2003 Server Crashed

I have a Windows 2003 server suddenly crashed with 0x0000007f (0x00000008, 0xf773ffe0, 0x00000000, 0x00000000).

Below are the results of the dump debug. I am not sure why I get a failure on loading of some of the symbols or if it matters. Does this Debug point to the e1000325.sys as the problem? Any help interpreting this is greatly appreciated.


Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\temp\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: LanManNt, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.070304-2240
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Wed Oct 3 09:07:58.998 2007 (GMT-4)
System Uptime: 28 days 1:13:00.940
WARNING: Process directory table base CFF9F060 doesn't match CR3 00521000
WARNING: Process directory table base CFF9F060 doesn't match CR3 00521000
Loading Kernel Symbols
.......................................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details
Loading unloaded module list
.........
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, f773ffe0, 0, 0}

*** ERROR: Module load completed but symbols could not be loaded for e1000325.sys
*** ERROR: Module load completed but symbols could not be loaded for ino_fltr.sys
*** WARNING: Unable to verify timestamp for ati3duag.dll
*** ERROR: Module load completed but symbols could not be loaded for ati3duag.dll
Probably caused by : e1000325.sys ( e1000325+2bda )

Followup: MachineOwner
---------

2: kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: f773ffe0
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_8

TSS: 00000028 -- (.tss 28)
eax=00000001 ebx=00000000 ecx=83f52cf0 edx=b7b9d074 esi=8a9a3218 edi=83f52cf0
eip=baa30bda esp=b7b9cfec ebp=b7b9d02c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
e1000325+0x2bda:
baa30bda 53 push ebx
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 2

TRAP_FRAME: b7b9de3c -- (.trap ffffffffb7b9de3c)
ErrCode = 00000000
eax=c1749800 ebx=0000000e ecx=0000000f edx=00000000 esi=8b0fb280 edi=00000000
eip=808b64a6 esp=b7b9deb0 ebp=b7b9deec iopl=0 nv up ei ng nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293
nt!CcMapData+0x8c:
Page 48c2e not present in the dump file. Type ".hh dbgerr004" for details
808b64a6 8a10 mov dl,byte ptr [eax] ds:0023:c1749800=??
Resetting default scope

LAST_CONTROL_TRANSFER: from baa31217 to baa30bda

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b7b9d02c baa31217 8a9a3218 83f52cf0 8676a578 e1000325+0x2bda
b7b9d048 f76ec790 8a9a3594 b7b9d074 00000001 e1000325+0x3217
b7b9d060 80a5b147 8b2f89b0 00000000 86493888 NDIS!ndisMProcessSGList+0x90
b7b9d08c f76ec69f 86493888 8b2f89b0 8676a558 hal!HalBuildScatterGatherList+0x1c7
b7b9d0e8 f76c92ff 89fc1008 83f52cf0 84f53b20 NDIS!ndisMAllocSGList+0xda
b7b9d104 b95aea5b 89fe7678 83f52cf0 86676548 NDIS!ndisMSendX+0x1dd
b7b9d12c b95adb95 89fc1008 83f52cf0 86676548 tcpip!ARPSendData+0x1a9
b7b9d158 b95ae634 8667655c b7b9d202 00000001 tcpip!ARPTransmit+0x112
b7b9d294 b95b2407 b95ec4d8 84f53b88 84f53b20 tcpip!_IPTransmit+0x866
b7b9d304 b95b261a 1af31112 b9d34002 1ac0d898 tcpip!TCPSend+0x604
b7b9d334 b95b0edd 00000001 00000000 00000030 tcpip!TdiSend+0x242
b7b9d370 ba6c89ac 877304a4 02f45b74 f7de2878 tcpip!TCPSendData+0xbf
b7b9d394 ba6d1a46 8b0ad000 853aea10 8b0ad000 msiscsi!iSpSendData+0xae
b7b9d43c ba6d4101 013aea10 86dd2b02 86dd2bfc msiscsi!iSpSendScsiCommand+0x166
b7b9d45c ba6c2435 8089c180 86dd2b02 00000000 msiscsi!iSpProcessScsiCommand+0x13d
b7b9d484 ba6ab6ca 8af85264 8b0ad000 b7b9d4b0 msiscsi!iScsiStartIo+0x31b
b7b9d494 ba6abafc 8b02ec80 86dd2bfc 878aeac8 iscsiprt!RaCallMiniportStartIo+0x1e
b7b9d4b0 ba6b4182 86dd2bfc 89212b88 8b10d840 iscsiprt!RaidAdapterPostScatterGatherExecute+0x5e
b7b9d4d0 ba6af823 00000000 00000001 00000000 iscsiprt!RaUnitStartIo+0xc4
b7b9d4f0 ba6b3575 8b10d840 018aeac8 00000000 iscsiprt!RaidStartIoPacket+0x49
b7b9d514 ba6b48a6 8b10d758 878aeac8 886b82b8 iscsiprt!RaidUnitSubmitRequest+0x63
b7b9d530 ba6ae844 8b10d758 878aeac8 b7b9d554 iscsiprt!RaUnitScsiIrp+0x92
b7b9d540 8081df65 8b10d6a0 878aeac8 89ece370 iscsiprt!RaDriverScsiIrp+0x2a
b7b9d554 f7329440 878aeac8 878aeb9c 878aeac8 nt!IofCallDriver+0x45
b7b9d57c f73294e0 89fc4a88 878aeac8 878aeac8 mpio!MPIOReadWrite+0x19e
b7b9d648 f7329b34 89fc4a88 886b8238 878aeb78 mpio!MPIOPdoHandleRequest+0x76
b7b9d660 f7328945 89fc4b40 878aeac8 878aeac8 mpio!MPIOPdoInternalDeviceControl+0x3c
b7b9d688 f732916f 89fc4a88 89fc4d78 01000000 mpio!MPIOPdoCommonDeviceControl+0x1fb
b7b9d6a8 f73262ef 89fc4a88 878aeac8 b7b9d6cc mpio!MPIOPdoDispatch+0x8f
b7b9d6b8 8081df65 89fc4a88 878aeac8 86dd2b50 mpio!MPIOGlobalDispatch+0x19
b7b9d6cc f725b607 86dd2b50 ea4c9000 b7b9d710 nt!IofCallDriver+0x45
b7b9d6dc f725b2b2 86dd2b50 89fcd0e8 842f8f28 CLASSPNP!SubmitTransferPacket+0xbb
b7b9d710 f725b533 00000000 00001000 842f8f68 CLASSPNP!ServiceTransferRequest+0x1e4
b7b9d734 8081df65 89fcd030 00000000 8b58f790 CLASSPNP!ClassReadWrite+0x159
b7b9d748 f74c80cf 842f8e28 842f8f4c b7b9d76c nt!IofCallDriver+0x45
b7b9d758 8081df65 8a0cb5c8 842f8e28 842f8f8c PartMgr!PmReadWrite+0x95
b7b9d76c f725ef9d 842f8f8c 8b51e710 8a0a7550 nt!IofCallDriver+0x45
b7b9d788 8081df65 89f52c68 00000000 842f8e28 CLASSPNP!ClassReadWrite+0x159
b7b9d79c f7300053 842f8e28 8b5e5c68 842f8e28 nt!IofCallDriver+0x45
b7b9d7b8 8081df65 8a0a7498 842f8e28 842f8fb8 ftdisk!FtDiskReadWrite+0x1a9
b7b9d7cc f72a98bc 8b58fc80 89faca58 89f722d8 nt!IofCallDriver+0x45
b7b9d7e4 8081df65 89f722d8 842f8e28 842f8e28 volsnap!VolSnapRead+0x52
b7b9d7f8 f7b50a62 b7b9dadc b7b9d9dc f7b508d9 nt!IofCallDriver+0x45
b7b9d804 f7b508d9 b7b9dadc 89f722d8 c490e000 Ntfs!NtfsSingleAsync+0x91
b7b9d9dc f7b51156 b7b9dadc 842f8e28 89faca58 Ntfs!NtfsNonCachedIo+0x2db
b7b9dac8 f7b51079 b7b9dadc 842f8e28 00000001 Ntfs!NtfsCommonRead+0xaf5
b7b9dc74 8081df65 89e79718 842f8e28 8b582768 Ntfs!NtfsFsdRead+0x113
b7b9dc88 f7239c45 8b582768 89f01b80 00000000 nt!IofCallDriver+0x45
b7b9dcb0 8081df65 8a00fab8 842f8e28 842f8e28 fltmgr!FltpDispatch+0x6f
b7b9dcc4 b9246349 00000000 8a0262f8 42ac9000 nt!IofCallDriver+0x45
b7b9dcd8 8081df65 89f01ac8 842f8e28 842f8e28 ino_fltr+0x9349
b7b9dcec 8081e4ed 8b0fb280 887aa078 c060ba48 nt!IofCallDriver+0x45
b7b9dd04 8085114a 89fe810a 887aa0b0 887aa090 nt!IoPageRead+0x109
b7b9dda0 8085ea66 00000001 c1749800 887aa078 nt!MiDispatchFault+0xece
b7b9de24 8088c798 00000000 c1749800 00000000 nt!MmAccessFault+0x89e
b7b9de24 808b64a6 00000000 c1749800 00000000 nt!KiTrap0E+0xdc
b7b9deec f7b90f2d 89fe8138 b7b9df1c 00000400 nt!CcMapData+0x8c
b7b9df0c f7b8e494 87429ef8 89faca58 42ac9800 Ntfs!NtfsMapStream+0x4b
b7b9df80 f7b90df0 87429ef8 89e797f8 e125c410 Ntfs!NtfsReadMftRecord+0x86
b7b9dfb8 f7b90fac 87429ef8 89e797f8 e125c410 Ntfs!NtfsReadFileRecord+0x7a
b7b9dff0 f7b9512a 87429ef8 e125c408 e125c410 Ntfs!NtfsLookupInFileRecord+0x37
b7b9e0c0 f7b4db15 87429ef8 e125c408 87429ef8 Ntfs!NtfsUpdateStandardInformation+0x46
b7b9e10c f7b821f9 87429ef8 89e797f8 e125c408 Ntfs!NtfsTeardownFromLcb+0x163
b7b9e164 f7b4f137 87429ef8 e125c4d0 00000000 Ntfs!NtfsTeardownStructures+0x12c
b7b9e190 f7b8f0a9 87429ef8 e125c4d0 00000000 Ntfs!NtfsDecrementCloseCounts+0xa9
b7b9e218 f7b891d8 87429ef8 e125c4d0 e125c408 Ntfs!NtfsCommonClose+0x3a1
b7b9e2ac f7ba28d2 00000000 00000000 b7b9e3f8 Ntfs!NtfsFspClose+0xe2
b7b9e3d8 f7b91ef8 86dd0988 86c45130 b7b9e418 Ntfs!NtfsCommonCreate+0x132
b7b9e4dc 8081df65 8b1b3718 86c45130 8b582768 Ntfs!NtfsFsdCreate+0x17d
b7b9e4f0 f7247458 87c4fa10 8b582768 8b4b44e0 nt!IofCallDriver+0x45
b7b9e51c 8081df65 8b4b3810 86c45130 86c45130 fltmgr!FltpCreate+0xe4
b7b9e530 808f8f71 b7b9e6d8 8b2f3cb0 00000000 nt!IofCallDriver+0x45
b7b9e618 80937942 8b2f3cc8 00000000 864dbd18 nt!IopParseDevice+0xa35
b7b9e698 80933a76 00000000 b7b9e6d8 00000240 nt!ObpLookupObjectName+0x5b0
b7b9e6ec 808eae25 00000000 00000000 80855000 nt!ObOpenObjectByName+0xea


STACK_COMMAND: .tss 0x28 ; kb

FOLLOWUP_IP:
e1000325+2bda
baa30bda 53 push ebx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: e1000325+2bda

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: e1000325

IMAGE_NAME: e1000325.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3f3c0347

FAILURE_BUCKET_ID: 0x7f_8_e1000325+2bda

BUCKET_ID: 0x7f_8_e1000325+2bda

Followup: MachineOwner
---------

2: kd> lmvm e1000325
start end module name
baa2e000 baa4cc00 e1000325 (no symbols)
Loaded symbol image file: e1000325.sys
Image path: \SystemRoot\system32\DRIVERS\e1000325.sys
Image name: e1000325.sys
Timestamp: Thu Aug 14 17:46:47 2003 (3F3C0347)
CheckSum: 00022398
ImageSize: 0001EC00
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0

 

I think I found my answers. Check this link for some easy advice on running and interpreting the Windows debugger.
http://www.networkworld.com/news/2005/041105-windows-crash.html?page=1

 

Your debug report does not have the output of thread and I guess it is stack overflow.

 

That is a stack overflow crash. The part of the stack that we can see in your trace is pretty hefty and I'm sure there is quite a bit more before that. Unfortunately there is also a page fault occurring making things even worse.

To see the entire stack, load up the dump in windbg then do the folowing commands:

.kframes 1000
kvf

The left column of each stack frame will show you how much stack each function call is using. If you find a driver that is using a lot of stack, contact the vendor for an update, fix or workaround.