Thanks David and Tim.
I do not have private symbols for xenvif, and am just looking through the source code to see what could be going wrong, although the public symbols I have might not match line to line with the source.
Here is a more detailed debugging info.
MODULE_NAME: xenvif
FAULTING_MODULE: fffff8035688b000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 577b672b
READ_ADDRESS: 0000000000000000
CURRENT_IRQL: 0
FAULTING_IP:
xenvif!ReceiverReturnPacket+37 [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\receiver.c @ 3321]
fffff801`afa4d6e3 498b1e mov rbx,qword ptr [r14]
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
LAST_CONTROL_TRANSFER: from fffff803569e4ee9 to fffff803569d93a0
STACK_TEXT:
ffffd0013e9e50d8 fffff803
569e4ee9 : 000000000000000a 00000000
00000000 0000000000000002 00000000
00000000 : nt!KeBugCheckEx
ffffd0013e9e50e0 fffff803
569e373a : 0000000000000000 00000000
00000001 4138463534313500 75427465
6e202c30 : nt!setjmpex+0x37d9
ffffd0013e9e5220 fffff801
afa4d6e3 : fffff801b20bab40 ffffe001
000007c4 fffff801b20babb0 ffffe001
5145f8a0 : nt!setjmpex+0x202a
ffffd0013e9e53b0 fffff801
afa56ef0 : 0000000100000001 00000000
00000001 ffffe0015191db48 ffffe001
5191db30 : xenvif!ReceiverReturnPacket+0x37 [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\receiver.c @ 3321]
ffffd0013e9e5400 fffff801
afb75e95 : fffffffffffffffe ffffe001
50f60230 ffffd0013e9e5602 00000000
00000000 : xenvif!VifReturnPacket+0x108 [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\vif.c @ 385]
ffffd0013e9e5450 fffff801
ae8630fd : ffffe00151843280 00000000
00000000 0000000000000000 00000000
00000003 : xennet+0x3e95
ffffd0013e9e5480 fffff801
ae861f60 : ffffe00150783838 ffffd001
3e9e5670 ffffe001519871a0 00000000
00000000 : NDIS!NdisMIndicateReceiveNetBufferLists+0x117d
ffffd0013e9e54e0 fffff801
ae862094 : ffffe001519871a0 ffffd001
3e9e5501 00000000000075d9 59ccdb19
1d1b3762 : NDIS!NdisAcquireRWLockWrite+0xbb0
ffffd0013e9e5570 fffff801
afb75dd2 : 0000000000000000 ffffd001
3e9e5800 ffffe00150f60230 ffffd001
3f535000 : NDIS!NdisMIndicateReceiveNetBufferLists+0x114
ffffd0013e9e5760 fffff801
afb75345 : 0000000000000000 00000000
00000000 ffffe00151843280 ffffe001
519ab010 : xennet+0x3dd2
ffffd0013e9e57d0 fffff801
afa4d34f : ffffe001518f56d0 ffffd001
00000002 ffffd0013e9e5820 00000000
00000000 : xennet+0x3345
ffffd0013e9e5800 fffff801
afa488a0 : 0000000000000001 ffffe001
518caab0 ffffe001518c9f50 ffffe001
518caad0 : xenvif!ReceiverNotify+0xa7 [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\receiver.c @ 3371]
ffffd0013e9e5850 fffff803
568f5bf0 : ffffd0013e9bef00 ffffd001
3e9e5990 ffffd0013e9e5b20 ffffd001
3e9e5a20 : xenvif!NotifierDpc+0x74 [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\notifier.c @ 159]
ffffd0013e9e5890 fffff803
568f4f37 : ffffe0015175a000 ffffe001
5175a080 0000000000000000 ffffd001
00000001 : nt!ExAcquireRundownProtectionCacheAwareEx+0xfe0
ffffd0013e9e59e0 fffff803
569dceea : ffffd0013e9bc180 ffffd001
3e9bc180 ffffd0013e9c8240 ffffe001
51655080 : nt!ExAcquireRundownProtectionCacheAwareEx+0x327
ffffd0013e9e5c60 00000000
00000000 : ffffd0013e9e6000 ffffd001
3e9e0000 0000000000000000 00000000
00000000 : nt!KeSynchronizeExecution+0x2efa
STACK_COMMAND: kb
FOLLOWUP_IP:
xenvif!ReceiverReturnPacket+37 [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\receiver.c @ 3321]
fffff801`afa4d6e3 498b1e mov rbx,qword ptr [r14]
FAULTING_SOURCE_LINE: c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\receiver.c
FAULTING_SOURCE_FILE: c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\receiver.c
FAULTING_SOURCE_LINE_NUMBER: 3321
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: xenvif!ReceiverReturnPacket+37
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: xenvif.sys
BUCKET_ID: WRONG_SYMBOLS
FAILURE_BUCKET_ID: WRONG_SYMBOLS
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:wrong_symbols
FAILURE_ID_HASH: {70b057e8-2462-896f-28e7-ac72d4d365f8}
Followup: MachineOwner
1: kd> kn
Child-SP RetAddr Call Site
00 ffffd0013e9e50d8 fffff803
569e4ee9 nt!KeBugCheckEx
01 ffffd0013e9e50e0 fffff803
569e373a nt!setjmpex+0x37d9
02 ffffd0013e9e5220 fffff801
afa4d6e3 nt!setjmpex+0x202a
03 (Inline Function) ---------------- xenvif!__RingReturnPacket+0x13 [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\receiver.c @ 1386] 04 ffffd001
3e9e53b0 fffff801afa56ef0 xenvif!ReceiverReturnPacket+0x37 [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\receiver.c @ 3321] 05 ffffd001
3e9e5400 fffff801afb75e95 xenvif!VifReturnPacket+0x108 [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\vif.c @ 385] 06 ffffd001
3e9e5450 fffff801ae8630fd xennet+0x3e95 07 ffffd001
3e9e5480 fffff801ae861f60 NDIS!NdisMIndicateReceiveNetBufferLists+0x117d 08 ffffd001
3e9e54e0 fffff801ae862094 NDIS!NdisAcquireRWLockWrite+0xbb0 09 ffffd001
3e9e5570 fffff801afb75dd2 NDIS!NdisMIndicateReceiveNetBufferLists+0x114 0a ffffd001
3e9e5760 fffff801afb75345 xennet+0x3dd2 0b ffffd001
3e9e57d0 fffff801afa4d34f xennet+0x3345 0c (Inline Function) --------
-------- xenvif!__RingReleaseLock+0x6a [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\receiver.c @ 1332]
0d (Inline Function) ---------------- xenvif!__RingNotify+0x7c [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\receiver.c @ 2669] 0e ffffd001
3e9e5800 fffff801afa488a0 xenvif!ReceiverNotify+0xa7 [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\receiver.c @ 3371] 0f ffffd001
3e9e5850 fffff803568f5bf0 xenvif!NotifierDpc+0x74 [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\notifier.c @ 159] 10 ffffd001
3e9e5890 fffff803568f4f37 nt!ExAcquireRundownProtectionCacheAwareEx+0xfe0 11 ffffd001
3e9e59e0 fffff803569dceea nt!ExAcquireRundownProtectionCacheAwareEx+0x327 12 ffffd001
3e9e5c60 00000000`00000000 nt!KeSynchronizeExecution+0x2efa
1: kd> ub fffff801afa4d6e3
xenvif!ReceiverReturnPacket+0x1b [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\receiver.c @ 3318]:
fffff801afa4d6c7 4c8b7260 mov r14,qword ptr [rdx+60h] fffff801
afa4d6cb 4883626000 and qword ptr [rdx+60h],0
fffff801afa4d6d0 488d7a68 lea rdi,[rdx+68h] fffff801
afa4d6d4 4c8bf9 mov r15,rcx
fffff801afa4d6d7 4885ff test rdi,rdi fffff801
afa4d6da 744a je xenvif!ReceiverReturnPacket+0x7a (fffff801afa4d726) fffff801
afa4d6dc 488b37 mov rsi,qword ptr [rdi]
fffff801`afa4d6df 48832700 and qword ptr [rdi],0
1: kd> dv /v
Unable to enumerate locals, Win32 error 0n318
Private symbols (symbols.pri) are required for locals.
Type “.hh dbgerr005” for details.
1: kd> .frame /r 03
03 (Inline Function) ---------------- xenvif!__RingReturnPacket+0x13 [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\receiver.c @ 1386] rax=ffffe001518f56d0 rbx=0000000000000001 rcx=ffffe001518f56d0 rdx=ffffe0015178f618 rsi=0000000000000000 rdi=ffffe0015178f680 rip=fffff801afa4d6e3 rsp=ffffd0013e9e53b0 rbp=ffffd0013e9e53e0 r8=0000000000000000 r9=0000000000000000 r10=ffffd0013e9c8240 r11=ffffe001518c9f50 r12=0000000000000002 r13=0000000000000003 r14=0000000000000000 r15=ffffe001518f56d0 iopl=0 nv up ei ng nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282 xenvif!__RingReturnPacket+0x13 [inlined in xenvif!ReceiverReturnPacket+0x37]: fffff801
afa4d6e3 498b1e mov rbx,qword ptr [r14] ds:002b:00000000`00000000=???
1: kd> ub fffff801afa4d6e3
xenvif!ReceiverReturnPacket+0x1b [c:\jenkins\jobs\beta-build-xenvif\workspace\src\xenvif\receiver.c @ 3318]:
fffff801afa4d6c7 4c8b7260 mov r14,qword ptr [rdx+60h] fffff801
afa4d6cb 4883626000 and qword ptr [rdx+60h],0
fffff801afa4d6d0 488d7a68 lea rdi,[rdx+68h] fffff801
afa4d6d4 4c8bf9 mov r15,rcx
fffff801afa4d6d7 4885ff test rdi,rdi fffff801
afa4d6da 744a je xenvif!ReceiverReturnPacket+0x7a (fffff801afa4d726) fffff801
afa4d6dc 488b37 mov rsi,qword ptr [rdi]
fffff801`afa4d6df 48832700 and qword ptr [rdi],0
So it seems like somewhere a NULL pointer is being dereferenced.