DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION error

NTDEV
1

I get an DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION error on usb stack. How can I detect which driver is a real cause of error? Can driver verifier help with this?

Thanks,
Tigran.

2

If the driver can be identified, KiBugCheckDriver points to the name of
the driver (PUNICODE_STRING). It may not be possible to identify the
driver, so the pointer may be invalid. So, with WinDbg connected, after
the crash and an !analyze -v, display the Buffer du.

I believe that you will only see this bug check with DV enabled.

Good luck,

mm

xxxxx@yahoo.com wrote:

I get an DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION error on usb stack. How can I detect which driver is a real cause of error? Can driver verifier help with this?

Thanks,
Tigran.

3

What function is KiBugCheckDriver, where should I call it?

I believe that you will only see this bug check with DV enabled.

What does it mean?

Thanks,
Tigran

4

KiBugCheckDriver is a kernel variable, not a function. It is a
UNICODE_STRING *, and if it is valid, it may contain the name of the
driver that caused the bugcheck. If so, if you use du on the ‘Buffer’
member, you can dump the driver name. However, nothing about this is
guaranteed; KiBugCheckDriver can be NULL or perhaps garbage.

It means that you should be seeing this bugcheck unless you have turned
on driver verifier. I think that this is correct, but I’m completely
certain. I don’t think that this answer will help you much, but I don’t
really know what else to say about it, except that it usually involves
typing “verifier” on a command line.

Good luck,

mm

xxxxx@yahoo.com wrote:

What function is KiBugCheckDriver, where should I call it?

> I believe that you will only see this bug check with DV enabled.

What does it mean?

Thanks,
Tigran

5

One more time. This:

It means that you should be seeing this bugcheck

should read

It means that you should not be seeing this bugcheck unless

Good luck,

mm

Martin O’Brien wrote:

KiBugCheckDriver is a kernel variable, not a function. It is a
UNICODE_STRING *, and if it is valid, it may contain the name of the
driver that caused the bugcheck. If so, if you use du on the ‘Buffer’
member, you can dump the driver name. However, nothing about this is
guaranteed; KiBugCheckDriver can be NULL or perhaps garbage.

It means that you should be seeing this bugcheck unless you have turned
on driver verifier. I think that this is correct, but I’m completely
certain. I don’t think that this answer will help you much, but I don’t
really know what else to say about it, except that it usually involves
typing “verifier” on a command line.

Good luck,

mm

xxxxx@yahoo.com wrote:
> What function is KiBugCheckDriver, where should I call it?
>
>> I believe that you will only see this bug check with DV enabled.
>
> What does it mean?
>
> Thanks,
> Tigran