Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\022211-18954-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`03066000 PsLoadedModuleList = 0xfffff800`032a3e50
Debug session time: Tue Feb 22 15:59:04.325 2011 (UTC - 5:00)
System Uptime: 0 days 3:28:55.057
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff9600009b068, fffff8801667b320, 0}
Probably caused by : win32k.sys ( win32k!ESTROBJ::vInit+d8 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff9600009b068, Address of the instruction which caused the bugcheck
Arg3: fffff8801667b320, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
win32k!ESTROBJ::vInit+d8
fffff960`0009b068 0fbaa33807000012 bt dword ptr [rbx+738h],12h
CONTEXT: fffff8801667b320 -- (.cxr 0xfffff8801667b320)
rax=fffff900c1eae020 rbx=fff7f900c00bf010 rcx=fffff900c00bfe10
rdx=fffff900c0081054 rsi=fffff8801667c000 rdi=0000000041800000
rip=fffff9600009b068 rsp=fffff8801667bcf0 rbp=0000000000000000
r8=0000000000000001 r9=000000000000001e r10=fffff900c0081054
r11=fffff8801667c2b0 r12=0000000000000000 r13=fffff8801667be20
r14=fffff8801667c2b0 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
win32k!ESTROBJ::vInit+0xd8:
fffff960`0009b068 0fbaa33807000012 bt dword ptr [rbx+738h],12h ds:002b:fff7f900`c00bf748=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff960000728de to fffff9600009b068
STACK_TEXT:
fffff880`1667bcf0 fffff960`000728de : fffff900`41800000 00000000`00000000 fffff900`00000001 fffff880`1667c2b0 : win32k!ESTROBJ::vInit+0xd8
fffff880`1667bd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!GreExtTextOutWLocked+0xb12
FOLLOWUP_IP:
win32k!ESTROBJ::vInit+d8
fffff960`0009b068 0fbaa33807000012 bt dword ptr [rbx+738h],12h
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: win32k!ESTROBJ::vInit+d8
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d23ecb0
STACK_COMMAND: .cxr 0xfffff8801667b320 ; kb
FAILURE_BUCKET_ID: X64_0x3B_win32k!ESTROBJ::vInit+d8
BUCKET_ID: X64_0x3B_win32k!ESTROBJ::vInit+d8
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\021911-23290-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`03015000 PsLoadedModuleList = 0xfffff800`03252e50
Debug session time: Sat Feb 19 12:17:50.208 2011 (UTC - 5:00)
System Uptime: 0 days 0:11:12.940
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff800031b8f8c, fffff88003833790, 0}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+100 )
Followup: Pool_corruption
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800031b8f8c, Address of the instruction which caused the bugcheck
Arg3: fffff88003833790, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExDeferredFreePool+100
fffff800`031b8f8c 4c8b02 mov r8,qword ptr [rdx]
CONTEXT: fffff88003833790 -- (.cxr 0xfffff88003833790)
rax=fffffa8003963610 rbx=0000000000000003 rcx=fffffa8003963610
rdx=fff7f8a008e9dd00 rsi=0000000000000000 rdi=fffff8a008f23920
rip=fffff800031b8f8c rsp=fffff88003834160 rbp=0000000000000000
r8=fff7f8a008e9dd00 r9=0000000000000000 r10=fffff8a008e9dbe0
r11=0000000000000001 r12=fffffa80039633c0 r13=0000000000000000
r14=0000000000000016 r15=0000000000000001
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!ExDeferredFreePool+0x100:
fffff800`031b8f8c 4c8b02 mov r8,qword ptr [rdx] ds:002b:fff7f8a0`08e9dd00=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800031b8f8c
STACK_TEXT:
fffff880`03834160 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x100
FOLLOWUP_IP:
nt!ExDeferredFreePool+100
fffff800`031b8f8c 4c8b02 mov r8,qword ptr [rdx]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExDeferredFreePool+100
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .cxr 0xfffff88003833790 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!ExDeferredFreePool+100
BUCKET_ID: X64_0x3B_nt!ExDeferredFreePool+100
Followup: Pool_corruption
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\022011-22105-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`03002000 PsLoadedModuleList = 0xfffff800`0323fe50
Debug session time: Sun Feb 20 12:38:43.993 2011 (UTC - 5:00)
System Uptime: 0 days 0:11:15.806
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff880037c3688, fffff880037c2ef0, fffff88001300535}
Probably caused by : Ntfs.sys ( Ntfs!NtfsExpandHashTable+75 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880037c3688
Arg3: fffff880037c2ef0
Arg4: fffff88001300535
Debugging Details:
------------------
EXCEPTION_RECORD: fffff880037c3688 -- (.exr 0xfffff880037c3688)
ExceptionAddress: fffff88001300535 (Ntfs!NtfsExpandHashTable+0x0000000000000075)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff880037c2ef0 -- (.cxr 0xfffff880037c2ef0)
rax=0000000000000fff rbx=fffffa8004a3f350 rcx=fff7f8a001d01c70
rdx=0000000000001000 rsi=fffffa8004230850 rdi=00000000000003ff
rip=fffff88001300535 rsp=fffff880037c38c0 rbp=000000002b7e998a
r8=fffff8a0025f0230 r9=fffff8a0095dc230 r10=fffffa8003961148
r11=0000000000000001 r12=fffff8a0030605f0 r13=0000000000000010
r14=fffff8a0097c7e10 r15=fffff8800e9ba4b0
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
Ntfs!NtfsExpandHashTable+0x75:
fffff880`01300535 234110 and eax,dword ptr [rcx+10h] ds:002b:fff7f8a0`01d01c80=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032aa0e0
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsExpandHashTable+75
fffff880`01300535 234110 and eax,dword ptr [rcx+10h]
FAULTING_IP:
Ntfs!NtfsExpandHashTable+75
fffff880`01300535 234110 and eax,dword ptr [rcx+10h]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff880012f9896 to fffff88001300535
STACK_TEXT:
fffff880`037c38c0 fffff880`012f9896 : fffffa80`04a3f350 fffffa80`04a3f350 00000000`2b7e998a 00000000`00000000 : Ntfs!NtfsExpandHashTable+0x75
fffff880`037c38f0 fffff880`012bf149 : 00000000`00000000 fffffa80`042d1660 fffffa80`04230850 00000000`000007ff : Ntfs!NtfsInsertHashEntry+0x152
fffff880`037c3970 fffff880`012e2b04 : fffff880`0e9ba4b0 fffffa80`042d1660 fffffa80`04230850 00000000`00000000 : Ntfs!NtfsOpenFile+0x61d
fffff880`037c3b50 fffff880`0124bc0d : fffffa80`04230850 fffffa80`042d1660 fffff880`0e9ba4b0 fffffa80`03fed000 : Ntfs!NtfsCommonCreate+0xc54
fffff880`037c3d30 fffff800`0306a5c7 : fffff880`0e9ba420 122930cf`6b38447d 6d3d33be`4788fb53 4e08a555`45fa5a64 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`037c3d60 fffff800`0306a581 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27
fffff880`0e9ba2f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsExpandHashTable+75
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff880037c2ef0 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsExpandHashTable+75
BUCKET_ID: X64_0x24_Ntfs!NtfsExpandHashTable+75
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\022211-33431-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`0305d000 PsLoadedModuleList = 0xfffff800`0329ae50
Debug session time: Tue Feb 22 16:00:58.083 2011 (UTC - 5:00)
System Uptime: 0 days 0:01:13.815
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1, {77bcf72a, 0, ffff, fffff88008b2eca0}
Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->KernelApcDisable field. A negative value indicates that a driver
has disabled APC calls without re-enabling them. A positive value indicates
that the reverse is true. This check is made on exit from a system call.
Arguments:
Arg1: 0000000077bcf72a, address of system function (system call)
Arg2: 0000000000000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex
Arg3: 000000000000ffff, Thread->KernelApcDisable
Arg4: fffff88008b2eca0, Previous KernelApcDisable
Debugging Details:
------------------
FAULTING_IP:
+3337313634396637
00000000`77bcf72a ?? ???
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800030ccca9 to fffff800030cd740
STACK_TEXT:
fffff880`08b2ea68 fffff800`030ccca9 : 00000000`00000001 00000000`77bcf72a 00000000`00000000 00000000`0000ffff : nt!KeBugCheckEx
fffff880`08b2ea70 fffff800`030ccbe0 : 00000000`00001045 00000000`00000738 00000000`00000000 0000007f`ffffffff : nt!KiBugCheckDispatch+0x69
fffff880`08b2ebb0 00000000`77bcf72a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
00000000`027ae918 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77bcf72a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiSystemServiceExit+245
fffff800`030ccbe0 4883ec50 sub rsp,50h
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiSystemServiceExit+245
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0x1_SysCallNum_4_nt!KiSystemServiceExit+245
BUCKET_ID: X64_0x1_SysCallNum_4_nt!KiSystemServiceExit+245
Followup: MachineOwner
---------