PROCESS_HAS_LOCKED_PAGES (76)
Caused by a driver not cleaning up correctly after an I/O.
Arguments:
Arg1: 0000000000000000, Locked memory pages found in process being terminated.
Arg2: fffffa800945b610, Process address.
Arg3: 0000000000000003, Humber of locked pages.
Arg4: 0000000000000000, Pointer to driver stacks (if enabled) or 0 if not.
Issue a !search over all of physical memory for the current process pointer.
This will yield at least one MDL which points to it. Then do another !search
for each MDL found, this will yield the IRP(s) that point to it, revealing
which driver is leaking the pages.
Otherwise, set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\TrackLockedPages to a DWORD 1 value and reboot. Then the system
will save stack traces so the guilty driver can be easily identified.
When you enable this flag, if the driver commits the error again you will
see a different bugcheck - DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (0xCB) -
which can identify the offending driver(s).
Debugging Details:
------------------
PROCESS_NAME: ts3client_win6
DEFAULT_BUCKET_ID: DRIVER_FAULT_0x76
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x76
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800031c69f5 to fffff80002e8ef00
STACK_TEXT:
fffff880`07bde318 fffff800`031c69f5 : 00000000`00000076 00000000`00000000 fffffa80`0945b610 00000000`00000003 : nt!KeBugCheckEx
fffff880`07bde320 fffff800`0314b207 : fffffa80`0945b610 00000000`00000008 fffffa80`00000000 fffffa80`00000004 : nt! ?? ::NNGAKEGL::`string'+0x181e6
fffff880`07bde360 fffff800`02e940b4 : 00000000`00000000 fffffa80`0945b610 fffffa80`0945b5e0 fffff800`0318873b : nt!PspProcessDelete+0x177
fffff880`07bde3c0 fffff800`03171a8f : fffffa80`0945b610 00000000`00000001 fffffa80`08953980 fffff800`031882bd : nt!ObfDereferenceObject+0xd4
fffff880`07bde420 fffff800`02e940b4 : 00000000`00000000 fffffa80`0891e060 fffffa80`04e89c40 fffffa80`05b1e5f0 : nt!PspThreadDelete+0xe3
fffff880`07bde460 fffff800`031a2194 : fffffa80`0891e060 00000000`00000000 fffffa80`08953980 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`07bde4c0 fffff800`031a2094 : 00000000`000005c4 fffffa80`0891e060 fffff8a0`0154f700 00000000`000005c4 : nt!ObpCloseHandleTableEntry+0xc4
fffff880`07bde550 fffff800`02e8e153 : fffffa80`08953980 fffff880`07bde620 00000000`00000003 ffffffff`9f0112d6 : nt!ObpCloseHandle+0x94
fffff880`07bde5a0 00000000`7768ffaa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0276e4b8 fffff800`02e86840 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7768ffaa
fffff880`07bde980 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiCallUserMode
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::NNGAKEGL::`string'+181e6
fffff800`031c69f5 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+181e6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
FAILURE_BUCKET_ID: X64_0x76_ts3client_win6_nt!_??_::NNGAKEGL::_string_+181e6
BUCKET_ID: X64_0x76_ts3client_win6_nt!_??_::NNGAKEGL::_string_+181e6