DRIVER_VERIFIER_DETECTED_VIOLATION with arg 1 =62

NTDEV
1

Hi,
I am trying to analyze a crash in my driver and verifier is reporting
error code 62. I could not find the explanation of it in DDK
documentation.
Can someone point me to the correct reason of this crash?

Thanks
Below is analyze output

0: kd> !analyze -v
************************************************************************
*******
*
*
* Bugcheck Analysis
*
*
*
************************************************************************
*******

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This
is
because the driver was specified in the registry as being suspect (by
the
administrator) and the kernel has enabled substantial checking of this
driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and
0xA will
be among the most commonly seen crashes.
Parameter 1 = 0x1000 .. 0x1020 - deadlock verifier error codes.
Typically the code is 0x1001 (deadlock detected) and you
can
issue a '!deadlock' KD command to get more information.
Arguments:
Arg1: 00000062, subclass of driver violation.
Arg2: 8a7ddc68
Arg3: 8a7ddc10
Arg4: 00000009

Debugging Details:

BUGCHECK_STR: 0xc4_62

IMAGE_NAME: scid.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 433ead1a

MODULE_NAME: scid

FAULTING_MODULE: b97aa000 scid

DEFAULT_BUCKET_ID: DRIVER_FAULT

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 809d5abd to 8087b6be

STACK_TEXT:
ba7fdad4 809d5abd 000000c4 00000062 8a7ddc68 nt!KeBugCheckEx+0x1b
ba7fdafc 8095c836 892c1118 80a78be4 89338700
nt!MiVerifyingDriverUnloading+0xf5
ba7fdb24 808da6b0 892c1118 893386d8 893386e8
nt!MmUnloadSystemImage+0x176
ba7fdb38 8092ac38 89338700 893386e8 00000000 nt!IopDeleteDriver+0x39
ba7fdb50 80840172 89338700 00000000 ba7fdc30
nt!ObpRemoveObjectRoutine+0xde
ba7fdb70 808daf66 ba7fdc30 ba7fdcac 8098cd0f
nt!ObfDereferenceObject+0x67
ba7fdc14 8098cd1e ba7fdd0c 00000000 ba7fdc30 nt!IopUnloadDriver+0x280
ba7fdc24 80834d3f ba7fdd0c ba7fdd48 8083d40d nt!NtUnloadDriver+0xf
ba7fdc24 8083d40d ba7fdd0c ba7fdd48 8083d40d nt!KiFastCallEntry+0xfc
ba7fdca0 80951f2a ba7fdd0c ba7fdd64 00c8f878 nt!ZwUnloadDriver+0x11
ba7fdd48 8098cd1e 00c8f880 00000000 ba7fdd64 nt!IopUnloadDriver+0xe7
ba7fdd58 80834d3f 00c8f880 00c8f888 7c82ed54 nt!NtUnloadDriver+0xf
ba7fdd58 7c82ed54 00c8f880 00c8f888 7c82ed54 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be
wrong.
00c8f868 00000000 00000000 00000000 00000000 0x7c82ed54

STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_NAME: MachineOwner

BUCKET_ID: 0xc4_62_IMAGE_scid.sys_DATE_10_1_2005

Followup: MachineOwner

2

From a similar question I asked last October, answered by Molly Brown:

This verifier code is new to Server 2003 SP1. It indicates that your
driver has pool still allocated when your driver unloads.

Parameter 1 is the verifier code (0x62)
Parameter 2 is the pointer to the driver name string
Parameter 3 is an internal verifier structure
Parameter 4 is the total number of non-freed paged and non-paged pool
allocations for your driver

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Harish Arora
Sent: Saturday, October 01, 2005 6:13 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] DRIVER_VERIFIER_DETECTED_VIOLATION with arg 1 =62

Hi,
I am trying to analyze a crash in my driver and verifier is reporting
error code 62. I could not find the explanation of it in DDK
documentation.
Can someone point me to the correct reason of this crash?

Thanks
Below is analyze output

0: kd> !analyze -v
************************************************************************
*******
*
*
* Bugcheck Analysis
*
*
*
************************************************************************
*******

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This
is
because the driver was specified in the registry as being suspect (by
the
administrator) and the kernel has enabled substantial checking of this
driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and
0xA will
be among the most commonly seen crashes.
Parameter 1 = 0x1000 .. 0x1020 - deadlock verifier error codes.
Typically the code is 0x1001 (deadlock detected) and you
can
issue a '!deadlock' KD command to get more information.
Arguments:
Arg1: 00000062, subclass of driver violation.
Arg2: 8a7ddc68
Arg3: 8a7ddc10
Arg4: 00000009

Debugging Details:

BUGCHECK_STR: 0xc4_62

IMAGE_NAME: scid.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 433ead1a

MODULE_NAME: scid

FAULTING_MODULE: b97aa000 scid

DEFAULT_BUCKET_ID: DRIVER_FAULT

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 809d5abd to 8087b6be

STACK_TEXT:
ba7fdad4 809d5abd 000000c4 00000062 8a7ddc68 nt!KeBugCheckEx+0x1b
ba7fdafc 8095c836 892c1118 80a78be4 89338700
nt!MiVerifyingDriverUnloading+0xf5
ba7fdb24 808da6b0 892c1118 893386d8 893386e8
nt!MmUnloadSystemImage+0x176
ba7fdb38 8092ac38 89338700 893386e8 00000000 nt!IopDeleteDriver+0x39
ba7fdb50 80840172 89338700 00000000 ba7fdc30
nt!ObpRemoveObjectRoutine+0xde
ba7fdb70 808daf66 ba7fdc30 ba7fdcac 8098cd0f
nt!ObfDereferenceObject+0x67
ba7fdc14 8098cd1e ba7fdd0c 00000000 ba7fdc30 nt!IopUnloadDriver+0x280
ba7fdc24 80834d3f ba7fdd0c ba7fdd48 8083d40d nt!NtUnloadDriver+0xf
ba7fdc24 8083d40d ba7fdd0c ba7fdd48 8083d40d nt!KiFastCallEntry+0xfc
ba7fdca0 80951f2a ba7fdd0c ba7fdd64 00c8f878 nt!ZwUnloadDriver+0x11
ba7fdd48 8098cd1e 00c8f880 00000000 ba7fdd64 nt!IopUnloadDriver+0xe7
ba7fdd58 80834d3f 00c8f880 00c8f888 7c82ed54 nt!NtUnloadDriver+0xf
ba7fdd58 7c82ed54 00c8f880 00c8f888 7c82ed54 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be
wrong.
00c8f868 00000000 00000000 00000000 00000000 0x7c82ed54

STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_NAME: MachineOwner

BUCKET_ID: 0xc4_62_IMAGE_scid.sys_DATE_10_1_2005

Followup: MachineOwner

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ''
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

BTW, to get more useful information, try:

!verifier 0x3

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Harish Arora
Sent: Saturday, October 01, 2005 6:13 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] DRIVER_VERIFIER_DETECTED_VIOLATION with arg 1 =62

Hi,
I am trying to analyze a crash in my driver and verifier is reporting
error code 62. I could not find the explanation of it in DDK
documentation.
Can someone point me to the correct reason of this crash?

Thanks
Below is analyze output

0: kd> !analyze -v
************************************************************************
*******
*
*
* Bugcheck Analysis
*
*
*
************************************************************************
*******

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This
is
because the driver was specified in the registry as being suspect (by
the
administrator) and the kernel has enabled substantial checking of this
driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and
0xA will
be among the most commonly seen crashes.
Parameter 1 = 0x1000 .. 0x1020 - deadlock verifier error codes.
Typically the code is 0x1001 (deadlock detected) and you
can
issue a '!deadlock' KD command to get more information.
Arguments:
Arg1: 00000062, subclass of driver violation.
Arg2: 8a7ddc68
Arg3: 8a7ddc10
Arg4: 00000009

Debugging Details:

BUGCHECK_STR: 0xc4_62

IMAGE_NAME: scid.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 433ead1a

MODULE_NAME: scid

FAULTING_MODULE: b97aa000 scid

DEFAULT_BUCKET_ID: DRIVER_FAULT

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 809d5abd to 8087b6be

STACK_TEXT:
ba7fdad4 809d5abd 000000c4 00000062 8a7ddc68 nt!KeBugCheckEx+0x1b
ba7fdafc 8095c836 892c1118 80a78be4 89338700
nt!MiVerifyingDriverUnloading+0xf5
ba7fdb24 808da6b0 892c1118 893386d8 893386e8
nt!MmUnloadSystemImage+0x176
ba7fdb38 8092ac38 89338700 893386e8 00000000 nt!IopDeleteDriver+0x39
ba7fdb50 80840172 89338700 00000000 ba7fdc30
nt!ObpRemoveObjectRoutine+0xde
ba7fdb70 808daf66 ba7fdc30 ba7fdcac 8098cd0f
nt!ObfDereferenceObject+0x67
ba7fdc14 8098cd1e ba7fdd0c 00000000 ba7fdc30 nt!IopUnloadDriver+0x280
ba7fdc24 80834d3f ba7fdd0c ba7fdd48 8083d40d nt!NtUnloadDriver+0xf
ba7fdc24 8083d40d ba7fdd0c ba7fdd48 8083d40d nt!KiFastCallEntry+0xfc
ba7fdca0 80951f2a ba7fdd0c ba7fdd64 00c8f878 nt!ZwUnloadDriver+0x11
ba7fdd48 8098cd1e 00c8f880 00000000 ba7fdd64 nt!IopUnloadDriver+0xe7
ba7fdd58 80834d3f 00c8f880 00c8f888 7c82ed54 nt!NtUnloadDriver+0xf
ba7fdd58 7c82ed54 00c8f880 00c8f888 7c82ed54 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be
wrong.
00c8f868 00000000 00000000 00000000 00000000 0x7c82ed54

STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_NAME: MachineOwner

BUCKET_ID: 0xc4_62_IMAGE_scid.sys_DATE_10_1_2005

Followup: MachineOwner

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ''
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Thanks Ken for this information.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-221480-
xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Saturday, October 01, 2005 4:17 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] DRIVER_VERIFIER_DETECTED_VIOLATION with arg 1 =62

BTW, to get more useful information, try:

!verifier 0x3

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Harish Arora
Sent: Saturday, October 01, 2005 6:13 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] DRIVER_VERIFIER_DETECTED_VIOLATION with arg 1 =62

Hi,
I am trying to analyze a crash in my driver and verifier is reporting
error code 62. I could not find the explanation of it in DDK
documentation.
Can someone point me to the correct reason of this crash?

Thanks
Below is analyze output

0: kd> !analyze -v

************************************************************************

*******
*
*
* Bugcheck Analysis
*
*
*

************************************************************************

*******

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.
This
is
because the driver was specified in the registry as being suspect (by
the
administrator) and the kernel has enabled substantial checking of this
driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and
0xA will
be among the most commonly seen crashes.
Parameter 1 = 0x1000 … 0x1020 - deadlock verifier error
codes.
Typically the code is 0x1001 (deadlock detected) and
you
can
issue a ‘!deadlock’ KD command to get more information.
Arguments:
Arg1: 00000062, subclass of driver violation.
Arg2: 8a7ddc68
Arg3: 8a7ddc10
Arg4: 00000009

Debugging Details:

BUGCHECK_STR: 0xc4_62

IMAGE_NAME: scid.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 433ead1a

MODULE_NAME: scid

FAULTING_MODULE: b97aa000 scid

DEFAULT_BUCKET_ID: DRIVER_FAULT

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 809d5abd to 8087b6be

STACK_TEXT:
ba7fdad4 809d5abd 000000c4 00000062 8a7ddc68 nt!KeBugCheckEx+0x1b
ba7fdafc 8095c836 892c1118 80a78be4 89338700
nt!MiVerifyingDriverUnloading+0xf5
ba7fdb24 808da6b0 892c1118 893386d8 893386e8
nt!MmUnloadSystemImage+0x176
ba7fdb38 8092ac38 89338700 893386e8 00000000 nt!IopDeleteDriver+0x39
ba7fdb50 80840172 89338700 00000000 ba7fdc30
nt!ObpRemoveObjectRoutine+0xde
ba7fdb70 808daf66 ba7fdc30 ba7fdcac 8098cd0f
nt!ObfDereferenceObject+0x67
ba7fdc14 8098cd1e ba7fdd0c 00000000 ba7fdc30 nt!IopUnloadDriver+0x280
ba7fdc24 80834d3f ba7fdd0c ba7fdd48 8083d40d nt!NtUnloadDriver+0xf
ba7fdc24 8083d40d ba7fdd0c ba7fdd48 8083d40d nt!KiFastCallEntry+0xfc
ba7fdca0 80951f2a ba7fdd0c ba7fdd64 00c8f878 nt!ZwUnloadDriver+0x11
ba7fdd48 8098cd1e 00c8f880 00000000 ba7fdd64 nt!IopUnloadDriver+0xe7
ba7fdd58 80834d3f 00c8f880 00c8f888 7c82ed54 nt!NtUnloadDriver+0xf
ba7fdd58 7c82ed54 00c8f880 00c8f888 7c82ed54 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be
wrong.
00c8f868 00000000 00000000 00000000 00000000 0x7c82ed54

STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_NAME: MachineOwner

BUCKET_ID: 0xc4_62_IMAGE_scid.sys_DATE_10_1_2005

Followup: MachineOwner

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@mendocinosoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Harish, I'm sorry about this omission. The 0x62 parameter is included in doc
of the 0xC4 bug check code in the Windows Driver Kit (WDK, formerly the DDK)
for Windows Vista.

When you realize that information is missing from a WDK page, please scroll
to the bottom of the page, click the "Send feedback on this topic" link, and
tell us what's missing. You can use this method to send feedback on the WDK
docs right to the doc writers.

June Blender (MSFT)
WDK (DDK) Tool Docs
xxxxx@microsoft.com

"Harish Arora" wrote in message
news:xxxxx@ntdev...
Hi,
I am trying to analyze a crash in my driver and verifier is reporting
error code 62. I could not find the explanation of it in DDK
documentation.
Can someone point me to the correct reason of this crash?

Thanks
Below is analyze output

0: kd> !analyze -v
***********************************************************


Bugcheck Analysis



*****************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This
is
because the driver was specified in the registry as being suspect (by
the
administrator) and the kernel has enabled substantial checking of this
driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and
0xA will
be among the most commonly seen crashes.
Parameter 1 = 0x1000 .. 0x1020 - deadlock verifier error codes.
Typically the code is 0x1001 (deadlock detected) and you
can
issue a '!deadlock' KD command to get more information.
Arguments:
Arg1: 00000062, subclass of driver violation.
Arg2: 8a7ddc68
Arg3: 8a7ddc10
Arg4: 00000009

Debugging Details:
------------------

BUGCHECK_STR: 0xc4_62

IMAGE_NAME: scid.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 433ead1a

MODULE_NAME: scid

FAULTING_MODULE: b97aa000 scid

DEFAULT_BUCKET_ID: DRIVER_FAULT

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 809d5abd to 8087b6be

STACK_TEXT:
ba7fdad4 809d5abd 000000c4 00000062 8a7ddc68 nt!KeBugCheckEx+0x1b
ba7fdafc 8095c836 892c1118 80a78be4 89338700
nt!MiVerifyingDriverUnloading+0xf5
ba7fdb24 808da6b0 892c1118 893386d8 893386e8
nt!MmUnloadSystemImage+0x176
ba7fdb38 8092ac38 89338700 893386e8 00000000 nt!IopDeleteDriver+0x39
ba7fdb50 80840172 89338700 00000000 ba7fdc30
nt!ObpRemoveObjectRoutine+0xde
ba7fdb70 808daf66 ba7fdc30 ba7fdcac 8098cd0f
nt!ObfDereferenceObject+0x67
ba7fdc14 8098cd1e ba7fdd0c 00000000 ba7fdc30 nt!IopUnloadDriver+0x280
ba7fdc24 80834d3f ba7fdd0c ba7fdd48 8083d40d nt!NtUnloadDriver+0xf
ba7fdc24 8083d40d ba7fdd0c ba7fdd48 8083d40d nt!KiFastCallEntry+0xfc
ba7fdca0 80951f2a ba7fdd0c ba7fdd64 00c8f878 nt!ZwUnloadDriver+0x11
ba7fdd48 8098cd1e 00c8f880 00000000 ba7fdd64 nt!IopUnloadDriver+0xe7
ba7fdd58 80834d3f 00c8f880 00c8f888 7c82ed54 nt!NtUnloadDriver+0xf
ba7fdd58 7c82ed54 00c8f880 00c8f888 7c82ed54 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be
wrong.
00c8f868 00000000 00000000 00000000 00000000 0x7c82ed54

STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_NAME: MachineOwner

BUCKET_ID: 0xc4_62_IMAGE_scid.sys_DATE_10_1_2005

Followup: MachineOwner
---------