*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904fb
Arg2: 93a99928
Arg3: 93a99500
Arg4: 82f2c7ff
Debugging Details:
------------------
EXCEPTION_RECORD: 93a99928 -- (.exr 0xffffffff93a99928)
ExceptionAddress: 82f2c7ff (nt!ExDeferredFreePool+0x0000019f)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000004
Attempt to read from address 00000004
CONTEXT: 93a99500 -- (.cxr 0xffffffff93a99500)
eax=b56d6808 ebx=00000000 ecx=000001ff edx=00000000 esi=b56d6810 edi=8525d500
eip=82f2c7ff esp=93a999f0 ebp=93a99a28 iopl=0 nv up ei ng nz ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00210292
nt!ExDeferredFreePool+0x19f:
82f2c7ff 397304 cmp dword ptr [ebx+4],esi ds:0023:00000004=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00000004
READ_ADDRESS: GetPointerFromAddress: unable to read from 82f74848
Unable to read MiSystemVaType memory at 82f53e20
00000004
FOLLOWUP_IP:
nt!ExDeferredFreePool+19f
82f2c7ff 397304 cmp dword ptr [ebx+4],esi
FAULTING_IP:
nt!ExDeferredFreePool+19f
82f2c7ff 397304 cmp dword ptr [ebx+4],esi
BUGCHECK_STR: 0x24
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from 82f2c35f to 82f2c7ff
STACK_TEXT:
93a99a28 82f2c35f 8525d500 00000000 ffff7fff nt!ExDeferredFreePool+0x19f
93a99a90 8ae3de69 b56ab008 6e664d46 93a99aac nt!ExFreePoolWithTag+0x8a4
93a99aa0 8ae3deb9 b56ab034 93a99ac4 8ae3e282 fltmgr!FltpFreeFileNameInformation+0x17
93a99aac 8ae3e282 b56ab034 861ea3d0 856a7578 fltmgr!FltReleaseFileNameInformation+0x2b
93a99ac4 8ae3e311 856a7578 00008000 ffffffff fltmgr!DeleteNameCacheNodes+0xfe
93a99ae0 8ae417af 861ea3d0 856a7578 856a75b8 fltmgr!FltpFreeNameCacheList+0x17
93a99afc 8ae419b4 856a7578 b406a738 00000000 fltmgr!CleanupStreamListCtrl+0x37
93a99b10 8308a2a1 856a757c b6f30ce8 00000000 fltmgr!DeleteStreamListCtrlCallback+0x5a
93a99b50 8af0c89c b406a738 b406a648 b406a738 nt!FsRtlTeardownPerStreamContexts+0x13a
93a99b6c 8aefd0b5 00000703 b406a670 b406a648 Ntfs!NtfsDeleteScb+0x214
93a99b84 8ae809e2 856a7450 b406a738 00000000 Ntfs!NtfsRemoveScb+0xc5
93a99ba0 8af0c2d7 856a7450 b406a648 00000000 Ntfs!NtfsPrepareFcbForRemoval+0x62
93a99be4 8ae7c2cb 856a7450 b406a738 b406a950 Ntfs!NtfsTeardownStructures+0x68
93a99c0c 8af10331 856a7450 b406a738 b406a950 Ntfs!NtfsDecrementCloseCounts+0xaf
93a99c6c 8af14414 856a7450 b406a738 b406a648 Ntfs!NtfsCommonClose+0x4f2
93a99d00 82e88a6b 00000000 00000000 85493558 Ntfs!NtfsFspClose+0x118
93a99d50 83013fda 80000000 b6f30a28 00000000 nt!ExpWorkerThread+0x10d
93a99d90 82ebc1f9 82e8895e 80000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExDeferredFreePool+19f
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .cxr 0xffffffff93a99500 ; kb
FAILURE_BUCKET_ID: 0x24_nt!ExDeferredFreePool+19f
BUCKET_ID: 0x24_nt!ExDeferredFreePool+19f
Followup: Pool_corruption
---------