NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880032a6268
Arg3: fffff880032a5ac0
Arg4: fffffa8007d3ad66
0: kd> .cxr fffff880032a5ac0
rax=0000000000000000 rbx=fffffa8007d39830 rcx=0000000000000002
rdx=0000000000000000 rsi=0000000000000001 rdi=fffffa8007d37bb0
rip=fffffa8007d3ad66 rsp=fffff880032a64a0 rbp=fffff8800123e8c4
r8=fffffa8006d2a450 r9=fffffa8007d39870 r10=0000000000000000
r11=0000000000000002 r12=fffffa8007d6c8f0 r13=0000000000000001
r14=fffffa8007d37bb0 r15=fffff880032a6740
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
fffffa80`07d3ad66 ff ???
0: kd> kb
*** Stack trace for last set context - .thread/.cxr resets it
RetAddr : Args to Child : Call Site
fffff8a0`001f9950 : fffff880`0123e858 fffff880`032a6520 fffffa80`07d39830 fffffa80`07d39b30 : 0xfffffa80`07d3ad66
fffff880`0123e858 : fffff880`032a6520 fffffa80`07d39830 fffffa80`07d39b30 fffffa80`07d39b30 : 0xfffff8a0`001f9950
fffff880`0123629b : fffffa80`07d6c802 fffff880`032a65f0 fffffa80`07d39b30 fffff8a0`001f9950 : fileinfo!FIStreamQueueQuery+0xe0
fffff880`01002067 : fffffa80`07d39bd0 fffff8a0`001f9950 fffff880`032a6640 fffff800`02ed40fd : fileinfo!FIPreReadWriteCallback+0x223
fffff880`01003329 : fffff880`032a6700 fffff880`032a6703 fffff880`032a6600 fffff880`032a6701 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880`010016c7 : fffffa80`07d39c60 fffffa80`07bbe800 fffffa80`07d268e0 fffff880`032a67e8 : fltmgr!FltpPassThrough+0x2d9
fffff800`02efdda5 : fffffa80`07d39c80 fffffa80`07d6c8f0 fffffa80`07ce0d20 fffff800`03052e80 : fltmgr!FltpDispatch+0xb7
fffff800`02efd881 : 00000000`00000800 00000000`00000800 fffffa80`07ce0c60 00000000`00000000 : nt!IoPageRead+0x255
fffff800`02ee40f9 : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000000`00000000 : nt!MiIssueHardFault+0x255
fffff800`02ed3fee : 00000000`00000000 fffff980`01eaf000 00000000`00000000 00000000`0000000e : nt!MmAccessFault+0x1399
fffff800`031d5587 : fffff8a0`00000001 00000000`0006f000 fffff880`032a6c58 fffff880`032a6c50 : nt!KiPageFault+0x16e
fffff880`016f6e25 : fffffa80`00011000 fffffa80`06d0b510 fffff8a0`00220f01 fffff8a0`0000000e : nt!CcMapData+0x117
fffff880`016faee3 : fffff8a0`00224140 00000000`0000006f fffffa80`07d45c70 fffff8a0`00265700 : Ntfs!FindFirstIndexEntry+0x1fa
fffff880`016eeee4 : fffffa80`07d45c70 fffff880`009a9040 fffffa80`07d45c70 fffff8a0`001f7e01 : Ntfs!NtfsFindIndexEntry+0x63
fffff880`016593ad : fffffa80`07d45c70 fffffa80`07cc0860 fffff880`009a9040 fffffa80`06d2a400 : Ntfs!NtfsCommonCreate+0x7c4
fffff800`02ecd9b7 : fffff880`009a8fb0 fffffa80`06d72b50 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff800`02ecd978 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue