Does this exception look familiar?

I’ve gotten this exception several times and I cannot make any sense out of
it. Has anyone seen anything like this? Any idea of what I’m doing wrong
in my mini-filter to cause this?

All I can tell is that svchost.exe is trying to close an invalid handle, and
I don’t know how I could make a user handle invallid.

*** Unhandled exception 0xc0000008, hit in
D:\WINDOWS\System32\svchost.exe -k netsvcs:
Break instruction exception - code 80000003 (first chance)
ntdll!DbgBreakPoint:
001b:7c834214 cc int 3

kd> .exr 0x01A4FC28
ExceptionAddress: 7c83466f (ntdll!KiRaiseUserExceptionDispatcher+0x00000037)
ExceptionCode: c0000008 (Invalid handle)
ExceptionFlags: 00000000
NumberParameters: 0
Thread tried to close a handle that was invalid or illegal to close

kd> .cxr 0x01A4FC3C
eax=c0000008 ebx=00000000 ecx=01a4ff5c edx=7c834638 esi=016ca3f8
edi=0169ecc0
eip=7c83466f esp=01a4ff08 ebp=01a4ff58 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntdll!KiRaiseUserExceptionDispatcher+0x37:
001b:7c83466f 8b0424 mov eax,[esp]

kd> kb
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr Args to Child
01a4ff58 7c834683 7c80ebd4 77e5c212 0000123c
ntdll!KiRaiseUserExceptionDispatcher+0x37
01a4ff5c 7c80ebd4 77e5c212 0000123c 00000000 ntdll!KiFastSystemCall+0x3
01a4ff60 77e5c212 0000123c 00000000 01a4ffac ntdll!NtSetEvent+0xc
01a4ff70 4b9cff93 0000123c 00000000 00000000 kernel32!SetEvent+0x10
01a4ffac 4b9d0265 01a4ffec 77e5deaa 0169ecc0
wscsvc!CThirdPartyMonitoring::MonitoringThreadProc+0x42d
01a4ffb4 77e5deaa 0169ecc0 00000000 00000000
wscsvc!CThirdPartyMonitoring::MonitoringThreadProcEntry+0x21
01a4ffec 00000000 4b9d0244 0169ecc0 00000000 kernel32!BaseThreadStart+0x37

Another clue:

I got a “not supported” error from FltGetStreamContext when
FileObject->FileName was \wkssvc. Usually I only see this error on paging
files. I don’t know if netsvcs is related to wkssvc or not.

“Mark Hahn” wrote in message news:xxxxx@ntfsd…
> I’ve gotten this exception several times and I cannot make any sense out
> of it. Has anyone seen anything like this? Any idea of what I’m doing
> wrong in my mini-filter to cause this?
>
> All I can tell is that svchost.exe is trying to close an invalid handle,
> and I don’t know how I could make a user handle invallid.
>
> Unhandled exception 0xc0000008, hit in
> D:\WINDOWS\System32\svchost.exe -k netsvcs:
> Break instruction exception - code 80000003 (first chance)
> ntdll!DbgBreakPoint:
> 001b:7c834214 cc int 3
>
> kd> .exr 0x01A4FC28
> ExceptionAddress: 7c83466f
> (ntdll!KiRaiseUserExceptionDispatcher+0x00000037)
> ExceptionCode: c0000008 (Invalid handle)
> ExceptionFlags: 00000000
> NumberParameters: 0
> Thread tried to close a handle that was invalid or illegal to close
>
> kd> .cxr 0x01A4FC3C
> eax=c0000008 ebx=00000000 ecx=01a4ff5c edx=7c834638 esi=016ca3f8
> edi=0169ecc0
> eip=7c83466f esp=01a4ff08 ebp=01a4ff58 iopl=0 nv up ei pl nz na pe nc
> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
> ntdll!KiRaiseUserExceptionDispatcher+0x37:
> 001b:7c83466f 8b0424 mov eax,[esp]
>
> kd> kb
>
Stack trace for last set context - .thread/.cxr resets it
> ChildEBP RetAddr Args to Child
> 01a4ff58 7c834683 7c80ebd4 77e5c212 0000123c
> ntdll!KiRaiseUserExceptionDispatcher+0x37
> 01a4ff5c 7c80ebd4 77e5c212 0000123c 00000000 ntdll!KiFastSystemCall+0x3
> 01a4ff60 77e5c212 0000123c 00000000 01a4ffac ntdll!NtSetEvent+0xc
> 01a4ff70 4b9cff93 0000123c 00000000 00000000 kernel32!SetEvent+0x10
> 01a4ffac 4b9d0265 01a4ffec 77e5deaa 0169ecc0
> wscsvc!CThirdPartyMonitoring::MonitoringThreadProc+0x42d
> 01a4ffb4 77e5deaa 0169ecc0 00000000 00000000
> wscsvc!CThirdPartyMonitoring::MonitoringThreadProcEntry+0x21
> 01a4ffec 00000000 4b9d0244 0169ecc0 00000000 kernel32!BaseThreadStart+0x37
>
>