Help : MSVAD Error !

NTDEV
1

Hello all,
-> I am trying to use MSVAD to stream data to a remote sink and grab data from a remote source .

-> When I play something like say Default Beep sound (the one that is there in the sound applet ) , it works : I get a trace like :

MSVAD: New Format: 64000
MSVAD: New Format: 22050
MSVAD: KSSTATE_PAUSE
MSVAD: KSSTATE_RUN
MSVAD: KSSTATE_PAUSE
MSVAD: KSSTATE_STOP

but when I play data ( a .wav file) using the same , I get a trace like :

MSVAD: New Format: 64000
MSVAD: New Format: 100
MSVAD: KSSTATE_PAUSE
MSVAD: New Format: 44100
MSVAD: KSSTATE_STOP

and then it crashes while freeing the buffer in FreeBuffer() routine, with a Status code of 0xC000004e

-> what is wrong ? Why am I getting almost absurd values 100Hz as the sample rate ?

If you want I will post the debugger trace also. Please provide any suggestions that you can .

TIA,
Venkatesh.D.N

2

This is the dump that i got :

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000007, A driver has unlocked a page more times than it locked it
Arg2: 000011c5, page frame number
Arg3: 00000001, current share count
Arg4: 00000000, 0

Debugging Details:

BUGCHECK_STR: 0x4E_7

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: wmplayer.exe

LAST_CONTROL_TRANSFER: from 805328e7 to 804e3b25

SYMBOL_ON_RAW_STACK: 1

STACK_ADDR_RAW_STACK_SYMBOL: fffffffff5d1c50c

STACK_COMMAND: dds F5D1C50C-0x20 ; kb

STACK_TEXT:
f5d1c4ec 00000000
f5d1c4f0 ffff0ff0
f5d1c4f4 00000400
f5d1c4f8 0000bb40
f5d1c4fc faff8520
f5d1c500 faff88f0
f5d1c504 faff88d8
f5d1c508 fb0c18ae kdcom!CpGetByte+0x9e
f5d1c50c 600c1d20
f5d1c510 b0000000
f5d1c514 c875f5c5
f5d1c518 00000000
f5d1c51c 00000000
f5d1c520 faff8904
f5d1c524 fb0c19aa kdcom!KdCompPollByte+0x10
f5d1c528 fb0c1d20 kdcom!Port
f5d1c52c faff8913
f5d1c530 00000000
f5d1c534 fb0c1f61 kdcom!KdReceivePacket+0x15
f5d1c538 faff8913
f5d1c53c 805057aa nt!DebugService+0x1b
f5d1c540 00000003
f5d1c544 00000001
f5d1c548 faff8a18
f5d1c54c faff892c
f5d1c550 8051d218 nt!KdPollBreakIn+0x51
f5d1c554 00000008
f5d1c558 00000000
f5d1c55c faff892c
f5d1c560 8051d234 nt!KdPollBreakIn+0x6d
f5d1c564 559ca001
f5d1c568 00000000

FOLLOWUP_IP:
kdcom!CpGetByte+9e
fb0c18ae 668bc3 mov ax,bx

SYMBOL_NAME: kdcom!CpGetByte+9e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: kdcom

IMAGE_NAME: kdcom.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8346

FAILURE_BUCKET_ID: 0x4E_7_kdcom!CpGetByte+9e

BUCKET_ID: 0x4E_7_kdcom!CpGetByte+9e

Followup: MachineOwner

kd> kb
ChildEBP RetAddr Args to Child
f5d1c44c 805328e7 00000003 f5d1c7a8 00000000 nt!RtlpBreakWithStatusInstruction
f5d1c498 805333be 00000003 000011c5 8101aa78 nt!KiBugCheckDebugBreak+0x19
f5d1c878 805339ae 0000004e 00000007 000011c5 nt!KeBugCheck2+0x574
f5d1c898 80525136 0000004e 00000007 000011c5 nt!KeBugCheckEx+0x1b
f5d1c8b8 804f5768 ff9b5000 812a0ff0 80562040 nt!MiDecrementReferenceCount+0x4e
f5d1c8ec 80549926 8131bd48 812a0ff0 80562040 nt!MiDeferredUnlockPages+0xed
f5d1c918 8054b28b ff9b5000 812a0ff0 812a0ff4 nt!MiFreePoolPages+0xac
f5d1c958 f642c7b5 ff9b5000 4456534d 812a0f6c nt!ExFreePoolWithTag+0x1b7
f5d1c96c f642e9ed 812a0f6c 812e6b80 812a0f68 vadSimpl!CMiniportWaveCyclicStreamMSVAD::FreeBuffer+0x95 [c:\msvad\basedma.cpp @ 242]
f5d1c980 f64328f2 812a0ff0 ff9e4140 812a0f68 vadSimpl!CMiniportWaveCyclicStreamMSVAD::~CMiniportWaveCyclicStreamMSVAD+0x15d [c:\msvad\basewave.cpp @ 516]
f5d1c994 f6429e01 812a0f68 f5d1c9b4 f6429f97 vadSimpl!CMiniportWaveCyclicStream::~CMiniportWaveCyclicStream+0x102 [c:\msvad\simple\minwave.cpp @ 723]
f5d1c9a0 f6429f97 00000001 81147a5c 81147970 vadSimpl!CMiniportWaveCyclicStream::scalar deleting destructor'+0x11 f5d1c9b4 f6429c95 812a0ff0 812a0ff0 f5d1c9e4 vadSimpl!CUnknown::NonDelegatingRelease+0x3d [d:\xpsprtm\drivers\wdm\audio\backpln\stdunk\stdunk.cpp @ 81] f5d1c9c4 fa909e33 812a0f68 81147984 81147970 vadSimpl!CMiniportWaveCyclicStream::Release+0x25 [c:\msvad\simple\minwave.h @ 77] f5d1c9d8 fa8f4eca 81147988 f5d1c9f8 fa8edd9a portcls!CPortPinWaveCyclic::~CPortPinWaveCyclic+0x7a f5d1c9e4 fa8edd9a 00000001 ffbadea0 ffb92108 portcls!CPortPinWaveCyclic::vector deleting destructor'+0xd
f5d1c9f8 fa8f3f84 81147984 f5d1ca1c fa8fe265 portcls!CUnknown::NonDelegatingRelease+0x24
f5d1ca04 fa8fe265 81147970 ffb30cc8 ffb63248 portcls!CPortPinWaveCyclic::Release+0x11
f5d1ca1c fa8d3737 ffbb6b48 ffb30cb8 f5d1ca74 portcls!DispatchClose+0x44
f5d1ca2c 804e3d77 ffbadde8 ffb30cb8 ffb30cb8 ks!DispatchClose+0x32

-> I am getting the error inspite of checking if the m_pvDmaBuffer exits, this is to be freed but ExFreePoolWithTag() itself is crashing the system .

-> Is this problem beacuse i am not able buffer the data at the required rate ?

Please help,
TIA,
Venkatesh.D.N

3

xxxxx@gmail.com wrote:

-> I am trying to use MSVAD to stream data to a remote sink and grab data from a remote source .

-> When I play something like say Default Beep sound (the one that is there in the sound applet ) , it works : I get a trace like :

MSVAD: New Format: 64000
MSVAD: New Format: 22050
MSVAD: KSSTATE_PAUSE
MSVAD: KSSTATE_RUN
MSVAD: KSSTATE_PAUSE
MSVAD: KSSTATE_STOP

but when I play data ( a .wav file) using the same , I get a trace like :

MSVAD: New Format: 64000
MSVAD: New Format: 100
MSVAD: KSSTATE_PAUSE
MSVAD: New Format: 44100
MSVAD: KSSTATE_STOP

and then it crashes while freeing the buffer in FreeBuffer() routine, with a Status code of 0xC000004e

-> what is wrong ? Why am I getting almost absurd values 100Hz as the sample rate ?

You need to get out your debugger and look at this in more detail. The
MSVAD code doesn’t try to validate the format, so it’s possible (for
example) that you’re getting some kind of compressed-file format with
fake information.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

4

xxxxx@gmail.com wrote:

This is the dump that i got :

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.

That makes much more sense. Your original message said you got a status
C000004E, which is STATUS_SECTION_PROTECTION, and that didn’t make any
sense at all. Bug check codes (which is what you have here) come from
an entirely different number space than status codes. Do not confuse them.

Arguments:
Arg1: 00000007, A driver has unlocked a page more times than it locked it
Arg2: 000011c5, page frame number
Arg3: 00000001, current share count
Arg4: 00000000, 0
…kd> kb
ChildEBP RetAddr Args to Child
f5d1c44c 805328e7 00000003 f5d1c7a8 00000000 nt!RtlpBreakWithStatusInstruction
f5d1c498 805333be 00000003 000011c5 8101aa78 nt!KiBugCheckDebugBreak+0x19
f5d1c878 805339ae 0000004e 00000007 000011c5 nt!KeBugCheck2+0x574
f5d1c898 80525136 0000004e 00000007 000011c5 nt!KeBugCheckEx+0x1b
f5d1c8b8 804f5768 ff9b5000 812a0ff0 80562040 nt!MiDecrementReferenceCount+0x4e
f5d1c8ec 80549926 8131bd48 812a0ff0 80562040 nt!MiDeferredUnlockPages+0xed
f5d1c918 8054b28b ff9b5000 812a0ff0 812a0ff4 nt!MiFreePoolPages+0xac
f5d1c958 f642c7b5 ff9b5000 4456534d 812a0f6c nt!ExFreePoolWithTag+0x1b7
f5d1c96c f642e9ed 812a0f6c 812e6b80 812a0f68 vadSimpl!CMiniportWaveCyclicStreamMSVAD::FreeBuffer+0x95 [c:\msvad\basedma.cpp @ 242]

You’re trying to free a block at FF9B5000. It’s a little dangerous to
draw general conclusions, but that’s not a typical non-paged-pool
address. You need to monitor the value of m_pvDmaBuffer as your driver
progresses to see if that’s really where it came from.

-> I am getting the error inspite of checking if the m_pvDmaBuffer exits, this is to be freed but ExFreePoolWithTag() itself is crashing the system .

-> Is this problem beacuse i am not able buffer the data at the required rate ?

It’s impossible to tell. You’re either freeing a block twice, or your
freeing a block that didn’t belong to you to begin with.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.