*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C1, {fffff9802882eff0, fffff9802882effc, 93c014, 24}
Probably caused by : memory_corruption ( nt!MmFreeSpecialPool+383 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: fffff9802882eff0, address trying to free
Arg2: fffff9802882effc, address where bits are corrupted
Arg3: 000000000093c014, (reserved)
Arg4: 0000000000000024, caller is freeing an address where bytes after the end of the allocation have been overwritten
Debugging Details:
------------------
BUGCHECK_STR: 0xC1_24
SPECIAL_POOL_CORRUPTION_TYPE: 24
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LOCK_ADDRESS: fffff80002cd1400 -- (!locks fffff80002cd1400)
Resource @ nt!PiEngineLock (0xfffff80002cd1400) Available
WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.
WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.
1 total locks
PNP_TRIAGE:
Lock address : 0xfffff80002cd1400
Thread Count : 0
Thread address: 0x0000000000000000
Thread wait : 0x0
LAST_CONTROL_TRANSFER: from fffff80002bd4843 to fffff80002acd740
STACK_TEXT:
fffff880`0795b8e8 fffff800`02bd4843 : 00000000`000000c1 fffff980`2882eff0 fffff980`2882effc 00000000`0093c014 : nt!KeBugCheckEx
fffff880`0795b8f0 fffff800`02c00390 : fffff800`02a5d000 00000000`54426d43 ffffffff`fffffd64 00000000`00000008 : nt!MmFreeSpecialPool+0x383
fffff880`0795ba20 fffff800`02f0b327 : 00000000`00000001 00000000`00000001 fffffa80`052cc390 00000000`00000006 : nt!ExDeferredFreePool+0xf4d
fffff880`0795bad0 fffff800`02f13456 : 00000000`00000000 fffff880`0795bc01 fffff880`0795bb98 00000000`00000000 : nt!PiQueryDeviceRelations+0x227
fffff880`0795bb30 fffff800`02d6f1b0 : fffff8a0`025b1cf0 fffff800`00000044 fffff880`0795bc01 fffff800`02d6f0b0 : nt!PiControlQueryDeviceRelations+0xf6
fffff880`0795bb90 fffff800`02acc993 : fffffa80`05223b60 00000000`013ae278 fffff880`0795bc60 00000000`00440088 : nt!NtPlugPlayControl+0x100
fffff880`0795bbe0 00000000`77660daa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`013ae208 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77660daa
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MmFreeSpecialPool+383
fffff800`02bd4843 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MmFreeSpecialPool+383
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xC1_24_VRF_nt!MmFreeSpecialPool+383
BUCKET_ID: X64_0xC1_24_VRF_nt!MmFreeSpecialPool+383
Followup: MachineOwner
---------