Hi All,
when i remove the disk when it is not mounted, it gives me a BSOD.
Please see the analyze -v output.
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 00000000, Object type of the object whose reference count is being lowered
Arg2: 85bd0020, Object whose reference count is being lowered
Arg3: 00000002, Reserved
Arg4: 866edeab, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object’s reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object?s reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
ADDITIONAL_DEBUG_TEXT:
Use ‘!findthebuild’ command to search for the target build information.
If the build information is available, run ‘!findthebuild -s ; .reload’ to set symbol path and load symbols.
MODULE_NAME: volsnap
FAULTING_MODULE: 82810000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bbf26
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x18
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 828e21d1 to 82868bc0
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
8ac37614 828e21d1 00000003 85bd0020 85bd0008 nt!DbgBreakPointWithStatus+0x4
8ac379d8 828e1574 00000018 00000000 85bd0020 nt!KeBugCheckEx+0xc7b
8ac379fc 8286632c 00000018 00000000 85bd0020 nt!KeBugCheckEx+0x1e
8ac37a3c 885e8aa4 852e7f6c 8629d1e0 85bd0020 nt!ObfDereferenceObjectWithTag+0x4b
8ac37a78 8283ef44 85bd0020 8629d008 8ac37b14 volsnap+0x2faa4
8ac37a90 829d815a 845c04d0 85bca8e0 845c04d0 nt!IofCallDriver+0x64
8ac37ac0 82acadbf 845c04d0 00000000 85bca8e0 nt!RtlGetDefaultCodePage+0x8a4
8ac37b18 828de9b2 845c04d0 00000002 993290a0 nt!IoReportTargetDeviceChange+0x99eb
8ac37b44 82ac2af7 00000018 993290a0 00000000 nt!IoTranslateBusAddress+0x933
8ac37b58 82ac2dab 00000002 00000018 00000000 nt!IoReportTargetDeviceChange+0x1723
8ac37b8c 82ac2a95 845c04d0 993290a0 00000002 nt!IoReportTargetDeviceChange+0x19d7
8ac37bc4 82ac2a17 85ef31b0 00000000 82c12808 nt!IoReportTargetDeviceChange+0x16c1
8ac37be0 828de466 845c04d0 00000001 85bca8e0 nt!IoReportTargetDeviceChange+0x1643
8ac37c0c 82ac6a85 85a1d070 00000001 00000000 nt!IoTranslateBusAddress+0x3e7
8ac37cc4 829c1bae 8ac37cf4 00000000 962e93f0 nt!IoReportTargetDeviceChange+0x56b1
8ac37cdc 829bbfb7 00000000 85ed0568 845d2d48 nt!RtlGetGroupSecurityDescriptor+0x53e
8ac37d00 8286b043 85ed0568 00000000 845d2d48 nt!IoCreateDevice+0xbce
8ac37d50 829f7d16 00000001 c46e69d0 00000000 nt!KeInsertQueueDpc+0x36e
8ac37d90 82899159 8286af36 00000001 00000000 nt!PsGetProcessSecurityPort+0xb5
00000000 00000000 00000000 00000000 00000000 nt!KeTestAlertThread+0x15a
STACK_COMMAND: kb
FOLLOWUP_IP:
volsnap+2faa4
885e8aa4 e9f6feffff jmp volsnap+0x2f99f (885e899f)
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: volsnap+2faa4
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: volsnap.sys
BUCKET_ID: WRONG_SYMBOLS