IRQL_NOT_LESS_OR_EQUAL stop error [Dump log]

This is my first post to this site. I've been getting these stop errors every few days. This is just one of them. They are all a little different. Let me know if I need to include anything else.
-Brian



Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini030505-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Fri Mar 4 23:02:04.906 2005 (GMT-5)
System Uptime: 1 days 2:14:45.506
Loading Kernel Symbols
......................................................................................................................................................
Loading unloaded module list
...............
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {2000000, 2, 0, 804e7506}

Probably caused by : ntoskrnl.exe ( nt!ExDeleteResourceLite+10 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 02000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804e7506, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 02000000

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExDeleteResourceLite+10
804e7506 8b16 mov edx,[esi]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 805773bc to 804e7506

STACK_TEXT:
b83dbb74 805773bc 02000000 e5156018 b83dbba0 nt!ExDeleteResourceLite+0x10
b83dbb84 80563ff6 e5156030 e5156018 00000000 nt!SepTokenDeleteMethod+0x6b
b83dbba0 804e3c55 e5156030 00000000 e5156030 nt!ObpRemoveObjectRoutine+0xdf
b83dbbc4 805770a7 851337c0 00000000 851339f8 nt!ObfDereferenceObject+0x5f
b83dbbd8 80576f99 851339f8 00000002 00000000 nt!PsRevertThreadToSelf+0xb1
b83dbc34 80576f54 851337c0 00000000 b83dbd64 nt!PsAssignImpersonationToken+0x28
b83dbd4c 804df06b fffffffe 00000005 001edd88 nt!NtSetInformationThread+0x207
b83dbd4c 7c90eb94 fffffffe 00000005 001edd88 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
072efee0 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
nt!ExDeleteResourceLite+10
804e7506 8b16 mov edx,[esi]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!ExDeleteResourceLite+10

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41108004

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xA_nt!ExDeleteResourceLite+10

BUCKET_ID: 0xA_nt!ExDeleteResourceLite+10

Followup: MachineOwner
---------

eax=00000000 ebx=00000000 ecx=fe040002 edx=00000000 esi=02000000 edi=00000000
eip=804e7506 esp=b83dbb6c ebp=b83dbb74 iopl=0 nv up ei pl zr ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010256
nt!ExDeleteResourceLite+0x10:
804e7506 8b16 mov edx,[esi] ds:0023:02000000=????????
ChildEBP RetAddr Args to Child
b83dbb74 805773bc 02000000 e5156018 b83dbba0 nt!ExDeleteResourceLite+0x10 (FPO: [Non-Fpo])
b83dbb84 80563ff6 e5156030 e5156018 00000000 nt!SepTokenDeleteMethod+0x6b (FPO: [Non-Fpo])
b83dbba0 804e3c55 e5156030 00000000 e5156030 nt!ObpRemoveObjectRoutine+0xdf (FPO: [Non-Fpo])
b83dbbc4 805770a7 851337c0 00000000 851339f8 nt!ObfDereferenceObject+0x5f (FPO: [Non-Fpo])
b83dbbd8 80576f99 851339f8 00000002 00000000 nt!PsRevertThreadToSelf+0xb1 (FPO: [Non-Fpo])
b83dbc34 80576f54 851337c0 00000000 b83dbd64 nt!PsAssignImpersonationToken+0x28 (FPO: [Non-Fpo])
b83dbd4c 804df06b fffffffe 00000005 001edd88 nt!NtSetInformationThread+0x207 (FPO: [Non-Fpo])
b83dbd4c 7c90eb94 fffffffe 00000005 001edd88 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ b83dbd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
072efee0 00000000 00000000 00000000 00000000 0x7c90eb94
start end module name
804d7000 806eb780 nt ntoskrnl.exe Wed Aug 04 02:19:48 2004 (41108004)
806ec000 8070c380 hal halaacpi.dll Wed Aug 04 01:59:05 2004 (41107B29)
b84ec000 b852c380 HTTP HTTP.sys Wed Aug 04 02:00:09 2004 (41107B69)
b8852000 b8866400 wdmaud wdmaud.sys Wed Aug 04 02:15:03 2004 (41107EE7)
b888f000 b88b2000 Fastfat Fastfat.SYS Wed Aug 04 02:14:15 2004 (41107EB7)
b90b2000 b90c2960 NAVENG NAVENG.Sys Thu Dec 30 16:46:10 2004 (41D47722)
b90c3000 b915ba60 NavEx15 NavEx15.Sys Thu Dec 30 16:45:19 2004 (41D476EF)
b915c000 b91b3000 SAVRT SAVRT.SYS Fri Dec 10 15:42:07 2004 (41BA0A1F)
b927b000 b9289d80 sysaudio sysaudio.sys Wed Aug 04 02:15:54 2004 (41107F1A)
b9523000 b9575180 srv srv.sys Wed Aug 04 02:14:44 2004 (41107ED4)
b959e000 b95ca400 mrxdav mrxdav.sys Wed Aug 04 02:00:49 2004 (41107B91)
b96c7000 b96c96a0 mdmxsdk mdmxsdk.sys Thu Oct 17 20:42:25 2002 (3DAF58F1)
b96e3000 b97235a0 symidsco symidsco.sys Thu Dec 09 20:17:28 2004 (41B8F928)
b9724000 b974c9e0 SYMFW SYMFW.SYS Sat Jan 22 00:57:51 2005 (41F1EB5F)
bf800000 bf9c0380 win32k win32k.sys Wed Aug 04 02:17:30 2004 (41107F7A)
bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 02:00:51 2004 (41107B93)
bf9d3000 bfd64180 nv4_disp nv4_disp.dll Thu Jul 15 15:13:32 2004 (40F6D75C)
eb7fb000 eb81bf00 ipnat ipnat.sys Wed Sep 29 18:28:36 2004 (415B3714)
eb81c000 eb88a400 mrxsmb mrxsmb.sys Tue Jan 18 23:26:50 2005 (41EDE18A)
eb88b000 eb8b5a00 rdbss rdbss.sys Wed Oct 27 21:13:57 2004 (418047D5)
eb8b6000 eb8c9000 SAVRTPEL SAVRTPEL.SYS Fri Dec 10 15:42:09 2004 (41BA0A21)
eb8c9000 eb91b000 SPBBCDrv SPBBCDrv.sys Wed Jul 21 19:08:26 2004 (40FEF76A)
eb91b000 eb93cd00 afd afd.sys Wed Aug 04 02:14:13 2004 (41107EB5)
eb93d000 eb964c00 netbt netbt.sys Wed Aug 04 02:14:36 2004 (41107ECC)
eb965000 eb97ea80 SYMEVENT SYMEVENT.SYS Tue Oct 19 17:18:08 2004 (41758490)
eb97f000 eb9beda0 SYMTDI SYMTDI.SYS Sat Jan 22 00:55:40 2005 (41F1EADC)
eb9bf000 eba16a80 tcpip tcpip.sys Wed Aug 04 02:14:39 2004 (41107ECF)
eba17000 eba29400 ipsec ipsec.sys Wed Aug 04 02:14:27 2004 (41107EC3)
ebb62000 ebb72480 nvarm nvarm.sys Tue May 25 18:58:00 2004 (40B3CF78)
ebb73000 ebc5e000 nvmcp nvmcp.sys Tue May 25 18:58:01 2004 (40B3CF79)
ebc5e000 ebc81980 portcls portcls.sys Wed Aug 04 02:15:47 2004 (41107F13)
ebc82000 ebce2b00 nvapu nvapu.sys Tue May 25 18:58:02 2004 (40B3CF7A)
ebce3000 ebd16200 update update.sys Wed Aug 04 01:58:32 2004 (41107B08)
ebd17000 ebd47100 rdpdr rdpdr.sys Wed Aug 04 02:01:10 2004 (41107BA6)
ebd48000 ebd58e00 psched psched.sys Wed Aug 04 02:04:16 2004 (41107C60)
ebd59000 ebd6f680 ndiswan ndiswan.sys Wed Aug 04 02:14:30 2004 (41107EC6)
ebd70000 ebd81780 bridge bridge.sys Wed Aug 04 01:59:56 2004 (41107B5C)
ebd82000 ebd95900 parport parport.sys Wed Aug 04 01:59:04 2004 (41107B28)
ebd96000 ebda9780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 02:07:04 2004 (41107D08)
ebdaa000 ec002840 nv4_mini nv4_mini.sys Thu Jul 15 15:17:29 2004 (40F6D849)
ec003000 ec0c55a0 winachcf winachcf.sys Fri Oct 18 20:05:41 2002 (3DB0A1D5)
ec0c6000 ec0e8680 ks ks.sys Wed Aug 04 02:15:20 2004 (41107EF8)
ec2d4000 ec2dd480 NDProxy NDProxy.SYS Fri Aug 17 16:55:30 2001 (3B7D84C2)
ec2e4000 ec2f2100 usbhub usbhub.sys Wed Aug 04 02:08:40 2004 (41107D68)
ec2f4000 ec2fdf00 termdd termdd.sys Wed Aug 04 01:58:52 2004 (41107B1C)
ec304000 ec30cc60 Pcouffin Pcouffin.sys Mon Jul 12 19:03:01 2004 (40F318A5)
ec314000 ec31c900 msgpc msgpc.sys Wed Aug 04 02:04:11 2004 (41107C5B)
ec324000 ec32fd00 raspptp raspptp.sys Wed Aug 04 02:14:26 2004 (41107EC2)
ec334000 ec33e200 raspppoe raspppoe.sys Wed Aug 04 02:05:06 2004 (41107C92)
ec344000 ec350880 rasl2tp rasl2tp.sys Wed Aug 04 02:14:21 2004 (41107EBD)
ec354000 ec363be0 LMouKE LMouKE.Sys Thu Oct 21 16:30:56 2004 (41781C80)
ec364000 ec3704a0 L8042mou L8042mou.Sys Thu Oct 21 16:31:05 2004 (41781C89)
ec641000 ec644c80 mssmbios mssmbios.sys Wed Aug 04 02:07:47 2004 (41107D33)
ec770000 ec774080 raspti raspti.sys Fri Aug 17 16:55:32 2001 (3B7D84C4)
ec778000 ec77c580 ptilink ptilink.sys Fri Aug 17 16:49:53 2001 (3B7D8371)
ec780000 ec784880 TDI TDI.SYS Wed Aug 04 02:07:47 2004 (41107D33)
ec7f7000 ec7f7c00 audstub audstub.sys Fri Aug 17 16:59:40 2001 (3B7D85BC)
ec809000 ec80b580 ndistapi ndistapi.sys Fri Aug 17 16:55:29 2001 (3B7D84C1)
ec819000 ec81b980 gameenum gameenum.sys Wed Aug 04 02:08:20 2004 (41107D54)
ec81d000 ec81fe60 L8042Kbd L8042Kbd.sys Thu Oct 21 16:32:12 2004 (41781CCC)
ec821000 ec824c80 serenum serenum.sys Wed Aug 04 01:59:06 2004 (41107B2A)
ec8f0000 ec8f6000 kbdclass kbdclass.sys Wed Aug 04 01:58:32 2004 (41107B08)
ec8f8000 ec8fda00 mouclass mouclass.sys Wed Aug 04 01:58:32 2004 (41107B08)
ec900000 ec901000 fdc fdc.sys unavailable (00000000)
ec908000 ec90e400 MxlW2k MxlW2k.SYS Wed Jun 30 09:12:01 2004 (40E2BC21)
ec910000 ec914680 dvd43llh dvd43llh.sys Mon Dec 20 10:29:48 2004 (41C6EFEC)
ec918000 ec91f580 Modem Modem.SYS Wed Aug 04 02:08:04 2004 (41107D44)
ecabe000 ecacae00 i8042prt i8042prt.sys Wed Aug 04 02:14:36 2004 (41107ECC)
ecace000 ecaddd80 serial serial.sys Wed Aug 04 02:15:51 2004 (41107F17)
ecade000 ecaec080 redbook redbook.sys Wed Aug 04 01:59:34 2004 (41107B46)
ecaee000 ecafa180 cdrom cdrom.sys Wed Aug 04 01:59:52 2004 (41107B58)
ecafe000 ecb08380 imapi imapi.sys Wed Aug 04 02:00:12 2004 (41107B6C)
ecb0e000 ecb1de80 Rtlnic51 Rtlnic51.sys Mon Aug 04 08:14:34 2003 (3F2E4E2A)
ecb3e000 ecb49e00 STREAM STREAM.SYS Wed Aug 04 02:07:58 2004 (41107D3E)
ecbd1000 ecbd3880 pfc pfc.sys Fri Sep 19 19:47:22 2003 (3F6B958A)
edf99000 edf9a280 USBD USBD.SYS Fri Aug 17 17:02:58 2001 (3B7D8682)
edf9b000 edf9c100 swenum swenum.sys Wed Aug 04 01:58:41 2004 (41107B11)
f1bbd000 f1bc7000 SYMNDIS SYMNDIS.SYS Sat Jan 22 00:57:07 2005 (41F1EB33)
f2010000 f201df80 dump_si3112 dump_si3112.sys Mon Jun 14 22:03:50 2004 (40CE5906)
f2030000 f2038d80 HIDCLASS HIDCLASS.SYS Wed Aug 04 02:08:18 2004 (41107D52)
f2040000 f204f900 Cdfs Cdfs.SYS Wed Aug 04 02:14:09 2004 (41107EB1)
f2060000 f2068700 wanarp wanarp.sys Wed Aug 04 02:04:57 2004 (41107C89)
f2070000 f207ed80 arp1394 arp1394.sys Wed Aug 04 01:58:28 2004 (41107B04)
f2080000 f2088880 Fips Fips.SYS Fri Aug 17 21:31:49 2001 (3B7DC585)
f2742000 f274a700 netbios netbios.sys Wed Aug 04 02:03:19 2004 (41107C27)
f313f000 f3141900 Dxapi Dxapi.sys Fri Aug 17 16:53:19 2001 (3B7D843F)
f3157000 f315a780 dump_scsiport dump_scsiport.sys Wed Aug 04 01:59:51 2004 (41107B57)
f315b000 f315d580 hidusb hidusb.sys Fri Aug 17 17:02:16 2001 (3B7D8658)
f549e000 f54a4000 symlcbrd symlcbrd.sys Sun Aug 22 04:10:18 2004 (412854EA)
f54a6000 f54ac000 IOPORT IOPORT.SYS Fri Nov 27 12:57:16 1998 (365EE7FC)
f54ae000 f54b51e0 SYMIDS SYMIDS.SYS Sat Jan 22 00:59:16 2005 (41F1EBB4)
f54b6000 f54bb060 SYMREDRV SYMREDRV.SYS Sat Jan 22 00:58:32 2005 (41F1EB88)
f5f37000 f5f3b500 watchdog watchdog.sys Wed Aug 04 02:07:32 2004 (41107D24)
f5f47000 f5f4d180 HIDPARSE HIDPARSE.SYS Wed Aug 04 02:08:15 2004 (41107D4F)
f5f4f000 f5f55780 USBSTOR USBSTOR.SYS Wed Aug 04 02:08:44 2004 (41107D6C)
f5f57000 f5f5d500 usbprint usbprint.sys Wed Aug 04 02:01:23 2004 (41107BB3)
f6311000 f6313280 rasacd rasacd.sys Fri Aug 17 16:55:39 2001 (3B7D84CB)
f6321000 f6324f00 MODEMCSA MODEMCSA.sys Fri Aug 17 16:57:37 2001 (3B7D8541)
f6eb8000 f6ee6000 Bt848 Bt848.sys Thu Feb 26 03:58:10 2004 (403DB522)
f6ee6000 f6f08e80 USBPORT USBPORT.SYS Wed Aug 04 02:08:34 2004 (41107D62)
f6fcf000 f6fddb80 drmk drmk.sys Wed Aug 04 02:07:54 2004 (41107D3A)
f75e0000 f75e3280 ndisuio ndisuio.sys Wed Aug 04 02:03:10 2004 (41107C1E)
f763d000 f7657580 Mup Mup.sys Wed Aug 04 02:15:20 2004 (41107EF8)
f7658000 f7684a80 NDIS NDIS.sys Wed Aug 04 02:14:27 2004 (41107EC3)
f7685000 f7711480 Ntfs Ntfs.sys Wed Aug 04 02:15:06 2004 (41107EEA)
f7712000 f7728780 KSecDD KSecDD.sys Wed Aug 04 01:59:45 2004 (41107B51)
f7729000 f773af00 sr sr.sys Wed Aug 04 02:06:22 2004 (41107CDE)
f773b000 f7759780 fltmgr fltmgr.sys Wed Aug 04 02:01:17 2004 (41107BAD)
f775a000 f7771800 SCSIPORT SCSIPORT.SYS Wed Aug 04 01:59:39 2004 (41107B4B)
f7772000 f7789480 atapi atapi.sys Wed Aug 04 01:59:41 2004 (41107B4D)
f778a000 f77af700 dmio dmio.sys Wed Aug 04 02:07:13 2004 (41107D11)
f77b0000 f77ce880 ftdisk ftdisk.sys Fri Aug 17 16:52:41 2001 (3B7D8419)
f77cf000 f77dfa80 pci pci.sys Wed Aug 04 02:07:45 2004 (41107D31)
f77e0000 f780dd80 ACPI ACPI.sys Wed Aug 04 02:07:35 2004 (41107D27)
f782f000 f7837c00 isapnp isapnp.sys Fri Aug 17 16:58:01 2001 (3B7D8559)
f783f000 f784de80 ohci1394 ohci1394.sys Wed Aug 04 02:10:05 2004 (41107DBD)
f784f000 f785c000 1394BUS 1394BUS.SYS Wed Aug 04 02:10:03 2004 (41107DBB)
f785f000 f7869500 MountMgr MountMgr.sys Wed Aug 04 01:58:29 2004 (41107B05)
f786f000 f787bc80 VolSnap VolSnap.sys Wed Aug 04 02:00:14 2004 (41107B6E)
f787f000 f788cf80 si3112 si3112.sys Mon Jun 14 22:03:50 2004 (40CE5906)
f788f000 f789bd80 nvatabus nvatabus.sys Mon Apr 21 17:32:54 2003 (3EA46386)
f789f000 f78a7e00 disk disk.sys Wed Aug 04 01:59:53 2004 (41107B59)
f78af000 f78bb200 CLASSPNP CLASSPNP.SYS Wed Aug 04 02:14:26 2004 (41107EC2)
f78ef000 f78f8200 amdk7 amdk7.sys Wed Aug 04 01:59:19 2004 (41107B37)
f78ff000 f790ae00 nvax nvax.sys Tue May 25 18:58:00 2004 (40B3CF78)
f7a4f000 f7a5e180 nic1394 nic1394.sys Wed Aug 04 01:58:28 2004 (41107B04)
f7aaf000 f7ab5200 PCIIDEX PCIIDEX.SYS Wed Aug 04 01:59:40 2004 (41107B4C)
f7ab7000 f7abb900 PartMgr PartMgr.sys Fri Aug 17 21:32:23 2001 (3B7DC5A7)
f7abf000 f7ac3900 nv_agp nv_agp.sys Wed Mar 19 19:13:47 2003 (3E7907BB)
f7ad7000 f7adc000 flpydisk flpydisk.sys Wed Aug 04 01:59:24 2004 (41107B3C)
f7aff000 f7b03280 usbohci usbohci.sys Wed Aug 04 02:08:34 2004 (41107D62)
f7b07000 f7b0d800 usbehci usbehci.sys Wed Aug 04 02:08:34 2004 (41107D62)
f7be7000 f7bec200 vga vga.sys Wed Aug 04 02:07:06 2004 (41107D0A)
f7bef000 f7bf3a80 Msfs Msfs.SYS Wed Aug 04 02:00:37 2004 (41107B85)
f7c27000 f7c2e880 Npfs Npfs.SYS Wed Aug 04 02:00:38 2004 (41107B86)
f7c3f000 f7c42000 BOOTVID BOOTVID.dll Fri Aug 17 16:49:09 2001 (3B7D8345)
f7c43000 f7c45800 SiWinAcc SiWinAcc.sys Thu May 20 14:38:49 2004 (40ACFB39)
f7d2f000 f7d30b80 kdcom kdcom.dll Fri Aug 17 16:49:10 2001 (3B7D8346)
f7d31000 f7d32100 WMILIB WMILIB.SYS Fri Aug 17 17:07:23 2001 (3B7D878B)
f7d33000 f7d34700 dmload dmload.sys Fri Aug 17 16:58:15 2001 (3B7D8567)
f7d71000 f7d72f00 Fs_Rec Fs_Rec.SYS Fri Aug 17 16:49:37 2001 (3B7D8361)
f7d73000 f7d74080 Beep Beep.SYS Fri Aug 17 16:47:33 2001 (3B7D82E5)
f7d75000 f7d76080 mnmdd mnmdd.SYS Fri Aug 17 16:57:28 2001 (3B7D8538)
f7d77000 f7d78080 RDPCDD RDPCDD.sys Fri Aug 17 16:46:56 2001 (3B7D82C0)
f7d7b000 f7d7c780 bjhid bjhid.sys Sun Nov 10 06:20:01 2002 (3DCE40E1)
f7dad000 f7dae640 SYMDNS SYMDNS.SYS Sat Jan 22 00:56:20 2005 (41F1EB04)
f7dc1000 f7dc2a80 ParVdm ParVdm.SYS Fri Aug 17 16:49:49 2001 (3B7D836D)
f7dc3000 f7dc42c0 CDRPDACC CDRPDACC.SYS Tue Oct 28 16:01:25 2003 (3F9ED925)
f7df7000 f7df7d00 pciide pciide.sys Fri Aug 17 16:51:49 2001 (3B7D83E5)
f7e35000 f7e35b80 Null Null.SYS Fri Aug 17 16:47:39 2001 (3B7D82EB)
f7ef6000 f7ef6d00 dxgthk dxgthk.sys Fri Aug 17 16:53:12 2001 (3B7D8438)

Unloaded modules:
b74d5000 b74ff000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b6ca9000 b6cd3000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b6ca9000 b6cd3000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b74d5000 b74ff000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b8012000 b803c000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b873d000 b8767000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7e63000 f7e64000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b878f000 b87b2000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b922b000 b9238000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b924b000 b9259000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
edf89000 edf8b000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7ae7000 f7aef000 wceusbsh.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f2732000 f273b000 processr.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7adf000 f7ae4000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f6335000 f6338000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

can you post two more different dumps

trim off the drivers list (everything below start end module name)

 

Second dump file. This one is: PAGE_FAULT_IN_NONPAGED_AREA (50)

I'll try to get a third post uploaded tonight.
Thanks!!
----------
Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini030205-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Wed Mar 2 17:39:43.446 2005 (GMT-5)
System Uptime: 1 days 22:34:44.386
Loading Kernel Symbols
.......................................................................................................................................................
Loading unloaded module list
.......................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {e04d1300, 0, 8054b52d, 0}


Could not read faulting driver name
Probably caused by : ntoskrnl.exe ( nt!ExAllocatePoolWithTag+66c )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e04d1300, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8054b52d, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: e04d1300

FAULTING_IP:
nt!ExAllocatePoolWithTag+66c
8054b52d 8b08 mov ecx,[eax]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from 804e730c to 8054b52d

STACK_TEXT:
b7dbbd18 804e730c 00000009 00000001 f0547350 nt!ExAllocatePoolWithTag+0x66c
b7dbbd3c 8057f9f2 00000009 00000008 f0547350 nt!ExAllocatePoolWithQuotaTag+0x46
b7dbbd58 804df06b e1eab330 0613ffec 7c90eb94 nt!NtRegisterThreadTerminatePort+0x43
b7dbbd58 7c90eb94 e1eab330 0613ffec 7c90eb94 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0613ffac 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
nt!ExAllocatePoolWithTag+66c
8054b52d 8b08 mov ecx,[eax]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!ExAllocatePoolWithTag+66c

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41108004

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0x50_nt!ExAllocatePoolWithTag+66c

BUCKET_ID: 0x50_nt!ExAllocatePoolWithTag+66c

Followup: MachineOwner
---------

eax=e04d1300 ebx=867ee050 ecx=867ef0b8 edx=00000002 esi=867ee088 edi=000001ff
eip=8054b52d esp=b7dbbcc4 ebp=b7dbbd18 iopl=0 nv up ei pl nz ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010216
nt!ExAllocatePoolWithTag+0x66c:
8054b52d 8b08 mov ecx,[eax] ds:0023:e04d1300=????????
ChildEBP RetAddr Args to Child
b7dbbd18 804e730c 00000009 00000001 f0547350 nt!ExAllocatePoolWithTag+0x66c (FPO: [Non-Fpo])
b7dbbd3c 8057f9f2 00000009 00000008 f0547350 nt!ExAllocatePoolWithQuotaTag+0x46 (FPO: [Non-Fpo])
b7dbbd58 804df06b e1eab330 0613ffec 7c90eb94 nt!NtRegisterThreadTerminatePort+0x43 (FPO: [Non-Fpo])
b7dbbd58 7c90eb94 e1eab330 0613ffec 7c90eb94 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ b7dbbd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0613ffac 00000000 00000000 00000000 00000000 0x7c90eb94

 

another dump file

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini030605-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Sat Mar 5 23:55:45.370 2005 (GMT-5)
System Uptime: 0 days 9:28:04.628
Loading Kernel Symbols
........................................................................................................................................................
Loading unloaded module list
...................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, e3806410, e3806410, c000106}

GetUlongFromAddress: unable to read from 80563070
Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+2be )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: e3806410, The pool entry we were looking for within the page.
Arg3: e3806410, The next pool entry.
Arg4: 0c000106, (reserved)

Debugging Details:
------------------

GetUlongFromAddress: unable to read from 80563070

BUGCHECK_STR: 0x19_20

POOL_ADDRESS: e3806410

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 8054be41 to 805339ae

STACK_TEXT:
b9565c70 8054be41 00000019 00000020 e3806410 nt!KeBugCheckEx+0x1b
b9565cc0 8057811a e3806418 00000000 b9565d44 nt!ExFreePoolWithTag+0x2be
b9565cd0 80598703 e3806418 b9565d01 00000001 nt!SeReleaseLuidAndAttributesArray+0x26
b9565d44 804df06b 00000134 00000000 0017688c nt!NtAdjustPrivilegesToken+0x32e
b9565d44 7c90eb94 00000134 00000000 0017688c nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00c7ff2c 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
nt!ExFreePoolWithTag+2be
8054be41 83f801 cmp eax,0x1

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!ExFreePoolWithTag+2be

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41108004

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2be

BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2be

Followup: MachineOwner
---------

eax=ffdff13c ebx=e3806410 ecx=00000000 edx=00000106 esi=e3806410 edi=0017649c
eip=805339ae esp=b9565c58 ebp=b9565c70 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
805339ae 5d pop ebp
ChildEBP RetAddr Args to Child
b9565c70 8054be41 00000019 00000020 e3806410 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
b9565cc0 8057811a e3806418 00000000 b9565d44 nt!ExFreePoolWithTag+0x2be (FPO: [Non-Fpo])
b9565cd0 80598703 e3806418 b9565d01 00000001 nt!SeReleaseLuidAndAttributesArray+0x26 (FPO: [Non-Fpo])
b9565d44 804df06b 00000134 00000000 0017688c nt!NtAdjustPrivilegesToken+0x32e (FPO: [Non-Fpo])
b9565d44 7c90eb94 00000134 00000000 0017688c nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ b9565d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
00c7ff2c 00000000 00000000 00000000 00000000 0x7c90eb94
start end module name

 

fourth dump file. Hope this helps!

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini022805-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Mon Feb 28 12:39:11.828 2005 (GMT-5)
System Uptime: 0 days 6:08:05.430
Loading Kernel Symbols
......................................................................................................................................................
Loading unloaded module list
............
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {506f058, 2, 0, 804e594c}

*** ERROR: Module load completed but symbols could not be loaded for afd.sys
Probably caused by : afd.sys ( afd+e2ae )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0506f058, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804e594c, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 0506f058

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiInsertQueueApc+84
804e594c 8b7704 mov esi,[edi+0x4]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 804e59e1 to 804e594c

STACK_TEXT:
805506f4 804e59e1 85145048 85145008 00000000 nt!KiInsertQueueApc+0x84
80550714 804ed174 85145048 86324f28 00000000 nt!KeInsertQueueApc+0x40
80550748 ebe5a2ae ebe5a240 805507a4 edf503ff nt!IopfCompleteRequest+0x1d8
WARNING: Stack unwind information not available. Following frames may be wrong.
80550764 804dcaad 86343768 86343758 69ef6622 afd+0xe2ae
80550880 804dc928 80559580 80559320 ffdff000 nt!KiTimerListExpire+0x122
805508ac 804dc179 80559980 00000000 0015915b nt!KiTimerExpiration+0xaf
805508c0 80559320 ffdffc50 00000000 00000000 nt!KiRetireDpcList+0x46
805508d0 804dc0ed 00000000 0000000e 00000000 nt!KiIdleThread0


FOLLOWUP_IP:
afd+e2ae
ebe5a2ae 56 push esi

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: afd+e2ae

MODULE_NAME: afd

IMAGE_NAME: afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107eb5

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xA_afd+e2ae

BUCKET_ID: 0xA_afd+e2ae

Followup: MachineOwner
---------

eax=85145048 ebx=00000000 ecx=8506f020 edx=00000000 esi=00000000 edi=0506f054
eip=804e594c esp=805506e4 ebp=805506f4 iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!KiInsertQueueApc+0x84:
804e594c 8b7704 mov esi,[edi+0x4] ds:0023:0506f058=????????
ChildEBP RetAddr Args to Child
805506f4 804e59e1 85145048 85145008 00000000 nt!KiInsertQueueApc+0x84 (FPO: [Non-Fpo])
80550714 804ed174 85145048 86324f28 00000000 nt!KeInsertQueueApc+0x40 (FPO: [Non-Fpo])
80550748 ebe5a2ae ebe5a240 805507a4 edf503ff nt!IopfCompleteRequest+0x1d8 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
80550764 804dcaad 86343768 86343758 69ef6622 afd+0xe2ae
80550880 804dc928 80559580 80559320 ffdff000 nt!KiTimerListExpire+0x122 (FPO: [Non-Fpo])
805508ac 804dc179 80559980 00000000 0015915b nt!KiTimerExpiration+0xaf (FPO: [Non-Fpo])
805508c0 80559320 ffdffc50 00000000 00000000 nt!KiRetireDpcList+0x46 (FPO: [0,0,0])
805508d0 804dc0ed 00000000 0000000e 00000000 nt!KiIdleThread0
start end module name

 

Ok great. 2 of the four are 100% pool corruption. the other two are probably the result of it, but cannot be conclusively done without actual debugging to confirm.

Heres the instructions for enabling special pool:
http://www.windowsbbs.com/showpost.php?p=221888&postcount=3

 

Added the following Registy Keys...

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

PoolTag DWORD Hex 2A
PoolTagOverruns Hex 1

I hope these are the correct values to use.

 

yup

 

Debug #1

Ok, I've had 5 BSOD's since updating the registry with the recommended pool values. I'm going to post all 5. Hope that's not overkill. Starting with the most recent... (let me know if you need the full log file)

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini031505-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Tue Mar 15 20:12:11.046 2005 (GMT-5)
System Uptime: 0 days 0:00:40.625
Loading Kernel Symbols
.......................................................................................................................................................
Loading unloaded module list
....
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C1, {93eaeff0, 93eaeffc, 29000c, 24}

*** ERROR: Module load completed but symbols could not be loaded for LMouKE.Sys
Probably caused by : LMouKE.Sys ( LMouKE+c27 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: 93eaeff0, address trying to free
Arg2: 93eaeffc, address where bits are corrupted
Arg3: 0029000c, (reserved)
Arg4: 00000024, caller is freeing an address where bytes after the end of the allocation have been overwritten

Debugging Details:
------------------


BUGCHECK_STR: 0xC1_24

SPECIAL_POOL_CORRUPTION_TYPE: 24

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 8067f82e to 805339ae

IRP_ADDRESS: a272ef68

STACK_TEXT:
ec45ea18 8067f82e 000000c1 93eaeff0 93eaeffc nt!KeBugCheckEx+0x1b
ec45ea58 8054bcaa 93eaeff0 85ba06e8 93eaeffc nt!MmFreeSpecialPool+0x29b
ec45ea98 804ed0ff 93eaeff0 00000000 a272efa8 nt!ExFreePoolWithTag+0x4a
ec45eaec 804ed15a a272efa8 ec45eb38 ec45eb2c nt!IopCompleteRequest+0xf4
ec45eb3c 806eec35 00000000 00000000 ec45eb54 nt!KiDeliverApc+0xb3
ec45eb3c 806ee866 00000000 00000000 ec45eb54 hal!HalpApcInterrupt+0xc5
ec45ebc4 804e59ec a272efa8 a272ef68 00000000 hal!KeReleaseInStackQueuedSpinLock+0x16
ec45ebe4 804ed174 a272efa8 85ba06e8 00000000 nt!KeInsertQueueApc+0x4b
ec45ec18 ef850c27 85ba1dd8 94c5ef38 a272ef68 nt!IopfCompleteRequest+0x1d8
ec45ec34 804e3d77 0000000c a272ef68 806ee2d0 LMouKE+0xc27
ec45ec44 8056a9ab a272efd8 85ba06e8 a272ef68 nt!IopfCallDriver+0x31
ec45ec58 8057d9f7 952b8e68 a272ef68 85ba06e8 nt!IopSynchronousServiceTail+0x60
ec45ed00 8057fbfa 000006b4 00000000 00000000 nt!IopXxxControlFile+0x611
ec45ed34 804df06b 000006b4 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
ec45ed34 7c90eb94 000006b4 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f6fb1c 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
LMouKE+c27
ef850c27 8b5d0c mov ebx,[ebp+0xc]

SYMBOL_STACK_INDEX: 9

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: LMouKE+c27

MODULE_NAME: LMouKE

IMAGE_NAME: LMouKE.Sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41781c80

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xC1_24_LMouKE+c27

BUCKET_ID: 0xC1_24_LMouKE+c27

Followup: MachineOwner
---------

eax=ffdff13c ebx=93eaeffc ecx=00000000 edx=93ea0000 esi=0000000c edi=93eae000
eip=805339ae esp=ec45ea00 ebp=ec45ea18 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
805339ae 5d pop ebp
ChildEBP RetAddr Args to Child
ec45ea18 8067f82e 000000c1 93eaeff0 93eaeffc nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
ec45ea58 8054bcaa 93eaeff0 85ba06e8 93eaeffc nt!MmFreeSpecialPool+0x29b (FPO: [Non-Fpo])
ec45ea98 804ed0ff 93eaeff0 00000000 a272efa8 nt!ExFreePoolWithTag+0x4a (FPO: [Non-Fpo])
ec45eaec 804ed15a a272efa8 ec45eb38 ec45eb2c nt!IopCompleteRequest+0xf4 (FPO: [Non-Fpo])
ec45eb3c 806eec35 00000000 00000000 ec45eb54 nt!KiDeliverApc+0xb3 (FPO: [Non-Fpo])
ec45eb3c 806ee866 00000000 00000000 ec45eb54 hal!HalpApcInterrupt+0xc5 (FPO: [0,2] TrapFrame @ ec45eb54)
ec45ebc4 804e59ec a272efa8 a272ef68 00000000 hal!KeReleaseInStackQueuedSpinLock+0x16 (FPO: [0,0,0])
ec45ebe4 804ed174 a272efa8 85ba06e8 00000000 nt!KeInsertQueueApc+0x4b (FPO: [Non-Fpo])
ec45ec18 ef850c27 85ba1dd8 94c5ef38 a272ef68 nt!IopfCompleteRequest+0x1d8 (FPO: [Non-Fpo])
ec45ec34 804e3d77 0000000c a272ef68 806ee2d0 LMouKE+0xc27 (FPO: [Non-Fpo])
ec45ec44 8056a9ab a272efd8 85ba06e8 a272ef68 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
ec45ec58 8057d9f7 952b8e68 a272ef68 85ba06e8 nt!IopSynchronousServiceTail+0x60 (FPO: [Non-Fpo])
ec45ed00 8057fbfa 000006b4 00000000 00000000 nt!IopXxxControlFile+0x611 (FPO: [Non-Fpo])
ec45ed34 804df06b 000006b4 00000000 00000000 nt!NtDeviceIoControlFile+0x2a (FPO: [Non-Fpo])
ec45ed34 7c90eb94 000006b4 00000000 00000000 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ ec45ed64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f6fb1c 00000000 00000000 00000000 00000000 0x7c90eb94

 

Debug #2

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini031505-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Tue Mar 15 17:53:30.109 2005 (GMT-5)
System Uptime: 0 days 21:05:19.688
Loading Kernel Symbols
.......................................................................................................................................................
Loading unloaded module list
............
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {c06ee25a, 2, 0, 806ee726}

*** ERROR: Module load completed but symbols could not be loaded for Bt848.sys
Probably caused by : STREAM.SYS ( STREAM!SCCallBackSrb+37 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c06ee25a, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 806ee726, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: c06ee25a

CURRENT_IRQL: 2

FAULTING_IP:
hal!KfReleaseSpinLock+6
806ee726 8a8858e26e80 mov cl,[eax+0x806ee258]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from ecd7ece7 to 806ee726

STACK_TEXT:
eb12495c ecd7ece7 00000000 8fdfeb80 eb124a40 hal!KfReleaseSpinLock+0x6
eb12496c ecd7f48f 854a4718 8fdfeb80 8fdfeb80 STREAM!SCCallBackSrb+0x37
eb124a40 ecd7f801 00000000 8fdfeac8 00000000 STREAM!StreamClassDpc+0x273
eb124a5c ecd80bcb 8fdfeb80 eb124a73 854a4718 STREAM!SCEndUnsynchronizedMinidriverDeviceCallin+0x29
eb124a74 bacc87ad 00000001 8fdfedc4 854a4718 STREAM!StreamClassDeviceNotification+0xb5
WARNING: Stack unwind information not available. Following frames may be wrong.
eb124a88 bacc855c 854a4718 00000006 eb124ab0 Bt848+0xb7ad
eb124a98 bacc867c 854a4718 00000001 00000000 Bt848+0xb55c
eb124ab0 ecd7f6ae 854a4718 854a4790 854a4718 Bt848+0xb67c
eb124acc ecd83897 00dfeb80 00000000 854a4718 STREAM!SCIssueRequestToDevice+0xd2
eb124afc ecd83b2b 00000106 85c43fe8 00000000 STREAM!SCSubmitRequest+0xb1
eb124b40 ecd85be2 00000106 01351bd8 85370150 STREAM!SCMinidriverDevicePropertyHandler+0x97
eb124b58 baca2f4c 85351bd8 85370150 85370008 STREAM!StreamClassMinidriverDeviceSetProperty+0x18
eb124bbc baca2ec9 85351bd8 00000006 85c437a4 ks!KspPropertyHandler+0x616
eb124be0 ecd85ceb 85351bd8 00000006 85c43768 ks!KsPropertyHandler+0x19
eb124c00 baca2f0f 8fdfeb80 85351bd8 eb124c34 STREAM!FilterDispatchIoControl+0xc3
eb124c10 ecd7fb5d 8fdfeac8 85351bd8 853c5620 ks!KsDispatchIrp+0x126
eb124c34 804e3d77 8fdfeac8 85351bd8 806ee2d0 STREAM!StreamClassPassThroughIrp+0xf1
eb124c44 8056a9ab 85351c6c 85ca4730 85351bd8 nt!IopfCallDriver+0x31
eb124c58 8057d9f7 8fdfeac8 85351bd8 85ca4730 nt!IopSynchronousServiceTail+0x60
eb124d00 8057fbfa 000001a8 000001d4 00000000 nt!IopXxxControlFile+0x611
eb124d34 804df06b 000001a8 000001d4 00000000 nt!NtDeviceIoControlFile+0x2a
eb124d34 7c90eb94 000001a8 000001d4 00000000 nt!KiFastCallEntry+0xf8
0012fb54 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
STREAM!SCCallBackSrb+37
ecd7ece7 eb0a jmp STREAM!SCCallBackSrb+0x43 (ecd7ecf3)

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: STREAM!SCCallBackSrb+37

MODULE_NAME: STREAM

IMAGE_NAME: STREAM.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41107d3e

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xA_STREAM!SCCallBackSrb+37

BUCKET_ID: 0xA_STREAM!SCCallBackSrb+37

Followup: MachineOwner
---------

eax=00000002 ebx=00000000 ecx=00000000 edx=00000002 esi=8fdfec58 edi=854a4718
eip=806ee726 esp=eb124960 ebp=eb12496c iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
hal!KfReleaseSpinLock+0x6:
806ee726 8a8858e26e80 mov cl,[eax+0x806ee258] ds:0023:806ee25a=41
ChildEBP RetAddr Args to Child
eb12495c ecd7ece7 00000000 8fdfeb80 eb124a40 hal!KfReleaseSpinLock+0x6 (FPO: [0,0,0])
eb12496c ecd7f48f 854a4718 8fdfeb80 8fdfeb80 STREAM!SCCallBackSrb+0x37 (FPO: [Non-Fpo])
eb124a40 ecd7f801 00000000 8fdfeac8 00000000 STREAM!StreamClassDpc+0x273 (FPO: [Non-Fpo])
eb124a5c ecd80bcb 8fdfeb80 eb124a73 854a4718 STREAM!SCEndUnsynchronizedMinidriverDeviceCallin+0x29 (FPO: [Non-Fpo])
eb124a74 bacc87ad 00000001 8fdfedc4 854a4718 STREAM!StreamClassDeviceNotification+0xb5 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
eb124a88 bacc855c 854a4718 00000006 eb124ab0 Bt848+0xb7ad
eb124a98 bacc867c 854a4718 00000001 00000000 Bt848+0xb55c
eb124ab0 ecd7f6ae 854a4718 854a4790 854a4718 Bt848+0xb67c
eb124acc ecd83897 00dfeb80 00000000 854a4718 STREAM!SCIssueRequestToDevice+0xd2 (FPO: [Non-Fpo])
eb124afc ecd83b2b 00000106 85c43fe8 00000000 STREAM!SCSubmitRequest+0xb1 (FPO: [Non-Fpo])
eb124b40 ecd85be2 00000106 01351bd8 85370150 STREAM!SCMinidriverDevicePropertyHandler+0x97 (FPO: [Non-Fpo])
eb124b58 baca2f4c 85351bd8 85370150 85370008 STREAM!StreamClassMinidriverDeviceSetProperty+0x18 (FPO: [Non-Fpo])
eb124bbc baca2ec9 85351bd8 00000006 85c437a4 ks!KspPropertyHandler+0x616 (FPO: [Non-Fpo])
eb124be0 ecd85ceb 85351bd8 00000006 85c43768 ks!KsPropertyHandler+0x19 (FPO: [Non-Fpo])
eb124c00 baca2f0f 8fdfeb80 85351bd8 eb124c34 STREAM!FilterDispatchIoControl+0xc3 (FPO: [Non-Fpo])
eb124c10 ecd7fb5d 8fdfeac8 85351bd8 853c5620 ks!KsDispatchIrp+0x126 (FPO: [Non-Fpo])
eb124c34 804e3d77 8fdfeac8 85351bd8 806ee2d0 STREAM!StreamClassPassThroughIrp+0xf1 (FPO: [Non-Fpo])
eb124c44 8056a9ab 85351c6c 85ca4730 85351bd8 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
eb124c58 8057d9f7 8fdfeac8 85351bd8 85ca4730 nt!IopSynchronousServiceTail+0x60 (FPO: [Non-Fpo])
eb124d00 8057fbfa 000001a8 000001d4 00000000 nt!IopXxxControlFile+0x611 (FPO: [Non-Fpo])

 

Debug #3

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini031405-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Mon Mar 14 20:46:49.718 2005 (GMT-5)
System Uptime: 0 days 0:00:40.312
Loading Kernel Symbols
.......................................................................................................................................................
Loading unloaded module list
....
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C1, {a0d80ff0, a0d80ffc, 15000c, 24}

*** ERROR: Module load completed but symbols could not be loaded for LMouKE.Sys
Probably caused by : LMouKE.Sys ( LMouKE+c27 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: a0d80ff0, address trying to free
Arg2: a0d80ffc, address where bits are corrupted
Arg3: 0015000c, (reserved)
Arg4: 00000024, caller is freeing an address where bytes after the end of the allocation have been overwritten

Debugging Details:
------------------


BUGCHECK_STR: 0xC1_24

SPECIAL_POOL_CORRUPTION_TYPE: 24

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 8067f82e to 805339ae

IRP_ADDRESS: a0c7af68

STACK_TEXT:
b91d2a18 8067f82e 000000c1 a0d80ff0 a0d80ffc nt!KeBugCheckEx+0x1b
b91d2a58 8054bcaa a0d80ff0 a24bcf90 a0d80ffc nt!MmFreeSpecialPool+0x29b
b91d2a98 804ed0ff a0d80ff0 00000000 a0c7afa8 nt!ExFreePoolWithTag+0x4a
b91d2aec 804ed15a a0c7afa8 b91d2b38 b91d2b2c nt!IopCompleteRequest+0xf4
b91d2b3c 806eec35 00000000 00000000 b91d2b54 nt!KiDeliverApc+0xb3
b91d2b3c 806ee866 00000000 00000000 b91d2b54 hal!HalpApcInterrupt+0xc5
b91d2bc4 804e59ec a0c7afa8 a0c7af68 00000000 hal!KeReleaseInStackQueuedSpinLock+0x16
b91d2be4 804ed174 a0c7afa8 a24bcf90 00000000 nt!KeInsertQueueApc+0x4b
b91d2c18 ec91ac27 a32cafb8 8ae28f38 a0c7af68 nt!IopfCompleteRequest+0x1d8
b91d2c34 804e3d77 0000000c a0c7af68 806ee2d0 LMouKE+0xc27
b91d2c44 8056a9ab a0c7afd8 a24bcf90 a0c7af68 nt!IopfCallDriver+0x31
b91d2c58 8057d9f7 8b5e2e68 a0c7af68 a24bcf90 nt!IopSynchronousServiceTail+0x60
b91d2d00 8057fbfa 000006b0 00000000 00000000 nt!IopXxxControlFile+0x611
b91d2d34 804df06b 000006b0 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
b91d2d34 7c90eb94 000006b0 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f6fb1c 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
LMouKE+c27
ec91ac27 8b5d0c mov ebx,[ebp+0xc]

SYMBOL_STACK_INDEX: 9

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: LMouKE+c27

MODULE_NAME: LMouKE

IMAGE_NAME: LMouKE.Sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41781c80

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xC1_24_LMouKE+c27

BUCKET_ID: 0xC1_24_LMouKE+c27

Followup: MachineOwner
---------

eax=ffdff13c ebx=a0d80ffc ecx=00000000 edx=a0d80000 esi=0000000c edi=a0d80000
eip=805339ae esp=b91d2a00 ebp=b91d2a18 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
805339ae 5d pop ebp
ChildEBP RetAddr Args to Child
b91d2a18 8067f82e 000000c1 a0d80ff0 a0d80ffc nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
b91d2a58 8054bcaa a0d80ff0 a24bcf90 a0d80ffc nt!MmFreeSpecialPool+0x29b (FPO: [Non-Fpo])
b91d2a98 804ed0ff a0d80ff0 00000000 a0c7afa8 nt!ExFreePoolWithTag+0x4a (FPO: [Non-Fpo])
b91d2aec 804ed15a a0c7afa8 b91d2b38 b91d2b2c nt!IopCompleteRequest+0xf4 (FPO: [Non-Fpo])
b91d2b3c 806eec35 00000000 00000000 b91d2b54 nt!KiDeliverApc+0xb3 (FPO: [Non-Fpo])
b91d2b3c 806ee866 00000000 00000000 b91d2b54 hal!HalpApcInterrupt+0xc5 (FPO: [0,2] TrapFrame @ b91d2b54)
b91d2bc4 804e59ec a0c7afa8 a0c7af68 00000000 hal!KeReleaseInStackQueuedSpinLock+0x16 (FPO: [0,0,0])
b91d2be4 804ed174 a0c7afa8 a24bcf90 00000000 nt!KeInsertQueueApc+0x4b (FPO: [Non-Fpo])
b91d2c18 ec91ac27 a32cafb8 8ae28f38 a0c7af68 nt!IopfCompleteRequest+0x1d8 (FPO: [Non-Fpo])
b91d2c34 804e3d77 0000000c a0c7af68 806ee2d0 LMouKE+0xc27 (FPO: [Non-Fpo])
b91d2c44 8056a9ab a0c7afd8 a24bcf90 a0c7af68 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
b91d2c58 8057d9f7 8b5e2e68 a0c7af68 a24bcf90 nt!IopSynchronousServiceTail+0x60 (FPO: [Non-Fpo])
b91d2d00 8057fbfa 000006b0 00000000 00000000 nt!IopXxxControlFile+0x611 (FPO: [Non-Fpo])
b91d2d34 804df06b 000006b0 00000000 00000000 nt!NtDeviceIoControlFile+0x2a (FPO: [Non-Fpo])
b91d2d34 7c90eb94 000006b0 00000000 00000000 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ b91d2d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f6fb1c 00000000 00000000 00000000 00000000 0x7c90eb94

 

Debug #4

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini031405-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Mon Mar 14 20:44:56.765 2005 (GMT-5)
System Uptime: 0 days 0:01:47.359
Loading Kernel Symbols
............................................................................................................................................................
Loading unloaded module list
....
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C1, {a6a7cff0, a6a7cffc, d7000c, 24}

*** ERROR: Module load completed but symbols could not be loaded for LMouKE.Sys
Probably caused by : LMouKE.Sys ( LMouKE+c27 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: a6a7cff0, address trying to free
Arg2: a6a7cffc, address where bits are corrupted
Arg3: 00d7000c, (reserved)
Arg4: 00000024, caller is freeing an address where bytes after the end of the allocation have been overwritten

Debugging Details:
------------------


BUGCHECK_STR: 0xC1_24

SPECIAL_POOL_CORRUPTION_TYPE: 24

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 8067f82e to 805339ae

IRP_ADDRESS: 8548a4d8

STACK_TEXT:
ed664a18 8067f82e 000000c1 a6a7cff0 a6a7cffc nt!KeBugCheckEx+0x1b
ed664a58 8054bcaa a6a7cff0 854992d0 a6a7cffc nt!MmFreeSpecialPool+0x29b
ed664a98 804ed0ff a6a7cff0 00000000 8548a518 nt!ExFreePoolWithTag+0x4a
ed664aec 804ed15a 8548a518 ed664b38 ed664b2c nt!IopCompleteRequest+0xf4
ed664b3c 806eec35 00000000 00000000 ed664b54 nt!KiDeliverApc+0xb3
ed664b3c 806ee866 00000000 00000000 ed664b54 hal!HalpApcInterrupt+0xc5
ed664bc4 804e59ec 8548a518 8548a4d8 00000000 hal!KeReleaseInStackQueuedSpinLock+0x16
ed664be4 804ed174 8548a518 854992d0 00000000 nt!KeInsertQueueApc+0x4b
ed664c18 eb390c27 85476230 924bcf38 8548a4d8 nt!IopfCompleteRequest+0x1d8
ed664c34 804e3d77 0000000c 8548a4d8 806ee2d0 LMouKE+0xc27
ed664c44 8056a9ab 8548a548 854992d0 8548a4d8 nt!IopfCallDriver+0x31
ed664c58 8057d9f7 96234e68 8548a4d8 854992d0 nt!IopSynchronousServiceTail+0x60
ed664d00 8057fbfa 000006b0 00000000 00000000 nt!IopXxxControlFile+0x611
ed664d34 804df06b 000006b0 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
ed664d34 7c90eb94 000006b0 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f3fb1c 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
LMouKE+c27
eb390c27 8b5d0c mov ebx,[ebp+0xc]

SYMBOL_STACK_INDEX: 9

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: LMouKE+c27

MODULE_NAME: LMouKE

IMAGE_NAME: LMouKE.Sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41781c80

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xC1_24_LMouKE+c27

BUCKET_ID: 0xC1_24_LMouKE+c27

Followup: MachineOwner
---------

eax=ffdff13c ebx=a6a7cffc ecx=00000000 edx=a6a70000 esi=0000000c edi=a6a7c000
eip=805339ae esp=ed664a00 ebp=ed664a18 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
805339ae 5d pop ebp
ChildEBP RetAddr Args to Child
ed664a18 8067f82e 000000c1 a6a7cff0 a6a7cffc nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
ed664a58 8054bcaa a6a7cff0 854992d0 a6a7cffc nt!MmFreeSpecialPool+0x29b (FPO: [Non-Fpo])
ed664a98 804ed0ff a6a7cff0 00000000 8548a518 nt!ExFreePoolWithTag+0x4a (FPO: [Non-Fpo])
ed664aec 804ed15a 8548a518 ed664b38 ed664b2c nt!IopCompleteRequest+0xf4 (FPO: [Non-Fpo])
ed664b3c 806eec35 00000000 00000000 ed664b54 nt!KiDeliverApc+0xb3 (FPO: [Non-Fpo])
ed664b3c 806ee866 00000000 00000000 ed664b54 hal!HalpApcInterrupt+0xc5 (FPO: [0,2] TrapFrame @ ed664b54)
ed664bc4 804e59ec 8548a518 8548a4d8 00000000 hal!KeReleaseInStackQueuedSpinLock+0x16 (FPO: [0,0,0])
ed664be4 804ed174 8548a518 854992d0 00000000 nt!KeInsertQueueApc+0x4b (FPO: [Non-Fpo])
ed664c18 eb390c27 85476230 924bcf38 8548a4d8 nt!IopfCompleteRequest+0x1d8 (FPO: [Non-Fpo])
ed664c34 804e3d77 0000000c 8548a4d8 806ee2d0 LMouKE+0xc27 (FPO: [Non-Fpo])
ed664c44 8056a9ab 8548a548 854992d0 8548a4d8 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
ed664c58 8057d9f7 96234e68 8548a4d8 854992d0 nt!IopSynchronousServiceTail+0x60 (FPO: [Non-Fpo])
ed664d00 8057fbfa 000006b0 00000000 00000000 nt!IopXxxControlFile+0x611 (FPO: [Non-Fpo])
ed664d34 804df06b 000006b0 00000000 00000000 nt!NtDeviceIoControlFile+0x2a (FPO: [Non-Fpo])
ed664d34 7c90eb94 000006b0 00000000 00000000 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ ed664d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f3fb1c 00000000 00000000 00000000 00000000 0x7c90eb94

 

Debug #5

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini031405-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Mon Mar 14 20:31:24.046 2005 (GMT-5)
System Uptime: 0 days 0:01:20.627
Loading Kernel Symbols
.......................................................................................................................................................
Loading unloaded module list
..........
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {c00883bc, 2, 0, 8067f223}

Probably caused by : memory_corruption ( nt!MiAllocateSpecialPool+ec )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c00883bc, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8067f223, address which referenced memory

Debugging Details:
------------------


OVERLAPPED_MODULE: kmixer

READ_ADDRESS: c00883bc

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiAllocateSpecialPool+ec
8067f223 8b0e mov ecx,[esi]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 8054c0af to 8067f223

STACK_TEXT:
eb25c88c 8054c0af 0000005c a079654b 00000001 nt!MiAllocateSpecialPool+0xec
eb25c8f4 80564cf7 00000001 0000005c a079654b nt!ExAllocatePoolWithTag+0x77
eb25c918 80564e5d 85baa528 80563a01 00000000 nt!ObpAllocateObject+0xc8
eb25c94c 8056bee3 80563a01 86996e70 00000000 nt!ObCreateObject+0x12a
eb25c9a8 8056817a 92f1cb60 00739a10 00000000 nt!CmpDoOpen+0x121
eb25cba0 80567e7e 00739a10 00000000 a573af30 nt!CmpParseKey+0x558
eb25cc28 80567c63 0000001c eb25cc68 00000040 nt!ObpLookupObjectName+0x119
eb25cc7c 805685d7 00000000 86996e70 80567501 nt!ObOpenObjectByName+0xeb
eb25cd50 804df06b 001011f0 00000001 0169f450 nt!NtOpenKey+0x1af
eb25cd50 7c90eb94 001011f0 00000001 0169f450 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0169f42c 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
nt!MiAllocateSpecialPool+ec
8067f223 8b0e mov ecx,[esi]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!MiAllocateSpecialPool+ec

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 41108004

STACK_COMMAND: kb

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_nt!MiAllocateSpecialPool+ec

BUCKET_ID: 0xA_nt!MiAllocateSpecialPool+ec

Followup: MachineOwner
---------

eax=0001dce3 ebx=00000000 ecx=0001bcff edx=00000000 esi=c00883bc edi=00000163
eip=8067f223 esp=eb25c86c ebp=eb25c88c iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!MiAllocateSpecialPool+0xec:
8067f223 8b0e mov ecx,[esi] ds:0023:c00883bc=????????
ChildEBP RetAddr Args to Child
eb25c88c 8054c0af 0000005c a079654b 00000001 nt!MiAllocateSpecialPool+0xec (FPO: [Non-Fpo])
eb25c8f4 80564cf7 00000001 0000005c a079654b nt!ExAllocatePoolWithTag+0x77 (FPO: [Non-Fpo])
eb25c918 80564e5d 85baa528 80563a01 00000000 nt!ObpAllocateObject+0xc8 (FPO: [Non-Fpo])
eb25c94c 8056bee3 80563a01 86996e70 00000000 nt!ObCreateObject+0x12a (FPO: [Non-Fpo])
eb25c9a8 8056817a 92f1cb60 00739a10 00000000 nt!CmpDoOpen+0x121 (FPO: [Non-Fpo])
eb25cba0 80567e7e 00739a10 00000000 a573af30 nt!CmpParseKey+0x558 (FPO: [Non-Fpo])
eb25cc28 80567c63 0000001c eb25cc68 00000040 nt!ObpLookupObjectName+0x119 (FPO: [Non-Fpo])
eb25cc7c 805685d7 00000000 86996e70 80567501 nt!ObOpenObjectByName+0xeb (FPO: [Non-Fpo])
eb25cd50 804df06b 001011f0 00000001 0169f450 nt!NtOpenKey+0x1af (FPO: [Non-Fpo])
eb25cd50 7c90eb94 001011f0 00000001 0169f450 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ eb25cd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0169f42c 00000000 00000000 00000000 00000000 0x7c90eb94

 

ok, fine work, im glad you posted all those dumps, you actually have two naughty drivers on your machine.

LMouKE.Sys - as best i can tell this is a logitech mouse driver.
Bt848.sys - looks like a conexant video driver

youll need to update or remove these drivers from the machine before you have stability. You can undo those two special pool registry keys, we are done with that for now. Once you get the drivers fixed, if you start getting problems again, we will start over in the troubleshooting.

 

Just following up...

Greetings!

We replaced the logitech mouse/keyboard drivers with the standard microsoft drivers. I haven't heard of any reported crashes since. So hopefully that was the main culprit. We left the bt848.sys driver in place. It was installed with an avermedia tv tuner card.

Thank you for your assistance! This is a great place!
-Brian