*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {0, ff, 1, 81aeeca7}
Probably caused by : hardware ( nt!EnlightenedSwapContext+a7 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81aeeca7, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 81b71868
Unable to read MiSystemVaType memory at 81b51420
00000000
CURRENT_IRQL: 1b
FAULTING_IP:
nt!EnlightenedSwapContext+a7
81aeeca7 0000 add byte ptr [eax],al
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: mfpmp.exe
TRAP_FRAME: 9ad99b44 -- (.trap 0xffffffff9ad99b44)
ErrCode = 00000002
eax=00000000 ebx=803d1000 ecx=00000000 edx=00000003 esi=85041ca0 edi=803d51e0
eip=81aeeca7 esp=9ad99bb8 ebp=84b82d90 iopl=1 ov dn di pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00011c06
nt!EnlightenedSwapContext+0xa7:
81aeeca7 0000 add byte ptr [eax],al ds:0023:00000000=??
Resetting default scope
MISALIGNED_IP:
nt!EnlightenedSwapContext+a7
81aeeca7 0000 add byte ptr [eax],al
LAST_CONTROL_TRANSFER: from 81aeeca7 to 81a94d24
STACK_TEXT:
9ad99b44 81aeeca7 badb0d00 00000003 81aef155 nt!KiTrap0E+0x2ac
9ad99bc0 81af12ff 85041ca0 803d1120 85041d28 nt!EnlightenedSwapContext+0xa7
9ad99c04 81aed1a6 85041ca0 00000001 0194fbf0 nt!KiSwapThread+0x44f
9ad99c6c 81c847e0 8580fa48 0194fb01 00000000 nt!KeRemoveQueueEx+0x741
9ad99cc4 81c86ede 8580fa48 9ad99cfc 9ad99d14 nt!IoRemoveIoCompletion+0x23
9ad99d48 81a91a1a 000000dc 0194fc28 0194fc10 nt!NtRemoveIoCompletion+0x106
9ad99d48 77299a94 000000dc 0194fc28 0194fc10 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0194fbf8 00000000 00000000 00000000 00000000 0x77299a94
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!EnlightenedSwapContext+a7
81aeeca7 0000 add byte ptr [eax],al
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!EnlightenedSwapContext+a7
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: hardware
FAILURE_BUCKET_ID: IP_MISALIGNED
BUCKET_ID: IP_MISALIGNED
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {2, b9ef0, dfedf, 1}
Probably caused by : win32k.sys ( win32k!sfac_LoadCriticalSfntMetrics+1be )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000002, A list entry was corrupt
Arg2: 000b9ef0, entry in list being removed
Arg3: 000dfedf, highest physical page number
Arg4: 00000001, reference count of entry being removed
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_2
CUSTOMER_CRASH_COUNT: 3
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 2
TRAP_FRAME: 8bb14418 -- (.trap 0xffffffff8bb14418)
ErrCode = 00000000
eax=01c71e78 ebx=01c467f0 ecx=00871e78 edx=00871e98 esi=8bb144dc edi=01c46828
eip=9608af38 esp=8bb1448c ebp=8bb1449c iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
win32k!sfac_LoadCriticalSfntMetrics+0x1be:
9608af38 0fb65002 movzx edx,byte ptr [eax+2] ds:0023:01c71e7a=??
Resetting default scope
LAST_CONTROL_TRANSFER: from 81a984d9 to 81ad10e3
STACK_TEXT:
8bb1449c 9608ad00 8bb1461c 8bb14634 00000001 win32k!sfac_LoadCriticalSfntMetrics+0x1be
8bb144bc 9608bd20 8bb149d0 8bb1490c 1d909bd7 win32k!fs_NewSfnt+0x5f
8bb14a70 9608ba74 ffa0e1e0 00000001 1d909b13 win32k!bReloadGlyphSet+0x196
8bb14ab4 9608bb5b 00000000 ffa0e1e0 00000001 win32k!ttfdQueryFontTree+0x4e
8bb14ad8 9608ba0b 00000000 ffa21b40 00000001 win32k!ttfdSemQueryFontTree+0x33
8bb14b00 9609383c 00000000 ffa21b40 00000001 win32k!PDEVOBJ::QueryFontTree+0x34
8bb14b3c 96059f14 ffa64580 00000000 ffa77008 win32k!PFEOBJ::pfdg+0x6a
8bb14b5c 9605a4d3 00000000 ffa13628 00000000 win32k!bComputeQuickLookup+0x46
8bb14bb4 9605a30b 957399a8 ffa04808 00000000 win32k!vUnlinkAllEudcFromRFONTList+0x55e
8bb14bd8 81bd62b1 957399a8 00000001 9573992c win32k!BuildAndLoadLinkedFontRoutine+0x77
8bb14c10 81bd6506 00000007 00000000 81af1e8d nt!RtlpCallQueryRegistryRoutine+0x201
8bb14c78 9605927b 00000000 96212108 9622d138 nt!RtlQueryRegistryValues+0x1b3
8bb14c94 96058ac5 96212108 81bd6353 00000000 win32k!BuildAndLoadLinkedFontRoutine+0xe2
8bb14ccc 9605920a 00000000 00000001 00000054 win32k!BuildAndLoadLinkedFontRoutine+0x26b
8bb14cfc 96058860 00000000 9623ac60 00000000 win32k!bInitializeEUDC+0x156
8bb14d48 960586d6 0017f610 8bb14d64 81a5ba1a win32k!InitializeGreCSRSS+0x162
8bb14d54 81a5ba1a 00000054 00000058 0017f62c win32k!NtUserInitialize+0x81
8bb14d54 77a89a94 00000054 00000058 0017f62c nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0017f62c 00000000 00000000 00000000 00000000 0x77a89a94
STACK_COMMAND: .trap 0xffffffff8bb14418 ; kb
FOLLOWUP_IP:
win32k!sfac_LoadCriticalSfntMetrics+1be
9608af38 0fb65002 movzx edx,byte ptr [eax+2]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: win32k!sfac_LoadCriticalSfntMetrics+1be
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 498f9e9d
FAILURE_BUCKET_ID: 0x4E_2_win32k!sfac_LoadCriticalSfntMetrics+1be
BUCKET_ID: 0x4E_2_win32k!sfac_LoadCriticalSfntMetrics+1be
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {61940, 72872000, 0, 0}
Probably caused by : memory_corruption ( nt!MiSwapWslEntries+57 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00061940, A PDE has been unexpectedly invalidated.
Arg2: 72872000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_61940
CUSTOMER_CRASH_COUNT: 4
DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT
PROCESS_NAME: SearchIndexer.e
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 81a825ad to 81adf0e3
STACK_TEXT:
9b664aec 81a825ad 0000001a 00061940 72872000 nt!KeBugCheckEx+0x1e
9b664b1c 81a7fa62 000000a4 000008d2 86c51f60 nt!MiSwapWslEntries+0x57
9b664b54 81a7e995 9b664b7c 7753d000 86c51f60 nt!MiUpdateWsle+0x147
9b664b8c 81a99729 c03ba9e8 83e1ec10 00000000 nt!MiAllocateWsle+0x14b
9b664bc4 81a991c7 00000000 86c51f60 7753dedc nt!MiCompleteProtoPteFault+0x211
9b664c08 81a9693f 00000000 7753dedc c03ba9e8 nt!MiResolveProtoPteFault+0x1c8
9b664cd0 81ab8f9f 7753dedc 8b9ac3a0 00000000 nt!MiDispatchFault+0x9a6
9b664d4c 81a6cb54 00000008 7753dedc 00000001 nt!MmAccessFault+0x1fb7
9b664d4c 7753dedc 00000008 7753dedc 00000001 nt!KiTrap0E+0xdc
WARNING: Frame IP not in any known module. Following frames may be wrong.
05d3eb38 00000000 00000000 00000000 00000000 0x7753dedc
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiSwapWslEntries+57
81a825ad cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiSwapWslEntries+57
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 49ac8fb4
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x1a_61940_nt!MiSwapWslEntries+57
BUCKET_ID: 0x1a_61940_nt!MiSwapWslEntries+57
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {1b, 2, 1, 81a22fe9}
Unable to load image \SystemRoot\system32\DRIVERS\Rtlh86.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Rtlh86.sys
*** ERROR: Module load completed but symbols could not be loaded for Rtlh86.sys
Probably caused by : NETIO.SYS ( NETIO!NetioDereferenceNetBufferListChain+cf )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000001b, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81a22fe9, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 81b89868
Unable to read MiSystemVaType memory at 81b69420
0000001b
CURRENT_IRQL: 2
FAULTING_IP:
hal!KeAcquireInStackQueuedSpinLockRaiseToSynch+19
81a22fe9 8711 xchg edx,dword ptr [ecx]
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: 803ecab8 -- (.trap 0xffffffff803ecab8)
ErrCode = 00000002
eax=803ecb38 ebx=803ecb50 ecx=0000001b edx=803ecb38 esi=ffffffff edi=849f3880
eip=81a22fe9 esp=803ecb2c ebp=803ecb48 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
hal!KeAcquireInStackQueuedSpinLockRaiseToSynch+0x19:
81a22fe9 8711 xchg edx,dword ptr [ecx] ds:0023:0000001b=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 81a22fe9 to 81aacd24
STACK_TEXT:
803ecab8 81a22fe9 badb0d00 803ecb38 803ecad8 nt!KiTrap0E+0x2ac
803ecb28 8fe3c0c2 84943e88 84943f70 00000000 hal!KeAcquireInStackQueuedSpinLockRaiseToSynch+0x19
803ecb50 8ae61ce7 849f3880 00000000 00000038 afd!AfdTLFastDgramSendComplete+0xb3
803ecb74 8ae61d33 84943f70 84943e88 00000001 tcpip!UdpEndSendMessages+0xfa
803ecb8c 8adaac7f 84943e88 00000001 00000001 tcpip!UdpSendMessagesDatagramsComplete+0x22
803ecbbc 8ae660ab 00000000 00000001 865f0c50 NETIO!NetioDereferenceNetBufferListChain+0xcf
803ecbd0 8ad4141e 865da9f8 84943e88 00000001 tcpip!FlSendNetBufferListChainComplete+0x1c
803ecc04 8ac764f1 85e610e8 84943e88 00000001 ndis!ndisMSendCompleteNetBufferListsInternal+0xb8
803ecc18 8fe9c0ee 865e6808 84943e88 00000001 ndis!NdisFSendNetBufferListsComplete+0x1a
803ecc3c 8ad414dd 86558008 84943e88 00000001 pacer!PcFilterSendNetBufferListsComplete+0xba
803ecc5c 8afbcabf 85e610e8 84943e88 00000001 ndis!NdisMSendNetBufferListsComplete+0x70
WARNING: Stack unwind information not available. Following frames may be wrong.
803ecc88 8afb7573 00000002 00000001 862aa198 Rtlh86+0x6abf
803ecca0 8ad3311c 8608a9e0 00000000 00000000 Rtlh86+0x1573
803eccc4 8ac74468 862aa1ac 00000000 00000000 ndis!ndisMiniportDpc+0x81
803ecce8 81b08450 862aa1ac 85e610e8 00000000 ndis!ndisInterruptDpc+0xc4
803ecd50 81b06edd 00000000 0000000e 00000000 nt!KiRetireDpcList+0x147
803ecd54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49
STACK_COMMAND: kb
FOLLOWUP_IP:
NETIO!NetioDereferenceNetBufferListChain+cf
8adaac7f 5b pop ebx
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: NETIO!NetioDereferenceNetBufferListChain+cf
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: NETIO
IMAGE_NAME: NETIO.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 47919103
FAILURE_BUCKET_ID: 0xA_NETIO!NetioDereferenceNetBufferListChain+cf
BUCKET_ID: 0xA_NETIO!NetioDereferenceNetBufferListChain+cf
Followup: MachineOwner
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007F, {8, 80154000, 0, 0}
Probably caused by : ntkrpamp.exe ( nt!KiTrap0E+dc )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 80154000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: spoolsv.exe
CURRENT_IRQL: 0
TRAP_FRAME: 9cd7b2cc -- (.trap 0xffffffff9cd7b2cc)
ErrCode = 00000009
eax=81ddd226 ebx=c0603018 ecx=9cd7b321 edx=80000000 esi=81b34910 edi=00003018
eip=81ac230a esp=9cd7b340 ebp=9cd7b39c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MmAccessFault+0x31f:
81ac230a 8b87000060c0 mov eax,dword ptr [edi-3FA00000h] ds:0023:c0603018=b0689863
Resetting default scope
LAST_CONTROL_TRANSFER: from 81a77b54 to 81ac1fed
STACK_TEXT:
9cd7affc 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x2
9cd7affc 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7b0e4 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7b0e4 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7b1cc 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7b1cc 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7b2b4 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7b2b4 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7b39c 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7b39c 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7b484 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7b484 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7b56c 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7b56c 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7b654 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7b654 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7b73c 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7b73c 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7b824 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7b824 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7b90c 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7b90c 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7b9f4 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7b9f4 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7badc 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7badc 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7bbc4 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7bbc4 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7bcac 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7bcac 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7bd94 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7bd94 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7be7c 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7be7c 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7bf64 81a77b54 00000000 c0603018 00000000 nt!MmAccessFault+0x31f
9cd7bf64 81ac230a 00000000 c0603018 00000000 nt!KiTrap0E+0xdc
9cd7c04c 00000000 00000000 00000000 00000000 nt!MmAccessFault+0x31f
STACK_COMMAND: kb
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
FOLLOWUP_NAME: MachineOwner
DEBUG_FLR_IMAGE_TIMESTAMP: 49ac8fb4
FOLLOWUP_IP:
nt!KiTrap0E+dc
81a77b54 85c0 test eax,eax
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KiTrap0E+dc
FAILURE_BUCKET_ID: TRAP_FRAME_RECURSION
BUCKET_ID: TRAP_FRAME_RECURSION
Followup: MachineOwner
---------