Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\042211-109871-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02815000 PsLoadedModuleList = 0xfffff800`02a52e50
Debug session time: Fri Apr 22 20:24:21.088 2011 (UTC - 4:00)
System Uptime: 0 days 3:36:15.731
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {39c6008, 2, 1, fffff88000e34e46}
Probably caused by : ataport.SYS ( ataport!PortListRemoveRequest+22 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000039c6008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff88000e34e46, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002abd0e0
00000000039c6008
CURRENT_IRQL: 2
FAULTING_IP:
ataport!PortListRemoveRequest+22
fffff880`00e34e46 49894008 mov qword ptr [r8+8],rax
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: fffff88002dfb830 -- (.trap 0xfffff88002dfb830)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80047be408 rbx=0000000000000000 rcx=fffffa80047be408
rdx=fffffa80046be408 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000e34e46 rsp=fffff88002dfb9c8 rbp=fffffa80047be3d0
r8=00000000039c6000 r9=fffffa80040ba5b0 r10=fffffa80047a2620
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
ataport!PortListRemoveRequest+0x22:
fffff880`00e34e46 49894008 mov qword ptr [r8+8],rax ds:0002:00000000`039c6008=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002884ca9 to fffff80002885740
STACK_TEXT:
fffff880`02dfb6e8 fffff800`02884ca9 : 00000000`0000000a 00000000`039c6008 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`02dfb6f0 fffff800`02883920 : fffffa80`047a1100 00000000`00000001 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`02dfb830 fffff880`00e34e46 : fffff880`00e358ec 00000000`00000000 00000000`00000013 fffffa80`047be408 : nt!KiPageFault+0x260
fffff880`02dfb9c8 fffff880`00e358ec : 00000000`00000000 00000000`00000013 fffffa80`047be408 00000000`00000000 : ataport!PortListRemoveRequest+0x22
fffff880`02dfb9d0 fffff880`00e356e5 : 00000000`00000014 00000000`00000001 00000000`00000001 00000000`000c0000 : ataport!TransferRequestsToQueue+0x34
fffff880`02dfba00 fffff880`00e2d1f6 : 00000000`00000001 fffffa80`047be1b0 fffffa80`047be3d0 fffffa80`03d00160 : ataport!PortAvioSchedulerTransferBatch+0x171
fffff880`02dfba40 fffff880`00e2f582 : 00000000`00000000 00000000`00000000 fffffa80`047be1b0 fffffa80`03d00160 : ataport!IdeStartNextDeviceRequest+0x66
fffff880`02dfbae0 fffff880`00e2f0ec : fffffa80`047a11a0 00000000`00000000 fffffa80`047a11a0 fffffa80`03d00160 : ataport!IdeProcessCompletedRequests+0x26a
fffff880`02dfbc10 fffff800`02890bfc : fffff880`02dd3180 00000009`7bd61944 fffffa80`047a1050 fffffa80`047a1118 : ataport!IdePortCompletionDpc+0x1a8
fffff880`02dfbcd0 fffff800`0288deea : fffff880`02dd3180 fffff880`02dddfc0 00000000`00000000 fffff880`00e2ef44 : nt!KiRetireDpcList+0x1bc
fffff880`02dfbd80 00000000`00000000 : fffff880`02dfc000 fffff880`02df6000 fffff880`02dfbd40 00000000`00000000 : nt!KiIdleLoop+0x5a
STACK_COMMAND: kb
FOLLOWUP_IP:
ataport!PortListRemoveRequest+22
fffff880`00e34e46 49894008 mov qword ptr [r8+8],rax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ataport!PortListRemoveRequest+22
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ataport
IMAGE_NAME: ataport.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc118
FAILURE_BUCKET_ID: X64_0xD1_ataport!PortListRemoveRequest+22
BUCKET_ID: X64_0xD1_ataport!PortListRemoveRequest+22
fffff880`00e34e46 49894008 mov qword ptr [r8+8],rax
fffff880`00e34e4a 488b4120 mov rax,qword ptr [rcx+20h]
fffff880`00e34e4e ff4918 dec dword ptr [rcx+18h]
fffff880`00e34e51 4885c0 test rax,rax
fffff880`00e34e54 7403 je ataport!PortListRemoveRequest+0x35 (fffff880`00e34e59)
ataport!PortListRemoveRequest+0x32:
fffff880`00e34e56 ff4804 dec dword ptr [rax+4]
ataport!PortListRemoveRequest+0x35:
fffff880`00e34e59 48394910 cmp qword ptr [rcx+10h],rcx
fffff880`00e34e5d 7507 jne ataport!PortListRemoveRequest+0x42 (fffff880`00e34e66)
ataport!PortListRemoveRequest+0x3b:
fffff880`00e34e5f 488b01 mov rax,qword ptr [rcx]
fffff880`00e34e62 48894110 mov qword ptr [rcx+10h],rax
ataport!PortListRemoveRequest+0x42:
fffff880`00e34e66 c3 ret
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\042311-19765-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02861000 PsLoadedModuleList = 0xfffff800`02a9ee50
Debug session time: Sat Apr 23 14:27:00.119 2011 (UTC - 4:00)
System Uptime: 0 days 0:38:30.492
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 39, {fffff80002b60414, 0, fffff80002ad6be0, 0}
Probably caused by : ntkrnlmp.exe ( nt!CmpLazyFlushWorker+0 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_EXIT_OWNED_MUTEX (39)
Arguments:
Arg1: fffff80002b60414
Arg2: 0000000000000000
Arg3: fffff80002ad6be0
Arg4: 0000000000000000
Debugging Details:
------------------
FAULTING_IP:
nt!CmpLazyFlushWorker+0
fffff800`02b60414 488bc4 mov rax,rsp
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x39
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff8000287c52b to fffff800028d1740
STACK_TEXT:
fffff880`031afca8 fffff800`0287c52b : 00000000`00000039 fffff800`02b60414 00000000`00000000 fffff800`02ad6be0 : nt!KeBugCheckEx
fffff880`031afcb0 fffff800`02b747c6 : 00000000`00000000 fffffa80`039de040 00000000`00000080 fffffa80`03967890 : nt! ?? ::FNODOBFM::`string'+0x54420
fffff880`031afd40 fffff800`028afc26 : fffff880`02f63180 fffffa80`039de040 fffff880`02f6dfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`031afd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!CmpLazyFlushWorker+0
fffff800`02b60414 488bc4 mov rax,rsp
SYMBOL_NAME: nt!CmpLazyFlushWorker+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0x39_nt!CmpLazyFlushWorker+0
BUCKET_ID: X64_0x39_nt!CmpLazyFlushWorker+0
fffff800`02b60568 f0012d31aaeeff lock add dword ptr [nt!CmpLazyFlushCount (fffff800`02a4afa0)],ebp
fffff800`02b6056f e951ffffff jmp nt!CmpLazyFlushWorker+0xb1 (fffff800`02b604c5)
nt!CmpLazyFlushWorker+0x160:
fffff800`02b60574 39742450 cmp dword ptr [rsp+50h],esi
fffff800`02b60578 74db je nt!CmpLazyFlushWorker+0x141 (fffff800`02b60555)
nt!CmpLazyFlushWorker+0x166:
fffff800`02b6057a ebd4 jmp nt!CmpLazyFlushWorker+0x13c (fffff800`02b60550)
nt! ?? ::NNGAKEGL::`string'+0x49120:
fffff800`02c2b1a0 488d0d41cceaff lea rcx,[nt!CmpLoadHiveLock (fffff800`02ad7de8)]
fffff800`02c2b1a7 e8846bcdff call nt!ExfAcquirePushLockExclusive (fffff800`02901d30)
fffff800`02c2b1ac 90 nop
fffff800`02c2b1ad e9ba52f3ff jmp nt!CmpLazyFlushWorker+0x58 (fffff800`02b6046c)
nt! ?? ::NNGAKEGL::`string'+0x49132:
fffff800`02c2b1b2 408acd mov cl,bpl
fffff800`02c2b1b5 e8a690f4ff call nt!CmpLockRegistryFreezeAware (fffff800`02b74260)
fffff800`02c2b1ba 90 nop
fffff800`02c2b1bb e9d952f3ff jmp nt!CmpLazyFlushWorker+0x85 (fffff800`02b60499)
nt! ?? ::NNGAKEGL::`string'+0x49140:
fffff800`02c2b1c0 408835dd6ce3ff mov byte ptr [nt!CmpForceForceFlush (fffff800`02a61ea4)],sil
fffff800`02c2b1c7 e9f952f3ff jmp nt!CmpLazyFlushWorker+0xb1 (fffff800`02b604c5)
nt! ?? ::NNGAKEGL::`string'+0x4914c:
fffff800`02c2b1cc 488d0d15cceaff lea rcx,[nt!CmpLoadHiveLock (fffff800`02ad7de8)]
fffff800`02c2b1d3 e848bbc7ff call nt!ExfReleasePushLock (fffff800`028a6d20)
fffff800`02c2b1d8 90 nop
fffff800`02c2b1d9 e94153f3ff jmp nt!CmpLazyFlushWorker+0x10b (fffff800`02b6051f)
nt! ?? ::NNGAKEGL::`string'+0x4915e:
fffff800`02c2b1de 6639b1c6010000 cmp word ptr [rcx+1C6h],si
fffff800`02c2b1e5 0f855353f3ff jne nt!CmpLazyFlushWorker+0x12a (fffff800`02b6053e)
nt! ?? ::NNGAKEGL::`string'+0x4916b:
fffff800`02c2b1eb e8b099c5ff call nt!KiCheckForKernelApcDelivery (fffff800`02884ba0)
fffff800`02c2b1f0 90 nop
fffff800`02c2b1f1 e94853f3ff jmp nt!CmpLazyFlushWorker+0x12a (fffff800`02b6053e)
nt! ?? ::NNGAKEGL::`string'+0x49176:
fffff800`02c2b1f6 4038742448 cmp byte ptr [rsp+48h],sil
fffff800`02c2b1fb 750c jne nt! ?? ::NNGAKEGL::`string'+0x49189 (fffff800`02c2b209)
nt! ?? ::NNGAKEGL::`string'+0x4917d:
fffff800`02c2b1fd 4088355efe1600 mov byte ptr [nt!CmpCannotWriteConfiguration (fffff800`02d9b062)],sil
fffff800`02c2b204 e94253f3ff jmp nt!CmpLazyFlushWorker+0x137 (fffff800`02b6054b)
nt! ?? ::NNGAKEGL::`string'+0x49189:
fffff800`02c2b209 e8823a0a00 call nt!CmpDiskFullWarning (fffff800`02ccec90)
fffff800`02c2b20e e8ed4ef3ff call nt!CmpLazyFlush (fffff800`02b60100)
fffff800`02c2b213 90 nop
fffff800`02c2b214 e93253f3ff jmp nt!CmpLazyFlushWorker+0x137 (fffff800`02b6054b)
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\042311-20358-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02816000 PsLoadedModuleList = 0xfffff800`02a53e50
Debug session time: Sat Apr 23 17:53:39.777 2011 (UTC - 4:00)
System Uptime: 0 days 3:24:28.150
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002889905, fffff88008637950, 0}
Probably caused by : ntkrnlmp.exe ( nt!ExpInterlockedPopEntrySListFault16+0 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002889905, Address of the instruction which caused the bugcheck
Arg3: fffff88008637950, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`02889905 498b08 mov rcx,qword ptr [r8]
CONTEXT: fffff88008637950 -- (.cxr 0xfffff88008637950)
rax=00000009e9800009 rbx=fffff880086383d0 rcx=fffffa80060dd9d0
rdx=fffdf900c344fe31 rsi=0000000000000004 rdi=00000000000000d8
rip=fffff80002889905 rsp=fffff88008638320 rbp=fffffa80060dd9d0
r8=fffdf900c344fe30 r9=000000000000001f r10=fffffa80060dd9d0
r11=fffff900c35ae068 r12=0000000000000000 r13=00000000000bfd20
r14=00000000000bd0f0 r15=0000000074202450
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!ExpInterlockedPopEntrySListFault16:
fffff800`02889905 498b08 mov rcx,qword ptr [r8] ds:002b:fffdf900`c344fe30=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: msnmsgr.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002889905
STACK_TEXT:
fffff880`08638320 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExpInterlockedPopEntrySListFault16
FOLLOWUP_IP:
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`02889905 498b08 mov rcx,qword ptr [r8]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExpInterlockedPopEntrySListFault16+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
STACK_COMMAND: .cxr 0xfffff88008637950 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!ExpInterlockedPopEntrySListFault16+0
BUCKET_ID: X64_0x3B_nt!ExpInterlockedPopEntrySListFault16+0
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\042311-31527-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02862000 PsLoadedModuleList = 0xfffff800`02a9fe50
Debug session time: Sat Apr 23 22:43:54.499 2011 (UTC - 4:00)
System Uptime: 0 days 0:00:21.247
Loading Kernel Symbols
...............................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff800028d5905, fffff88003911c80, 0}
Probably caused by : ntkrnlmp.exe ( nt!ExpInterlockedPopEntrySListFault16+0 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800028d5905, Address of the instruction which caused the bugcheck
Arg3: fffff88003911c80, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`028d5905 498b08 mov rcx,qword ptr [r8]
CONTEXT: fffff88003911c80 -- (.cxr 0xfffff88003911c80)
rax=00000000002c0001 rbx=fffff880039128e8 rcx=fffffa8005a42d90
rdx=fffdf900c00d2cd1 rsi=0000000000000005 rdi=0000000000000228
rip=fffff800028d5905 rsp=fffff88003912650 rbp=fffffa8005a42d90
r8=fffdf900c00d2cd0 r9=0000000000000006 r10=fffffa8005a42d90
r11=0000000000000004 r12=0000000000000000 r13=0000000000000001
r14=0000000000000006 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!ExpInterlockedPopEntrySListFault16:
fffff800`028d5905 498b08 mov rcx,qword ptr [r8] ds:002b:fffdf900`c00d2cd0=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800028d5905
STACK_TEXT:
fffff880`03912650 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExpInterlockedPopEntrySListFault16
FOLLOWUP_IP:
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`028d5905 498b08 mov rcx,qword ptr [r8]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExpInterlockedPopEntrySListFault16+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
STACK_COMMAND: .cxr 0xfffff88003911c80 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!ExpInterlockedPopEntrySListFault16+0
BUCKET_ID: X64_0x3B_nt!ExpInterlockedPopEntrySListFault16+0
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\042311-69124-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02856000 PsLoadedModuleList = 0xfffff800`02a93e50
Debug session time: Sat Apr 23 23:05:52.264 2011 (UTC - 4:00)
System Uptime: 0 days 0:08:41.012
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {7, 1097, 5cdc731, fffff8800650c708}
GetPointerFromAddress: unable to read from fffff80002afe0e0
GetUlongFromAddress: unable to read from fffff80002a6c1b0
GetUlongFromAddress: unable to read from fffff80002a6c1b0
Probably caused by : Ntfs.sys ( Ntfs! ?? ::FNODOBFM::`string'+67c5 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 0000000000001097, (reserved)
Arg3: 0000000005cdc731, Memory contents of the pool block
Arg4: fffff8800650c708, Address of the block of pool being deallocated
Debugging Details:
------------------
GetUlongFromAddress: unable to read from fffff80002a6c1b0
GetUlongFromAddress: unable to read from fffff80002a6c1b0
POOL_ADDRESS: fffff8800650c708
BUGCHECK_STR: 0xc2_7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: services.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800029f960e to fffff800028c6740
STACK_TEXT:
fffff880`0650c558 fffff800`029f960e : 00000000`000000c2 00000000`00000007 00000000`00001097 00000000`05cdc731 : nt!KeBugCheckEx
fffff880`0650c560 fffff880`01054a0d : 00000000`0000070d fffff880`00db7533 fffff880`0650c9f0 00000000`00000000 : nt!ExDeferredFreePool+0x11eb
fffff880`0650c610 fffff880`0104176a : fffff880`0650c730 fffff880`00000001 00000000`00000000 fffff880`0650c730 : Ntfs! ?? ::FNODOBFM::`string'+0x67c5
fffff880`0650c660 fffff880`010e3244 : fffff880`0650c980 fffff880`0650c730 fffffa80`06a26010 fffff8a0`0010b010 : Ntfs!NtfsCommonCleanupOnNewStack+0x14a
fffff880`0650c6d0 fffff880`00db623f : fffff880`0650c730 fffffa80`06a26010 fffffa80`06a263b0 fffffa80`067f74d0 : Ntfs!NtfsFsdCleanup+0x144
fffff880`0650c940 fffff880`00db46df : fffffa80`04952de0 00000000`00000000 fffffa80`047a5f00 fffffa80`06a26010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0650c9d0 fffff800`02bda84f : fffffa80`06a26010 fffffa80`0610fb30 00000000`00000000 fffffa80`03aee660 : fltmgr!FltpDispatch+0xcf
fffff880`0650ca30 fffff800`02bc0724 : 00000000`00000000 fffffa80`0610fb30 00000000`00000000 fffffa80`03b08060 : nt!IopCloseFile+0x11f
fffff880`0650cac0 fffff800`02bda341 : fffffa80`0610fb30 fffffa80`00000001 fffff8a0`018039e0 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
fffff880`0650cb40 fffff800`02bda254 : 00000000`000001fc fffffa80`0610fb30 fffff8a0`018039e0 00000000`000001fc : nt!ObpCloseHandleTableEntry+0xb1
fffff880`0650cbd0 fffff800`028c5993 : fffffa80`05baf060 fffff880`0650cca0 00000000`0008040c fffffa80`06182e60 : nt!ObpCloseHandle+0x94
fffff880`0650cc20 00000000`76e4f7aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0022de18 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76e4f7aa
STACK_COMMAND: kb
FOLLOWUP_IP:
Ntfs! ?? ::FNODOBFM::`string'+67c5
fffff880`01054a0d 4c897b20 mov qword ptr [rbx+20h],r15
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: Ntfs! ?? ::FNODOBFM::`string'+67c5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
FAILURE_BUCKET_ID: X64_0xc2_7_Ntfs!_??_::FNODOBFM::_string_+67c5
BUCKET_ID: X64_0xc2_7_Ntfs!_??_::FNODOBFM::_string_+67c5
Followup: MachineOwner
---------