Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032711-18049-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`0301c000 PsLoadedModuleList = 0xfffff800`03259e50
Debug session time: Sun Mar 27 02:56:09.426 2011 (UTC - 4:00)
System Uptime: 0 days 4:48:51.971
Loading Kernel Symbols
...............................................................
................................................................
...................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 1f1f2, 2, 1b4f1}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000001f1f2, page frame number
Arg3: 0000000000000002, current page state
Arg4: 000000000001b4f1, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: bitRipper.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff8000311c38c to fffff8000308c740
STACK_TEXT:
fffff880`0b5da2e8 fffff800`0311c38c : 00000000`0000004e 00000000`00000099 00000000`0001f1f2 00000000`00000002 : nt!KeBugCheckEx
fffff880`0b5da2f0 fffff800`030e94d2 : 00000000`00000002 00000000`00000000 fffffa80`004ed980 fffff800`032435f8 : nt!MiBadShareCount+0x4c
fffff880`0b5da330 fffff800`0314d2ad : fffffa80`004ed980 fffff880`0b5da480 00000000`00000080 00000000`0019ca32 : nt! ?? ::FNODOBFM::`string'+0x11aa2
fffff880`0b5da390 fffff800`0304141e : 00000000`00000000 fffff880`0b5da480 ffffffff`ffffffff 00000000`00000210 : nt!MiRemoveLowestPriorityStandbyPage+0x2ad
fffff880`0b5da410 fffff800`030b86ce : fffff980`0e7fc000 00000000`0c054532 fffff880`00000000 00000000`00001000 : nt! ?? ::FNODOBFM::`string'+0x44ef3
fffff880`0b5da600 fffff800`030b8434 : fffffa80`0c34ce10 00000000`0c054532 fffff880`0b5da740 00000000`000303e8 : nt!CcMapAndCopyInToCache+0x20e
fffff880`0b5da6f0 fffff880`012c7fb8 : 00000001`18f703e8 fffffa80`0c385800 fffff880`0b5da7e0 fffffa80`000388d2 : nt!CcCopyWrite+0x194
fffff880`0b5da780 fffff880`010f1132 : fffffa80`0c3858b0 fffff880`010f4732 fffffa80`000388d2 00000000`00038801 : Ntfs!NtfsCopyWriteA+0x208
fffff880`0b5da970 fffff880`010f4c2a : fffff880`0b5daa40 fffffa80`0727b878 00000000`0c050000 00000000`00038800 : fltmgr!FltpPerformFastIoCall+0xf2
fffff880`0b5da9d0 fffff880`011127fe : 00000000`000388d2 00000000`00000000 fffffa80`0c3858b0 fffff880`0b5dab40 : fltmgr!FltpPassThroughFastIo+0xda
fffff880`0b5daa10 fffff800`033a164e : fffffa80`0c385924 fffffa80`0c3858b0 00000000`00000000 fffffa80`0c385924 : fltmgr!FltpFastIoWrite+0x1ce
fffff880`0b5daab0 fffff800`0308b993 : 00000000`75262401 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x5ad
fffff880`0b5dabb0 00000000`75262dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02d2f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75262dd9
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`0311c38c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032611-19593-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`03059000 PsLoadedModuleList = 0xfffff800`03296e50
Debug session time: Sat Mar 26 22:05:51.657 2011 (UTC - 4:00)
System Uptime: 0 days 4:37:38.203
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 2e967, 0, 2ea67}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000002e967, page frame number
Arg3: 0000000000000000, current page state
Arg4: 000000000002ea67, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: chrome.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff8000315938c to fffff800030c9740
STACK_TEXT:
fffff880`0c6b3f98 fffff800`0315938c : 00000000`0000004e 00000000`00000099 00000000`0002e967 00000000`00000000 : nt!KeBugCheckEx
fffff880`0c6b3fa0 fffff800`0313b9f7 : 00000000`00000000 fffff680`0005ab78 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`0c6b3fe0 fffff800`0309dc13 : fffffa80`06da1b30 fffff700`0001fa56 0000007f`fffffff8 fffff8a0`0aa0e3f8 : nt! ?? ::FNODOBFM::`string'+0x3223e
fffff880`0c6b4070 fffff800`0309c67a : fffffa80`06da1b30 fffffa80`00000000 fffff880`0001ec08 fffff800`00000005 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`0c6b4920 fffff800`033acabf : fffff8a0`09b539a0 fffff880`0c6b4c20 00000000`00000000 fffffa80`06ef3b60 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0c6b4970 fffff800`03386735 : 00000000`c0000005 00000000`c0000001 00000000`7ef14000 fffffa80`0ca33530 : nt!PspExitThread+0x92f
fffff880`0c6b4a30 fffff800`030a61cb : 00000000`00000100 fffffa80`06ef3c20 00000000`00000001 fffff800`030d0b9d : nt!PsExitSpecialApc+0x1d
fffff880`0c6b4a60 fffff800`030a6610 : 00000000`00000000 fffff880`0c6b4ae0 fffff800`0338684c 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`0c6b4ae0 fffff800`030c8a37 : fffffa80`06ef3b60 00000000`0000184c fffff880`0c6b4bf8 fffffa80`0be071e0 : nt!KiInitiateUserApc+0x70
fffff880`0c6b4c20 00000000`75412dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`2069ef28 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75412dd9
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`0315938c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032411-29608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`0300c000 PsLoadedModuleList = 0xfffff800`03249e50
Debug session time: Thu Mar 24 04:16:34.944 2011 (UTC - 4:00)
System Uptime: 1 days 12:10:31.129
Loading Kernel Symbols
...............................................................
................................................................
......................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 1863f5, 1, 185cf5}
Probably caused by : udfs.sys ( udfs!UdfFlushVolume+964 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000001863f5, page frame number
Arg3: 0000000000000001, current page state
Arg4: 0000000000185cf5, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff8000310c38c to fffff8000307c740
STACK_TEXT:
fffff880`0316f7b8 fffff800`0310c38c : 00000000`0000004e 00000000`00000099 00000000`001863f5 00000000`00000001 : nt!KeBugCheckEx
fffff880`0316f7c0 fffff800`030213d7 : 00000000`001863f5 00000000`00032392 fffffa80`0096ab60 00000580`00000000 : nt!MiBadShareCount+0x4c
fffff880`0316f800 fffff800`03061b82 : 00000000`00000000 fffff8a0`16d5a000 00000000`00000000 fffff8a0`16cfe200 : nt! ?? ::FNODOBFM::`string'+0x2d244
fffff880`0316f8f0 fffff880`064aa814 : fffffa80`0a877348 00000000`00000000 fffffa80`00000000 00000000`00000000 : nt!CcPurgeCacheSection+0x172
fffff880`0316f960 fffff880`064bc99e : fffffa80`06fde7e0 fffffa80`0a5be5a0 fffff800`03221500 00000000`00000001 : udfs!UdfFlushVolume+0x964
fffff880`0316fa00 fffff880`06481096 : fffffa80`06fde7e0 fffffa80`06e4ae10 fffffa80`06e4af28 fffffa80`06e4ae10 : udfs!UdfCommonShutdown+0xc2
fffff880`0316faa0 fffff880`010b26af : fffffa80`0aa58db0 fffffa80`06e4ae10 fffff800`03281210 fffffa80`06e4ae10 : udfs!UdfFsdDispatch+0x356
fffff880`0316fb10 fffff800`032cb1cc : fffffa80`0aa59060 fffff800`0322be00 00000000`00000001 00000000`00000000 : fltmgr!FltpDispatch+0x9f
fffff880`0316fb70 fffff800`032cb362 : 00000000`00000001 00000000`00000001 fffff800`032215a0 00000000`00000000 : nt!IopShutdownBaseFileSystems+0xac
fffff880`0316fbf0 fffff800`032cc046 : fffff800`032cbe60 fffff800`032215a0 00000000`00000001 fffff880`01280050 : nt!IoShutdownSystem+0x122
fffff880`0316fc70 fffff800`03089961 : fffff800`032cbe60 fffff880`012a6230 fffffa80`06a32601 fffffa80`00000004 : nt!PopGracefulShutdown+0x1e6
fffff880`0316fcb0 fffff800`0331f7c6 : 00000000`00000000 fffffa80`06a32680 00000000`00000080 fffffa80`06a0b040 : nt!ExpWorkerThread+0x111
fffff880`0316fd40 fffff800`0305ac26 : fffff880`030a4180 fffffa80`06a32680 fffff880`030af040 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0316fd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
udfs!UdfFlushVolume+964
fffff880`064aa814 3ac3 cmp al,bl
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: udfs!UdfFlushVolume+964
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: udfs
IMAGE_NAME: udfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc1f9
FAILURE_BUCKET_ID: X64_0x4E_99_udfs!UdfFlushVolume+964
BUCKET_ID: X64_0x4E_99_udfs!UdfFlushVolume+964
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032611-20451-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`03002000 PsLoadedModuleList = 0xfffff800`0323fe50
Debug session time: Sat Mar 26 17:26:48.656 2011 (UTC - 4:00)
System Uptime: 0 days 13:24:58.217
Loading Kernel Symbols
...............................................................
................................................................
......................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 2f3b2, 0, 118bb2}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000002f3b2, page frame number
Arg3: 0000000000000000, current page state
Arg4: 0000000000118bb2, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: audiodg.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff8000310238c to fffff80003072740
STACK_TEXT:
fffff880`0c6b91d8 fffff800`0310238c : 00000000`0000004e 00000000`00000099 00000000`0002f3b2 00000000`00000000 : nt!KeBugCheckEx
fffff880`0c6b91e0 fffff800`030e4ce2 : 00000000`00000000 fffffa80`049f8480 0000000f`ffffffff 00000000`00000000 : nt!MiBadShareCount+0x4c
fffff880`0c6b9220 fffff800`030b8ac1 : ad200001`00000000 fffff680`00014f80 00000000`00000200 000fffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x3252e
fffff880`0c6b92a0 fffff800`030b3dee : 00000000`00000002 fffff880`00000000 fffffa80`08014060 fffffa80`080143f8 : nt!MiDecommitPages+0x1a1
fffff880`0c6b9b30 fffff800`03071993 : ffffffff`ffffffff 00000000`028ddd88 00000000`028ddd80 00000000`00000001 : nt!NtFreeVirtualMemory+0x2de
fffff880`0c6b9c20 00000000`76fbf89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`028ddcd8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76fbf89a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`0310238c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032711-30092-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`03016000 PsLoadedModuleList = 0xfffff800`03253e50
Debug session time: Sun Mar 27 03:03:11.200 2011 (UTC - 4:00)
System Uptime: 0 days 0:05:48.745
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {2, 728e9, 22ffff, 2000}
Probably caused by : memory_corruption ( nt!MiUnlinkPageFromLockedList+8e )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000002, A list entry was corrupt
Arg2: 00000000000728e9, entry in list being removed
Arg3: 000000000022ffff, highest physical page number
Arg4: 0000000000002000, reference count of entry being removed
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff800030a76be to fffff80003086740
STACK_TEXT:
fffff880`031fbab8 fffff800`030a76be : 00000000`0000004e 00000000`00000002 00000000`000728e9 00000000`0022ffff : nt!KeBugCheckEx
fffff880`031fbac0 fffff800`030bcc40 : 00000000`00000001 fffff800`00000000 00000000`00000000 fffffa80`00000053 : nt!MiUnlinkPageFromLockedList+0x8e
fffff880`031fbb50 fffff800`030bda6c : 00000000`00000000 fffffa80`090d7a40 fffffa80`090d7ad8 00000000`00000005 : nt!MiGatherMappedPages+0x108
fffff880`031fbc50 fffff800`033297c6 : fffffa80`06a51040 00000000`00000080 fffffa80`06a28040 c781f123`f38bfe03 : nt!MiMappedPageWriter+0x198
fffff880`031fbd40 fffff800`03064c26 : fffff880`030a4180 fffffa80`06a51040 fffff880`030af040 23ce03e8`0b05c6c1 : nt!PspSystemThreadStartup+0x5a
fffff880`031fbd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiUnlinkPageFromLockedList+8e
fffff800`030a76be cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiUnlinkPageFromLockedList+8e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_2_nt!MiUnlinkPageFromLockedList+8e
BUCKET_ID: X64_0x4E_2_nt!MiUnlinkPageFromLockedList+8e
Followup: MachineOwner
---------