MEMORY_MANAGEMENT (1a) BSOD

NTDEV
1

Hello,

I have a disk filter driver running on Windows 7 both 32 and 64 bits without any problems yet. When running the driver on Win 10 64 bits especially MEMORY_MANAGEMENT (1a) BSOD pops up and I have reinspected my code for weeks now, read some threads here on OSR but I haven’t been able to pin point what could cause this. The test is being performed on a machine with low Ram (2 GB) on Windows 10 because I wanted to observe and deal with the most critical scenarios.

Here is a what come when the BSOD come. If anybody can give me some useful advice or where to look or even the cause of this Ill really appreciate.

Thank you.

*** Fatal System Error: 0x0000001a
(0x000000000000003F,0x0000000000048A76,0x0000000002EA198B,0x00000000F9F2E002)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

*** WARNING: Unable to verify timestamp for ntdll.dll
*** ERROR: Module load completed but symbols could not be loaded for ntdll.dll
Connected to Windows 10 14393 x64 target at (Wed Nov 30 09:31:32.630 2016 (UTC + 9:00)), ptr64 TRUE
Loading Kernel Symbols
.CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
.CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
.CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.

Loading User Symbols
PEB address is NULL !
Loading unloaded module list
…
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {3f, 48a76, 2ea198b, f9f2e002}

CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol

MEMORY_MANAGEMENT (1a)

Any other values for parameter 1 must be individually examined.

Arguments:
Arg1: 000000000000003f, The subtype of the bugcheck.
Arg2: 0000000000048a76
Arg3: 0000000002ea198b
Arg4: 00000000f9f2e002

2

First of all, enable Driver Verifier for your driver and repeat a tests.
You may also use the Static Driver Verifier, PREfast and Code Analysis tools.

3

Why don’t you post the whole output of “!analyze -v” ?

The call stack could help. Could it be the paging system ? …

Bugcheck 1a with first parameter 3f is not documented.

4

Thank you for your prompt responses. I did use driver verifier before but it didn’t give me any errors. I will perform more test using all the options it provides.

Here is the output of “!analyse - v”

1: kd> !analyze -v
Connected to Windows 10 14393 x64 target at (Thu Dec 1 17:26:27.277 2016 (UTC + 9:00)), ptr64 TRUE
Loading Kernel Symbols
.CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
.CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
…CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
…CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
…CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
…

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

…
…CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
…CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
…
…
Loading User Symbols
…CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
Unable to read NT module Base Name string at 0000026128306048 - Win32 error 0n30 ..CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol. Unable to read LDR_DATA_TABLE_ENTRY at 000002612830b4a0 - Win32 error 0n30

Loading unloaded module list
…
WARNING: .reload failed, module list may be incomplete
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
Cannot read _LDR_DATA_TABLE_ENTRY at 000002612830b4a0
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn’t have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing “.symopt- 100”. Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ULONG64 ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn’t have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing “.symopt- 100”. Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ULONG64 ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn’t have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing “.symopt- 100”. Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ULONG64 ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn’t have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing “.symopt- 100”. Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ULONG64 ***
*** ***
*************************************************************************
Unable to read NT module Base Name string at 00000261`28306048 - Win32 error 0n30
*** ERROR: Symbol file could not be found. Defaulted to export symbols for combase.dll -
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.

DUMP_CLASS: 1

DUMP_QUALIFIER: 0

FAULTING_IP:
+0
0033:00007ffa`ec927b73 458b2c8a mov r13d,dword ptr [r10+rcx*4]

EXCEPTION_RECORD: 00000089b1efefb0 – (.exr 0x89b1efefb0)
ExceptionAddress: 00007ffaec927b73
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 00000261ecb81a60
Attempt to read from address 00000261ecb81a60

DEFAULT_BUCKET_ID: STATUS_BREAKPOINT

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint has been reached.

EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid

EXCEPTION_CODE_STR: 80000003

EXCEPTION_PARAMETER1: 0000000000000000

WATSON_BKT_PROCSTAMP: 578998f1

WATSON_BKT_MODULE: ntdll.dll

WATSON_BKT_MODSTAMP: 578997b2

WATSON_BKT_MODOFFSET: f212a

BUILD_VERSION_STRING: 14393.0.amd64fre.rs1_release.160715-1616

MODLIST_WITH_TSCHKSUM_HASH: 8534755ab65ab751722406aac6c52ec8f40ff0a7

MODLIST_SHA1_HASH: 63ecc2076c006a06958de6d3a0c4d4e824335c08

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

PRODUCT_TYPE: 1

SUITE_MASK: 784

ANALYSIS_SESSION_HOST: DESKTOP-BQ3SG77

ANALYSIS_SESSION_TIME: 12-01-2016 17:27:06.0427

ANALYSIS_VERSION: 10.0.14321.1024 amd64fre

CONTEXT: 00000089b1efeac0 – (.cxr 0x89b1efeac0)
rax=0000000000000000 rbx=00000261286069b8 rcx=00000000301e00f3
rdx=00000000301e00f3 rsi=000002612c402694 rdi=00000089b1eff400
rip=00007ffaec927b73 rsp=00000089b1eff1d0 rbp=00000089b1eff299
r8=000002612c400000 r9=000002612c400000 r10=000002612c401694
r11=0000000000000002 r12=00000089b1eff598 r13=00000089b1eff8e0
r14=00000089b1eff400 r15=0000026128614d30
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
0033:00007ffaec927b73 458b2c8a mov r13d,dword ptr [r10+rcx*4] ds:002b:00000261ecb81a60=???
Resetting default scope

FOLLOWUP_IP:
ntdll!RtlUnhandledExceptionFilter2+34a
0033:00007ffa`f41d212a cc int 3

READ_ADDRESS: 00000261ecb81a60

BUGCHECK_STR: STATUS_BREAKPOINT

THREAD_ATTRIBUTES:
OS_LOCALE: KOR

PROBLEM_CLASSES:

Tid [0x0]
Frame [0x00]
String [STATUS_BREAKPOINT]
Data Bucketing

LAST_CONTROL_TRANSFER: from 0000000000000008 to 00007ffaec927b73

IP_ON_HEAP: 00007ffaec927b73
The fault address in not in any loaded module, please check your build’s rebase
log at \bin\build_logs\timebuild\ntrebase.log for module which may
contain the address if it were loaded.

STACK_TEXT:
00000089b1efe170 00007ffaf0735e77 : 00000089b1efe350 00007ffaf41ed402 00007ffaeca0bf80 00000261283036c8 : ntdll!RtlUnhandledExceptionFilter2+0x34a
00000089b1efe1f0 00007ffaf418da9b : 00007ffaeca0bf80 00007ffaf4211b44 0000000000000000 00007ffaf16aad4b : KERNELBASE!UnhandledExceptionFilter+0x157
00000089b1efe2f0 00007ffaf4175946 : 00000089b1effbe0 00000089b1efefb0 00007ffaf3538364 00000089b1effbe0 : ntdll!RtlUserThreadStart$filt$0+0x38
00000089b1efe320 00007ffaf418991d : 0000000000000000 00000089b1efe4c0 00000089b1efeac0 0000000000000000 : ntdll!C_specific_handler+0x96
00000089b1efe390 00007ffaf41286d3 : 00007ffaf35d34b0 00000089b1efeac0 0000000000000000 b1aaa824a86a7795 : ntdll!RtlpExecuteHandlerForException+0xd
00000089b1efe3c0 00007ffaf4188a3a : 0000000000000000 0000026100000060 00000261286069b8 0000000000000000 : ntdll!RtlDispatchException+0x373
00000089b1efeac0 00007ffaec927b73 : 0000000000000008 0000000000000002 0000000000000ab0 000002610002a934 : ntdll!KiUserExceptionDispatch+0x3a
00000089b1eff1d0 0000000000000008 : 0000000000000002 0000000000000ab0 000002610002a934 0000000000000002 : 0x00007ffaec927b73<br>00000089b1eff1d8 0000000000000002 : 0000000000000ab0 000002610002a934 0000000000000002 000002612c400000 : 0x8<br>00000089b1eff1e0 0000000000000ab0 : 000002610002a934 0000000000000002 000002612c400000 000002612c400000 : 0x2<br>00000089b1eff1e8 000002610002a934 : 0000000000000002 000002612c400000 000002612c400000 000002612c402694 : 0xab0<br>00000089b1eff1f0 0000000000000002 : 000002612c400000 000002612c400000 000002612c402694 0000000000000000 : 0x000002610002a934
00000089b1eff1f8 000002612c400000 : 000002612c400000 000002612c402694 0000000000000000 00007ffaec924552 : 0x2
00000089b1eff200 000002612c400000 : 000002612c402694 0000000000000000 00007ffaec924552 000000000000002c : 0x000002612c400000<br>00000089b1eff208 000002612c402694 : 0000000000000000 00007ffaec924552 000000000000002c 0000000000000008 : 0x000002612c400000
00000089b1eff210 0000000000000000 : 00007ffaec924552 000000000000002c 0000000000000008 0000000000000002 : 0x00000261`2c402694

STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: 540e65e2a9db925b7e789f1200575c3462568bed

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 239f92b65582ef5f9eae60417561a743da4477cf

THREAD_SHA1_HASH_MOD: aff8b0dabc8d844388b1a38dd035d9811d0d5815

FAULT_INSTR_CODE: e8b4dcc

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: ntdll!RtlUnhandledExceptionFilter2+34a

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ntdll

IMAGE_NAME: ntdll.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 578997b2

BUCKET_ID_FUNC_OFFSET: 34a

BUCKET_ID: STATUS_BREAKPOINT_ntdll!RtlUnhandledExceptionFilter2

PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT_ntdll!RtlUnhandledExceptionFilter2

FAILURE_EXCEPTION_CODE: 80000003

FAILURE_IMAGE_NAME: ntdll.dll

BUCKET_ID_IMAGE_STR: ntdll.dll

FAILURE_MODULE_NAME: ntdll

BUCKET_ID_MODULE_STR: ntdll

FAILURE_FUNCTION_NAME: RtlUnhandledExceptionFilter2

BUCKET_ID_FUNCTION_STR: RtlUnhandledExceptionFilter2

BUCKET_ID_OFFSET: 34a

BUCKET_ID_MODTIMEDATESTAMP: 578997b2

BUCKET_ID_MODCHECKSUM: 1d8dbd

BUCKET_ID_MODVER_STR: 0.0.0.0

BUCKET_ID_PREFIX_STR: STATUS_BREAKPOINT

FAILURE_PROBLEM_CLASS: STATUS_BREAKPOINT

FAILURE_SYMBOL_NAME: ntdll.dll!RtlUnhandledExceptionFilter2

FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_ntdll.dll!RtlUnhandledExceptionFilter2

TARGET_TIME: 2016-12-01T08:24:07.000Z

OSBUILD: 14393

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal

USER_LCID: 0

OSBUILD_TIMESTAMP: 2016-07-16 11:21:29

BUILDDATESTAMP_STR: 160715-1616

BUILDLAB_STR: rs1_release

BUILDOSVER_STR: 10.0.14393.0.amd64fre.rs1_release.160715-1616

ANALYSIS_SESSION_ELAPSED_TIME: 20ba9

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:status_breakpoint_80000003_ntdll.dll!rtlunhandledexceptionfilter2

FAILURE_ID_HASH: {50ca479e-79a7-fd5a-2eed-5b8f14cbb537}

Followup: MachineOwner
---------

5

This does not look like a bugcheck 1a but a breakpoint exception.

6

Apologies, I meant this output of “!analyse - v”

KDTARGET: Refreshing KD connection

*** Fatal System Error: 0x0000001a
(0x000000000000003F,0x0000000000048E80,0x000000007768BEEB,0x00000000ACD69C91)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

*** WARNING: Unable to verify timestamp for ntdll.dll
*** ERROR: Module load completed but symbols could not be loaded for ntdll.dll
Connected to Windows 10 14393 x64 target at (Mon Dec 5 10:32:12.194 2016 (UTC + 9:00)), ptr64 TRUE
Loading Kernel Symbols
.CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
Loading User Symbols
PEB address is NULL !
Loading unloaded module list
…
Cannot read PEB32 from WOW64 TEB32 c8137f50 - NTSTATUS 0xC0000141
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {3f, 48e80, 7768beeb, acd69c91}
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
Probably caused by : memory_corruption

Followup: memory_corruption

nt!DbgBreakPointWithStatus:
fffff801`5cbd1a60 cc int 3
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)

Any other values for parameter 1 must be individually examined.

Arguments:
Arg1: 000000000000003f, The subtype of the bugcheck.
Arg2: 0000000000048e80
Arg3: 000000007768beeb
Arg4: 00000000acd69c91

Debugging Details:

CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.

DUMP_CLASS: 1

DUMP_QUALIFIER: 0

BUILD_VERSION_STRING: 14393.0.amd64fre.rs1_release.160715-1616

DUMP_TYPE: 0

BUGCHECK_P1: 3f

BUGCHECK_P2: 48e80

BUGCHECK_P3: 7768beeb

BUGCHECK_P4: acd69c91

ADDITIONAL_DEBUG_TEXT: Memory Manager detected corruption of a pagefile page while performing an in-page operation.
The data read from storage does not match the original data written.
This indicates the data was corrupted by the storage stack, or device hardware.

BUGCHECK_STR: 0x1a_3f

CPU_COUNT: 2

CPU_MHZ: dac

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 1E’00000000 (cache) 1E’00000000 (init)

DEFAULT_BUCKET_ID: CODE_CORRUPTION

PROCESS_NAME: MemCompression

CURRENT_IRQL: 2

ANALYSIS_SESSION_HOST: DESKTOP-BQ3SG77

ANALYSIS_SESSION_TIME: 12-05-2016 10:35:49.0029

ANALYSIS_VERSION: 10.0.14321.1024 amd64fre

TRAP_FRAME: ffffd201bf570b00 – (.trap 0xffffd201bf570b00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000dc60f20 rbx=0000000000000000 rcx=000000000000eee0
rdx=0000000000000014 rsi=0000000000000000 rdi=0000000000000000
rip=00007ffa70c8891f rsp=0000000007d6e330 rbp=00000000005a0cc0
r8=ffffffffe00042ff r9=000000000000000e r10=000000000dc52040
r11=0000000000000008 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
0033:00007ffa`70c8891f ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff8015cc5596a to fffff8015cbd1a60

STACK_TEXT:
ffffd201bf56f378 fffff8015cc5596a : 000000000000003f 000000000000001a ffffd201bf56f4e0 fffff8015cb18c88 : nt!DbgBreakPointWithStatus
ffffd201bf56f380 fffff8015cc55359 : 0000000000000003 ffffd201bf56f4e0 fffff8015cbd9340 000000000000001a : nt!KiBugCheckDebugBreak+0x12
ffffd201bf56f3e0 fffff8015cbcc094 : 0000000000000000 fffff8015cb850f9 ffffa180013be4c0 ffffe20b4c0e88b8 : nt!KeBugCheck2+0x8a5
ffffd201bf56faf0 fffff8015cc21a0a : 000000000000001a 000000000000003f 0000000000048e80 000000007768beeb : nt!KeBugCheckEx+0x104
ffffd201bf56fb30 fffff8015caeb88a : ffffe20b57e38030 0000000000003000 ffffd201bf56fc80 ffffe20b57e38010 : nt! ?? ::FNODOBFM::string'+0x4684a ffffd201bf56fc00 fffff8015ca96fe5 : ffffd201bf570010 ffffd201bf56fdc0 ffff86800006e8d8 ffffe20b57e38010 : nt!MiWaitForInPageComplete+0x48a ffffd201bf56fd30 fffff8015caf9a00 : 00000000c0033333 ffffd201bf570010 0000000000000000 ffffd201bf570010 : nt!MiIssueHardFault+0x1b5 ffffd201bf56fe10 fffff8015cbd55fc : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!MmAccessFault+0xca0 ffffd201bf570010 fffff8015cb99ed0 : ffffd201c1e0a000 ffffe20b4dc3d050 000000000dd1ba00 fffff8015cb353e4 : nt!KiPageFault+0x13c ffffd201bf5701a0 fffff8015cb353e4 : 0000000000001000 fffff8015ccd42e0 ffffd201c1e0a000 0000000000000000 : nt!RtlDecompressBufferXpressLz+0x50 ffffd201bf5701c0 fffff8015cb8ca5b : 0000000000000002 ffffd201c1e0a000 000000000dd1ba00 ffffd201c1e0a000 : nt!RtlDecompressBufferEx+0x64 ffffd201bf570210 fffff8015cb8c8d3 : 0000000000000000 ffffe20b4dc3d050 0000000000000000 000000000000ba00 : nt!ST_STORE<sm_traits>::StDmSinglePageCopy+0x157<br>ffffd201bf5702f0 fffff8015cb8cc61 : 0000000000000001 0000000000000a82 0000000000000001 ffffd20100001000 : nt!ST_STORE<sm_traits>::StDmSinglePageTransfer+0x7b<br>ffffd201bf570340 fffff8015cb8cda0 : 00000000ffffffff ffffe20ba2a37000 ffffd201bf570428 ffffe20b5133f2c0 : nt!ST_STORE<sm_traits>::StDmpSinglePageRetrieve+0x199<br>ffffd201bf5703e0 fffff8015cb8dbc2 : 0000000000000000 ffffe20b5133f2c0 0000000000000070 ffffe20b5133f2c0 : nt!ST_STORE<sm_traits>::StDmPageRetrieve+0x98<br>ffffd201bf5704a0 fffff8015cb8dd09 : ffffe20b4dc3d000 ffffd201bf5705b0 fffff8015cb8dce8 fffff8015cb8dce8 : nt!SMKM_STORE<sm_traits>::SmStDirectReadIssue+0x52<br>ffffd201bf5704f0 fffff8015cae6e75 : ffffe20b4e9bb080 ffffd201bf5705b0 ffffe20b614b4060 fffff8015cb33fec : nt!SMKM_STORE<sm_traits>::SmStDirectReadCallout+0x21<br>ffffd201bf570520 fffff8015cb86f29 : 0000000000000003 ffffe20ba2a37000 ffffe20b4dc3d000 0000000000000000 : nt!KeExpandKernelStackAndCalloutInternal+0x85<br>ffffd201bf570570 fffff8015cb8a32c : ffffd201bf570670 ffffd201bf5707b0 ffffe20b4dc3d000 fffff8015cb87102 : nt!SMKM_STORE<sm_traits>::SmStDirectRead+0xad<br>ffffd201bf570640 fffff8015cb8a017 : ffffe20b4dc3d000 ffffe20b5133f2c0 fffff8015ce3da40 ffffd201bf5707b0 : nt!SMKM_STORE<sm_traits>::SmStWorkItemQueue+0x1a4<br>ffffd201bf570690 fffff8015cb86dbf : 000000000000000c ffffe20b614b4110 ffffe20b5133f2c0 0000000000000001 : nt!SMKM_STORE_MGR<sm_traits>::SmIoCtxQueueWork+0xbf<br>ffffd201bf570710 fffff8015cb8dce2 : ffffe20b00000001 ffffe20b614b4110 ffffd20100000000 ffffe20b4dc3d000 : nt!SMKM_STORE_MGR<sm_traits>::SmPageRead+0x16b<br>ffffd201bf570780 fffff8015ca964c9 : 0000000000000000 ffffe20b4c99fb08 ffffe20b4c99fb01 ffffe20b00000000 : nt!SmPageRead+0x2e<br>ffffd201bf5707d0 fffff8015ca96f8d : 0000000000000002 ffffd201bf570b00 ffffe20b614b4010 0000000000000000 : nt!MiIssueHardFaultIo+0x145<br>ffffd201bf570860 fffff8015caf9a00 : 00000000c0033333 ffffd201bf570b00 0000000000000004 ffffd201bf570b00 : nt!MiIssueHardFault+0x15d<br>ffffd201bf570900 fffff8015cbd55fc : ffffe20b4e9bb080 0000000080000005 0000000000000000 ffffe20b561e6d01 : nt!MmAccessFault+0xca0<br>ffffd201bf570b00 00007ffa70c8891f : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiPageFault+0x13c<br>0000000007d6e330 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007ffa70c8891f

STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff8015ca83595 - nt!MiDuplicateCloneLeaf+39
[fa:a1]
fffff8015ca84250 - nt!MiExpandPagedPool+84 (+0xcbb)
[f6:86]
fffff8015ca84462 - nt!MiExpandSystemCache+86 (+0x212)
[f6:86]
fffff8015ca844b0-fffff8015ca844b1 2 bytes - nt!MiExpandSystemCache+d4 (+0x4e)
[fb f6:c3 86]
fffff8015ca844ef - nt!MiExpandSystemCache+113 (+0x3f)
[fa:a1]
fffff8015ca8451d - nt!MiExpandSystemCache+141 (+0x2e)
[fa:a1]
fffff8015ca84f22 - nt!MiExpandPtes+d6 (+0xa05)
[f6:86]
fffff8015ca8542b - nt!MiMakeProtoAddressValid+3b (+0x509)
[f6:86]
fffff8015ca85481 - nt!MiMakeProtoAddressValid+91 (+0x56)
[fa:a1]
fffff8015ca8561f - nt!MiGetWorkingSetInfoList+11f (+0x19e)
[f6:86]
fffff8015ca856cf-fffff8015ca856d0 2 bytes - nt!MiGetWorkingSetInfoList+1cf (+0xb0)
[fb f6:c3 86]
fffff8015ca857fc - nt!MiGetWorkingSetInfoList+2fc (+0x12d)
[fa:a1]
fffff8015ca85b3e - nt!MiGetWorkingSetInfoList+63e (+0x342)
[f6:86]
fffff8015ca85c1f - nt!MiGetWorkingSetInfoList+71f (+0xe1)
[fa:a1]
fffff8015ca85ca3 - nt!MiGetWorkingSetInfoList+7a3 (+0x84)
[fa:a1]
fffff8015ca86119 - nt!MmRemoveExecuteGrants+10d (+0x476)
[f6:86]
fffff8015ca8614a - nt!MmRemoveExecuteGrants+13e (+0x31)
[fa:a1]
fffff8015ca8623a - nt!MiQueryPfn+16 (+0xf0)
[fa:a1]
fffff8015ca862e8 - nt!MiLockProtoPage+50 (+0xae)
[f6:86]
fffff8015ca8630f - nt!MiLockProtoPage+77 (+0x27)
[fa:a1]
fffff8015ca86581 - nt!MiFreeLargePageMemory+61 (+0x272)
[fa:a1]
fffff8015ca8693c - nt!MiExpandNonPagedPool+1d4 (+0x3bb)
[f6:86]
fffff8015ca86a79-fffff8015ca86a7a 2 bytes - nt!MiExpandNonPagedPool+311 (+0x13d)
[fb f6:c3 86]
fffff8015ca86a9a - nt!MiExpandNonPagedPool+332 (+0x21)
[f6:86]
fffff8015ca86abd - nt!MiExpandNonPagedPool+355 (+0x23)
[fa:a1]
fffff8015ca86d4a - nt!MiSplitBitmapPages+4e (+0x28d)
[f6:86]
fffff8015ca86da4-fffff8015ca86da5 2 bytes - nt!MiSplitBitmapPages+a8 (+0x5a)
[fb f6:c3 86]
fffff8015ca86e00 - nt!MiSplitBitmapPages+104 (+0x5c)
[fa:a1]
fffff8015ca87088 - nt!MiConvertWsleHash+68 (+0x288)
[f6:86]
fffff8015ca870e5 - nt!MiConvertWsleHash+c5 (+0x5d)
[f6:86]
fffff8015ca870ef - nt!MiConvertWsleHash+cf (+0x0a)
[f6:86]
fffff8015ca871ea - nt!MiConvertWsleHash+1ca (+0xfb)
[fa:a1]
fffff8015ca872e8 - nt!MiConvertWsleHash+2c8 (+0xfe)
[f6:86]
fffff8015ca8738d - nt!MiMapNewWorkingSetPage+6d (+0xa5)
[f6:86]
fffff8015ca874ed - nt!MiMapNewWorkingSetPage+1cd (+0x160)
[fa:a1]
fffff8015ca87549-fffff8015ca8754a 2 bytes - nt!MiMapNewWorkingSetPage+229 (+0x5c)
[fb f6:c3 86]
fffff8015ca87566-fffff8015ca87567 2 bytes - nt!MiMapNewWorkingSetPage+246 (+0x1d)
[fb f6:c3 86]
fffff8015ca8757a - nt!MiMapNewWorkingSetPage+25a (+0x14)
[f6:86]
fffff8015ca875a4-fffff8015ca875a5 2 bytes - nt!MiMapNewWorkingSetPage+284 (+0x2a)
[fb f6:c3 86]
fffff8015ca875b6-fffff8015ca875b8 3 bytes - nt!MiMapNewWorkingSetPage+296 (+0x12)
[7d fb f6:61 c3 86]
fffff8015ca875c5-fffff8015ca875c7 3 bytes - nt!MiMapNewWorkingSetPage+2a5 (+0x0f)
[7d fb f6:61 c3 86]
fffff8015ca875d7-fffff8015ca875da 4 bytes - nt!MiMapNewWorkingSetPage+2b7 (+0x12)
[be 7d fb f6:b0 61 c3 86]
fffff8015ca875e6-fffff8015ca875e9 4 bytes - nt!MiMapNewWorkingSetPage+2c6 (+0x0f)
[be 7d fb f6:b0 61 c3 86]
fffff8015ca87801-fffff8015ca87802 2 bytes - nt!MiUnlinkStandbyBatch+41 (+0x21b)
[fb f6:c3 86]
fffff8015ca87811 - nt!MiUnlinkStandbyBatch+51 (+0x10)
[fa:a1]
fffff8015ca8782f - nt!MiUnlinkStandbyBatch+6f (+0x1e)
[fa:a1]
fffff8015ca87856 - nt!MiUnlinkStandbyBatch+96 (+0x27)
[fa:a1]
fffff8015ca8788e - nt!MiUnlinkStandbyBatch+ce (+0x38)
[fa:a1]
fffff8015ca87971 - nt!MiUnlinkStandbyBatch+1b1 (+0xe3)
[fa:a1]
fffff8015ca879d2 - nt!MiUnlinkStandbyBatch+212 (+0x61)
[f6:86]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without ‘-lo [num_lines]’ to view entire output.
fffff8015cccd718-fffff8015cccd719 2 bytes - nt!ExFreePoolWithTag+388
[fb f6:c3 86]
fffff8015cccdbce - nt!ExFreePoolWithTag+83e (+0x4b6)
[f6:86]
fffff8015cccec88-fffff8015cccec89 2 bytes - nt!ExAllocatePoolWithTag+eb8 (+0x10ba)
[fb f6:c3 86]
fffff8015cccecbc - nt!ExAllocatePoolWithTag+eec (+0x34)
[fa:a1]
fffff8015ccd6f30-fffff8015ccd6f32 3 bytes - nt!_guard_dispatch_icall_fptr
[40 84 bc:80 17 bd]
fffff8015ce4f24d - nt!MmDuplicateMemory+231
[fa:a1]
fffff8015ce4f2a5 - nt!MmDuplicateMemory+289 (+0x58)
[fa:a1]
fffff8015ce4f32a - nt!MmDuplicateMemory+30e (+0x85)
[fa:a1]
fffff8015ce4f555 - nt!MmDuplicateMemory+539 (+0x22b)
[fa:a1]
fffff8015ce4fb29 - nt!MiMarkKernelPageTablePages+d (+0x5d4)
[f6:86]
fffff8015ce4fb7a - nt!MiMarkKernelPageTablePages+5e (+0x51)
[f7:87]
fffff8015ce50079 - nt!MmMarkHiberPhase+71 (+0x4ff)
[fa:a1]
fffff8015ce50090 - nt!MmMarkHiberPhase+88 (+0x17)
[fa:a1]
fffff8015ce5068b - nt!MiMarkHiberNotCachedPages+2b (+0x5fb)
[fa:a1]
fffff8015ce507a3 - nt!MiMarkNonPagedHiberPhasePages+67 (+0x118)
[fa:a1]
fffff8015ce5086e - nt!MiMarkKernelPageTablesHelper+3e (+0xcb)
[f6:86]
fffff8015ce50b1d - nt!MiEnumerateKernelLeafPtes+11 (+0x2af)
[f6:86]
fffff8015ce50b27 - nt!MiEnumerateKernelLeafPtes+1b (+0x0a)
[f7:87]
fffff8015ce53337 - nt!MmInitializeProcessor+3b (+0x2810)
[f6:86]
fffff8015ce57ca4 - nt! ?? ::OKHAJAOM::string'+2b74 (+0x496d)<br> [fa:a1]<br> fffff8015ce57d2c - nt! ?? ::OKHAJAOM::string’+2bfc (+0x88)
[fa:a1]
fffff8015ce57dd4 - nt! ?? ::OKHAJAOM::string'+2ca4 (+0xa8)<br> [fa:a1]<br> fffff8015ce57ede - nt! ?? ::OKHAJAOM::string’+2dae (+0x10a)
[fa:a1]
fffff8015ce60567 - nt!MmFreeIndependentPages+53
[fa:a1]
fffff8015ce61716 - nt!MiSelectSystemImageAddress+26 (+0x11af)
[f6:86]
fffff8015ce72229 - nt!PfpPfnPrioRequest+99 (+0x10b13)
[fa:a1]
fffff8015ce72268 - nt!PfpPfnPrioRequest+d8 (+0x3f)
[fa:a1]
fffff8015ce9f13e - nt!MiReturnPageTablePageCommitment+16e (+0x2ced6)
[f6:86]
fffff8015cea0f13 - nt!MiPfPrepareSequentialReadList+2e3 (+0x1dd5)
[fa:a1]
fffff8015cea3d13 - nt!MiRelocateImagePfn+73 (+0x2e00)
[fa:a1]
fffff8015cea3d20 - nt!MiRelocateImagePfn+80 (+0x0d)
[f6:86]
fffff8015cea3d3b - nt!MiRelocateImagePfn+9b (+0x1b)
[f6:86]
fffff8015cea59c5-fffff8015cea59c6 2 bytes - nt!MiMapViewOfDataSection+c45 (+0x1c8a)
[fb f6:c3 86]
fffff8015cea5a0a-fffff8015cea5a0d 4 bytes - nt!MiMapViewOfDataSection+c8a (+0x45)
[be 7d fb f6:b0 61 c3 86]
fffff8015ceafaaf - nt!MiPfPrepareReadList+4cf (+0xa0a5)
[fa:a1]
fffff8015cebdf7f-fffff8015cebdf82 4 bytes - nt!MiInitializeWorkingSetList+f3 (+0xe4d0)
[be 7d fb f6:b0 61 c3 86]
fffff8015cebdfc2 - nt!MiInitializeWorkingSetList+136 (+0x43)
[fa:a1]
fffff8015cebe015 - nt!MiInitializeWorkingSetList+189 (+0x53)
[fa:a1]
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.

fffff8015cec467e - nt!MiReleaseProcessReferenceToSessionDataPage+a2 (+0x6669)
[fa:a1]
fffff8015cf1ea55 - nt!MmChangeImageProtection+159 (+0x5a3d7)
[fa:a1]
fffff8015cf1ec88 - nt!MiAllocateDriverPage+9c (+0x233)
[fa:a1]
fffff8015cf1ecf3 - nt!MiValidateImagePfn+3b (+0x6b)
[fa:a1]
fffff8015cf1ed3d - nt!MiValidateImagePfn+85 (+0x4a)
[f6:86]</sm_traits></sm_traits></sm_traits></sm_traits></sm_traits></sm_traits></sm_traits></sm_traits></sm_traits></sm_traits>

7

I have the same problem. Can anybody help :frowning: :frowning: :frowning: :frowning: :frowning: :frowning:

8

This thread is 2 Years Old.

Please, please. Do. Not. Resurrect. Old. Threads.

If you have an up issue Start a new thread

Please?

Peter