STOP 0x50 in RDPDD.DLL

I have a 2003 terminal server crashing a few times a week. I have two dumps so far I will post them both. It seems to be the "Alpha Five" database client ALPHA5.EXE trying to display something and RDPDD.DLL (The terminal services RDP display driver) crashes.

I have opened a case with MS but progress is slow so I figured I'd see what you guys think. I haven't seen any hotfixes that replace RDPDD.DLL. I have installed a WIN32K.SYS hotfix so I am running the most recent QFE of WIN32K.SYS but nothing has changed.

Any thoughts?



Loading Dump File [C:\DumpFiles\MEMORY-050214.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*C:\SYMBOLS*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_gdr.040410-1234
Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8
Debug session time: Mon Feb 14 14:14:32.424 2005 (GMT-7)
System Uptime: 0 days 17:36:57.136
Loading Kernel Symbols
.......................................................................................................
Loading unloaded module list
...
Loading User Symbols
.....................................................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {be1fc7e0, 0, bf817beb, 0}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for A5BROWSE.dll -
Probably caused by : RDPDD.dll ( RDPDD!DrvBitBlt+19d )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: be1fc7e0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: bf817beb, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


READ_ADDRESS: be1fc7e0 Nonpaged pool

FAULTING_IP:
win32k!vSolidFillRect1+ae
bf817beb 2311 and edx,[ecx]

MM_INTERNAL_CODE: 0

IMAGE_NAME: RDPDD.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 3e80b815

MODULE_NAME: RDPDD

FAULTING_MODULE: bf800000 win32k

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

CURRENT_IRQL: 1

LAST_CONTROL_TRANSFER: from bf80843f to bf817beb

TRAP_FRAME: b2a9247c -- (.trap ffffffffb2a9247c)
ErrCode = 00000000
eax=0000ffff ebx=0000000f ecx=be1fc7e0 edx=0000ffff esi=be1fc7c0 edi=00000008
eip=bf817beb esp=b2a924f0 ebp=b2a92510 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
win32k!vSolidFillRect1+0xae:
bf817beb 2311 and edx,[ecx] ds:0023:be1fc7e0=????????
Resetting default scope

STACK_TEXT:
b2a92510 bf80843f b2a92aa4 be1fc7e0 be200000 win32k!vSolidFillRect1+0xae
b2a92690 bf807fff bf817b62 b2a92aa4 00000000 win32k!vDIBSolidBlt+0x19a
b2a926fc bff6201b bc01d018 00000000 00000000 win32k!EngBitBlt+0xdf
b2a92a64 bf830494 bc01c558 00000000 00000000 RDPDD!DrvBitBlt+0x19d
b2a92ac0 bf819dca 00000000 bc1fba30 00000001 win32k!ExtTextOutRect+0x1c3
b2a92c00 bf8072b2 b2a92d38 7ffde22c 00000028 win32k!GreBatchTextOut+0xd0
b2a92d54 804dfce0 00000142 00125cd4 00000000 win32k!NtGdiFlushUserBatch+0x119
b2a92d54 7ffe0304 00000142 00125cd4 00000000 nt!KiSystemService+0xa1
00125cc8 77d061a4 77d08519 2d01021d 00000039 SharedUserData!SystemCallStub+0x4
00125cdc 600e9bf6 00360188 2d01021d 0012b3fc USER32!NtUserCallOneParam+0xc
WARNING: Stack unwind information not available. Following frames may be wrong.
600f3177 0fdbc068 e39c6860 75ff600f 1075ff14 A5BROWSE!AI_browse_erase_background+0x3505
51ec8b55 00000000 00000000 00000000 00000000 0xfdbc068


FOLLOWUP_IP:
RDPDD!DrvBitBlt+19d
bff6201b 894524 mov [ebp+0x24],eax

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: RDPDD!DrvBitBlt+19d

STACK_COMMAND: .trap ffffffffb2a9247c ; kb

FAILURE_BUCKET_ID: 0x50_RDPDD!DrvBitBlt+19d

BUCKET_ID: 0x50_RDPDD!DrvBitBlt+19d

Followup: MachineOwner
---------

 

Second dump file

Loading Dump File [E:\WINDOWS\MEMORY-050215.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*C:\SYMBOLS*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_gdr.040410-1234
Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8
Debug session time: Tue Feb 15 14:01:55.496 2005 (GMT-7)
System Uptime: 0 days 23:45:14.547
Loading Kernel Symbols
......................................................................................................
Loading unloaded module list
......
Loading User Symbols
...............................................................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {be1fc828, 1, bf817b50, 0}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for A5BROWSE.dll -
Probably caused by : RDPDD.dll ( RDPDD!DrvBitBlt+19d )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: be1fc828, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: bf817b50, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


WRITE_ADDRESS: be1fc828 Nonpaged pool

FAULTING_IP:
win32k!vSolidFillRect1+12f
bf817b50 894704 mov [edi+0x4],eax

MM_INTERNAL_CODE: 0

IMAGE_NAME: RDPDD.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 3e80b815

MODULE_NAME: RDPDD

FAULTING_MODULE: bf800000 win32k

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

CURRENT_IRQL: 1

LAST_CONTROL_TRANSFER: from bf80843f to bf817b50

TRAP_FRAME: b68b447c -- (.trap ffffffffb68b447c)
ErrCode = 00000002
eax=d699d699 ebx=0000000f ecx=ffff0000 edx=0000000b esi=be1fc800 edi=be1fc824
eip=bf817b50 esp=b68b44f0 ebp=b68b4510 iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
win32k!vSolidFillRect1+0x12f:
bf817b50 894704 mov [edi+0x4],eax ds:0023:be1fc828=????????
Resetting default scope

STACK_TEXT:
b68b4510 bf80843f b68b4aa4 00000002 be200000 win32k!vSolidFillRect1+0x12f
b68b4690 bf807fff bf817b62 b68b4aa4 00000000 win32k!vDIBSolidBlt+0x19a
b68b46fc bff6201b bc01d018 00000000 00000000 win32k!EngBitBlt+0xdf
b68b4a64 bf830494 bc01c558 00000000 00000000 RDPDD!DrvBitBlt+0x19d
b68b4ac0 bf819dca 00000000 bc3e4ef8 00000001 win32k!ExtTextOutRect+0x1c3
b68b4c00 bf8072b2 b68b4d38 7ffde254 00000028 win32k!GreBatchTextOut+0xd0
b68b4d54 804dfce0 00000142 0012a704 00000000 win32k!NtGdiFlushUserBatch+0x119
b68b4d54 7ffe0304 00000142 0012a704 00000000 nt!KiSystemService+0xa1
0012a6f8 77d061a4 77d08519 ee0105b4 00000039 SharedUserData!SystemCallStub+0x4
0012a70c 600e9bf6 001200f6 ee0105b4 0012fe2c USER32!NtUserCallOneParam+0xc
WARNING: Stack unwind information not available. Following frames may be wrong.
600f3177 0fdbc068 e39c6860 75ff600f 1075ff14 A5BROWSE!AI_browse_erase_background+0x3505
51ec8b55 00000000 00000000 00000000 00000000 0xfdbc068


FOLLOWUP_IP:
RDPDD!DrvBitBlt+19d
bff6201b 894524 mov [ebp+0x24],eax

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: RDPDD!DrvBitBlt+19d

STACK_COMMAND: .trap ffffffffb68b447c ; kb

FAILURE_BUCKET_ID: 0x50_W_RDPDD!DrvBitBlt+19d

BUCKET_ID: 0x50_W_RDPDD!DrvBitBlt+19d

Followup: MachineOwner
---------

 

If you'd like to PM me your case number, ill take a look at the status of your case

What is the current course of action recommended by MSFT support on this?
What does alpha software say about using thier product in a terminal server environment?
Have you registered to get access to the support forums over there?

 

No course of action recommended yet. The tech is a dude in India and he doesn't seem very experienced. However, I think the debugging is being done by someone else.

I have not done much research on the Alpha5 side. I don't know what they say about terminal services. I will check into that further.