Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\121410-38017-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82e0b000 PsLoadedModuleList = 0x82f53810
Debug session time: Tue Dec 14 14:47:01.307 2010 (UTC - 5:00)
System Uptime: 0 days 3:15:19.289
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
...............
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 000029b2, page frame number
Arg3: 00000002, current page state
Arg4: 0000296c, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 82ef46dc to 82ee7d10
STACK_TEXT:
a6b4b7f0 82ef46dc 0000004e 00000099 000029b2 nt!KeBugCheckEx+0x1e
a6b4b808 82eb2598 c004a000 a6b4b990 093dc000 nt!MiBadShareCount+0x24
a6b4b91c 82ec4ad4 c0049800 c0049ff8 850a2030 nt!MiDeletePteRun+0x66a
a6b4ba20 82ebe40e 08fa0002 09788fff 850a2030 nt!MiDeleteVirtualAddresses+0x3c1
a6b4baf0 82eb2718 850a2030 85cf3110 84fccd48 nt!MiRemoveMappedView+0x325
a6b4bb18 83085558 84fccd48 00000000 00000000 nt!MiRemoveVadAndView+0xe5
a6b4bb7c 83088e32 850a2030 08fa0000 00000000 nt!MiUnmapViewOfSection+0x265
a6b4bb90 96c5d5cf 850a2030 08fa0000 ffb97a40 nt!MmUnmapViewOfSection+0x12
a6b4bc28 96bfc81e 872322e0 00000001 fe36d9c0 win32k!SURFACE::bDeleteSurface+0x2f8
a6b4bc44 96bfd1f7 4a050e05 00000001 fe36d9c0 win32k!GreDereferenceObject+0x6b
a6b4bc58 96bfcdc4 ffb97a40 00000000 fe36d9c0 win32k!SFMLOGICALSURFACE::CleanupShape+0x1f
a6b4bc70 96c4f730 ffb97a40 78120fb8 fe36d9c0 win32k!SFMLOGICALSURFACE::DeInitialize+0x3f
a6b4bc88 96bfd313 fe36d9c0 00000001 00000000 win32k!bhLSurfDestroyLogicalSurfaceObject+0x31
a6b4bcac 96c01d88 ffb8f748 00000000 306dc721 win32k!GreSfmCloseCompositorRef+0x8b
a6b4bd1c 82e4e44a 78120fb8 00000008 00000000 win32k!NtGdiHLSurfSetInformation+0x110
a6b4bd1c 76f364f4 78120fb8 00000008 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0160fc8c 00000000 00000000 00000000 00000000 0x76f364f4
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+24
82ef46dc cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+24
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c3fac
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x4E_99_nt!MiBadShareCount+24
BUCKET_ID: 0x4E_99_nt!MiBadShareCount+24
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\121410-42026-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82e3a000 PsLoadedModuleList = 0x82f82810
Debug session time: Tue Dec 14 11:30:35.956 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:52.813
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
.....
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
RDR_FILE_SYSTEM (27)
If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: baad0073
Arg2: 9cac34f8
Arg3: 9cac30d0
Arg4: 8f404834
Debugging Details:
------------------
EXCEPTION_RECORD: 9cac34f8 -- (.exr 0xffffffff9cac34f8)
ExceptionAddress: 8f404834 (csc!CscCreateAndInitializeFobxContext+0x000000a1)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 00000074
Attempt to write to address 00000074
CONTEXT: 9cac30d0 -- (.cxr 0xffffffff9cac30d0)
eax=00000000 ebx=00000000 ecx=0000006c edx=00000000 esi=87732bf8 edi=9c73ca14
eip=8f404834 esp=9cac35c0 ebp=9cac35d0 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
csc!CscCreateAndInitializeFobxContext+0xa1:
8f404834 204074 and byte ptr [eax+74h],al ds:0023:00000074=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: spoolsv.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 00000074
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82fa2718
Unable to read MiSystemVaType memory at 82f82160
00000074
FOLLOWUP_IP:
csc!CscCreateAndInitializeFobxContext+a1
8f404834 204074 and byte ptr [eax+74h],al
FAULTING_IP:
csc!CscCreateAndInitializeFobxContext+a1
8f404834 204074 and byte ptr [eax+74h],al
BUGCHECK_STR: 0x27
DEFAULT_BUCKET_ID: CODE_CORRUPTION
MISALIGNED_IP:
csc!CscCreateAndInitializeFobxContext+a1
8f404834 204074 and byte ptr [eax+74h],al
LAST_CONTROL_TRANSFER: from 8f430151 to 8f404834
STACK_TEXT:
9cac35d0 8f430151 8a86c2a0 9c73ca14 00000000 csc!CscCreateAndInitializeFobxContext+0xa1
9cac3618 8f427290 00000000 0173c8c0 85f6a538 csc!CscCreateSlashDotOpen+0x43c
9cac3708 8ef6bbfb 85f6a4a8 8a86c008 85f6a4a8 csc!CscCreate+0x28b
9cac3734 8ef6c2d8 00f6a4a8 00ec0780 8a86c008 rdbss!RxCollapseOrCreateSrvOpen+0x44e
9cac37cc 8ef6a920 85f6a4a8 85ec0780 9cac37ec rdbss!RxCreateFromNetRoot+0x478
9cac3800 8ef51fb1 00000000 85ec0780 125a1f87 rdbss!RxCommonCreate+0x2ae
9cac3888 8ef6ce2b 8ef62240 85ec0780 87a353d0 rdbss!RxFsdCommonDispatch+0x646
9cac38b8 8f430572 85f6f020 00ec0780 85ec0830 rdbss!RxFsdDispatch+0x1ab
9cac38e4 82e764bc 85f6f020 00000000 85ec0854 csc!CscFsdDispatch+0x29e
9cac38fc 8f4035ff 87a352b8 87a35248 8a95a7d8 nt!IofCallDriver+0x63
9cac3964 894b60fb 87a352b8 00000103 87a35248 csc!CscSurrogatePreProcess+0x5fa
9cac3984 894b6b68 01a35248 c0000016 85ec0838 mup!MupCallSurrogatePrePost+0xf6
9cac399c 894b6f5b 87a35248 15e76bd0 00000000 mup!MupStateMachine+0xb1
9cac39e8 82e764bc 85cbcbf0 85ec0780 85ec0780 mup!MupCreate+0x109
9cac3a00 88edf20c 85ec0780 00000000 85ec085c nt!IofCallDriver+0x63
9cac3a24 88ef28c9 9cac3a44 85cbc6b0 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
9cac3a70 82e764bc 85cbc6b0 85cbd008 87a3542c fltmgr!FltpCreate+0x2db
9cac3a88 8307a6ad 805d8a2b 9cac3c30 00000000 nt!IofCallDriver+0x63
9cac3b60 8305b26b 85cbcbf0 85ed9eb0 878fed20 nt!IopParseDevice+0xed7
9cac3bdc 830812d9 00000000 9cac3c30 00000040 nt!ObpLookupObjectName+0x4fa
9cac3c38 8307962b 0266f38c 84ed9eb0 805d8d01 nt!ObOpenObjectByName+0x165
9cac3cb4 83084f42 6e4780a0 00120089 0266f38c nt!IopCreateFile+0x673
9cac3d00 82e7d44a 6e4780a0 00120089 0266f38c nt!NtCreateFile+0x34
9cac3d00 779c64f4 6e4780a0 00120089 0266f38c nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0266f3f0 00000000 00000000 00000000 00000000 0x779c64f4
CHKIMG_EXTENSION: !chkimg -lo 50 -d !csc
8f404811 - csc!CscCreateAndInitializeFobxContext+7e
[ 02:22 ]
1 error : !csc (8f404811)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
STACK_COMMAND: .cxr 0xffffffff9cac30d0 ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------