// The crashing thread in storport.sys:
0: kd> !thread
GetPointerFromAddress: unable to read from 83f6a71c
THREAD 8642c4c0 Cid 0004.0030 Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
8e3876c0 SynchronizationEvent
IRP List:
889f6a18: (0006,01d8) Flags: 00060000 Mdl: 00000000
87baaab0: (0006,01d8) Flags: 00060000 Mdl: 00000000
Not impersonating
GetUlongFromAddress: unable to read from 83f2a4dc
Owning Process 86409020 Image: System
Attached Process N/A Image: N/A
ffdf0000: Unable to get shared data
Wait Start TickCount 435178
Context Switch Count 5017 NoStackSwap
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address nt!ExpWorkerThread (0x83e6ff2e)
Stack Init 8e387fd0 Current 8e3875b0 Base 8e388000 Limit 8e385000 Call 0
Priority 15 BasePriority 12 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr Args to Child
8e3875c8 83e70c25 8642c4c0 00000000 8e300120 nt!KiSwapContext+0x26 (FPO: [Uses EBP] [0,0,4])
8e387600 83e6f523 8642c580 8642c4c0 8e3876c0 nt!KiSwapThread+0x266
8e387628 83e6940f 8642c4c0 8642c580 00000000 nt!KiCommitThreadWait+0x1df
8e3876a0 8c1af18c 8e3876c0 00000000 00000000 nt!KeWaitForSingleObject+0x393
8e3876d0 8c1a7e7d 870aa8f8 88e81008 8e387930 storport!RaSendIrpSynchronous+0x50 (FPO: [Non-Fpo])
8e38773c 8c1a860e 8e387930 8e3877ac 8682a2c0 storport!RaidBusEnumeratorIssueSynchronousRequest+0x6c (FPO: [Non-Fpo])
8e387760 8c1a8763 8682a2c0 00000000 8e3877ac storport!RaidBusEnumeratorIssueReportLuns+0x3d (FPO: [Non-Fpo])
8e387788 8c1a89b4 8e387930 00000000 8e3877ac storport!RaidBusEnumeratorGetLunListFromTarget+0x72 (FPO: [Non-Fpo])
8e3877d8 8c1a543a 8e387930 00000000 8e387814 storport!RaidBusEnumeratorGetLunList+0x43 (FPO: [Non-Fpo])
8e387918 8c1a5504 864329d8 8c1a8a30 8e387930 storport!RaidAdapterEnumerateBus+0xbd (FPO: [Non-Fpo])
8e387974 8c1d9165 864329d8 869cca10 00000007 storport!RaidAdapterRescanBus+0x49 (FPO: [Non-Fpo])
8e387998 8c1d982d 864329d8 00000000 8c1b7000 storport!RaidAdapterQueryDeviceRelationsIrp+0x90 (FPO: [Non-Fpo])
8e3879b4 8c1d9d7c 00000007 019cca10 869ccaec storport!RaidAdapterPnpIrp+0x94 (FPO: [Non-Fpo])
8e3879d0 83e3e4ac 86432920 869cca10 8e387a48 storport!RaDriverPnpIrp+0x71 (FPO: [Non-Fpo])
8e3879e8 83faad76 00000000 863a2030 8660b578 nt!IofCallDriver+0x63
8e387a04 83faacad 8e387a24 83e15b87 8660b578 nt!PnpAsynchronousCall+0x92
8e387a64 83faaa2f 00000000 83e15b87 8660b578 nt!PnpQueryDeviceRelations+0xc5
8e387aa8 83fa9a5b 8660b578 0000003c 86751450 nt!PipEnumerateDevice+0xf9
8e387ca4 83fa3630 863bcce8 86751450 8e387cd0 nt!PipProcessDevNodeTree+0x32c
8e387cd8 83e15f9f 83f65e80 8642c4c0 83f3c5bc nt!PiProcessReenumeration+0x74
8e387d00 83e7003b 00000000 00000000 8642c4c0 nt!PnpDeviceActionWorker+0x224
8e387d50 840109df 00000001 a7216d8b 00000000 nt!ExpWorkerThread+0x10d
8e387d90 83ec21d9 83e6ff2e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
// The first completed IRP for this thread, showing a USB event for a logitech webcam driver:
0: kd> !irp 889f6a18
Irp is active with 6 stacks 7 is current (= 0x889f6b60)
No Mdl: No System Buffer: Thread 8642c4c0: Irp is completed.
cmd flg cl Device File Completion-Context
[ 0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[ 1b, 0] 0 0 87d31028 00000000 83e8b959-889f87a8
\Driver\usbohci nt!IopUnloadSafeCompletion
Args: 00000000 00000000 00000000 885ccdb8
[ 1b, 0] 0 0 87be6c68 00000000 93100a74-8e38786c
\Driver\usbccgp LVUSBSta
Args: 00000000 00000000 00000000 00000000
// The second IRP on this thread, also showing a USB event for a logitech webcam driver:
0: kd> !irp 87baaab0
Irp is active with 6 stacks 7 is current (= 0x87baabf8)
No Mdl: No System Buffer: Thread 8642c4c0: Irp is completed.
cmd flg cl Device File Completion-Context
[ 0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
[ 1b, 0] 0 0 87d31028 00000000 83e8b959-863b2df8
\Driver\usbohci nt!IopUnloadSafeCompletion
Args: 00000000 00000000 00000000 885ccdb8
[ 1b, 0] 0 0 87be6c68 00000000 93100a74-8e387858
\Driver\usbccgp LVUSBSta
Args: 00000000 00000000 00000000 00000000
0: kd> lmvm LVUSBSta
start end module name
93100000 93108900 LVUSBSta T (no symbols)
Loaded symbol image file: LVUSBSta.sys
Image path: \SystemRoot\system32\drivers\LVUSBSta.sys
Image name: LVUSBSta.sys
Timestamp: Sat Jul 26 10:59:36 2008 (488B3BD8)
CheckSum: 0001726E
ImageSize: 00008900
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> !sysinfo machineid
Machine ID Information [From Smbios 2.5, DMIVersion 0, Size=1727]
BiosMajorRelease = 8
BiosMinorRelease = 14
BiosVendor = American Megatrends Inc.
BiosVersion = 1304
BiosReleaseDate = 03/19/2010
SystemManufacturer = System manufacturer
SystemProductName = System Product Name
SystemFamily = To Be Filled By O.E.M.
SystemVersion = System Version
SystemSKU = To Be Filled By O.E.M.
BaseBoardManufacturer = ASUSTeK Computer INC.
BaseBoardProduct = M2N68-AM SE2
BaseBoardVersion = Rev X.0x