[list=1]
[*]
Loading Dump File [F:\BSODDmpFiles\Boudi\Windows_NT6_BSOD_jcgriff2\021612-15210-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0300a000 PsLoadedModuleList = 0xfffff800`0324f670
Debug session time: Thu Feb 16 05:02:38.321 2012 (GMT-7)
System Uptime: 0 days 2:24:09.258
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff88002868318, fffff88002867b70, fffff88001027aa8}
Unable to load image \SystemRoot\system32\DRIVERS\bdfsfltr.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for bdfsfltr.sys
*** ERROR: Module load completed but symbols could not be loaded for bdfsfltr.sys
Probably caused by : bdfsfltr.sys ( bdfsfltr+13da3 )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88002868318
Arg3: fffff88002867b70
Arg4: fffff88001027aa8
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88002868318 -- (.exr 0xfffff88002868318)
ExceptionAddress: fffff88001027aa8 (fltmgr!FltpGetStreamListCtrl+0x0000000000000088)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88002867b70 -- (.cxr 0xfffff88002867b70)
rax=fffff8a003bc6ca8 rbx=fffffa800700e320 rcx=fffff8a003bc6c70
rdx=fffffa80093ab010 rsi=fffffa80093ab010 rdi=fffff880028685e0
rip=fffff88001027aa8 rsp=fffff88002868550 rbp=fffffa8009782290
r8=0000000000000000 r9=fffff880028685e0 r10=0000000000000000
r11=0000000000000011 r12=0000000000000000 r13=fffff880028686b8
r14=0000000000000000 r15=fffff880028688b0
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
fltmgr!FltpGetStreamListCtrl+0x88:
fffff880`01027aa8 ff1542e80000 call qword ptr [fltmgr!_imp_FsRtlLookupPerStreamContextInternal (fffff880`010362f0)] ds:002b:fffff880`010362f0=000000000004729c
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b9100
ffffffffffffffff
FOLLOWUP_IP:
bdfsfltr+13da3
fffff880`01144da3 ?? ???
FAULTING_IP:
fltmgr!FltpGetStreamListCtrl+88
fffff880`01027aa8 ff1542e80000 call qword ptr [fltmgr!_imp_FsRtlLookupPerStreamContextInternal (fffff880`010362f0)]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff88001032da1 to fffff88001027aa8
STACK_TEXT:
fffff880`02868550 fffff880`01032da1 : fffffa80`093ab010 fffff800`030b25db 00000000`00000000 00000000`00000004 : fltmgr!FltpGetStreamListCtrl+0x88
fffff880`028685b0 fffff880`01144da3 : 00000000`00000000 00000000`00000000 fffff880`028686d0 fffff880`0102e013 : fltmgr!FltGetStreamContext+0x21
fffff880`028685e0 00000000`00000000 : 00000000`00000000 fffff880`028686d0 fffff880`0102e013 fffffa80`07b93338 : bdfsfltr+0x13da3
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: bdfsfltr+13da3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: bdfsfltr
IMAGE_NAME: bdfsfltr.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4e302d69
STACK_COMMAND: .cxr 0xfffff88002867b70 ; kb
FAILURE_BUCKET_ID: X64_0x24_bdfsfltr+13da3
BUCKET_ID: X64_0x24_bdfsfltr+13da3
Followup: MachineOwner
---------
[*]
Loading Dump File [F:\BSODDmpFiles\Boudi\Windows_NT6_BSOD_jcgriff2\021512-19796-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0304e000 PsLoadedModuleList = 0xfffff800`03293670
Debug session time: Tue Feb 14 13:44:40.231 2012 (GMT-7)
System Uptime: 0 days 0:13:12.041
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff88008bf53fd, 1, fffff800033e42ce, 0}
Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiMapViewOfSection+1ae )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff88008bf53fd, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff800033e42ce, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032fd100
fffff88008bf53fd
FAULTING_IP:
nt!MiMapViewOfSection+1ae
fffff800`033e42ce 488b842408010000 mov rax,qword ptr [rsp+108h]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: TrustedInstall
CURRENT_IRQL: 0
TRAP_FRAME: fffff88008bfd720 -- (.trap 0xfffff88008bfd720)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000002000 rbx=0000000000000000 rcx=0000000000000004
rdx=fffff8000304e000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800033e42ce rsp=fffff88008bfd8b0 rbp=fffffa800ab27278
r8=0000000000001000 r9=fffff88008bfda10 r10=0000000000000004
r11=fffffa800ab27060 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiMapViewOfSection+0x1ae:
fffff800`033e42ce 488b842408010000 mov rax,qword ptr [rsp+108h] ss:0018:fffff880`08bfd9b8=0000000000000000
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800030769fc to fffff800030cac40
STACK_TEXT:
fffff880`08bfd5b8 fffff800`030769fc : 00000000`00000050 fffff880`08bf53fd 00000000`00000001 fffff880`08bfd720 : nt!KeBugCheckEx
fffff880`08bfd5c0 fffff800`030c8d6e : 00000000`00000001 fffff880`08bf53fd 00000002`0d25f000 fffffa80`071d8550 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`08bfd720 fffff800`033e42ce : 00000000`00000001 00000000`00000000 00000000`00000000 fffff880`00961000 : nt!KiPageFault+0x16e
fffff880`08bfd8b0 fffff800`033e478e : ffffdbc2`00000004 fffffa80`0ab27060 fffff880`08bfda10 00000000`00000000 : nt!MiMapViewOfSection+0x1ae
fffff880`08bfd9a0 fffff800`030c9ed3 : 00000000`000007e4 fffffa80`071d8550 00000000`00b1c008 00000000`00000001 : nt!NtMapViewOfSection+0x2bd
fffff880`08bfda70 00000000`74571b42 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00b1bfe8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74571b42
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiMapViewOfSection+1ae
fffff800`033e42ce 488b842408010000 mov rax,qword ptr [rsp+108h]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiMapViewOfSection+1ae
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x50_nt!MiMapViewOfSection+1ae
BUCKET_ID: X64_0x50_nt!MiMapViewOfSection+1ae
Followup: MachineOwner
---------
[*]
Loading Dump File [F:\BSODDmpFiles\Boudi\Windows_NT6_BSOD_jcgriff2\021212-26161-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c12000 PsLoadedModuleList = 0xfffff800`02e57670
Debug session time: Sat Feb 11 08:45:21.799 2012 (GMT-7)
System Uptime: 0 days 3:01:38.721
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : tcpip.sys ( tcpip!TcpTryToContinueRcvWndTuning+9b )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.
FAULTING_IP:
+6aa0952f02cfd8d4
00000000`00000000 ?? ???
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: System
CURRENT_IRQL: 2
EXCEPTION_RECORD: fffff80000b9c088 -- (.exr 0xfffff80000b9c088)
ExceptionAddress: fffff880016ea77b (tcpip!TcpTryToContinueRcvWndTuning+0x000000000000009b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
TRAP_FRAME: fffff80000b9c130 -- (.trap 0xfffff80000b9c130)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffff880017ff150
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880016ea77b rsp=fffff80000b9c2c0 rbp=0000000000000002
r8=fffff80000b9c3b8 r9=00000000000000fa r10=fffff80002e04e80
r11=0000000000000004 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
tcpip!TcpTryToContinueRcvWndTuning+0x9b:
fffff880`016ea77b f083471001 lock add dword ptr [rdi+10h],1 ds:0055:00000000`00000010=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002c865fe to fffff80002c8ec10
STACK_TEXT:
fffff800`00b9b168 fffff800`02c865fe : fffff880`018183ac fffff880`016e9cf2 fffff880`017c4d88 fffff800`00b9c088 : nt!KeBugCheck
fffff800`00b9b170 fffff800`02cba4fd : fffff800`02e9871c fffff800`02dd5c30 fffff800`02c12000 fffff800`00b9c088 : nt!KiKernelCalloutExceptionHandler+0xe
fffff800`00b9b1a0 fffff800`02cb92d5 : fffff800`02dd90fc fffff800`00b9b218 fffff800`00b9c088 fffff800`02c12000 : nt!RtlpExecuteHandlerForException+0xd
fffff800`00b9b1d0 fffff800`02cca361 : fffff800`00b9c088 fffff800`00b9b8e0 fffff800`00000000 fffbfa80`07c1d880 : nt!RtlDispatchException+0x415
fffff800`00b9b8b0 fffff800`02c8e2c2 : fffff800`00b9c088 00000000`00000000 fffff800`00b9c130 fffffa80`07bffde0 : nt!KiDispatchException+0x135
fffff800`00b9bf50 fffff800`02c8cbca : 0000057f`f78227e8 0000057f`f69092d8 fffff800`00b9c100 fffffa80`087ddb80 : nt!KiExceptionDispatch+0xc2
fffff800`00b9c130 fffff880`016ea77b : fffffa80`07be9d40 00000000`00000000 00000000`00000000 fffffa80`07be9d40 : nt!KiGeneralProtectionFault+0x10a
fffff800`00b9c2c0 fffff880`016ea123 : fffffa80`07be9d40 00000000`00000000 fffffa80`07d28010 fffffa80`07d28010 : tcpip!TcpTryToContinueRcvWndTuning+0x9b
fffff800`00b9c330 fffff800`02c9a5fc : fffff800`02e04e80 00000000`00000000 fffff800`00b9c4c0 00000000`00000000 : tcpip!TcpPeriodicTimeoutHandler+0xb22
fffff800`00b9c430 fffff800`02c9a496 : fffffa80`07d280e0 00000000`000aa907 00000000`00000000 00000001`01010100 : nt!KiProcessTimerDpcTable+0x6c
fffff800`00b9c4a0 fffff800`02c9a37e : 00000019`6024e3c5 fffff800`00b9cb18 00000000`000aa907 fffff800`02e07368 : nt!KiProcessExpiredTimerList+0xc6
fffff800`00b9caf0 fffff800`02c9a167 : 00000008`7418bec1 00000008`000aa907 00000008`7418be98 00000000`00000007 : nt!KiTimerExpiration+0x1be
fffff800`00b9cb90 fffff800`02c8696a : fffff800`02e04e80 fffff800`02e12cc0 00000000`00000002 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`00b9cc40 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cc00 00000000`00000000 : nt!KiIdleLoop+0x5a
STACK_COMMAND: kb
FOLLOWUP_IP:
tcpip!TcpTryToContinueRcvWndTuning+9b
fffff880`016ea77b f083471001 lock add dword ptr [rdi+10h],1
SYMBOL_STACK_INDEX: 7
SYMBOL_NAME: tcpip!TcpTryToContinueRcvWndTuning+9b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4e83e948
FAILURE_BUCKET_ID: X64_0x1E_tcpip!TcpTryToContinueRcvWndTuning+9b
BUCKET_ID: X64_0x1E_tcpip!TcpTryToContinueRcvWndTuning+9b
Followup: MachineOwner
---------
[/list]