*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffffac006c58c20, 2, 0, fffff80002cb97df}
Probably caused by : memory_corruption ( nt!MiResolveMappedFileFault+8b )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffac006c58c20, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cb97df, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f010e0
GetUlongFromAddress: unable to read from fffff80002f01198
fffffac006c58c20 Nonpaged pool
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiResolveMappedFileFault+8b
fffff800`02cb97df 4d8b11 mov r10,qword ptr [r9]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: MsMpEng.exe
TRAP_FRAME: fffff880025fe5d0 -- (.trap 0xfffff880025fe5d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff880025febe0 rbx=0000000000000000 rcx=0000000000000001
rdx=00000000032c4000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cb97df rsp=fffff880025fe760 rbp=fffff880025fe7c0
r8=fffff8a003f12330 r9=fffffac006c58c20 r10=0000000fffffffff
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!MiResolveMappedFileFault+0x8b:
fffff800`02cb97df 4d8b11 mov r10,qword ptr [r9] ds:fffffac0`06c58c20=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002cc8de9 to fffff80002cc9880
STACK_TEXT:
fffff880`025fe488 fffff800`02cc8de9 : 00000000`0000000a fffffac0`06c58c20 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`025fe490 fffff800`02cc7a60 : 00000000`00060000 fac006c5`8c2004c0 fffff880`025fe5d8 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`025fe5d0 fffff800`02cb97df : 00000000`00001000 00000000`00002001 00000000`00000000 fffff880`025fe798 : nt!KiPageFault+0x260
fffff880`025fe760 fffff800`02cef9cd : fac006c5`8c2004c0 ffffffff`00000420 fffff8a0`03f12330 00000000`00000000 : nt!MiResolveMappedFileFault+0x8b
fffff880`025fe8d0 fffff800`02ce561e : 00000000`00000000 00000000`032c4000 fffff680`00019620 fffffa80`05d3bec8 : nt!MiResolveProtoPteFault+0x48d
fffff880`025fe970 fffff800`02ce37a3 : ffffffff`ffffff00 00000000`032c4000 00000000`00000000 fffff800`00000000 : nt!MiDispatchFault+0x1de
fffff880`025fea80 fffff800`02cc796e : 00000000`00000000 00000000`00394d60 00000000`00001001 fffffa80`04ee09d0 : nt!MmAccessFault+0x343
fffff880`025febe0 000007fe`fb8c7a88 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`01c8df50 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fe`fb8c7a88
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiResolveMappedFileFault+8b
fffff800`02cb97df 4d8b11 mov r10,qword ptr [r9]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiResolveMappedFileFault+8b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 5147dc36
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xA_nt!MiResolveMappedFileFault+8b
BUCKET_ID: X64_0xA_nt!MiResolveMappedFileFault+8b
Followup: MachineOwner
---------