Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\030711-33852-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02e63000 PsLoadedModuleList = 0xfffff800`030a0e50
Debug session time: Mon Mar 7 13:04:50.502 2011 (UTC - 5:00)
System Uptime: 0 days 2:25:21.422
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {7, 1097, 0, fffff8a0055639b0}
GetPointerFromAddress: unable to read from fffff8000310b0e0
Probably caused by : fileinfo.sys ( fileinfo!FIStreamLogForNL+203 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 0000000000001097, (reserved)
Arg3: 0000000000000000, Memory contents of the pool block
Arg4: fffff8a0055639b0, Address of the block of pool being deallocated
Debugging Details:
------------------
POOL_ADDRESS: fffff8a0055639b0
FREED_POOL_TAG: MPsc
BUGCHECK_STR: 0xc2_7_MPsc
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff8000300660e to fffff80002ed3740
STACK_TEXT:
fffff880`0ba917a8 fffff800`0300660e : 00000000`000000c2 00000000`00000007 00000000`00001097 00000000`00000000 : nt!KeBugCheckEx
fffff880`0ba917b0 fffff880`012998e3 : fffff8a0`05563a00 fffff8a0`05430990 00000000`00000000 fffff880`012995a4 : nt!ExDeferredFreePool+0x11eb
fffff880`0ba91860 fffff880`01299b4f : 00000000`00000000 fffff880`0ba919e8 fffff880`0ba919e0 fffff880`0ba919d8 : fileinfo!FIStreamLogForNL+0x203
fffff880`0ba91940 fffff880`01296716 : fffffa80`04cbf010 00000000`0006d528 fffffa80`00000000 00000000`00000000 : fileinfo!FIIterate+0x24b
fffff880`0ba919d0 fffff800`031ec547 : fffffa80`07b8b730 fffffa80`07b8b730 fffffa80`04cbf128 fffffa80`04cbf010 : fileinfo!FIControlDispatch+0x156
fffff880`0ba91a10 fffff800`031ecda6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`0ba91b40 fffff800`02ed2993 : 00000000`00000926 00000000`000003e8 00000000`00000000 0000007f`ffffffff : nt!NtDeviceIoControlFile+0x56
fffff880`0ba91bb0 00000000`779ef72a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01b3ea28 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x779ef72a
STACK_COMMAND: kb
FOLLOWUP_IP:
fileinfo!FIStreamLogForNL+203
fffff880`012998e3 41017500 add dword ptr [r13],esi
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: fileinfo!FIStreamLogForNL+203
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fileinfo
IMAGE_NAME: fileinfo.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc481
FAILURE_BUCKET_ID: X64_0xc2_7_MPsc_fileinfo!FIStreamLogForNL+203
BUCKET_ID: X64_0xc2_7_MPsc_fileinfo!FIStreamLogForNL+203
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\030711-41948-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02e5a000 PsLoadedModuleList = 0xfffff800`03097e50
Debug session time: Mon Mar 7 14:29:31.465 2011 (UTC - 5:00)
System Uptime: 0 days 1:15:52.135
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800adbc2f8, fffff8800adbbb60, fffff80002ecd905}
Probably caused by : Ntfs.sys ( Ntfs!NtfsOpenAttribute+8d4 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800adbc2f8
Arg3: fffff8800adbbb60
Arg4: fffff80002ecd905
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800adbc2f8 -- (.exr 0xfffff8800adbc2f8)
ExceptionAddress: fffff80002ecd905 (nt!ExpInterlockedPopEntrySListFault16)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8800adbbb60 -- (.cxr 0xfffff8800adbbb60)
rax=00000006bfc00059 rbx=fffffa8003f54c00 rcx=fffff80003046600
rdx=3d80fffff8a0027f rsi=fffff80003046600 rdi=0000000000000011
rip=fffff80002ecd905 rsp=fffff8800adbc530 rbp=fffffa8003adb000
r8=3d80fffff8a0027e r9=fffff80002e5a000 r10=fffff80003046600
r11=0000000000000001 r12=0000000000000009 r13=0000000000000000
r14=0000000000000002 r15=000000006366744e
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!ExpInterlockedPopEntrySListFault16:
fffff800`02ecd905 498b08 mov rcx,qword ptr [r8] ds:002b:3d80ffff`f8a0027e=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: WerFault.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800031020e0
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsOpenAttribute+8d4
fffff880`014c2124 488bf8 mov rdi,rax
FAULTING_IP:
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`02ecd905 498b08 mov rcx,qword ptr [r8]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff80002ffe646 to fffff80002ecd905
STACK_TEXT:
fffff880`0adbc530 fffff800`02ffe646 : fffffa80`03cb2b10 00000000`00000000 ffff0001`04150001 00000000`03170ebd : nt!ExpInterlockedPopEntrySListFault16
fffff880`0adbc540 fffff880`014c2124 : 00000000`00000000 fffffa80`03f54c00 fffff8a0`00000002 fffff8a0`01c1cb58 : nt!ExAllocatePoolWithTag+0x276
fffff880`0adbc630 fffff880`014afe45 : fffffa80`03f54cf0 fffffa80`09e92eb0 fffffa80`07800180 fffff8a0`01c1cb58 : Ntfs!NtfsOpenAttribute+0x8d4
fffff880`0adbc740 fffff880`014ac78b : fffff880`0a3ebf20 fffffa80`03f54cf0 fffff8a0`01c1cb58 fffff8a0`00000024 : Ntfs!NtfsOpenExistingAttr+0x145
fffff880`0adbc800 fffff880`014aceff : fffffa80`03f54cf0 fffffa80`09e92a80 fffff8a0`01c1cb58 fffff880`00000024 : Ntfs!NtfsOpenAttributeInExistingFile+0x5ab
fffff880`0adbc990 fffff880`014bde76 : fffffa80`03f54cf0 fffffa80`09e92a80 fffff8a0`01c1cb58 00000000`00000701 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
fffff880`0adbca80 fffff880`014b828d : fffffa80`03f54cf0 fffffa80`09e92a80 fffff880`0adbcc60 fffff880`0adbcca8 : Ntfs!NtfsFindStartingNode+0x5e6
fffff880`0adbcb50 fffff880`01421c0d : fffffa80`03f54cf0 fffffa80`09e92a80 fffff880`0a3ebf20 fffffa80`09a16000 : Ntfs!NtfsCommonCreate+0x3dd
fffff880`0adbcd30 fffff800`02ec25c7 : fffff880`0a3ebe90 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0adbcd60 fffff800`02ec2581 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27
fffff880`0a3ebd60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: Ntfs!NtfsOpenAttribute+8d4
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff8800adbbb60 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsOpenAttribute+8d4
BUCKET_ID: X64_0x24_Ntfs!NtfsOpenAttribute+8d4
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\030711-32479-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02e11000 PsLoadedModuleList = 0xfffff800`0304ee50
Debug session time: Mon Mar 7 16:38:53.531 2011 (UTC - 5:00)
System Uptime: 0 days 1:48:17.201
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffff680000b4fe8, 0, 0, fffff80002e952e2}
Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+1c2 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff680000b4fe8, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002e952e2, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b90e0
fffff680000b4fe8
CURRENT_IRQL: 0
FAULTING_IP:
nt!MiAgeWorkingSet+1c2
fffff800`02e952e2 488b19 mov rbx,qword ptr [rcx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: chrome.exe
TRAP_FRAME: fffff880035167a0 -- (.trap 0xfffff880035167a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000007ffffffff8 rbx=0000000000000000 rcx=fffff680000b4fe8
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e952e2 rsp=fffff88003516930 rbp=00000000000b4fee
r8=0000000000000001 r9=fffffa8003e667d8 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!MiAgeWorkingSet+0x1c2:
fffff800`02e952e2 488b19 mov rbx,qword ptr [rcx] ds:fffff680`000b4fe8=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002e80ca9 to fffff80002e81740
STACK_TEXT:
fffff880`03516658 fffff800`02e80ca9 : 00000000`0000000a fffff680`000b4fe8 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`03516660 fffff800`02e7f920 : 00000000`00000000 00000980`00000000 00000000`00001400 00000000`0000144b : nt!KiBugCheckDispatch+0x69
fffff880`035167a0 fffff800`02e952e2 : 00000000`0000146b 00000000`00000001 00000000`00000002 00000000`00001461 : nt!KiPageFault+0x260
fffff880`03516930 fffff800`02f03a5e : fffffa80`03e667d8 fffff880`00000001 00000000`00000001 fffff880`03516bb0 : nt!MiAgeWorkingSet+0x1c2
fffff880`03516ae0 fffff800`02e95ee2 : 00000000`00001961 00000000`00000000 fffffa80`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x496d6
fffff880`03516b80 fffff800`02e96173 : 00000000`00000008 fffff880`03516c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03516bd0 fffff800`031247c6 : fffffa80`03b75ae0 00000000`00000080 fffffa80`03b4d890 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`03516d40 fffff800`02e5fc26 : fffff880`009eb180 fffffa80`03b75ae0 fffff880`009f5fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03516d80 00000000`00000000 : fffff880`03517000 fffff880`03511000 fffff880`03516820 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiAgeWorkingSet+1c2
fffff800`02e952e2 488b19 mov rbx,qword ptr [rcx]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiAgeWorkingSet+1c2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xA_nt!MiAgeWorkingSet+1c2
BUCKET_ID: X64_0xA_nt!MiAgeWorkingSet+1c2
Followup: MachineOwner
---------