[list=1]
[*]
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\BSODDmpFiles\Tenack\Windows_NT6_BSOD_jcgriff2\021712-37830-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03061000 PsLoadedModuleList = 0xfffff800`032a6670
Debug session time: Fri Feb 17 10:55:53.348 2012 (GMT-7)
System Uptime: 0 days 0:01:27.550
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 11e002, 5, 1}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000011e002, page frame number
Arg3: 0000000000000005, current page state
Arg4: 0000000000000001, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80003166d7c to fffff800030ddc40
STACK_TEXT:
fffff880`09a88638 fffff800`03166d7c : 00000000`0000004e 00000000`00000099 00000000`0011e002 00000000`00000005 : nt!KeBugCheckEx
fffff880`09a88640 fffff800`030853d7 : 95b00001`1e002025 fffffa80`035a0060 fffff880`09a88848 fffff680`0000a9e0 : nt!MiBadShareCount+0x4c
fffff880`09a88680 fffff800`0310fbb7 : fffff880`00000000 fffff680`0000a9f8 fffffa80`09673960 00000000`07000001 : nt! ?? ::FNODOBFM::`string'+0x3309d
fffff880`09a88830 fffff800`03111569 : 00000000`00000000 00000000`0153ffff fffffa80`00000000 fffff683`00000000 : nt!MiDeleteVirtualAddresses+0x41f
fffff880`09a889f0 fffff800`033f5221 : fffffa80`09755010 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`09a88b10 fffff800`033f5623 : 0000007f`00000000 00000000`01530000 fffffa80`00000001 00000000`00540001 : nt!MiUnmapViewOfSection+0x1b1
fffff880`09a88bd0 fffff800`030dced3 : 00000000`00000008 000007fe`f35c6480 fffffa80`09673960 00000000`00000000 : nt!NtUnmapViewOfSection+0x5f
fffff880`09a88c20 00000000`76d315ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`005ee0a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d315ba
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`03166d7c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
[*]
Loading Dump File [F:\BSODDmpFiles\Tenack\Windows_NT6_BSOD_jcgriff2\021412-16692-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0304d000 PsLoadedModuleList = 0xfffff800`03292670
Debug session time: Tue Feb 14 15:42:29.054 2012 (GMT-7)
System Uptime: 0 days 0:01:05.381
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff800031f8617, fffff88002192f00, 0}
Probably caused by : ntkrnlmp.exe ( nt!ExAllocatePoolWithTag+537 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800031f8617, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88002192f00, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExAllocatePoolWithTag+537
fffff800`031f8617 48895808 mov qword ptr [rax+8],rbx
CONTEXT: fffff88002192f00 -- (.cxr 0xfffff88002192f00)
rax=0000000000000000 rbx=fffffa800183e2c0 rcx=fffff8a00200e2d0
rdx=0000000000000038 rsi=0000000000000005 rdi=0000000000000001
rip=fffff800031f8617 rsp=fffff880021938e0 rbp=0000000000001000
r8=0000000000000001 r9=fffffa800183e2c0 r10=fffffa800183e148
r11=0000000000000001 r12=fffffa800183e140 r13=0000000000000000
r14=fffffa8003df1b60 r15=0000000020206553
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!ExAllocatePoolWithTag+0x537:
fffff800`031f8617 48895808 mov qword ptr [rax+8],rbx ds:002b:00000000`00000008=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: services.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800031f8617
STACK_TEXT:
fffff880`021938e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExAllocatePoolWithTag+0x537
FOLLOWUP_IP:
nt!ExAllocatePoolWithTag+537
fffff800`031f8617 48895808 mov qword ptr [rax+8],rbx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExAllocatePoolWithTag+537
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff88002192f00 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!ExAllocatePoolWithTag+537
BUCKET_ID: X64_0x3B_nt!ExAllocatePoolWithTag+537
Followup: MachineOwner
---------
[/list]