W2K3 server rebooting, Memory Dump included

I was just put in charge of a Windows 2003 box that randomly reboots throughout the day. any help would be greatly appreciated.

randy


Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\randon.reed1\Desktop\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808af988
Debug session time: Tue Jan 3 15:05:10.639 2006 (GMT-7)
System Uptime: 2 days 11:20:27.367
WARNING: Process directory table base 7FC51000 doesn't match CR3 00039000
WARNING: Process directory table base 7FC51000 doesn't match CR3 00039000
Loading Kernel Symbols
.....................................................................................................................
Loading unloaded module list
.................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, f7737fe0, 0, 0}

*** ERROR: Module load completed but symbols could not be loaded for b57xp32.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMTDI.SYS -
*** ERROR: Module load completed but symbols could not be loaded for msiscsi.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for iscsiprt.sys -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -
*** ERROR: Module load completed but symbols could not be loaded for ofant.sys
Probably caused by : b57xp32.sys ( b57xp32+10305 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: f7737fe0
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_8

TSS: 00000028 -- (.tss 28)
eax=898d2dd8 ebx=89b69220 ecx=00000239 edx=00000066 esi=898d2dd8 edi=89b688a8
eip=ba602305 esp=b3631f2c ebp=b363233c iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
b57xp32+0x10305:
ba602305 53 push ebx
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from ba60a19c to ba602305

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b363233c ba60a19c 89b67000 898d2dd8 89b67000 b57xp32+0x10305
b3632660 ba60a218 89b67000 00000000 00000000 b57xp32+0x1819c
b3632690 ba5f5b92 89b67000 898d2dd8 8787c6b0 b57xp32+0x18218
b36326b8 f723d804 89bbb008 00000000 00000001 b57xp32+0x3b92
b36326d0 80a7a24f 89cdc030 00000000 87121b80 NDIS!ndisMProcessSGList+0x90
b36326fc f723d6fe 87121b80 89cdc030 88920950 hal!HalBuildScatterGatherList+0x1c7
b3632754 f722149d 89afb008 8787c6b0 87a23de0 NDIS!ndisMAllocSGList+0xd9
b3632770 b6356f47 89a47738 8787c6b0 89420620 NDIS!ndisMSendX+0x1a0
b3632798 b635624a 89afb008 8787c6b0 88cf9a20 tcpip!ARPSendData+0x198
b36327c0 b6356632 88cf9a02 b3632802 00000001 tcpip!ARPTransmit+0x95
b36328fc b6357c11 b638fbb8 87a23e48 87a23de0 tcpip!_IPTransmit+0x84f
b363296c b6357db0 fa52f7b8 00000002 899cef04 tcpip!TCPSend+0x5fa
b3632994 b6358488 00000001 00000000 00000002 tcpip!TdiSend+0x1cc
b36329c8 b6352fda 899cee70 889123ac 899cef28 tcpip!TCPSendData+0x83
b36329e4 8083f9d0 89ad5e18 899cee70 899cef4c tcpip!TCPDispatchInternalDeviceControl+0x19a
b36329f8 b633172e 889127a8 89b4d718 899cef04 nt!IofCallDriver+0x45
b3632a14 b6330fe4 87b05260 00000000 00000000 SYMTDI!rHeapFree+0x1155
b3632a3c b6332ce7 89b569e0 899cee70 89b569e0 SYMTDI!rHeapFree+0xa0b
b3632a50 8083f9d0 89b569e0 899cee70 88928008 SYMTDI!rHeapFree+0x270e
b3632a64 ba564945 89bda320 88928008 889127a8 nt!IofCallDriver+0x45
b3632a8c ba56ad47 019127a8 89bda320 01632aac msiscsi+0x4945
b3632ac8 ba56baec 009127a8 89bda320 89b4ba5c msiscsi+0xad47
b3632ae8 ba561f69 89b4b5ac 89a47e74 00000000 msiscsi+0xbaec
b3632b0c ba54e259 02b4b5ac 89a47e74 ba54f48b msiscsi+0x1f69
b3632b34 ba554fe6 886b3e20 869b8a90 886b3e18 iscsiprt+0x1259
b3632b54 ba551497 00000000 00000001 00000000 iscsiprt!iScsiPortFreeDeviceBase+0x22ae
b3632b74 ba55462c 886b3e18 01920e28 00000000 iscsiprt!iScsiPortInitialize+0x2cf
b3632bcc f7338a20 89a47dc8 35e3e000 b3632c10 iscsiprt!iScsiPortFreeDeviceBase+0x18f4
b3632bdc f7338635 89a47dc8 89de30e8 86dfdd30 CLASSPNP!SubmitTransferPacket+0xbb
b3632c10 f7338712 00000000 00001000 86dfdc30 CLASSPNP!ServiceTransferRequest+0x1e4
b3632c34 8083f9d0 89de3030 00000000 89f52250 CLASSPNP!ClassReadWrite+0x159
b3632c48 f74c80cf 88a079d0 86dfdd54 b3632c6c nt!IofCallDriver+0x45
b3632c58 8083f9d0 88a0a410 86dfdc30 86dfdd78 PartMgr!PmReadWrite+0x95
b3632c6c f73f7053 86dfdc30 89f53d60 86dfdc30 nt!IofCallDriver+0x45
b3632c88 8083f9d0 88a07918 86dfdc30 86dfdd9c ftdisk!FtDiskReadWrite+0x1a9
b3632c9c f73a0720 89f52348 89b32c90 88a00020 nt!IofCallDriver+0x45
b3632cb4 8083f9d0 88a00020 86dfdc30 86dfdc30 volsnap!VolSnapRead+0x52
b3632cc8 f725c0ce b3632fac b3632eac f725b702 nt!IofCallDriver+0x45
b3632cd4 f725b702 b3632fac 88a00020 d663e000 Ntfs!NtfsSingleAsync+0x91
b3632eac f725975e b3632fac 86dfdc30 89b32c90 Ntfs!NtfsNonCachedIo+0x2db
b3632f98 f725c8de b3632fac 86dfdc30 00000001 Ntfs!NtfsCommonRead+0xaf5
b3633144 8083f9d0 88840520 86dfdc30 89f36a28 Ntfs!NtfsFsdRead+0x113
b3633158 f7316c53 89f36a28 885e10e0 00000002 nt!IofCallDriver+0x45
b3633180 8083f9d0 888439e0 86dfdc30 86dfdc30 fltmgr!FltpDispatch+0x6f
b3633194 b7ab80bb 86dfdde4 89aa4030 8083f9d0 nt!IofCallDriver+0x45
b36331b4 b4a4fc60 886a2eb0 86dfdc30 b3633214 SYMEVENT!SYMEvent_GetVMDataPtr+0x86fb
b36331c8 b4a4f7e8 886a2eb0 86dfdc30 00000000 ofant+0xdc60
00000000 00000000 00000000 00000000 00000000 ofant+0xd7e8


FOLLOWUP_IP:
b57xp32+10305
ba602305 53 push ebx

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: b57xp32+10305

MODULE_NAME: b57xp32

IMAGE_NAME: b57xp32.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 40d4cc94

STACK_COMMAND: .tss 28 ; kb

FAILURE_BUCKET_ID: 0x7f_8_b57xp32+10305

BUCKET_ID: 0x7f_8_b57xp32+10305

Followup: MachineOwner
---------

 

BugCheck 7F, {8, f7737fe0, 0, 0}
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
b57xp32+0x10305:
ba602305 53 push ebx

When you see a 7f double fault on a push, its usually stack overflow. You can see from the stack theres a million filter drivers on the machine, which is what gets you into this mess. It has to be debugged to be sure, but i've seen enough of these to have 80% confidence thats the problem here. If you need confirmation, call microsoft support with your dump for analysis.


I think you are a good candidate to try KStackMinFree via http://service1.symantec.com/SUPPORT/ent-security.nsf/pfdocs/2002071208532048

see also http://support.microsoft.com/default.aspx?scid=kb;en-us;835281
and http://support.microsoft.com/default.aspx?scid=kb;en-us;822789

 

Hi,

Refer the following case, it seems that it is the exact match
http://www.windowsbbs.com/showthread.php?t=37135

 

Thanks for the assistance. I updated the driver for the Broadcom NetXtreme NIC and it has been running 2 days now. I've also started watching the SAV 10 install that we have to see if it is doing anything out of the ordinary.

Once again, Thanks for the Help.