*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
[COLOR=Red]BugCheck 19[/COLOR], {20, fffff900c37579b0, fffff900c3757a00, 2505000f}
Probably caused by : win32k.sys ( win32k!EngFreeMem+21 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
[COLOR=Red]
BAD_POOL_HEADER (19)[/COLOR]
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, [COLOR=Red]and then special pool applied to the suspect tags or the [B]driver
verifier[/B] to a suspect driver.[/COLOR]
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffff900c37579b0, The pool entry we were looking for within the page.
Arg3: fffff900c3757a00, The next pool entry.
Arg4: 000000002505000f, (reserved)
Debugging Details:
------------------
BUGCHECK_STR: 0x19_20
POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff80003513100
GetUlongFromAddress: unable to read from fffff800035131c0
fffff900c37579b0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff8000340ecae to fffff800032e41c0
STACK_TEXT:
fffff880`055c6db8 fffff800`0340ecae : 00000000`00000019 00000000`00000020 fffff900`c37579b0 fffff900`c3757a00 : nt!KeBugCheckEx
fffff880`055c6dc0 fffff960`000a9405 : fffff880`055c6f20 00000000`00000000 fffff880`64667454 00000000`07c84a44 : nt!ExDeferredFreePool+0x12da
fffff880`055c6e70 fffff960`000b1e1e : 00000000`07c84a44 fffff880`055c6f20 00000000`00000000 00000000`07c8080b : win32k!EngFreeMem+0x21
fffff880`055c6ea0 fffff960`000a914b : fffff900`c0c28030 00000000`00000001 00000000`00000001 00000000`00000000 : win32k!bLoadGlyphSet+0x146
fffff880`055c6ed0 fffff960`000a92ea : fffff900`c0c28030 fffff900`00000001 fffff900`c0c28030 fffff960`0021b374 : win32k!bReloadGlyphSet+0x24b
fffff880`055c7590 fffff960`000a9242 : 00000000`00000000 fffff900`c0c28030 fffff900`00000001 00001fa0`00d50094 : win32k!ttfdQueryFontTree+0x66
fffff880`055c75e0 fffff960`000f5f53 : fffff960`000a91e8 fffff900`c01fef20 00000000`00000001 00000000`00000000 : win32k!ttfdSemQueryFontTree+0x5a
fffff880`055c7620 fffff960`000f5dff : fffff880`055c7730 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!PDEVOBJ::QueryFontTree+0x63
fffff880`055c76a0 fffff960`000b0036 : fffff900`c008a010 00000000`00000000 00000000`00000002 00000000`00000000 : win32k!PFEOBJ::pfdg+0xa3
fffff880`055c7700 fffff960`0010a548 : fffff900`c0d53d80 fffff880`055c7990 fffff880`055c7890 fffff880`055c79e0 : win32k!RFONTOBJ::bRealizeFont+0x46
fffff880`055c7820 fffff960`000db069 : 00000000`10010000 fffff900`00000000 00000d8a`00000000 00000000`00000002 : win32k!RFONTOBJ::bInit+0x548
fffff880`055c7940 fffff960`000dafff : fffff900`c0081000 fffff880`055c7b60 00000000`322f534f 00000000`00000000 : win32k!ulGetFontData2+0x31
fffff880`055c79b0 fffff960`000daf11 : 00000000`ffffffff 00000000`ffffffff fffffa80`0549b790 fffff960`0015690e : win32k!ulGetFontData+0x7f
fffff880`055c7a00 fffff800`032e3453 : 00000000`39010d8a 00000000`00000000 00000000`02faf668 00000000`00000000 : win32k!NtGdiGetFontData+0x8d
fffff880`055c7a70 000007fe`fe56594a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02faf648 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fe`fe56594a
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!EngFreeMem+21
fffff960`000a9405 4883c420 add rsp,20h
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: win32k!EngFreeMem+21
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4fd6b298
FAILURE_BUCKET_ID: X64_0x19_20_win32k!EngFreeMem+21
BUCKET_ID: X64_0x19_20_win32k!EngFreeMem+21
Followup: MachineOwner
---------
