*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C4, {f6, 110, fffffa8006dde060, fffff8800b4fa522}
Unable to load image RTCore64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for RTCore64.sys
*** ERROR: Module load completed but symbols could not be loaded for RTCore64.sys
Probably caused by : RTCore64.sys ( RTCore64+1522 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 0000000000000110, Handle value being referenced.
Arg3: fffffa8006dde060, Address of the current process.
Arg4: fffff8800b4fa522, Address inside the driver that is performing the incorrect reference.
Debugging Details:
------------------
BUGCHECK_STR: 0xc4_f6
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: MSIAfterburner
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80001f643dc to fffff80001adac40
STACK_TEXT:
fffff880`0bd945a8 fffff800`01f643dc : 00000000`000000c4 00000000`000000f6 00000000`00000110 fffffa80`06dde060 : nt!KeBugCheckEx
fffff880`0bd945b0 fffff800`01f79ae4 : 00000000`00000110 fffffa80`06dde060 00000000`00000002 00000000`00000001 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`0bd945f0 fffff800`01d32210 : 00000000`00000000 fffff880`0bd94820 00000000`00000000 00000000`00000000 : nt!VfCheckUserHandle+0x1b4
fffff880`0bd946d0 fffff800`01db5375 : 00000000`00000000 00000000`000f001f 00000000`00000000 fffff800`01db5300 : nt! ?? ::NNGAKEGL::`string'+0x212ce
fffff880`0bd947a0 fffff800`01f79878 : 00000000`00000004 00000000`00000002 fffff880`0bd94890 fffff800`01ad6470 : nt!ObReferenceObjectByHandle+0x25
fffff880`0bd947f0 fffff880`0b4fa522 : 00000000`efdc0000 00000000`00000002 00000000`00000004 fffff800`00000000 : nt!VerifierObReferenceObjectByHandle+0x48
fffff880`0bd94840 00000000`efdc0000 : 00000000`00000002 00000000`00000004 fffff800`00000000 fffff880`0bd948c8 : RTCore64+0x1522
fffff880`0bd94848 00000000`00000002 : 00000000`00000004 fffff800`00000000 fffff880`0bd948c8 00000000`00000000 : 0xefdc0000
fffff880`0bd94850 00000000`00000004 : fffff800`00000000 fffff880`0bd948c8 00000000`00000000 fffff800`01df5a97 : 0x2
fffff880`0bd94858 fffff800`00000000 : fffff880`0bd948c8 00000000`00000000 fffff800`01df5a97 fffff800`01df5a97 : 0x4
fffff880`0bd94860 fffff880`0bd948c8 : 00000000`00000000 fffff800`01df5a97 fffff800`01df5a97 fffffa80`06b45650 : 0xfffff800`00000000
fffff880`0bd94868 00000000`00000000 : fffff800`01df5a97 fffff800`01df5a97 fffffa80`06b45650 fffff800`01df5a97 : 0xfffff880`0bd948c8
STACK_COMMAND: kb
FOLLOWUP_IP:
RTCore64+1522
fffff880`0b4fa522 85c0 test eax,eax
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: RTCore64+1522
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: RTCore64
IMAGE_NAME: RTCore64.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 42941d90
FAILURE_BUCKET_ID: X64_0xc4_f6_RTCore64+1522
BUCKET_ID: X64_0xc4_f6_RTCore64+1522
Followup: MachineOwner