BugCheck Problem

NTFSD
1

Hi All,

I have probelm with my filter driver running, my filter driver intecept the
file open request, it works fine for the small files, but if the file over
2GB, sometime it got the bugcheck as following, anyone know how to analize
this bugcheck?

Thanks

Bin

*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 808930e3, The address that the exception occurred at
Arg3: b902e380, Trap Frame
Arg4: 00000000

Debugging Details:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExAllocatePoolWithTag+56b
808930e3 897904 mov [ecx+0x4],edi

TRAP_FRAME: b902e380 -- (.trap ffffffffb902e380)
ErrCode = 00000003
eax=746e0005 ebx=808aeae0 ecx=746e4953 edx=00000000 esi=000001ff
edi=7453624f
eip=808930e3 esp=b902e3f4 ebp=b902e430 iopl=0 nv up ei pl zr na po
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
nt!ExAllocatePoolWithTag+0x56b:
808930e3 897904 mov [ecx+0x4],edi
ds:0023:746e4957=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x8E

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 80932d2e to 808930e3

STACK_TEXT:
b902e430 80932d2e 00000000 f772f120 7453624f nt!ExAllocatePoolWithTag+0x56b
b902e460 808ebb57 00bceb64 00000000 b902e501 nt!ObOpenObjectByName+0x32
b902e5e4 80888c6c 00bceb64 00bceb3c 00bceb94 nt!NtQueryAttributesFile+0x11d
b902e5e4 7c82ed54 00bceb64 00bceb3c 00bceb94 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00bceb94 00000000 00000000 00000000 00000000 0x7c82ed54

FOLLOWUP_IP:
nt!ExAllocatePoolWithTag+56b
808930e3 897904 mov [ecx+0x4],edi

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!ExAllocatePoolWithTag+56b

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42435b14

STACK_COMMAND: .trap ffffffffb902e380 ; kb

FAILURE_BUCKET_ID: 0x8E_nt!ExAllocatePoolWithTag+56b

BUCKET_ID: 0x8E_nt!ExAllocatePoolWithTag+56b

Followup: MachineOwner

2

You likely have a use-after-free memory error that has corrupted the
free list in the non-paged pool (frequently crashes in ExAllocatePool or
ExFreePool and variants are caused because of an error prior to the call
that triggers the bug check.)

I'd suggest running this with driver verifier (specifically "special
pool") and/or on W2K3SP1 (which has overrun detection even without
verifier.) That is likely to highlight the problem.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Bin Zeng
Sent: Wednesday, June 07, 2006 5:11 PM
To: ntfsd redirect
Subject: [ntfsd] BugCheck Problem

Hi All,

I have probelm with my filter driver running, my filter driver intecept
the
file open request, it works fine for the small files, but if the file
over
2GB, sometime it got the bugcheck as following, anyone know how to
analize
this bugcheck?

Thanks

Bin

************************************************************************
*******
*

*
* Bugcheck Analysis

*
*

*
************************************************************************
*******

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never
have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 808930e3, The address that the exception occurred at
Arg3: b902e380, Trap Frame
Arg4: 00000000

Debugging Details:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExAllocatePoolWithTag+56b
808930e3 897904 mov [ecx+0x4],edi

TRAP_FRAME: b902e380 -- (.trap ffffffffb902e380)
ErrCode = 00000003
eax=746e0005 ebx=808aeae0 ecx=746e4953 edx=00000000 esi=000001ff
edi=7453624f
eip=808930e3 esp=b902e3f4 ebp=b902e430 iopl=0 nv up ei pl zr na
po
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
nt!ExAllocatePoolWithTag+0x56b:
808930e3 897904 mov [ecx+0x4],edi
ds:0023:746e4957=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x8E

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 80932d2e to 808930e3

STACK_TEXT:
b902e430 80932d2e 00000000 f772f120 7453624f
nt!ExAllocatePoolWithTag+0x56b
b902e460 808ebb57 00bceb64 00000000 b902e501 nt!ObOpenObjectByName+0x32
b902e5e4 80888c6c 00bceb64 00bceb3c 00bceb94
nt!NtQueryAttributesFile+0x11d
b902e5e4 7c82ed54 00bceb64 00bceb3c 00bceb94 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be
wrong.
00bceb94 00000000 00000000 00000000 00000000 0x7c82ed54

FOLLOWUP_IP:
nt!ExAllocatePoolWithTag+56b
808930e3 897904 mov [ecx+0x4],edi

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!ExAllocatePoolWithTag+56b

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42435b14

STACK_COMMAND: .trap ffffffffb902e380 ; kb

FAILURE_BUCKET_ID: 0x8E_nt!ExAllocatePoolWithTag+56b

BUCKET_ID: 0x8E_nt!ExAllocatePoolWithTag+56b

Followup: MachineOwner

Questions? First check the IFS FAQ at

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Hi,Tony

Thanks for you reply, very appreciated.

i tried to run with driver driver verifier (specifically "special

pool") , it didn’t get memory dump, but if i remove the driver verifier, it
got dump.

And my computer is running on windows 2003 sp1.

The IMAGE_NAME: ntkrpamp.exe cause the bugcheck, why not my filter driver
cause the
bugcheck?

Any suggestion?

Thanks

Bin

From: “Tony Mason”
>Reply-To: “Windows File Systems Devs Interest List”
>To: “Windows File Systems Devs Interest List”
>Subject: RE: [ntfsd] BugCheck Problem
>Date: Wed, 7 Jun 2006 17:21:53 -0400
>
>You likely have a use-after-free memory error that has corrupted the
>free list in the non-paged pool (frequently crashes in ExAllocatePool or
>ExFreePool and variants are caused because of an error prior to the call
>that triggers the bug check.)
>
>I’d suggest running this with driver verifier (specifically “special
>pool”) and/or on W2K3SP1 (which has overrun detection even without
>verifier.) That is likely to highlight the problem.
>
>Regards,
>
>Tony
>
>Tony Mason
>Consulting Partner
>OSR Open Systems Resources, Inc.
>http://www.osr.com
>
>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com] On Behalf Of Bin Zeng
>Sent: Wednesday, June 07, 2006 5:11 PM
>To: ntfsd redirect
>Subject: [ntfsd] BugCheck Problem
>
>Hi All,
>
>I have probelm with my filter driver running, my filter driver intecept
>the
>file open request, it works fine for the small files, but if the file
>over
>2GB, sometime it got the bugcheck as following, anyone know how to
>analize
>this bugcheck?
>
>Thanks
>
>Bin
>
>
> ****************************************************************
>
>
>
>
> Bugcheck Analysis
>
>
>
>
> *
> *****************************************************************
>
>
>KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
>This is a very common bugcheck. Usually the exception address pinpoints
>the driver/function that caused the problem. Always note this address
>as well as the link date of the driver/image that contains this address.
>Some common problems are exception code 0x80000003. This means a hard
>coded breakpoint or assertion was hit, but this system was booted
>/NODEBUG. This is not supposed to happen as developers should never
>have
>hardcoded breakpoints in retail code, but …
>If this happens, make sure a debugger gets connected, and the
>system is booted /DEBUG. This will let us see why this breakpoint is
>happening.
>Arguments:
>Arg1: c0000005, The exception code that was not handled
>Arg2: 808930e3, The address that the exception occurred at
>Arg3: b902e380, Trap Frame
>Arg4: 00000000
>
>Debugging Details:
>------------------
>
>
>EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at “0x%08lx”
>referenced memory at “0x%08lx”. The memory could not be “%s”.
>
>FAULTING_IP:
>nt!ExAllocatePoolWithTag+56b
>808930e3 897904 mov [ecx+0x4],edi
>
>TRAP_FRAME: b902e380 – (.trap ffffffffb902e380)
>ErrCode = 00000003
>eax=746e0005 ebx=808aeae0 ecx=746e4953 edx=00000000 esi=000001ff
>edi=7453624f
>eip=808930e3 esp=b902e3f4 ebp=b902e430 iopl=0 nv up ei pl zr na
>po
>nc
>cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
>efl=00010246
>nt!ExAllocatePoolWithTag+0x56b:
>808930e3 897904 mov [ecx+0x4],edi
>ds:0023:746e4957=???
>Resetting default scope
>
>CUSTOMER_CRASH_COUNT: 1
>
>DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
>
>BUGCHECK_STR: 0x8E
>
>CURRENT_IRQL: 0
>
>LAST_CONTROL_TRANSFER: from 80932d2e to 808930e3
>
>STACK_TEXT:
>b902e430 80932d2e 00000000 f772f120 7453624f
>nt!ExAllocatePoolWithTag+0x56b
>b902e460 808ebb57 00bceb64 00000000 b902e501 nt!ObOpenObjectByName+0x32
>b902e5e4 80888c6c 00bceb64 00bceb3c 00bceb94
>nt!NtQueryAttributesFile+0x11d
>b902e5e4 7c82ed54 00bceb64 00bceb3c 00bceb94 nt!KiFastCallEntry+0xfc
>WARNING: Frame IP not in any known module. Following frames may be
>wrong.
>00bceb94 00000000 00000000 00000000 00000000 0x7c82ed54
>
>
>FOLLOWUP_IP:
>nt!ExAllocatePoolWithTag+56b
>808930e3 897904 mov [ecx+0x4],edi
>
>SYMBOL_STACK_INDEX: 0
>
>FOLLOWUP_NAME: MachineOwner
>
>SYMBOL_NAME: nt!ExAllocatePoolWithTag+56b
>
>MODULE_NAME: nt
>
>IMAGE_NAME: ntkrpamp.exe
>
>DEBUG_FLR_IMAGE_TIMESTAMP: 42435b14
>
>STACK_COMMAND: .trap ffffffffb902e380 ; kb
>
>FAILURE_BUCKET_ID: 0x8E_nt!ExAllocatePoolWithTag+56b
>
>BUCKET_ID: 0x8E_nt!ExAllocatePoolWithTag+56b
>
>Followup: MachineOwner
>---------
>
>
>
>—
>Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@osr.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>—
>Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>To unsubscribe send a blank email to xxxxx@lists.osr.com

4

The sequence probably looks something like:

ExFreePool(blockOfMemory);

// somewhere else

blockOfMemory->Foo = ;

This can cause that sort of corruption. But the system doesn’t crash
when you set the value - it crashes later when someone accesses the
memory over which you’ve written.

When you say “it didn’t get a memory dump” do you mean “the system
crashed but a crash dump was not produced” or do you mean “it does not
crash”. If it is the latter, I’d suggest running it on a uni-processor.
There are some memory checks disabled on the MP systems that are enabled
on a UP system; when you enable verifier on your driver you may change
the behavior of the system sufficiently that you aren’t seeing quite the
same behavior.

If you just aren’t getting a crash dump, but the system is crashing, you
will need to hook up a debugger to observe the system directly.

Another thing to do is to look at the memory location that is crashing
(“!pool ” in WinDBG) and see if you recognize the memory tags
around the location that was corrupted. There is not guarantee that
this will identify the problem, but if you see one of your tags you can
look back at your driver code to review your specific code.

Memory corruption problems can be frustrating to track down and fix,
unfortunately. Tools like verifier help, but are not a 100% solution
for finding such issues.

Best of luck debugging your driver.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Bin Zeng
Sent: Wednesday, June 07, 2006 10:35 PM
To: ntfsd redirect
Subject: RE: [ntfsd] BugCheck Problem

Hi,Tony

Thanks for you reply, very appreciated.

i tried to run with driver driver verifier (specifically “special
>pool”) , it didn’t get memory dump, but if i remove the driver
verifier, it
>got dump.

And my computer is running on windows 2003 sp1.

The IMAGE_NAME: ntkrpamp.exe cause the bugcheck, why not my filter
driver
cause the
bugcheck?

Any suggestion?

Thanks

Bin

>From: “Tony Mason”
>Reply-To: “Windows File Systems Devs Interest List”

>To: “Windows File Systems Devs Interest List”
>Subject: RE: [ntfsd] BugCheck Problem
>Date: Wed, 7 Jun 2006 17:21:53 -0400
>
>You likely have a use-after-free memory error that has corrupted the
>free list in the non-paged pool (frequently crashes in ExAllocatePool
or
>ExFreePool and variants are caused because of an error prior to the
call
>that triggers the bug check.)
>
>I’d suggest running this with driver verifier (specifically “special
>pool”) and/or on W2K3SP1 (which has overrun detection even without
>verifier.) That is likely to highlight the problem.
>
>Regards,
>
>Tony
>
>Tony Mason
>Consulting Partner
>OSR Open Systems Resources, Inc.
>http://www.osr.com
>
>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com] On Behalf Of Bin Zeng
>Sent: Wednesday, June 07, 2006 5:11 PM
>To: ntfsd redirect
>Subject: [ntfsd] BugCheck Problem
>
>Hi All,
>
>I have probelm with my filter driver running, my filter driver intecept
>the
>file open request, it works fine for the small files, but if the file
>over
>2GB, sometime it got the bugcheck as following, anyone know how to
>analize
>this bugcheck?
>
>Thanks
>
>Bin
>
>
> ***********************************************************

>
>
>
>
> Bugcheck Analysis
>
>
>
>
>
> ***********************************************************************

>
>
>KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
>This is a very common bugcheck. Usually the exception address
pinpoints
>the driver/function that caused the problem. Always note this address
>as well as the link date of the driver/image that contains this
address.
>Some common problems are exception code 0x80000003. This means a hard
>coded breakpoint or assertion was hit, but this system was booted
>/NODEBUG. This is not supposed to happen as developers should never
>have
>hardcoded breakpoints in retail code, but …
>If this happens, make sure a debugger gets connected, and the
>system is booted /DEBUG. This will let us see why this breakpoint is
>happening.
>Arguments:
>Arg1: c0000005, The exception code that was not handled
>Arg2: 808930e3, The address that the exception occurred at
>Arg3: b902e380, Trap Frame
>Arg4: 00000000
>
>Debugging Details:
>------------------
>
>
>EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at “0x%08lx”
>referenced memory at “0x%08lx”. The memory could not be “%s”.
>
>FAULTING_IP:
>nt!ExAllocatePoolWithTag+56b
>808930e3 897904 mov [ecx+0x4],edi
>
>TRAP_FRAME: b902e380 – (.trap ffffffffb902e380)
>ErrCode = 00000003
>eax=746e0005 ebx=808aeae0 ecx=746e4953 edx=00000000 esi=000001ff
>edi=7453624f
>eip=808930e3 esp=b902e3f4 ebp=b902e430 iopl=0 nv up ei pl zr na
>po
>nc
>cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
>efl=00010246
>nt!ExAllocatePoolWithTag+0x56b:
>808930e3 897904 mov [ecx+0x4],edi
>ds:0023:746e4957=???
>Resetting default scope
>
>CUSTOMER_CRASH_COUNT: 1
>
>DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
>
>BUGCHECK_STR: 0x8E
>
>CURRENT_IRQL: 0
>
>LAST_CONTROL_TRANSFER: from 80932d2e to 808930e3
>
>STACK_TEXT:
>b902e430 80932d2e 00000000 f772f120 7453624f
>nt!ExAllocatePoolWithTag+0x56b
>b902e460 808ebb57 00bceb64 00000000 b902e501 nt!ObOpenObjectByName+0x32
>b902e5e4 80888c6c 00bceb64 00bceb3c 00bceb94
>nt!NtQueryAttributesFile+0x11d
>b902e5e4 7c82ed54 00bceb64 00bceb3c 00bceb94 nt!KiFastCallEntry+0xfc
>WARNING: Frame IP not in any known module. Following frames may be
>wrong.
>00bceb94 00000000 00000000 00000000 00000000 0x7c82ed54
>
>
>FOLLOWUP_IP:
>nt!ExAllocatePoolWithTag+56b
>808930e3 897904 mov [ecx+0x4],edi
>
>SYMBOL_STACK_INDEX: 0
>
>FOLLOWUP_NAME: MachineOwner
>
>SYMBOL_NAME: nt!ExAllocatePoolWithTag+56b
>
>MODULE_NAME: nt
>
>IMAGE_NAME: ntkrpamp.exe
>
>DEBUG_FLR_IMAGE_TIMESTAMP: 42435b14
>
>STACK_COMMAND: .trap ffffffffb902e380 ; kb
>
>FAILURE_BUCKET_ID: 0x8E_nt!ExAllocatePoolWithTag+56b
>
>BUCKET_ID: 0x8E_nt!ExAllocatePoolWithTag+56b
>
>Followup: MachineOwner
>---------
>
>
>
>—
>Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@osr.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>—
>Questions? First check the IFS FAQ at
>https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
>To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Memory corruption. Run the driver with Verifier and look at the BSODs which
will be produced by Verifier, it will help a lot.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Bin Zeng”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, June 08, 2006 1:10 AM
Subject: [ntfsd] BugCheck Problem

> Hi All,
>
> I have probelm with my filter driver running, my filter driver intecept the
> file open request, it works fine for the small files, but if the file over
> 2GB, sometime it got the bugcheck as following, anyone know how to analize
> this bugcheck?
>
> Thanks
>
> Bin
>
>
>
*****
>
>
> * Bugcheck Analysis
>
>
>
>
>
> KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
> This is a very common bugcheck. Usually the exception address pinpoints
> the driver/function that caused the problem. Always note this address
> as well as the link date of the driver/image that contains this address.
> Some common problems are exception code 0x80000003. This means a hard
> coded breakpoint or assertion was hit, but this system was booted
> /NODEBUG. This is not supposed to happen as developers should never have
> hardcoded breakpoints in retail code, but …
> If this happens, make sure a debugger gets connected, and the
> system is booted /DEBUG. This will let us see why this breakpoint is
> happening.
> Arguments:
> Arg1: c0000005, The exception code that was not handled
> Arg2: 808930e3, The address that the exception occurred at
> Arg3: b902e380, Trap Frame
> Arg4: 00000000
>
> Debugging Details:
> ------------------
>
>
> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at “0x%08lx”
> referenced memory at “0x%08lx”. The memory could not be “%s”.
>
> FAULTING_IP:
> nt!ExAllocatePoolWithTag+56b
> 808930e3 897904 mov [ecx+0x4],edi
>
> TRAP_FRAME: b902e380 – (.trap ffffffffb902e380)
> ErrCode = 00000003
> eax=746e0005 ebx=808aeae0 ecx=746e4953 edx=00000000 esi=000001ff
> edi=7453624f
> eip=808930e3 esp=b902e3f4 ebp=b902e430 iopl=0 nv up ei pl zr na po
> nc
> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> efl=00010246
> nt!ExAllocatePoolWithTag+0x56b:
> 808930e3 897904 mov [ecx+0x4],edi
> ds:0023:746e4957=???
> Resetting default scope
>
> CUSTOMER_CRASH_COUNT: 1
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
>
> BUGCHECK_STR: 0x8E
>
> CURRENT_IRQL: 0
>
> LAST_CONTROL_TRANSFER: from 80932d2e to 808930e3
>
> STACK_TEXT:
> b902e430 80932d2e 00000000 f772f120 7453624f nt!ExAllocatePoolWithTag+0x56b
> b902e460 808ebb57 00bceb64 00000000 b902e501 nt!ObOpenObjectByName+0x32
> b902e5e4 80888c6c 00bceb64 00bceb3c 00bceb94 nt!NtQueryAttributesFile+0x11d
> b902e5e4 7c82ed54 00bceb64 00bceb3c 00bceb94 nt!KiFastCallEntry+0xfc
> WARNING: Frame IP not in any known module. Following frames may be wrong.
> 00bceb94 00000000 00000000 00000000 00000000 0x7c82ed54
>
>
> FOLLOWUP_IP:
> nt!ExAllocatePoolWithTag+56b
> 808930e3 897904 mov [ecx+0x4],edi
>
> SYMBOL_STACK_INDEX: 0
>
> FOLLOWUP_NAME: MachineOwner
>
> SYMBOL_NAME: nt!ExAllocatePoolWithTag+56b
>
> MODULE_NAME: nt
>
> IMAGE_NAME: ntkrpamp.exe
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 42435b14
>
> STACK_COMMAND: .trap ffffffffb902e380 ; kb
>
> FAILURE_BUCKET_ID: 0x8E_nt!ExAllocatePoolWithTag+56b
>
> BUCKET_ID: 0x8E_nt!ExAllocatePoolWithTag+56b
>
> Followup: MachineOwner
> ---------
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com