BugCheck A, {fffffa80142f8178, 2, 1, fffff80003487035}
*** WARNING: Unable to verify timestamp for npf.sys
*** ERROR: Module load completed but symbols could not be loaded for npf.sys
Probably caused by : npf.sys ( npf+2b81 )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa80142f8178, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80003487035, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800036b6100
GetUlongFromAddress: unable to read from fffff800036b61c0
fffffa80142f8178 Nonpaged pool
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeAcquireSpinLockRaiseToDpc+55
fffff800`03487035 f0480fba2900 lock bts qword ptr [rcx],0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
TRAP_FRAME: fffff8800d7f1590 -- (.trap 0xfffff8800d7f1590)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=fffffa80142f8178
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003487035 rsp=fffff8800d7f1720 rbp=fffffa80142f8178
r8=0000000000000000 r9=0000000000000000 r10=000000000000f68b
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!KeAcquireSpinLockRaiseToDpc+0x55:
fffff800`03487035 f0480fba2900 lock bts qword ptr [rcx],0 ds:fffffa80`142f8178=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000347c469 to fffff8000347cec0
STACK_TEXT:
fffff880`0d7f1448 fffff800`0347c469 : 00000000`0000000a fffffa80`142f8178 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0d7f1450 fffff800`0347b0e0 : ffffffff`ff676980 fffff800`039f6b7f fffff880`018cad20 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0d7f1590 fffff800`03487035 : 00000000`00000000 fffff880`018705b2 fffff880`018c7100 fffffa80`00000000 : nt!KiPageFault+0x260
fffff880`0d7f1720 fffff880`076a1b81 : 00000000`00000001 fffffa80`083b11a0 fffffa80`09ad9450 fffffa80`142f5000 : nt!KeAcquireSpinLockRaiseToDpc+0x55
fffff880`0d7f1770 00000000`00000001 : fffffa80`083b11a0 fffffa80`09ad9450 fffffa80`142f5000 00000000`00060000 : npf+0x2b81
fffff880`0d7f1778 fffffa80`083b11a0 : fffffa80`09ad9450 fffffa80`142f5000 00000000`00060000 fffff880`0d7f1798 : 0x1
fffff880`0d7f1780 fffffa80`09ad9450 : fffffa80`142f5000 00000000`00060000 fffff880`0d7f1798 fffff880`0d7f1798 : 0xfffffa80`083b11a0
fffff880`0d7f1788 fffffa80`142f5000 : 00000000`00060000 fffff880`0d7f1798 fffff880`0d7f1798 00000000`00000000 : 0xfffffa80`09ad9450
fffff880`0d7f1790 00000000`00060000 : fffff880`0d7f1798 fffff880`0d7f1798 00000000`00000000 fffffa80`09ad9450 : 0xfffffa80`142f5000
fffff880`0d7f1798 fffff880`0d7f1798 : fffff880`0d7f1798 00000000`00000000 fffffa80`09ad9450 fffff880`0190b38b : 0x60000
fffff880`0d7f17a0 fffff880`0d7f1798 : 00000000`00000000 fffffa80`09ad9450 fffff880`0190b38b fffffa80`0aa918d0 : 0xfffff880`0d7f1798
fffff880`0d7f17a8 00000000`00000000 : fffffa80`09ad9450 fffff880`0190b38b fffffa80`0aa918d0 fffffa80`0aa918d0 : 0xfffff880`0d7f1798
STACK_COMMAND: kb
FOLLOWUP_IP:
npf+2b81
fffff880`076a1b81 ?? ???
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: npf+2b81
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: npf
IMAGE_NAME: npf.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c24de72
FAILURE_BUCKET_ID: X64_0xA_npf+2b81
BUCKET_ID: X64_0xA_npf+2b81
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0xa_npf+2b81
FAILURE_ID_HASH: {748ef928-b00a-ca6f-9a2a-4c73375cc495}
Followup: MachineOwner
---------
4: kd> lmvm npf
start end module name
fffff880`0769f000 fffff880`076ab000 npf T (no symbols)
Loaded symbol image file: npf.sys
Image path: \??\C:\Windows\system32\drivers\npf.sys
Image name: npf.sys
Timestamp: Fri Jun 25 22:20:58 2010 (4C24DE72)
CheckSum: 00011844
ImageSize: 0000C000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4