Recently I got a IRQL_NOT_LESS_OR_EQUAL BSOD on a 2 processor NT40-SP6
machine. The think I can’t explain is why the BSOD in
halmps!KfAcquireSpinLock.
My understanding is that SPIN lock object address (the one that cause page
fault at DISPATH IRQL) is NOT provided by user process (the one that called
KERNEL32!FindClose). As the stack frame shows, the SPIN object should be
allocated and initialized in kernel (somewhere in ntkrnlmp).
Is this BSOD (really) out of my control?
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pagable (or completely invalid) address at
an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: bad0b0e4, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 80003d3a, address which referenced memory
Details:
Write address bad0b0e4unable to get nt!MmPoolCodeEnd
unable to get nt!MmPoolCodeStart
, Nonpaged pool
Current IRQL 2
Fault occurred in driver halmps.dll ( halmps!KfAcquireSpinLock+0x1a )
80003d3a f00fba2900 lock bts word ptr [ecx],0x0
Followup : MachineOwner
f0e75e20 80003d3a ntkrnlmp!KiTrap0E+0x284
f0e75e90 801091e1 halmps!KfAcquireSpinLock+0x1a
f0e75ea4 80192660 ntkrnlmp!ExAcquireResourceExclusiveLite+0x1b
f0e75ecc 80137a78 ntkrnlmp!ObpDecrementHandleCount+0x22
f0e75ef8 801413a9 ntkrnlmp!NtClose+0x176
f0e75ef8 77f6779f ntkrnlmp!KiSystemService+0xc9
02649d2c 77f0c7dd ntdll!ZwClose+0xb
02649d74 00402014 KERNEL32!FindClose+0x60
wbr Primoz
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com