Information On an unknown driver: XPCL36K.dll

I have a question regarding the minidump (below) which I’ve received
from one of our customers.

The system is running print jobs overnight, but somewhere along the way
his machine is rebooting.

This driver XPCL36K.dll is not related to our software, and I could not
retrieve any information as to where (or why) it is used.

Any help is greatly appreciated.

The dump is below:

**********************************************************************

C:\Program Files\Debugging Tools for Windows>kd -y
srv*c:\symbols*http://msdl.mi
crosoft.com/download/symbols -i c:\windows\i386 -z
C:\dumpfiles\mini102705-01.dm
p

Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\dumpfiles\mini102705-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
srv*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is: c:\windows\i386
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Thu Oct 27 14:36:42.873 2005 (GMT-7)
System Uptime: 0 days 4:15:02.140
Loading Kernel Symbols



Loading unloaded module list

Loading User Symbols
************************************************************************
*******
*
*
* Bugcheck Analysis
*
*
*
************************************************************************
*******

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {e4c8d33c, 0, bfacf38b, 1}

Unable to load image XPCL36K.DLL, Win32 error 2
*** WARNING: Unable to verify timestamp for XPCL36K.DLL
*** ERROR: Module load completed but symbols could not be loaded for
XPCL36K.DLL

Could not read faulting driver name
Probably caused by : XPCL36K.DLL ( XPCL36K+1738b )

Followup: MachineOwner

kd>

**********************************************************************

An !analyze -v returns the following:

kd> !analyze -v
************************************************************************
*******
*
*
* Bugcheck Analysis
*
*
*
************************************************************************
*******

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: e4c8d33c, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: bfacf38b, If non-zero, the instruction address which referenced
the bad me
mory
address.
Arg4: 00000001, (reserved)

Debugging Details:

Could not read faulting driver name

READ_ADDRESS: e4c8d33c

FAULTING_IP:
XPCL36K+1738b
bfacf38b 8b8bdc060000 mov ecx,[ebx+0x6dc]

MM_INTERNAL_CODE: 1

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from 006f0072 to bfacf38b

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
e3dbb218 006f0072 00200078 006f0044 00750063 XPCL36K+0x1738b
e3dbb21c 00200078 006f0044 00750063 00650054 0x6f0072
e3dbb220 006f0044 00750063 00650054 00680063 0x200078
e3dbb224 00750063 00650054 00680063 00360020 0x6f0044
e3dbb228 00650054 00680063 00360020 00300031 0x750063
e3dbb22c 00680063 00360020 00300031 00200030 0x650054
e3dbb230 00360020 00300031 00200030 00430050 0x680063
e3dbb234 00300031 00200030 00430050 0035004c 0x360020
e3dbb238 00200030 00430050 0035004c 00000065 0x300031
e3dbb23c 00430050 0035004c 00000065 00000000 0x200030
e3dbb240 0035004c 00000065 00000000 00000000 0x430050
e3dbb244 00000000 00000000 00000000 00000000 0x35004c

FOLLOWUP_IP:
XPCL36K+1738b
bfacf38b 8b8bdc060000 mov ecx,[ebx+0x6dc]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: XPCL36K+1738b

MODULE_NAME: XPCL36K

IMAGE_NAME: XPCL36K.DLL

DEBUG_FLR_IMAGE_TIMESTAMP: 3d516081

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0x50_XPCL36K+1738b

BUCKET_ID: 0x50_XPCL36K+1738b

Followup: MachineOwner

kd>

*******************************************************************

Thanks Guys!!!

Luy

Luy Teitelroit wrote:

I have a question regarding the minidump (below) which I’ve received
from one of our customers.

The system is running print jobs overnight, but somewhere along the way
his machine is rebooting.

This driver XPCL36K.dll is not related to our software, and I could not
retrieve any information as to where (or why) it is used.

They have a Xerox Docutech 6100 printer whose driver has run amok.

e3dbb218 006f0072 00200078 006f0044 00750063 XPCL36K+0x1738b
e3dbb21c 00200078 006f0044 00750063 00650054 0x6f0072
e3dbb220 006f0044 00750063 00650054 00680063 0x200078
e3dbb224 00750063 00650054 00680063 00360020 0x6f0044
e3dbb228 00650054 00680063 00360020 00300031 0x750063
e3dbb22c 00680063 00360020 00300031 00200030 0x650054
e3dbb230 00360020 00300031 00200030 00430050 0x680063
e3dbb234 00300031 00200030 00430050 0035004c 0x360020
e3dbb238 00200030 00430050 0035004c 00000065 0x300031
e3dbb23c 00430050 0035004c 00000065 00000000 0x200030
e3dbb240 0035004c 00000065 00000000 00000000 0x430050
e3dbb244 00000000 00000000 00000000 00000000 0x35004c

The stack has been overwritten by this Unicode string:

rox Docu
x DocuTe
DocuTech
cuTech 6
Tech 610
ch 6100
6100 PC
100 PCL5
0 PCL5


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.