*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 18, {852478e0, 85466d48, 1, fffffffe}
Probably caused by : ntkrnlmp.exe ( nt!ObfDereferenceObjectWithTag+4b )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 852478e0, Object type of the object whose reference count is being lowered
Arg2: 85466d48, Object whose reference count is being lowered
Arg3: 00000001, Reserved
Arg4: fffffffe, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object’s reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82c6045c to 82cdc490
STACK_TEXT:
8e86dcc4 82c6045c 00000018 852478e0 85466d48 nt!KeBugCheckEx+0x1e
8e86dce8 82c6040a 85466d48 82c78f5e 82d43360 nt!ObfDereferenceObjectWithTag+0x4b
8e86dcf0 82c78f5e 82d43360 852b9a70 82d3cbb8 nt!ObfDereferenceObject+0xd
8e86dcf4 82d43360 852b9a70 82d3cbb8 82c65173 nt!PspReaper+0x84
8e86dd50 82df250a 00000002 c0b470e6 00000000 nt!PsReaperWorkItem
8e86dd90 82c93879 82c65066 00000002 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ObfDereferenceObjectWithTag+4b
82c6045c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+4b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 503f7f30
FAILURE_BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag+4b
BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag+4b
Followup: MachineOwner
---------
0: kd> !object 85466d48
GetUlongFromAddress: unable to read from 82d69824
Could not read ObjectType address
You used DV beautifully. 