Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\011711-28641-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03001000 PsLoadedModuleList = 0xfffff800`0323ee50
Debug session time: Mon Jan 17 15:27:45.663 2011 (UTC - 5:00)
System Uptime: 0 days 0:09:30.599
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 18, {0, fffffa8005564a00, 2, a27d3a03114df019}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+46411 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: fffffa8005564a00, Object whose reference count is being lowered
Arg3: 0000000000000002, Reserved
Arg4: a27d3a03114df019, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object’s reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80003008fdc to fffff80003071740
STACK_TEXT:
fffff880`03718c48 fffff800`03008fdc : 00000000`00000018 00000000`00000000 fffffa80`05564a00 00000000`00000002 : nt!KeBugCheckEx
fffff880`03718c50 fffff800`0307e961 : fffff800`032165a0 fffff800`0336dc20 fffffa80`0251cb60 fffffa80`00000003 : nt! ?? ::FNODOBFM::`string'+0x46411
fffff880`03718cb0 fffff800`03315c06 : 5ec05ec0`71427142 fffffa80`0251cb60 00000000`00000080 fffffa80`024be040 : nt!ExpWorkerThread+0x111
fffff880`03718d40 fffff800`0304fc26 : fffff880`03583180 fffffa80`0251cb60 fffff880`0358e0c0 d847d847`59175917 : nt!PspSystemThreadStartup+0x5a
fffff880`03718d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+46411
fffff800`03008fdc cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+46411
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+46411
BUCKET_ID: X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+46411
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\10675d1295296479-bccode-1000007e-dmp-included-011711-28236-01-dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03009000 PsLoadedModuleList = 0xfffff800`03246e50
Debug session time: Mon Jan 17 00:19:06.625 2011 (UTC - 5:00)
System Uptime: 0 days 6:44:19.577
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
.............
Unable to load image \SystemRoot\system32\DRIVERS\athrxusb.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for athrxusb.sys
*** ERROR: Module load completed but symbols could not be loaded for athrxusb.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff880026f204b, fffff88004c6e918, fffff88004c6e180}
Probably caused by : athrxusb.sys ( athrxusb+6804b )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880026f204b, The address that the exception occurred at
Arg3: fffff88004c6e918, Exception Record Address
Arg4: fffff88004c6e180, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
athrxusb+6804b
fffff880`026f204b 0fb7896e360000 movzx ecx,word ptr [rcx+366Eh]
EXCEPTION_RECORD: fffff88004c6e918 -- (.exr 0xfffff88004c6e918)
ExceptionAddress: fffff880026f204b (athrxusb+0x000000000006804b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88004c6e180 -- (.cxr 0xfffff88004c6e180)
rax=000000000000000b rbx=fffffa8005120b60 rcx=ffff000000000063
rdx=fffffa8000000063 rsi=fffffa80024af040 rdi=0000000000000001
rip=fffff880026f204b rsp=fffff88004c6eb50 rbp=0000000000000080
r8=0000000000000028 r9=fffff88003163180 r10=fffffa80024ed810
r11=fffffa800354b520 r12=fffffa800532e0a0 r13=fffff880026e0ea0
r14=0000000000000000 r15=fffff88003168040
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
athrxusb+0x6804b:
fffff880`026f204b 0fb7896e360000 movzx ecx,word ptr [rcx+366Eh] ds:002b:ffff0000`000036d1=????
Resetting default scope
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b10e0
ffffffffffffffff
FOLLOWUP_IP:
athrxusb+6804b
fffff880`026f204b 0fb7896e360000 movzx ecx,word ptr [rcx+366Eh]
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from fffffa8005323030 to fffff880026f204b
STACK_TEXT:
fffff880`04c6eb50 fffffa80`05323030 : fffff880`04c6eb78 fffffa80`00000022 fffff880`026de710 ffff000b`00000022 : athrxusb+0x6804b
fffff880`04c6eb58 fffff880`04c6eb78 : fffffa80`00000022 fffff880`026de710 ffff000b`00000022 907c0000`907e0021 : 0xfffffa80`05323030
fffff880`04c6eb60 fffffa80`00000022 : fffff880`026de710 ffff000b`00000022 907c0000`907e0021 91040000`91060062 : 0xfffff880`04c6eb78
fffff880`04c6eb68 fffff880`026de710 : ffff000b`00000022 907c0000`907e0021 91040000`91060062 91080000`910a0044 : 0xfffffa80`00000022
fffff880`04c6eb70 ffff000b`00000022 : 907c0000`907e0021 91040000`91060062 91080000`910a0044 910c0000`910e004d : athrxusb+0x54710
fffff880`04c6eb78 907c0000`907e0021 : 91040000`91060062 91080000`910a0044 910c0000`910e004d 91100000`91120056 : 0xffff000b`00000022
fffff880`04c6eb80 91040000`91060062 : 91080000`910a0044 910c0000`910e004d 91100000`91120056 ffff0000`00000063 : 0x907c0000`907e0021
fffff880`04c6eb88 91080000`910a0044 : 910c0000`910e004d 91100000`91120056 ffff0000`00000063 fffff880`026e0ea0 : 0x91040000`91060062
fffff880`04c6eb90 910c0000`910e004d : 91100000`91120056 ffff0000`00000063 fffff880`026e0ea0 00000000`0000000a : 0x91080000`910a0044
fffff880`04c6eb98 91100000`91120056 : ffff0000`00000063 fffff880`026e0ea0 00000000`0000000a fffff880`026f211a : 0x910c0000`910e004d
fffff880`04c6eba0 ffff0000`00000063 : fffff880`026e0ea0 00000000`0000000a fffff880`026f211a fffffa80`0535e030 : 0x91100000`91120056
fffff880`04c6eba8 fffff880`026e0ea0 : 00000000`0000000a fffff880`026f211a fffffa80`0535e030 00000000`00000000 : 0xffff0000`00000063
fffff880`04c6ebb0 00000000`0000000a : fffff880`026f211a fffffa80`0535e030 00000000`00000000 0000000c`00000006 : athrxusb+0x56ea0
fffff880`04c6ebb8 fffff880`026f211a : fffffa80`0535e030 00000000`00000000 0000000c`00000006 00000002`03082cff : 0xa
fffff880`04c6ebc0 fffffa80`0535e030 : 00000000`00000000 0000000c`00000006 00000002`03082cff fffffa80`0535e030 : athrxusb+0x6811a
fffff880`04c6ebc8 00000000`00000000 : 0000000c`00000006 00000002`03082cff fffffa80`0535e030 ffff0000`06b6ec3f : 0xfffffa80`0535e030
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: athrxusb+6804b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: athrxusb
IMAGE_NAME: athrxusb.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 45bdef26
STACK_COMMAND: .cxr 0xfffff88004c6e180 ; kb
FAILURE_BUCKET_ID: X64_0x7E_athrxusb+6804b
BUCKET_ID: X64_0x7E_athrxusb+6804b
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\011711-31247-01-dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03016000 PsLoadedModuleList = 0xfffff800`03253e50
Debug session time: Mon Jan 17 15:17:18.616 2011 (UTC - 5:00)
System Uptime: 0 days 0:13:12.458
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff8000306f2c9, 0, ffffffffffffffff}
Probably caused by : memory_corruption ( nt!MiDereferenceControlAreaPfn+5d )
Followup: MachineOwner
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8000306f2c9, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MiDereferenceControlAreaPfn+5d
fffff800`0306f2c9 f00fba69481f lock bts dword ptr [rcx+48h],1Fh
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032be0e0
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR: 0x1E_c0000005
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: chrome.exe
CURRENT_IRQL: 2
EXCEPTION_RECORD: fffff880087e8738 -- (.exr 0xfffff880087e8738)
ExceptionAddress: fffff8000306f2c9 (nt!MiDereferenceControlAreaPfn+0x000000000000005d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
TRAP_FRAME: fffff880087e87e0 -- (.trap 0xfffff880087e87e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=db7edf86bbec27b7
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000306f2c9 rsp=fffff880087e8970 rbp=0000000000000000
r8=0000000000000001 r9=0000000000000101 r10=0000000000000002
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!MiDereferenceControlAreaPfn+0x5d:
fffff800`0306f2c9 f00fba69481f lock bts dword ptr [rcx+48h],1Fh ds:db7edf86`bbec27ff=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800030c0a39 to fffff80003086740
STACK_TEXT:
fffff880`087e7f68 fffff800`030c0a39 : 00000000`0000001e ffffffff`c0000005 fffff800`0306f2c9 00000000`00000000 : nt!KeBugCheckEx
fffff880`087e7f70 fffff800`03085d82 : fffff880`087e8738 db7edf86`bbec27b7 fffff880`087e87e0 00000000`00000001 : nt!KiDispatchException+0x1b9
fffff880`087e8600 fffff800`0308468a : 00000000`00000002 00000000`00000001 fffffa80`00e508c0 00000000`00000080 : nt!KiExceptionDispatch+0xc2
fffff880`087e87e0 fffff800`0306f2c9 : 00000000`0000004c 00000000`0000007f fffffa80`00e4bb20 00000000`0004c3e6 : nt!KiGeneralProtectionFault+0x10a
fffff880`087e8970 fffff800`03049cd8 : 00000000`00000002 00000000`00000000 fffffa80`00e52780 00000000`00000080 : nt!MiDereferenceControlAreaPfn+0x5d
fffff880`087e89e0 fffff800`0314729d : fffffa80`00e52780 fffff880`087e8b40 00000000`00000080 00000000`00059759 : nt!MiRestoreTransitionPte+0xcc
fffff880`087e8a40 fffff800`030333a4 : fffff680`000260d0 fffff880`087e8b40 00000000`00000000 ffffffff`ffffffff : nt!MiRemoveLowestPriorityStandbyPage+0x2ad
fffff880`087e8ac0 fffff800`0308482e : 00000000`00000001 00000000`00000032 00000000`00000001 00000000`04709a2c : nt! ?? ::FNODOBFM::`string'+0x43485
fffff880`087e8c20 00000000`6cc73a75 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`001cea80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6cc73a75
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiDereferenceControlAreaPfn+5d
fffff800`0306f2c9 f00fba69481f lock bts dword ptr [rcx+48h],1Fh
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!MiDereferenceControlAreaPfn+5d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x1E_c0000005_nt!MiDereferenceControlAreaPfn+5d
BUCKET_ID: X64_0x1E_c0000005_nt!MiDereferenceControlAreaPfn+5d
Followup: MachineOwner
---------