Exchange Server BSOD and restarted with crash dump

techaview · 10th April 2007

Hi recently my exchange server restarted with BSOD and generated a crash dump. below is the output with !anyalze -v and lmv. My server is windows 2003 sp1. Is it the same as this? Win2003 SE SP1 Dump Help. Thanks in advance

_________________________________________________________________
0: kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: e0042000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------

BUGCHECK_STR: 0x7f_8

TSS: 00000028 -- (.tss 28)
eax=fa4f3020 ebx=00000000 ecx=f27c1cc0 edx=102b1001 esi=f27c1048 edi=fb2111a0
eip=f626006f esp=f27c1000 ebp=f27c1004 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
Ntfs!NtfsCleanupIrpContext+0x6:
f626006f 56 push esi
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 1

LAST_CONTROL_TRANSFER: from f625c2d7 to f626006f

STACK_TEXT:
f27c1004 f625c2d7 f27c1048 00000000 fb2111a0 Ntfs!NtfsCleanupIrpContext+0x6
f27c1020 f625c288 f27c1048 fa2595b8 00000001 Ntfs!NtfsPrePostIrpInternal+0x48
f27c1038 f62694cc f27c1048 fa2595b8 0108070a Ntfs!NtfsPrePostIrp+0x14
f27c11e0 e0840153 fb334438 fa2595b8 fa2595b8 Ntfs!NtfsFsdRead+0x1ea
f27c11f4 f6319d28 fac904a8 fb32e578 fa259790 nt!IofCallDriver+0x45
f27c1220 e0840153 fb356020 fa2595b8 fa2597b4 fltmgr!FltpDispatch+0x152
f27c1234 f5dac891 faa08020 fb08c230 facc2c18 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may be wrong.
f27c1248 e0840153 fb126f10 fa2595b8 fa2595b8 SYMEVENT+0x7891
f27c125c f6319d28 fa259790 fb32e578 fa2597b4 nt!IofCallDriver+0x45
f27c1288 e0840153 faa08020 fa2595b8 fa2595b8 fltmgr!FltpDispatch+0x152
f27c129c f5795a00 faa00898 fa2595b8 f27c12fc nt!IofCallDriver+0x45
f27c12b0 f5795588 faa00898 fa2595b8 00000000 ofant+0xda00
00000000 00000000 00000000 00000000 00000000 ofant+0xd588

STACK_COMMAND: .tss 0x28 ; kb

FOLLOWUP_IP:
SYMEVENT+7891
f5dac891 5f pop edi

SYMBOL_STACK_INDEX: 7

SYMBOL_NAME: SYMEVENT+7891

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SYMEVENT

IMAGE_NAME: SYMEVENT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 43cc07de

FAILURE_BUCKET_ID: 0x7f_8_SYMEVENT+7891

BUCKET_ID: 0x7f_8_SYMEVENT+7891

Followup: MachineOwner
---------

techaview · 10th April 2007

0: kd> lm
start end module name
4a680000 4a684000 csrss (deferred)
75490000 754f5000 USP10 (deferred)
75a50000 75a5b000 CSRSRV (deferred)
75a60000 75a70000 basesrv (deferred)
75a80000 75acd000 winsrv (deferred)
76f50000 76f63000 Secur32 (deferred)
77380000 77411000 USER32 (deferred)
77c00000 77c48000 GDI32 (deferred)
77c50000 77cef000 RPCRT4 (deferred)
77e40000 77f42000 KERNEL32 (deferred)
77f50000 77feb000 ADVAPI32 (deferred)
7c800000 7c8c0000 ntdll (no symbols)
7f000000 7f009000 LPK (deferred)
de000000 de1cf000 win32k (deferred)
de1cf000 de1e6000 dxg (deferred)
de1e6000 de23c680 ati2drad (deferred)
de23d000 de287000 ATMFD (deferred)
e0800000 e0a7a000 nt (pdb symbols) C:\symbols\ntkrnlmp.pdb\DA4D2E91B9E04DF9A447976D7EB8BECD2\ntkrnlmp.pdb
e0a7a000 e0aa6000 hal (deferred)
f25b3000 f25c4f20 naveng (deferred)
f25c5000 f2693740 navex15 (deferred)
f3213000 f323e000 RDPWD (deferred)
f3706000 f3711000 TDTCP (deferred)
f42ff000 f4329000 Fastfat (deferred)
f47c1000 f4811000 HTTP (deferred)
f50f1000 f51004c0 ScSBB (deferred)
f52b1000 f530e000 srv (deferred)
f5730000 f575fe60 exifs (deferred)
f5788000 f57ad700 ofant (no symbols)
f58ee000 f5903000 Cdfs (deferred)
f5903000 f5920000 EraserUtilRebootDrv (deferred)
f5920000 f5981000 eeCtrl (deferred)
f5981000 f5992000 Fips (deferred)
f5992000 f5a08000 mrxsmb (deferred)
f5a08000 f5a38000 rdbss (deferred)
f5a38000 f5a9a000 SPBBCDrv (deferred)
f5a9a000 f5ac4000 afd (deferred)
f5ac4000 f5af5000 netbt (deferred)
f5af5000 f5b1f000 ipnat (deferred)
f5b1f000 f5baf000 tcpip (deferred)
f5bd7000 f5bf0000 ipsec (deferred)
f5d91000 f5da5000 Savrtpel (deferred)
f5da5000 f5dc7000 SYMEVENT (no symbols)
f5dc7000 f5e1f000 savrt (deferred)
f5e1f000 f5e34000 usbhub (deferred)
f5eb3000 f5efd000 update (deferred)
f5efd000 f5f34000 rdpdr (deferred)
f5f84000 f5f8e000 Dxapi (deferred)
f5fa4000 f5fae000 dump_diskdump (deferred)
f5fd4000 f5fe6000 raspptp (deferred)
f5fe6000 f5fff000 ndiswan (deferred)
f5fff000 f6013000 rasl2tp (deferred)
f6013000 f6031c00 e1000325 (deferred)
f6032000 f6046000 ibmrmsst (deferred)
f6046000 f6070000 USBPORT (deferred)
f6070000 f6097000 ks (deferred)
f6097000 f60ab000 redbook (deferred)
f60ab000 f60c0000 cdrom (deferred)
f60c0000 f60d5000 serial (deferred)
f60d5000 f60ed000 parport (deferred)
f60ed000 f6100000 i8042prt (deferred)
f6100000 f611ba00 b57xp32 (deferred)
f611c000 f6138000 VIDEOPRT (deferred)
f6138000 f618bd80 ati2mpad (deferred)
f61fc000 f621b000 Mup (deferred)
f621b000 f625a000 NDIS (deferred)
f625a000 f62ef000 Ntfs (pdb symbols) C:\symbols\ntfs.pdb\DF8CD23355324E71824D94ED509B922B2\ntfs.pdb
f62ef000 f6315000 KSecDD (deferred)
f6315000 f633a000 fltmgr (pdb symbols) C:\symbols\fltMgr.pdb\89680A31E23A42F8B81765B0CCF6AC7B1\fltMgr.pdb
f633a000 f634d000 CLASSPNP (deferred)
f634d000 f635f000 AACMgt (deferred)
f635f000 f637e000 SCSIPORT (deferred)
f637e000 f63a2000 adpu320 (deferred)
f63a2000 f63bf000 atapi (deferred)
f63bf000 f63e9000 volsnap (deferred)
f63e9000 f6415000 dmio (deferred)
f6415000 f643c000 ftdisk (deferred)
f643c000 f6452000 pci (deferred)
f6452000 f6486000 ACPI (deferred)
f64a7000 f64b0000 WMILIB (deferred)
f64b7000 f64c6000 isapnp (deferred)
f64c7000 f64d4000 PCIIDEX (deferred)
f64d7000 f64e7000 MountMgr (deferred)
f64e7000 f64f2000 PartMgr (deferred)
f64f7000 f6507000 disk (deferred)
f6507000 f6513000 Dfs (deferred)
f6517000 f6521000 crcdisk (deferred)
f6547000 f6553000 vga (deferred)
f6557000 f6564000 Npfs (deferred)
f6567000 f6575000 msgpc (deferred)
f6597000 f65a2000 kbdclass (deferred)
f65a7000 f65b2000 TDI (deferred)
f65b7000 f65c0000 raspti (deferred)
f65c7000 f65d0000 ndistapi (deferred)
f65d7000 f65e0000 mssmbios (pdb symbols) C:\symbols\mssmbios.pdb\DD4D360AB16648F8B4985A9734CFA0201\mssmbios.pdb
f65e7000 f65f1000 serenum (deferred)
f65f7000 f6605000 NDProxy (deferred)
f6607000 f6612000 fdc (deferred)
f6617000 f6622000 Msfs (deferred)
f6627000 f6630000 watchdog (deferred)
f6637000 f6646000 raspppoe (deferred)
f6647000 f6654000 netbios (deferred)
f6657000 f6666000 termdd (deferred)
f6687000 f6696000 intelppm (deferred)
f66b7000 f66c4000 wanarp (deferred)
f66e7000 f66f1000 mouclass (deferred)
f66f7000 f6702000 ptilink (deferred)
f6707000 f6711000 flpydisk (deferred)
f6717000 f6723980 baspxp32 (deferred)
f6727000 f672f000 kdcom (deferred)
f672f000 f6737000 BOOTVID (deferred)
f6737000 f673e000 pciide (deferred)
f673f000 f6746000 dmload (deferred)
f6747000 f674eea0 aac (deferred)
f6797000 f679e000 parvdm (deferred)
f67a7000 f67ab400 usbohci (deferred)
f67af000 f67b7000 audstub (deferred)
f6807000 f680f000 Fs_Rec (deferred)
f680f000 f6816000 Null (deferred)
f6817000 f681e000 Beep (deferred)
f681f000 f6827000 mnmdd (deferred)
f6827000 f682f000 RDPCDD (deferred)
f682f000 f6837000 rasacd (deferred)
f686f000 f6876ea0 dump_aac (deferred)
f6877000 f687e000 dxgthk (deferred)
f68af000 f68b3840 ImbDrvNT (deferred)
f69b5000 f69b6280 swenum (deferred)
f69bd000 f69be580 USBD (deferred)
f69cd000 f69ce4c0 BASFND (deferred)

Unloaded modules:
f25b3000 f25c5000 naveng.sys
f25c5000 f2694000 navex15.sys
f25b3000 f25c5000 naveng.sys
f25c5000 f2694000 navex15.sys
f27d4000 f27e6000 naveng.sys
f27e6000 f28b5000 navex15.sys
f27d4000 f27e6000 naveng.sys
f27e6000 f28b5000 navex15.sys
f29b0000 f29c2000 naveng.sys
f29c2000 f2a91000 navex15.sys
f29b0000 f29c2000 naveng.sys
f29c2000 f2a91000 navex15.sys
f29b0000 f29c2000 naveng.sys
f29c2000 f2a91000 navex15.sys
f3132000 f3144000 naveng.sys
f3144000 f3213000 navex15.sys
f5cb0000 f5cc2000 naveng.sys
f5cc2000 f5d91000 navex15.sys
f5fc4000 f5fd2000 imapi.sys
f67cf000 f67d7000 Sfloppy.SYS

cpc2004 · 11th April 2007

The crash instruction is push. Probably it is stack overflow but I need the output of !thread and !lm tn to confirm.

Quote:

Originally Posted by techaview

Hi recently my exchange server restarted with BSOD and generated a crash dump. below is the output with !anyalze -v and lmv. My server is windows 2003 sp1. Is it the same as this? Win2003 SE SP1 Dump Help. Thanks in advance

_________________________________________________________________
0: kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: e0042000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------

BUGCHECK_STR: 0x7f_8

TSS: 00000028 -- (.tss 28)
eax=fa4f3020 ebx=00000000 ecx=f27c1cc0 edx=102b1001 esi=f27c1048 edi=fb2111a0
eip=f626006f esp=f27c1000 ebp=f27c1004 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
Ntfs!NtfsCleanupIrpContext+0x6:
f626006f 56 push esi
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 1

LAST_CONTROL_TRANSFER: from f625c2d7 to f626006f

STACK_TEXT:
f27c1004 f625c2d7 f27c1048 00000000 fb2111a0 Ntfs!NtfsCleanupIrpContext+0x6
f27c1020 f625c288 f27c1048 fa2595b8 00000001 Ntfs!NtfsPrePostIrpInternal+0x48
f27c1038 f62694cc f27c1048 fa2595b8 0108070a Ntfs!NtfsPrePostIrp+0x14
f27c11e0 e0840153 fb334438 fa2595b8 fa2595b8 Ntfs!NtfsFsdRead+0x1ea
f27c11f4 f6319d28 fac904a8 fb32e578 fa259790 nt!IofCallDriver+0x45
f27c1220 e0840153 fb356020 fa2595b8 fa2597b4 fltmgr!FltpDispatch+0x152
f27c1234 f5dac891 faa08020 fb08c230 facc2c18 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may be wrong.
f27c1248 e0840153 fb126f10 fa2595b8 fa2595b8 SYMEVENT+0x7891
f27c125c f6319d28 fa259790 fb32e578 fa2597b4 nt!IofCallDriver+0x45
f27c1288 e0840153 faa08020 fa2595b8 fa2595b8 fltmgr!FltpDispatch+0x152
f27c129c f5795a00 faa00898 fa2595b8 f27c12fc nt!IofCallDriver+0x45
f27c12b0 f5795588 faa00898 fa2595b8 00000000 ofant+0xda00
00000000 00000000 00000000 00000000 00000000 ofant+0xd588

STACK_COMMAND: .tss 0x28 ; kb

FOLLOWUP_IP:
SYMEVENT+7891
f5dac891 5f pop edi

SYMBOL_STACK_INDEX: 7

SYMBOL_NAME: SYMEVENT+7891

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SYMEVENT

IMAGE_NAME: SYMEVENT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 43cc07de

FAILURE_BUCKET_ID: 0x7f_8_SYMEVENT+7891

BUCKET_ID: 0x7f_8_SYMEVENT+7891

Followup: MachineOwner
---------

techaview · 11th April 2007

!thread and lm tn as requested. thanks!

0: kd> !thread
THREAD fa4f3020 Cid 11ac.222c Teb: 7fffe000 Win32Thread: e6235008 RUNNING on processor 0
IRP List:
f9a040f8: (0006,0220) Flags: 00000884 Mdl: 00000000
Not impersonating
DeviceMap e1800930
Owning Process f9dd9d88 Image: csrss.exe
Wait Start TickCount 2320641 Ticks: 0
Context Switch Count 166 LargeStack
UserTime 00:00:00.0000
KernelTime 00:00:00.0078
*** ERROR: Module load completed but symbols could not be loaded for csrss.exe
Start Address csrss (0x4a6810ea)
Stack Init f27c4000 Current f27c1d88 Base f27c4000 Limit f27c1000 Call 0
Priority 14 BasePriority 13 PriorityDecrement 0
ChildEBP RetAddr Args to Child
00000000 f626006f 00000000 00000000 00000000 nt!KiTrap08+0x75 (FPO: TSS 28:0)
f27c1004 f625c2d7 f27c1048 00000000 fb2111a0 Ntfs!NtfsCleanupIrpContext+0x6 (FPO: [Non-Fpo])
f27c1020 f625c288 f27c1048 fa2595b8 00000001 Ntfs!NtfsPrePostIrpInternal+0x48 (FPO: [Non-Fpo])
f27c1038 f62694cc f27c1048 fa2595b8 0108070a Ntfs!NtfsPrePostIrp+0x14 (FPO: [Non-Fpo])
f27c11e0 e0840153 fb334438 fa2595b8 fa2595b8 Ntfs!NtfsFsdRead+0x1ea (FPO: [Non-Fpo])
f27c11f4 f6319d28 fac904a8 fb32e578 fa259790 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
f27c1220 e0840153 fb356020 fa2595b8 fa2597b4 fltmgr!FltpDispatch+0x152 (FPO: [Non-Fpo])
f27c1234 f5dac891 faa08020 fb08c230 facc2c18 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
f27c1248 e0840153 fb126f10 fa2595b8 fa2595b8 SYMEVENT+0x7891
f27c125c f6319d28 fa259790 fb32e578 fa2597b4 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
f27c1288 e0840153 faa08020 fa2595b8 fa2595b8 fltmgr!FltpDispatch+0x152 (FPO: [Non-Fpo])
f27c129c f5795a00 faa00898 fa2595b8 f27c12fc nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
f27c12b0 f5795588 faa00898 fa2595b8 00000000 ofant+0xda00
00000000 00000000 00000000 00000000 00000000 ofant+0xd588

0: kd> lm tn
start end module name
4a680000 4a684000 csrss csrss.exe Tue Mar 25 15:12:32 2003 (3E800160)
75490000 754f5000 USP10 USP10.dll Sat Feb 17 22:01:45 2007 (45D70AC9)
75a50000 75a5b000 CSRSRV CSRSRV.dll Sat Feb 17 22:00:41 2007 (45D70A89)
75a60000 75a70000 basesrv basesrv.dll Sat Feb 17 21:58:44 2007 (45D70A14)
75a80000 75acd000 winsrv winsrv.dll Sat Feb 17 22:01:48 2007 (45D70ACC)
76f50000 76f63000 Secur32 Secur32.dll Sat Feb 17 22:01:39 2007 (45D70AC3)
77380000 77411000 USER32 USER32.dll Sat Feb 17 22:01:43 2007 (45D70AC7)
77c00000 77c48000 GDI32 GDI32.dll Sat Feb 17 21:59:26 2007 (45D70A3E)
77c50000 77cef000 RPCRT4 RPCRT4.dll Sat Feb 17 22:01:14 2007 (45D70AAA)
77e40000 77f42000 KERNEL32 KERNEL32.dll Sat Feb 17 22:02:00 2007 (45D70AD8)
77f50000 77feb000 ADVAPI32 ADVAPI32.dll Sat Feb 17 21:59:02 2007 (45D70A26)
7c800000 7c8c0000 ntdll ntdll.dll Sat Feb 17 22:02:00 2007 (45D70AD8)
7f000000 7f009000 LPK LPK.DLL Sat Feb 17 21:59:59 2007 (45D70A5F)
de000000 de1cf000 win32k win32k.sys Sat Feb 17 14:31:05 2007 (45D6A129)
de1cf000 de1e6000 dxg dxg.sys Sat Feb 17 14:14:39 2007 (45D69D4F)
de1e6000 de23c680 ati2drad ati2drad.dll Sat Feb 17 21:59:26 2007 (45D70A3E)
de23d000 de287000 ATMFD ATMFD.DLL Sat Feb 17 21:59:31 2007 (45D70A43)
e0800000 e0a7a000 nt ntkrnlmp.exe Sat Feb 17 14:29:03 2007 (45D6A0AF)
e0a7a000 e0aa6000 hal halmacpi.dll Sat Feb 17 13:48:26 2007 (45D6972A)
f25b3000 f25c4f20 naveng naveng.sys Tue Jan 23 09:05:17 2007 (45B55F4D)
f25c5000 f2693740 navex15 navex15.sys Tue Jan 23 09:39:38 2007 (45B5675A)
f3213000 f323e000 RDPWD RDPWD.SYS Sat Feb 17 13:44:38 2007 (45D69646)
f3706000 f3711000 TDTCP TDTCP.SYS Sat Feb 17 13:44:32 2007 (45D69640)
f42ff000 f4329000 Fastfat Fastfat.SYS Sat Feb 17 14:27:55 2007 (45D6A06B)
f47c1000 f4811000 HTTP HTTP.sys Sat Feb 17 14:28:12 2007 (45D6A07C)
f50f1000 f51004c0 ScSBB ScSBB.sys Fri Oct 01 23:59:10 2004 (415D7ECE)
f52b1000 f530e000 srv srv.sys Sat Feb 17 14:27:20 2007 (45D6A048)
f5730000 f575fe60 exifs exifs.sys Fri Aug 26 08:29:05 2005 (430E6251)
f5788000 f57ad700 ofant ofant.sys Thu Jul 22 07:11:23 2004 (40FEF81B)
f58ee000 f5903000 Cdfs Cdfs.SYS Sat Feb 17 14:27:08 2007 (45D6A03C)
f5903000 f5920000 EraserUtilRebootDrv EraserUtilRebootDrv.sys Thu Feb 01 08:54:39 2007 (45C13A4F)
f5920000 f5981000 eeCtrl eeCtrl.sys Thu Feb 01 08:54:39 2007 (45C13A4F)
f5981000 f5992000 Fips Fips.SYS Sat Feb 17 14:26:33 2007 (45D6A019)
f5992000 f5a08000 mrxsmb mrxsmb.sys Sat Feb 17 14:28:15 2007 (45D6A07F)
f5a08000 f5a38000 rdbss rdbss.sys Sat Feb 17 14:27:37 2007 (45D6A059)
f5a38000 f5a9a000 SPBBCDrv SPBBCDrv.sys Tue Feb 07 04:34:12 2006 (43E7B2C4)
f5a9a000 f5ac4000 afd afd.sys Sat Feb 17 14:28:16 2007 (45D6A080)
f5ac4000 f5af5000 netbt netbt.sys Sat Feb 17 14:28:57 2007 (45D6A0A9)
f5af5000 f5b1f000 ipnat ipnat.sys Sat Feb 17 13:59:08 2007 (45D699AC)
f5b1f000 f5baf000 tcpip tcpip.sys Sat Feb 17 14:28:05 2007 (45D6A075)
f5bd7000 f5bf0000 ipsec ipsec.sys Sat Feb 17 14:29:28 2007 (45D6A0C8)
f5d91000 f5da5000 Savrtpel Savrtpel.sys Tue Dec 20 12:24:50 2005 (43A78792)
f5da5000 f5dc7000 SYMEVENT SYMEVENT.SYS Tue Jan 17 04:53:50 2006 (43CC07DE)
f5dc7000 f5e1f000 savrt savrt.sys Tue Dec 20 12:24:48 2005 (43A78790)
f5e1f000 f5e34000 usbhub usbhub.sys Sat Feb 17 14:13:05 2007 (45D69CF1)
f5eb3000 f5efd000 update update.sys Sat Feb 17 14:28:59 2007 (45D6A0AB)
f5efd000 f5f34000 rdpdr rdpdr.sys Sat Feb 17 13:51:00 2007 (45D697C4)
f5f84000 f5f8e000 Dxapi Dxapi.sys Tue Mar 25 15:06:01 2003 (3E7FFFD9)
f5fa4000 f5fae000 dump_diskdump dump_diskdump.sys Sat Feb 17 14:07:44 2007 (45D69BB0)
f5fd4000 f5fe6000 raspptp raspptp.sys Sat Feb 17 14:29:20 2007 (45D6A0C0)
f5fe6000 f5fff000 ndiswan ndiswan.sys Sat Feb 17 14:29:22 2007 (45D6A0C2)
f5fff000 f6013000 rasl2tp rasl2tp.sys Sat Feb 17 14:29:02 2007 (45D6A0AE)
f6013000 f6031c00 e1000325 e1000325.sys Fri Aug 15 05:46:47 2003 (3F3C0347)
f6032000 f6046000 ibmrmsst ibmrmsst.sys Fri Dec 12 07:41:34 2003 (3FD900AE)
f6046000 f6070000 USBPORT USBPORT.SYS Sat Feb 17 14:12:59 2007 (45D69CEB)
f6070000 f6097000 ks ks.sys Sat Feb 17 14:30:40 2007 (45D6A110)
f6097000 f60ab000 redbook redbook.sys Sat Feb 17 14:07:26 2007 (45D69B9E)
f60ab000 f60c0000 cdrom cdrom.sys Sat Feb 17 14:07:48 2007 (45D69BB4)
f60c0000 f60d5000 serial serial.sys Sat Feb 17 14:06:46 2007 (45D69B76)
f60d5000 f60ed000 parport parport.sys Sat Feb 17 14:06:42 2007 (45D69B72)
f60ed000 f6100000 i8042prt i8042prt.sys Sat Feb 17 14:30:40 2007 (45D6A110)
f6100000 f611ba00 b57xp32 b57xp32.sys Tue Feb 03 10:18:55 2004 (401F050F)
f611c000 f6138000 VIDEOPRT VIDEOPRT.SYS Sat Feb 17 14:10:30 2007 (45D69C56)
f6138000 f618bd80 ati2mpad ati2mpad.sys Fri Jul 19 09:13:20 2002 (3D3767B0)
f61fc000 f621b000 Mup Mup.sys Sat Feb 17 14:27:41 2007 (45D6A05D)
f621b000 f625a000 NDIS NDIS.sys Sat Feb 17 14:28:49 2007 (45D6A0A1)
f625a000 f62ef000 Ntfs Ntfs.sys Sat Feb 17 14:27:23 2007 (45D6A04B)
f62ef000 f6315000 KSecDD KSecDD.sys Sat Feb 17 13:46:32 2007 (45D696B8)
f6315000 f633a000 fltmgr fltmgr.sys Sat Feb 17 13:51:08 2007 (45D697CC)
f633a000 f634d000 CLASSPNP CLASSPNP.SYS Sat Feb 17 14:28:16 2007 (45D6A080)
f634d000 f635f000 AACMgt AACMgt.sys unavailable (FFFFFFFE)
f635f000 f637e000 SCSIPORT SCSIPORT.SYS unavailable (FFFFFFFE)
f637e000 f63a2000 adpu320 adpu320.sys unavailable (FFFFFFFE)
f63a2000 f63bf000 atapi atapi.sys unavailable (FFFFFFFE)
f63bf000 f63e9000 volsnap volsnap.sys unavailable (FFFFFFFE)
f63e9000 f6415000 dmio dmio.sys unavailable (FFFFFFFE)
f6415000 f643c000 ftdisk ftdisk.sys unavailable (FFFFFFFE)
f643c000 f6452000 pci pci.sys unavailable (FFFFFFFE)
f6452000 f6486000 ACPI ACPI.sys unavailable (FFFFFFFE)
f64a7000 f64b0000 WMILIB WMILIB.SYS unavailable (FFFFFFFE)
f64b7000 f64c6000 isapnp isapnp.sys unavailable (FFFFFFFE)
f64c7000 f64d4000 PCIIDEX PCIIDEX.SYS unavailable (FFFFFFFE)
f64d7000 f64e7000 MountMgr MountMgr.sys unavailable (FFFFFFFE)
f64e7000 f64f2000 PartMgr PartMgr.sys unavailable (FFFFFFFE)
f64f7000 f6507000 disk disk.sys Sat Feb 17 14:07:51 2007 (45D69BB7)
f6507000 f6513000 Dfs Dfs.sys Sat Feb 17 13:51:17 2007 (45D697D5)
f6517000 f6521000 crcdisk crcdisk.sys Sat Feb 17 14:09:50 2007 (45D69C2E)
f6547000 f6553000 vga vga.sys Sat Feb 17 14:10:30 2007 (45D69C56)
f6557000 f6564000 Npfs Npfs.SYS Sat Feb 17 13:50:36 2007 (45D697AC)
f6567000 f6575000 msgpc msgpc.sys Sat Feb 17 13:58:37 2007 (45D6998D)
f6597000 f65a2000 kbdclass kbdclass.sys Sat Feb 17 14:05:39 2007 (45D69B33)
f65a7000 f65b2000 TDI TDI.SYS Sat Feb 17 14:01:19 2007 (45D69A2F)
f65b7000 f65c0000 raspti raspti.sys Sat Feb 17 13:59:23 2007 (45D699BB)
f65c7000 f65d0000 ndistapi ndistapi.sys Sat Feb 17 13:59:19 2007 (45D699B7)
f65d7000 f65e0000 mssmbios mssmbios.sys Sat Feb 17 13:59:12 2007 (45D699B0)
f65e7000 f65f1000 serenum serenum.sys Sat Feb 17 14:06:44 2007 (45D69B74)
f65f7000 f6605000 NDProxy NDProxy.SYS Sat Feb 17 13:59:21 2007 (45D699B9)
f6607000 f6612000 fdc fdc.sys Sat Feb 17 14:07:16 2007 (45D69B94)
f6617000 f6622000 Msfs Msfs.SYS Sat Feb 17 13:50:33 2007 (45D697A9)
f6627000 f6630000 watchdog watchdog.sys Sat Feb 17 14:11:45 2007 (45D69CA1)
f6637000 f6646000 raspppoe raspppoe.sys Sat Feb 17 13:59:23 2007 (45D699BB)
f6647000 f6654000 netbios netbios.sys Sat Feb 17 13:58:29 2007 (45D69985)
f6657000 f6666000 termdd termdd.sys Sat Feb 17 13:44:32 2007 (45D69640)
f6687000 f6696000 intelppm intelppm.sys Sat Feb 17 13:48:30 2007 (45D6972E)
f66b7000 f66c4000 wanarp wanarp.sys Sat Feb 17 13:59:17 2007 (45D699B5)
f66e7000 f66f1000 mouclass mouclass.sys Tue Mar 25 15:03:09 2003 (3E7FFF2D)
f66f7000 f6702000 ptilink ptilink.sys Sat Feb 17 14:06:38 2007 (45D69B6E)
f6707000 f6711000 flpydisk flpydisk.sys Tue Mar 25 15:04:32 2003 (3E7FFF80)
f6717000 f6723980 baspxp32 baspxp32.sys Thu Feb 05 03:34:15 2004 (40214937)
f6727000 f672f000 kdcom KDCOM.DLL unavailable (FFFFFFFE)
f672f000 f6737000 BOOTVID BOOTVID.dll unavailable (FFFFFFFE)
f6737000 f673e000 pciide pciide.sys unavailable (FFFFFFFE)
f673f000 f6746000 dmload dmload.sys unavailable (FFFFFFFE)
f6747000 f674eea0 aac aac.sys Fri Jun 04 13:40:14 2004 (40C00B3E)
f6797000 f679e000 parvdm parvdm.sys Tue Mar 25 15:03:49 2003 (3E7FFF55)
f67a7000 f67ab400 usbohci usbohci.sys Sat Feb 17 14:13:01 2007 (45D69CED)
f67af000 f67b7000 audstub audstub.sys Tue Mar 25 15:09:12 2003 (3E800098)
f6807000 f680f000 Fs_Rec Fs_Rec.SYS Tue Mar 25 15:08:36 2003 (3E800074)
f680f000 f6816000 Null Null.SYS Tue Mar 25 15:03:05 2003 (3E7FFF29)
f6817000 f681e000 Beep Beep.SYS Tue Mar 25 15:03:04 2003 (3E7FFF28)
f681f000 f6827000 mnmdd mnmdd.SYS Tue Mar 25 15:07:53 2003 (3E800049)
f6827000 f682f000 RDPCDD RDPCDD.sys Tue Mar 25 15:03:05 2003 (3E7FFF29)
f682f000 f6837000 rasacd rasacd.sys Tue Mar 25 15:11:50 2003 (3E800136)
f686f000 f6876ea0 dump_aac dump_aac.sys Fri Jun 04 13:40:14 2004 (40C00B3E)
f6877000 f687e000 dxgthk dxgthk.sys Tue Mar 25 15:05:52 2003 (3E7FFFD0)
f68af000 f68b3840 ImbDrvNT ImbDrvNT.sys Fri Oct 01 23:35:22 2004 (415D793A)
f69b5000 f69b6280 swenum swenum.sys Sat Feb 17 14:05:56 2007 (45D69B44)
f69bd000 f69be580 USBD USBD.SYS Tue Mar 25 15:10:39 2003 (3E8000EF)
f69cd000 f69ce4c0 BASFND BASFND.sys Fri Apr 25 07:16:49 2003 (3EA87061)

Unloaded modules:
f25b3000 f25c5000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f25c5000 f2694000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f25b3000 f25c5000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f25c5000 f2694000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f27d4000 f27e6000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f27e6000 f28b5000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f27d4000 f27e6000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f27e6000 f28b5000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f29b0000 f29c2000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f29c2000 f2a91000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f29b0000 f29c2000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f29c2000 f2a91000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f29b0000 f29c2000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f29c2000 f2a91000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f3132000 f3144000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f3144000 f3213000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f5cb0000 f5cc2000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f5cc2000 f5d91000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f5fc4000 f5fd2000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f67cf000 f67d7000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000

cpc2004 · 12th April 2007

According to the output of !threadm the stack limit is f27c1000 and the value of ESP is f27c1000. I confirm it is stack overflow issue. Extend the size of the stack will resolve your problem.

>>>>
Stack Init f27c4000 Current f27c1d88 Base f27c4000 Limit f27c1000 Call 0
>>>>

Quote:

Originally Posted by techaview

!thread and lm tn as requested. thanks!

0: kd> !thread
THREAD fa4f3020 Cid 11ac.222c Teb: 7fffe000 Win32Thread: e6235008 RUNNING on processor 0
IRP List:
f9a040f8: (0006,0220) Flags: 00000884 Mdl: 00000000
Not impersonating
DeviceMap e1800930
Owning Process f9dd9d88 Image: csrss.exe
Wait Start TickCount 2320641 Ticks: 0
Context Switch Count 166 LargeStack
UserTime 00:00:00.0000
KernelTime 00:00:00.0078
*** ERROR: Module load completed but symbols could not be loaded for csrss.exe
Start Address csrss (0x4a6810ea)
Stack Init f27c4000 Current f27c1d88 Base f27c4000 Limit f27c1000 Call 0
Priority 14 BasePriority 13 PriorityDecrement 0
ChildEBP RetAddr Args to Child
00000000 f626006f 00000000 00000000 00000000 nt!KiTrap08+0x75 (FPO: TSS 28:0)
f27c1004 f625c2d7 f27c1048 00000000 fb2111a0 Ntfs!NtfsCleanupIrpContext+0x6 (FPO: [Non-Fpo])
f27c1020 f625c288 f27c1048 fa2595b8 00000001 Ntfs!NtfsPrePostIrpInternal+0x48 (FPO: [Non-Fpo])
f27c1038 f62694cc f27c1048 fa2595b8 0108070a Ntfs!NtfsPrePostIrp+0x14 (FPO: [Non-Fpo])
f27c11e0 e0840153 fb334438 fa2595b8 fa2595b8 Ntfs!NtfsFsdRead+0x1ea (FPO: [Non-Fpo])
f27c11f4 f6319d28 fac904a8 fb32e578 fa259790 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
f27c1220 e0840153 fb356020 fa2595b8 fa2597b4 fltmgr!FltpDispatch+0x152 (FPO: [Non-Fpo])
f27c1234 f5dac891 faa08020 fb08c230 facc2c18 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
f27c1248 e0840153 fb126f10 fa2595b8 fa2595b8 SYMEVENT+0x7891
f27c125c f6319d28 fa259790 fb32e578 fa2597b4 nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
f27c1288 e0840153 faa08020 fa2595b8 fa2595b8 fltmgr!FltpDispatch+0x152 (FPO: [Non-Fpo])
f27c129c f5795a00 faa00898 fa2595b8 f27c12fc nt!IofCallDriver+0x45 (FPO: [Non-Fpo])
f27c12b0 f5795588 faa00898 fa2595b8 00000000 ofant+0xda00
00000000 00000000 00000000 00000000 00000000 ofant+0xd588

0: kd> lm tn
start end module name
4a680000 4a684000 csrss csrss.exe Tue Mar 25 15:12:32 2003 (3E800160)
75490000 754f5000 USP10 USP10.dll Sat Feb 17 22:01:45 2007 (45D70AC9)
75a50000 75a5b000 CSRSRV CSRSRV.dll Sat Feb 17 22:00:41 2007 (45D70A89)
75a60000 75a70000 basesrv basesrv.dll Sat Feb 17 21:58:44 2007 (45D70A14)
75a80000 75acd000 winsrv winsrv.dll Sat Feb 17 22:01:48 2007 (45D70ACC)
76f50000 76f63000 Secur32 Secur32.dll Sat Feb 17 22:01:39 2007 (45D70AC3)
77380000 77411000 USER32 USER32.dll Sat Feb 17 22:01:43 2007 (45D70AC7)
77c00000 77c48000 GDI32 GDI32.dll Sat Feb 17 21:59:26 2007 (45D70A3E)
77c50000 77cef000 RPCRT4 RPCRT4.dll Sat Feb 17 22:01:14 2007 (45D70AAA)
77e40000 77f42000 KERNEL32 KERNEL32.dll Sat Feb 17 22:02:00 2007 (45D70AD8)
77f50000 77feb000 ADVAPI32 ADVAPI32.dll Sat Feb 17 21:59:02 2007 (45D70A26)
7c800000 7c8c0000 ntdll ntdll.dll Sat Feb 17 22:02:00 2007 (45D70AD8)
7f000000 7f009000 LPK LPK.DLL Sat Feb 17 21:59:59 2007 (45D70A5F)
de000000 de1cf000 win32k win32k.sys Sat Feb 17 14:31:05 2007 (45D6A129)
de1cf000 de1e6000 dxg dxg.sys Sat Feb 17 14:14:39 2007 (45D69D4F)
de1e6000 de23c680 ati2drad ati2drad.dll Sat Feb 17 21:59:26 2007 (45D70A3E)
de23d000 de287000 ATMFD ATMFD.DLL Sat Feb 17 21:59:31 2007 (45D70A43)
e0800000 e0a7a000 nt ntkrnlmp.exe Sat Feb 17 14:29:03 2007 (45D6A0AF)
e0a7a000 e0aa6000 hal halmacpi.dll Sat Feb 17 13:48:26 2007 (45D6972A)
f25b3000 f25c4f20 naveng naveng.sys Tue Jan 23 09:05:17 2007 (45B55F4D)
f25c5000 f2693740 navex15 navex15.sys Tue Jan 23 09:39:38 2007 (45B5675A)
f3213000 f323e000 RDPWD RDPWD.SYS Sat Feb 17 13:44:38 2007 (45D69646)
f3706000 f3711000 TDTCP TDTCP.SYS Sat Feb 17 13:44:32 2007 (45D69640)
f42ff000 f4329000 Fastfat Fastfat.SYS Sat Feb 17 14:27:55 2007 (45D6A06B)
f47c1000 f4811000 HTTP HTTP.sys Sat Feb 17 14:28:12 2007 (45D6A07C)
f50f1000 f51004c0 ScSBB ScSBB.sys Fri Oct 01 23:59:10 2004 (415D7ECE)
f52b1000 f530e000 srv srv.sys Sat Feb 17 14:27:20 2007 (45D6A048)
f5730000 f575fe60 exifs exifs.sys Fri Aug 26 08:29:05 2005 (430E6251)
f5788000 f57ad700 ofant ofant.sys Thu Jul 22 07:11:23 2004 (40FEF81B)
f58ee000 f5903000 Cdfs Cdfs.SYS Sat Feb 17 14:27:08 2007 (45D6A03C)
f5903000 f5920000 EraserUtilRebootDrv EraserUtilRebootDrv.sys Thu Feb 01 08:54:39 2007 (45C13A4F)
f5920000 f5981000 eeCtrl eeCtrl.sys Thu Feb 01 08:54:39 2007 (45C13A4F)
f5981000 f5992000 Fips Fips.SYS Sat Feb 17 14:26:33 2007 (45D6A019)
f5992000 f5a08000 mrxsmb mrxsmb.sys Sat Feb 17 14:28:15 2007 (45D6A07F)
f5a08000 f5a38000 rdbss rdbss.sys Sat Feb 17 14:27:37 2007 (45D6A059)
f5a38000 f5a9a000 SPBBCDrv SPBBCDrv.sys Tue Feb 07 04:34:12 2006 (43E7B2C4)
f5a9a000 f5ac4000 afd afd.sys Sat Feb 17 14:28:16 2007 (45D6A080)
f5ac4000 f5af5000 netbt netbt.sys Sat Feb 17 14:28:57 2007 (45D6A0A9)
f5af5000 f5b1f000 ipnat ipnat.sys Sat Feb 17 13:59:08 2007 (45D699AC)
f5b1f000 f5baf000 tcpip tcpip.sys Sat Feb 17 14:28:05 2007 (45D6A075)
f5bd7000 f5bf0000 ipsec ipsec.sys Sat Feb 17 14:29:28 2007 (45D6A0C8)
f5d91000 f5da5000 Savrtpel Savrtpel.sys Tue Dec 20 12:24:50 2005 (43A78792)
f5da5000 f5dc7000 SYMEVENT SYMEVENT.SYS Tue Jan 17 04:53:50 2006 (43CC07DE)
f5dc7000 f5e1f000 savrt savrt.sys Tue Dec 20 12:24:48 2005 (43A78790)
f5e1f000 f5e34000 usbhub usbhub.sys Sat Feb 17 14:13:05 2007 (45D69CF1)
f5eb3000 f5efd000 update update.sys Sat Feb 17 14:28:59 2007 (45D6A0AB)
f5efd000 f5f34000 rdpdr rdpdr.sys Sat Feb 17 13:51:00 2007 (45D697C4)
f5f84000 f5f8e000 Dxapi Dxapi.sys Tue Mar 25 15:06:01 2003 (3E7FFFD9)
f5fa4000 f5fae000 dump_diskdump dump_diskdump.sys Sat Feb 17 14:07:44 2007 (45D69BB0)
f5fd4000 f5fe6000 raspptp raspptp.sys Sat Feb 17 14:29:20 2007 (45D6A0C0)
f5fe6000 f5fff000 ndiswan ndiswan.sys Sat Feb 17 14:29:22 2007 (45D6A0C2)
f5fff000 f6013000 rasl2tp rasl2tp.sys Sat Feb 17 14:29:02 2007 (45D6A0AE)
f6013000 f6031c00 e1000325 e1000325.sys Fri Aug 15 05:46:47 2003 (3F3C0347)
f6032000 f6046000 ibmrmsst ibmrmsst.sys Fri Dec 12 07:41:34 2003 (3FD900AE)
f6046000 f6070000 USBPORT USBPORT.SYS Sat Feb 17 14:12:59 2007 (45D69CEB)
f6070000 f6097000 ks ks.sys Sat Feb 17 14:30:40 2007 (45D6A110)
f6097000 f60ab000 redbook redbook.sys Sat Feb 17 14:07:26 2007 (45D69B9E)
f60ab000 f60c0000 cdrom cdrom.sys Sat Feb 17 14:07:48 2007 (45D69BB4)
f60c0000 f60d5000 serial serial.sys Sat Feb 17 14:06:46 2007 (45D69B76)
f60d5000 f60ed000 parport parport.sys Sat Feb 17 14:06:42 2007 (45D69B72)
f60ed000 f6100000 i8042prt i8042prt.sys Sat Feb 17 14:30:40 2007 (45D6A110)
f6100000 f611ba00 b57xp32 b57xp32.sys Tue Feb 03 10:18:55 2004 (401F050F)
f611c000 f6138000 VIDEOPRT VIDEOPRT.SYS Sat Feb 17 14:10:30 2007 (45D69C56)
f6138000 f618bd80 ati2mpad ati2mpad.sys Fri Jul 19 09:13:20 2002 (3D3767B0)
f61fc000 f621b000 Mup Mup.sys Sat Feb 17 14:27:41 2007 (45D6A05D)
f621b000 f625a000 NDIS NDIS.sys Sat Feb 17 14:28:49 2007 (45D6A0A1)
f625a000 f62ef000 Ntfs Ntfs.sys Sat Feb 17 14:27:23 2007 (45D6A04B)
f62ef000 f6315000 KSecDD KSecDD.sys Sat Feb 17 13:46:32 2007 (45D696B8)
f6315000 f633a000 fltmgr fltmgr.sys Sat Feb 17 13:51:08 2007 (45D697CC)
f633a000 f634d000 CLASSPNP CLASSPNP.SYS Sat Feb 17 14:28:16 2007 (45D6A080)
f634d000 f635f000 AACMgt AACMgt.sys unavailable (FFFFFFFE)
f635f000 f637e000 SCSIPORT SCSIPORT.SYS unavailable (FFFFFFFE)
f637e000 f63a2000 adpu320 adpu320.sys unavailable (FFFFFFFE)
f63a2000 f63bf000 atapi atapi.sys unavailable (FFFFFFFE)
f63bf000 f63e9000 volsnap volsnap.sys unavailable (FFFFFFFE)
f63e9000 f6415000 dmio dmio.sys unavailable (FFFFFFFE)
f6415000 f643c000 ftdisk ftdisk.sys unavailable (FFFFFFFE)
f643c000 f6452000 pci pci.sys unavailable (FFFFFFFE)
f6452000 f6486000 ACPI ACPI.sys unavailable (FFFFFFFE)
f64a7000 f64b0000 WMILIB WMILIB.SYS unavailable (FFFFFFFE)
f64b7000 f64c6000 isapnp isapnp.sys unavailable (FFFFFFFE)
f64c7000 f64d4000 PCIIDEX PCIIDEX.SYS unavailable (FFFFFFFE)
f64d7000 f64e7000 MountMgr MountMgr.sys unavailable (FFFFFFFE)
f64e7000 f64f2000 PartMgr PartMgr.sys unavailable (FFFFFFFE)
f64f7000 f6507000 disk disk.sys Sat Feb 17 14:07:51 2007 (45D69BB7)
f6507000 f6513000 Dfs Dfs.sys Sat Feb 17 13:51:17 2007 (45D697D5)
f6517000 f6521000 crcdisk crcdisk.sys Sat Feb 17 14:09:50 2007 (45D69C2E)
f6547000 f6553000 vga vga.sys Sat Feb 17 14:10:30 2007 (45D69C56)
f6557000 f6564000 Npfs Npfs.SYS Sat Feb 17 13:50:36 2007 (45D697AC)
f6567000 f6575000 msgpc msgpc.sys Sat Feb 17 13:58:37 2007 (45D6998D)
f6597000 f65a2000 kbdclass kbdclass.sys Sat Feb 17 14:05:39 2007 (45D69B33)
f65a7000 f65b2000 TDI TDI.SYS Sat Feb 17 14:01:19 2007 (45D69A2F)
f65b7000 f65c0000 raspti raspti.sys Sat Feb 17 13:59:23 2007 (45D699BB)
f65c7000 f65d0000 ndistapi ndistapi.sys Sat Feb 17 13:59:19 2007 (45D699B7)
f65d7000 f65e0000 mssmbios mssmbios.sys Sat Feb 17 13:59:12 2007 (45D699B0)
f65e7000 f65f1000 serenum serenum.sys Sat Feb 17 14:06:44 2007 (45D69B74)
f65f7000 f6605000 NDProxy NDProxy.SYS Sat Feb 17 13:59:21 2007 (45D699B9)
f6607000 f6612000 fdc fdc.sys Sat Feb 17 14:07:16 2007 (45D69B94)
f6617000 f6622000 Msfs Msfs.SYS Sat Feb 17 13:50:33 2007 (45D697A9)
f6627000 f6630000 watchdog watchdog.sys Sat Feb 17 14:11:45 2007 (45D69CA1)
f6637000 f6646000 raspppoe raspppoe.sys Sat Feb 17 13:59:23 2007 (45D699BB)
f6647000 f6654000 netbios netbios.sys Sat Feb 17 13:58:29 2007 (45D69985)
f6657000 f6666000 termdd termdd.sys Sat Feb 17 13:44:32 2007 (45D69640)
f6687000 f6696000 intelppm intelppm.sys Sat Feb 17 13:48:30 2007 (45D6972E)
f66b7000 f66c4000 wanarp wanarp.sys Sat Feb 17 13:59:17 2007 (45D699B5)
f66e7000 f66f1000 mouclass mouclass.sys Tue Mar 25 15:03:09 2003 (3E7FFF2D)
f66f7000 f6702000 ptilink ptilink.sys Sat Feb 17 14:06:38 2007 (45D69B6E)
f6707000 f6711000 flpydisk flpydisk.sys Tue Mar 25 15:04:32 2003 (3E7FFF80)
f6717000 f6723980 baspxp32 baspxp32.sys Thu Feb 05 03:34:15 2004 (40214937)
f6727000 f672f000 kdcom KDCOM.DLL unavailable (FFFFFFFE)
f672f000 f6737000 BOOTVID BOOTVID.dll unavailable (FFFFFFFE)
f6737000 f673e000 pciide pciide.sys unavailable (FFFFFFFE)
f673f000 f6746000 dmload dmload.sys unavailable (FFFFFFFE)
f6747000 f674eea0 aac aac.sys Fri Jun 04 13:40:14 2004 (40C00B3E)
f6797000 f679e000 parvdm parvdm.sys Tue Mar 25 15:03:49 2003 (3E7FFF55)
f67a7000 f67ab400 usbohci usbohci.sys Sat Feb 17 14:13:01 2007 (45D69CED)
f67af000 f67b7000 audstub audstub.sys Tue Mar 25 15:09:12 2003 (3E800098)
f6807000 f680f000 Fs_Rec Fs_Rec.SYS Tue Mar 25 15:08:36 2003 (3E800074)
f680f000 f6816000 Null Null.SYS Tue Mar 25 15:03:05 2003 (3E7FFF29)
f6817000 f681e000 Beep Beep.SYS Tue Mar 25 15:03:04 2003 (3E7FFF28)
f681f000 f6827000 mnmdd mnmdd.SYS Tue Mar 25 15:07:53 2003 (3E800049)
f6827000 f682f000 RDPCDD RDPCDD.sys Tue Mar 25 15:03:05 2003 (3E7FFF29)
f682f000 f6837000 rasacd rasacd.sys Tue Mar 25 15:11:50 2003 (3E800136)
f686f000 f6876ea0 dump_aac dump_aac.sys Fri Jun 04 13:40:14 2004 (40C00B3E)
f6877000 f687e000 dxgthk dxgthk.sys Tue Mar 25 15:05:52 2003 (3E7FFFD0)
f68af000 f68b3840 ImbDrvNT ImbDrvNT.sys Fri Oct 01 23:35:22 2004 (415D793A)
f69b5000 f69b6280 swenum swenum.sys Sat Feb 17 14:05:56 2007 (45D69B44)
f69bd000 f69be580 USBD USBD.SYS Tue Mar 25 15:10:39 2003 (3E8000EF)
f69cd000 f69ce4c0 BASFND BASFND.sys Fri Apr 25 07:16:49 2003 (3EA87061)

Unloaded modules:
f25b3000 f25c5000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f25c5000 f2694000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f25b3000 f25c5000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f25c5000 f2694000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f27d4000 f27e6000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f27e6000 f28b5000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f27d4000 f27e6000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f27e6000 f28b5000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f29b0000 f29c2000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f29c2000 f2a91000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f29b0000 f29c2000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f29c2000 f2a91000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f29b0000 f29c2000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f29c2000 f2a91000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f3132000 f3144000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f3144000 f3213000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f5cb0000 f5cc2000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f5cc2000 f5d91000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f5fc4000 f5fd2000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f67cf000 f67d7000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000

techaview · 12th April 2007

is it the same method as the link below? thanks
Win2003 SE SP1 Dump Help

cpc2004 · 13th April 2007

Yes, the size of your stack 12K. Extend it to 24K.