Computer Randomly Restarts

thanks

 

Lets look at this problem from a hardware perspective.
I see you are using an Antec power supply.
They are usually very good power supplies, I use the True 330 here.
However, any power supply CAN go down.
An intermittent power supply rail would certainly cause this reboot problem.
If you can borrow another supply of equal or greater power than what you have to try or go with a new supply.

Daddad

 

But if it is a PS problem, would I be getting all these blue screens that seem to point to a driver error? Wouldn't the computer just be flat restarting if the PS was at fault? Granted, it had been flat restarting, but after I turned off automatic restarts, it no longer restarts, but goes to a blue screen and produces a dump file. However, if there is a chance that it is the PS, I can try to get another PS to test with, although I don't know where I'll get one. Thanks for the tip

 

The latest crash report:


Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini121704-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805644a0
Debug session time: Fri Dec 17 11:43:22 2004
System Uptime: 0 days 0:11:25.137
Loading Kernel Symbols
..............................................................................................................................................
Loading unloaded module list
..................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C1, {873bcf00, 873bcba3, 410100, 23}

Probably caused by : memory_corruption ( nt!MmFreeSpecialPool+2a1 )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: 873bcf00, address trying to free
Arg2: 873bcba3, address where bits are corrupted
Arg3: 00410100, (reserved)
Arg4: 00000023, caller is freeing an address where nearby bytes within the same page have been corrupted

Debugging Details:
------------------


BUGCHECK_STR: 0xC1_23

SPECIAL_POOL_CORRUPTION_TYPE: 23

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 8068dbb1 to 80537832

IRP_ADDRESS: 873bcf00

STACK_TEXT:
f3058b50 8068dbb1 000000c1 873bcf00 873bcba3 nt!KeBugCheckEx+0x1b
f3058b90 80552e31 873bcf00 f3058c13 85911d30 nt!MmFreeSpecialPool+0x2a1
f3058bd0 8067b4cd 873bcf00 00000000 8067b674 nt!ExFreePoolWithTag+0x4a
f3058bdc 8067b674 86080908 873bcf00 00000000 nt!VfIrpFree+0xc
f3058bf8 80674088 00000000 873bcf00 f3058c5c nt!VerifierIoFreeIrp+0x129
f3058c08 804ed3b9 873bcf00 873bcf40 85d5d020 nt!IovFreeIrpPrivate+0x41
f3058c5c 804ed49a 873bcf40 f3058ca8 f3058c9c nt!IopCompleteRequest+0x319
f3058cac 804ed4d9 00000000 00000000 00000000 nt!KiDeliverApc+0xb3
f3058cc4 804e223f 00000000 f3058d1c 00000000 nt!KiSwapThread+0x89
f3058cec 8056f2fa 00000001 00000006 f3058d01 nt!KeWaitForSingleObject+0x1c2
f3058d50 804ddf0f 000000ec 00000001 f3058d1c nt!NtWaitForSingleObject+0x9a
f3058d50 7c90eb94 000000ec 00000001 f3058d1c nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00e5fb74 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
nt!MmFreeSpecialPool+2a1
8068dbb1 8b4108 mov eax,[ecx+0x8]

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!MmFreeSpecialPool+2a1

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 41107faa

STACK_COMMAND: kb

IMAGE_NAME: memory_corruption

BUCKET_ID: 0xC1_23_nt!MmFreeSpecialPool+2a1

Followup: MachineOwner
---------

eax=ffdff13c ebx=873bcba3 ecx=00000000 edx=00000001 esi=00000100 edi=873bc000
eip=80537832 esp=f3058b38 ebp=f3058b50 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
80537832 5d pop ebp
ChildEBP RetAddr Args to Child
f3058b50 8068dbb1 000000c1 873bcf00 873bcba3 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f3058b90 80552e31 873bcf00 f3058c13 85911d30 nt!MmFreeSpecialPool+0x2a1 (FPO: [Non-Fpo])
f3058bd0 8067b4cd 873bcf00 00000000 8067b674 nt!ExFreePoolWithTag+0x4a (FPO: [Non-Fpo])
f3058bdc 8067b674 86080908 873bcf00 00000000 nt!VfIrpFree+0xc (FPO: [0,0,0])
f3058bf8 80674088 00000000 873bcf00 f3058c5c nt!VerifierIoFreeIrp+0x129 (FPO: [Non-Fpo])
f3058c08 804ed3b9 873bcf00 873bcf40 85d5d020 nt!IovFreeIrpPrivate+0x41 (FPO: [Non-Fpo])
f3058c5c 804ed49a 873bcf40 f3058ca8 f3058c9c nt!IopCompleteRequest+0x319 (FPO: [Non-Fpo])
f3058cac 804ed4d9 00000000 00000000 00000000 nt!KiDeliverApc+0xb3 (FPO: [Non-Fpo])
f3058cc4 804e223f 00000000 f3058d1c 00000000 nt!KiSwapThread+0x89 (FPO: [0,0,0])
f3058cec 8056f2fa 00000001 00000006 f3058d01 nt!KeWaitForSingleObject+0x1c2 (FPO: [Non-Fpo])
f3058d50 804ddf0f 000000ec 00000001 f3058d1c nt!NtWaitForSingleObject+0x9a (FPO: [Non-Fpo])
f3058d50 7c90eb94 000000ec 00000001 f3058d1c nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ f3058d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
00e5fb74 00000000 00000000 00000000 00000000 0x7c90eb94
start end module name
804d7000 80701000 nt ntkrnlmp.exe Wed Aug 04 02:18:18 2004 (41107FAA)
80701000 80721d00 hal halmacpi.dll Wed Aug 04 01:59:09 2004 (41107B2D)
bac09000 bac11880 Fips Fips.SYS Fri Aug 17 21:31:49 2001 (3B7DC585)
bac19000 bac2c900 parport parport.sys Wed Aug 04 01:59:04 2004 (41107B28)
bac2d000 bac487a0 ptserlp ptserlp.sys Fri May 04 17:39:53 2001 (3AF321A9)
bac49000 bac5a200 Rtlnicxp Rtlnicxp.sys Tue Apr 13 08:14:12 2004 (407BD994)
bac5b000 bac7de80 USBPORT USBPORT.SYS Wed Aug 04 02:08:34 2004 (41107D62)
bac7e000 bac91780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 02:07:04 2004 (41107D08)
bac9e000 baca1c80 mssmbios mssmbios.sys Wed Aug 04 02:07:47 2004 (41107D33)
bacca000 baccc580 ndistapi ndistapi.sys Fri Aug 17 16:55:29 2001 (3B7D84C1)
bacd6000 bacd9c00 ElbyCDFL ElbyCDFL.sys Thu Nov 28 09:18:04 2002 (3DE6259C)
bacda000 bacdcdc0 itchfltr itchfltr.sys Wed Mar 10 16:42:24 2004 (404F8BC0)
bacde000 bace1c80 serenum serenum.sys Wed Aug 04 01:59:06 2004 (41107B2A)
bad18000 bad32580 Mup Mup.sys Wed Aug 04 02:15:20 2004 (41107EF8)
bad33000 badc6840 vmodem vmodem.sys Fri Mar 09 00:52:33 2001 (3AA86FA1)
badc7000 bae280a0 vpctcom vpctcom.sys Fri Mar 09 00:52:54 2001 (3AA86FB6)
bae29000 bae55a80 NDIS NDIS.sys Wed Aug 04 02:14:27 2004 (41107EC3)
bae56000 baee2480 Ntfs Ntfs.sys Wed Aug 04 02:15:06 2004 (41107EEA)
baee3000 baef9780 KSecDD KSecDD.sys Wed Aug 04 01:59:45 2004 (41107B51)
baefa000 baf0bf00 sr sr.sys Wed Aug 04 02:06:22 2004 (41107CDE)
baf0c000 baf0d000 fltmgr fltmgr.sys unavailable (00000000)
baf2b000 baf42480 atapi atapi.sys Wed Aug 04 01:59:41 2004 (41107B4D)
baf43000 baf5a800 SCSIPORT SCSIPORT.SYS Wed Aug 04 01:59:39 2004 (41107B4B)
baf5b000 baf80700 dmio dmio.sys Wed Aug 04 02:07:13 2004 (41107D11)
baf81000 baf9f880 ftdisk ftdisk.sys Fri Aug 17 16:52:41 2001 (3B7D8419)
bafa0000 bafb0a80 pci pci.sys Wed Aug 04 02:07:45 2004 (41107D31)
bafb1000 bafded80 ACPI ACPI.sys Wed Aug 04 02:07:35 2004 (41107D27)
bf800000 bf9c0380 win32k win32k.sys Wed Aug 04 02:17:30 2004 (41107F7A)
bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 02:00:51 2004 (41107B93)
bf9d3000 bfd63480 nv4_disp nv4_disp.dll Fri Oct 29 21:15:58 2004 (4182EB4E)
f1a92000 f1aa2760 NAVENG NAVENG.Sys Thu Sep 30 21:59:17 2004 (415CB9F5)
f1aa3000 f1b3b680 NavEx15 NavEx15.Sys Thu Sep 30 22:11:15 2004 (415CBCC3)
f1c06000 f1c29000 Fastfat Fastfat.SYS Wed Aug 04 02:14:15 2004 (41107EB7)
f27f5000 f2835380 HTTP HTTP.sys Wed Aug 04 02:00:09 2004 (41107B69)
f2b88000 f2bd9000 SAVRT SAVRT.SYS Sat Nov 01 06:26:37 2003 (3FA3986D)
f3269000 f32bb180 srv srv.sys Wed Aug 04 02:14:44 2004 (41107ED4)
f330c000 f3338400 mrxdav mrxdav.sys Wed Aug 04 02:00:49 2004 (41107B91)
f351d000 f3528900 Defrag32 Defrag32.SYS Thu Apr 29 14:14:52 2004 (4091461C)
f354d000 f354f640 ElbyCDIO ElbyCDIO.sys Fri Nov 29 06:38:16 2002 (3DE751A8)
f3652000 f3666400 wdmaud wdmaud.sys Wed Aug 04 02:15:03 2004 (41107EE7)
f379f000 f37add80 sysaudio sysaudio.sys Wed Aug 04 02:15:54 2004 (41107F1A)
f4183000 f4186280 ndisuio ndisuio.sys Wed Aug 04 02:03:10 2004 (41107C1E)
f5387000 f539e480 dump_atapi dump_atapi.sys Wed Aug 04 01:59:41 2004 (41107B4D)
f53c7000 f5434680 mrxsmb mrxsmb.sys Wed Oct 27 21:14:16 2004 (418047E8)
f5435000 f545fa00 rdbss rdbss.sys Wed Oct 27 21:13:57 2004 (418047D5)
f5460000 f5481d00 afd afd.sys Wed Aug 04 02:14:13 2004 (41107EB5)
f5482000 f54a9c00 netbt netbt.sys Wed Aug 04 02:14:36 2004 (41107ECC)
f54aa000 f54ea5a0 symidsco symidsco.sys Tue Nov 23 20:08:22 2004 (41A3DF06)
f54eb000 f55138c0 SYMFW SYMFW.SYS Fri Oct 15 19:18:20 2004 (41705ABC)
f5514000 f5526c20 SYMEVENT SYMEVENT.SYS Wed Aug 06 21:32:39 2003 (3F31AC37)
f55c7000 f5606be0 SYMTDI SYMTDI.SYS Fri Oct 15 19:18:05 2004 (41705AAD)
f5607000 f5627f00 ipnat ipnat.sys Wed Sep 29 18:28:36 2004 (415B3714)
f5628000 f567fa80 tcpip tcpip.sys Wed Aug 04 02:14:39 2004 (41107ECF)
f5680000 f5692400 ipsec ipsec.sys Wed Aug 04 02:14:27 2004 (41107EC3)
f6839000 f683b900 Dxapi Dxapi.sys Fri Aug 17 16:53:19 2001 (3B7D843F)
f6864000 f6897200 update update.sys Wed Aug 04 01:58:32 2004 (41107B08)
f6898000 f68c8100 rdpdr rdpdr.sys Wed Aug 04 02:01:10 2004 (41107BA6)
f68c9000 f68d9e00 psched psched.sys Wed Aug 04 02:04:16 2004 (41107C60)
f68da000 f68f0680 ndiswan ndiswan.sys Wed Aug 04 02:14:30 2004 (41107EC6)
f68f1000 f6952c00 ALCXSENS ALCXSENS.SYS Mon Feb 23 13:11:09 2004 (403A423D)
f6993000 f69a2900 Cdfs Cdfs.SYS Wed Aug 04 02:14:09 2004 (41107EB1)
f69d3000 f69e2060 LMouFlt2 LMouFlt2.sys Tue May 21 21:02:00 2002 (3CEAEE08)
f69e3000 f6a06980 portcls portcls.sys Wed Aug 04 02:15:47 2004 (41107F13)
f6a07000 f6a9fa00 ALCXWDM ALCXWDM.SYS Mon Aug 02 09:09:17 2004 (410E3CFD)
f6aa0000 f6ac2680 ks ks.sys Wed Aug 04 02:15:20 2004 (41107EF8)
f6ac3000 f6d752c0 nv4_mini nv4_mini.sys Fri Oct 29 21:20:09 2004 (4182EC49)
f7487000 f748fc00 isapnp isapnp.sys Fri Aug 17 16:58:01 2001 (3B7D8559)
f7497000 f74a5e80 ohci1394 ohci1394.sys Wed Aug 04 02:10:05 2004 (41107DBD)
f74a7000 f74b4000 1394BUS 1394BUS.SYS Wed Aug 04 02:10:03 2004 (41107DBB)
f74b7000 f74c1500 MountMgr MountMgr.sys Wed Aug 04 01:58:29 2004 (41107B05)
f74c7000 f74d3c80 VolSnap VolSnap.sys Wed Aug 04 02:00:14 2004 (41107B6E)
f74d7000 f74dfe00 disk disk.sys Wed Aug 04 01:59:53 2004 (41107B59)
f74e7000 f74f3200 CLASSPNP CLASSPNP.SYS Wed Aug 04 02:14:26 2004 (41107EC2)
f74f7000 f7502900 Defrag32b Defrag32b.sys Thu Apr 29 14:14:52 2004 (4091461C)
f7507000 f7516c40 vvoice vvoice.sys Thu Apr 19 18:46:11 2001 (3ADF6AB3)
f7517000 f7521880 sbp2port sbp2port.sys Wed Aug 04 01:59:54 2004 (41107B5A)
f7527000 f7531580 agp440 agp440.sys Wed Aug 04 02:07:40 2004 (41107D2C)
f7557000 f7563e00 i8042prt i8042prt.sys Wed Aug 04 02:14:36 2004 (41107ECC)
f7567000 f7576180 nic1394 nic1394.sys Wed Aug 04 01:58:28 2004 (41107B04)
f7577000 f7581380 imapi imapi.sys Wed Aug 04 02:00:12 2004 (41107B6C)
f7587000 f7593180 cdrom cdrom.sys Wed Aug 04 01:59:52 2004 (41107B58)
f7597000 f75a5080 redbook redbook.sys Wed Aug 04 01:59:34 2004 (41107B46)
f75a7000 f75b5b80 drmk drmk.sys Wed Aug 04 02:07:54 2004 (41107D3A)
f75b7000 f75c3880 rasl2tp rasl2tp.sys Wed Aug 04 02:14:21 2004 (41107EBD)
f75c7000 f75d1200 raspppoe raspppoe.sys Wed Aug 04 02:05:06 2004 (41107C92)
f75d7000 f75e2d00 raspptp raspptp.sys Wed Aug 04 02:14:26 2004 (41107EC2)
f75e7000 f75ef900 msgpc msgpc.sys Wed Aug 04 02:04:11 2004 (41107C5B)
f75f7000 f7600f00 termdd termdd.sys Wed Aug 04 01:58:52 2004 (41107B1C)
f7607000 f7610480 NDProxy NDProxy.SYS Fri Aug 17 16:55:30 2001 (3B7D84C2)
f7617000 f7625100 usbhub usbhub.sys Wed Aug 04 02:08:40 2004 (41107D68)
f7647000 f764f700 wanarp wanarp.sys Wed Aug 04 02:04:57 2004 (41107C89)
f7657000 f7665d80 arp1394 arp1394.sys Wed Aug 04 01:58:28 2004 (41107B04)
f7677000 f7680fa0 SYMNDIS SYMNDIS.SYS Fri Oct 15 19:18:14 2004 (41705AB6)
f7697000 f769f2e0 LHidUsb LHidUsb.Sys Wed Mar 03 13:11:00 2004 (40461FB4)
f76a7000 f76afd80 HIDCLASS HIDCLASS.SYS Wed Aug 04 02:08:18 2004 (41107D52)
f76b7000 f76bf700 netbios netbios.sys Wed Aug 04 02:03:19 2004 (41107C27)
f76d7000 f76e7000 SAVRTPEL SAVRTPEL.SYS Sat Nov 01 06:26:40 2003 (3FA39870)
f76e7000 f76efd00 intelppm intelppm.sys Wed Aug 04 01:59:19 2004 (41107B37)
f76f7000 f7706d80 serial serial.sys Wed Aug 04 02:15:51 2004 (41107F17)
f7707000 f770d200 PCIIDEX PCIIDEX.SYS Wed Aug 04 01:59:40 2004 (41107B4C)
f770f000 f7713900 PartMgr PartMgr.sys Fri Aug 17 21:32:23 2001 (3B7DC5A7)
f7717000 f771c600 ElbyVCD ElbyVCD.sys Thu Nov 28 05:43:49 2002 (3DE5F365)
f7727000 f772c000 SYMREDRV SYMREDRV.SYS Fri Oct 15 19:18:24 2004 (41705AC0)
f775f000 f7765180 HIDPARSE HIDPARSE.SYS Wed Aug 04 02:08:15 2004 (41107D4F)
f7767000 f776e1e0 SYMIDS SYMIDS.SYS Fri Oct 15 19:18:29 2004 (41705AC5)
f7777000 f777c620 LHidFlt2 LHidFlt2.sys Tue May 21 21:02:09 2002 (3CEAEE11)
f77a7000 f77ab500 watchdog watchdog.sys Wed Aug 04 02:07:32 2004 (41107D24)
f7817000 f781c000 usbuhci usbuhci.sys Wed Aug 04 02:08:34 2004 (41107D62)
f781f000 f7825800 usbehci usbehci.sys Wed Aug 04 02:08:34 2004 (41107D62)
f7827000 f782e580 Modem Modem.SYS Wed Aug 04 02:08:04 2004 (41107D44)
f782f000 f7830000 fdc fdc.sys unavailable (00000000)
f7837000 f783d000 kbdclass kbdclass.sys Wed Aug 04 01:58:32 2004 (41107B08)
f783f000 f7845400 MxlW2k MxlW2k.SYS Fri Jan 30 19:09:18 2004 (401AF22E)
f7847000 f784b880 TDI TDI.SYS Wed Aug 04 02:07:47 2004 (41107D33)
f784f000 f7853580 ptilink ptilink.sys Fri Aug 17 16:49:53 2001 (3B7D8371)
f7857000 f785b080 raspti raspti.sys Fri Aug 17 16:55:32 2001 (3B7D84C4)
f785f000 f7864a00 mouclass mouclass.sys Wed Aug 04 01:58:32 2004 (41107B08)
f7867000 f786c000 flpydisk flpydisk.sys Wed Aug 04 01:59:24 2004 (41107B3C)
f7877000 f787c200 vga vga.sys Wed Aug 04 02:07:06 2004 (41107D0A)
f787f000 f7880000 Msfs Msfs.SYS unavailable (00000000)
f7887000 f788e880 Npfs Npfs.SYS Wed Aug 04 02:00:38 2004 (41107B86)
f7897000 f789a000 BOOTVID BOOTVID.dll Fri Aug 17 16:49:09 2001 (3B7D8345)
f7943000 f7945280 rasacd rasacd.sys Fri Aug 17 16:55:39 2001 (3B7D84CB)
f795b000 f795df80 mouhid mouhid.sys Fri Aug 17 16:47:57 2001 (3B7D82FD)
f7987000 f7988b80 kdcom kdcom.dll Fri Aug 17 16:49:10 2001 (3B7D8346)
f7989000 f798a100 WMILIB WMILIB.SYS Fri Aug 17 17:07:23 2001 (3B7D878B)
f798b000 f798c000 dmload dmload.sys unavailable (00000000)
f79b7000 f79b8480 LKbdFlt2 LKbdFlt2.sys Tue May 21 21:01:41 2002 (3CEAEDF5)
f79b9000 f79ba100 swenum swenum.sys Wed Aug 04 01:58:41 2004 (41107B11)
f79bb000 f79bc280 USBD USBD.SYS Fri Aug 17 17:02:58 2001 (3B7D8682)
f79bd000 f79be000 Fs_Rec Fs_Rec.SYS unavailable (00000000)
f79bf000 f79c0080 Beep Beep.SYS Fri Aug 17 16:47:33 2001 (3B7D82E5)
f79c1000 f79c2080 mnmdd mnmdd.SYS Fri Aug 17 16:57:28 2001 (3B7D8538)
f79c3000 f79c4080 RDPCDD RDPCDD.sys Fri Aug 17 16:46:56 2001 (3B7D82C0)
f79c5000 f79c6640 SYMDNS SYMDNS.SYS Fri Oct 15 19:18:07 2004 (41705AAF)
f79df000 f79e0100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 17:07:23 2001 (3B7D878B)
f7a03000 f7a04000 ParVdm ParVdm.SYS unavailable (00000000)
f7a4f000 f7a4fd00 pciide pciide.sys Fri Aug 17 16:51:49 2001 (3B7D83E5)
f7ad0000 f7ad07a0 symlcbrd symlcbrd.sys Wed Oct 16 02:50:27 2002 (3DAD0C33)
f7afa000 f7afaa80 PQNTDrv PQNTDrv.SYS Wed Apr 16 16:21:28 2003 (3E9DBB48)
f7b7e000 f7b7f000 Null Null.SYS unavailable (00000000)
f7bb6000 f7bb6c00 audstub audstub.sys Fri Aug 17 16:59:40 2001 (3B7D85BC)
f7bc3000 f7bc3d00 dxgthk dxgthk.sys Fri Aug 17 16:53:12 2001 (3B7D8438)

Unloaded modules:
f1b3c000 f1b66000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f1a92000 f1aa3000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f1aa3000 f1b3c000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f1a70000 f1a81000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f1a92000 f1b2b000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f1a92000 f1aa3000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f1aa3000 f1b3c000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f2a16000 f2a27000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f2a27000 f2ac0000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f3565000 f358f000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7bb0000 f7bb1000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f362f000 f3652000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f421f000 f422c000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f372f000 f373d000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f798f000 f7991000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f76c7000 f76d0000 processr.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f786f000 f7874000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f793f000 f7942000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

I am still getting lots of special pool corruption blue screens, and I'd like to know whether this is a hardware problem or not, so that if it is I can quickly RMA my MoBo before Christmas. Anybody know?

 

OK, I think I might finally have something. I used driver verifier to check on all of my drivers, not just the unsigned ones like I'd been doing for the past few days. Upon reboot, the computer would not start but went to a blue screen where I got the message:

IO system verification error in ptserlp.sys (WDM driver error 20e) [ptserlp.sys + 7dc5 at f6618DC5]

To make sure this message wasn't a fluke, or that I wouldn't get a different driver error every time I restarted, I restarted the computer a couple times to check. Every time it got the same results, this ptserlp.sys (driver?) So, I went in safe mode and disabled verifier and then I was able to boot normally into Windows. But what is this driver, how do I fix it, is it a hardware problem? Is it my MoBo? Some please help

 

I do not like to use driver verifier when chasing straight up pool corruption issues, as it enables several different things, whether you ask it to or not. Verifier is really for programmers more than end users.
One of them is basic IO checking, which can fail all day long and never cause a problem. This latest IO verificaiton crash is not nessicarily a problem and as far as I'm concerned can be ignored.

Don't get fancy, you're lucky the machine booted at all in safe mode with verifier on. Thats not always the case

I cannot speak to if you have a motherboard problem, we have no evidence in the software on this, only your 'development' posted below that would imply something sketchy in the hardware.

As far as this latest dump, the special pool caught that it was corrupted on the free, not on the corruption. Grab another dump or two, AFTER you unwind verifier and make sure you have the special pool keys set. You can also trim off the list of drivers at the end of the debug log, we really dont need another copy.

 

Thanks for the advice JoeHobart. I have turned off verifier, and will post when/if I get more crashes. Sorry about posting the list of drivers, I didn't realize that was nonessential I appreciate you helping me with this problem.

 

Crash 1:

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 80552b91, f316ebf8, 0}

*** ERROR: Module load completed but symbols could not be loaded for a347bus.sys
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+271 )

Followup: Pool_corruption
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates
that an unaligned data reference was encountered. The trap frame will
supply additional information.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80552b91, The address that the exception occurred at
Arg3: f316ebf8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
nt!ExDeferredFreePool+271
80552b91 8b3b mov edi,[ebx]

TRAP_FRAME: f316ebf8 -- (.trap fffffffff316ebf8)
.trap fffffffff316ebf8
ErrCode = 00000000
eax=00000001 ebx=0535d000 ecx=00000007 edx=867f246e esi=867ed078 edi=0535d000
eip=80552b91 esp=f316ec6c ebp=f316ecac iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!ExDeferredFreePool+0x271:
80552b91 8b3b mov edi,[ebx] ds:0023:0535d000=????????
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 16

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 80552aca to 80552b91

STACK_TEXT:
f316ecac 80552aca 00000001 f78012a0 e32fe008 nt!ExDeferredFreePool+0x271
f316ecec f77e5ffe e32fe008 58434c41 f77e71d4 nt!ExFreePoolWithTag+0x47f
WARNING: Stack unwind information not available. Following frames may be wrong.
f316ed18 f77f2f35 e28f0298 00d6ec4c 0016ed30 a347bus+0xffe
f316ed38 f77f2fcc 00d6ec90 00d6ebe4 f316ed64 a347bus+0xdf35
f316ed64 7c90eb94 badb0d00 00d6ebcc f2dc6d98 a347bus+0xdfcc
00d6ec24 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+271
80552b91 8b3b mov edi,[ebx]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: Pool_corruption

SYMBOL_NAME: nt!ExDeferredFreePool+271

MODULE_NAME: Pool_Corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: 0x8E_nt!ExDeferredFreePool+271

Followup: Pool_corruption
---------

eax=00000001 ebx=0535d000 ecx=00000007 edx=867f246e esi=867ed078 edi=0535d000
eip=80552b91 esp=f316ec6c ebp=f316ecac iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!ExDeferredFreePool+0x271:
80552b91 8b3b mov edi,[ebx] ds:0023:0535d000=????????
ChildEBP RetAddr Args to Child
f316ecac 80552aca 00000001 f78012a0 e32fe008 nt!ExDeferredFreePool+0x271 (FPO: [Non-Fpo])
f316ecec f77e5ffe e32fe008 58434c41 f77e71d4 nt!ExFreePoolWithTag+0x47f (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
f316ed18 f77f2f35 e28f0298 00d6ec4c 0016ed30 a347bus+0xffe
f316ed38 f77f2fcc 00d6ec90 00d6ebe4 f316ed64 a347bus+0xdf35
f316ed64 7c90eb94 badb0d00 00d6ebcc f2dc6d98 a347bus+0xdfcc
00d6ec24 00000000 00000000 00000000 00000000 0x7c90eb94

 

Crash 2:
Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 80552ae7, f74cd98c, 0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+109 )

Followup: Pool_corruption
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates
that an unaligned data reference was encountered. The trap frame will
supply additional information.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80552ae7, The address that the exception occurred at
Arg3: f74cd98c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
nt!ExDeferredFreePool+109
80552ae7 895f04 mov [edi+0x4],ebx

TRAP_FRAME: f74cd98c -- (.trap fffffffff74cd98c)
.trap fffffffff74cd98c
ErrCode = 00000002
eax=e42cc000 ebx=00b05872 ecx=000001ff edx=e42ccc60 esi=867ec050 edi=00dca67c
eip=80552ae7 esp=f74cda00 ebp=f74cda40 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!ExDeferredFreePool+0x109:
80552ae7 895f04 mov [edi+0x4],ebx ds:0023:00dca680=????????
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 19

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 80552aca to 80552ae7

STACK_TEXT:
f74cda40 80552aca 00000001 f74cdb64 8000000b nt!ExDeferredFreePool+0x109
f74cda80 80575bba e42d87e0 00000000 00000000 nt!ExFreePoolWithTag+0x47f
f74cdaa4 80575751 00000000 00000000 00000000 nt!RtlpInheritAcl+0x76
f74cdb80 80575a6c 00000000 e2bfcf80 f74cdbd8 nt!RtlpNewSecurityObject+0x387
f74cdbac 80575df0 00000000 00000000 f74cdbd8 nt!SeAssignSecurity+0x4f
f74cdbdc 80575f8c f74cdc00 00000000 e2b879d8 nt!ObAssignSecurity+0x35
f74cdcc4 8057e433 e2b879d8 f74cdc00 00000000 nt!ObInsertObject+0x47d
f74cdd44 804ddf0f 00000470 0000002c 0080f890 nt!NtDuplicateToken+0x154
f74cdd44 7c90eb94 00000470 0000002c 0080f890 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0080f860 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+109
80552ae7 895f04 mov [edi+0x4],ebx

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: Pool_corruption

SYMBOL_NAME: nt!ExDeferredFreePool+109

MODULE_NAME: Pool_Corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: 0x8E_nt!ExDeferredFreePool+109

Followup: Pool_corruption
---------

eax=e42cc000 ebx=00b05872 ecx=000001ff edx=e42ccc60 esi=867ec050 edi=00dca67c
eip=80552ae7 esp=f74cda00 ebp=f74cda40 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!ExDeferredFreePool+0x109:
80552ae7 895f04 mov [edi+0x4],ebx ds:0023:00dca680=????????
ChildEBP RetAddr Args to Child
f74cda40 80552aca 00000001 f74cdb64 8000000b nt!ExDeferredFreePool+0x109 (FPO: [Non-Fpo])
f74cda80 80575bba e42d87e0 00000000 00000000 nt!ExFreePoolWithTag+0x47f (FPO: [Non-Fpo])
f74cdaa4 80575751 00000000 00000000 00000000 nt!RtlpInheritAcl+0x76 (FPO: [Non-Fpo])
f74cdb80 80575a6c 00000000 e2bfcf80 f74cdbd8 nt!RtlpNewSecurityObject+0x387 (FPO: [Non-Fpo])
f74cdbac 80575df0 00000000 00000000 f74cdbd8 nt!SeAssignSecurity+0x4f (FPO: [Non-Fpo])
f74cdbdc 80575f8c f74cdc00 00000000 e2b879d8 nt!ObAssignSecurity+0x35 (FPO: [Non-Fpo])
f74cdcc4 8057e433 e2b879d8 f74cdc00 00000000 nt!ObInsertObject+0x47d (FPO: [Non-Fpo])
f74cdd44 804ddf0f 00000470 0000002c 0080f890 nt!NtDuplicateToken+0x154 (FPO: [Non-Fpo])
f74cdd44 7c90eb94 00000470 0000002c 0080f890 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ f74cdd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0080f860 00000000 00000000 00000000 00000000 0x7c90eb94

 

Crash 3:

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {8df762b8, 0, 80570d5f, 0}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!ObpCloseHandleTableEntry+10 )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: 8df762b8, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 80570d5f, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: 8df762b8

FAULTING_IP:
nt!ObpCloseHandleTableEntry+10
80570d5f 8b4e08 mov ecx,[esi+0x8]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 20

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from 8058d3f4 to 80570d5f

STACK_TEXT:
f3d2ac14 8058d3f4 e35cdd68 e112c020 00000010 nt!ObpCloseHandleTableEntry+0x10
f3d2ac34 8058cc2e e112c020 00000010 f3d2ac74 nt!ObpCloseHandleProcedure+0x1f
f3d2ac54 8058d3a0 e35cdd68 8058d3d5 f3d2ac74 nt!ExSweepHandleTable+0x3b
f3d2ac80 8058cb23 86024590 85c8ba48 85c8bc90 nt!ObKillProcess+0x5c
f3d2ad08 805763b0 c0000005 85c8ba48 00000000 nt!PspExitThread+0x58a
f3d2ad28 8058cf5d 85c8ba48 c0000005 f3d2ad64 nt!PspTerminateThreadByPointer+0x52
f3d2ad54 804ddf0f 00000000 c0000005 0007fee4 nt!NtTerminateProcess+0x118
f3d2ad54 7c90eb94 00000000 c0000005 0007fee4 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007fde4 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
nt!ObpCloseHandleTableEntry+10
80570d5f 8b4e08 mov ecx,[esi+0x8]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!ObpCloseHandleTableEntry+10

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41107faa

STACK_COMMAND: kb

BUCKET_ID: 0x50_nt!ObpCloseHandleTableEntry+10

Followup: MachineOwner
---------

eax=f3d2ac74 ebx=000001fc ecx=00000000 edx=8df762b1 esi=8df762b0 edi=e112c020
eip=80570d5f esp=f3d2ac08 ebp=f3d2ac14 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!ObpCloseHandleTableEntry+0x10:
80570d5f 8b4e08 mov ecx,[esi+0x8] ds:0023:8df762b8=????????
ChildEBP RetAddr Args to Child
f3d2ac14 8058d3f4 e35cdd68 e112c020 00000010 nt!ObpCloseHandleTableEntry+0x10 (FPO: [Non-Fpo])
f3d2ac34 8058cc2e e112c020 00000010 f3d2ac74 nt!ObpCloseHandleProcedure+0x1f (FPO: [Non-Fpo])
f3d2ac54 8058d3a0 e35cdd68 8058d3d5 f3d2ac74 nt!ExSweepHandleTable+0x3b (FPO: [Non-Fpo])
f3d2ac80 8058cb23 86024590 85c8ba48 85c8bc90 nt!ObKillProcess+0x5c (FPO: [Non-Fpo])
f3d2ad08 805763b0 c0000005 85c8ba48 00000000 nt!PspExitThread+0x58a (FPO: [Non-Fpo])
f3d2ad28 8058cf5d 85c8ba48 c0000005 f3d2ad64 nt!PspTerminateThreadByPointer+0x52 (FPO: [Non-Fpo])
f3d2ad54 804ddf0f 00000000 c0000005 0007fee4 nt!NtTerminateProcess+0x118 (FPO: [Non-Fpo])
f3d2ad54 7c90eb94 00000000 c0000005 0007fee4 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ f3d2ad64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007fde4 00000000 00000000 00000000 00000000 0x7c90eb94

 

Crash 4:


Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {10, 2, 1, 804f8dd0}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -
Probably caused by : SYMEVENT.SYS ( SYMEVENT!SYMEvent_GetVMDataPtr+33ae )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000010, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 804f8dd0, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000010

CURRENT_IRQL: 2

FAULTING_IP:
nt!MmCopyToCachedPage+3d3
804f8dd0 ff4010 inc dword ptr [eax+0x10]

CUSTOMER_CRASH_COUNT: 21

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 804f8981 to 804f8dd0

STACK_TEXT:
f3669aac 804f8981 c1a20000 0147eab0 00000000 nt!MmCopyToCachedPage+0x3d3
f3669b3c 804fea1d 8637c3e0 0147eab0 f3669b70 nt!CcMapAndCopy+0x1af
f3669bc0 f7688278 85c52db8 00360000 00010000 nt!CcFastCopyWrite+0x230
f3669c28 f7707a27 85c52db8 f3669cd4 00010000 Ntfs!NtfsCopyWriteA+0x23d
f3669c5c f5b57b4e 85c52db8 f3669cd4 00010000 sr!SrFastIoWrite+0x77
WARNING: Stack unwind information not available. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 SYMEVENT!SYMEvent_GetVMDataPtr+0x33ae


FOLLOWUP_IP:
SYMEVENT!SYMEvent_GetVMDataPtr+33ae
f5b57b4e 5f pop edi

SYMBOL_STACK_INDEX: 5

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SYMEVENT!SYMEvent_GetVMDataPtr+33ae

MODULE_NAME: SYMEVENT

IMAGE_NAME: SYMEVENT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 3f31ac37

STACK_COMMAND: kb

BUCKET_ID: 0xA_W_SYMEVENT!SYMEvent_GetVMDataPtr+33ae

Followup: MachineOwner
---------

eax=00000000 ebx=81412dd8 ecx=81053000 edx=00033b69 esi=e1345d80 edi=00027fe9
eip=804f8dd0 esp=f3669a34 ebp=f3669aac iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MmCopyToCachedPage+0x3d3:
804f8dd0 ff4010 inc dword ptr [eax+0x10] ds:0023:00000010=????????
ChildEBP RetAddr Args to Child
f3669aac 804f8981 c1a20000 0147eab0 00000000 nt!MmCopyToCachedPage+0x3d3 (FPO: [Non-Fpo])
f3669b3c 804fea1d 8637c3e0 0147eab0 f3669b70 nt!CcMapAndCopy+0x1af (FPO: [Non-Fpo])
f3669bc0 f7688278 85c52db8 00360000 00010000 nt!CcFastCopyWrite+0x230 (FPO: [Non-Fpo])
f3669c28 f7707a27 85c52db8 f3669cd4 00010000 Ntfs!NtfsCopyWriteA+0x23d (FPO: [Non-Fpo])
f3669c5c f5b57b4e 85c52db8 f3669cd4 00010000 sr!SrFastIoWrite+0x77 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 SYMEVENT!SYMEvent_GetVMDataPtr+0x33ae

 

Crash 5:

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, f5b0feff, f3ebeb38, 0}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -
*** ERROR: Module load completed but symbols could not be loaded for a347bus.sys
Probably caused by : SYMEVENT.SYS ( SYMEVENT!SYMEvent_GetVMDataPtr+675f )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates
that an unaligned data reference was encountered. The trap frame will
supply additional information.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f5b0feff, The address that the exception occurred at
Arg3: f3ebeb38, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
SYMEVENT!SYMEvent_GetVMDataPtr+675f
f5b0feff 8b4310 mov eax,[ebx+0x10]

TRAP_FRAME: f3ebeb38 -- (.trap fffffffff3ebeb38)
.trap fffffffff3ebeb38
ErrCode = 00000000
eax=e13c4ff0 ebx=065b526c ecx=e152ad48 edx=f5b08d8c esi=e152ad48 edi=e1a17ae8
eip=f5b0feff esp=f3ebebac ebp=f3ebec7c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
SYMEVENT!SYMEvent_GetVMDataPtr+0x675f:
f5b0feff 8b4310 mov eax,[ebx+0x10] ds:0023:065b527c=????????
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 22

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 80570c83 to f5b0feff

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f3ebec7c 80570c83 85ba2020 8632a1d0 00100001 SYMEVENT!SYMEvent_GetVMDataPtr+0x675f
f3ebecac 80570dd6 85ba2020 01229500 867e7ad0 nt!ObpDecrementHandleCount+0x11b
f3ebecd4 80570cfc e27bdf08 86229518 000000d4 nt!ObpCloseHandleTableEntry+0x14d
f3ebed1c 80570d46 000000d4 00000001 00000000 nt!ObpCloseHandle+0x87
f3ebed30 f77f3072 000000d4 00000000 00000000 nt!NtClose+0x1d
f3ebed58 804ddf0f 000000d4 0121f930 7c90eb94 a347bus+0xe072
f3ebed58 7c90eb94 000000d4 0121f930 7c90eb94 nt!KiFastCallEntry+0xfc
0121f8e0 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
SYMEVENT!SYMEvent_GetVMDataPtr+675f
f5b0feff 8b4310 mov eax,[ebx+0x10]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SYMEVENT!SYMEvent_GetVMDataPtr+675f

MODULE_NAME: SYMEVENT

IMAGE_NAME: SYMEVENT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 3f31ac37

STACK_COMMAND: .trap fffffffff3ebeb38 ; kb

BUCKET_ID: 0x8E_SYMEVENT!SYMEvent_GetVMDataPtr+675f

Followup: MachineOwner
---------

eax=e13c4ff0 ebx=065b526c ecx=e152ad48 edx=f5b08d8c esi=e152ad48 edi=e1a17ae8
eip=f5b0feff esp=f3ebebac ebp=f3ebec7c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
SYMEVENT!SYMEvent_GetVMDataPtr+0x675f:
f5b0feff 8b4310 mov eax,[ebx+0x10] ds:0023:065b527c=????????
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
f3ebec7c 80570c83 85ba2020 8632a1d0 00100001 SYMEVENT!SYMEvent_GetVMDataPtr+0x675f
f3ebecac 80570dd6 85ba2020 01229500 867e7ad0 nt!ObpDecrementHandleCount+0x11b (FPO: [Non-Fpo])
f3ebecd4 80570cfc e27bdf08 86229518 000000d4 nt!ObpCloseHandleTableEntry+0x14d (FPO: [Non-Fpo])
f3ebed1c 80570d46 000000d4 00000001 00000000 nt!ObpCloseHandle+0x87 (FPO: [Non-Fpo])
f3ebed30 f77f3072 000000d4 00000000 00000000 nt!NtClose+0x1d (FPO: [Non-Fpo])
f3ebed58 804ddf0f 000000d4 0121f930 7c90eb94 a347bus+0xe072
f3ebed58 7c90eb94 000000d4 0121f930 7c90eb94 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ f3ebed64)
0121f8e0 00000000 00000000 00000000 00000000 0x7c90eb94

 

My gosh, it's crashing every 4 minutes. Crash 6:

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, e377d000, e377d880, d100200}

Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+2c1 )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: e377d000, The pool entry we were looking for within the page.
Arg3: e377d880, The next pool entry.
Arg4: 0d100200, (reserved)

Debugging Details:
------------------


BUGCHECK_STR: 0x19_20

POOL_ADDRESS: e377d000

CUSTOMER_CRASH_COUNT: 23

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

LAST_CONTROL_TRANSFER: from 80552fc8 to 80537832

STACK_TEXT:
f7c5dcb8 80552fc8 00000019 00000020 e377d000 nt!KeBugCheckEx+0x1b
f7c5dd08 8057e689 e377d008 00000000 85bf7250 nt!ExFreePoolWithTag+0x2c1
f7c5dd48 8056e78f 00bf7268 00000000 85bf7268 nt!IopDeleteFile+0x17e
f7c5dd64 80580fd4 85bf7268 00000001 80569c20 nt!ObpRemoveObjectRoutine+0xdf
f7c5dd7c 804e29d6 00000000 00000000 867c37a8 nt!ObpProcessRemoveObjectQueue+0x36
f7c5ddac 80576b24 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
f7c5dddc 804eed86 804e2912 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
nt!ExFreePoolWithTag+2c1
80552fc8 83f801 cmp eax,0x1

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!ExFreePoolWithTag+2c1

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41107faa

STACK_COMMAND: kb

BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2c1

Followup: MachineOwner
---------

eax=ffdff13c ebx=e377d000 ecx=00000000 edx=00000000 esi=e377d000 edi=00000000
eip=80537832 esp=f7c5dca0 ebp=f7c5dcb8 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
80537832 5d pop ebp
ChildEBP RetAddr Args to Child
f7c5dcb8 80552fc8 00000019 00000020 e377d000 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f7c5dd08 8057e689 e377d008 00000000 85bf7250 nt!ExFreePoolWithTag+0x2c1 (FPO: [Non-Fpo])
f7c5dd48 8056e78f 00bf7268 00000000 85bf7268 nt!IopDeleteFile+0x17e (FPO: [Non-Fpo])
f7c5dd64 80580fd4 85bf7268 00000001 80569c20 nt!ObpRemoveObjectRoutine+0xdf (FPO: [Non-Fpo])
f7c5dd7c 804e29d6 00000000 00000000 867c37a8 nt!ObpProcessRemoveObjectQueue+0x36 (FPO: [1,0,0])
f7c5ddac 80576b24 00000000 00000000 00000000 nt!ExpWorkerThread+0xef (FPO: [Non-Fpo])
f7c5dddc 804eed86 804e2912 00000000 00000000 nt!PspSystemThreadStartup+0x34 (FPO: [Non-Fpo])
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

 

dump1) pool corruption
dump2) pool corruption
dump3) memory corruption (possibly induced by pool corruption)
dump4) pool corruption
dump5) norton symevent having a nutty, because of bad data(probably induced by pool corruption)
dump6) corrupt pool header

In looking at these dumps, it doesnt seem like special pool is enabled anymore? Did you verify that the regkeys joe had you set were still configured?

Save that dump6, it could be exciting if special pool is indeed enabled.

 

Oh, I "ll check. You know, I had to roll back my computer the other day to get it to restart, I didn't even think about it changing those registry keys. Thanks

 

OK, I put Joe's keys back in place.

 

First Crash since adding registry keys:

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 80552ae5, f39c9820, 0}

*** ERROR: Module load completed but symbols could not be loaded for a347bus.sys
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+107 )

Followup: Pool_corruption
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates
that an unaligned data reference was encountered. The trap frame will
supply additional information.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80552ae5, The address that the exception occurred at
Arg3: f39c9820, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
nt!ExDeferredFreePool+107
80552ae5 893b mov [ebx],edi

TRAP_FRAME: f39c9820 -- (.trap fffffffff39c9820)
.trap fffffffff39c9820
ErrCode = 00000002
eax=e10ed000 ebx=00000000 ecx=000001ff edx=e10ed038 esi=867ee0a0 edi=34000000
eip=80552ae5 esp=f39c9894 ebp=f39c98d4 iopl=0 nv up ei ng nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
nt!ExDeferredFreePool+0x107:
80552ae5 893b mov [ebx],edi ds:0023:00000000=????????
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 80552aca to 80552ae5

STACK_TEXT:
f39c98d4 80552aca 00000001 867ba360 85f9ea40 nt!ExDeferredFreePool+0x107
f39c9914 8057474b e353f1e8 00000000 f39c9950 nt!ExFreePoolWithTag+0x47f
f39c9924 8056eaee e353f1e8 f39c9901 00000000 nt!ObReleaseObjectSecurity+0x1a
f39c9950 80574958 e2883700 85f9ea40 00000001 nt!ObCheckObjectAccess+0xd3
f39c999c 80573c4a e1ae4b60 009a0098 00000000 nt!CmpDoOpen+0x256
f39c9b94 80574152 009a0098 00000000 85f9ea40 nt!CmpParseKey+0x558
f39c9c0c 805715e8 0000064c f39c9c4c 00000040 nt!ObpLookupObjectName+0x119
f39c9c60 8057401f 00000000 867ba320 00000001 nt!ObOpenObjectByName+0xea
f39c9d34 f77f2fbc 00c6f654 02000000 00c6f570 nt!NtOpenKey+0x1af
WARNING: Stack unwind information not available. Following frames may be wrong.
f39c9d64 7c90eb94 badb0d00 00c6f558 00000000 a347bus+0xdfbc
00c6f5b0 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+107
80552ae5 893b mov [ebx],edi

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: Pool_corruption

SYMBOL_NAME: nt!ExDeferredFreePool+107

MODULE_NAME: Pool_Corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: 0x8E_nt!ExDeferredFreePool+107

Followup: Pool_corruption
---------

eax=e10ed000 ebx=00000000 ecx=000001ff edx=e10ed038 esi=867ee0a0 edi=34000000
eip=80552ae5 esp=f39c9894 ebp=f39c98d4 iopl=0 nv up ei ng nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
nt!ExDeferredFreePool+0x107:
80552ae5 893b mov [ebx],edi ds:0023:00000000=????????
ChildEBP RetAddr Args to Child
f39c98d4 80552aca 00000001 867ba360 85f9ea40 nt!ExDeferredFreePool+0x107 (FPO: [Non-Fpo])
f39c9914 8057474b e353f1e8 00000000 f39c9950 nt!ExFreePoolWithTag+0x47f (FPO: [Non-Fpo])
f39c9924 8056eaee e353f1e8 f39c9901 00000000 nt!ObReleaseObjectSecurity+0x1a (FPO: [Non-Fpo])
f39c9950 80574958 e2883700 85f9ea40 00000001 nt!ObCheckObjectAccess+0xd3 (FPO: [Non-Fpo])
f39c999c 80573c4a e1ae4b60 009a0098 00000000 nt!CmpDoOpen+0x256 (FPO: [Non-Fpo])
f39c9b94 80574152 009a0098 00000000 85f9ea40 nt!CmpParseKey+0x558 (FPO: [Non-Fpo])
f39c9c0c 805715e8 0000064c f39c9c4c 00000040 nt!ObpLookupObjectName+0x119 (FPO: [Non-Fpo])
f39c9c60 8057401f 00000000 867ba320 00000001 nt!ObOpenObjectByName+0xea (FPO: [Non-Fpo])
f39c9d34 f77f2fbc 00c6f654 02000000 00c6f570 nt!NtOpenKey+0x1af (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
f39c9d64 7c90eb94 badb0d00 00c6f558 00000000 a347bus+0xdfbc
00c6f5b0 00000000 00000000 00000000 00000000 0x7c90eb94

 

Second Crash:

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8055259a, f3eae3e0, 0}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -
Unable to load image SAVRT.SYS, Win32 error 2
*** WARNING: Unable to verify timestamp for SAVRT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SAVRT.SYS
Probably caused by : SYMEVENT.SYS ( SYMEVENT!SYMEvent_GetSubTask+24d0 )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates
that an unaligned data reference was encountered. The trap frame will
supply additional information.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8055259a, The address that the exception occurred at
Arg3: f3eae3e0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
nt!ExAllocatePoolWithTag+663
8055259a 8b06 mov eax,[esi]

TRAP_FRAME: f3eae3e0 -- (.trap fffffffff3eae3e0)
.trap fffffffff3eae3e0
ErrCode = 00000000
eax=867ec338 ebx=867ec050 ecx=867ec338 edx=00000002 esi=00000000 edi=000001ff
eip=8055259a esp=f3eae454 ebp=f3eae4a8 iopl=0 nv up ei pl nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010213
nt!ExAllocatePoolWithTag+0x663:
8055259a 8b06 mov eax,[esi] ds:0023:00000000=????????
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from f5b13300 to 8055259a

STACK_TEXT:
f3eae4a8 f5b13300 00000001 00000001 47766553 nt!ExAllocatePoolWithTag+0x663
WARNING: Stack unwind information not available. Following frames may be wrong.
f3eae60c 8056e063 8668cc08 00000000 85af0f30 SYMEVENT!SYMEvent_GetSubTask+0x24d0
f3eae684 805715e8 00000000 f3eae6c4 00000040 nt!ObpLookupObjectName+0x53c
f3eae6d8 8057f4c3 00000000 00000000 55214600 nt!ObOpenObjectByName+0xea
f3eae754 8057f592 f3eae858 00000180 f3eae824 nt!IopCreateFile+0x407
f3eae7b0 f2f8bd27 f3eae858 00000180 f3eae824 nt!IoCreateFile+0x8e
f3eae850 f2f8be03 e17d3e18 e2cf53e8 f3eae91b SAVRT+0x3fd27
f3eae868 f2f8f70d e17d3e18 f3eae91b e19fc430 SAVRT+0x3fe03
f3eae878 f2f63361 e17d3e18 00000001 f2f60a7e SAVRT+0x4370d
e19fc430 00000000 00000000 00000000 00000000 SAVRT+0x17361


FOLLOWUP_IP:
SYMEVENT!SYMEvent_GetSubTask+24d0
f5b13300 85c0 test eax,eax

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SYMEVENT!SYMEvent_GetSubTask+24d0

MODULE_NAME: SYMEVENT

IMAGE_NAME: SYMEVENT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 3f31ac37

STACK_COMMAND: .trap fffffffff3eae3e0 ; kb

BUCKET_ID: 0x8E_SYMEVENT!SYMEvent_GetSubTask+24d0

Followup: MachineOwner
---------

eax=867ec338 ebx=867ec050 ecx=867ec338 edx=00000002 esi=00000000 edi=000001ff
eip=8055259a esp=f3eae454 ebp=f3eae4a8 iopl=0 nv up ei pl nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010213
nt!ExAllocatePoolWithTag+0x663:
8055259a 8b06 mov eax,[esi] ds:0023:00000000=????????
ChildEBP RetAddr Args to Child
f3eae4a8 f5b13300 00000001 00000001 47766553 nt!ExAllocatePoolWithTag+0x663 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
f3eae60c 8056e063 8668cc08 00000000 85af0f30 SYMEVENT!SYMEvent_GetSubTask+0x24d0
f3eae684 805715e8 00000000 f3eae6c4 00000040 nt!ObpLookupObjectName+0x53c (FPO: [Non-Fpo])
f3eae6d8 8057f4c3 00000000 00000000 55214600 nt!ObOpenObjectByName+0xea (FPO: [Non-Fpo])
f3eae754 8057f592 f3eae858 00000180 f3eae824 nt!IopCreateFile+0x407 (FPO: [Non-Fpo])
f3eae7b0 f2f8bd27 f3eae858 00000180 f3eae824 nt!IoCreateFile+0x8e (FPO: [Non-Fpo])
f3eae850 f2f8be03 e17d3e18 e2cf53e8 f3eae91b SAVRT+0x3fd27
f3eae868 f2f8f70d e17d3e18 f3eae91b e19fc430 SAVRT+0x3fe03
f3eae878 f2f63361 e17d3e18 00000001 f2f60a7e SAVRT+0x4370d
e19fc430 00000000 00000000 00000000 00000000 SAVRT+0x17361

 

Third Crash:


Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 8ea58, 0, 0}

Probably caused by : memory_corruption ( nt!MiDecrementShareCount+4f )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0008ea58, page frame number
Arg3: 00000000, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x4E

LAST_CONTROL_TRANSFER: from 8052a17a to 80537832

STACK_TEXT:
f327d7a8 8052a17a 0000004e 00000099 0008ea58 nt!KeBugCheckEx+0x1b
f327d7d4 805058e0 c0503870 00000075 85c0b2d8 nt!MiDecrementShareCount+0x4f
f327d7f4 8058d216 77c58001 85c0b0e0 003ffffc nt!MiDeleteValidAddress+0x145
f327d814 80505ac4 85c0b0e0 85c0b218 85c0b0e0 nt!MiDeleteAddressesInWorkingSet+0x65
f327d848 8058cbbe 00c0b0e0 85f81328 c000001d nt!MmCleanProcessAddressSpace+0x193
f327d8d0 8058d31f c000001d f327d92c 804e7c8d nt!PspExitThread+0x621
f327d8dc 804e7c8d 85f81328 f327d928 f327d91c nt!PsExitSpecialApc+0x22
f327d92c 804ddf7a 00000001 00000000 f327d944 nt!KiDeliverApc+0x1af
f327d92c 7c90ead0 00000001 00000000 f327d944 nt!KiServiceExit+0x59
WARNING: Frame IP not in any known module. Following frames may be wrong.
0843fec0 00000000 00000000 00000000 00000000 0x7c90ead0
f327dc00 80570593 f327dc78 f327dc7c 000025ff nt!KiCallUserMode+0x4
f327dc5c bf861e3b 0000004d 00000000 00000000 nt!KeUserModeCallback+0x87
f327dc80 bf802d70 00000000 e4815008 00000000 win32k!ClientDeliverUserApc+0x20
f327dca8 bf801aa8 000025ff 00000000 00000001 win32k!xxxSleepThread+0x1e4
f327dcec bf80f106 f327dd18 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x418
f327dd4c 804ddf0f 0843ff10 00000000 00000000 win32k!NtUserGetMessage+0x27
f327dd4c 7c90eb94 0843ff10 00000000 00000000 nt!KiFastCallEntry+0xfc
0843fec0 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
nt!MiDecrementShareCount+4f
8052a17a f6400401 test byte ptr [eax+0x4],0x1

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!MiDecrementShareCount+4f

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 41107faa

STACK_COMMAND: kb

IMAGE_NAME: memory_corruption

BUCKET_ID: 0x4E_nt!MiDecrementShareCount+4f

Followup: MachineOwner
---------

eax=ffdff13c ebx=0008ea58 ecx=00000000 edx=00000000 esi=81db2840 edi=0008ea58
eip=80537832 esp=f327d790 ebp=f327d7a8 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
80537832 5d pop ebp
ChildEBP RetAddr Args to Child
f327d7a8 8052a17a 0000004e 00000099 0008ea58 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f327d7d4 805058e0 c0503870 00000075 85c0b2d8 nt!MiDecrementShareCount+0x4f (FPO: [Non-Fpo])
f327d7f4 8058d216 77c58001 85c0b0e0 003ffffc nt!MiDeleteValidAddress+0x145 (FPO: [Non-Fpo])
f327d814 80505ac4 85c0b0e0 85c0b218 85c0b0e0 nt!MiDeleteAddressesInWorkingSet+0x65 (FPO: [Non-Fpo])
f327d848 8058cbbe 00c0b0e0 85f81328 c000001d nt!MmCleanProcessAddressSpace+0x193 (FPO: [Non-Fpo])
f327d8d0 8058d31f c000001d f327d92c 804e7c8d nt!PspExitThread+0x621 (FPO: [Non-Fpo])
f327d8dc 804e7c8d 85f81328 f327d928 f327d91c nt!PsExitSpecialApc+0x22 (FPO: [Non-Fpo])
f327d92c 804ddf7a 00000001 00000000 f327d944 nt!KiDeliverApc+0x1af (FPO: [Non-Fpo])
f327d92c 7c90ead0 00000001 00000000 f327d944 nt!KiServiceExit+0x59 (FPO: [0,0] TrapFrame @ f327d944)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0843fec0 00000000 00000000 00000000 00000000 0x7c90ead0
f327dc00 80570593 f327dc78 f327dc7c 000025ff nt!KiCallUserMode+0x4 (FPO: [2,3,4])
f327dc5c bf861e3b 0000004d 00000000 00000000 nt!KeUserModeCallback+0x87 (FPO: [Non-Fpo])
f327dc80 bf802d70 00000000 e4815008 00000000 win32k!ClientDeliverUserApc+0x20 (FPO: [Non-Fpo])
f327dca8 bf801aa8 000025ff 00000000 00000001 win32k!xxxSleepThread+0x1e4 (FPO: [Non-Fpo])
f327dcec bf80f106 f327dd18 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x418 (FPO: [Non-Fpo])
f327dd4c 804ddf0f 0843ff10 00000000 00000000 win32k!NtUserGetMessage+0x27 (FPO: [Non-Fpo])
f327dd4c 7c90eb94 0843ff10 00000000 00000000 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ f327dd64)
0843fec0 00000000 00000000 00000000 00000000 0x7c90eb94