BugCheck A, {1c, 2, 1, 8240f71e}
*** WARNING: Unable to verify timestamp for athr.sys
*** ERROR: Module load completed but symbols could not be loaded for athr.sys
Probably caused by : athr.sys ( athr+94c40 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000001c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8240f71e, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 8216482c
Unable to read MiSystemVaType memory at 821446e0
0000001c
CURRENT_IRQL: 2
FAULTING_IP:
hal!KeAcquireSpinLockRaiseToSynch+e
8240f71e f00fba2900 lock bts dword ptr [ecx],0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: MsMpEng.exe
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
DPC_STACK_BASE: FFFFFFFF86D8B000
TRAP_FRAME: 86d8adc4 -- (.trap 0xffffffff86d8adc4)
ErrCode = 00000002
eax=00000002 ebx=85766ed0 ecx=0000001c edx=86d8ae84 esi=84b4c0e0 edi=00000000
eip=8240f71e esp=86d8ae38 ebp=86d8ae5c iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
hal!KeAcquireSpinLockRaiseToSynch+0xe:
8240f71e f00fba2900 lock bts dword ptr [ecx],0 ds:0023:0000001c=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 8240f71e to 8203acbf
STACK_TEXT:
86d8adc4 8240f71e badb0d00 86d8ae84 2b842802 nt!KiTrap0E+0x1b3
86d8ae34 8bcc4c40 ed449672 00000224 00000224 hal!KeAcquireSpinLockRaiseToSynch+0xe
WARNING: Stack unwind information not available. Following frames may be wrong.
86d8ae5c 8bd6b726 84f06020 86d8ae84 86d8ae9c athr+0x94c40
86d8ae70 8bd9c838 84f06020 86d8ae84 86d8ae9c athr+0x13b726
86d8aea0 8bd80cb7 85116020 87918c20 85766ed0 athr+0x16c838
86d8aec8 8bc6ad6d 85116020 86d8aee4 8bc31830 athr+0x150cb7
86d8aed4 8bc31830 84f06020 84ede020 86d8af20 athr+0x3ad6d
86d8aee4 8764b89a 84ede020 00000000 86d8af10 athr+0x1830
86d8af20 875f6a1f 85766ee4 00766ed0 00000000 ndis!ndisMiniportDpc+0xe2
86d8af48 820582c5 85766ee4 85766ed0 00000000 ndis!ndisInterruptDpc+0xaf
86d8afa4 82058128 82126e20 853704c0 00000000 nt!KiExecuteAllDpcs+0xf9
86d8aff4 820578ec 86f26ce4 00000000 00000000 nt!KiRetireDpcList+0xd5
86d8aff8 86f26ce4 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2c
820578ec 00000000 0000001a 00d6850f bb830000 0x86f26ce4
STACK_COMMAND: kb
FOLLOWUP_IP:
athr+94c40
8bcc4c40 ?? ???
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: athr+94c40
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: athr
IMAGE_NAME: athr.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5539d395
FAILURE_BUCKET_ID: 0xA_athr+94c40
BUCKET_ID: 0xA_athr+94c40
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xa_athr+94c40
FAILURE_ID_HASH: {63fb11b9-95e3-3436-3b5c-df04ce0e4c59}
Followup: MachineOwner
---------
0: kd> lmvm athr
start end module name
8bc30000 8bf4c000 athr T (no symbols)
Loaded symbol image file: athr.sys
Image path: \SystemRoot\system32\DRIVERS\athr.sys
Image name: athr.sys
Timestamp: Fri Apr 24 10:54:37 2015 (5539D395)
CheckSum: 0031BCD7
ImageSize: 0031C000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4