Need your help on analyzing a BSOD dump

Hello, everybody!

I have a problem with a BSOD that appears every once in a while on a machine
that I’m developing an NDIS driver for (it’s a driver based on the
packet.sys
sample from the WinNT DDK, it’s supposed to capture Ethernet data and send
raw Ethernet
data).

I get the following error:

*** STOP: 0x0000000A (0x00000000,0x00000002,0x00000001,0xF0DBC538)

IRQL_NOT_LESS_OR_EQUAL*** Address f0dbc538 has base at f0dbc000 - PACKET.SYS

CPUID:GenuineIntel 6.8.3 irql:1e SYSVER 0xf0000565

.
.
.
.
.

Address dword dump Build [1381] - Name

f0b239c0 f0dbc538 f0dbc538 80148d58 ffffffff f0b23a3c 80177458 - PACKET.SYS

f0b239c4 80148d58 80148d58 ffffffff f0b23a3c 80177458 f0b23a70 -
ntoskrnl.exe
f0b239d0 80177458 80177458 f0b23a70 e1f8ac68 f0b23a74 80e65808 -
ntoskrnl.exe
f0b239f0 8013d774 8013d774 80140000 ffff0023 f0b20023 8066e000 -
ntoskrnl.exe
f0b239f4 80140000 80140000 ffff0023 f0b20023 8066e000 2019f804 -
ntoskrnl.exe

Beginning dump of physical memory

My questions:

  1. I check that I run in the correct IRQL in EVERY function I enter.
    Then how come I get the IRQ_NOT_LESS_OR_EQUAL error?

  2. What’s the meaning of the first line (STOP…), and how can I use it
    to determine the cause of the problem?

  3. How come that every time the machine crashes, the IRQL is 30 ?

And one general question:

What’s the best way to debug this issue (tools, techniques), and not
less important: Any ideas of why this error might happen?

Thank you ever so much,

  • Barak

Barak Mandelovich xxxxx@mercury.co.il
Mercury Interactive ltd.


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

looks like u’r getting a NULL pointer, check the packets u are receiving for
NULL pointer.
----- Original Message -----
From: “Barak Mandelovich”
To: “NT Developers Interest List”
Sent: Tuesday, March 27, 2001 3:09 PM
Subject: [ntdev] Need your help on analyzing a BSOD dump

> Hello, everybody!
>
> I have a problem with a BSOD that appears every once in a while on a
machine
> that I’m developing an NDIS driver for (it’s a driver based on the
> packet.sys
> sample from the WinNT DDK, it’s supposed to capture Ethernet data and send
> raw Ethernet
> data).
>
> I get the following error:
>
>
> STOP: 0x0000000A (0x00000000,0x00000002,0x00000001,0xF0DBC538)
>
> IRQL_NOT_LESS_OR_EQUAL
Address f0dbc538 has base at f0dbc000 -
PACKET.SYS
>
>
>
>
>
> CPUID:GenuineIntel 6.8.3 irql:1e SYSVER 0xf0000565
>
>
>
> .
> .
> .
> .
> .
>
>
> Address dword dump Build [1381] - Name
>
> f0b239c0 f0dbc538 f0dbc538 80148d58 ffffffff f0b23a3c 80177458 -
PACKET.SYS
>
> f0b239c4 80148d58 80148d58 ffffffff f0b23a3c 80177458 f0b23a70 -
> ntoskrnl.exe
> f0b239d0 80177458 80177458 f0b23a70 e1f8ac68 f0b23a74 80e65808 -
> ntoskrnl.exe
> f0b239f0 8013d774 8013d774 80140000 ffff0023 f0b20023 8066e000 -
> ntoskrnl.exe
> f0b239f4 80140000 80140000 ffff0023 f0b20023 8066e000 2019f804 -
> ntoskrnl.exe
>
>
> Beginning dump of physical memory
>
>
>
>
> My questions:
>
> 1. I check that I run in the correct IRQL in EVERY function I enter.
> Then how come I get the IRQ_NOT_LESS_OR_EQUAL error?
>
> 2. What’s the meaning of the first line (STOP…), and how can I use it
> to determine the cause of the problem?
>
> 3. How come that every time the machine crashes, the IRQL is 30 ?
>
> And one general question:
>
> What’s the best way to debug this issue (tools, techniques), and not
> less important: Any ideas of why this error might happen?
>
>
> Thank you ever so much,
>
> - Barak
>
>
> ------------------------------------------------------------------------
> Barak Mandelovich xxxxx@mercury.co.il
> Mercury Interactive ltd.
> ------------------------------------------------------------------------
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@wipro.com
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Chief among the culprits here is referencing an IRP AFTER passing it to
IoCompleteRequest.

Gary G. Little
Sr. Staff Engineer
Broadband Storage, Inc.
xxxxx@broadstor.com
xxxxx@delphieng.com

-----Original Message-----
From: Barak Mandelovich [mailto:xxxxx@mercury.co.il]
Sent: Tuesday, March 27, 2001 1:40 AM
To: NT Developers Interest List
Subject: [ntdev] Need your help on analyzing a BSOD dump

Hello, everybody!

I have a problem with a BSOD that appears every once in a while on a machine
that I’m developing an NDIS driver for (it’s a driver based on the
packet.sys
sample from the WinNT DDK, it’s supposed to capture Ethernet data and send
raw Ethernet
data).

I get the following error:

*** STOP: 0x0000000A (0x00000000,0x00000002,0x00000001,0xF0DBC538)

IRQL_NOT_LESS_OR_EQUAL*** Address f0dbc538 has base at f0dbc000 - PACKET.SYS

CPUID:GenuineIntel 6.8.3 irql:1e SYSVER 0xf0000565

.
.
.
.
.

Address dword dump Build [1381] - Name

f0b239c0 f0dbc538 f0dbc538 80148d58 ffffffff f0b23a3c 80177458 - PACKET.SYS

f0b239c4 80148d58 80148d58 ffffffff f0b23a3c 80177458 f0b23a70 -
ntoskrnl.exe
f0b239d0 80177458 80177458 f0b23a70 e1f8ac68 f0b23a74 80e65808 -
ntoskrnl.exe
f0b239f0 8013d774 8013d774 80140000 ffff0023 f0b20023 8066e000 -
ntoskrnl.exe
f0b239f4 80140000 80140000 ffff0023 f0b20023 8066e000 2019f804 -
ntoskrnl.exe

Beginning dump of physical memory

My questions:

  1. I check that I run in the correct IRQL in EVERY function I enter.
    Then how come I get the IRQ_NOT_LESS_OR_EQUAL error?

  2. What’s the meaning of the first line (STOP…), and how can I use it
    to determine the cause of the problem?

  3. How come that every time the machine crashes, the IRQL is 30 ?

And one general question:

What’s the best way to debug this issue (tools, techniques), and not
less important: Any ideas of why this error might happen?

Thank you ever so much,

  • Barak

Barak Mandelovich xxxxx@mercury.co.il
Mercury Interactive ltd.


You are currently subscribed to ntdev as: xxxxx@delphieng.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com