Two Servers Crashing Part II

Here is the debug from the other server that has been crashing:

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {7, 7739, 1, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** ERROR: Symbol file could not be found. Defaulted to export symbols for tcpip.sys -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for NDIS.sys -
*** ERROR: Module load completed but symbols could not be loaded for e1000nt5.sys
Probably caused by : e1000nt5.sys ( e1000nt5+973 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000007, A driver has unlocked a page more times than it locked it
Arg2: 00007739, page frame number
Arg3: 00000001, current share count
Arg4: 00000000, 0

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x4E

LAST_CONTROL_TRANSFER: from 8043815e to 8044db81

STACK_TEXT:
eb42bda0 8043815e 87739928 87739820 00000104 nt!MmTrimAllSystemPagableMemory+0x722f
eb42bdb8 8041e2e0 87739902 874693c8 87739820 nt!MmUnlockPages+0x110
eb42bddc b7a5ecc3 00000002 87747b08 00000000 nt!IofCompleteRequest+0x1fa
eb42bdf4 b7a60553 87739802 00000000 00000013 tcpip!IPTransmit+0x3f0
eb42be10 b7a5c875 00000000 88f5e910 b7a5c87c tcpip!IPTransmit+0x1c80
eb42be1c b7a5c87c bfe9a216 88acd208 eb42be9c tcpip+0x875
eb42be20 bfe9a216 88acd208 eb42be9c 89012008 tcpip+0x87c
WARNING: Stack unwind information not available. Following frames may be wrong.
eb42be74 bfc07973 88f5e900 eb42be94 00000002 NDIS!FddiShouldAddressLoopBack+0x4f3
eb42bfa4 bfc07507 89012000 eb42bfd0 89012458 e1000nt5+0x973
eb42bfc8 bfe83bb8 89012000 0000d471 8908e848 e1000nt5+0x507
8908e800 8908e800 00000000 eb42bff4 00a0857c NDIS!NdisMSetTimer+0x46e


FOLLOWUP_IP:
e1000nt5+973
bfc07973 8b45f4 mov eax,[ebp-0xc]

SYMBOL_STACK_INDEX: 8

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: e1000nt5+973

MODULE_NAME: e1000nt5

IMAGE_NAME: e1000nt5.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3e6de2bc

STACK_COMMAND: kb

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

 

high probability that e1000nt5.sys passed bad data to TCPIP. Is this driver up to date, or was it changed about the same time the phenomenon started? Do you have NIC teaming?

 

1) No NIC teaming
2) No the diver wasn't updated at that time
3) I updated the NIC driver this morning and set the speed to 1000GB full instead of Auto. There is also a CAT 5 cable instead of CAT 5e so I will swap that out.

Thanks,

mike