0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
the operating system. The only supported way to extend a kernel
mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000002
Arg3: fffffa80071d3b50
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0xc4_91
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: FlashPlayerPlu
CURRENT_IRQL: 2
TAG_NOT_DEFINED_c000000f: FFFFF8000485DFB0
LAST_CONTROL_TRANSFER: from fffff800034d880a to fffff80003481fc0
STACK_TEXT:
fffff800`04857ff8 fffff800`034d880a : 00000000`000000c4 00000000`00000091 00000000`00000002 fffffa80`071d3b50 : nt!KeBugCheckEx
fffff800`04858000 fffff800`0351dcd5 : fffffa80`08894000 00000000`00040120 fffff800`00000003 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4874
fffff800`04858040 fffff800`0353bded : fffff880`0824e000 fffff880`08255000 00000000`00000000 fffff800`0485dd10 : nt!RtlEnoughStackSpaceForStackCapture+0x15
fffff800`04858070 fffff800`0353cc8b : 00000000`00000001 fffff800`048580f0 00000000`00000000 fffff800`0485dd10 : nt!RtlWalkFrameChain+0x4d
fffff800`048580a0 fffff880`04a81221 : 00000000`00000000 fffff800`04858130 fffffa80`07e43000 00000000`00040120 : nt!RtlCaptureStackBackTrace+0x4b
fffff800`048580d0 00000000`00000000 : fffff800`04858130 fffffa80`07e43000 00000000`00040120 fffff800`04858150 : nvlddmkm+0x1b7221
STACK_COMMAND: kb
FOLLOWUP_IP:
nvlddmkm+1b7221
fffff880`04a81221 ?? ???
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: nvlddmkm+1b7221
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nvlddmkm
IMAGE_NAME: nvlddmkm.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 50de9218
FAILURE_BUCKET_ID: X64_0xc4_91_nvlddmkm+1b7221
BUCKET_ID: X64_0xc4_91_nvlddmkm+1b7221
Followup: MachineOwner
---------
0: kd> lmvm nvlddmkm
start end module name
fffff880`048ca000 fffff880`05368000 nvlddmkm T (no symbols)
Loaded symbol image file: nvlddmkm.sys
Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
Image name: nvlddmkm.sys
Timestamp: Sat Dec 29 12:17:52 2012 (50DE9218)
CheckSum: 00A7F96C
ImageSize: 00A9E000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
[COLOR=Red][B]BugCheck 116[/B][/COLOR], {fffffa8006d21010, fffff8800f384584, ffffffffc00000b5, a}
Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+14b584 )
Followup: MachineOwner
---------