BSOD and BAD POOL CALLER

When attempting to boot up my Windows MCE box, I'm receiving a BSOD with an 0xc2 stop code. So, first things first, I try to recover the minidump and take it to another PC so that I can debug it. I've used CHKDSK, MEMTEST86, and a few other things to avail. The problem is I don't know where to go from here.

Help or suggestions? Below are the debug results.
===========================================================Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\mini052308-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri May 23 06:47:37.640 2008 (GMT-6)
System Uptime: 0 days 0:00:41.218
Loading Kernel Symbols
............................................................................................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {43, dda38000, 0, 0}

Probably caused by : ntkrpamp.exe ( nt!CmpFree+17 )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000043, Attempt to free a virtual address which was never in any pool
Arg2: dda38000, Address being freed.
Arg3: 00000000, 0
Arg4: 00000000, 0

Debugging Details:
------------------


FAULTING_IP:
nt!CmpFree+17
80639fd7 5d pop ebp

BUGCHECK_STR: 0xc2_43

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: logonui.exe

LAST_CONTROL_TRANSFER: from 80547c2d to 804f9deb

STACK_TEXT:
b22369e0 80547c2d 000000c2 00000043 dda38000 nt!KeBugCheckEx+0x1b
b2236a20 8054a49a dda38000 e205df80 e1d0f000 nt!MiFreePoolPages+0x8b
b2236a60 80639fd7 dda38000 00000000 b2236acc nt!ExFreePoolWithTag+0x1ba
b2236a70 8063cb9c dda38000 00001000 00000000 nt!CmpFree+0x17
b2236acc 8063cf81 e1ee1008 00000000 00000000 nt!HvpRecoverData+0x3ec
b2236b18 8062ec7e e1ee1008 00000000 00000001 nt!HvMapHive+0x133
b2236b30 8063646d e1ee1101 00000005 00000000 nt!HvInitializeHive+0x416
b2236b9c 8062407f b2236bd8 00000005 00000000 nt!CmpInitializeHive+0x26d
b2236bf4 80629195 b2236d00 00000000 b2236c60 nt!CmpInitHiveFromFile+0xa3
b2236c1c 80630320 b2236cc8 b2236c68 b2236c58 nt!CmpCmdHiveOpen+0x21
b2236ca8 80623ca3 b2236ce0 b2236cc8 00000000 nt!CmLoadKey+0x8c
b2236d40 80623e46 0007f5ec 0007f5d4 00000000 nt!NtLoadKey2+0x225
b2236d54 8054086c 0007f5ec 0007f5d4 0007f618 nt!NtLoadKey+0x12
b2236d54 7c90eb94 0007f5ec 0007f5d4 0007f618 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007f618 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CmpFree+17
80639fd7 5d pop ebp

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!CmpFree+17

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

FAILURE_BUCKET_ID: 0xc2_43_nt!CmpFree+17

BUCKET_ID: 0xc2_43_nt!CmpFree+17

Followup: MachineOwner
---------

eax=f88f713c ebx=dda38000 ecx=00000000 edx=00000081 esi=8118eb8c edi=c06ed1c0
eip=804f9deb esp=b22369c8 ebp=b22369e0 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
804f9deb 5d pop ebp
ChildEBP RetAddr Args to Child
b22369e0 80547c2d 000000c2 00000043 dda38000 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
b2236a20 8054a49a dda38000 e205df80 e1d0f000 nt!MiFreePoolPages+0x8b (FPO: [Non-Fpo])
b2236a60 80639fd7 dda38000 00000000 b2236acc nt!ExFreePoolWithTag+0x1ba (FPO: [Non-Fpo])
b2236a70 8063cb9c dda38000 00001000 00000000 nt!CmpFree+0x17 (FPO: [Non-Fpo])
b2236acc 8063cf81 e1ee1008 00000000 00000000 nt!HvpRecoverData+0x3ec (FPO: [Non-Fpo])
b2236b18 8062ec7e e1ee1008 00000000 00000001 nt!HvMapHive+0x133 (FPO: [Non-Fpo])
b2236b30 8063646d e1ee1101 00000005 00000000 nt!HvInitializeHive+0x416 (FPO: [Non-Fpo])
b2236b9c 8062407f b2236bd8 00000005 00000000 nt!CmpInitializeHive+0x26d (FPO: [Non-Fpo])
b2236bf4 80629195 b2236d00 00000000 b2236c60 nt!CmpInitHiveFromFile+0xa3 (FPO: [Non-Fpo])
b2236c1c 80630320 b2236cc8 b2236c68 b2236c58 nt!CmpCmdHiveOpen+0x21 (FPO: [Non-Fpo])
b2236ca8 80623ca3 b2236ce0 b2236cc8 00000000 nt!CmLoadKey+0x8c (FPO: [Non-Fpo])
b2236d40 80623e46 0007f5ec 0007f5d4 00000000 nt!NtLoadKey2+0x225 (FPO: [Non-Fpo])
b2236d54 8054086c 0007f5ec 0007f5d4 0007f618 nt!NtLoadKey+0x12 (FPO: [Non-Fpo])
b2236d54 7c90eb94 0007f5ec 0007f5d4 0007f618 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b2236d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007f618 00000000 00000000 00000000 00000000 0x7c90eb94
start end module name
804d7000 806e2000 nt ntkrpamp.exe Wed Feb 28 01:38:53 2007 (45E53F9D)
806e2000 80702d00 hal halmacpi.dll Tue Aug 03 23:59:09 2004 (41107B2D)
af6a4000 af6bc8c0 tfsnudfa tfsnudfa.sys Tue May 31 16:50:00 2005 (429CEA18)
af6bd000 af6d5160 tfsnudf tfsnudf.sys Tue May 31 16:49:19 2005 (429CE9EF)
af6d6000 af6eb320 tfsnifs tfsnifs.sys Tue May 31 16:49:14 2005 (429CE9EA)
b16ec000 b17c0a80 dump_iastor dump_iastor.sys Mon Apr 25 09:28:12 2005 (426D0C8C)
b1b5a000 b1b5ad00 dxgthk dxgthk.sys Fri Aug 17 14:53:12 2001 (3B7D8438)
b1bde000 b1be1280 ndisuio ndisuio.sys Wed Aug 04 00:03:10 2004 (41107C1E)
b1e2a000 b1e2daa0 tfsnopio tfsnopio.sys Tue May 31 16:49:37 2005 (429CEA01)
b2257000 b2266900 Cdfs Cdfs.SYS Wed Aug 04 00:14:09 2004 (41107EB1)
b22bf000 b22c1900 Dxapi Dxapi.sys Fri Aug 17 14:53:19 2001 (3B7D843F)
b2d89000 b2d8bf80 mouhid mouhid.sys Fri Aug 17 14:47:57 2001 (3B7D82FD)
b2d8d000 b2d90a00 kbdhid kbdhid.sys Tue Aug 03 23:58:33 2004 (41107B09)
b4c99000 b4d07a00 mrxsmb mrxsmb.sys Fri May 05 03:41:42 2006 (445B1DD6)
b5535000 b555fa00 rdbss rdbss.sys Fri May 05 03:47:55 2006 (445B1F4B)
b6782000 b67a3d00 afd afd.sys Wed Aug 04 00:14:13 2004 (41107EB5)
b67a4000 b67cbc00 netbt netbt.sys Wed Aug 04 00:14:36 2004 (41107ECC)
b67cc000 b67ecf00 ipnat ipnat.sys Wed Sep 29 16:28:36 2004 (415B3714)
b8f95000 b8f9d700 netbios netbios.sys Wed Aug 04 00:03:19 2004 (41107C27)
b8fa5000 b8fad080 ipfltdrv ipfltdrv.sys Fri Aug 17 14:55:07 2001 (3B7D84AB)
b8fb5000 b8fbdd80 HIDCLASS HIDCLASS.SYS Wed Aug 04 00:08:18 2004 (41107D52)
b9167000 b916f700 wanarp wanarp.sys Wed Aug 04 00:04:57 2004 (41107C89)
ba135000 ba139500 watchdog watchdog.sys Wed Aug 04 00:07:32 2004 (41107D24)
bf000000 bf011580 dxg dxg.sys Wed Aug 04 00:00:51 2004 (41107B93)
bf012000 bf04e000 ati2dvag ati2dvag.dll Thu Apr 14 20:15:15 2005 (425F23B3)
bf04e000 bf080000 ati2cqag ati2cqag.dll Thu Apr 14 19:40:38 2005 (425F1B96)
bf080000 bf0b2000 atikvmag atikvmag.dll Thu Apr 14 19:46:00 2005 (425F1CD8)
bf0b2000 bf2e5520 ati3duag ati3duag.dll Thu Apr 14 20:02:16 2005 (425F20A8)
bf2e6000 bf379960 ativvaxx ativvaxx.dll Thu Apr 14 19:56:20 2005 (425F1F44)
bf800000 bf9c2800 win32k win32k.sys Wed Mar 19 03:46:46 2008 (47E0E106)
ed0b3000 ed0b5580 hidusb hidusb.sys Fri Aug 17 15:02:16 2001 (3B7D8658)
edcb0000 edcd3000 Mpfp Mpfp.sys Fri Mar 02 12:16:50 2007 (45E87822)
edcd3000 edd2ae80 tcpip tcpip.sys Tue Oct 30 11:20:52 2007 (472767F4)
edd2b000 edd3d400 ipsec ipsec.sys Wed Aug 04 00:14:27 2004 (41107EC3)
ee53f000 ee5477e0 tfsncofs tfsncofs.sys Tue May 31 16:49:32 2005 (429CE9FC)
ef266000 ef26f5a0 drvnddm drvnddm.sys Thu Apr 21 14:43:05 2005 (42681059)
ef2b6000 ef2be880 Fips Fips.SYS Fri Aug 17 19:31:49 2001 (3B7DC585)
ef3c1000 ef3e2700 portcls portcls.sys Tue Mar 16 12:58:17 2004 (40574E49)
ef3e3000 ef40ef80 sthda sthda.sys Thu Mar 31 13:21:44 2005 (424C4DC8)
f742f000 f745a100 windrvr6 windrvr6.sys Sun Jul 25 11:28:41 2004 (4103EDC9)
f745b000 f74b3e80 update update.sys Mon Apr 23 04:32:54 2007 (462C8B56)
f74b4000 f74e4100 rdpdr rdpdr.sys Wed Aug 04 00:01:10 2004 (41107BA6)
f74e5000 f74f5e00 psched psched.sys Wed Aug 04 00:04:16 2004 (41107C60)
f74f6000 f750c680 ndiswan ndiswan.sys Wed Aug 04 00:14:30 2004 (41107EC6)
f750d000 f7533000 e100b325 e100b325.sys Thu Oct 14 17:30:44 2004 (416F0C24)
f7533000 f75c7b60 IntelC52 IntelC52.sys Fri Mar 05 12:15:31 2004 (4048D1D3)
f75c8000 f76ee6a0 IntelC51 IntelC51.sys Fri Mar 05 12:14:39 2004 (4048D19F)
f76ef000 f7711680 ks ks.sys Wed Aug 04 00:15:20 2004 (41107EF8)
f7712000 f7734e80 USBPORT USBPORT.SYS Wed Aug 04 00:08:34 2004 (41107D62)
f7735000 f775b000 HDAudBus HDAudBus.sys Thu Aug 12 18:45:52 2004 (411C0F40)
f775b000 f776e780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 00:07:04 2004 (41107D08)
f776f000 f7894000 ati2mtag ati2mtag.sys Thu Apr 14 20:14:55 2005 (425F239F)
f78a4000 f78a7c80 mssmbios mssmbios.sys Wed Aug 04 00:07:47 2004 (41107D33)
f7957000 f7965b80 drmk drmk.sys Wed Aug 04 00:07:54 2004 (41107D3A)
f7987000 f7990480 NDProxy NDProxy.SYS Fri Aug 17 14:55:30 2001 (3B7D84C2)
f7997000 f79a0f00 termdd termdd.sys Tue Aug 03 23:58:52 2004 (41107B1C)
f79a7000 f79af900 msgpc msgpc.sys Wed Aug 04 00:04:11 2004 (41107C5B)
f80c8000 f80ca580 ndistapi ndistapi.sys Fri Aug 17 14:55:29 2001 (3B7D84C1)
f80e4000 f80e6280 rasacd rasacd.sys Fri Aug 17 14:55:39 2001 (3B7D84CB)
f8274000 f8277f00 MODEMCSA MODEMCSA.sys Fri Aug 17 14:57:37 2001 (3B7D8541)
f82c1000 f82db580 Mup Mup.sys Wed Aug 04 00:15:20 2004 (41107EF8)
f82dc000 f8308a80 NDIS NDIS.sys Wed Aug 04 00:14:27 2004 (41107EC3)
f8309000 f8395400 Ntfs Ntfs.sys Fri Feb 09 04:10:31 2007 (45CC56A7)
f8396000 f83ac780 KSecDD KSecDD.sys Tue Aug 03 23:59:45 2004 (41107B51)
f83ad000 f83c20c0 drvmcdb drvmcdb.sys Fri Apr 22 16:56:10 2005 (4269810A)
f83c3000 f83d4f00 sr sr.sys Wed Aug 04 00:06:22 2004 (41107CDE)
f83d5000 f83f4780 fltMgr fltMgr.sys Mon Aug 21 03:14:57 2006 (44E97991)
f83f5000 f84c9a80 iastor iastor.sys Mon Apr 25 09:28:12 2005 (426D0C8C)
f84ca000 f84e1480 atapi atapi.sys Tue Aug 03 23:59:41 2004 (41107B4D)
f84e2000 f8507700 dmio dmio.sys Wed Aug 04 00:07:13 2004 (41107D11)
f8508000 f8526880 ftdisk ftdisk.sys Fri Aug 17 14:52:41 2001 (3B7D8419)
f8527000 f8537a80 pci pci.sys Wed Aug 04 00:07:45 2004 (41107D31)
f8538000 f8565d80 ACPI ACPI.sys Wed Aug 04 00:07:35 2004 (41107D27)
f8667000 f866fc00 isapnp isapnp.sys Fri Aug 17 14:58:01 2001 (3B7D8559)
f8677000 f8681500 MountMgr MountMgr.sys Tue Aug 03 23:58:29 2004 (41107B05)
f8687000 f8693c80 VolSnap VolSnap.sys Wed Aug 04 00:00:14 2004 (41107B6E)
f8697000 f869fe00 disk disk.sys Tue Aug 03 23:59:53 2004 (41107B59)
f86a7000 f86b3200 CLASSPNP CLASSPNP.SYS Wed Aug 04 00:14:26 2004 (41107EC2)
f86b7000 f86bfb80 PxHelp20 PxHelp20.sys Wed Oct 18 11:33:53 2006 (45366581)
f87c7000 f87cfd00 intelppm intelppm.sys Tue Aug 03 23:59:19 2004 (41107B37)
f87d7000 f87e3180 cdrom cdrom.sys Tue Aug 03 23:59:52 2004 (41107B58)
f87e7000 f87f5080 redbook redbook.sys Tue Aug 03 23:59:34 2004 (41107B46)
f87f7000 f8801380 imapi imapi.sys Wed Aug 04 00:00:12 2004 (41107B6C)
f8807000 f88152e0 IntelC53 IntelC53.sys Tue Jun 15 12:52:38 2004 (40CF4576)
f8817000 f8823880 rasl2tp rasl2tp.sys Wed Aug 04 00:14:21 2004 (41107EBD)
f8827000 f8831200 raspppoe raspppoe.sys Wed Aug 04 00:05:06 2004 (41107C92)
f8837000 f8842d00 raspptp raspptp.sys Wed Aug 04 00:14:26 2004 (41107EC2)
f88b7000 f88c5100 usbhub usbhub.sys Wed Aug 04 00:08:40 2004 (41107D68)
f88e7000 f88ed200 PCIIDEX PCIIDEX.SYS Tue Aug 03 23:59:40 2004 (41107B4C)
f88ef000 f88f3900 PartMgr PartMgr.sys Fri Aug 17 19:32:23 2001 (3B7DC5A7)
f895f000 f8965440 tfsnboio tfsnboio.sys Tue May 31 16:49:20 2005 (429CE9F0)
f897f000 f8984bc0 ssrtln ssrtln.sys Fri May 13 11:37:18 2005 (4284E5CE)
f8987000 f898d180 HIDPARSE HIDPARSE.SYS Wed Aug 04 00:08:15 2004 (41107D4F)
f898f000 f8994200 vga vga.sys Wed Aug 04 00:07:06 2004 (41107D0A)
f8997000 f899ba80 Msfs Msfs.SYS Wed Aug 04 00:00:37 2004 (41107B85)
f899f000 f89a6880 Npfs Npfs.SYS Wed Aug 04 00:00:38 2004 (41107B86)
f89ef000 f89f4000 usbuhci usbuhci.sys Wed Aug 04 00:08:34 2004 (41107D62)
f89f7000 f89fd800 usbehci usbehci.sys Wed Aug 04 00:08:34 2004 (41107D62)
f89ff000 f8a04be0 mohfilt mohfilt.sys Fri Mar 05 12:13:37 2004 (4048D161)
f8a07000 f8a0e580 Modem Modem.SYS Wed Aug 04 00:08:04 2004 (41107D44)
f8a0f000 f8a16000 GEARAspiWDM GEARAspiWDM.sys Mon Aug 07 11:11:27 2006 (44D7743F)
f8a17000 f8a1b880 TDI TDI.SYS Wed Aug 04 00:07:47 2004 (41107D33)
f8a1f000 f8a23580 ptilink ptilink.sys Fri Aug 17 14:49:53 2001 (3B7D8371)
f8a27000 f8a2b080 raspti raspti.sys Fri Aug 17 14:55:32 2001 (3B7D84C4)
f8a2f000 f8a35000 kbdclass kbdclass.sys Tue Aug 03 23:58:32 2004 (41107B08)
f8a37000 f8a3ca00 mouclass mouclass.sys Tue Aug 03 23:58:32 2004 (41107B08)
f8a3f000 f8a43300 omci omci.sys Mon Nov 04 16:05:02 2002 (3DC6FD1E)
f8a77000 f8a7a000 BOOTVID BOOTVID.dll Fri Aug 17 14:49:09 2001 (3B7D8345)
f8b67000 f8b68b80 kdcom kdcom.dll Fri Aug 17 14:49:10 2001 (3B7D8346)
f8b69000 f8b6a100 WMILIB WMILIB.SYS Fri Aug 17 15:07:23 2001 (3B7D878B)
f8b6b000 f8b6c700 dmload dmload.sys Fri Aug 17 14:58:15 2001 (3B7D8567)
f8b81000 f8b828a0 tfsnpool tfsnpool.sys Tue May 31 16:49:15 2005 (429CE9EB)
f8bdd000 f8bde5c0 sscdbhk5 sscdbhk5.sys Fri May 13 11:37:26 2005 (4284E5D6)
f8bdf000 f8be0100 swenum swenum.sys Tue Aug 03 23:58:41 2004 (41107B11)
f8beb000 f8bec280 USBD USBD.SYS Fri Aug 17 15:02:58 2001 (3B7D8682)
f8c0f000 f8c11000 i2omgmt i2omgmt.SYS Wed Aug 04 00:00:50 2004 (41107B92)
f8c11000 f8c12000 Fs_Rec Fs_Rec.SYS unavailable (00000000)
f8c13000 f8c14080 Beep Beep.SYS Fri Aug 17 14:47:33 2001 (3B7D82E5)
f8c15000 f8c16080 mnmdd mnmdd.SYS Fri Aug 17 14:57:28 2001 (3B7D8538)
f8c17000 f8c18080 RDPCDD RDPCDD.sys Fri Aug 17 14:46:56 2001 (3B7D82C0)
f8c2f000 f8c2fd00 pciide pciide.sys Fri Aug 17 14:51:49 2001 (3B7D83E5)
f8c67000 f8c67fe0 tfsndrct tfsndrct.sys Tue May 31 16:49:36 2005 (429CEA00)
f8c87000 f8c88000 Null Null.SYS unavailable (00000000)
f8cbc000 f8cbcc00 audstub audstub.sys Fri Aug 17 14:59:40 2001 (3B7D85BC)
f8dbb000 f8dbb880 tfsndres tfsndres.sys Tue May 31 16:50:05 2005 (429CEA1D)

Unloaded modules:
b8f85000 b8f95000 serial.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f80e8000 f80ec000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f8767000 f8774000 i8042prt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f8977000 f897c000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8b3b000 f8b3e000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

Thanks for the tip, but I've tried Safe Mode and had no luck there either. I've already booted a live Knoppix CD so that I could recover my data, but would really like to repair this install. I would like to run SFC or a similar utility, but without GUI access to Windows I'm unable to run this.

What's my next step?

 

Sorry for the delayed reply - busy day. Thanks for your responses thus far.

Here's the scoop: the machine is not mine but rather someone else's Dell from which I'm retrieving their data. When ordering the PC, they opted NOT to receive the Windows MCE install CD from Dell. However, the I386 folder is present on the hard drive. I have thought about attempting a repair from that directory. How off target is that?

 

Presumably if the winnt executable is in that i386 folder, then you could go make some Windows XP bootdisks (bootdisk.com or something like that), cd c:\i386, winnt, and launch text mode setup.

Driver verifier is the easy way to solve this probably pretty quickly but you'd have to get into safe mode.