Crash in Ntoskrnl.exe

WINDBG
1

Hello All,

I am getting a NT trap (IRQL_NOT_LESS_OR_EQUAL) in Ntoskrnl.exe (at
0x8013d949). Stack from WinDbg shows only 4 lines having KiRetireDpcList as
the culprit code and nothing below that.

Although I have my driver (which I am suspecting to be the culprit), the bad
thing about this trap is that in the stack traces in the BSOD is not
consistent. I mean to say that in the stack traces some it shows one driver
and next time it shows another driver.

Is there any method by which I know which driver is creating the problem ?

Thanks in advance

  • Vipul

You are currently subscribed to windbg as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-windbg-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

You can go ripping thru the stack either manually or using “analyzebugcheck
-v” A major cause for this is using spin locks poorly or not at all. If you
haven’t done so, upgrade WinDbg to version 3.00.0020.

Gary G. Little
Staff Engineer
Broadband Storage, Inc.
xxxxx@broadstor.com

-----Original Message-----
From: Vipul Jain [mailto:xxxxx@fvc.com]
Sent: Wednesday, September 19, 2001 2:58 PM
To: Kernel Debugging Interest List
Subject: [windbg] Crash in Ntoskrnl.exe

Hello All,

I am getting a NT trap (IRQL_NOT_LESS_OR_EQUAL) in Ntoskrnl.exe (at
0x8013d949). Stack from WinDbg shows only 4 lines having KiRetireDpcList as
the culprit code and nothing below that.

Although I have my driver (which I am suspecting to be the culprit), the bad
thing about this trap is that in the stack traces in the BSOD is not
consistent. I mean to say that in the stack traces some it shows one driver
and next time it shows another driver.

Is there any method by which I know which driver is creating the problem ?

Thanks in advance

  • Vipul

You are currently subscribed to windbg as: xxxxx@broadstor.com
To unsubscribe send a blank email to leave-windbg-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to windbg as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-windbg-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

For memory access violation cases, you can use the tool gflags.exe and turn
on kernel special pool overRun detection.

Suifun

Gary Little

> cc:
Sent by: Subject: [windbg] RE: Crash in Ntoskrnl.exe
xxxxx@lis
ts.osr.com

09/19/2001 03:12 PM
Please respond to
“Kernel Debugging
Interest List”

You can go ripping thru the stack either manually or using “analyzebugcheck
-v” A major cause for this is using spin locks poorly or not at all. If you
haven’t done so, upgrade WinDbg to version 3.00.0020.

Gary G. Little
Staff Engineer
Broadband Storage, Inc.
xxxxx@broadstor.com

-----Original Message-----
From: Vipul Jain [mailto:xxxxx@fvc.com]
Sent: Wednesday, September 19, 2001 2:58 PM
To: Kernel Debugging Interest List
Subject: [windbg] Crash in Ntoskrnl.exe

Hello All,

I am getting a NT trap (IRQL_NOT_LESS_OR_EQUAL) in Ntoskrnl.exe (at
0x8013d949). Stack from WinDbg shows only 4 lines having KiRetireDpcList as
the culprit code and nothing below that.

Although I have my driver (which I am suspecting to be the culprit), the
bad
thing about this trap is that in the stack traces in the BSOD is not
consistent. I mean to say that in the stack traces some it shows one driver
and next time it shows another driver.

Is there any method by which I know which driver is creating the problem ?

Thanks in advance
- Vipul

—
You are currently subscribed to windbg as: xxxxx@broadstor.com
To unsubscribe send a blank email to leave-windbg-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to windbg as: suifun@us.ibm.com
To unsubscribe send a blank email to leave-windbg-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to windbg as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-windbg-$subst(‘Recip.MemberIDChar’)@lists.osr.com