Atapi.sys BSOD from SP2

A client I support in the evenings are getting BSOD with atapi.sys being listed at the issue. This is happening on all their clients, which are Windows XP w/ SP2. Here is a output from one of their memory dumps:

Loading Dump File [C:\Install\Dump\Memory\Minidump\Mini051805-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINNT\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Wed May 18 09:16:29.062 2005 (GMT-4)
System Uptime: 0 days 23:42:28.642
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
............................................................................................................................
Loading unloaded module list
.............................
Loading User Symbols
Unable to load image atapi.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for atapi.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {50, d, 1, f7753502}

Probably caused by : atapi.sys ( atapi!IdePortNotification+ee )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000050, memory referenced
Arg2: 0000000d, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: f7753502, address which referenced memory

Debugging Details:
------------------


OVERLAPPED_MODULE: navex15

WRITE_ADDRESS: 00000050

CURRENT_IRQL: d

FAULTING_IP:
atapi!IdePortNotification+ee
f7753502 5f pop edi

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from f774dd7f to f7753502

STACK_TEXT:
805500d0 f774dd7f 00000000 8534b370 8518bbf4 atapi!IdePortNotification+0xee
80550108 f77505f8 5034b370 85387f04 0000000e atapi!AtapiInterrupt+0x6cd
8055011c 804da915 85387ca0 8534b030 0001000d atapi!IdePortInterrupt+0x18


FOLLOWUP_IP:
atapi!IdePortNotification+ee
f7753502 5f pop edi

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: atapi!IdePortNotification+ee

MODULE_NAME: atapi

IMAGE_NAME: atapi.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b4d

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xD1_W_atapi!IdePortNotification+ee

BUCKET_ID: 0xD1_W_atapi!IdePortNotification+ee

Followup: MachineOwner
---------

eax=00000050 ebx=8534b370 ecx=85387950 edx=000001f7 esi=8534b0e8 edi=8534b374
eip=f7753502 esp=805500c8 ebp=805500d0 iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
atapi!IdePortNotification+0xee:
f7753502 5f pop edi
ChildEBP RetAddr Args to Child
805500d0 f774dd7f 00000000 8534b370 8518bbf4 atapi!IdePortNotification+0xee (FPO: [Non-Fpo])
80550108 f77505f8 5034b370 85387f04 0000000e atapi!AtapiInterrupt+0x6cd (FPO: [Non-Fpo])
8055011c 804da915 85387ca0 8534b030 0001000d atapi!IdePortInterrupt+0x18 (FPO: [Non-Fpo])
start end module name
804d7000 806eb100 nt ntoskrnl.exe Tue Mar 01 19:59:37 2005 (42250FF9)
806ec000 806ffd80 hal hal.dll Wed Aug 04 01:59:04 2004 (41107B28)
bf800000 bf9c0500 win32k win32k.sys Tue Mar 01 20:06:42 2005 (422511A2)
bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 02:00:51 2004 (41107B93)
bf9d3000 bfa2da80 s3gnb s3gnb.dll Fri Dec 13 05:41:24 2002 (3DF9B954)
bffa0000 bffe5c00 ATMFD ATMFD.DLL Wed Aug 04 03:56:56 2004 (411096C8)
ef0b0000 ef0c0980 naveng naveng.sys Tue Mar 15 15:35:44 2005 (42374720)
ef0c1000 ef159e20 navex15 navex15.sys Tue Mar 15 15:51:30 2005 (42374AD2)
ef52a000 ef52cac0 SYMREDRV SYMREDRV.SYS Thu Mar 11 17:50:38 2004 (4050ED3E)
ef546000 ef568000 RDPWD RDPWD.SYS Wed Aug 04 01:59:01 2004 (41107B25)
ef568000 ef5a8100 HTTP HTTP.sys Fri Oct 08 19:48:20 2004 (41672744)
ef87e000 ef892400 wdmaud wdmaud.sys Wed Aug 04 02:15:03 2004 (41107EE7)
ef9e3000 ef9f1d80 sysaudio sysaudio.sys Wed Aug 04 02:15:54 2004 (41107F1A)
eff4b000 eff9d180 srv srv.sys Wed Aug 04 02:14:44 2004 (41107ED4)
f0016000 f0042400 mrxdav mrxdav.sys Wed Aug 04 02:00:49 2004 (41107B91)
f037b000 f037e280 ndisuio ndisuio.sys Wed Aug 04 02:03:10 2004 (41107C1E)
f03b3000 f03c3280 Udfs Udfs.SYS Wed Aug 04 02:00:27 2004 (41107B7B)
f03c4000 f0433380 BsUDF BsUDF.SYS Wed Oct 23 22:10:42 2002 (3DB756A2)
f4dec000 f4e03480 dump_atapi dump_atapi.sys Wed Aug 04 01:59:41 2004 (41107B4D)
f4e1c000 f4e1e900 Dxapi Dxapi.sys Fri Aug 17 16:53:19 2001 (3B7D843F)
f4e2c000 f4e9a400 mrxsmb mrxsmb.sys Tue Jan 18 23:26:50 2005 (41EDE18A)
f4e9b000 f4ec5a00 rdbss rdbss.sys Wed Oct 27 21:13:57 2004 (418047D5)
f4ec6000 f4ee6f00 ipnat ipnat.sys Wed Sep 29 18:28:36 2004 (415B3714)
f4ee7000 f4f08d00 afd afd.sys Wed Aug 04 02:14:13 2004 (41107EB5)
f4f09000 f4f30c00 netbt netbt.sys Wed Aug 04 02:14:36 2004 (41107ECC)
f4f31000 f4f700e0 SYMTDI SYMTDI.SYS Thu Mar 11 17:50:21 2004 (4050ED2D)
f4f71000 f4fc8d80 tcpip tcpip.sys Sun Mar 13 19:55:05 2005 (4234E0E9)
f4fc9000 f4fdb400 ipsec ipsec.sys Wed Aug 04 02:14:27 2004 (41107EC3)
f50a6000 f50b8f00 SYMEVENT SYMEVENT.SYS Wed Jan 14 21:02:13 2004 (4005F4A5)
f50b9000 f5108000 savrt savrt.sys Mon Feb 09 18:24:30 2004 (402816AE)
f7180000 f71b3200 update update.sys Wed Aug 04 01:58:32 2004 (41107B08)
f71b4000 f71e4100 rdpdr rdpdr.sys Wed Aug 04 02:01:10 2004 (41107BA6)
f7255000 f725d880 Fips Fips.SYS Fri Aug 17 21:31:49 2001 (3B7DC585)
f7265000 f726d700 wanarp wanarp.sys Wed Aug 04 02:04:57 2004 (41107C89)
f72b5000 f72bd700 netbios netbios.sys Wed Aug 04 02:03:19 2004 (41107C27)
f72c9000 f72cb280 rasacd rasacd.sys Fri Aug 17 16:55:39 2001 (3B7D84CB)
f730d000 f731de00 psched psched.sys Wed Aug 04 02:04:16 2004 (41107C60)
f731e000 f7334680 ndiswan ndiswan.sys Wed Aug 04 02:14:30 2004 (41107EC6)
f7335000 f7348900 parport parport.sys Wed Aug 04 01:59:04 2004 (41107B28)
f739c000 f73bc060 ptserial ptserial.sys Tue Jun 11 13:31:15 2002 (3D0633E3)
f73bd000 f73e0980 portcls portcls.sys Wed Aug 04 02:15:47 2004 (41107F13)
f73e1000 f743b580 viaudios viaudios.sys Wed Feb 26 01:24:22 2003 (3E5C5D96)
f743c000 f745e680 ks ks.sys Wed Aug 04 02:15:20 2004 (41107EF8)
f745f000 f7481e80 USBPORT USBPORT.SYS Wed Aug 04 02:08:34 2004 (41107D62)
f7482000 f7495780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 02:07:04 2004 (41107D08)
f7496000 f74bd000 s3gnbm s3gnbm.sys Fri Dec 13 05:41:33 2002 (3DF9B95D)
f74d5000 f74d8c80 mssmbios mssmbios.sys Wed Aug 04 02:07:47 2004 (41107D33)
f7505000 f751f580 Mup Mup.sys Wed Aug 04 02:15:20 2004 (41107EF8)
f7520000 f75c8560 vmodem vmodem.sys Wed Jun 05 14:25:37 2002 (3CFE57A1)
f75c9000 f7648980 vpctcom vpctcom.sys Wed Jun 05 19:02:49 2002 (3CFE9899)
f7649000 f7675a80 NDIS NDIS.sys Wed Aug 04 02:14:27 2004 (41107EC3)
f7676000 f7702480 Ntfs Ntfs.sys Wed Aug 04 02:15:06 2004 (41107EEA)
f7703000 f7719780 KSecDD KSecDD.sys Wed Aug 04 01:59:45 2004 (41107B51)
f771a000 f772bf00 sr sr.sys Wed Aug 04 02:06:22 2004 (41107CDE)
f772c000 f772d000 fltmgr fltmgr.sys unavailable (00000000)
f774b000 f7762480 atapi atapi.sys Wed Aug 04 01:59:41 2004 (41107B4D)
f7763000 f7788700 dmio dmio.sys Wed Aug 04 02:07:13 2004 (41107D11)
f7789000 f77a7880 ftdisk ftdisk.sys Fri Aug 17 16:52:41 2001 (3B7D8419)
f77a8000 f77b8a80 pci pci.sys Wed Aug 04 02:07:45 2004 (41107D31)
f77b9000 f77e6d80 ACPI ACPI.sys Wed Aug 04 02:07:35 2004 (41107D27)
f7808000 f7810c00 isapnp isapnp.sys Fri Aug 17 16:58:01 2001 (3B7D8559)
f7818000 f7822500 MountMgr MountMgr.sys Wed Aug 04 01:58:29 2004 (41107B05)
f7828000 f7834c80 VolSnap VolSnap.sys Wed Aug 04 02:00:14 2004 (41107B6E)
f7838000 f7840e00 disk disk.sys Wed Aug 04 01:59:53 2004 (41107B59)
f7848000 f7854200 CLASSPNP CLASSPNP.SYS Wed Aug 04 02:14:26 2004 (41107EC2)
f7858000 f7867940 vvoice vvoice.sys Tue Jun 11 13:30:28 2002 (3D0633B4)
f7868000 f7872500 viaagp viaagp.sys Wed Aug 04 02:07:42 2004 (41107D2E)
f7898000 f78a0900 msgpc msgpc.sys Wed Aug 04 02:04:11 2004 (41107C5B)
f78d8000 f78e7900 Cdfs Cdfs.SYS Wed Aug 04 02:14:09 2004 (41107EB1)
f78f8000 f7901f00 termdd termdd.sys Wed Aug 04 01:58:52 2004 (41107B1C)
f7918000 f7921480 NDProxy NDProxy.SYS Fri Aug 17 16:55:30 2001 (3B7D84C2)
f7928000 f7936100 usbhub usbhub.sys Wed Aug 04 02:08:40 2004 (41107D68)
f7948000 f7958000 Savrtpel Savrtpel.sys Mon Feb 09 18:24:34 2004 (402816B2)
f79e8000 f79f0d00 intelppm intelppm.sys Wed Aug 04 01:59:19 2004 (41107B37)
f79f8000 f7a02380 imapi imapi.sys Wed Aug 04 02:00:12 2004 (41107B6C)
f7a08000 f7a14180 cdrom cdrom.sys Wed Aug 04 01:59:52 2004 (41107B58)
f7a18000 f7a26080 redbook redbook.sys Wed Aug 04 01:59:34 2004 (41107B46)
f7a28000 f7a36b80 drmk drmk.sys Wed Aug 04 02:07:54 2004 (41107D3A)
f7a38000 f7a47d80 serial serial.sys Wed Aug 04 02:15:51 2004 (41107F17)
f7a48000 f7a54e00 i8042prt i8042prt.sys Wed Aug 04 02:14:36 2004 (41107ECC)
f7a58000 f7a64880 rasl2tp rasl2tp.sys Wed Aug 04 02:14:21 2004 (41107EBD)
f7a68000 f7a72200 raspppoe raspppoe.sys Wed Aug 04 02:05:06 2004 (41107C92)
f7a78000 f7a83d00 raspptp raspptp.sys Wed Aug 04 02:14:26 2004 (41107EC2)
f7a88000 f7a8e200 PCIIDEX PCIIDEX.SYS Wed Aug 04 01:59:40 2004 (41107B4C)
f7a90000 f7a94900 PartMgr PartMgr.sys Fri Aug 17 21:32:23 2001 (3B7DC5A7)
f7b10000 f7b14500 watchdog watchdog.sys Wed Aug 04 02:07:32 2004 (41107D24)
f7b20000 f7b25000 usbuhci usbuhci.sys Wed Aug 04 02:08:34 2004 (41107D62)
f7b30000 f7b36800 usbehci usbehci.sys Wed Aug 04 02:08:34 2004 (41107D62)
f7b38000 f7b3f580 Modem Modem.SYS Wed Aug 04 02:08:04 2004 (41107D44)
f7b40000 f7b46a00 fetnd5 fetnd5.sys Fri Jul 20 07:40:24 2001 (3B5818A8)
f7b50000 f7b51000 fdc fdc.sys unavailable (00000000)
f7b58000 f7b5da00 mouclass mouclass.sys Wed Aug 04 01:58:32 2004 (41107B08)
f7b60000 f7b66000 kbdclass kbdclass.sys Wed Aug 04 01:58:32 2004 (41107B08)
f7b68000 f7b6c880 TDI TDI.SYS Wed Aug 04 02:07:47 2004 (41107D33)
f7b70000 f7b74580 ptilink ptilink.sys Fri Aug 17 16:49:53 2001 (3B7D8371)
f7b78000 f7b7c080 raspti raspti.sys Fri Aug 17 16:55:32 2001 (3B7D84C4)
f7b88000 f7b8d000 flpydisk flpydisk.sys Wed Aug 04 01:59:24 2004 (41107B3C)
f7bb8000 f7bbd200 vga vga.sys Wed Aug 04 02:07:06 2004 (41107D0A)
f7bc0000 f7bc4a80 Msfs Msfs.SYS Wed Aug 04 02:00:37 2004 (41107B85)
f7bc8000 f7bcf880 Npfs Npfs.SYS Wed Aug 04 02:00:38 2004 (41107B86)
f7c00000 f7c05500 TDTCP TDTCP.SYS Wed Aug 04 01:58:52 2004 (41107B1C)
f7c18000 f7c1b000 BOOTVID BOOTVID.dll Fri Aug 17 16:49:09 2001 (3B7D8345)
f7c1c000 f7c1e480 bsstor bsstor.sys Thu Jun 06 02:41:41 2002 (3CFF0425)
f7ca0000 f7ca3f00 MODEMCSA MODEMCSA.sys Fri Aug 17 16:57:37 2001 (3B7D8541)
f7ce8000 f7cebc80 serenum serenum.sys Wed Aug 04 01:59:06 2004 (41107B2A)
f7cec000 f7cee980 gameenum gameenum.sys Wed Aug 04 02:08:20 2004 (41107D54)
f7cf0000 f7cf2580 ndistapi ndistapi.sys Fri Aug 17 16:55:29 2001 (3B7D84C1)
f7d08000 f7d09b80 kdcom kdcom.dll Fri Aug 17 16:49:10 2001 (3B7D8346)
f7d0a000 f7d0b100 WMILIB WMILIB.SYS Fri Aug 17 17:07:23 2001 (3B7D878B)
f7d0c000 f7d0d500 viaide viaide.sys Wed Aug 04 01:59:42 2004 (41107B4E)
f7d0e000 f7d0f000 dmload dmload.sys unavailable (00000000)
f7d1e000 f7d1f100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 17:07:23 2001 (3B7D878B)
f7d2a000 f7d2ba20 incdrm incdrm.SYS Wed May 15 20:58:50 2002 (3CE3044A)
f7d2c000 f7d2d100 swenum swenum.sys Wed Aug 04 01:58:41 2004 (41107B11)
f7d30000 f7d31280 USBD USBD.SYS Fri Aug 17 17:02:58 2001 (3B7D8682)
f7d74000 f7d75f00 Fs_Rec Fs_Rec.SYS Fri Aug 17 16:49:37 2001 (3B7D8361)
f7d78000 f7d79080 Beep Beep.SYS Fri Aug 17 16:47:33 2001 (3B7D82E5)
f7d7a000 f7d7b080 mnmdd mnmdd.SYS Fri Aug 17 16:57:28 2001 (3B7D8538)
f7d7c000 f7d7d080 RDPCDD RDPCDD.sys Fri Aug 17 16:46:56 2001 (3B7D82C0)
f7dac000 f7dad000 ParVdm ParVdm.SYS unavailable (00000000)
f7e7d000 f7e7d600 SetupNT SetupNT.sys Wed Oct 25 15:27:22 2000 (39F7341A)
f7f0d000 f7f0db80 msmpu401 msmpu401.sys Fri Aug 17 16:59:59 2001 (3B7D85CF)
f7f0e000 f7f0ec00 audstub audstub.sys Fri Aug 17 16:59:40 2001 (3B7D85BC)
f7f3a000 f7f3ad00 dxgthk dxgthk.sys Fri Aug 17 16:53:12 2001 (3B7D8438)
f7f4e000 f7f4f000 Null Null.SYS unavailable (00000000)

Unloaded modules:
ef086000 ef0b0000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef086000 ef0b0000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef086000 ef0b0000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f4ffc000 f500d000 naveng.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f500d000 f50a6000 navex15.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef130000 ef15a000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef130000 ef15a000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef130000 ef15a000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef130000 ef15a000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef130000 ef15a000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef130000 ef15a000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef130000 ef15a000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef130000 ef15a000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef130000 ef15a000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef130000 ef15a000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef130000 ef15a000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef1fa000 ef224000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef1fa000 ef224000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef1fa000 ef224000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef2c4000 ef2ee000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef831000 ef85b000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7e9f000 f7ea0000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ef85b000 ef87e000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
efc73000 efc80000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
efc83000 efc91000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7da4000 f7da6000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7295000 f729e000 processr.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7ba0000 f7ba5000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f7cb0000 f7cb3000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000

 

Microsoft's Crash team analyzed 3 memory dumps and came to the conclusion that shortly after loading SP2 every client processor on the network must have went bad. Seriously, they keep telling me that it appears to be a hardware issue with the CPU. I told them it is happening on every single client on the network and they insist that the clients CPUs are bad. Hummm, computers were running just fine for about 1-year and then all of a sudden after loading SP2 we have BSOD on every client computer that states atapi.sys is either causing the issue or somehow related to the issue. And, given the fact that Microsoft updated atapi.sys in SP2 wouldn't have anything to do with why we are having issues with atapi.sys after SP2, but didn't have any issues prior to SP2. Okay, I will go to my client and tell them that they have to replace all their client computers because Microsoft said all their processors are bad.

 

If all the client machines are running the same processor, have you checked to see if there are known issues with that particular CPU and XP-SP2?

This wouldn't be the first thing that did work pre-SP2 but did not work post-SP2. In quite a few of those cases it turned out the vendor didn't pay enough attention to OS changes that were done to tighten security and had to do a mad scramble to get compliant after SP2 blew their stuff up.

Might be something as simple as a BIOS update.

 

All clients are installed with Intel 2Ghz Celeron processors. I haven't heard of any incompatibilities with this processor. But, if I had all the answers, then I wouldn’t be asking for your help. The computers are "clones" that were manufactured by a local computer company. The winmsd states:

System Manufacturer: VIA Technologies, Inc.
System Model: P4M266A-8235

 

Does your customer have a PC you can mess with? If so, interesting to see what would happen if you did a format, fresh XP install, and SP upgrade.

Also, if the local shop made a bunch of these, are they aware of any issues? They make keep closer track of hardware issues with stuff they routinely sell.

M$ isn't anything like approaching perfect but the guys who dig into those dump files usually know their stuff. I am a little surprised they just told you it was massive, widespread hardware failure and then dropped you though. That is a horrible way for them to provide support.

The dump you posted is a mini-dump. Is that what they worked with or did you provide them with some full dumps?

 

Yes, I contacted the computer manufacture and asked if they have seen this specific issue with any of their computers. They said no, but they did state that numerous people have had issues after loading SP2. Their solution to customers they support directly was to reload Windows XP w/ SP2 slipped in and all was well. But, I really don’t want to do that to all these clients.

I have supplied Microsoft with (3) different "Complete" memory dumps from three different computers. All of them are the same stop code 0xd1 specifying atapi.sys as being the cause.

The customer has agreed to let me come in and work with one of the client computers that is crashing the most. I was going to unload Symantec AntiVirus Corp and also the Veritas BackupExec Agent. Then I was going to reload SP2 and leave the antivirus and backup software off to see if the system continues to crash. If not, then I will load each separately with a week in between so that I can monitor to see if these specific applications are somehow agitating the problem.

 

Their solution to customers they support directly was to reload Windows XP w/ SP2 slipped in and all was well.

Not surprised you don't want to do that. Yuck. But if they had to recommend that as a 'fix' then something is for sure busted with their stuff and rather than finding the cause, they are doing a kludge that makes the customer work. Bah, humbug on them.

Might be worth trying a repair install with a slipstreamed XP/SP2 CD. Could work.

Meanwhile, I am at work now and the folks I need to ask are stored in my home address book but I'll see if I can locate a serious expert who might have some suggestions. Probably take a day or so but I will give it a try.

 

Your efforts are very much appreciated. Thank you very much!! I am also a member of Experts Exchange and no one on that site can answer this problem either.

 

this is a hardware issue. I realize that is a tough pill to swallow due to the number of machines affected. Heres how this kind of thing usually goes down. A driver gets updated, which changes the underlying assembly code to a different set of instructions. Those instructions when run in the new sequence are what expose the errata/bus noise/cache fetch failure.

I would have to write a thesis on how this works, but pop EDI does not cause the CPU to access memory address 0x00000050. Somehow the processor was told to execute something that references [eax].

You are skeptical, i can tell..

Code:

This is what the debugger capture 'in memory'
Address          opcode              assembly
f7579502 5f                            pop     edi
f7579503 838e2801000004        or      dword ptr [esi+0x128],0x4

kd> db f7579502
f7579502  5f 83 8e 28 01 00 00 04


**now, note that edi does not equal 50... so we wonder how 
that happened. eax=00000050 but pop isnt talking to eax.

What if, due to buggy hardware the byte located at 502 was read as a zero.

kd> db f7579502
f7579502  8f 00 8e 28 01 00 00 04

f7579502 8f00             pop     [eax]
f7579504 8e28             mov     gs,[eax]

now we see that pop is referencing [eax] which would cause your error. The trick here is that the "code" the CPU ran is different than what was in ATAPI.SYS. Lots of vectors for this, memory, bus, bridges, CPU caches, cpu instruction errata.

The above bitflip isnt the one that is happening on your machines, i dont have time to to map out all the possibilities to figure out a plausible single bit/byte flip, but trust me, thats what happened.

Point being, i would not expect reinstalling to have any effect. You are more likely to see results from a BIOS update.

 

Thanks Joe. Good stuff, as usual.

DigitalNetworks - you can take that answer as solid information. This certainly does look like something the hardware maker should address and fix even if it means ginning up a new part and shipping it as a replacement to systems that have problems.

 

You guys are awesome!! Thank you very much!! I cannot say thanks enough, as I have spent hours trying to research this, with no success. I am a developer by hobby and I do not possess nowhere near the amount of skill that was demonstrated by your analysis of this memory dump. Plus, I don’t understand Assembly code either. I looked at the x86 Registers and a simple tutorial on Assembly, but I could never make sense of what was presented here.

I have taken your response to the computer manufacture and obtained a new BIOS update. I am also going to update the chipset drivers. I updated the BIOS and chipset drivers on two of their computers yesterday.

While I have your attention, since I do like programming using high-level languages, but as a hobby and not professionally. Would it be worth my time to learn Assembly and the x86 architecture to the degree of being able to make sense of what you explained? Currently, I would have never been able to make sense of this memory dump and still am not able to fully grasp what you explained on why exactly it happened and why you know it is the BIOS. If it is worth my time studying this area, then do you have a suggestion on books, WWW or tutorials?

Thanks again!!

 

your welcome, I hope the BIOS update helps your problem.

Debugging is a niche skill. Its really difficult to advance the competence without a mentor. One of the last bastions of black art computer science is debugging (especially kernel). For example OSR charges 2500$ US for 4 days of training... Thats the market price of only 4 days of basic instruction.. and after that, you do not suddenly possess the rosetta stone of dumps, only an understanding of how to start. Nothing against OSR (im a subscriber, and have been to some of thier great classes), only trying to help you understand the scope of what you ask.

Assembly isnt that useful unless you program in C, or have to do post mortem debug analysis. That said, theres not many commands to learn. Its pretty easy to get the basics. That, an understanding of Windows Internals, and the intel processor manual pdfs and you have all the tools you need to play around.