*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_d
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: avp.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 828dbe98 to 8287dd1b
STACK_TEXT:
a8d27be8 828dbe98 badb0d00 862e7870 00000080 nt!KiSystemFatalException+0xf
a8d27c70 82a8333f 857f8b40 862e7870 ffffffff nt!MiRemoveVadAndView+0x14
a8d27cd0 82aa1737 86ac4d40 01b70000 00000000 nt!MiUnmapViewOfSection+0x265
a8d27cf0 8b8fedd0 ffffffff 01b70000 ffffffff nt!NtUnmapViewOfSection+0x55
WARNING: Stack unwind information not available. Following frames may be wrong.
a8d27d24 8287a1fa ffffffff 01b70000 0451ef60 klif+0x30dd0
a8d27d24 773b70b4 ffffffff 01b70000 0451ef60 nt!KiFastCallEntry+0x12a
0451ef60 00000000 00000000 00000000 00000000 0x773b70b4
STACK_COMMAND: kb
FOLLOWUP_IP:
klif+30dd0
8b8fedd0 ?? ???
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: klif+30dd0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: klif
IMAGE_NAME: klif.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ca58e03
FAILURE_BUCKET_ID: 0x7f_d_klif+30dd0
BUCKET_ID: 0x7f_d_klif+30dd0
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 0000023e, A driver has marked an IRP pending but didn't return STATUS_PENDING.
Arg2: 8b8732da, The address in the driver's code where the error was detected.
Arg3: 86ca9bb8, IRP address.
Arg4: 00000000, Status code.
Debugging Details:
------------------
Unable to load image \SystemRoot\system32\DRIVERS\dtsoftbus01.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dtsoftbus01.sys
*** ERROR: Module load completed but symbols could not be loaded for dtsoftbus01.sys
BUGCHECK_STR: 0xc9_23e
DRIVER_VERIFIER_IO_VIOLATION_TYPE: 23e
FAULTING_IP:
dtsoftbus01+12da
8b8732da 55 push ebp
FOLLOWUP_IP:
dtsoftbus01+12da
8b8732da 55 push ebp
IRP_ADDRESS: 86ca9bb8
DEVICE_OBJECT: 86c5dc68
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 82b38f03 to 828e0eb4
STACK_TEXT:
8db1babc 82b38f03 000000c9 0000023e 8b8732da nt!KeBugCheckEx+0x1e
8db1badc 82b3b2cd 8b8732da 8db1bb14 8b8732da nt!VerifierBugCheckIfAppropriate+0x30
8db1baf4 82b3b414 0000023e 8b8732da 00000000 nt!ViErrorFinishReport+0xc9
8db1bb64 82b39620 0000023e 86ca9bb8 00000000 nt!VfErrorReport6+0x51
8db1bb94 82b38e5f 88c5c90c 88c5c8a8 00000000 nt!IovpCallDriver2+0x155
8db1bba8 82b336d4 88c5c90c 00000000 873eca10 nt!VfAfterCallDriver+0x119
8db1bbcc 82839545 00000000 87403378 86c5dc68 nt!IovCallDriver+0x269
8db1bbe0 8b03149c 78c135e8 8db1bc6c 00000000 nt!IofCallDriver+0x1b
8db1bc24 8b03cffe 00403378 8db1bc6c 8db1bc50 Wdf01000!FxIoTarget::SubmitSync+0x198
8db1bc48 8b8bd7d6 00000020 87403378 873eca10 Wdf01000!imp_WdfRequestSend+0x178
8db1bc7c 8b8bd381 873e9448 82b3e4f3 873e9448 cdrom!RequestSendMcnRequest+0x4a
8db1bcb0 8b8bd85d 873e9448 777f2328 873eb378 cdrom!RequestProcessSerializedIoctl+0x37c
8db1bcc4 8b051042 78c14c80 873eb348 873eb378 cdrom!IoctlWorkItemRoutine+0x4b
8db1bce0 8b0510aa 873ea6c8 8db1bd00 82a164dc Wdf01000!FxWorkItem::WorkItemHandler+0xad
8db1bcec 82a164dc 873ea6c8 873eb378 855e9d48 Wdf01000!FxWorkItem::WorkItemThunk+0x19
8db1bd00 8287fa6b 873eb348 00000000 855e9d48 nt!IopProcessWorkItem+0x23
8db1bd50 82a0afda 00000001 a1dee682 00000000 nt!ExpWorkerThread+0x10d
8db1bd90 828b31d9 8287f95e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: .bugcheck ; kb
SYMBOL_NAME: dtsoftbus01+12da
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: dtsoftbus01
IMAGE_NAME: dtsoftbus01.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4dfb0484
FAILURE_BUCKET_ID: 0xc9_23e_VRFOCA_dtsoftbus01+12da
BUCKET_ID: 0xc9_23e_VRFOCA_dtsoftbus01+12da
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82860c6d, The address that the exception occurred at
Arg3: 80786bf8, Exception Record Address
Arg4: 807867d0, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MmZeroPageThread+462
82860c6d 8b36 mov esi,dword ptr [esi]
EXCEPTION_RECORD: 80786bf8 -- (.exr 0xffffffff80786bf8)
ExceptionAddress: 82860c6d (nt!MmZeroPageThread+0x00000462)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00002413
Attempt to read from address 00002413
CONTEXT: 807867d0 -- (.cxr 0xffffffff807867d0)
eax=047125dc ebx=00002413 ecx=0000001c edx=00000003 esi=00002413 edi=00000000
eip=82860c6d esp=80786cc0 ebp=80786d44 iopl=0 nv up ei pl nz na po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010203
nt!MmZeroPageThread+0x462:
82860c6d 8b36 mov esi,dword ptr [esi] ds:0023:00002413=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00002413
READ_ADDRESS: GetPointerFromAddress: unable to read from 8296b848
Unable to read MiSystemVaType memory at 8294ae40
00002413
FOLLOWUP_IP:
nt!MmZeroPageThread+462
82860c6d 8b36 mov esi,dword ptr [esi]
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from 8298e44f to 82860c6d
STACK_TEXT:
80786d44 8298e44f 00000000 80786d90 82a0afda nt!MmZeroPageThread+0x462
80786d50 82a0afda 8080a6d0 a424cac0 00000000 nt!Phase1Initialization+0x14
80786d90 828b31d9 8298e43b 8080a6d0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MmZeroPageThread+462
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02a389
STACK_COMMAND: .cxr 0xffffffff807867d0 ; kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x7E_nt!MmZeroPageThread+462
BUCKET_ID: 0x7E_nt!MmZeroPageThread+462
Followup: MachineOwner
---------