INVALID_PROCESS_ATTACH_ATTEMPT crash

NTDEV
1

Hi All,

We have a application that transmits data through a PCI card. We have
developed the driver for the PCI card too. We are running on an NT4.0
system

Sometimes when the application executes we get BSOD with
INVALID_PROCESS_ATTACH_ATTEMPT in ntoskrnl.exe.

We installed softice on the machine to get the call stack. The following
details were revealed from softice at the time of crash

CLOCK2 - KTEB … ntoskrnl!.text…
KeBugCheckEx
Error=5 (INVALID_PROCESS_ATTACH_ATTEMPT)

The call stack gave:
NtConnectPort
MmIsThisAnNTSystem
KeBugCheck

We are totally confused as to where the problem is. Since Softice shows an
IRQL of clock2. We are not sure if the problem is caused by the
application or our PCI card driver or some other external factor.

We looked at the available documentation. We ARE NOT calling
KeAttachProcess() anywhere in our PCI driver.Whats more interesting is
that the call stack gives NTConnectPort() in the stack which indicates
that some NT LPC is happening somewhere. Also the driver and application
use Overlapped IO, so NT APCs can also be happening.

Anybody inputs on where the problem could be or how to proceed ?

Thanks in advance

Madhu

2

Please, use Windbg, WITH OS symbols, and paste a full stack trace there. Ill
be most likely able to tell you then why it happens, or at least give you a
pointer. But I need data copy / paste from Windbg, not 3 lines of stack
only, which anyway look for me as a trased backtrace.

----- Original Message -----
From:
To: “NT Developers Interest List”
Sent: Friday, August 09, 2002 3:54 PM
Subject: [ntdev] INVALID_PROCESS_ATTACH_ATTEMPT crash

> Hi All,
>
> We have a application that transmits data through a PCI card. We have
> developed the driver for the PCI card too. We are running on an NT4.0
> system
>
> Sometimes when the application executes we get BSOD with
> INVALID_PROCESS_ATTACH_ATTEMPT in ntoskrnl.exe.
>
> We installed softice on the machine to get the call stack. The following
> details were revealed from softice at the time of crash
>
> CLOCK2 - KTEB … ntoskrnl!.text…
> KeBugCheckEx
> Error=5 (INVALID_PROCESS_ATTACH_ATTEMPT)
>
> The call stack gave:
> NtConnectPort
> MmIsThisAnNTSystem
> KeBugCheck
>
> We are totally confused as to where the problem is. Since Softice shows an
> IRQL of clock2. We are not sure if the problem is caused by the
> application or our PCI card driver or some other external factor.
>
> We looked at the available documentation. We ARE NOT calling
> KeAttachProcess() anywhere in our PCI driver.Whats more interesting is
> that the call stack gives NTConnectPort() in the stack which indicates
> that some NT LPC is happening somewhere. Also the driver and application
> use Overlapped IO, so NT APCs can also be happening.
>
> Anybody inputs on where the problem could be or how to proceed ?
>
> Thanks in advance
>
> Madhu
>
> —
> You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>

3

And about your IRQL level, I would be surprised to be anything else than
CLOCK2. Its very normal, and its the only IRQL at which this bugcheck can
come to life.

----- Original Message -----
From:
To: “NT Developers Interest List”
Sent: Friday, August 09, 2002 3:54 PM
Subject: [ntdev] INVALID_PROCESS_ATTACH_ATTEMPT crash

> Hi All,
>
> We have a application that transmits data through a PCI card. We have
> developed the driver for the PCI card too. We are running on an NT4.0
> system
>
> Sometimes when the application executes we get BSOD with
> INVALID_PROCESS_ATTACH_ATTEMPT in ntoskrnl.exe.
>
> We installed softice on the machine to get the call stack. The following
> details were revealed from softice at the time of crash
>
> CLOCK2 - KTEB … ntoskrnl!.text…
> KeBugCheckEx
> Error=5 (INVALID_PROCESS_ATTACH_ATTEMPT)
>
> The call stack gave:
> NtConnectPort
> MmIsThisAnNTSystem
> KeBugCheck
>
> We are totally confused as to where the problem is. Since Softice shows an
> IRQL of clock2. We are not sure if the problem is caused by the
> application or our PCI card driver or some other external factor.
>
> We looked at the available documentation. We ARE NOT calling
> KeAttachProcess() anywhere in our PCI driver.Whats more interesting is
> that the call stack gives NTConnectPort() in the stack which indicates
> that some NT LPC is happening somewhere. Also the driver and application
> use Overlapped IO, so NT APCs can also be happening.
>
> Anybody inputs on where the problem could be or how to proceed ?
>
> Thanks in advance
>
> Madhu
>
> —
> You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>