NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904fb
Arg2: 96a83788
Arg3: 96a83360
Arg4: 8b0fa20f
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for tdrpm273.sys
FAULTING_MODULE: 82051000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 0
EXCEPTION_RECORD: 96a83788 -- (.exr 0xffffffff96a83788)
ExceptionAddress: 8b0fa20f (Ntfs!TxfShutdownRm+0x000001e9)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 326a8b04
Attempt to read from address 326a8b04
CONTEXT: 96a83360 -- (.cxr 0xffffffff96a83360)
eax=8b056820 ebx=00000000 ecx=8b0c1d4a edx=8fb041ec esi=8fb04000 edi=8fb04060
eip=8b0fa20f esp=96a83850 ebp=96a838d0 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
Ntfs!TxfShutdownRm+0x1e9:
8b0fa20f a1048b6a32 mov eax,dword ptr ds:[326A8B04h] ds:0023:326a8b04=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x24
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 8b0fb810 to 8b0fa20f
STACK_TEXT:
96a838d0 8b0fb810 96a83a70 8fb04000 00000000 Ntfs!TxfShutdownRm+0x1e9
96a8392c 8b0f5a55 96a83a70 859a10d8 00000000 Ntfs!TxfShutdownVolume+0xef
96a83978 8b0f5b47 96a83a70 859a10d8 00000001 Ntfs!TxfShutdownVolumeNoRaise+0x75
96a839b0 8b0f5c23 01a83a70 859a10d8 00000001 Ntfs!NtfsShutdownVolume+0x5d
96a839c4 8b0c8731 96a83a70 859a10d8 00000000 Ntfs!NtfsShutdownVolumeWorker+0x12
96a83a24 8b0f5d47 96a83a70 00000000 8b0f5c11 Ntfs!NtfsForEachVcb+0x10c
96a83b90 8208d4ac 84b7dab8 85445588 85445588 Ntfs!NtfsFsdShutdown+0xf6
WARNING: Stack unwind information not available. Following frames may be wrong.
96a83ba8 8af7e3e8 84b7d7d0 00000000 8591fd30 nt+0x3c4ac
96a83bd4 8208d4ac 84b7d7d0 85445588 8b62f520 fltmgr!FltpDispatch+0xe2
96a83bec 8b63355e 8b654f7c 84b7d7d0 85445588 nt+0x3c4ac
96a83bf0 8b654f7c 84b7d7d0 85445588 60000001 tdrpm273+0x555e
96a83bf4 84b7d7d0 85445588 60000001 8b655e31 tdrpm273+0x26f7c
96a83bf8 85445588 60000001 8b655e31 84b5a518 0x84b7d7d0
96a83bfc 60000001 8b655e31 84b5a518 84b5a518 0x85445588
96a83c00 8b655e31 84b5a518 84b5a518 8591fd30 0x60000001
96a83c04 84b5a518 84b5a518 8591fd30 84b5a518 tdrpm273+0x27e31
96a83c08 84b5a518 8591fd30 84b5a518 8b654f07 0x84b5a518
96a83c0c 8591fd30 84b5a518 8b654f07 60000001 0x84b5a518
96a83c10 84b5a518 8b654f07 60000001 84b5a500 0x8591fd30
96a83c14 8b654f07 60000001 84b5a500 8591fd30 0x84b5a518
96a83c18 60000001 84b5a500 8591fd30 8b62f520 tdrpm273+0x26f07
96a83c1c 84b5a500 8591fd30 8b62f520 8591fd30 0x60000001
96a83c20 8591fd30 8b62f520 8591fd30 8b655da6 0x84b5a500
96a83c24 8b62f520 8591fd30 8b655da6 60000001 0x8591fd30
96a83c28 8591fd30 8b655da6 60000001 84b5a501 tdrpm273+0x1520
96a83c2c 8b655da6 60000001 84b5a501 84b5a518 0x8591fd30
96a83c30 60000001 84b5a501 84b5a518 8591fd30 tdrpm273+0x27da6
96a83c34 84b5a501 84b5a518 8591fd30 84b7dab8 0x60000001
96a83c38 84b5a518 8591fd30 84b7dab8 8b655323 0x84b5a501
96a83c3c 8591fd30 84b7dab8 8b655323 84b5a518 0x84b5a518
96a83c40 84b7dab8 8b655323 84b5a518 8591fba0 0x8591fd30
96a83c44 8b655323 84b5a518 8591fba0 8591fc58 0x84b7dab8
96a83c48 84b5a518 8591fba0 8591fc58 96a83c80 tdrpm273+0x27323
96a83c4c 8591fba0 8591fc58 96a83c80 96a81000 0x84b5a518
96a83c50 8591fc58 96a83c80 96a81000 8b65328c 0x8591fba0
96a83c54 96a83c80 96a81000 8b65328c 96a84000 0x8591fc58
96a83c58 96a81000 8b65328c 96a84000 8591fba0 0x96a83c80
96a83c80 823737eb 00000001 00000000 00000000 0x96a81000
96a83cb4 823736d8 821b77c8 821920c0 86eb8490 nt+0x3227eb
96a83cec 82377a5d 00000001 86eb8490 8218b580 nt+0x3226d8
96a83d00 820bf03b 00000000 00000000 86eb8490 nt+0x326a5d
96a83d50 8225f9df 80000000 b9b8c0ba 00000000 nt+0x6e03b
96a83d90 821111d9 820bef2e 80000000 00000000 nt+0x20e9df
00000000 00000000 00000000 00000000 00000000 nt+0xc01d9
CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs
8b0fa20d - Ntfs!TxfShutdownRm+1e7
[ 68:78 ]
1 error : !Ntfs (8b0fa20d)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
MEMORY_CORRUPTOR: ONE_BIT
STACK_COMMAND: .cxr 0xffffffff96a83360 ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption