So what would cause BSOD's like this?

Chris_Aseltine · October 22, 2012, 11:39am

It looks like wininit.exe or csrss.exe is crashing, so the machine blue screens?

It said VISTA_DRIVER_FAULT but I didn’t see it fingering any particular driver.

Crash #1:

Loading Dump File [C:\Users\Chris\Downloads\tmp5\MEMORY-lastweek.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: srv*c:\users\chris\downloads\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff80002e5c000 PsLoadedModuleList = 0xfffff800030a0670
Debug session time: Fri Oct 19 09:57:43.224 2012 (UTC - 5:00)
System Uptime: 2 days 14:11:46.036
Loading Kernel Symbols
…
…
…
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffd8018). Type “.hh dbgerr001” for details
Loading unloaded module list
…
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa800eabdb30, fffffa800eabde10, fffff800031da460}

Probably caused by : wininit.exe

Followup: MachineOwner

4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa800eabdb30, Terminating object
Arg3: fffffa800eabde10, Process image file name
Arg4: fffff800031da460, Explanatory message (ascii)

Debugging Details:

PROCESS_OBJECT: fffffa800eabdb30

IMAGE_NAME: wininit.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: wininit

FAULTING_MODULE: 0000000000000000

PROCESS_NAME: wininit.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

BUGCHECK_STR: 0xF4_IOERR

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

CURRENT_IRQL: 0

STACK_TEXT:
fffff8800904d9c8 fffff80003262822 : 00000000000000f4 0000000000000003 fffffa800eabdb30 fffffa800eabde10 : nt!KeBugCheckEx
fffff8800904d9d0 fffff8000320ee0b : ffffffffffffffff fffffa800ea91060 fffffa800eabdb30 fffffa800eabdb30 : nt!PspCatchCriticalBreak+0x92
fffff8800904da10 fffff8000318df04 : ffffffffffffffff 0000000000000001 fffffa800eabdb30 0000007f00000008 : nt! ?? ::NNGAKEGL::string'+0x176e6 fffff8800904da60 fffff80002eda253 : fffffa800eabdb30 00000000c0000006 fffffa800ea91060 0000000000000026 : nt!NtTerminateProcess+0xf4 fffff8800904dae0 0000000077c215da : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13 0000000000def968 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 00000000`00000000 : 0x77c215da

STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: X64_0xF4_IOERR_IMAGE_wininit.exe

BUCKET_ID: X64_0xF4_IOERR_IMAGE_wininit.exe

Followup: MachineOwner

Crash #2:

Loading Dump File [C:\Users\Chris\Downloads\tmp5\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: srv*c:\users\chris\downloads\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff80002e63000 PsLoadedModuleList = 0xfffff800030a7670
Debug session time: Mon Oct 22 09:57:19.383 2012 (UTC - 5:00)
System Uptime: 2 days 23:59:17.195
Loading Kernel Symbols
…
…
…
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffdb018). Type “.hh dbgerr001” for details
Loading unloaded module list
…
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa800fd2b150, fffffa800fd2b430, fffff800031e1460}

Probably caused by : csrss.exe

Followup: MachineOwner

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa800fd2b150, Terminating object
Arg3: fffffa800fd2b430, Process image file name
Arg4: fffff800031e1460, Explanatory message (ascii)

Debugging Details:

PROCESS_OBJECT: fffffa800fd2b150

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000

PROCESS_NAME: csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

BUGCHECK_STR: 0xF4_IOERR

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

CURRENT_IRQL: 0

STACK_TEXT:
fffff8800a5e3e38 fffff80003269822 : 00000000000000f4 0000000000000003 fffffa800fd2b150 fffffa800fd2b430 : nt!KeBugCheckEx
fffff8800a5e3e40 fffff80003215e0b : ffffffffffffffff fffffa800fc5a060 fffffa800fd2b150 fffffa800fd2b150 : nt!PspCatchCriticalBreak+0x92
fffff8800a5e3e80 fffff80003194f04 : ffffffffffffffff 0000000000000001 fffffa800fd2b150 0000000000000008 : nt! ?? ::NNGAKEGL::string'+0x176e6 fffff8800a5e3ed0 fffff80002ee1253 : fffffa800fd2b150 fffff800c0000006 fffffa800fc5a060 00000000009a0dc0 : nt!NtTerminateProcess+0xf4 fffff8800a5e3f50 fffff80002edd810 : fffff80002f2cb7f fffff8800a5e4a38 fffff8800a5e4790 fffff8800a5e4ae0 : nt!KiSystemServiceCopyEnd+0x13 fffff8800a5e40e8 fffff80002f2cb7f : fffff8800a5e4a38 fffff8800a5e4790 fffff8800a5e4ae0 0000000077425a44 : nt!KiServiceLinkage fffff8800a5e40f0 fffff80002ee1642 : fffff8800a5e4a38 00000000009e0000 fffff8800a5e4ae0 0000000077431670 : nt! ?? ::FNODOBFM::string’+0x488a4
fffff8800a5e4900 fffff80002ee01ba : 0000000000000000 0000000077425a47 fffffa800fd2b101 00000000009e0000 : nt!KiExceptionDispatch+0xc2
fffff8800a5e4ae0 00000000777c8f36 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiPageFault+0x23a
00000000009a14e0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x777c8f36

STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: X64_0xF4_IOERR_IMAGE_csrss.exe

BUCKET_ID: X64_0xF4_IOERR_IMAGE_csrss.exe

Followup: MachineOwner

Scott_Noone_OSR · October 22, 2012, 11:53am

0xc0000006 == STATUS_IN_PAGE_ERROR. Maybe a boot drive failure?

Do you have a driver loaded here or is this a user machine? If it’s just a
user machine and you can get it to boot, check the event log to see if
you’ve been experiencing I/O failures without knowing it (very annoying that
these can just silently build up until something REALLY bad happens).

-scott

wrote in message news:xxxxx@ntdev…

It looks like wininit.exe or csrss.exe is crashing, so the machine blue
screens?

It said VISTA_DRIVER_FAULT but I didn’t see it fingering any particular
driver.

Crash #1:

Loading Dump File [C:\Users\Chris\Downloads\tmp5\MEMORY-lastweek.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is:
srv*c:\users\chris\downloads\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff80002e5c000 PsLoadedModuleList = 0xfffff800030a0670
Debug session time: Fri Oct 19 09:57:43.224 2012 (UTC - 5:00)
System Uptime: 2 days 14:11:46.036
Loading Kernel Symbols
…
…
…
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffd8018). Type “.hh dbgerr001” for
details
Loading unloaded module list
…
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa800eabdb30, fffffa800eabde10, fffff800031da460}

Probably caused by : wininit.exe

Followup: MachineOwner

4: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or
been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa800eabdb30, Terminating object
Arg3: fffffa800eabde10, Process image file name
Arg4: fffff800031da460, Explanatory message (ascii)

Debugging Details:

PROCESS_OBJECT: fffffa800eabdb30

IMAGE_NAME: wininit.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: wininit

FAULTING_MODULE: 0000000000000000

PROCESS_NAME: wininit.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced
memory at 0x%p. The required data was not placed into memory because of an
I/O error status of 0x%x.

BUGCHECK_STR: 0xF4_IOERR

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

CURRENT_IRQL: 0

STACK_TEXT:
fffff8800904d9c8 fffff80003262822 : 00000000000000f4 0000000000000003
fffffa800eabdb30 fffffa800eabde10 : nt!KeBugCheckEx
fffff8800904d9d0 fffff8000320ee0b : ffffffffffffffff fffffa800ea91060
fffffa800eabdb30 fffffa800eabdb30 : nt!PspCatchCriticalBreak+0x92
fffff8800904da10 fffff8000318df04 : ffffffffffffffff 0000000000000001
fffffa800eabdb30 0000007f00000008 : nt! ?? ::NNGAKEGL::string'+0x176e6 fffff8800904da60 fffff80002eda253 : fffffa800eabdb30 00000000c0000006 fffffa800ea91060 0000000000000026 : nt!NtTerminateProcess+0xf4 fffff8800904dae0 0000000077c215da : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13 0000000000def968 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 00000000`00000000 : 0x77c215da

STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: X64_0xF4_IOERR_IMAGE_wininit.exe

BUCKET_ID: X64_0xF4_IOERR_IMAGE_wininit.exe

Followup: MachineOwner

Crash #2:

Loading Dump File [C:\Users\Chris\Downloads\tmp5\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is:
srv*c:\users\chris\downloads\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff80002e63000 PsLoadedModuleList = 0xfffff800030a7670
Debug session time: Mon Oct 22 09:57:19.383 2012 (UTC - 5:00)
System Uptime: 2 days 23:59:17.195
Loading Kernel Symbols
…
…
…
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffdb018). Type “.hh dbgerr001” for
details
Loading unloaded module list
…
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa800fd2b150, fffffa800fd2b430, fffff800031e1460}

Probably caused by : csrss.exe

Followup: MachineOwner

2: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or
been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa800fd2b150, Terminating object
Arg3: fffffa800fd2b430, Process image file name
Arg4: fffff800031e1460, Explanatory message (ascii)

Debugging Details:

PROCESS_OBJECT: fffffa800fd2b150

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000

PROCESS_NAME: csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced
memory at 0x%p. The required data was not placed into memory because of an
I/O error status of 0x%x.

BUGCHECK_STR: 0xF4_IOERR

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

CURRENT_IRQL: 0

STACK_TEXT:
fffff8800a5e3e38 fffff80003269822 : 00000000000000f4 0000000000000003
fffffa800fd2b150 fffffa800fd2b430 : nt!KeBugCheckEx
fffff8800a5e3e40 fffff80003215e0b : ffffffffffffffff fffffa800fc5a060
fffffa800fd2b150 fffffa800fd2b150 : nt!PspCatchCriticalBreak+0x92
fffff8800a5e3e80 fffff80003194f04 : ffffffffffffffff 0000000000000001
fffffa800fd2b150 0000000000000008 : nt! ?? ::NNGAKEGL::string'+0x176e6 fffff8800a5e3ed0 fffff80002ee1253 : fffffa800fd2b150 fffff800c0000006 fffffa800fc5a060 00000000009a0dc0 : nt!NtTerminateProcess+0xf4 fffff8800a5e3f50 fffff80002edd810 : fffff80002f2cb7f fffff8800a5e4a38 fffff8800a5e4790 fffff8800a5e4ae0 : nt!KiSystemServiceCopyEnd+0x13 fffff8800a5e40e8 fffff80002f2cb7f : fffff8800a5e4a38 fffff8800a5e4790 fffff8800a5e4ae0 0000000077425a44 : nt!KiServiceLinkage fffff8800a5e40f0 fffff80002ee1642 : fffff8800a5e4a38 00000000009e0000 fffff8800a5e4ae0 0000000077431670 : nt! ?? ::FNODOBFM::string’+0x488a4
fffff8800a5e4900 fffff80002ee01ba : 0000000000000000 0000000077425a47
fffffa800fd2b101 00000000009e0000 : nt!KiExceptionDispatch+0xc2
fffff8800a5e4ae0 00000000777c8f36 : 0000000000000000 0000000000000000
0000000000000000 0000000000000000 : nt!KiPageFault+0x23a
00000000009a14e0 0000000000000000 : 0000000000000000 0000000000000000
0000000000000000 0000000000000000 : 0x777c8f36

STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: X64_0xF4_IOERR_IMAGE_csrss.exe

BUCKET_ID: X64_0xF4_IOERR_IMAGE_csrss.exe

Followup: MachineOwner

Chris_Aseltine · October 22, 2012, 12:22pm

Scott Noone wrote:

0xc0000006 == STATUS_IN_PAGE_ERROR. Maybe a boot
drive failure?

Meaning the machine would not be able to boot subsequent to this crash? Because it was actually able to. Everything was “going along fine” and the user “wasn’t touching anything” and then it blue screened (both times).

Do you have a driver loaded here or is this a user machine?
If it’s just a user machine and you can get it to boot, check
the event log to see if you’ve been experiencing I/O failures
without knowing it (very annoying that these can just silently
build up until something REALLY bad happens).

This is just a user machine with no special drivers loaded on it. I will check the event log.

Daniel_Terhell · October 22, 2012, 12:25pm

Typical overheating bug.

//Daniel

wrote in message news:xxxxx@ntdev…
> It looks like wininit.exe or csrss.exe is crashing, so the machine blue
> screens?
>
> It said VISTA_DRIVER_FAULT but I didn’t see it fingering any particular
> driver.
>
> Crash #1:
>
>
> Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\Users\Chris\Downloads\tmp5\MEMORY-lastweek.DMP]
> Kernel Summary Dump File: Only kernel address space is available
>
> Symbol search path is:
> srvc:\users\chris\downloads\symbolshttp://msdl.microsoft.com/download/symbols
> Executable search path is:
> Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
> Product: WinNt, suite: TerminalServer SingleUserTS
> Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
> Machine Name:
> Kernel base = 0xfffff80002e5c000 PsLoadedModuleList = 0xfffff800030a0670
> Debug session time: Fri Oct 19 09:57:43.224 2012 (UTC - 5:00)
> System Uptime: 2 days 14:11:46.036
> Loading Kernel Symbols
> …
> …
> …
> Loading User Symbols
> PEB is paged out (Peb.Ldr = 000007fffffd8018). Type ".hh dbgerr001" for > details > Loading unloaded module list > ........ > ******************************************************************************* > * > * > * Bugcheck Analysis > * > * > * >******************************************************************************* > > Use !analyze -v to get detailed debugging information. > > BugCheck F4, {3, fffffa800eabdb30, fffffa800eabde10, fffff800031da460} > > Probably caused by : wininit.exe > > Followup: MachineOwner > --------- > > 4: kd> !analyze -v > ******************************************************************************* > * > * > * Bugcheck Analysis > * > * > * >******************************************************************************* > > CRITICAL_OBJECT_TERMINATION (f4) > A process or thread crucial to system operation has unexpectedly exited or > been > terminated. > Several processes and threads are necessary for the operation of the > system; when they are terminated (for any reason), the system can no > longer function. > Arguments: > Arg1: 0000000000000003, Process > Arg2: fffffa800eabdb30, Terminating object > Arg3: fffffa800eabde10, Process image file name > Arg4: fffff800031da460, Explanatory message (ascii) > > Debugging Details: > ------------------ > > > PROCESS_OBJECT: fffffa800eabdb30 > > IMAGE_NAME: wininit.exe > > DEBUG_FLR_IMAGE_TIMESTAMP: 0 > > MODULE_NAME: wininit > > FAULTING_MODULE: 0000000000000000 > > PROCESS_NAME: wininit.exe > > EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced > memory at 0x%p. The required data was not placed into memory because of an > I/O error status of 0x%x. > > BUGCHECK_STR: 0xF4_IOERR > > DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT > > CURRENT_IRQL: 0 > > STACK_TEXT: > fffff8800904d9c8 fffff80003262822 : 00000000000000f4 0000000000000003 > fffffa800eabdb30 fffffa800eabde10 : nt!KeBugCheckEx > fffff8800904d9d0 fffff8000320ee0b : ffffffffffffffff fffffa800ea91060 > fffffa800eabdb30 fffffa800eabdb30 : nt!PspCatchCriticalBreak+0x92 > fffff8800904da10 fffff8000318df04 : ffffffffffffffff 0000000000000001 > fffffa800eabdb30 0000007f00000008 : nt! ?? ::NNGAKEGL::string’+0x176e6
> fffff8800904da60 fffff80002eda253 : fffffa800eabdb30 00000000c0000006
> fffffa800ea91060 0000000000000026 : nt!NtTerminateProcess+0xf4
> fffff8800904dae0 0000000077c215da : 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13
> 0000000000def968 0000000000000000 : 0000000000000000 0000000000000000
> 0000000000000000 0000000000000000 : 0x77c215da
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_NAME: MachineOwner
>
> FAILURE_BUCKET_ID: X64_0xF4_IOERR_IMAGE_wininit.exe
>
> BUCKET_ID: X64_0xF4_IOERR_IMAGE_wininit.exe
>
> Followup: MachineOwner
> ---------
>
>
>
>
>
>
>
> Crash #2:
>
>
> Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\Users\Chris\Downloads\tmp5\MEMORY.DMP]
> Kernel Summary Dump File: Only kernel address space is available
>
> Symbol search path is:
> srvc:\users\chris\downloads\symbolshttp://msdl.microsoft.com/download/symbols
> Executable search path is:
> Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
> Product: WinNt, suite: TerminalServer SingleUserTS
> Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
> Machine Name:
> Kernel base = 0xfffff80002e63000 PsLoadedModuleList = 0xfffff800030a7670
> Debug session time: Mon Oct 22 09:57:19.383 2012 (UTC - 5:00)
> System Uptime: 2 days 23:59:17.195
> Loading Kernel Symbols
> …
> …
> …
> Loading User Symbols
> PEB is paged out (Peb.Ldr = 000007fffffdb018). Type ".hh dbgerr001" for > details > Loading unloaded module list > ....... > ******************************************************************************* > * > * > * Bugcheck Analysis > * > * > * >******************************************************************************* > > Use !analyze -v to get detailed debugging information. > > BugCheck F4, {3, fffffa800fd2b150, fffffa800fd2b430, fffff800031e1460} > > Probably caused by : csrss.exe > > Followup: MachineOwner > --------- > > 2: kd> !analyze -v > ******************************************************************************* > * > * > * Bugcheck Analysis > * > * > * >******************************************************************************* > > CRITICAL_OBJECT_TERMINATION (f4) > A process or thread crucial to system operation has unexpectedly exited or > been > terminated. > Several processes and threads are necessary for the operation of the > system; when they are terminated (for any reason), the system can no > longer function. > Arguments: > Arg1: 0000000000000003, Process > Arg2: fffffa800fd2b150, Terminating object > Arg3: fffffa800fd2b430, Process image file name > Arg4: fffff800031e1460, Explanatory message (ascii) > > Debugging Details: > ------------------ > > > PROCESS_OBJECT: fffffa800fd2b150 > > IMAGE_NAME: csrss.exe > > DEBUG_FLR_IMAGE_TIMESTAMP: 0 > > MODULE_NAME: csrss > > FAULTING_MODULE: 0000000000000000 > > PROCESS_NAME: csrss.exe > > EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced > memory at 0x%p. The required data was not placed into memory because of an > I/O error status of 0x%x. > > BUGCHECK_STR: 0xF4_IOERR > > DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT > > CURRENT_IRQL: 0 > > STACK_TEXT: > fffff8800a5e3e38 fffff80003269822 : 00000000000000f4 0000000000000003 > fffffa800fd2b150 fffffa800fd2b430 : nt!KeBugCheckEx > fffff8800a5e3e40 fffff80003215e0b : ffffffffffffffff fffffa800fc5a060 > fffffa800fd2b150 fffffa800fd2b150 : nt!PspCatchCriticalBreak+0x92 > fffff8800a5e3e80 fffff80003194f04 : ffffffffffffffff 0000000000000001 > fffffa800fd2b150 0000000000000008 : nt! ?? ::NNGAKEGL::string’+0x176e6
> fffff8800a5e3ed0 fffff80002ee1253 : fffffa800fd2b150 fffff800c0000006
> fffffa800fc5a060 00000000009a0dc0 : nt!NtTerminateProcess+0xf4
> fffff8800a5e3f50 fffff80002edd810 : fffff80002f2cb7f fffff8800a5e4a38
> fffff8800a5e4790 fffff8800a5e4ae0 : nt!KiSystemServiceCopyEnd+0x13
> fffff8800a5e40e8 fffff80002f2cb7f : fffff8800a5e4a38 fffff8800a5e4790
> fffff8800a5e4ae0 0000000077425a44 : nt!KiServiceLinkage
> fffff8800a5e40f0 fffff80002ee1642 : fffff8800a5e4a38 00000000009e0000
> fffff8800a5e4ae0 0000000077431670 : nt! ?? ::FNODOBFM::string'+0x488a4 > fffff8800a5e4900 fffff80002ee01ba : 0000000000000000 0000000077425a47 > fffffa800fd2b101 00000000009e0000 : nt!KiExceptionDispatch+0xc2 > fffff8800a5e4ae0 00000000777c8f36 : 0000000000000000 0000000000000000 > 0000000000000000 0000000000000000 : nt!KiPageFault+0x23a > 00000000009a14e0 0000000000000000 : 0000000000000000 0000000000000000 > 0000000000000000 00000000`00000000 : 0x777c8f36
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_NAME: MachineOwner
>
> FAILURE_BUCKET_ID: X64_0xF4_IOERR_IMAGE_csrss.exe
>
> BUCKET_ID: X64_0xF4_IOERR_IMAGE_csrss.exe
>
> Followup: MachineOwner
> ---------
>
>
>
>
>

Peter_Viscarola_OSR · October 22, 2012, 12:42pm

Or a transient memory problem…

Overheating around the core chipset will usually trigger an emergency power-off. At least that’s what I’ve seen.

Bad boot media, badly seated HBA… All possible.

Peter
OSR

Scott_Noone_OSR · October 22, 2012, 1:22pm

>> 0xc0000006 == STATUS_IN_PAGE_ERROR. Maybe a boot drive failure?

Meaning the machine would not be able to boot subsequent to this crash?
Because it was actually able to. Everything was >“going along fine” and
the user “wasn’t touching anything” and then it blue screened (both times).

It may be able to boot, transient storage failures are quite common in my
experience. How catastrophic they are depends on what exactly you’re reading
in when the I/O fails.

-scott

wrote in message news:xxxxx@ntdev…

Scott Noone wrote:

0xc0000006 == STATUS_IN_PAGE_ERROR. Maybe a boot
drive failure?

Meaning the machine would not be able to boot subsequent to this crash?
Because it was actually able to. Everything was “going along fine” and the
user “wasn’t touching anything” and then it blue screened (both times).

Do you have a driver loaded here or is this a user machine?
If it’s just a user machine and you can get it to boot, check
the event log to see if you’ve been experiencing I/O failures
without knowing it (very annoying that these can just silently
build up until something REALLY bad happens).

This is just a user machine with no special drivers loaded on it. I will
check the event log.

Maxim_S_Shatskih · October 23, 2012, 2:43pm

> Overheating around the core chipset will usually trigger an emergency power-off.

…on a good hardware, not on a common Asus/Gigabyte/MSI motherboards.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

Alex_Grig · October 23, 2012, 4:07pm

>…on a good hardware, not on a common Asus/Gigabyte/MSI motherboards.

Now, if anybody could solve sporadic hard reboots of my Intel motherboard, when the (shared) video memory suddenly gets corrupted all over, and the box falls into cold reboot sequence…

Daniel_Terhell · October 23, 2012, 4:59pm

In most cases one of the thermal zone of the CPU will reach its CRT trip
point before other devices in the system do. Also ACPI does not specify a
target window for a safe shutdown and it’s completely up to them OEM to
decide when this should happen.

In any case, I have a list of bughcecks that I have collected from
overheated systems, the termination of wininit.exe is the most common of
them. The question is why do these processes get
terminated, and for what reason, with the CPU severely throttled down and
running at a fraction of the advertised clock speed, I suppose because of a
timeout.

//Daniel

“Maxim S. Shatskih” wrote in message
news:xxxxx@ntdev…
> Overheating around the core chipset will usually trigger an emergency
> power-off.

…on a good hardware, not on a common Asus/Gigabyte/MSI motherboards.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

Peter_Viscarola_OSR · October 24, 2012, 10:32am

Well, the processes in question (Wininit or csrss) are two of very few running during start. And remember, if one of these accvios due to thermal runaway, that will result in the crash you’re seeing. I don’t think you need an “orderly” termination of the process to trigger the bug check.

Peter
OSR

Chris_Aseltine · October 24, 2012, 11:42am

Daniel Terhell wrote:

In any case, I have a list of bughcecks that I have collected
from overheated systems, the termination of wininit.exe is
the most common of them. The question is why do these
processes get terminated, and for what reason, with the CPU
severely throttled down and running at a fraction of the advertised
clock speed, I suppose because of a timeout.

I ran the Prime95 torture test on the machine in question (the CPU is an i7-3770k [not overclocked]); each core went up to about 65 degrees C but it gave no indication that the CPU itself was going to overheat.

Would taking the box apart and checking for proper airflow, or somehow looking at chipset, RAM, video card temps make sense?

I also ran memtest86+ overnight and it didn’t find anything either.

Pavel_A1 · October 24, 2012, 1:22pm

Are there some less voodoo-ish means to diagnose such things?
WER, maybe?
–pa

On 24-Oct-2012 17:48, xxxxx@gmail.com wrote:

Daniel Terhell wrote:

> In any case, I have a list of bughcecks that I have collected
> from overheated systems, the termination of wininit.exe is
> the most common of them. The question is why do these
> processes get terminated, and for what reason, with the CPU
> severely throttled down and running at a fraction of the advertised
> clock speed, I suppose because of a timeout.

I ran the Prime95 torture test on the machine in question (the CPU is an i7-3770k [not overclocked]); each core went up to about 65 degrees C but it gave no indication that the CPU itself was going to overheat.

Would taking the box apart and checking for proper airflow, or somehow looking at chipset, RAM, video card temps make sense?

I also ran memtest86+ overnight and it didn’t find anything either.

Chris_Aseltine · October 25, 2012, 10:30am

Pavel A wrote:

Are there some less voodoo-ish means to diagnose such things?
WER, maybe?

Prime95? Voodoo?

Anyway, I pulled the box last night only to find that none of the case fans was running. So, Daniel, you may indeed have been right, so thanks for the tip if so

Peter_Viscarola_OSR · October 25, 2012, 11:02am

If the system is crashing, not shutting down, due to overheating… Yuck! Who wrote that BIOS?!

Peter
OSR

Maxim_S_Shatskih · October 25, 2012, 11:24am

> If the system is crashing, not shutting down, due to overheating… Yuck! Who wrote that BIOS?!

Usual not-so-brand-name mobo manufacturer.

BSOD due to overheating is normal. In older Windows, it was usually in ole32.dll now it can be in some other place.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

Maxim_S_Shatskih · October 25, 2012, 11:28am

> Anyway, I pulled the box last night only to find that none of the case fans was running

Live and learn

Once I had an issue that my app, which processes ~50GB files, generated the file which was wrong in 2-3 bytes.

I spent around a week trying to find the bug, using hardcore methods like adding lots of invariant checks and instrumenting the code a lot, to just find that my memory (Samsung IIRC) could not sustain the claimed FSB clock rate.

This was found by “copy” the 50GB file to another one, and then “fc /b”, without any my code on the system.

Lowering the FSB clock from 800 to 667 MHz helped a lot the issue was closed

ECC memory and good hardware (HP/IBM/Dell servers) are good for such heavy tests

The first tool to check for such overheating/hardware errors is Windows boot-time memory diag tool. It was just hanging on the machine I’ve described above at 800 MHz, and was fine at 667.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

MBond · October 25, 2012, 6:22pm

My personal favorite were alpha machines with memory controller errata. The
machine would install fine, run fine, run memory tests fine, but as soon as
MSSQL or another memory intensive was under stress (the very worst possible
time for a failure) the BSOD came within seconds. As I recall, the
workaround was either to replace an expensive FRU or to solder a couple of
wires onto it; depending on the model and whether anyone was comfortable
with making those kinds of field modifications.

Sometimes we look back nostalgically to the past, but this was one of those
things I am very glad to be rid of.

“Maxim S. Shatskih” wrote in message news:xxxxx@ntdev…

If the system is crashing, not shutting down, due to overheating… Yuck!
Who wrote that BIOS?!

Usual not-so-brand-name mobo manufacturer.

BSOD due to overheating is normal. In older Windows, it was usually in
ole32.dll now it can be in some other place.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com