Bugcheck Analysis

June_Barkan · March 24, 2009, 10:49am

I as wondering if I may get some assistance for this crash… (The Trend Firewall driver has been disabled)

Loading Dump File [C:\Documents and Settings\jbarkan\Desktop\Mini032309-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) UP Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.080813-1204
Kernel base = 0x80800000 PsLoadedModuleList = 0x8089ffa8
Debug session time: Mon Mar 23 15:14:24.474 2009 (GMT-4)
System Uptime: 19 days 20:36:13.218
Loading Kernel Symbols
…
Loading User Symbols
Loading unloaded module list
…
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck CB, {f6a4b2f2, f6a4fd2d, 852e4d48, 2}

Probably caused by : afd.sys ( afd!AfdAllocateMdlChain+bf )

Followup: MachineOwner

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (cb)
Caused by a driver not cleaning up completely after an I/O.
When possible, the guilty driver’s name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: f6a4b2f2, The calling address in the driver that locked the pages or if the
IO manager locked the pages this points to the dispatch routine of
the top driver on the stack to which the IRP was sent.
Arg2: f6a4fd2d, The caller of the calling address in the driver that locked the
pages. If the IO manager locked the pages this points to the device
object of the top driver on the stack to which the IRP was sent.
Arg3: 852e4d48, A pointer to the MDL containing the locked pages.
Arg4: 00000002, The number of locked pages.

Debugging Details:

FAULTING_IP:
afd!AfdAllocateMdlChain+bf
f6a4b2f2 8b45dc mov eax,dword ptr [ebp-24h]

BUGCHECK_STR: 0xCB_MINIPORT

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

PROCESS_NAME: w3wp.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 80848f6f to 80826de7

STACK_TEXT:
f586dc38 80848f6f 000000cb f6a4b2f2 f6a4fd2d nt!KeBugCheckEx+0x1b
f586dc68 80944295 ffffff6e 85c056b8 fffffffd nt!MmCleanProcessAddressSpace+0x551
f586dcf0 80944313 fffffffd f586dd4c 8082c461 nt!PspExitThread+0x5f1
f586dcfc 8082c461 85c056b8 f586dd48 f586dd3c nt!PsExitSpecialApc+0x1d
f586dd4c 808839e0 00000001 00000000 f586dd64 nt!KiDeliverApc+0x1ab
f586dd4c 7c8285ec 00000001 00000000 f586dd64 nt!KiServiceExit+0x55
WARNING: Frame IP not in any known module. Following frames may be wrong.
01cffea4 00000000 00000000 00000000 00000000 0x7c8285ec

STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
afd!AfdAllocateMdlChain+bf
f6a4b2f2 8b45dc mov eax,dword ptr [ebp-24h]

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: afd

IMAGE_NAME: afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 48a40d20

SYMBOL_NAME: afd!AfdAllocateMdlChain+bf

FAILURE_BUCKET_ID: 0xCB_MINIPORT_afd!AfdAllocateMdlChain+bf

BUCKET_ID: 0xCB_MINIPORT_afd!AfdAllocateMdlChain+bf

Followup: MachineOwner

kd> lmvm afd
start    end        module name
f6a3c000 f6a66000   afd        (pdb symbols)          c:\websymbols\afd.pdb\58290F5DE8594177A0C88B7AD053A8C32\afd.pdb
    Loaded symbol image file: afd.sys
    Mapped memory image file: c:\websymbols\afd.sys\48A40D202a000\afd.sys
    Image path: afd.sys
    Image name: afd.sys
    Timestamp:        Thu Aug 14 06:46:56 2008 (48A40D20)
    CheckSum:         00029DE7
    ImageSize:        0002A000
    File version:     5.2.3790.4355
    Product version: 5.2.3790.4355
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     afd.sys
    OriginalFilename: afd.sys
    ProductVersion:   5.2.3790.4355
    FileVersion:      5.2.3790.4355 (srv03_sp2_gdr.080814-1204)
    FileDescription: Ancillary Function Driver for WinSock
    LegalCopyright:   © Microsoft Corporation. All rights reserved.