Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032511-15522-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`0285a000 PsLoadedModuleList = 0xfffff800`02a97e50
Debug session time: Fri Mar 25 11:42:08.674 2011 (UTC - 4:00)
System Uptime: 0 days 0:00:18.938
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 34, {50830, fffff88005456408, fffff88005455c60, fffff800028d7170}
Probably caused by : ntkrnlmp.exe ( nt!ObFastReferenceObject+10 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CACHE_MANAGER (34)
See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000050830
Arg2: fffff88005456408
Arg3: fffff88005455c60
Arg4: fffff800028d7170
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88005456408 -- (.exr 0xfffff88005456408)
ExceptionAddress: fffff800028d7170 (nt!ObFastReferenceObject+0x0000000000000010)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000040
Attempt to read from address 0000000000000040
CONTEXT: fffff88005455c60 -- (.cxr 0xfffff88005455c60)
rax=0000000000000010 rbx=0000000000000010 rcx=0000000000000040
rdx=0000000000000022 rsi=fffff8a001d12810 rdi=0000000000000040
rip=fffff800028d7170 rsp=fffff88005456640 rbp=fffff880054568d0
r8=fffffa8004c488cf r9=fffffa800612fb60 r10=000000000000000f
r11=34b000011c6f5921 r12=fffffa8006192350 r13=fffffa800619f7c0
r14=0000000fffffffff r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!ObFastReferenceObject+0x10:
fffff800`028d7170 4c8b01 mov r8,qword ptr [rcx] ds:002b:00000000`00000040=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000040
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002b020e0
0000000000000040
FOLLOWUP_IP:
nt!ObFastReferenceObject+10
fffff800`028d7170 4c8b01 mov r8,qword ptr [rcx]
FAULTING_IP:
nt!ObFastReferenceObject+10
fffff800`028d7170 4c8b01 mov r8,qword ptr [rcx]
BUGCHECK_STR: 0x34
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from fffff8000293bd49 to fffff800028d7170
STACK_TEXT:
fffff880`05456640 fffff800`0293bd49 : 00000000`00000008 00000000`00000010 fffff8a0`01d12808 fffffa80`0620a6f8 : nt!ObFastReferenceObject+0x10
fffff880`05456670 fffff800`028e8e6f : fffff6fc`c0035680 00000000`00000001 fffff880`00000010 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x2a34d
fffff880`054567e0 fffff800`0291080e : fffff980`06ac0000 00000000`000c9000 00000000`00000000 00000000`00000005 : nt!MmCheckCachedPageStates+0x3ef
fffff880`05456990 fffff800`02b300ce : 00000000`00100000 00000000`00100000 00000000`000c9000 00000000`00040001 : nt!CcFetchDataForRead+0x10e
fffff880`054569f0 fffff800`0287cb2c : fffffa80`03c9db30 00000000`00100000 00000000`00040000 fffff800`02a6f501 : nt!CcMapAndCopyFromCache+0xba
fffff880`05456a90 fffff800`028bfdb6 : fffffa80`06192350 00000000`00000000 fffff800`00000005 fffff800`02bb2201 : nt!CcPerformReadAhead+0x3b8
fffff880`05456bc0 fffff800`028d9161 : fffffa80`03cd5d60 fffff800`028bfb98 fffff800`02ad1150 00000000`00000002 : nt!CcWorkerThread+0x21e
fffff880`05456c70 fffff800`02b6f166 : 00000000`0387ee39 fffffa80`0612fb60 00000000`00000080 fffffa80`03cb8040 : nt!ExpWorkerThread+0x111
fffff880`05456d00 fffff800`028aa486 : fffff880`009e9180 fffffa80`0612fb60 fffffa80`04ba7b60 fffff880`0124fa90 : nt!PspSystemThreadStartup+0x5a
fffff880`05456d40 00000000`00000000 : fffff880`05457000 fffff880`05451000 fffff880`054566a0 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ObFastReferenceObject+10
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
STACK_COMMAND: .cxr 0xfffff88005455c60 ; kb
FAILURE_BUCKET_ID: X64_0x34_nt!ObFastReferenceObject+10
BUCKET_ID: X64_0x34_nt!ObFastReferenceObject+10
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032411-17206-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02815000 PsLoadedModuleList = 0xfffff800`02a52e50
Debug session time: Thu Mar 24 11:41:51.598 2011 (UTC - 4:00)
System Uptime: 0 days 0:04:31.520
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41790, fffffa80014449e0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+339d6 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa80014449e0
Arg3: 000000000000ffff
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41790
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: dllhost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800028f926e to fffff80002886f00
STACK_TEXT:
fffff880`0678f928 fffff800`028f926e : 00000000`0000001a 00000000`00041790 fffffa80`014449e0 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0678f930 fffff800`028c8c4a : 00000000`00000000 00000000`0381afff fffffa80`00000000 fffffa80`04d08b30 : nt! ?? ::FNODOBFM::`string'+0x339d6
fffff880`0678faf0 fffff800`02886153 : ffffffff`ffffffff 00000000`0263d330 00000000`0263d2f8 ffffffff`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`0678fbe0 00000000`7753009a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0263d268 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7753009a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+339d6
fffff800`028f926e cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+339d6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+339d6
BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+339d6
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032411-19063-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02858000 PsLoadedModuleList = 0xfffff800`02a95e50
Debug session time: Thu Mar 24 11:36:49.014 2011 (UTC - 4:00)
System Uptime: 0 days 0:04:15.310
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff800029fbf8c, fffff88005f2dea0, 0}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+100 )
Followup: Pool_corruption
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800029fbf8c, Address of the instruction which caused the bugcheck
Arg3: fffff88005f2dea0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExDeferredFreePool+100
fffff800`029fbf8c 4c8b02 mov r8,qword ptr [rdx]
CONTEXT: fffff88005f2dea0 -- (.cxr 0xfffff88005f2dea0)
rax=fffff8a005b73000 rbx=0000000000000000 rcx=fffff8a005f72b40
rdx=0000018002580320 rsi=fffff8a005b73000 rdi=fffff8a005f66010
rip=fffff800029fbf8c rsp=fffff88005f2e880 rbp=000000000000000e
r8=0000018002580320 r9=0000000000000000 r10=fffff8a005f76b40
r11=0000000000000000 r12=fffffa8003c493c0 r13=0000000000000000
r14=000000000000000f r15=0000000000000001
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!ExDeferredFreePool+0x100:
fffff800`029fbf8c 4c8b02 mov r8,qword ptr [rdx] ds:002b:00000180`02580320=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800029fbf8c
STACK_TEXT:
fffff880`05f2e880 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x100
FOLLOWUP_IP:
nt!ExDeferredFreePool+100
fffff800`029fbf8c 4c8b02 mov r8,qword ptr [rdx]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExDeferredFreePool+100
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .cxr 0xfffff88005f2dea0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!ExDeferredFreePool+100
BUCKET_ID: X64_0x3B_nt!ExDeferredFreePool+100
Followup: Pool_corruption
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032511-16614-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`0285b000 PsLoadedModuleList = 0xfffff800`02a98e50
Debug session time: Fri Mar 25 11:48:01.911 2011 (UTC - 4:00)
System Uptime: 0 days 0:04:55.176
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 120993, 3, 11fa0a}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000120993, page frame number
Arg3: 0000000000000003, current page state
Arg4: 000000000011fa0a, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: WmiPrvSE.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff8000295b32c to fffff800028ccf00
STACK_TEXT:
fffff880`03a2c0b8 fffff800`0295b32c : 00000000`0000004e 00000000`00000099 00000000`00120993 00000000`00000003 : nt!KeBugCheckEx
fffff880`03a2c0c0 fffff800`02882545 : 00000000`00000000 fffff680`00001758 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`03a2c100 fffff800`028a1493 : fffffa80`0519ab30 fffff700`00000669 0000007f`fffffff8 fffff8a0`05f9b468 : nt! ?? ::FNODOBFM::`string'+0x322ac
fffff880`03a2c190 fffff800`0289feee : fffffa80`0519ab30 fffffa80`00000007 00000000`000001bc fffff800`00000000 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`03a2ca40 fffff800`02baf7af : fffff8a0`025f7af0 00000000`00000001 00000000`00000000 fffffa80`06404450 : nt!MmCleanProcessAddressSpace+0x96
fffff880`03a2ca90 fffff800`02b88cb8 : 00000000`00000000 00000000`00000001 000007ff`fffde000 00000000`00000000 : nt!PspExitThread+0x47f
fffff880`03a2cb60 fffff800`028cc153 : fffffa80`0519ab30 fffff880`00000000 fffffa80`06404450 fffffa80`04f9ec70 : nt!NtTerminateProcess+0x138
fffff880`03a2cbe0 00000000`7789017a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001cfd18 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7789017a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`0295b32c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------