Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\downloads\070710-29531-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02c60000 PsLoadedModuleList = 0xfffff800`02e9de50
Debug session time: Wed Jul 7 17:47:27.901 2010 (UTC + 1:00)
System Uptime: 0 days 0:11:50.854
Loading Kernel Symbols
.............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
[B]BugCheck 18, {0, fffffa8005ffaef0[/B], 2, ffffffffffffffff}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+46451 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: fffffa8005ffaef0, Object whose reference count is being lowered
Arg3: 0000000000000002, Reserved
Arg4: ffffffffffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object’s reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002c67fac to fffff80002cd0600
STACK_TEXT:
fffff880`02926428 fffff800`02c67fac : 00000000`00000018 00000000`00000000 fffffa80`05ffaef0 00000000`00000002 : nt!KeBugCheckEx
fffff880`02926430 fffff800`02fccf09 : fffff880`02926ca0 fffff880`02926810 00000000`0000001e 00000000`00000006 : nt! ?? ::FNODOBFM::`string'+0x46451
fffff880`02926490 fffff800`02fcd7d6 : fffff880`02fd3101 00001f80`00d100dc fffffa80`00000001 00000000`00000001 : nt!ObpWaitForMultipleObjects+0x2d3
fffff880`02926960 fffff800`02ccf853 : fffffa80`05ffa060 00000000`00c0fb08 fffff880`02926bc8 fffff880`02926c00 : nt!NtWaitForMultipleObjects+0xe5
fffff880`02926bb0 00000000`7788046a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00c0fae8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7788046a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+46451
fffff800`02c67fac cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+46451
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb
FAILURE_BUCKET_ID: X64_0x18_OVER_DEREFERENCE_nt!_??_::FNODOBFM::_string_+46451
BUCKET_ID: X64_0x18_OVER_DEREFERENCE_nt!_??_::FNODOBFM::_string_+46451
Followup: MachineOwner
---------
3: kd> !object 02fccf09
GetUlongFromAddress: unable to read from fffff80002f08010
3: kd> !object fffffa8005ffaef0
GetUlongFromAddress: unable to read from fffff80002f08010
Could not read ObjectType address