Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\USER\Downloads\Compressed\123014-25630-01\123014-25630-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
Machine Name:
Kernel base = 0xfffff800`03409000 PsLoadedModuleList = 0xfffff800`0364c670
Debug session time: Wed Dec 31 00:01:13.438 2014 (UTC + 6:00)
System Uptime: 0 days 1:43:15.484
Loading Kernel Symbols
...............................................................
................................................................
......................................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {20, fffffa8007ce5440, fffffa8007ce5460, 4020044}
*** WARNING: Unable to verify timestamp for mwac.sys
*** ERROR: Module load completed but symbols could not be loaded for mwac.sys
Probably caused by : fwpkclnt.sys ( fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+20a )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffffa8007ce5440, The pool entry we were looking for within the page.
Arg3: fffffa8007ce5460, The next pool entry.
Arg4: 0000000004020044, (reserved)
Debugging Details:
------------------
BUGCHECK_STR: 0x19_20
POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff800036b6100
GetUlongFromAddress: unable to read from fffff800036b61c0
fffffa8007ce5440 Nonpaged pool
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: mbamservice.ex
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800035b1cae to fffff8000347ec00
STACK_TEXT:
fffff880`0c357258 fffff800`035b1cae : 00000000`00000019 00000000`00000020 fffffa80`07ce5440 fffffa80`07ce5460 : nt!KeBugCheckEx
fffff880`0c357260 fffff880`01928c9d : 00000000`00000008 00000000`00000008 00000000`676e7049 fffff880`05e6d024 : nt!ExDeferredFreePool+0x12da
fffff880`0c357310 fffff880`0153004a : 00000000`00000000 fffff880`0152c0c3 00000000`00000000 fffffa80`03a17620 : tcpip!IppInspectBuildHeaders+0x65d
fffff880`0c3575f0 fffff880`0842912d : 00000000`00000000 00000000`00000014 00000000`00000000 fffffa80`04624b50 : fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+0x20a
fffff880`0c357690 00000000`00000000 : 00000000`00000014 00000000`00000000 fffffa80`04624b50 fffffa80`04624b64 : mwac+0x612d
STACK_COMMAND: kb
FOLLOWUP_IP:
fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+20a
fffff880`0153004a 85c0 test eax,eax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+20a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fwpkclnt
IMAGE_NAME: fwpkclnt.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 50e4f5c8
FAILURE_BUCKET_ID: X64_0x19_20_fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+20a
BUCKET_ID: X64_0x19_20_fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+20a
Followup: MachineOwner
---------
