Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032911-18813-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`02c1f000 PsLoadedModuleList = 0xfffff800`02e64e90
Debug session time: Tue Mar 29 00:41:43.628 2011 (UTC - 4:00)
System Uptime: 0 days 0:08:18.783
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff88004ae9550, 0, 6f1f988}
Probably caused by : dxgkrnl.sys ( dxgkrnl!DXGCONTEXT::Present+cc )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88004ae9550, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000006f1f988, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
dxgkrnl!DXGCONTEXT::Present+cc
fffff880`04ae9550 0fba66580e bt dword ptr [rsi+58h],0Eh
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000006f1f988
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ed00e8
0000000006f1f988
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: dwm.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88006f1f3e0 -- (.trap 0xfffff88006f1f3e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffffa8008a81410
rdx=0000000006f1f930 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88004ae9550 rsp=fffff88006f1f578 rbp=fffff8a0073c8ec0
r8=fffff88006f1f8c0 r9=fffff88006f1f8f0 r10=fffff88002f65660
r11=fffff8a007adea40 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
dxgkrnl!DXGCONTEXT::Present+0xcc:
fffff880`04ae9550 0fba66580e bt dword ptr [rsi+58h],0Eh ds:00000000`00000058=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ceb028 to fffff80002c9f640
STACK_TEXT:
fffff880`06f1eb58 fffff800`02ceb028 : 00000000`0000001e ffffffff`c0000005 fffff880`04ae9550 00000000`00000000 : nt!KeBugCheckEx
fffff880`06f1eb60 fffff800`02c9ecc2 : fffff880`06f1f338 fffff8a0`073c8ec0 fffff880`06f1f3e0 00000000`06f1f930 : nt! ?? ::FNODOBFM::`string'+0x4987d
fffff880`06f1f200 fffff800`02c9d83a : 00000000`00000000 00000000`06f1f988 fffffa80`09655c00 fffff8a0`073c8ec0 : nt!KiExceptionDispatch+0xc2
fffff880`06f1f3e0 fffff880`04ae9550 : 00000000`00000000 00000000`00000000 00000000`06f1f930 00000000`00000001 : nt!KiPageFault+0x23a
fffff880`06f1f578 fffff880`06f1f8c0 : fffff880`06f1f8f0 00000000`00000004 fffffa80`0977cd60 fffffa80`0967a001 : dxgkrnl!DXGCONTEXT::Present+0xcc
fffff880`06f1f898 fffff880`06f1f8f0 : 00000000`00000004 fffffa80`0977cd60 fffffa80`0967a001 fffff8a0`072bef00 : 0xfffff880`06f1f8c0
fffff880`06f1f8a0 00000000`00000004 : fffffa80`0977cd60 fffffa80`0967a001 fffff8a0`072bef00 00000000`00000000 : 0xfffff880`06f1f8f0
fffff880`06f1f8a8 fffffa80`0977cd60 : fffffa80`0967a001 fffff8a0`072bef00 00000000`00000000 00000000`00000001 : 0x4
fffff880`06f1f8b0 fffffa80`0967a001 : fffff8a0`072bef00 00000000`00000000 00000000`00000001 fffffa80`08a8f000 : 0xfffffa80`0977cd60
fffff880`06f1f8b8 fffff8a0`072bef00 : 00000000`00000000 00000000`00000001 fffffa80`08a8f000 00000000`00000001 : 0xfffffa80`0967a001
fffff880`06f1f8c0 00000000`00000000 : 00000000`00000001 fffffa80`08a8f000 00000000`00000001 fffff8a0`073d9000 : 0xfffff8a0`072bef00
STACK_COMMAND: kb
FOLLOWUP_IP:
dxgkrnl!DXGCONTEXT::Present+cc
fffff880`04ae9550 0fba66580e bt dword ptr [rsi+58h],0Eh
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: dxgkrnl!DXGCONTEXT::Present+cc
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: dxgkrnl
IMAGE_NAME: dxgkrnl.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce799fa
FAILURE_BUCKET_ID: X64_0x1E_c0000005_dxgkrnl!DXGCONTEXT::Present+cc
BUCKET_ID: X64_0x1E_c0000005_dxgkrnl!DXGCONTEXT::Present+cc
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88004ae9550, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000006f1f988, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
dxgkrnl!DXGCONTEXT::Present+cc
fffff880`04ae9550 0fba66580e bt dword ptr [rsi+58h],0Eh
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000006f1f988
READ_ADDRESS: 0000000006f1f988
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: dwm.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88006f1f3e0 -- (.trap 0xfffff88006f1f3e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffffa8008a81410
rdx=0000000006f1f930 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88004ae9550 rsp=fffff88006f1f578 rbp=fffff8a0073c8ec0
r8=fffff88006f1f8c0 r9=fffff88006f1f8f0 r10=fffff88002f65660
r11=fffff8a007adea40 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
dxgkrnl!DXGCONTEXT::Present+0xcc:
fffff880`04ae9550 0fba66580e bt dword ptr [rsi+58h],0Eh ds:00000000`00000058=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ceb028 to fffff80002c9f640
STACK_TEXT:
fffff880`06f1eb58 fffff800`02ceb028 : 00000000`0000001e ffffffff`c0000005 fffff880`04ae9550 00000000`00000000 : nt!KeBugCheckEx
fffff880`06f1eb60 fffff800`02c9ecc2 : fffff880`06f1f338 fffff8a0`073c8ec0 fffff880`06f1f3e0 00000000`06f1f930 : nt! ?? ::FNODOBFM::`string'+0x4987d
fffff880`06f1f200 fffff800`02c9d83a : 00000000`00000000 00000000`06f1f988 fffffa80`09655c00 fffff8a0`073c8ec0 : nt!KiExceptionDispatch+0xc2
fffff880`06f1f3e0 fffff880`04ae9550 : 00000000`00000000 00000000`00000000 00000000`06f1f930 00000000`00000001 : nt!KiPageFault+0x23a
fffff880`06f1f578 fffff880`06f1f8c0 : fffff880`06f1f8f0 00000000`00000004 fffffa80`0977cd60 fffffa80`0967a001 : dxgkrnl!DXGCONTEXT::Present+0xcc
fffff880`06f1f898 fffff880`06f1f8f0 : 00000000`00000004 fffffa80`0977cd60 fffffa80`0967a001 fffff8a0`072bef00 : 0xfffff880`06f1f8c0
fffff880`06f1f8a0 00000000`00000004 : fffffa80`0977cd60 fffffa80`0967a001 fffff8a0`072bef00 00000000`00000000 : 0xfffff880`06f1f8f0
fffff880`06f1f8a8 fffffa80`0977cd60 : fffffa80`0967a001 fffff8a0`072bef00 00000000`00000000 00000000`00000001 : 0x4
fffff880`06f1f8b0 fffffa80`0967a001 : fffff8a0`072bef00 00000000`00000000 00000000`00000001 fffffa80`08a8f000 : 0xfffffa80`0977cd60
fffff880`06f1f8b8 fffff8a0`072bef00 : 00000000`00000000 00000000`00000001 fffffa80`08a8f000 00000000`00000001 : 0xfffffa80`0967a001
fffff880`06f1f8c0 00000000`00000000 : 00000000`00000001 fffffa80`08a8f000 00000000`00000001 fffff8a0`073d9000 : 0xfffff8a0`072bef00
STACK_COMMAND: kb
FOLLOWUP_IP:
dxgkrnl!DXGCONTEXT::Present+cc
fffff880`04ae9550 0fba66580e bt dword ptr [rsi+58h],0Eh
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: dxgkrnl!DXGCONTEXT::Present+cc
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: dxgkrnl
IMAGE_NAME: dxgkrnl.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce799fa
FAILURE_BUCKET_ID: X64_0x1E_c0000005_dxgkrnl!DXGCONTEXT::Present+cc
BUCKET_ID: X64_0x1E_c0000005_dxgkrnl!DXGCONTEXT::Present+cc
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032011-18330-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`02c49000 PsLoadedModuleList = 0xfffff800`02e8ee90
Debug session time: Sun Mar 20 17:54:54.580 2011 (UTC - 4:00)
System Uptime: 0 days 1:23:31.985
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff8800459748e, fffff8800339d100, 0}
Unable to load image \SystemRoot\system32\drivers\RTKVHD64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for RTKVHD64.sys
*** ERROR: Module load completed but symbols could not be loaded for RTKVHD64.sys
Probably caused by : portcls.sys ( portcls!CPortFilterTopology::NonDelegatingQueryInterface+3a )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8800459748e, Address of the instruction which caused the bugcheck
Arg3: fffff8800339d100, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
portcls!CPortFilterTopology::NonDelegatingQueryInterface+3a
fffff880`0459748e eb04 jmp portcls!CPortFilterTopology::NonDelegatingQueryInterface+0x40 (fffff880`04597494)
CONTEXT: fffff8800339d100 -- (.cxr 0xfffff8800339d100)
rax=fffffa8006c11e30 rbx=fffffa8006c11e30 rcx=fffffa8006c11e38
rdx=fffff8800458e498 rsi=fffffa80095741d0 rdi=0000000000000000
rip=fffff8800459748e rsp=fffff8800339dae0 rbp=fffffa80095741c8
r8=fffff8800339db78 r9=11d05791b4c90a60 r10=fffff880009e9ca0
r11=fffff8800339dad0 r12=fffffa80086b2620 r13=0000000000000001
r14=0000000000000000 r15=fffffa800809d900
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
portcls!CPortFilterTopology::NonDelegatingQueryInterface+0x3a:
fffff880`0459748e eb04 jmp portcls!CPortFilterTopology::NonDelegatingQueryInterface+0x40 (fffff880`04597494)
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: audiodg.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff8800459730a to fffff8800459748e
STACK_TEXT:
fffff880`0339dae0 fffff880`0459730a : 00000000`0000041f 00000000`00000000 fffffa80`0809d900 00000000`000007ff : portcls!CPortFilterTopology::NonDelegatingQueryInterface+0x3a
fffff880`0339db10 fffff880`045970ee : 00000000`00000000 fffffa80`0809da50 fffffa80`095741c0 fffffa80`06f26900 : portcls!CPortTopology::NewIrpTarget+0xbe
fffff880`0339db40 fffff880`0449aeea : fffffa80`06f26900 fffffa80`08084630 00000000`00000000 fffffa80`00000000 : portcls!xDispatchCreate+0xfa
fffff880`0339dbc0 fffff880`044957a6 : fffffa80`06f26900 fffffa80`0808eb00 fffffa80`0809d900 00000000`00000000 : ks!DispatchCreate+0x11e
fffff880`0339dc10 fffff880`04596897 : fffffa80`06f26900 fffffa80`0809d900 00000000`00000000 fffff800`02f66e1e : ks!KsDispatchIrp+0xc6
fffff880`0339dc40 fffff880`04596064 : 00000000`c000000d fffffa80`06f26b80 fffffa80`0808ebd0 00000000`00000801 : portcls!DispatchCreate+0x67
fffff880`0339dc70 fffff880`065033fd : fffffa80`080a25a0 00000000`00000000 fffffa80`071e82f0 fffffa80`06f26900 : portcls!PcDispatchIrp+0x54
fffff880`0339dca0 fffffa80`080a25a0 : 00000000`00000000 fffffa80`071e82f0 fffffa80`06f26900 fffffa80`06f26900 : RTKVHD64+0xd23fd
fffff880`0339dca8 00000000`00000000 : fffffa80`071e82f0 fffffa80`06f26900 fffffa80`06f26900 fffff880`045d8825 : 0xfffffa80`080a25a0
FOLLOWUP_IP:
portcls!CPortFilterTopology::NonDelegatingQueryInterface+3a
fffff880`0459748e eb04 jmp portcls!CPortFilterTopology::NonDelegatingQueryInterface+0x40 (fffff880`04597494)
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: portcls!CPortFilterTopology::NonDelegatingQueryInterface+3a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: portcls
IMAGE_NAME: portcls.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bcc03
STACK_COMMAND: .cxr 0xfffff8800339d100 ; kb
FAILURE_BUCKET_ID: X64_0x3B_portcls!CPortFilterTopology::NonDelegatingQueryInterface+3a
BUCKET_ID: X64_0x3B_portcls!CPortFilterTopology::NonDelegatingQueryInterface+3a
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\030711-26504-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a51000 PsLoadedModuleList = 0xfffff800`02c8ee50
Debug session time: Sun Mar 6 19:34:36.100 2011 (UTC - 4:00)
System Uptime: 0 days 1:46:57.723
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800926dcf8, fffff8800926d560, fffff880012fcd49}
Probably caused by : Ntfs.sys ( Ntfs!NtfsFindStartingNode+4b9 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800926dcf8
Arg3: fffff8800926d560
Arg4: fffff880012fcd49
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800926dcf8 -- (.exr 0xfffff8800926dcf8)
ExceptionAddress: fffff880012fcd49 (Ntfs!NtfsFindStartingNode+0x00000000000004b9)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8800926d560 -- (.cxr 0xfffff8800926d560)
rax=ffbff8a006c8b510 rbx=fffffa8008df8a60 rcx=fffff8a006ce1a38
rdx=fffffa8008f6d370 rsi=fffff8800926e098 rdi=fffff8a006ce16a0
rip=fffff880012fcd49 rsp=fffff8800926df30 rbp=fffffa8008df8a60
r8=0000000000000000 r9=0000000000000000 r10=fffffa8008df8a60
r11=0000000000000000 r12=fffff8800926e3c0 r13=0000000000000000
r14=fffff8800926e3b0 r15=fffff8800926e438
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
Ntfs!NtfsFindStartingNode+0x4b9:
fffff880`012fcd49 f6404103 test byte ptr [rax+41h],3 ds:002b:ffbff8a0`06c8b551=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: CCC.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cf90e0
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsFindStartingNode+4b9
fffff880`012fcd49 f6404103 test byte ptr [rax+41h],3
FAULTING_IP:
Ntfs!NtfsFindStartingNode+4b9
fffff880`012fcd49 f6404103 test byte ptr [rax+41h],3
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff880012f728d to fffff880012fcd49
STACK_TEXT:
fffff880`0926df30 fffff880`012f728d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsFindStartingNode+0x4b9
fffff880`0926e000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreate+0x3dd
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsFindStartingNode+4b9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff8800926d560 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsFindStartingNode+4b9
BUCKET_ID: X64_0x24_Ntfs!NtfsFindStartingNode+4b9
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032611-18174-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`02c5d000 PsLoadedModuleList = 0xfffff800`02ea2e90
Debug session time: Sat Mar 26 17:07:47.663 2011 (UTC - 4:00)
System Uptime: 0 days 0:10:51.068
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff88002922228, fffff88002921a80, fffff880012ce665}
Probably caused by : Ntfs.sys ( Ntfs!NtfsFlushVolume+449 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88002922228
Arg3: fffff88002921a80
Arg4: fffff880012ce665
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88002922228 -- (.exr 0xfffff88002922228)
ExceptionAddress: fffff880012ce665 (Ntfs!NtfsFlushVolume+0x0000000000000449)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88002921a80 -- (.cxr 0xfffff88002921a80)
rax=ffbff8a003940010 rbx=0000000000000000 rcx=fffff8a00391e6e0
rdx=fffff8a00750c300 rsi=0000000000000001 rdi=fffffa80090c44e0
rip=fffff880012ce665 rsp=fffff88002922460 rbp=fffff88002922720
r8=fffff8a00391e6e0 r9=fffff8a00391e700 r10=fffff880029224f0
r11=fffff88002922410 r12=fffff8a007b015c0 r13=fffff8a007b01770
r14=0000000000000702 r15=fffffa8007ee9180
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
Ntfs!NtfsFlushVolume+0x449:
fffff880`012ce665 f0017014 lock add dword ptr [rax+14h],esi ds:002b:ffbff8a0`03940024=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f0e0e8
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsFlushVolume+449
fffff880`012ce665 f0017014 lock add dword ptr [rax+14h],esi
FAULTING_IP:
Ntfs!NtfsFlushVolume+449
fffff880`012ce665 f0017014 lock add dword ptr [rax+14h],esi
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff880012d6fad to fffff880012ce665
STACK_TEXT:
fffff880`02922460 fffff880`012d6fad : fffffa80`090c44e0 fffffa80`07ee9180 00000000`00100001 00000000`00000000 : Ntfs!NtfsFlushVolume+0x449
fffff880`02922590 fffff880`012d76b4 : fffffa80`090c44e0 fffffa80`0910a410 fffffa80`09738ad0 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x459
fffff880`02922670 fffff880`0106abcf : fffffa80`0910a7b0 fffffa80`0910a410 fffffa80`090c44e0 fffff880`02922698 : Ntfs!NtfsFsdFlushBuffers+0x104
fffff880`029226e0 fffff880`010696df : fffffa80`076f7a30 00000000`00000000 fffffa80`076f7a00 fffffa80`0910a410 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`02922770 fffff800`02fe571b : 00000000`00000002 fffffa80`09738ad0 00000000`00000000 fffffa80`0910a410 : fltmgr!FltpDispatch+0xcf
fffff880`029227d0 fffff800`02f7c871 : fffffa80`0910a410 fffffa80`06802060 fffffa80`09738ad0 00000000`000007ff : nt!IopSynchronousServiceTail+0xfb
fffff880`02922840 fffff800`02cdc8d3 : fffffa80`06802060 fffffa80`06701040 fffffa80`076f7a30 fffffa80`09738ad0 : nt!NtFlushBuffersFile+0x171
fffff880`029228d0 fffff800`02cd8e70 : fffff800`02f1c96d 00000000`00000004 fffffa80`075ed190 fffffa80`098065f0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`02922a68 fffff800`02f1c96d : 00000000`00000004 fffffa80`075ed190 fffffa80`098065f0 fffff800`02fb2f48 : nt!KiServiceLinkage
fffff880`02922a70 fffff800`02f7acce : fffff880`03348a38 fffffa80`06802060 00000000`00000080 00000000`00000001 : nt!PopFlushVolumeWorker+0x1bd
fffff880`02922d40 fffff800`02ccefe6 : fffff800`02e4fe80 fffffa80`06802060 fffff800`02e5dcc0 fffff880`01266384 : nt!PspSystemThreadStartup+0x5a
fffff880`02922d80 00000000`00000000 : fffff880`02923000 fffff880`0291d000 fffff880`029215d0 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsFlushVolume+449
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce792f9
STACK_COMMAND: .cxr 0xfffff88002921a80 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsFlushVolume+449
BUCKET_ID: X64_0x24_Ntfs!NtfsFlushVolume+449
Followup: MachineOwner
---------