Memory related BSOD; precise cause???

[zigzag3143]

ZigZag,

What would your recommended next course of action be?

I tried something based on another HIDCLASS.sys BSOD I saw while searching. I disabled my Bluetooth adapter and tried the Novabench test to recreate the error. It didn't happen; Nova bench competed the test completely. I thought that would be it, but then I tried to run PeerBlock 2 and it happened again, this time it said pbfilter was causing the trouble...


-Kevin

Kevin

Peerblock is a known cause of them.

 

[oberstwake]

Peerblock was never running during any previous BSOD. It only caused one one time after I tried to launch it, something that happens with several applications, so I don't think that is the cause. Here are my latest dump files.

 

[writhziden]

Problem Devices:

Generic Bluetooth Adapter	USB\VID_0B05&PID_179C\6&DF2EE03&0&7	This device is disabled.

Security Software:

msmpeng.exe	c:\program files\microsoft security client\antimalware\msmpeng.exe	1040	8	200	1380	3/21/2012 9:14 AM	3.0.8402.0	12.48 KB (12,784 bytes)	4/27/2011 5:21 PM
nissrv.exe	c:\program files\microsoft security client\antimalware\nissrv.exe	2828	8	200	1380	3/21/2012 9:14 AM	3.0.8402.0	281.52 KB (288,272 bytes)	4/27/2011 5:21 PM
msseces.exe	c:\program files\microsoft security client\msseces.exe	3560	8	200	1380	3/21/2012 9:19 AM	2.1.1116.0	1.37 MB (1,436,736 bytes)	6/15/2011 2:35 PM

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\oberstwake\Windows_NT6_BSOD_jcgriff2\032112-21902-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`03652000 PsLoadedModuleList = 0xfffff800`03896650
Debug session time: Wed Mar 21 10:11:41.917 2012 (UTC - 6:00)
System Uptime: 0 days 10:42:38.745
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C1, {fffff9805a17cf10, fffff9805a17c0c4, 1300f0, 23}

Probably caused by : win32k.sys ( win32k!xxxMsgWaitForMultipleObjects+108 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption.  Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: fffff9805a17cf10, address trying to free
Arg2: fffff9805a17c0c4, address where bits are corrupted
Arg3: 00000000001300f0, (reserved)
Arg4: 0000000000000023, caller is freeing an address where nearby bytes within the same page have been corrupted

Debugging Details:
------------------


BUGCHECK_STR:  0xC1_23

SPECIAL_POOL_CORRUPTION_TYPE:  23

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  1

IRP_ADDRESS:  ffffffffffffff88

LAST_CONTROL_TRANSFER:  from fffff8000375748a to fffff800036ced40

STACK_TEXT:  
fffff880`0a6122a8 fffff800`0375748a : 00000000`000000c1 fffff980`5a17cf10 fffff980`5a17c0c4 00000000`001300f0 : nt!KeBugCheckEx
fffff880`0a6122b0 fffff800`037d00e3 : fffff880`0a612328 fffff880`0a612538 fffff880`0a612ae0 fffffa80`141b2b60 : nt!MiCheckSpecialPoolSlop+0x9a
fffff880`0a6122f0 fffff800`037fb93b : fffff800`03652000 00000000`20206f49 ffffffff`fff2362a fffffa80`1379bdc0 : nt!MmFreeSpecialPool+0x1d3
fffff880`0a612430 fffff800`036e371e : fffffa80`141b2b60 fffff800`036d1c8a 00000000`00000010 00000000`00000082 : nt!ExDeferredFreePool+0xf33
fffff880`0a6124e0 fffff800`036c16d7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopCompleteRequest+0x5ce
fffff880`0a6125b0 fffff800`036c48cd : fffffa80`141b2b60 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1c7
fffff880`0a612630 fffff800`036d12ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiCommitThreadWait+0x3dd
fffff880`0a6126c0 fffff960`00179878 : fffff900`00000002 fffffa80`1411a4d0 fffff900`00000001 fffff880`0000000d : nt!KeWaitForMultipleObjects+0x272
fffff880`0a612980 fffff960`0017a844 : 00000000`00000000 fffff900`c01bc8f0 fffff960`003c5560 fffff900`c01bc780 : win32k!xxxMsgWaitForMultipleObjects+0x108
fffff880`0a612a00 fffff960`00135034 : fffffa80`00000001 fffffa80`0000000c fffffa80`141b2b60 fffff6fc`40021750 : win32k!xxxDesktopThread+0x254
fffff880`0a612a80 fffff960`001b529a : fffffa80`00000001 fffff960`003c5560 00000000`00000020 00000000`00000000 : win32k!xxxCreateSystemThreads+0x64
fffff880`0a612ab0 fffff800`036cdfd3 : fffffa80`141b2b60 00000000`00000004 000007ff`fffae000 00000000`00000000 : win32k!NtUserCallNoParam+0x36
fffff880`0a612ae0 000007fe`fe011eea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01a3f9e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fe011eea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!xxxMsgWaitForMultipleObjects+108
fffff960`00179878 8bf0            mov     esi,eax

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  win32k!xxxMsgWaitForMultipleObjects+108

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4f2b63bd

FAILURE_BUCKET_ID:  X64_0xC1_23_VRF_win32k!xxxMsgWaitForMultipleObjects+108

BUCKET_ID:  X64_0xC1_23_VRF_win32k!xxxMsgWaitForMultipleObjects+108

Followup: MachineOwner
---------

Okay, I see that you removed the Bluetooth device on purpose, so disregard the problem devices. Also, disable Verifier. This is what is currently causing your crashes, and we cannot be sure whether the problem is resolved, but the Bluetooth disabling may very well have cleared up the issue.

To disable Verifier: Start Menu -> All Programs -> Accessories -> Right click Command Prompt -> Run as administrator ->

verifier /reset​

-> restart your computer.