*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 76, {0, fffffa80084de060, 3, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+18026 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PROCESS_HAS_LOCKED_PAGES (76)
Caused by a driver not cleaning up correctly after an I/O.
Arguments:
Arg1: 0000000000000000, Locked memory pages found in process being terminated.
Arg2: fffffa80084de060, Process address.
Arg3: 0000000000000003, Number of locked pages.
Arg4: 0000000000000000, Pointer to driver stacks (if enabled) or 0 if not.
Issue a !search over all of physical memory for the current process pointer.
This will yield at least one MDL which points to it. Then do another !search
for each MDL found, this will yield the IRP(s) that point to it, revealing
which driver is leaking the pages.
Otherwise, set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\TrackLockedPages to a DWORD 1 value and reboot. Then the system
will save stack traces so the guilty driver can be easily identified.
When you enable this flag, if the driver commits the error again you will
see a different bugcheck - DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (0xCB) -
which can identify the offending driver(s).
Debugging Details:
------------------
PROCESS_NAME: audiodg.exe
DEFAULT_BUCKET_ID: DRIVER_FAULT_0x76
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x76
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80003734069 to fffff800034d7c40
STACK_TEXT:
fffff880`0394a9f8 fffff800`03734069 : 00000000`00000076 00000000`00000000 fffffa80`084de060 00000000`00000003 : nt!KeBugCheckEx
fffff880`0394aa00 fffff800`0378e987 : fffffa80`084de060 fffffa80`03c6ff30 fffffa80`00000000 fffffa80`00000000 : nt! ?? ::NNGAKEGL::`string'+0x18026
fffff880`0394aa40 fffff800`034e1af4 : 00000000`00000000 fffffa80`084de060 fffffa80`084de030 fffff800`03863db5 : nt!PspProcessDelete+0x177
fffff880`0394aaa0 fffff800`035d87d9 : fffffa80`084de060 fffffa80`08b4a000 fffffa80`08b4aeb0 fffffa80`08b4aea8 : nt!ObfDereferenceObject+0xd4
fffff880`0394ab00 fffff800`0392858e : fffffa80`00000562 fffffa80`04d9e000 fffffa80`084de060 fffffa80`08b4aeb0 : nt!MmFreeAccessPfnBuffer+0x29
fffff880`0394ab30 fffff800`03949c70 : fffffa80`05b77b01 00000000`00000080 fffffa80`03cde040 fffff800`0365fda8 : nt!PfpFlushBuffers+0x23e
fffff880`0394abd0 fffff800`03772fee : ffffffff`ff676980 fffffa80`05b77b60 fffffa80`05ae3b60 fffff800`034cf757 : nt!PfTLoggingWorker+0xe0
fffff880`0394ad00 fffff800`034c95e6 : fffff880`009e7180 fffffa80`05b77b60 fffff880`009f1f40 fffff880`01251a20 : nt!PspSystemThreadStartup+0x5a
fffff880`0394ad40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::NNGAKEGL::`string'+18026
fffff800`03734069 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+18026
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x76_audiodg.exe_nt!_??_::NNGAKEGL::_string_+18026
BUCKET_ID: X64_0x76_audiodg.exe_nt!_??_::NNGAKEGL::_string_+18026