Anyone seen this spew before?

NTDEV
1

I have a system start driver with verifier enabled. After dozens of
clean boots I see the
below appear in windbg’s output. I know there are several drivers on my
test machine
that are rather vocal; I’m not familiar with the below spew…

Is the below a product of a noisy driver or is this a Microsoft warning
originating with
verifier or a checked component?

WARNING: tcpip overlaps dump_atapi
WARNING: tcpip overlaps mrxsmb
WARNING: netbt overlaps ati2dvai
WARNING: netbt overlaps dump_atapi
WARNING: rdbss overlaps ati2dvai
WARNING: mrxsmb overlaps ati2dvai
…

For what it’s worth, the boot continues without a crash… I suppose
‘warning’ vs ‘error’
is a little significant :slight_smile:

Two other things, I see this spew began as my driver was loading, but
before verifier
began checking it, and this began before my driver exited DriverEntry
(based on DbgPrint
statements).

Ideas?

2

I’m not certain that it *isn’t* related to DV, but I’ve seen this occur when WinDbg/KD’s idea of the loaded kernel module list gets out of sync with the actual loaded model list. So when a driver/module loads, KD checks the range of memory occupied by that driver, and notices that it overlaps an existing module, at least according to its own internal state, and prints the warning.

I could be totally wrong on this; it could be something significant. But if there are no other signs of something going wrong, and if this only happens due to some particular sequence of (reboot | load driver | unload driver | restart KD | etc)*, then it’s probably just KD’s idea of the loaded modules getting out of sync with the actual state of the kernel.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of MM
Sent: Monday, April 30, 2007 10:54 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Anyone seen this spew before?

I have a system start driver with verifier enabled. After dozens of
clean boots I see the
below appear in windbg’s output. I know there are several drivers on my
test machine
that are rather vocal; I’m not familiar with the below spew…

Is the below a product of a noisy driver or is this a Microsoft warning
originating with
verifier or a checked component?

WARNING: tcpip overlaps dump_atapi
WARNING: tcpip overlaps mrxsmb
WARNING: netbt overlaps ati2dvai
WARNING: netbt overlaps dump_atapi
WARNING: rdbss overlaps ati2dvai
WARNING: mrxsmb overlaps ati2dvai
…

For what it’s worth, the boot continues without a crash… I suppose
‘warning’ vs ‘error’
is a little significant :slight_smile:

Two other things, I see this spew began as my driver was loading, but
before verifier
began checking it, and this began before my driver exited DriverEntry
(based on DbgPrint
statements).

Ideas?

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

The warnings are from windbg- it generally means that you lost synchronization temporarily while modules were being unloaded, and it now sees overlapping addresses. They are warnings because the probability of modules being loaded with overlapping addresses in a shipping kernel is infinitesimal.

When I see these (and I’m in the mood to care :-), I just break in, do a .reload to clean up the list, and proceed. Otherwise, you may get some spurious results in symbol resolution (ln, stack traces, and the like). More often, I just ignore them until something breaks, at which point I usually wind up doing some reloading anyway…

4

Arlie and Bob, Thanks…

After spending almost a week trying to defuse a memory corruption bomb,
those warnings were a little unpleasant too see.

I appreciate the explanations - thanks again.