feaa5 win32k!xxxDesktopWndProcWorker+0x7a
92 180 fffff880`023d7730 fffff960`000f3fd7 win32k!xxxDesktopWndProc+0x55
93 30 fffff880`023d7760 fffff960`0013d105 win32k!xxxReceiveMessage+0x6cb
94 f0 fffff880`023d7850 fffff960`0013d6ad win32k!xxxRealInternalGetMessage+0x339
95 e0 fffff880`023d7930 fffff960`0010c790 win32k!xxxInternalGetMessage+0x35
96 40 fffff880`023d7970 fffff960`0010c667 win32k!xxxHandleDesktopMessages+0x50
97 90 fffff880`023d7a00 fffff960`000c5140 win32k!xxxDesktopThread+0x263
98 80 fffff880`023d7a80 fffff960`00147bad win32k!xxxCreateSystemThreads+0x64
99 30 fffff880`023d7ab0 fffff800`034f09d3 win32k!NtUserCallNoParam+0x39
9a 30 fffff880`023d7ae0 000007fe`fd4e1f1a nt!KiSystemServiceCopyEnd+0x13
9b 00000000`0241fb38 000007fe`fd4e3759 winsrv!ZwUserCallNoParam+0xa
9c 8 00000000`0241fb40 00000000`77a13865 winsrv!StartCreateSystemThreads+0x19
9d 30 00000000`0241fb70 00000000`00000000 ntdll!RtlUserThreadStart+0x25
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000406f8
Arg4: fffff88004afe4ec
Debugging Details:
------------------
KEY_VALUES_STRING: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 402
BUILD_VERSION_STRING: 7601.24231.amd64fre.win7sp1_ldr.180810-0600
SYSTEM_MANUFACTURER: Dell Inc.
SYSTEM_PRODUCT_NAME: OptiPlex 990
SYSTEM_VERSION: 01
BIOS_VENDOR: Dell Inc.
BIOS_VERSION: A13
BIOS_DATE: 04/02/2012
BASEBOARD_MANUFACTURER: Dell Inc.
BASEBOARD_PRODUCT: 0D6H9T
BASEBOARD_VERSION: A03
DUMP_TYPE: 0
BUGCHECK_P1: 8
BUGCHECK_P2: 80050031
BUGCHECK_P3: 406f8
BUGCHECK_P4: fffff88004afe4ec
BUGCHECK_STR: 0x7f_8
TRAP_FRAME: fffff80004b49e50 -- (.trap 0xfffff80004b49e50)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000004 rbx=0000000000000000 rcx=fffff880023d0014
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88004afe4ec rsp=fffff880023cfff0 rbp=fffffa800a6f91d0
r8=0000000000000044 r9=fffff88004b039b0 r10=fffffa8009cef1c0
r11=fffff880023d0840 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
atikmdag+0xd64ec:
fffff880`04afe4ec e88f51fdff call atikmdag+0xab680 (fffff880`04ad3680)
Resetting default scope
CPU_COUNT: 4
CPU_MHZ: c15
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 2a
CPU_STEPPING: 7
CPU_MICROCODE: 6,2a,7,0 (F,M,S,R) SIG: 25'00000000 (cache) 25'00000000 (init)
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: csrss.exe
CURRENT_IRQL: b
ANALYSIS_SESSION_HOST: 123-WSM-FOG
ANALYSIS_SESSION_TIME: 10-24-2018 14:19:20.0718
ANALYSIS_VERSION: 10.0.17763.1 amd64fre
STACK_OVERFLOW: Stack Limit: fffff880023d0000. Use (kF) and (!stackusage) to investigate stack usage.
STACKUSAGE_IMAGE: The module at base 0xFFFFF96000070000 was blamed for the stack overflow. It is using 23088 bytes of stack.
STACK_COMMAND: .trap 0xfffff80004b49e50 ; kb
THREAD_SHA1_HASH_MOD_FUNC: 6a385cbb0f8ccdfe23d79c837887292e3a0343d4
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: a6b9b24f6a7c8d313955e42df514504db9c2022d
THREAD_SHA1_HASH_MOD: 12bfd209d07a227395ddd4f8fb373895e22f9deb
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5b40db20
IMAGE_VERSION: 6.1.7601.24204
FAILURE_BUCKET_ID: X64_0x7f_8_STACK_USAGE_IMAGE_win32k.sys
BUCKET_ID: X64_0x7f_8_STACK_USAGE_IMAGE_win32k.sys
PRIMARY_PROBLEM_CLASS: X64_0x7f_8_STACK_USAGE_IMAGE_win32k.sys
TARGET_TIME: 2018-10-24T15:54:07.000Z
OSBUILD: 7601
OSSERVICEPACK: 1000
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 7
OSEDITION: Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2018-08-10 10:14:00
BUILDDATESTAMP_STR: 180810-0600
BUILDLAB_STR: win7sp1_ldr
BUILDOSVER_STR: 6.1.7601.24231.amd64fre.win7sp1_ldr.180810-0600
ANALYSIS_SESSION_ELAPSED_TIME: 15b0
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x7f_8_stack_usage_image_win32k.sys
FAILURE_ID_HASH: {9379fe1d-c62a-7f6a-5b2c-3449edfdc1b1}
Followup: MachineOwner
---------
Stack Usage By Function
=================================================================================
Size Count Module
0x00048260 2 nt!KiSystemServiceCopyEnd
0x00001500 14 win32k!xxxDesktopWndProcWorker
0x00000E70 7 win32k!xxxRealDefWindowProc
0x00000E70 7 win32k!xxxRealDefWindowProc
0x00000770 7 win32k!xxxInterSendMsgEx
0x00000690 7 win32k!xxxReceiveMessage
0x000004D0 7 win32k!xxxSendMessageTimeout
0x000004D0 7 win32k!xxxSendMessageTimeout
0x00000480 6 win32k!xxxRealSleepThread
0x00000460 14 win32k!xxxDefWindowProc
0x000002C0 1 nt!KeWaitForMultipleObjects
0x000002A0 14 win32k!xxxDesktopWndProc
0x00000240 1 mfeaack
0x00000220 1 nt!ObOpenObjectByPointerWithTag
0x00000190 1 nt!KiInterruptDispatch
0x00000190 1 mfeaack
0x00000160 1 sk
0x00000150 7 win32k!xxxSleepThread
0x00000140 1 nt!KiBugCheckDispatch
0x00000140 1 mfeaack
0x00000130 1 nt!NtReadFile
0x00000130 1 sk
0x00000120 1 sk
0x00000110 1 nt! ?? ::NNGAKEGL::`string'
0x000000E0 1 sk
0x000000E0 1 mfeaack
0x000000E0 1 win32k!xxxRealInternalGetMessage
0x000000D0 1 sk
0x000000C0 1 win32k!xxxRealSleepThread
0x000000B0 1 mfeaack
0x00000090 1 nt!KiCommitThreadWait
0x00000090 1 atikmdag
0x00000090 1 atikmdag
0x00000090 1 win32k!xxxHandleDesktopMessages
0x00000080 1 nt!KiDeliverApc
0x00000080 1 nt!ObpCallPreOperationCallbacks
0x00000080 1 nt!ObpPreInterceptHandleCreate
0x00000080 1 sk
0x00000080 1 atikmdag
0x00000080 1 atikmdag
0x00000080 1 mfeaack
0x00000080 1 win32k!xxxDesktopThread
0x00000070 1 sk
0x00000070 1 mfeaack
0x00000070 1 mfeaack
0x00000060 1 sk
0x00000060 1 win32k!StartDeviceRead
0x00000050 1 nt!KeAcquireSpinLockRaiseToDpc
0x00000050 1 nt!ObOpenObjectByPointer
0x00000050 1 mfeaack
0x00000040 1 sk
0x00000040 1 mfeaack
0x00000040 1 win32k!xxxInternalGetMessage
0x00000030 1 winsrv!StartCreateSystemThreads
0x00000030 1 sk
0x00000030 1 sk
0x00000030 1 mfehidk
0x00000030 1 mfehidk
0x00000030 1 atikmpag
0x00000030 1 atikmdag
0x00000030 1 atikmdag
0x00000030 1 mfeaack
0x00000030 1 mfeaack
0x00000030 1 win32k!xxxCreateSystemThreads
0x00000030 1 win32k!NtUserCallNoParam
0x00000030 1 win32k!InputApc
0x00000008 1 winsrv!ZwUserCallNoParam
0x00000008 2 nt!KeBugCheckEx
0x00000008 1 nt!KiServiceLinkage
Total Size: 0x0004FCC8
Stack Usage By Module
=================================================================================
Size Count Module
0x00048F10 17 nt
0x00005A30 106 win32k
0x000008F0 12 mfeaack
0x00000750 11 sk
0x00000280 6 atikmdag
0x00000060 2 mfehidk
0x00000038 2 winsrv
0x00000030 1 atikmpag
Total Size: 0x0004FCC8My Computer
- Computer type
- PC/Desktop
- OS
- Windows 7 Professional