*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D5, {fffff980040c0ed0, 0, fffff8800525a1aa, 0}
*** WARNING: Unable to verify timestamp for usbfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for usbfilter.sys
Could not read faulting driver name
Probably caused by : usbfilter.sys ( usbfilter+41aa )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL (d5)
Memory was referenced after it was freed.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff980040c0ed0, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: fffff8800525a1aa, if non-zero, the address which referenced memory.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003b12100
GetUlongFromAddress: unable to read from fffff80003b121c0
fffff980040c0ed0
FAULTING_IP:
usbfilter+41aa
fffff880`0525a1aa 8b4230 mov eax,dword ptr [rdx+30h]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0xD5
PROCESS_NAME: System
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
TRAP_FRAME: fffff880031bd280 -- (.trap 0xfffff880031bd280)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff880031bd478
rdx=fffff980040c0ea0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800525a1aa rsp=fffff880031bd410 rbp=0000000000000002
r8=0000000000000000 r9=fffff8800525a1a5 r10=0000000000000100
r11=fffff88002fd5180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
usbfilter+0x41aa:
fffff880`0525a1aa 8b4230 mov eax,dword ptr [rdx+30h] ds:fffff980`040c0ed0=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80003958bf0 to fffff800038dabc0
STACK_TEXT:
fffff880`031bd118 fffff800`03958bf0 : 00000000`00000050 fffff980`040c0ed0 00000000`00000000 fffff880`031bd280 : nt!KeBugCheckEx
fffff880`031bd120 fffff800`038d8cee : 00000000`00000000 fffff980`040c0ed0 fffffa80`089bd500 fffff980`04144d80 : nt! ?? ::FNODOBFM::`string'+0x4518f
fffff880`031bd280 fffff880`0525a1aa : fffff880`031bd478 00000000`00000000 fffff980`04144d80 fffffa80`0933d910 : nt!KiPageFault+0x16e
fffff880`031bd410 fffff880`031bd478 : 00000000`00000000 fffff980`04144d80 fffffa80`0933d910 00000000`00000000 : usbfilter+0x41aa
fffff880`031bd418 00000000`00000000 : fffff980`04144d80 fffffa80`0933d910 00000000`00000000 fffff880`031bd478 : 0xfffff880`031bd478
STACK_COMMAND: kb
FOLLOWUP_IP:
usbfilter+41aa
fffff880`0525a1aa 8b4230 mov eax,dword ptr [rdx+30h]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: usbfilter+41aa
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: usbfilter
IMAGE_NAME: usbfilter.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4b3082ae
FAILURE_BUCKET_ID: X64_0xD5_VRF_usbfilter+41aa
BUCKET_ID: X64_0xD5_VRF_usbfilter+41aa
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0xd5_vrf_usbfilter+41aa
FAILURE_ID_HASH: {99a3ab33-5d0d-830d-93f8-a253b816e3d3}
Followup: MachineOwner
---------
3: kd> lmvm usbfilter
start end module name
fffff880`05256000 fffff880`05263000 usbfilter T (no symbols)
Loaded symbol image file: usbfilter.sys
Image path: \SystemRoot\system32\DRIVERS\usbfilter.sys
Image name: usbfilter.sys
Timestamp: Tue Dec 22 13:56:22 2009 (4B3082AE)
CheckSum: 0000DFD8
ImageSize: 0000D000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4