Double Fault bug check

I have a Windows 2000 box that has blue screened three times in the past two days. It also did the same three BSODs in two days back in October. It is a quad processor box with 4 GB RAM, some local hard drive space and a bit of SAN storage over Emulex adapter. No drivers were updated when it started happening in October or recently. Only changes to OS were critical updates applied November 24th. It is an SAP application server with Oracle running.

We had a problem like this on a file server and found that it was related to eTrust Antivirus. I disabled Antivirus on this system to see if it would repeat and it did. I have two memory dumps and they both pretty much show the same thing. After running the dump check, nothing jumped out at me to say what might be causing the problem, but for some reason I want to say driver, but the fact that the dump check output is very similar, I am looking at bad memory as a culprit too.

Please take a look at the dump check output below and throw some ideas my way. Thanks in advance, I really appreciate it.
----------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\sapccpprd\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (8 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b00
Debug session time: Wed Dec 7 14:25:37.781 2005 (GMT-7)
System Uptime: 0 days 12:04:00.503
Loading Kernel Symbols
.........................................................................................................
Loading unloaded module list
.......
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiIdleLoop+e )

Followup: MachineOwner
---------

5: kd> !analyze -v;r;kv;lmtn;!thread
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_8

TSS: 00000028 -- (.tss 28)
eax=89053ca8 ebx=89049000 ecx=89049878 edx=002a1d7a esi=89053ca8 edi=80471c70
eip=804675f6 esp=f5cdbd5c ebp=89049800 iopl=0 nv up di pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010046
nt!KiIdleLoop+0xe:
804675f6 ff11 call dword ptr [ecx]{nt!PopIdle0 (80455a00)} ds:0023:89049878=80455a00
Resetting default scope

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

LAST_CONTROL_TRANSFER: from 00000000 to 804675f6

STACK_TEXT:
89049800 00000000 00000000 00000000 0017412d nt!KiIdleLoop+0xe


FOLLOWUP_IP:
nt!KiIdleLoop+e
804675f6 ff11 call dword ptr [ecx]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiIdleLoop+e

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 427b58bb

STACK_COMMAND: .tss 28 ; kb

FAILURE_BUCKET_ID: 0x7f_8_nt!KiIdleLoop+e

BUCKET_ID: 0x7f_8_nt!KiIdleLoop+e

Followup: MachineOwner
---------

eax=8904913c ebx=0000007f ecx=89059888 edx=00000000 esi=00000000 edi=00000000
eip=8046a10f esp=89048fe8 ebp=00000000 iopl=0 nv up di ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000086
nt!KiTrap08+0x41:
8046a10f ebef jmp nt!KiTrap08+0x32 (8046a100)
ChildEBP RetAddr Args to Child
00000000 804675f6 00000000 00000000 00000000 nt!KiTrap08+0x41 (FPO: TaskGate 28:0)
89049800 00000000 00000000 00000000 0017412d nt!KiIdleLoop+0xe
start end module name
80062000 80076f80 hal halmacpi.dll Thu Dec 02 20:29:15 2004 (41AFDD8B)
80400000 805a2840 nt ntkrnlmp.exe Fri May 06 05:44:59 2005 (427B58BB)
a0000000 a0190000 win32k win32k.sys unavailable (FFFFFFFE)
a0190000 a01b1000 atidrab atidrab.dll unavailable (FFFFFFFE)
bdd71000 bdd86f20 RDPWD RDPWD.SYS Fri Jun 17 00:41:40 2005 (42B270A4)
be3c7000 be3d6a20 ipsec ipsec.sys Tue Apr 29 17:04:59 2003 (3EAF051B)
be7af000 be7d1ac0 Fastfat Fastfat.SYS Tue Jul 19 04:44:42 2005 (42DCD99A)
bea02000 bea3c440 srv srv.sys Tue May 03 02:10:42 2005 (42773202)
bea6d000 bea718c0 TDTCP TDTCP.SYS Fri Mar 21 14:43:08 2003 (3E7B876C)
bed6d000 bed75a60 termdd termdd.sys Fri Mar 21 14:43:08 2003 (3E7B876C)
bedfd000 bee1c140 afd afd.sys Mon Apr 11 15:31:21 2005 (425AECA9)
bee45000 bee6a700 ino_fltr ino_fltr.sys Sat Apr 10 08:10:10 2004 (40780042)
bef3b000 bef43240 Fips Fips.SYS Tue May 09 09:28:29 2000 (39182E9D)
bef67000 bef69dc0 ndisuio ndisuio.sys Wed Jan 15 12:55:21 2003 (3E25BCA9)
bf7d3000 bf83ca40 mrxsmb mrxsmb.sys Fri Apr 01 18:23:32 2005 (424DF414)
bf84f000 bf87bac0 rdbss rdbss.sys Mon Apr 11 15:31:22 2005 (425AECAA)
bf87c000 bf8a6d00 netbt netbt.sys Fri Apr 01 18:23:24 2005 (424DF40C)
bf8a7000 bf8f51a0 tcpip tcpip.sys Thu May 12 04:24:58 2005 (42832EFA)
bf922000 bf925c80 dump_cpqcissm dump_cpqcissm.sys Mon May 19 10:19:35 2003 (3EC90417)
bf92a000 bf92d6c0 dump_diskdump dump_diskdump.sys Tue Feb 25 12:18:04 2003 (3E5BC16C)
bfa5a000 bfa5a980 sysmgmt sysmgmt.sys Wed Jan 29 12:14:33 2003 (3E382819)
bfa6b000 bfa6b6c0 fiddrv fiddrv.sys Fri Dec 06 23:13:00 2002 (3DF1916C)
bfb34000 bfb5e3a0 update update.sys Tue Apr 15 22:22:01 2003 (3E9CDA69)
bfb5f000 bfb7ab40 ks ks.sys Tue Apr 15 22:02:11 2003 (3E9CD5C3)
bfb8d000 bfbb0060 rdpdr rdpdr.sys Fri Mar 21 14:43:14 2003 (3E7B8772)
bfbd9000 bfbde240 Msfs Msfs.SYS Tue Oct 26 17:21:32 1999 (3816377C)
bfbf9000 bfbffa20 EFS EFS.SYS Wed Jan 15 12:46:55 2003 (3E25BAAF)
bfc01000 bfc17ba0 ndiswan ndiswan.sys Tue Apr 29 17:05:01 2003 (3EAF051D)
bfc18000 bfc36000 n1000nt5 n1000nt5.sys Mon Oct 13 14:26:06 2003 (3F8B0A5E)
bfc5e000 bfc6f6c0 atimpab atimpab.sys Wed Nov 10 16:34:06 1999 (382A00EE)
bfc70000 bfcb1800 cpqasm2 cpqasm2.sys Tue May 27 13:05:58 2003 (3ED3B716)
bfcf2000 bfcf5e60 TDI TDI.SYS Wed Jan 15 12:56:26 2003 (3E25BCEA)
bfcf6000 bfcf8740 awlegacy awlegacy.sys Mon Apr 21 12:08:43 2003 (3EA433AB)
bfd42000 bfd442e0 ndistapi ndistapi.sys Wed Jan 15 12:54:15 2003 (3E25BC67)
bfd46000 bfd49580 vga vga.sys Sat Sep 25 12:37:40 1999 (37ED1674)
bfd56000 bfd59640 serenum serenum.sys Wed Jan 15 12:47:01 2003 (3E25BAB5)
bfd66000 bfd69d80 aw_host5 aw_host5.sys Thu Oct 23 08:32:19 2003 (3F97E673)
bfe02000 bfe15b20 CPQPHP CPQPHP.SYS Mon Jan 06 16:44:27 2003 (3E1A14DB)
bfe16000 bfe2bbe0 Mup Mup.sys Thu Dec 02 20:37:23 2004 (41AFDF73)
bfe2c000 bfe55aa0 NDIS NDIS.sys Tue Apr 29 17:05:01 2003 (3EAF051D)
bfe56000 bfed3480 Ntfs Ntfs.sys Tue May 10 03:20:29 2005 (42807CDD)
bfed4000 bfee57c0 KSecDD KSecDD.sys Sat Sep 20 18:32:19 2003 (3F6CF193)
bfee6000 bfef81c0 Dfs Dfs.sys Tue Feb 11 19:19:06 2003 (3E49AF1A)
bfef9000 bff0b500 drvmcdb drvmcdb.sys Fri Dec 21 23:33:52 2001 (3C242950)
bff0c000 bff2d5a0 fltmgr fltmgr.sys Thu Apr 14 00:59:00 2005 (425E14B4)
bff2e000 bff484c0 lpxnds lpxnds.sys Mon Aug 04 12:04:06 2003 (3F2EA016)
bff49000 bff5b180 SCSIPORT SCSIPORT.SYS Wed Dec 29 22:53:36 2004 (41D397E0)
bff5c000 bff82aa0 LsiCsb6 LsiCsb6.sys Fri May 02 11:51:45 2003 (3EB2B031)
bff83000 bff98180 atapi atapi.sys Tue Apr 01 11:08:25 2003 (3E89D599)
bff99000 bffba9c0 dmio dmio.sys Wed Jan 15 12:47:04 2003 (3E25BAB8)
bffbb000 bffd75a0 ftdisk ftdisk.sys Thu Dec 02 20:29:58 2004 (41AFDDB6)
bffd8000 bffffc20 ACPI ACPI.sys Wed Jan 15 12:44:22 2003 (3E25BA16)
f5800000 f580e6a0 pci pci.sys Wed Jan 15 12:44:07 2003 (3E25BA07)
f5810000 f581b680 isapnp isapnp.sys Wed Jan 15 12:43:47 2003 (3E25B9F3)
f5820000 f582faa0 adpu160m adpu160m.sys Wed Jan 15 12:42:27 2003 (3E25B9A3)
f5830000 f58390e0 symmpi symmpi.sys Tue Dec 10 10:31:28 2002 (3DF624F0)
f5840000 f5848700 CLASSPNP CLASSPNP.SYS Wed Jan 15 12:42:51 2003 (3E25B9BB)
f5850000 f585b120 vsp vsp.sys Fri Sep 05 10:36:50 2003 (3F58BBA2)
f58e0000 f58ef600 Cdfs Cdfs.SYS Fri Apr 01 18:23:36 2005 (424DF418)
f5910000 f591c4c0 VIDEOPRT VIDEOPRT.SYS Wed Jan 15 12:47:20 2003 (3E25BAC8)
f5920000 f592b680 i8042prt i8042prt.sys Tue Apr 15 22:00:59 2003 (3E9CD57B)
f5930000 f593f400 serial serial.sys Tue Apr 15 22:19:39 2003 (3E9CD9DB)
f5940000 f594e4c0 CPQCISSE CPQCISSE.sys Tue May 27 12:59:36 2003 (3ED3B598)
f5950000 f595ca80 rasl2tp rasl2tp.sys Tue Apr 29 17:05:06 2003 (3EAF0522)
f5960000 f596bc40 raspptp raspptp.sys Wed May 14 17:47:00 2003 (3EC2D574)
f5980000 f5989be0 usbhub usbhub.sys Tue Mar 18 16:30:41 2003 (3E77AC21)
f59a0000 f59a9ce0 NDProxy NDProxy.SYS Thu Sep 30 17:25:35 1999 (37F3F16F)
f59b0000 f59b8fa0 Npfs Npfs.SYS Sat Oct 09 17:58:07 1999 (37FFD68F)
f59c0000 f59c8680 msgpc msgpc.sys Wed Jan 15 12:54:25 2003 (3E25BC71)
f59d0000 f59d81a0 netbios netbios.sys Tue Oct 12 13:34:19 1999 (38038D3B)
f5a80000 f5a85520 PCIIDEX PCIIDEX.SYS Tue Feb 25 11:31:08 2003 (3E5BB66C)
f5a88000 f5a8f5a0 MountMgr MountMgr.sys Thu Dec 02 20:33:01 2004 (41AFDE6D)
f5a90000 f5a96320 symc8xx symc8xx.sys Fri Mar 30 10:01:54 2001 (3AC4BC02)
f5a98000 f5a9d180 sym_hi sym_hi.sys Sat Sep 25 13:11:49 1999 (37ED1E75)
f5aa0000 f5aa7720 disk disk.sys Wed Jan 15 12:43:05 2003 (3E25B9C9)
f5aa8000 f5aacd00 ino_flpy ino_flpy.sys Thu Jun 19 11:17:12 2003 (3EF1F018)
f5ab8000 f5ac0000 RCSpyMP RCSpyMP.sys Tue Jun 08 08:31:13 2004 (40C5CDB1)
f5ad8000 f5addec0 kbdclass kbdclass.sys Thu Feb 20 09:37:30 2003 (3E55044A)
f5ae0000 f5ae4a60 flpydisk flpydisk.sys Wed Jan 15 12:42:52 2003 (3E25B9BC)
f5ae8000 f5aed400 mouclass mouclass.sys Thu Feb 20 09:37:45 2003 (3E550459)
f5b08000 f5b0f000 fdc fdc.sys unavailable (FFFFFFFE)
f5b10000 f5b14400 ptilink ptilink.sys Wed Jan 15 12:47:15 2003 (3E25BAC3)
f5b18000 f5b1ec40 cdrom cdrom.sys Wed Jan 15 12:43:04 2003 (3E25B9C8)
f5b28000 f5b2dfc0 openhci openhci.sys Fri Feb 28 17:28:59 2003 (3E5FFECB)
f5b30000 f5b340e0 raspti raspti.sys Fri Oct 08 14:45:10 1999 (37FE57D6)
f5b40000 f5b44fc0 USBD USBD.SYS Wed Jan 22 10:05:33 2003 (3E2ECF5D)
f5b80000 f5b84ae0 CpqCiDrv CpqCiDrv.sys Thu Apr 10 09:15:31 2003 (3E958A93)
f5b88000 f5b8fd00 wanarp wanarp.sys Fri Aug 16 06:25:01 2002 (3D5CEF1D)
f5c10000 f5c12a20 BOOTVID BOOTVID.dll Wed Nov 03 18:24:33 1999 (3820E051)
f5c14000 f5c16d00 PartMgr PartMgr.sys Wed Jan 15 12:43:07 2003 (3E25B9CB)
f5c18000 f5c1bfe0 symc810 symc810.sys Sat Sep 25 13:11:49 1999 (37ED1E75)
f5c1c000 f5c1fc80 cpqcissm cpqcissm.sys Mon May 19 10:19:35 2003 (3EC90417)
f5c20000 f5c23360 cpqarry2 cpqarry2.sys Fri Oct 01 17:47:57 1999 (37F5482D)
f5c24000 f5c26e40 lpxftr lpxftr.sys Wed May 14 17:12:05 2003 (3EC2CD45)
f5c28000 f5c2b320 Gernuwa Gernuwa.sys Mon Apr 21 11:00:31 2003 (3EA423AF)
f5d00000 f5d01d20 Diskperf Diskperf.sys Wed Feb 12 14:34:38 2003 (3E4ABDEE)
f5d02000 f5d03b80 dmload dmload.sys Wed Jan 15 12:47:06 2003 (3E25BABA)
f5d10000 f5d11ca0 Fs_Rec Fs_Rec.SYS Wed Jan 15 12:53:30 2003 (3E25BC3A)
f5d18000 f5d19e40 rasacd rasacd.sys Sat Sep 25 12:41:23 1999 (37ED1753)
f5dc8000 f5dc8f80 WMILIB WMILIB.SYS Sat Sep 25 12:36:47 1999 (37ED163F)
f5dc9000 f5dc9b00 pciide pciide.sys Wed Jan 15 12:43:03 2003 (3E25B9C7)
f5dcc000 f5dcc9e0 Null Null.SYS Sat Sep 25 12:34:58 1999 (37ED15D2)
f5dce000 f5dceee0 Beep Beep.SYS Wed Oct 20 16:18:59 1999 (380E3FD3)
f5dd2000 f5dd2f80 mnmdd mnmdd.SYS Sat Sep 25 12:37:40 1999 (37ED1674)
f5e0f000 f5e0fa40 audstub audstub.sys Sat Sep 25 12:35:33 1999 (37ED15F5)
f5e19000 f5e19d80 swenum swenum.sys Sat Sep 25 12:36:31 1999 (37ED162F)

Unloaded modules:
f5dfe000 f5dff000 ig40wnt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
bfa64000 bfa65000 ig40wnt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
bfa52000 bfa53000 ig40wnt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
bfa66000 bfa67000 ig40wnt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f59e0000 f59e9000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bfbe9000 bfbee000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
bfd4e000 bfd51000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
THREAD 89053ca8 Cid 0.0 Teb: 00000000 Win32Thread: 00000000 RUNNING
IRP List:
unable to get IRP object
Not impersonating
Owning Process 80471c70
Wait Start TickCount 0 Elapsed Ticks: 2780192
Context Switch Count 4235648
UserTime 0:00:00.0000
KernelTime 11:58:45.0906
Start Address 0x00000000
Stack Init f5c5c000 Current f5c5bd50 Base f5c5c000 Limit f5c59000 Call 0
Priority 16 BasePriority 0 PriorityDecrement 0 DecrementCount 0

ChildEBP RetAddr Args to Child
00000000 804675f6 00000000 00000000 00000000 nt!KiTrap08+0x41
89049800 00000000 00000000 00000000 0017412d nt!KiIdleLoop+0xe

 

Bug check 2

Here is the output from the second memory.dmp file:

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (8 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b00
Debug session time: Wed Dec 7 02:18:59.915 2005 (GMT-7)
System Uptime: 0 days 11:01:13.578
Loading Kernel Symbols
........................................................................................................
Loading unloaded module list
.........
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiIdleLoop+e )

Followup: MachineOwner
---------

5: kd> !analyze -v;r;kv;lmtn;!thread
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_8

TSS: 00000028 -- (.tss 28)
eax=89053ca8 ebx=89049000 ecx=89049878 edx=00269022 esi=89053ca8 edi=80471c70
eip=804675f6 esp=f5cdbd5c ebp=89049800 iopl=0 nv up di pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010046
nt!KiIdleLoop+0xe:
804675f6 ff11 call dword ptr [ecx]{nt!PopIdle0 (80455a00)} ds:0023:89049878=80455a00
Resetting default scope

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

LAST_CONTROL_TRANSFER: from 00000000 to 804675f6

STACK_TEXT:
89049800 00000000 00000000 00000000 0006c0dc nt!KiIdleLoop+0xe


FOLLOWUP_IP:
nt!KiIdleLoop+e
804675f6 ff11 call dword ptr [ecx]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiIdleLoop+e

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 427b58bb

STACK_COMMAND: .tss 28 ; kb

FAILURE_BUCKET_ID: 0x7f_8_nt!KiIdleLoop+e

BUCKET_ID: 0x7f_8_nt!KiIdleLoop+e

Followup: MachineOwner
---------

eax=8904913c ebx=0000007f ecx=89059888 edx=00000000 esi=00000000 edi=00000000
eip=8046a10f esp=89048fe8 ebp=00000000 iopl=0 nv up di ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000086
nt!KiTrap08+0x41:
8046a10f ebef jmp nt!KiTrap08+0x32 (8046a100)
ChildEBP RetAddr Args to Child
00000000 804675f6 00000000 00000000 00000000 nt!KiTrap08+0x41 (FPO: TaskGate 28:0)
89049800 00000000 00000000 00000000 0006c0dc nt!KiIdleLoop+0xe
start end module name
80062000 80076f80 hal halmacpi.dll Thu Dec 02 20:29:15 2004 (41AFDD8B)
80400000 805a2840 nt ntkrnlmp.exe Fri May 06 05:44:59 2005 (427B58BB)
a0000000 a0190000 win32k win32k.sys unavailable (FFFFFFFE)
a0190000 a01b1000 atidrab atidrab.dll unavailable (FFFFFFFE)
bdfe7000 bdffcf20 RDPWD RDPWD.SYS Fri Jun 17 00:41:40 2005 (42B270A4)
be0a5000 be0b4a20 ipsec ipsec.sys Tue Apr 29 17:04:59 2003 (3EAF051B)
be50d000 be515a60 termdd termdd.sys Fri Mar 21 14:43:08 2003 (3E7B876C)
be7f5000 be817ac0 Fastfat Fastfat.SYS Tue Jul 19 04:44:42 2005 (42DCD99A)
bea48000 bea82440 srv srv.sys Tue May 03 02:10:42 2005 (42773202)
bed5b000 bed63240 Fips Fips.SYS Tue May 09 09:28:29 2000 (39182E9D)
bed6b000 bed7a600 Cdfs Cdfs.SYS Fri Apr 01 18:23:36 2005 (424DF418)
bedf3000 bee12140 afd afd.sys Mon Apr 11 15:31:21 2005 (425AECA9)
bee3b000 bee60700 ino_fltr ino_fltr.sys Sat Apr 10 08:10:10 2004 (40780042)
beed1000 beed3dc0 ndisuio ndisuio.sys Wed Jan 15 12:55:21 2003 (3E25BCA9)
bf7c9000 bf832a40 mrxsmb mrxsmb.sys Fri Apr 01 18:23:32 2005 (424DF414)
bf845000 bf871ac0 rdbss rdbss.sys Mon Apr 11 15:31:22 2005 (425AECAA)
bf872000 bf89cd00 netbt netbt.sys Fri Apr 01 18:23:24 2005 (424DF40C)
bf89d000 bf8eb1a0 tcpip tcpip.sys Thu May 12 04:24:58 2005 (42832EFA)
bf91c000 bf91fc80 dump_cpqcissm dump_cpqcissm.sys Mon May 19 10:19:35 2003 (3EC90417)
bf924000 bf9276c0 dump_diskdump dump_diskdump.sys Tue Feb 25 12:18:04 2003 (3E5BC16C)
bfb34000 bfb5e3a0 update update.sys Tue Apr 15 22:22:01 2003 (3E9CDA69)
bfb5f000 bfb7ab40 ks ks.sys Tue Apr 15 22:02:11 2003 (3E9CD5C3)
bfb8d000 bfbb0060 rdpdr rdpdr.sys Fri Mar 21 14:43:14 2003 (3E7B8772)
bfbb1000 bfbb58c0 TDTCP TDTCP.SYS Fri Mar 21 14:43:08 2003 (3E7B876C)
bfbd9000 bfbde240 Msfs Msfs.SYS Tue Oct 26 17:21:32 1999 (3816377C)
bfbf9000 bfbffa20 EFS EFS.SYS Wed Jan 15 12:46:55 2003 (3E25BAAF)
bfc01000 bfc17ba0 ndiswan ndiswan.sys Tue Apr 29 17:05:01 2003 (3EAF051D)
bfc18000 bfc36000 n1000nt5 n1000nt5.sys Mon Oct 13 14:26:06 2003 (3F8B0A5E)
bfc5e000 bfc6f6c0 atimpab atimpab.sys Wed Nov 10 16:34:06 1999 (382A00EE)
bfc70000 bfcb1800 cpqasm2 cpqasm2.sys Tue May 27 13:05:58 2003 (3ED3B716)
bfcf2000 bfcf5e60 TDI TDI.SYS Wed Jan 15 12:56:26 2003 (3E25BCEA)
bfcf6000 bfcf8740 awlegacy awlegacy.sys Mon Apr 21 12:08:43 2003 (3EA433AB)
bfd42000 bfd442e0 ndistapi ndistapi.sys Wed Jan 15 12:54:15 2003 (3E25BC67)
bfd46000 bfd49580 vga vga.sys Sat Sep 25 12:37:40 1999 (37ED1674)
bfd56000 bfd59640 serenum serenum.sys Wed Jan 15 12:47:01 2003 (3E25BAB5)
bfd66000 bfd69d80 aw_host5 aw_host5.sys Thu Oct 23 08:32:19 2003 (3F97E673)
bfe02000 bfe15b20 CPQPHP CPQPHP.SYS Mon Jan 06 16:44:27 2003 (3E1A14DB)
bfe16000 bfe2bbe0 Mup Mup.sys Thu Dec 02 20:37:23 2004 (41AFDF73)
bfe2c000 bfe55aa0 NDIS NDIS.sys Tue Apr 29 17:05:01 2003 (3EAF051D)
bfe56000 bfed3480 Ntfs Ntfs.sys Tue May 10 03:20:29 2005 (42807CDD)
bfed4000 bfee57c0 KSecDD KSecDD.sys Sat Sep 20 18:32:19 2003 (3F6CF193)
bfee6000 bfef81c0 Dfs Dfs.sys Tue Feb 11 19:19:06 2003 (3E49AF1A)
bfef9000 bff0b500 drvmcdb drvmcdb.sys Fri Dec 21 23:33:52 2001 (3C242950)
bff0c000 bff2d5a0 fltmgr fltmgr.sys Thu Apr 14 00:59:00 2005 (425E14B4)
bff2e000 bff484c0 lpxnds lpxnds.sys Mon Aug 04 12:04:06 2003 (3F2EA016)
bff49000 bff5b180 SCSIPORT SCSIPORT.SYS Wed Dec 29 22:53:36 2004 (41D397E0)
bff5c000 bff82aa0 LsiCsb6 LsiCsb6.sys Fri May 02 11:51:45 2003 (3EB2B031)
bff83000 bff98180 atapi atapi.sys Tue Apr 01 11:08:25 2003 (3E89D599)
bff99000 bffba9c0 dmio dmio.sys Wed Jan 15 12:47:04 2003 (3E25BAB8)
bffbb000 bffd75a0 ftdisk ftdisk.sys Thu Dec 02 20:29:58 2004 (41AFDDB6)
bffd8000 bffffc20 ACPI ACPI.sys Wed Jan 15 12:44:22 2003 (3E25BA16)
f5800000 f580e6a0 pci pci.sys Wed Jan 15 12:44:07 2003 (3E25BA07)
f5810000 f581b680 isapnp isapnp.sys Wed Jan 15 12:43:47 2003 (3E25B9F3)
f5820000 f582faa0 adpu160m adpu160m.sys Wed Jan 15 12:42:27 2003 (3E25B9A3)
f5830000 f58390e0 symmpi symmpi.sys Tue Dec 10 10:31:28 2002 (3DF624F0)
f5840000 f5848700 CLASSPNP CLASSPNP.SYS Wed Jan 15 12:42:51 2003 (3E25B9BB)
f5850000 f585b120 vsp vsp.sys Fri Sep 05 10:36:50 2003 (3F58BBA2)
f5910000 f591c4c0 VIDEOPRT VIDEOPRT.SYS Wed Jan 15 12:47:20 2003 (3E25BAC8)
f5920000 f592b680 i8042prt i8042prt.sys Tue Apr 15 22:00:59 2003 (3E9CD57B)
f5930000 f593f400 serial serial.sys Tue Apr 15 22:19:39 2003 (3E9CD9DB)
f5940000 f594e4c0 CPQCISSE CPQCISSE.sys Tue May 27 12:59:36 2003 (3ED3B598)
f5950000 f595ca80 rasl2tp rasl2tp.sys Tue Apr 29 17:05:06 2003 (3EAF0522)
f5960000 f596bc40 raspptp raspptp.sys Wed May 14 17:47:00 2003 (3EC2D574)
f5980000 f5989be0 usbhub usbhub.sys Tue Mar 18 16:30:41 2003 (3E77AC21)
f59a0000 f59a9ce0 NDProxy NDProxy.SYS Thu Sep 30 17:25:35 1999 (37F3F16F)
f59b0000 f59b8fa0 Npfs Npfs.SYS Sat Oct 09 17:58:07 1999 (37FFD68F)
f59c0000 f59c8680 msgpc msgpc.sys Wed Jan 15 12:54:25 2003 (3E25BC71)
f59d0000 f59d81a0 netbios netbios.sys Tue Oct 12 13:34:19 1999 (38038D3B)
f5a80000 f5a85520 PCIIDEX PCIIDEX.SYS Tue Feb 25 11:31:08 2003 (3E5BB66C)
f5a88000 f5a8f5a0 MountMgr MountMgr.sys Thu Dec 02 20:33:01 2004 (41AFDE6D)
f5a90000 f5a96320 symc8xx symc8xx.sys Fri Mar 30 10:01:54 2001 (3AC4BC02)
f5a98000 f5a9d180 sym_hi sym_hi.sys Sat Sep 25 13:11:49 1999 (37ED1E75)
f5aa0000 f5aa7720 disk disk.sys Wed Jan 15 12:43:05 2003 (3E25B9C9)
f5aa8000 f5aacd00 ino_flpy ino_flpy.sys Thu Jun 19 11:17:12 2003 (3EF1F018)
f5ab8000 f5ac0000 RCSpyMP RCSpyMP.sys Tue Jun 08 08:31:13 2004 (40C5CDB1)
f5ad8000 f5addec0 kbdclass kbdclass.sys Thu Feb 20 09:37:30 2003 (3E55044A)
f5ae0000 f5ae4a60 flpydisk flpydisk.sys Wed Jan 15 12:42:52 2003 (3E25B9BC)
f5ae8000 f5aed400 mouclass mouclass.sys Thu Feb 20 09:37:45 2003 (3E550459)
f5b08000 f5b0e580 fdc fdc.sys Wed Jan 15 12:42:51 2003 (3E25B9BB)
f5b10000 f5b14400 ptilink ptilink.sys Wed Jan 15 12:47:15 2003 (3E25BAC3)
f5b18000 f5b1ec40 cdrom cdrom.sys Wed Jan 15 12:43:04 2003 (3E25B9C8)
f5b28000 f5b2dfc0 openhci openhci.sys Fri Feb 28 17:28:59 2003 (3E5FFECB)
f5b30000 f5b340e0 raspti raspti.sys Fri Oct 08 14:45:10 1999 (37FE57D6)
f5b40000 f5b44fc0 USBD USBD.SYS Wed Jan 22 10:05:33 2003 (3E2ECF5D)
f5b80000 f5b84ae0 CpqCiDrv CpqCiDrv.sys Thu Apr 10 09:15:31 2003 (3E958A93)
f5b88000 f5b8fd00 wanarp wanarp.sys Fri Aug 16 06:25:01 2002 (3D5CEF1D)
f5c10000 f5c12a20 BOOTVID BOOTVID.dll Wed Nov 03 18:24:33 1999 (3820E051)
f5c14000 f5c16d00 PartMgr PartMgr.sys Wed Jan 15 12:43:07 2003 (3E25B9CB)
f5c18000 f5c1bfe0 symc810 symc810.sys Sat Sep 25 13:11:49 1999 (37ED1E75)
f5c1c000 f5c1fc80 cpqcissm cpqcissm.sys Mon May 19 10:19:35 2003 (3EC90417)
f5c20000 f5c23360 cpqarry2 cpqarry2.sys Fri Oct 01 17:47:57 1999 (37F5482D)
f5c24000 f5c26e40 lpxftr lpxftr.sys Wed May 14 17:12:05 2003 (3EC2CD45)
f5c28000 f5c2b320 Gernuwa Gernuwa.sys Mon Apr 21 11:00:31 2003 (3EA423AF)
f5d00000 f5d01d20 Diskperf Diskperf.sys Wed Feb 12 14:34:38 2003 (3E4ABDEE)
f5d02000 f5d03b80 dmload dmload.sys Wed Jan 15 12:47:06 2003 (3E25BABA)
f5d10000 f5d11ca0 Fs_Rec Fs_Rec.SYS Wed Jan 15 12:53:30 2003 (3E25BC3A)
f5d18000 f5d19e40 rasacd rasacd.sys Sat Sep 25 12:41:23 1999 (37ED1753)
f5dc8000 f5dc8f80 WMILIB WMILIB.SYS Sat Sep 25 12:36:47 1999 (37ED163F)
f5dc9000 f5dc9b00 pciide pciide.sys Wed Jan 15 12:43:03 2003 (3E25B9C7)
f5dcc000 f5dcc9e0 Null Null.SYS Sat Sep 25 12:34:58 1999 (37ED15D2)
f5dce000 f5dceee0 Beep Beep.SYS Wed Oct 20 16:18:59 1999 (380E3FD3)
f5dd2000 f5dd2f80 mnmdd mnmdd.SYS Sat Sep 25 12:37:40 1999 (37ED1674)
f5e00000 f5e00980 sysmgmt sysmgmt.sys Wed Jan 29 12:14:33 2003 (3E382819)
f5e0f000 f5e0fa40 audstub audstub.sys Sat Sep 25 12:35:33 1999 (37ED15F5)
f5e19000 f5e19d80 swenum swenum.sys Sat Sep 25 12:36:31 1999 (37ED162F)

Unloaded modules:
f5e30000 f5e31000 ig40wnt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f5e2c000 f5e2d000 ig40wnt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f5e15000 f5e16000 ig40wnt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f5e16000 f5e17000 ig40wnt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f5e11000 f5e12000 ig40wnt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f5e03000 f5e04000 ig40wnt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f59e0000 f59e9000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bfbe9000 bfbee000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
bfd4e000 bfd51000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
THREAD 89053ca8 Cid 0.0 Teb: 00000000 Win32Thread: 00000000 RUNNING
IRP List:
unable to get IRP object
Not impersonating
Owning Process 80471c70
Wait Start TickCount 0 Elapsed Ticks: 2539109
Context Switch Count 4570789
UserTime 0:00:00.0000
KernelTime 10:58:08.0531
Start Address 0x00000000
Stack Init f5c5c000 Current f5c5bd50 Base f5c5c000 Limit f5c59000 Call 0
Priority 16 BasePriority 0 PriorityDecrement 0 DecrementCount 0

ChildEBP RetAddr Args to Child
00000000 804675f6 00000000 00000000 00000000 nt!KiTrap08+0x41
89049800 00000000 00000000 00000000 0006c0dc nt!KiIdleLoop+0xe

 

The .tss output

Almost forgot to include the output of the .tss 28 command.
First memory dump:
5: kd> .tss 28
eax=89053ca8 ebx=89049000 ecx=89049878 edx=002a1d7a esi=89053ca8 edi=80471c70
eip=804675f6 esp=f5cdbd5c ebp=89049800 iopl=0 nv up di pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010046
nt!KiIdleLoop+0xe:
804675f6 ff11 call dword ptr [ecx]{nt!PopIdle0 (80455a00)} ds:0023:89049878=80455a00






From the second bugcheck file:
5: kd> .tss 28
eax=89053ca8 ebx=89049000 ecx=89049878 edx=00269022 esi=89053ca8 edi=80471c70
eip=804675f6 esp=f5cdbd5c ebp=89049800 iopl=0 nv up di pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010046
nt!KiIdleLoop+0xe:
804675f6 ff11 call dword ptr [ecx]{nt!PopIdle0 (80455a00)} ds:0023:89049878=80455a00

 

I opened a case with Microsoft yesterday, but I still haven't received a call back. Quite surprised because the last time I opened a case with them, I got a call within 2 hours.

 

Sorry for the delay in the follow up, but I am almost too embarassed to post that the fix to the issue was a BIOS update. It turned out to be the known Intel issue with the microcode with certain xeon processors. So upgrading the BIOS seems to have resolved the problem.

 

Hi SJDannen,

Do you have the url document this problem?