Windows 2003 Bugcheck code 0000000A

I have a recently installed server that is getting at least one time a day the following blue screen.

Is there anyway I can identify the faulty driver ? Nothing has changed in the hardware, but since this is a Terminal Server loaded with Citrix Metaframe XP, it has a lot of applications installed.

Here it goes....



Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\minidump\ts40\Mini022505-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows Server 2003 Kernel Version 3790 MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8
Debug session time: Fri Feb 25 10:56:10.531 2005 (GMT-3)
System Uptime: 0 days 5:53:12.225
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................................................................................
Loading unloaded module list
..
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {d598d998, 2, 0, 80599089}

Probably caused by : ntoskrnl.exe ( nt!LpcpCopyRequestData+221 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: d598d998, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80599089, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: d598d998

CURRENT_IRQL: 2

FAULTING_IP:
nt!LpcpCopyRequestData+221
80599089 8b0f mov ecx,[edi]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 804e2f58 to 80543ac9

STACK_TEXT:
b910d198 804e2f58 0000000a d598d998 00000002 nt!MiAddRangeToCrashDump+0x6d
b910d1b4 b910d1d8 b910d260 805b5dad e1796618 nt!GetMachineBootPointers+0x9
WARNING: Frame IP not in any known module. Following frames may be wrong.
89a5f740 00000000 00000000 00000000 00000000 0xb910d1d8


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!LpcpCopyRequestData+221
80599089 8b0f mov ecx,[edi]

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!LpcpCopyRequestData+221

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 40b53739

FAILURE_BUCKET_ID: 0xA_nt!LpcpCopyRequestData+221

BUCKET_ID: 0xA_nt!LpcpCopyRequestData+221

Followup: MachineOwner
---------

3: kd> !analyze -f
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {d598d998, 2, 0, 80599089}

Probably caused by : ntoskrnl.exe ( nt!LpcpCopyRequestData+221 )

Followup: MachineOwner
---------

3: kd> !analyze -hang
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {d598d998, 2, 0, 80599089}

Scanning for threads blocked on locks ...
80584348: Unable to get value of ExpSystemResourcesList
Probably caused by : ntoskrnl.exe ( nt!LpcpCopyRequestData+221 )

Followup: MachineOwner
---------

3: kd> .bugcheck
Bugcheck code 0000000A
Arguments d598d998 00000002 00000000 80599089

 

I wrote a little utility to automate setting the debugger up with all the correct swtiches to run. Youll find it in my signature. Can you rerun your dump through it, so we get symbols loading and a good stack.

Looks like you didnt set the exepath or the symbol path correctly.

 

Here it goes !

Tks, Rodrigo



Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\minidump\ts40\Mini022505-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows Server 2003 Kernel Version 3790 MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_gdr.040410-1234
Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8
Debug session time: Fri Feb 25 10:56:10.531 2005 (GMT-3)
System Uptime: 0 days 5:53:12.225
Loading Kernel Symbols
...............................................................................................................................
Loading unloaded module list
..
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {d598d998, 2, 0, 80599089}

*** WARNING: Unable to verify timestamp for WDICA.SYS
*** ERROR: Module load completed but symbols could not be loaded for WDICA.SYS
Probably caused by : WDICA.SYS ( WDICA+2e4fd )

Followup: MachineOwner
---------

3: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: d598d998, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80599089, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: d598d998

CURRENT_IRQL: 2

FAULTING_IP:
nt!HvpGetCellMapped+11f
80599089 8b0f mov ecx,[edi]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 8059a235 to 80599089

TRAP_FRAME: b910d1b4 -- (.trap ffffffffb910d1b4)
.trap ffffffffb910d1b4
ErrCode = 00000000
eax=89d51d08 ebx=e1796618 ecx=00000000 edx=00000998 esi=e18110c0 edi=d598d998
eip=80599089 esp=b910d228 ebp=b910d280 iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x11f:
80599089 8b0f mov ecx,[edi] ds:0023:d598d998=????????
.trap
Resetting default scope

STACK_TEXT:
b910d280 8059a235 e1796618 0130c998 87e15b08 nt!HvpGetCellMapped+0x11f
b910d29c 8059baf8 e1796618 e33c5518 e3d4a8ec nt!CmpGetValueDataFromCache+0x69
b910d2e0 80591005 e1796618 e33c5518 00d4a8ec nt!CmpQueryKeyValueData+0x297
b910d344 80590f3b e2d5f3f8 001c001a f4dfeeb6 nt!CmQueryValueKey+0xd6
b910d3e4 804dfd24 00000f30 b910d49c 00000001 nt!NtQueryValueKey+0x2a8
b910d3e4 804ebda1 00000f30 b910d49c 00000001 nt!KiSystemService+0xd0
b910d474 f4e0c4fd 00000f30 b910d49c 00000001 nt!ZwQueryValueKey+0x11
WARNING: Stack unwind information not available. Following frames may be wrong.
b910d4ac f4dfef14 00000f30 f4dfeeb6 00000000 WDICA+0x2e4fd
b910d4dc f4defc19 00000f40 b910d51c b910d538 WDICA+0x20f14
b910d538 00000000 87e79340 95079450 b482401a WDICA+0x11c19


FOLLOWUP_IP:
WDICA+2e4fd
f4e0c4fd ?? ???

SYMBOL_STACK_INDEX: 7

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: WDICA+2e4fd

MODULE_NAME: WDICA

IMAGE_NAME: WDICA.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41549323

STACK_COMMAND: .trap ffffffffb910d1b4 ; kb

FAILURE_BUCKET_ID: 0xA_WDICA+2e4fd

BUCKET_ID: 0xA_WDICA+2e4fd

Followup: MachineOwner
---------

eax=f774f13c ebx=0000000a ecx=8804c020 edx=40000000 esi=f774f120 edi=d598d998
eip=80543ac9 esp=b910d180 ebp=b910d198 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x19:
80543ac9 5d pop ebp
ChildEBP RetAddr Args to Child
b910d198 804e2f58 0000000a d598d998 00000002 nt!KeBugCheckEx+0x19 (FPO: [Non-Fpo])
b910d198 80599089 0000000a d598d998 00000002 nt!KiTrap0E+0x224 (FPO: [0,0] TrapFrame @ b910d1b4)
b910d280 8059a235 e1796618 0130c998 87e15b08 nt!HvpGetCellMapped+0x11f (FPO: [Non-Fpo])
b910d29c 8059baf8 e1796618 e33c5518 e3d4a8ec nt!CmpGetValueDataFromCache+0x69 (FPO: [Non-Fpo])
b910d2e0 80591005 e1796618 e33c5518 00d4a8ec nt!CmpQueryKeyValueData+0x297 (FPO: [Non-Fpo])
b910d344 80590f3b e2d5f3f8 001c001a f4dfeeb6 nt!CmQueryValueKey+0xd6 (FPO: [Non-Fpo])
b910d3e4 804dfd24 00000f30 b910d49c 00000001 nt!NtQueryValueKey+0x2a8 (FPO: [Non-Fpo])
b910d3e4 804ebda1 00000f30 b910d49c 00000001 nt!KiSystemService+0xd0 (FPO: [0,0] TrapFrame @ b910d404)
b910d474 f4e0c4fd 00000f30 b910d49c 00000001 nt!ZwQueryValueKey+0x11 (FPO: [6,0,0])
WARNING: Stack unwind information not available. Following frames may be wrong.
b910d4ac f4dfef14 00000f30 f4dfeeb6 00000000 WDICA+0x2e4fd
b910d4dc f4defc19 00000f40 b910d51c b910d538 WDICA+0x20f14
b910d538 00000000 87e79340 95079450 b482401a WDICA+0x11c19
start end module name
804de000 80745000 nt ntkrnlmp.exe Wed May 26 21:32:57 2004 (40B53739)
80745000 8076d000 hal halmacpi.dll Tue Mar 25 04:07:28 2003 (3E800030)
bf800000 bf9c7000 win32k win32k.sys Mon Aug 09 19:48:07 2004 (4117FF27)
bf9c7000 bfa1d680 ati2drad ati2drad.dll Tue Mar 25 06:43:37 2003 (3E8024C9)
bfa1e000 bfa7c680 vdtw30 vdtw30.dll Fri Sep 24 18:34:40 2004 (415492F0)
bff80000 bff96000 dxg dxg.sys Tue Mar 25 06:46:23 2003 (3E80256F)
bffa0000 bffe8000 ATMFD ATMFD.DLL Tue Mar 25 06:46:23 2003 (3E80256F)
f4da6000 f4da8f00 pdcrypt1 pdcrypt1.sys Sat Jan 24 02:50:47 2004 (401207B7)
f4daa000 f4dac600 pdrframe pdrframe.sys Sat Jan 24 02:50:26 2004 (401207A2)
f4dde000 f4e10580 WDICA WDICA.SYS Fri Sep 24 18:35:31 2004 (41549323)
f4ea1000 f4ea4100 icareduc icareduc.sys Sat Jan 24 02:45:58 2004 (40120696)
f5299000 f52c6000 Fastfat Fastfat.SYS Tue Mar 25 05:00:16 2003 (3E800C90)
f5596000 f55a0000 TDTCP TDTCP.SYS Tue Mar 25 04:02:52 2003 (3E7FFF1C)
f56fe000 f575d000 srv srv.sys Tue Mar 25 05:49:51 2003 (3E80182F)
f57ad000 f57df000 mrxdav mrxdav.sys Tue Mar 25 04:09:13 2003 (3E800099)
f5807000 f585f000 HTTP HTTP.sys Tue Mar 25 05:55:21 2003 (3E801979)
f594f000 f5997e00 cdm cdm.sys Fri Sep 24 18:32:41 2004 (41549279)
f5aa0000 f5aa2300 ctxsmcdrv ctxsmcdrv.sys Sat Jan 24 02:52:09 2004 (40120809)
f5ad8000 f5b4b9e0 nwfs nwfs.sys Mon Jun 14 17:57:18 2004 (40CE112E)
f5b4c000 f5b71720 srvloc srvloc.sys Mon May 03 18:07:04 2004 (4096B478)
f5c7a000 f5c7cb80 NWHOST NWHOST.sys Tue Feb 17 18:16:59 2004 (403284CB)
f5c9a000 f5c9dee0 nwdhcp nwdhcp.sys Mon Feb 23 14:52:38 2004 (403A3DE6)
f5cb2000 f5ce1000 afd afd.sys Tue Mar 25 04:40:50 2003 (3E800802)
f5d69000 f5d71680 nwdns nwdns.sys Thu Apr 29 19:58:28 2004 (40918894)
f5e99000 f5eb1000 Cdfs Cdfs.SYS Tue Mar 25 05:17:19 2003 (3E80108F)
f5ed9000 f5eec000 Fips Fips.SYS Tue Mar 25 05:54:59 2003 (3E801963)
f5f8c000 f5ff7000 mrxsmb mrxsmb.sys Mon Oct 11 21:38:12 2004 (416B2774)
f5ff7000 f6022000 rdbss rdbss.sys Mon Oct 11 21:38:09 2004 (416B2771)
f6022000 f6057000 netbt netbt.sys Fri Jul 18 14:16:03 2003 (3F182B53)
f607f000 f60e1000 tcpip tcpip.sys Tue Mar 25 05:04:01 2003 (3E800D71)
f60e1000 f60fd000 ipsec ipsec.sys Tue Mar 25 04:55:45 2003 (3E800B81)
f611d000 f6130000 usbhub usbhub.sys Tue Mar 25 04:10:46 2003 (3E8000F6)
f61d0000 f6293000 dmboot dmboot.sys Tue Mar 25 04:08:18 2003 (3E800062)
f62d9000 f62e2000 ndisuio ndisuio.sys Tue Mar 25 04:09:47 2003 (3E8000BB)
f6379000 f63ac000 update update.sys Tue Mar 25 05:59:59 2003 (3E801A8F)
f63b4000 f63b7e20 dump_cpqcissm dump_cpqcissm.sys Mon Feb 02 17:01:16 2004 (401EAC8C)
f63d4000 f6408000 rdpdr rdpdr.sys Tue Mar 25 04:09:30 2003 (3E8000AA)
f642a000 f643f000 raspptp raspptp.sys Tue Mar 25 05:19:09 2003 (3E8010FD)
f643f000 f645a000 ndiswan ndiswan.sys Tue Mar 25 05:48:19 2003 (3E8017D3)
f645a000 f6471000 rasl2tp rasl2tp.sys Tue Mar 25 04:54:46 2003 (3E800B46)
f6471000 f648ca00 q57xp32 q57xp32.sys Mon Feb 02 23:19:08 2004 (401F051C)
f648d000 f64aee80 USBPORT USBPORT.SYS Tue Mar 25 04:10:43 2003 (3E8000F3)
f64ff000 f6529000 ks ks.sys Tue Mar 25 05:47:36 2003 (3E8017A8)
f6529000 f653d000 redbook redbook.sys Tue Mar 25 04:04:38 2003 (3E7FFF86)
f653d000 f6551000 cdrom cdrom.sys Tue Mar 25 04:05:18 2003 (3E7FFFAE)
f6551000 f6569000 serial serial.sys Tue Mar 25 04:40:08 2003 (3E8007D8)
f6569000 f657f000 i8042prt i8042prt.sys Tue Mar 25 06:01:43 2003 (3E801AF7)
f657f000 f65cb000 cpqasm2 cpqasm2.sys Tue May 18 14:59:39 2004 (40AA4F0B)
f65cb000 f65e4000 VIDEOPRT VIDEOPRT.SYS Tue Mar 25 04:08:02 2003 (3E800052)
f65e4000 f6637d80 ati2mpad ati2mpad.sys Thu Jul 18 22:13:20 2002 (3D3767B0)
f6648000 f6656000 NDProxy NDProxy.SYS Tue Mar 25 04:11:30 2003 (3E800122)
f6668000 f6677000 termdd termdd.sys Tue Mar 25 04:02:52 2003 (3E7FFF1C)
f6678000 f6681000 raspti raspti.sys Tue Mar 25 04:11:36 2003 (3E800128)
f6688000 f6693000 ptilink ptilink.sys Tue Mar 25 04:03:51 2003 (3E7FFF57)
f6698000 f66a3000 TDI TDI.SYS Tue Mar 25 04:14:28 2003 (3E8001D4)
f66a8000 f66b6000 raspppoe raspppoe.sys Tue Mar 25 04:11:37 2003 (3E800129)
f66b8000 f66c1000 ndistapi ndistapi.sys Tue Mar 25 04:11:28 2003 (3E800120)
f66c8000 f66d5580 CPQCISSE CPQCISSE.sys Thu Mar 11 18:50:26 2004 (4050DF22)
f7140000 f7143a80 cdfdrv cdfdrv.sys Fri Sep 24 18:37:48 2004 (415493AC)
f7208000 f7222000 CPQPHP CPQPHP.SYS Fri Apr 23 13:44:10 2004 (408947DA)
f7222000 f7244000 Mup Mup.sys Tue Mar 25 05:55:58 2003 (3E80199E)
f7244000 f7285000 NDIS NDIS.sys Tue Mar 25 05:45:35 2003 (3E80172F)
f7285000 f7322000 Ntfs Ntfs.sys Tue Mar 25 04:40:05 2003 (3E8007D5)
f7322000 f7343000 KSecDD KSecDD.sys Tue Mar 25 04:05:39 2003 (3E7FFFC3)
f7343000 f7359000 CLASSPNP CLASSPNP.SYS Tue Mar 25 04:38:14 2003 (3E800766)
f7359000 f736de80 adpu160m adpu160m.sys Thu Jun 20 23:02:53 2002 (3D12894D)
f736e000 f738a000 atapi atapi.sys Tue Mar 25 04:04:48 2003 (3E7FFF90)
f738a000 f73b0000 SCSIPORT SCSIPORT.SYS Tue Mar 25 05:01:25 2003 (3E800CD5)
f73b0000 f73d1000 volsnap volsnap.sys Tue Mar 25 04:05:47 2003 (3E7FFFCB)
f73d1000 f73fb000 dmio dmio.sys Tue Mar 25 04:08:14 2003 (3E80005E)
f73fb000 f7420000 ftdisk ftdisk.sys Tue Mar 25 04:05:26 2003 (3E7FFFB6)
f7420000 f7435000 pci pci.sys Tue Mar 25 04:16:40 2003 (3E800258)
f7435000 f7466000 ACPI ACPI.sys Tue Mar 25 04:16:21 2003 (3E800245)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 04:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 04:16:35 2003 (3E800253)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Tue Mar 25 04:04:44 2003 (3E7FFF8C)
f74b7000 f74c6000 MountMgr MountMgr.sys Tue Mar 25 04:03:05 2003 (3E7FFF29)
f74c7000 f74d5000 PartMgr PartMgr.sys Tue Mar 25 05:04:02 2003 (3E800D72)
f74d7000 f74e6ae0 cpq32fs2 cpq32fs2.sys Mon Nov 18 20:47:47 2002 (3DD97C23)
f74e7000 f74ef080 symc8xx symc8xx.sys Tue Sep 25 15:25:49 2001 (3BB0CC2D)
f74f7000 f7500100 symmpi symmpi.sys Tue Dec 10 14:32:15 2002 (3DF6251F)
f7507000 f7516000 disk disk.sys Tue Mar 25 04:05:20 2003 (3E7FFFB0)
f7517000 f7523000 Dfs Dfs.sys Tue Mar 25 04:09:52 2003 (3E8000C0)
f7527000 f752f640 nicm nicm.sys Mon Feb 09 13:16:16 2004 (4027B250)
f7537000 f7540000 crcdisk crcdisk.sys Tue Mar 25 04:07:23 2003 (3E80002B)
f7557000 f7561000 kbdclass kbdclass.sys Tue Mar 25 04:03:10 2003 (3E7FFF2E)
f7567000 f7571000 mouclass mouclass.sys Tue Mar 25 04:03:09 2003 (3E7FFF2D)
f7577000 f7581000 serenum serenum.sys Tue Mar 25 04:04:01 2003 (3E7FFF61)
f7587000 f7592000 fdc fdc.sys Tue Mar 25 04:04:31 2003 (3E7FFF7F)
f7597000 f75a1000 flpydisk flpydisk.sys Tue Mar 25 04:04:32 2003 (3E7FFF80)
f75a7000 f75b3000 vga vga.sys Tue Mar 25 04:08:03 2003 (3E800053)
f75b7000 f75c1000 Msfs Msfs.SYS Tue Mar 25 04:08:56 2003 (3E800088)
f75c7000 f75d3000 Npfs Npfs.SYS Tue Mar 25 04:08:59 2003 (3E80008B)
f75d7000 f75e6000 msgpc msgpc.sys Tue Mar 25 04:10:12 2003 (3E8000D4)
f75e7000 f75f4000 wanarp wanarp.sys Tue Mar 25 04:11:22 2003 (3E80011A)
f75f7000 f7604000 netbios netbios.sys Tue Mar 25 04:09:53 2003 (3E8000C1)
f7617000 f7623000 processr processr.sys Tue Mar 25 04:07:36 2003 (3E800038)
f7627000 f7630000 watchdog watchdog.sys Tue Mar 25 04:09:01 2003 (3E80008D)
f7637000 f7640000 dump_scsiport dump_scsiport.sys Tue Mar 25 04:05:15 2003 (3E7FFFAB)
f7647000 f7651000 Dxapi Dxapi.sys Tue Mar 25 04:06:01 2003 (3E7FFFD9)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 04:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 04:07:58 2003 (3E80004E)
f7717000 f771e000 pciide pciide.sys Tue Mar 25 04:04:46 2003 (3E7FFF8E)
f771f000 f7726000 dmload dmload.sys Tue Mar 25 04:08:08 2003 (3E800058)
f7727000 f772e080 sym_hi sym_hi.sys Wed Oct 03 20:48:12 2001 (3BBBA3BC)
f775f000 f7766000 dxgthk dxgthk.sys Tue Mar 25 04:05:52 2003 (3E7FFFD0)
f7767000 f776f000 rasacd rasacd.sys Tue Mar 25 04:11:50 2003 (3E800136)
f7797000 f779da20 resmgr resmgr.sys Tue Jun 01 21:19:33 2004 (40BD1D15)
f77a7000 f77abb80 nwslp nwslp.sys Thu Apr 29 19:57:54 2004 (40918872)
f77b7000 f77be000 sysmgmt sysmgmt.sys Tue May 18 14:59:41 2004 (40AA4F0D)
f77bf000 f77c7000 OPRGHDLR OPRGHDLR.SYS Tue Mar 25 04:16:25 2003 (3E800249)
f77d7000 f77dba20 CpqCiDrv CpqCiDrv.sys Fri Jul 11 12:32:03 2003 (3F0ED873)
f77df000 f77e3200 usbohci usbohci.sys Tue Mar 25 04:10:41 2003 (3E8000F1)
f77e7000 f77ef000 audstub audstub.sys Tue Mar 25 04:09:12 2003 (3E800098)
f77ff000 f7807000 Fs_Rec Fs_Rec.SYS Tue Mar 25 04:08:36 2003 (3E800074)
f7807000 f780e000 Null Null.SYS Tue Mar 25 04:03:05 2003 (3E7FFF29)
f780f000 f7816000 Beep Beep.SYS Tue Mar 25 04:03:04 2003 (3E7FFF28)
f7817000 f781f000 mnmdd mnmdd.SYS Tue Mar 25 04:07:53 2003 (3E800049)
f781f000 f7827000 RDPCDD RDPCDD.sys Tue Mar 25 04:03:05 2003 (3E7FFF29)
f7897000 f789ab60 cpqarray cpqarray.sys Mon Oct 21 18:18:51 2002 (3DB46F3B)
f789b000 f789ef80 symc810 symc810.sys Fri Dec 08 14:40:59 2000 (3A311D2B)
f789f000 f78a2e20 cpqcissm cpqcissm.sys Mon Feb 02 17:01:16 2004 (401EAC8C)
f78a3000 f78a6460 cpqarry2 cpqarry2.sys Mon Nov 05 18:47:33 2001 (3BE708F5)
f78a7000 f78aad40 nwfilter nwfilter.sys Fri Mar 05 12:45:50 2004 (4048A0AE)
f799d000 f799e200 swenum swenum.sys Tue Mar 25 04:03:22 2003 (3E7FFF3A)
f799f000 f79a0580 USBD USBD.SYS Tue Mar 25 04:10:39 2003 (3E8000EF)
f79f1000 f79f2460 NWSNS NWSNS.sys Thu Feb 13 11:27:38 2003 (3E4BAB5A)
f7a86000 f7a86f00 icacdd icacdd.sys Sat Jan 24 02:45:14 2004 (4012066A)

Unloaded modules:
f7607000 f7615000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f77f7000 f77ff000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

ok, well done. Thats what we needed.

This is crashing while manipulating a reg key. In my experience, if you have a full dump (this one is just a mini), the key it was fooling around with is usually in the dump. Sometimes its just a corrupt regkey, sometimes it is more serious problem. Unfortunatly, its a bit of a fishing expidition, since we dont know whats up yet. Its beyond what i can talk you through over a bunch of posts.

My recommendation is to setup for a full memory dump, wait for next occurance. Run it through the tool to confirm that you are getting the same STACK_TEXT, then contact microsoft support, who will have you upload the dump for analysis by the experts.

 

Ok, I have actually set up this already, and I´m now waiting for the error again to have the full dump.

I guess that it might be something well documented. I´m currently looking for Help at a Citrix Forum, since this .sys comes from Citrix Metaframe.

In the meantime, if you or anybody else has any insights, please let me know.

Thanks a lot for your help.

Rodrigo