*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 76, {0, fffffa8006bd9b30, 2a, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+18026 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PROCESS_HAS_LOCKED_PAGES (76)
Caused by a driver not cleaning up correctly after an I/O.
Arguments:
Arg1: 0000000000000000, Locked memory pages found in process being terminated.
Arg2: fffffa8006bd9b30, Process address.
Arg3: 000000000000002a, Number of locked pages.
Arg4: 0000000000000000, Pointer to driver stacks (if enabled) or 0 if not.
Issue a !search over all of physical memory for the current process pointer.
This will yield at least one MDL which points to it. Then do another !search
for each MDL found, this will yield the IRP(s) that point to it, revealing
which driver is leaking the pages.
Otherwise, set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\TrackLockedPages to a DWORD 1 value and reboot. Then the system
will save stack traces so the guilty driver can be easily identified.
When you enable this flag, if the driver commits the error again you will
see a different bugcheck - DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (0xCB) -
which can identify the offending driver(s).
Debugging Details:
------------------
PROCESS_NAME: audiodg.exe
DEFAULT_BUCKET_ID: DRIVER_FAULT_0x76
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x76
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80003134069 to fffff80002ed7c40
STACK_TEXT:
fffff880`03567a38 fffff800`03134069 : 00000000`00000076 00000000`00000000 fffffa80`06bd9b30 00000000`0000002a : nt!KeBugCheckEx
fffff880`03567a40 fffff800`0318e987 : fffffa80`06bd9b30 fffffa80`03973c90 fffffa80`00000000 fffffa80`00000003 : nt! ?? ::NNGAKEGL::`string'+0x18026
fffff880`03567a80 fffff800`02ee1af4 : 00000000`00000000 fffffa80`06bd9b30 fffffa80`06bd9b00 fffff800`03263db5 : nt!PspProcessDelete+0x177
fffff880`03567ae0 fffff800`02fd87d9 : fffffa80`06bd9b30 fffffa80`074f1000 fffffa80`074f1ea8 fffffa80`074f1ea0 : nt!ObfDereferenceObject+0xd4
fffff880`03567b40 fffff800`0332858e : fffffa80`00000534 fffffa80`0776a000 fffffa80`06bd9b30 fffffa80`074f1ea8 : nt!MmFreeAccessPfnBuffer+0x29
fffff880`03567b70 fffff800`03349c70 : fffffa80`06837001 00000000`00000080 fffffa80`039eeb30 fffff800`0305fda8 : nt!PfpFlushBuffers+0x23e
fffff880`03567c10 fffff800`03172fee : ffffffff`ff676980 fffffa80`06837060 fffff880`03567db0 fffffa80`06837060 : nt!PfTLoggingWorker+0xe0
fffff880`03567d40 fffff800`02ec95e6 : fffff800`0304de80 fffffa80`06837060 fffff800`0305bcc0 fffff880`0126c384 : nt!PspSystemThreadStartup+0x5a
fffff880`03567d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::NNGAKEGL::`string'+18026
fffff800`03134069 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+18026
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x76_audiodg.exe_nt!_??_::NNGAKEGL::_string_+18026
BUCKET_ID: X64_0x76_audiodg.exe_nt!_??_::NNGAKEGL::_string_+18026
Followup: MachineOwner
Now it's a bit of a waiting game.....
