Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\050111-29156-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a65000 PsLoadedModuleList = 0xfffff800`02ca2e50
Debug session time: Sun May 1 18:02:58.559 2011 (UTC - 4:00)
System Uptime: 0 days 1:57:26.260
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffff68000379d98, 0, 0, fffff80002b059fa}
Probably caused by : memory_corruption ( nt!MiSwapWslEntries+6a )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff68000379d98, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002b059fa, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d0d0e0
fffff68000379d98
CURRENT_IRQL: 0
FAULTING_IP:
nt!MiSwapWslEntries+6a
fffff800`02b059fa 498b00 mov rax,qword ptr [r8]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: WowError.exe
TRAP_FRAME: fffff880096e4a60 -- (.trap 0xfffff880096e4a60)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000072f14139 rbx=0000000000000000 rcx=0000000072f137c0
rdx=0000000000740180 rsi=0000000000000000 rdi=0000000000000000
rip=0000000072f14139 rsp=000000000037ef54 rbp=000000000037ef5c
r8=000000000000002b r9=000000007728fcd5 r10=0000000000000000
r11=0000000000000246 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
0023:72f14139 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ad4ca9 to fffff80002ad5740
STACK_TEXT:
fffff880`096e4328 fffff800`02ad4ca9 : 00000000`0000000a fffff680`00379d98 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`096e4330 fffff800`02ad3920 : 00000000`00000000 fffffa80`00000028 00000000`00000000 0c3d0000`00001000 : nt!KiBugCheckDispatch+0x69
fffff880`096e4470 fffff800`02b059fa : fffffa80`00000028 fffffa80`07639ec8 fffff700`01080488 00000000`00037a00 : nt!KiPageFault+0x260
fffff880`096e4600 fffff800`02af11d2 : fffff700`01080000 00000000`72f14001 fffff700`01080000 fffffa80`06300270 : nt!MiSwapWslEntries+0x6a
fffff880`096e4660 fffff800`02afc1fd : 00000000`000003fe 00000000`00000000 00000000`00000000 fffffa80`07d48678 : nt!MiUpdateWsle+0xd2
fffff880`096e46c0 fffff800`02afbb83 : 3fe00000`99810025 00000000`99810121 fffff800`02c8a720 00000000`00000000 : nt!MiCompleteProtoPteFault+0x2cd
fffff880`096e4750 fffff800`02af15be : 00000000`00000000 00000000`72f14139 fffff680`003978a0 fffffa80`07639ec8 : nt!MiResolveProtoPteFault+0x1d3
fffff880`096e47f0 fffff800`02aef743 : 00000000`00000000 00000000`72f14139 00000000`00000000 00000000`00000000 : nt!MiDispatchFault+0x1de
fffff880`096e4900 fffff800`02ad382e : 00000000`00000008 00000000`00380000 00000000`0032ab01 fffffa80`00000000 : nt!MmAccessFault+0x343
fffff880`096e4a60 00000000`72f14139 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0037ef54 fffff800`02acd080 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x72f14139
fffff880`096e4e70 00000000`00000002 : 00000000`00000000 fffffa80`00680727 fffff880`096e4dd8 00000000`00000259 : nt!KiCallUserMode
fffff880`096e4e78 00000000`00000000 : fffffa80`00680727 fffff880`096e4dd8 00000000`00000259 fffff880`096e5db0 : 0x2
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiSwapWslEntries+6a
fffff800`02b059fa 498b00 mov rax,qword ptr [r8]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiSwapWslEntries+6a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xA_nt!MiSwapWslEntries+6a
BUCKET_ID: X64_0xA_nt!MiSwapWslEntries+6a
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\050111-26239-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a1d000 PsLoadedModuleList = 0xfffff800`02c5ae50
Debug session time: Sun May 1 16:03:37.662 2011 (UTC - 4:00)
System Uptime: 0 days 0:04:22.973
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {411, fffff683ff7a0cd8, 33800000bc03e884, fffff680000049f9}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+6051 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000411, The subtype of the bugcheck.
Arg2: fffff683ff7a0cd8
Arg3: 33800000bc03e884
Arg4: fffff680000049f9
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_411
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: CurseClient.ex
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80002a5470e to fffff80002a8d740
STACK_TEXT:
fffff880`097af8c8 fffff800`02a5470e : 00000000`0000001a 00000000`00000411 fffff683`ff7a0cd8 33800000`bc03e884 : nt!KeBugCheckEx
fffff880`097af8d0 fffff800`02abf7ad : 000007fe`f419b7e0 fffff683`ff7a0cd8 0000007f`fffffff8 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x6051
fffff880`097af920 fffff800`02aa9d26 : 00000000`00000000 00000000`1bacdac0 fffff683`ff7a1488 fffffa80`068a06c8 : nt!MiResolveTransitionFault+0x38d
fffff880`097af9b0 fffff800`02aa7743 : ffffffff`ffffffff 000007fe`f42918e0 fffff880`097afc20 fffff680`00000000 : nt!MiDispatchFault+0x946
fffff880`097afac0 fffff800`02a8b82e : 00000000`00000000 00000000`1e73ed60 fffff880`097afb01 fffffa80`05cca3e0 : nt!MmAccessFault+0x343
fffff880`097afc20 000007fe`f428abb2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`1e73ed10 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`f428abb2
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+6051
fffff800`02a5470e cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+6051
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0x1a_411_nt!_??_::FNODOBFM::_string_+6051
BUCKET_ID: X64_0x1a_411_nt!_??_::FNODOBFM::_string_+6051
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\051011-29718-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a1d000 PsLoadedModuleList = 0xfffff800`02c5ae50
Debug session time: Tue May 10 15:55:10.154 2011 (UTC - 4:00)
System Uptime: 0 days 2:31:49.855
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffff8000280c310, 2, 1, fffff80002a91e09}
Probably caused by : ntkrnlmp.exe ( nt!KiTryUnwaitThread+159 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff8000280c310, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002a91e09, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc50e0
fffff8000280c310
CURRENT_IRQL: 2
FAULTING_IP:
nt!KiTryUnwaitThread+159
fffff800`02a91e09 f0480fbaaf9044000000 lock bts qword ptr [rdi+4490h],0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: audiodg.exe
TRAP_FRAME: fffff88003cb9960 -- (.trap 0xfffff88003cb9960)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000001
rdx=fffffa8003b36168 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002a91e09 rsp=fffff88003cb9af0 rbp=fffff880009e8180
r8=0000000000000000 r9=0000000000000000 r10=fffffa8003a00200
r11=0000000000100002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!KiTryUnwaitThread+0x159:
fffff800`02a91e09 f0480fbaaf9044000000 lock bts qword ptr [rdi+4490h],0 ds:00000000`00004490=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002a8cca9 to fffff80002a8d740
STACK_TEXT:
fffff880`03cb9818 fffff800`02a8cca9 : 00000000`0000000a fffff800`0280c310 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`03cb9820 fffff800`02a8b920 : fffff8a0`018e0a01 fffffa80`03b36060 fffffa80`00000001 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03cb9960 fffff800`02a91e09 : 00000002`00000000 fffffa80`03cbdc50 00000000`00000001 fffffa80`03cbdc50 : nt!KiPageFault+0x260
fffff880`03cb9af0 fffff800`02a917d2 : fffffa80`0683ed30 00000000`00000000 00000000`00000000 fffff880`009e8180 : nt!KiTryUnwaitThread+0x159
fffff880`03cb9b50 fffff800`02da7f94 : fffff880`00000000 00000000`00000001 fffffa80`03a00200 fffffa80`0683ed38 : nt!KeSetEvent+0x142
fffff880`03cb9bc0 fffff800`02a8c993 : fffffa80`053f9060 fffffa80`06f0f9e0 00000000`00000000 fffffa80`0683ed30 : nt!NtSetEvent+0x90
fffff880`03cb9c20 00000000`771cf79a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0232fc28 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771cf79a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiTryUnwaitThread+159
fffff800`02a91e09 f0480fbaaf9044000000 lock bts qword ptr [rdi+4490h],0
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KiTryUnwaitThread+159
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0xA_nt!KiTryUnwaitThread+159
BUCKET_ID: X64_0xA_nt!KiTryUnwaitThread+159
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\051111-34491-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16792.amd64fre.win7_gdr.110408-1633
Machine Name:
Kernel base = 0xfffff800`02a61000 PsLoadedModuleList = 0xfffff800`02c9ee50
Debug session time: Wed May 11 14:26:53.169 2011 (UTC - 4:00)
System Uptime: 0 days 0:09:34.854
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffff80002850310, 2, 1, fffff80002ae35a0}
Probably caused by : ntkrnlmp.exe ( nt!KiSignalThread+54 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff80002850310, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ae35a0, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d090e0
fffff80002850310
CURRENT_IRQL: 2
FAULTING_IP:
nt!KiSignalThread+54
fffff800`02ae35a0 f0480fbaaf9044000000 lock bts qword ptr [rdi+4490h],0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: CCC.exe
TRAP_FRAME: fffff88009fd8940 -- (.trap 0xfffff88009fd8940)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8003b551b0 rbx=0000000000000000 rcx=fffff88002d63180
rdx=fffffa8003ab3770 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ae35a0 rsp=fffff88009fd8ad0 rbp=fffff88002d63180
r8=fffffa8003cd4460 r9=fffffa8003ab3878 r10=0000000000000001
r11=00000000000f00ff r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!KiSignalThread+0x54:
fffff800`02ae35a0 f0480fbaaf9044000000 lock bts qword ptr [rdi+4490h],0 ds:0202:00000000`00004490=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ad0c69 to fffff80002ad1700
STACK_TEXT:
fffff880`09fd87f8 fffff800`02ad0c69 : 00000000`0000000a fffff800`02850310 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`09fd8800 fffff800`02acf8e0 : 00000000`00000005 fffffa80`03ab3770 00000000`00000000 fffff800`02dcc7f2 : nt!KiBugCheckDispatch+0x69
fffff880`09fd8940 fffff800`02ae35a0 : 00000000`00000000 fffffa80`03ab3878 fffffa80`03ab3770 fffffa80`04015060 : nt!KiPageFault+0x260
fffff880`09fd8ad0 fffff800`02ae27e1 : fffff880`02d63180 fffffa80`03ab3770 fffffa80`03cd4460 fffffa80`03b551b0 : nt!KiSignalThread+0x54
fffff880`09fd8b00 fffff800`02dccbf4 : 00000000`00000000 00000000`00000000 00000000`1e157400 fffff880`00000000 : nt!KiInsertQueue+0xd1
fffff880`09fd8b70 fffff800`02ae17ae : 00000000`00000000 00000000`00000001 fffffa80`03fe36a0 fffffa80`03fe36a0 : nt!IoSetIoCompletionEx+0x58
fffff880`09fd8ba0 fffff800`02ad0953 : fffffa80`04015060 fffffa80`03fe36a0 fffff880`09fd8ca0 00000000`1e157480 : nt!NtReleaseWorkerFactoryWorker+0x196
fffff880`09fd8c20 00000000`77200a6a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1b35f6e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77200a6a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiSignalThread+54
fffff800`02ae35a0 f0480fbaaf9044000000 lock bts qword ptr [rdi+4490h],0
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KiSignalThread+54
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4d9fdd34
FAILURE_BUCKET_ID: X64_0xA_nt!KiSignalThread+54
BUCKET_ID: X64_0xA_nt!KiSignalThread+54
Followup: MachineOwner
---------