Driver Verifier BSOD

NTDEV
1

Hi all,

I am having trouble using the Driver Verifer. My system is running W2k
SP3. I first tried to enable the Driver Verifier for my driver. As soon as
I rebooted, I got a blue screen during reboot. This surprised me because
my driver wasn’t even loading at boot time. The blue screen was as
follows. I tried booting in safe mode to get rid of the Verifier, and I
still got the blue screen. I was finally able to get the system running
again by booting the last known good configuration.

So, I tried usind the Driver Verifier on the null device (I figured that
had to work right). When I rebooted, I got the same blue screen. It seems
that if I am trying to use the Verifier on any driver, I get a blue screen
at boot, even in safe mode. The blue screen I get is shown below.

0x000000d5 (0xb7292f38, 0x00000000, 0xeb50eb2D, 0x00000000)

Can anyone offer advice / help with this. I am not sure how to even
proceed at this point, other than to abandon the verifier.

Thanks in advance,

Don

2

Bug Check 0xD5: DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL
The DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL bug check has a value of
0x000000D5. This indicates that a driver has referenced memory which was
earlier freed.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read 1: Write
3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is
printed on the blue screen and stored in memory at the location
(PUNICODE_STRING) KiBugCheckDriver.

Did you try analyze -v? Did you enable DV for all drivers? Do you have a
stack frame with the correct symbols? Did you look in the DDK for this
bugcheck? DO you have a debugger attached to the system?

=====================
Mark Roddy
Hollis Technology Solutions
www.hollistech.com
xxxxx@hollistech.com

-----Original Message-----
From: Don Edvalson [mailto:xxxxx@pinnaclesys.com]
Sent: Thursday, July 17, 2003 2:04 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] Driver Verifier BSOD

Hi all,

I am having trouble using the Driver Verifer. My system is running W2k SP3.
I first tried to enable the Driver Verifier for my driver. As soon as I
rebooted, I got a blue screen during reboot. This surprised me because my
driver wasn’t even loading at boot time. The blue screen was as follows. I
tried booting in safe mode to get rid of the Verifier, and I still got the
blue screen. I was finally able to get the system running again by booting
the last known good configuration.

So, I tried usind the Driver Verifier on the null device (I figured that had
to work right). When I rebooted, I got the same blue screen. It seems that
if I am trying to use the Verifier on any driver, I get a blue screen at
boot, even in safe mode. The blue screen I get is shown below.

0x000000d5 (0xb7292f38, 0x00000000, 0xeb50eb2D, 0x00000000)

Can anyone offer advice / help with this. I am not sure how to even proceed
at this point, other than to abandon the verifier.

Thanks in advance,

Don

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

3

Oh, and it would appear that some other driver is corrupting pool, and dv is
detecting it.

=====================
Mark Roddy
Hollis Technology Solutions
www.hollistech.com
xxxxx@hollistech.com

-----Original Message-----
From: Don Edvalson [mailto:xxxxx@pinnaclesys.com]
Sent: Thursday, July 17, 2003 2:04 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] Driver Verifier BSOD

Hi all,

I am having trouble using the Driver Verifer. My system is running W2k SP3.
I first tried to enable the Driver Verifier for my driver. As soon as I
rebooted, I got a blue screen during reboot. This surprised me because my
driver wasn’t even loading at boot time. The blue screen was as follows. I
tried booting in safe mode to get rid of the Verifier, and I still got the
blue screen. I was finally able to get the system running again by booting
the last known good configuration.

So, I tried usind the Driver Verifier on the null device (I figured that had
to work right). When I rebooted, I got the same blue screen. It seems that
if I am trying to use the Verifier on any driver, I get a blue screen at
boot, even in safe mode. The blue screen I get is shown below.

0x000000d5 (0xb7292f38, 0x00000000, 0xeb50eb2D, 0x00000000)

Can anyone offer advice / help with this. I am not sure how to even proceed
at this point, other than to abandon the verifier.

Thanks in advance,

Don

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

4

Mark,

Thanks for your response. In answer to your questions,

I did not enable DV for all drivers. First I enabled it only for my
driver. When that Bug Checked, I enabled it only for the NULL driver. That
bug checked also.

Unfortunately, the Bug Check is not leaving a dump behind, so I can’t do a
post mortem kind of analysis.

Now I seem to have myself in even worst trouble. Since I tried enabling DV
for the Null driver, I can’t get my machine to boot at all. Safe mode,
last known working mode, etc. all get the same blue screen. I can get a
recovery console to run, but that doesn’t get me into the registry to turn
off DV.

I have Soft Ice on the system, but now I can’t get it to boot far enough
to use it.

Any Ideas?

Don

Bug Check 0xD5: DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL
The DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL bug check has a value of
0x000000D5. This indicates that a driver has referenced memory which was
earlier freed.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read 1: Write
3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is
printed on the blue screen and stored in memory at the location
(PUNICODE_STRING) KiBugCheckDriver.

Did you try analyze -v? Did you enable DV for all drivers? Do you have a
stack frame with the correct symbols? Did you look in the DDK for this
bugcheck? DO you have a debugger attached to the system?

=====================
Mark Roddy
Hollis Technology Solutions
www.hollistech.com
xxxxx@hollistech.com

-----Original Message-----
From: Don Edvalson [mailto:xxxxx@pinnaclesys.com]
Sent: Thursday, July 17, 2003 2:04 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] Driver Verifier BSOD

Hi all,

I am having trouble using the Driver Verifer. My system is running W2k SP3.
I first tried to enable the Driver Verifier for my driver. As soon as I
rebooted, I got a blue screen during reboot. This surprised me because my
driver wasn’t even loading at boot time. The blue screen was as follows. I
tried booting in safe mode to get rid of the Verifier, and I still got the
blue screen. I was finally able to get the system running again by booting
the last known good configuration.

So, I tried usind the Driver Verifier on the null device (I figured that had
to work right). When I rebooted, I got the same blue screen. It seems that
if I am trying to use the Verifier on any driver, I get a blue screen at
boot, even in safe mode. The blue screen I get is shown below.

0x000000d5 (0xb7292f38, 0x00000000, 0xeb50eb2D, 0x00000000)

Can anyone offer advice / help with this. I am not sure how to even proceed
at this point, other than to abandon the verifier.

Thanks in advance,

Don

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

5

Here is your problem:

//
// MessageId: DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL
//
// MessageText:
//
//
// The driver is attempting to access memory after it has been freed.
//
#define DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL ((ULONG)0x000000D5L)

----- Original Message -----
From: “Don Edvalson”
To: “Windows System Software Developers Interest List”
Sent: Thursday, July 17, 2003 10:03 PM
Subject: [ntdev] Driver Verifier BSOD

> Hi all,
>
> I am having trouble using the Driver Verifer. My system is running W2k
> SP3. I first tried to enable the Driver Verifier for my driver. As soon as
> I rebooted, I got a blue screen during reboot. This surprised me because
> my driver wasn’t even loading at boot time. The blue screen was as
> follows. I tried booting in safe mode to get rid of the Verifier, and I
> still got the blue screen. I was finally able to get the system running
> again by booting the last known good configuration.
>
> So, I tried usind the Driver Verifier on the null device (I figured that
> had to work right). When I rebooted, I got the same blue screen. It seems
> that if I am trying to use the Verifier on any driver, I get a blue screen
> at boot, even in safe mode. The blue screen I get is shown below.
>
> 0x000000d5 (0xb7292f38, 0x00000000, 0xeb50eb2D, 0x00000000)
>
> Can anyone offer advice / help with this. I am not sure how to even
> proceed at this point, other than to abandon the verifier.
>
> Thanks in advance,
>
> Don
>
> —
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

6

Don Edvalson wrote:

Now I seem to have myself in even worst trouble. Since I tried enabling DV
for the Null driver, I can’t get my machine to boot at all. Safe mode,
last known working mode, etc. all get the same blue screen. I can get a
recovery console to run, but that doesn’t get me into the registry to turn
off DV.

If your boot drive is FAT32, you might be able to rename the driver
that’s currently causing you a problem by booting from a DOS floppy
first.

–
Walter Oney, Consulting and Training
Basic and Advanced Driver Programming Seminars
Check out our schedule at http://www.oneysoft.com

7

Use windbg from another PC.

-----Original Message-----
From: Don Edvalson [mailto:xxxxx@pinnaclesys.com]
Sent: Thursday, July 17, 2003 2:27 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] RE: Driver Verifier BSOD

Mark,

Thanks for your response. In answer to your questions,

I did not enable DV for all drivers. First I enabled it only for my
driver. When that Bug Checked, I enabled it only for the NULL driver. That
bug checked also.

Unfortunately, the Bug Check is not leaving a dump behind, so I can’t do a
post mortem kind of analysis.

Now I seem to have myself in even worst trouble. Since I tried enabling DV
for the Null driver, I can’t get my machine to boot at all. Safe mode,
last known working mode, etc. all get the same blue screen. I can get a
recovery console to run, but that doesn’t get me into the registry to turn
off DV.

I have Soft Ice on the system, but now I can’t get it to boot far enough
to use it.

Any Ideas?

Don

Bug Check 0xD5: DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL
The DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL bug check has a value of
0x000000D5. This indicates that a driver has referenced memory which was
earlier freed.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read 1: Write
3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is
printed on the blue screen and stored in memory at the location
(PUNICODE_STRING) KiBugCheckDriver.

Did you try analyze -v? Did you enable DV for all drivers? Do you have a
stack frame with the correct symbols? Did you look in the DDK for this
bugcheck? DO you have a debugger attached to the system?

=====================
Mark Roddy
Hollis Technology Solutions
www.hollistech.com
xxxxx@hollistech.com

-----Original Message-----
From: Don Edvalson [mailto:xxxxx@pinnaclesys.com]
Sent: Thursday, July 17, 2003 2:04 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] Driver Verifier BSOD

Hi all,

I am having trouble using the Driver Verifer. My system is running W2k
SP3.
I first tried to enable the Driver Verifier for my driver. As soon as I
rebooted, I got a blue screen during reboot. This surprised me because my
driver wasn’t even loading at boot time. The blue screen was as follows. I
tried booting in safe mode to get rid of the Verifier, and I still got the
blue screen. I was finally able to get the system running again by booting
the last known good configuration.

So, I tried usind the Driver Verifier on the null device (I figured that
had
to work right). When I rebooted, I got the same blue screen. It seems that
if I am trying to use the Verifier on any driver, I get a blue screen at
boot, even in safe mode. The blue screen I get is shown below.

0x000000d5 (0xb7292f38, 0x00000000, 0xeb50eb2D, 0x00000000)

Can anyone offer advice / help with this. I am not sure how to even
proceed
at this point, other than to abandon the verifier.

Thanks in advance,

Don

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

You are currently subscribed to ntdev as: xxxxx@stratus.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

8

> > Now I seem to have myself in even worst trouble. Since I tried enabling DV

> for the Null driver, I can’t get my machine to boot at all. Safe mode,
> last known working mode, etc. all get the same blue screen. I can get a

Is WinDbg attached?

If yes, and if the driver has Boot start type, do the following:

  • wait till all boot driver binaries are reported loaded in WinDbg
  • break in just after
  • say
    !dh
  • find “Address Of Entry Point” in the printout
  • say
    a +AddressOfEntryPoint
    (prompt changes to “Input”)
    mov eax, 0xc0000001
    (lots of symbol-related prints follow)
    ret 8
    hit Enter in empty string - prompt changes back
  • say Go or F5

If the driver is non-Boot start type, the break in somewhere before it is
loaded, go to Event Filters menu and set “Load Module” to Enable. Then hit F5
till your binary is loaded. Just after that, do the operations above. Then set
“Load Module” to Output and hit F5.

This fails the driver load to the OS, the OS will boot, though will complain
about the failed driver. Then logon and delete the .SYS binary.

Max

9

If you contact our support people, they’ll tell you how to load SoftICE
before most everything else, that might help.

Alberto.

-----Original Message-----
From: Croci, MaryBeth [mailto:xxxxx@stratus.com]
Sent: Thursday, July 17, 2003 3:20 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] RE: Driver Verifier BSOD

Use windbg from another PC.

-----Original Message-----
From: Don Edvalson [mailto:xxxxx@pinnaclesys.com]
Sent: Thursday, July 17, 2003 2:27 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] RE: Driver Verifier BSOD

Mark,

Thanks for your response. In answer to your questions,

I did not enable DV for all drivers. First I enabled it only for my
driver. When that Bug Checked, I enabled it only for the NULL driver. That
bug checked also.

Unfortunately, the Bug Check is not leaving a dump behind, so I can’t do a
post mortem kind of analysis.

Now I seem to have myself in even worst trouble. Since I tried enabling DV
for the Null driver, I can’t get my machine to boot at all. Safe mode,
last known working mode, etc. all get the same blue screen. I can get a
recovery console to run, but that doesn’t get me into the registry to turn
off DV.

I have Soft Ice on the system, but now I can’t get it to boot far enough
to use it.

Any Ideas?

Don

Bug Check 0xD5: DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL
The DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL bug check has a value of
0x000000D5. This indicates that a driver has referenced memory which was
earlier freed.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read 1: Write
3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is
printed on the blue screen and stored in memory at the location
(PUNICODE_STRING) KiBugCheckDriver.

Did you try analyze -v? Did you enable DV for all drivers? Do you have a
stack frame with the correct symbols? Did you look in the DDK for this
bugcheck? DO you have a debugger attached to the system?

=====================
Mark Roddy
Hollis Technology Solutions
www.hollistech.com
xxxxx@hollistech.com

-----Original Message-----
From: Don Edvalson [mailto:xxxxx@pinnaclesys.com]
Sent: Thursday, July 17, 2003 2:04 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] Driver Verifier BSOD

Hi all,

I am having trouble using the Driver Verifer. My system is running W2k
SP3.
I first tried to enable the Driver Verifier for my driver. As soon as I
rebooted, I got a blue screen during reboot. This surprised me because my
driver wasn’t even loading at boot time. The blue screen was as follows. I
tried booting in safe mode to get rid of the Verifier, and I still got the
blue screen. I was finally able to get the system running again by booting
the last known good configuration.

So, I tried usind the Driver Verifier on the null device (I figured that
had
to work right). When I rebooted, I got the same blue screen. It seems that
if I am trying to use the Verifier on any driver, I get a blue screen at
boot, even in safe mode. The blue screen I get is shown below.

0x000000d5 (0xb7292f38, 0x00000000, 0xeb50eb2D, 0x00000000)

Can anyone offer advice / help with this. I am not sure how to even
proceed
at this point, other than to abandon the verifier.

Thanks in advance,

Don

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

You are currently subscribed to ntdev as: xxxxx@stratus.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

You are currently subscribed to ntdev as: xxxxx@compuware.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

The contents of this e-mail are intended for the named addressee only. It
contains information that may be confidential. Unless you are the named
addressee or an authorized designee, you may not copy or use it, or disclose
it to anyone else. If you received it in error please notify us immediately
and then destroy it.

10

Hey everyone,

You have no idea how much I appreciate everyone help. The response I have
gotten to this question is amazing. Thanks.

I got my machine back to life (got the DV disabled). (thank heavens :slight_smile:

Now I am left in an interesting situation. It would appear that some
driver (not the one I wrote, I removed it) is causing the DV to BugCheck.
But, this is happening EVEN if the ONLY driver enabled for DV is one that
is not even loading. It appears that the act of enabling the DV for one
driver causes it to perform some verification of all drivers, even those
that are not enabled.

The offending driver must be something pretty central, because I get the
BugCheck even in SafeMode. That rules out most of the hardware on my
machine, leaving only a very small core.

However, the BugCheck is not leaving a memory dump behind (I am not sure
why, the system is configured to) and I can’t tell from the BSOD which
driver caused the BugCheck.

Perhaps the suggestion of bringing up WinDbg serially from a seperate
machine might work. I have never used WinDbg except for crash dumps, but I
am sure I could learn.

Anyway, any suggestions on how to figure out what the offending driver
running in safe mode might be? I am surprised that there are even any
non-Microsoft supplied drivers running in Safe-Mode.

Thanks,

Don

11

The path or least resistance is to install windbg. This will allow you to
debug the crashed system and determine who the offending driver is. I’m sure
softice *might* be able to do this, but I have no idea what the procedure
would be. If you know how to use windbg to debug dumps then you basically
know how to use windbg to debug live machines. Analyze -v will probably tell
which driver was offending.

As I stated elsewhere, it is indeed some other driver that is causing your
problem. DV does make global changes, such as pool monitoring, that will
sometimes catch some driver other than the one you are interested in.
Certainly there is no requirement that all boot drivers are microsoft
sourced, as anyone who can install a driver can make that driver boot start.

=====================
Mark Roddy
Hollis Technology Solutions
www.hollistech.com
xxxxx@hollistech.com

-----Original Message-----
From: Don Edvalson [mailto:xxxxx@pinnaclesys.com]
Sent: Thursday, July 17, 2003 4:25 PM
To: Windows System Software Developers Interest List
Subject: [ntdev] RE: Driver Verifier BSOD

Hey everyone,

You have no idea how much I appreciate everyone help. The response I have
gotten to this question is amazing. Thanks.

I got my machine back to life (got the DV disabled). (thank heavens :slight_smile:

Now I am left in an interesting situation. It would appear that some driver
(not the one I wrote, I removed it) is causing the DV to BugCheck. But, this
is happening EVEN if the ONLY driver enabled for DV is one that is not even
loading. It appears that the act of enabling the DV for one driver causes it
to perform some verification of all drivers, even those that are not
enabled.

The offending driver must be something pretty central, because I get the
BugCheck even in SafeMode. That rules out most of the hardware on my
machine, leaving only a very small core.

However, the BugCheck is not leaving a memory dump behind (I am not sure
why, the system is configured to) and I can’t tell from the BSOD which
driver caused the BugCheck.

Perhaps the suggestion of bringing up WinDbg serially from a seperate
machine might work. I have never used WinDbg except for crash dumps, but I
am sure I could learn.

Anyway, any suggestions on how to figure out what the offending driver
running in safe mode might be? I am surprised that there are even any
non-Microsoft supplied drivers running in Safe-Mode.

Thanks,

Don

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

12

> Perhaps the suggestion of bringing up WinDbg serially from a seperate

machine might work. I have never used WinDbg except for crash dumps, but I
am sure I could learn.

Yes. Run WinDbg and say !analyze -v on the crash. This will print the call
stack and also lots of other useful information, which will help to solve the
problem.

Max

13

Thanks to everyone for your help.

I was finally able to track down the offending driver. It had nothing to
do with what I was working on. As was hinted at earlier, as soon as you
turn on the DV for one driver, it starts doing at least some level of
checking on all drivers. As soon as I got rid of the bad driver, all was
well.

Now I just need to get someone to fix the bad driver :slight_smile:

Thanks for your help

Don

14

The offending driver vendor ought to be (figuratively) taken out and shot
for releasing a driver that has not been run through DV, let alone whql’d.

=====================
Mark Roddy
Hollis Technology Solutions
www.hollistech.com
xxxxx@hollistech.com

-----Original Message-----
From: Don Edvalson [mailto:xxxxx@pinnaclesys.com]
Sent: Friday, July 18, 2003 11:39 AM
To: Windows System Software Developers Interest List
Subject: [ntdev] RE: Driver Verifier BSOD

Thanks to everyone for your help.

I was finally able to track down the offending driver. It had nothing to do
with what I was working on. As was hinted at earlier, as soon as you turn on
the DV for one driver, it starts doing at least some level of checking on
all drivers. As soon as I got rid of the bad driver, all was well.

Now I just need to get someone to fix the bad driver :slight_smile:

Thanks for your help

Don

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com