*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff8800120a8cb, fffff88001f96938, fffff88001f961a0}
Probably caused by : Ntfs.sys ( Ntfs!NtfsRemoveClose+a3 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800120a8cb, The address that the exception occurred at
Arg3: fffff88001f96938, Exception Record Address
Arg4: fffff88001f961a0, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
Ntfs!NtfsRemoveClose+a3
fffff880`0120a8cb f08380e4000000ff lock add dword ptr [rax+0E4h],0FFFFFFFFh
EXCEPTION_RECORD: fffff88001f96938 -- (.exr 0xfffff88001f96938)
ExceptionAddress: fffff8800120a8cb (Ntfs!NtfsRemoveClose+0x00000000000000a3)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88001f961a0 -- (.cxr 0xfffff88001f961a0)
rax=fdfff8a009759460 rbx=fffffa8003e954f0 rcx=fffff88001264220
rdx=fffff88001264220 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800120a8cb rsp=fffff88001f96b70 rbp=fffff80001a625a0
r8=00000000ffffffff r9=0000000000000727 r10=fffff88001262700
r11=fffff8a009759590 r12=fffff88001264000 r13=0000000000000000
r14=fffff88001f96c08 r15=0000000000000001
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
Ntfs!NtfsRemoveClose+0xa3:
fffff880`0120a8cb f08380e4000000ff lock add dword ptr [rax+0E4h],0FFFFFFFFh ds:002b:fdfff8a0`09759544=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001af50e0
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsRemoveClose+a3
fffff880`0120a8cb f08380e4000000ff lock add dword ptr [rax+0E4h],0FFFFFFFFh
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from fffff8800128a286 to fffff8800120a8cb
STACK_TEXT:
fffff880`01f96b70 fffff880`0128a286 : fffffa80`03e84010 00000000`00000000 fffff8a0`09752b40 fffffa80`04a51180 : Ntfs!NtfsRemoveClose+0xa3
fffff880`01f96ba0 fffff800`018ca861 : 00000000`00000000 fffff880`01550000 fffff800`01a62501 00000000`00000002 : Ntfs!NtfsFspClose+0x56
fffff880`01f96c70 fffff800`01b62a86 : 4bf75faf`ffffffff fffffa80`039c8680 00000000`00000080 fffffa80`039ae040 : nt!ExpWorkerThread+0x111
fffff880`01f96d00 fffff800`0189bb06 : fffff880`01e5c180 fffffa80`039c8680 fffff880`01e66fc0 043e6c42`68d2bb06 : nt!PspSystemThreadStartup+0x5a
fffff880`01f96d40 00000000`00000000 : fffff880`01f97000 fffff880`01f91000 fffff880`01f969b0 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsRemoveClose+a3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff88001f961a0 ; kb
FAILURE_BUCKET_ID: X64_0x7E_Ntfs!NtfsRemoveClose+a3
BUCKET_ID: X64_0x7E_Ntfs!NtfsRemoveClose+a3
Followup: MachineOwner
---------
