[FONT="Lucida Console"]Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\USER\Downloads\Compressed\Fugue SF_19-01-2014\Fugue SF_19-01-2014\011914-54210-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18247.x86fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0x8301c000 PsLoadedModuleList = 0x831654d0
Debug session time: Mon Jan 20 01:04:04.625 2014 (UTC + 6:00)
System Uptime: 1 days 21:46:18.669
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {20, 8600d000, 8600d300, 8600000}
GetPointerFromAddress: unable to read from 8318584c
Unable to read MiSystemVaType memory at 83164e20
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+1b1 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 8600d000, The pool entry we were looking for within the page.
Arg3: 8600d300, The next pool entry.
Arg4: 08600000, (reserved)
Debugging Details:
------------------
GetPointerFromAddress: unable to read from 8318584c
Unable to read MiSystemVaType memory at 83164e20
BUGCHECK_STR: 0x19_20
POOL_ADDRESS: GetPointerFromAddress: unable to read from 8318584c
Unable to read MiSystemVaType memory at 83164e20
8600d000
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 83e2704e to 8313cc6b
STACK_TEXT:
807fcadc 83e2704e 8600d008 00000000 830e01d5 nt!ExFreePoolWithTag+0x1b1
807fcaf4 83e1d816 8600d008 807fcb18 83eb161c Ntfs!NtfsFreeNonpagedDataFcb+0x28
807fcb00 83eb161c 83e4a300 8600d008 88119618 Ntfs!ExFreeToPagedLookasideList+0x1e
807fcb18 83ea21b9 8600d008 00000000 86d15240 Ntfs!NtfsDeleteNonpagedFcb+0x3c
807fcb40 83e1cb84 88119618 807fcb70 807fcb7a Ntfs!NtfsDeleteFcb+0xd5
807fcb94 83eb13a2 88119618 86d150d8 b54b1798 Ntfs!NtfsTeardownFromLcb+0x24f
807fcbe4 83e213e0 88119618 b54b1888 014b1a30 Ntfs!NtfsTeardownStructures+0xf3
807fcc0c 83eb5371 88119618 b54b1888 b54b1a30 Ntfs!NtfsDecrementCloseCounts+0xaf
807fcc6c 83eb9454 88119618 b54b1888 b54b1798 Ntfs!NtfsCommonClose+0x4f2
807fcd00 8309914b 00000000 00000000 85e84020 Ntfs!NtfsFspClose+0x118
807fcd50 8322513d 00000000 a437ca99 00000000 nt!ExpWorkerThread+0x10d
807fcd90 830cc559 8309903e 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExFreePoolWithTag+1b1
8313cc6b cc int 3
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExFreePoolWithTag+1b1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 521e9cb6
FAILURE_BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+1b1
BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+1b1
Followup: MachineOwner
---------[/FONT]
rb:
