nt!KiDoubleFaultStack

While analyzing a DRIVER_POWER_STATE_FAILURE (9f) and looking into the stack (u 83b33000 83b36000) I recognized almost 'endless' nt!KiDoubleFaultStack entries from the beginning of the thread. Is this kind of a chain reaction?

Thanks!

83b35004 83b3512c nt!KiDoubleFaultStack+0x212c
83b35008 8d4b2e0f tcpip!ProcessInboundTransportLayerClassify+0x5e0
83b3500c 86fdbc90
83b35010 00000100
83b35014 87529bb8
83b35018 00000000
83b3501c 83b3509c nt!KiDoubleFaultStack+0x209c
83b35020 8d4bc510 tcpip!WfpAleMatchStatefulEndpoint+0x1d1
83b35024 8c3406a8
83b35028 00000002
83b3502c 00000011
83b35030 89138138
83b35034 298142ad
83b35038 83b35060 nt!KiDoubleFaultStack+0x2060
83b3503c 00000000
83b35040 83b35064 nt!KiDoubleFaultStack+0x2064
83b35044 00000004
83b35048 000200ff
83b3504c 00000000
83b35050 83b35370 nt!KiDoubleFaultStack+0x2370
83b35054 8c3406a8
83b35058 83b35350 nt!KiDoubleFaultStack+0x2350
83b3505c 8d4bc626 tcpip!WfpAleMatchStatefulEndpoint+0x2e7
83b35060 00000000
83b35064 00000000
83b35068 00000000
83b3506c 8b6756a4
83b35070 0ee140d1
83b35074 83b35120 nt!KiDoubleFaultStack+0x2120
83b35078 8d4b14b9 tcpip!ProcessAleForNonTcpIn+0x92
83b3507c 83b35128 nt!KiDoubleFaultStack+0x2128
83b35080 00000011
83b35084 00000002
83b35088 00006c07
83b3508c 000092eb
83b35090 83b35350 nt!KiDoubleFaultStack+0x2350
83b35094 83b35118 nt!KiDoubleFaultStack+0x2118
83b35098 89138138
83b3509c 8b6756a4
83b350a0 88fc5000
83b350a4 00000000
83b350a8 00000000
83b350ac 86fdbc90
83b350b0 00000000
83b350b4 00000001
83b350b8 00000000
83b350bc 00000001
83b350c0 00000014
83b350c4 00000008
83b350c8 00000000
83b350cc 83b350d8 nt!KiDoubleFaultStack+0x20d8
83b350d0 8d4a8e0d tcpip!IpSecGetSecurityContext+0xd
83b350d4 86fdbc90
83b350d8 83b35148 nt!KiDoubleFaultStack+0x2148
83b350dc 8d4a9208 tcpip!IPSecTLPacketsInProcessing+0x19
83b350e0 86fdbc90
83b350e4 00000100
83b350e8 87529bb8
83b350ec 00000000
83b350f0 00002b43
83b350f4 00000000
83b350f8 00000000
83b350fc 00000000
83b35100 00000000
83b35104 00000000
83b35108 00000000
83b3510c 00000000
83b35110 83b3536c nt!KiDoubleFaultStack+0x236c
83b35114 890338a8
83b35118 00000000
83b3511c 83b35144 nt!KiDoubleFaultStack+0x2144
83b35120 8d4c1817 tcpip!OptionalUpdateNonTcpAleState+0x101
83b35124 890338a8
83b35128 00000100
83b3512c 86fdbc90
83b35130 00000000
83b35134 00000002
83b35138 00006c07
83b3513c 000092eb
83b35140 89138138
83b35144 83b35384 nt!KiDoubleFaultStack+0x2384
83b35148 8d4b12cb tcpip!WfpProcessInTransportStackIndication+0x676
83b3514c 83b3536c nt!KiDoubleFaultStack+0x236c
83b35150 8c3406a8
83b35154 00000002
83b35158 00000011
83b3515c 87431710
83b35160 89138138
83b35164 00006c07
83b35168 8b6756a4
83b3516c 000092eb
83b35170 83b35350 nt!KiDoubleFaultStack+0x2350
83b35174 86fdbc90
83b35178 88fc5004
83b3517c 88fc5000
83b35180 8c3406a8
83b35184 8d521da0 tcpip!Ipv4Global
83b35188 88f91544
83b3518c 88f915e0
83b35190 83b352d4 nt!KiDoubleFaultStack+0x22d4
83b35194 83aa4b82 nt!RtlpPopulateContext+0x2c
83b35198 00000002
83b3519c 00000000
83b351a0 83b351bc nt!KiDoubleFaultStack+0x21bc
83b351a4 83aa5751 nt!RtlLookupEntryHashTable+0x1e
83b351a8 de6ad53c
83b351ac 8d530760 tcpip!remoteEndpointTable
83b351b0 83b35200 nt!KiDoubleFaultStack+0x2200
83b351b4 00000002
83b351b8 83b35200 nt!KiDoubleFaultStack+0x2200
83b351bc 83b351e4 nt!KiDoubleFaultStack+0x21e4
83b351c0 8d4b19b4 tcpip!WfpAlepFindRemoteEndpoint+0x2a
83b351c4 8d530760 tcpip!remoteEndpointTable
83b351c8 de6ad53c
83b351cc 83b351d8 nt!KiDoubleFaultStack+0x21d8
83b351d0 83b351e0 nt!KiDoubleFaultStack+0x21e0
83b351d4 8d2bb096 ndis!ndisReleaseReadWriteLockX+0x76
83b351d8 00000000
83b351dc 8d5307a0 tcpip!remoteEndpointTableLock
83b351e0 83b351f4 nt!KiDoubleFaultStack+0x21f4
83b351e4 8d2bb017 ndis!NdisReleaseReadWriteLock+0x12
83b351e8 8d5307a0 tcpip!remoteEndpointTableLock
83b351ec 83b35398 nt!KiDoubleFaultStack+0x2398
83b351f0 00000000
83b351f4 83b353a0 nt!KiDoubleFaultStack+0x23a0
83b351f8 8d4c1ae8 tcpip!WfpAleFastUdpInspection+0x223
83b351fc 8d5307a0 tcpip!remoteEndpointTableLock
83b35200 83b35398 nt!KiDoubleFaultStack+0x2398
83b35204 8c3406a8
83b35208 88fc5004
83b3520c 88fc5000
83b35210 00000000
83b35214 8b6756a4
83b35218 00000011
83b3521c 00000000
83b35220 00000000
83b35224 00000000
83b35228 6c070002
83b3522c 000092eb
83b35230 00000000
83b35234 00000000
83b35238 00000000
83b3523c 00000000
83b35240 00000000
83b35244 00000000
83b35248 00000000
83b3524c 00000000
83b35250 00000000
83b35254 00000000
83b35258 00000000
83b3525c 00000000
83b35260 00000000
83b35264 00000000
83b35268 00000000
83b3526c 00000000
83b35270 00000000
83b35274 00000000
83b35278 00000000
83b3527c 00000000
83b35280 00000000
83b35284 00000000
83b35288 00000000
83b3528c 00000000
83b35290 00000000
83b35294 00000000
83b35298 00000000
83b3529c 00000000
83b352a0 00000000
83b352a4 00000000
83b352a8 00000000
83b352ac 00000000
83b352b0 8f371120
83b352b4 00000003
83b352b8 8c6d8a18
83b352bc 0000001d
83b352c0 00000000
83b352c4 0000000f
83b352c8 83b42360 nt!KiNode0+0x60
83b352cc 00000000
83b352d0 83b35354 nt!KiDoubleFaultStack+0x2354
83b352d4 83a8a0cd nt!KiDeferredReadyThread+0x6a1
83b352d8 83b38d20 nt!KiInitialPCR+0x120
83b352dc 8c6d8a18
83b352e0 8c6d0cb0
83b352e4 8c6d8a18
83b352e8 83a8a31e nt!KiDeferredReadyThread+0x8f2
83b352ec 83ad2f66 nt!_iswctype_l+0xa6
83b352f0 ffffffde
83b352f4 00000000
83b352f8 83b35560 nt!KiDoubleFaultStack+0x2560
83b352fc 83ad2be1 nt!_output_l+0x87d
83b35300 00000000
83b35304 83b35600 nt!KiDoubleFaultStack+0x2600
83b35308 83b35600 nt!KiDoubleFaultStack+0x2600
83b3530c 83ad2c47 nt!_output_l+0x8e3
83b35310 00000000
83b35314 83b38d20 nt!KiInitialPCR+0x120
83b35318 00000007
83b3531c 00000000
83b35320 83b35584 nt!KiDoubleFaultStack+0x2584
83b35324 00000000
83b35328 00000000
83b3532c 00000000
83b35330 00000000
83b35334 00000000
83b35338 00000000
83b3533c 00000024
83b35340 83b35694 nt!KiDoubleFaultStack+0x2694
83b35344 00000022
83b35348 ffffffff
83b3534c 82206190 crashdmp!StrCollectingData
83b35350 00000000
83b35354 83b35370 nt!KiDoubleFaultStack+0x2370
83b35358 83a8ad41 nt!KiReadyThread+0x30
83b3535c 8c6d8a18
83b35360 00000000
83b35364 8c6d8a18
83b35368 00000001
83b3536c 8c6d8a18
83b35370 83ad2f29 nt!_iswctype_l+0x69
83b35374 83ad2f66 nt!_iswctype_l+0xa6
83b35378 fffffff8
83b3537c 00000000
83b35380 83b355e8 nt!KiDoubleFaultStack+0x25e8
83b35384 83ad2be1 nt!_output_l+0x87d
83b35388 83ad265e nt!_output_l+0x2fa
83b3538c 83b356b8 nt!KiDoubleFaultStack+0x26b8
83b35390 83b356b8 nt!KiDoubleFaultStack+0x26b8
83b35394 83ad2c47 nt!_output_l+0x8e3
83b35398 00000000
83b3539c 00000000
83b353a0 00000000
83b353a4 00000000
83b353a8 83b3560c nt!KiDoubleFaultStack+0x260c
83b353ac 00000000
83b353b0 00000007
83b353b4 00000000
83b353b8 00000000
83b353bc 00000000
83b353c0 00000000
83b353c4 0000004a
83b353c8 83b356a0 nt!KiDoubleFaultStack+0x26a0
83b353cc 00000008
83b353d0 ffffffff
83b353d4 83b355d4 nt!KiDoubleFaultStack+0x25d4
83b353d8 00000000
83b353dc 8b675602
83b353e0 8bcac530
83b353e4 8713b118
83b353e8 00001000
83b353ec 83b35410 nt!KiDoubleFaultStack+0x2410
83b353f0 00000000
83b353f4 8c01a008
83b353f8 8bcac438
83b353fc 8c01a008
83b35400 8bcac438
83b35404 83b35402 nt!KiDoubleFaultStack+0x2402
83b35408 00000000
83b3540c 00000005
83b35410 86fdbc90
83b35414 00000002
83b35418 83e26ba9 hal!KfLowerIrql+0x61
83b3541c 00000005
83b35420 89835e02
83b35424 83b35434 nt!KiDoubleFaultStack+0x2434
83b35428 83e26ba9 hal!KfLowerIrql+0x61
83b3542c 00000000
83b35430 89835e02
83b35434 83b3546c nt!KiDoubleFaultStack+0x246c
83b35438 83e247ab hal!KfReleaseSpinLock+0xb
83b3543c aa3b1119Unable to load image e1k6232.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for e1k6232.sys
*** ERROR: Module load completed but symbols could not be loaded for e1k6232.sys
e1k6232+0x1d119
83b35440 00000000
83b35444 00000085
83b35448 83b35474 nt!KiDoubleFaultStack+0x2474
83b3544c 87020678
83b35450 00000000
83b35454 83b35468 nt!KiDoubleFaultStack+0x2468
83b35458 83b35474 nt!KiDoubleFaultStack+0x2474
83b3545c 00000000
83b35460 89262098
83b35464 00000006
83b35468 89835e00
83b3546c 83b354a4 nt!KiDoubleFaultStack+0x24a4
83b35470 aa3b11e1 e1k6232+0x1d1e1
83b35474 89834000
83b35478 868f1e98
83b3547c 89835e6c
83b35480 86fdbc90
83b35484 874320e0
83b35488 00000000
83b3548c 00000000
83b35490 00000000
83b35494 00000000
83b35498 fffffffc
83b3549c 0000ffff
83b354a0 89262098
83b354a4 83b354b8 nt!KiDoubleFaultStack+0x24b8
83b354a8 aa3b141c e1k6232+0x1d41c
83b354ac 89834000
83b354b0 86fdbc90
83b354b4 00000000
83b354b8 83b354d0 nt!KiDoubleFaultStack+0x24d0
83b354bc 8d2ec5bf ndis!NdisFReturnNetBufferLists+0x4c
83b354c0 89834000
83b354c4 86fdbc90
83b354c8 00000000
83b354cc 00000000
83b354d0 ffffffff
83b354d4 00000000
83b354d8 83b4231f nt!KiNode0+0x1f
83b354dc ffffffff
83b354e0 00000000
83b354e4 83b4231f nt!KiNode0+0x1f
83b354e8 83b354f8 nt!KiDoubleFaultStack+0x24f8
83b354ec ffffffff
83b354f0 0000001f
83b354f4 83b35504 nt!KiDoubleFaultStack+0x2504
83b354f8 83e26ba9 hal!KfLowerIrql+0x61
83b354fc 83b42380 nt!KiInitialThread
83b35500 0000001f
83b35504 83b3550c nt!KiDoubleFaultStack+0x250c
83b35508 96f7e367Unable to load image nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
nvlddmkm+0x160367
83b3550c 83b35538 nt!KiDoubleFaultStack+0x2538
83b35510 96f92ade nvlddmkm+0x174ade
83b35514 892682e8
83b35518 0000001f
83b3551c 00000028
83b35520 83b35598 nt!KiDoubleFaultStack+0x2598
83b35524 8b040000
83b35528 00000000
83b3552c 00000000
83b35530 00000000
83b35534 0000001f
83b35538 83b35558 nt!KiDoubleFaultStack+0x2558
83b3553c 96f92b51 nvlddmkm+0x174b51
83b35540 83b42380 nt!KiInitialThread
83b35544 00000030
83b35548 83b35570 nt!KiDoubleFaultStack+0x2570
83b3554c 8690aaf8
83b35550 83b42380 nt!KiInitialThread
83b35554 ffffffff
83b35558 96f561b7 nvlddmkm+0x1381b7
83b3555c a6b92701
83b35560 83b355a4 nt!KiDoubleFaultStack+0x25a4
83b35564 83ad2ee4 nt!_vsnprintf_l+0x72
83b35568 83b35584 nt!KiDoubleFaultStack+0x2584
83b3556c 822042a2 crashdmp! ?? ::FNODOBFM::`string'+0x4
83b35570 00000000
83b35574 8caa675e BOOTVID!__outpw+0x1a
83b35578 000003ce
83b3557c 00001008
83b35580 83b3559c nt!KiDoubleFaultStack+0x259c
83b35584 8caa6847 BOOTVID!SetPixel+0x6d
83b35588 8076a4b1
83b3558c 0000000f
83b35590 0000010b
83b35594 00000175
83b35598 00000010
83b3559c 83b355bc nt!KiDoubleFaultStack+0x25bc
83b355a0 8caa6a03 BOOTVID!DisplayCharacter+0x49
83b355a4 0000010b
83b355a8 00000175
83b355ac 0000000f
83b355b0 83b35623 nt!KiDoubleFaultStack+0x2623
83b355b4 0000000e
83b355b8 00000000
83b355bc 83b355e0 nt!KiDoubleFaultStack+0x25e0
83b355c0 8caa6f6a BOOTVID!VidDisplayString+0x62
83b355c4 00000000
83b355c8 83b35600 nt!KiDoubleFaultStack+0x2600
83b355cc 82202c56 crashdmp!CrashdmpFinishRoutine+0x88
83b355d0 00001000
83b355d4 00000000
83b355d8 00000001
83b355dc 00000080
83b355e0 00000000
83b355e4 83b355ec nt!KiDoubleFaultStack+0x25ec
83b355e8 83a1f724 nt!MmIsAddressValid+0xd
83b355ec 83b35618 nt!KiDoubleFaultStack+0x2618
83b355f0 83a12751 nt!IopIsAddressRangeValid+0x36
83b355f4 83b45000 nt!NonPagedPoolDescriptor+0x940
83b355f8 8bab33c8
83b355fc 8bab1480
83b35600 83b35644 nt!KiDoubleFaultStack+0x2644
83b35604 83ae85f9 nt!IopFillTriageDumpDataBlocks+0xc5
83b35608 8bab33c8
83b3560c 83b35000 nt!KiDoubleFaultStack+0x2000
83b35610 00001000
83b35614 8baaac40
83b35618 8baa7000
83b3561c 000125d8
83b35620 8bab1410
83b35624 8bab43c8
83b35628 8bac6000
83b3562c 00001000
83b35630 00000000
83b35634 83b356d8 nt!KiDoubleFaultStack+0x26d8
83b35638 00000006
83b3563c 7454ebe0
83b35640 8bab1470
83b35644 83b35670 nt!KiDoubleFaultStack+0x2670
83b35648 83ae8a99 nt!IoFillTriageDumpBuffer+0x450
83b3564c 8baa7000
83b35650 00000001
83b35654 8baa6000
83b35658 83b356e4 nt!KiDoubleFaultStack+0x26e4
83b3565c 83b35a5c nt!KiDoubleFaultStack+0x2a5c
83b35660 00000000
83b35664 000000c8
83b35668 00000000
83b3566c 000125d8
83b35670 83b35708 nt!KiDoubleFaultStack+0x2708
83b35674 83ae8cd8 nt!IoWriteCrashDump+0x145
83b35678 0001effc
83b3567c 00000dff
83b35680 00000001
83b35684 00000dff
83b35688 00000000
83b3568c 83b35790 nt!KiDoubleFaultStack+0x2790
83b35690 83b42380 nt!KiInitialThread
83b35694 00001790
83b35698 00000001
83b3569c 83b356d8 nt!KiDoubleFaultStack+0x26d8
83b356a0 83b356d8 nt!KiDoubleFaultStack+0x26d8
83b356a4 00000000
83b356a8 a6b92569
83b356ac 00001000
83b356b0 fffff000
83b356b4 00000258
83b356b8 00000000
83b356bc 00000001
83b356c0 00000080
83b356c4 00000000
83b356c8 83b356d0 nt!KiDoubleFaultStack+0x26d0
83b356cc 83a1f724 nt!MmIsAddressValid+0xd
83b356d0 83b356fc nt!KiDoubleFaultStack+0x26fc
83b356d4 83a12751 nt!IopIsAddressRangeValid+0x36
83b356d8 0000000c
83b356dc 00000040
83b356e0 83b74e60 nt!IopTriageDumpDataBlocks
83b356e4 83a1268b nt!IopAddTriageDumpDataBlock+0x23
83b356e8 00000000
83b356ec 00fff000
83b356f0 83b356a8 nt!KiDoubleFaultStack+0x26a8
83b356f4 00000000
83b356f8 ffffffff
83b356fc 83ace6f0 nt!_except_handler4
83b35700 a6ac4291
83b35704 fffffffe
83b35708 83b35ae0 nt!KiDoubleFaultStack+0x2ae0
83b3570c 83aedbcd nt!KeBugCheck2+0x9fb
83b35710 0000009f
83b35714 00000004
83b35718 00000258
83b3571c 86768858
83b35720 83b35b24 nt!KiDoubleFaultStack+0x2b24
83b35724 83b35790 nt!KiDoubleFaultStack+0x2790
83b35728 83b35b30 nt!KiDoubleFaultStack+0x2b30
83b3572c 00000000
83b35730 83b42380 nt!KiInitialThread
83b35734 83016c92Unable to load image NETw5s32.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NETw5s32.sys
*** ERROR: Module load completed but symbols could not be loaded for NETw5s32.sys
NETw5s32+0x40dc92
83b35738 83b38d20 nt!KiInitialPCR+0x120
83b3573c 00000000
83b35740 40000082
83b35744 00000000
83b35748 00000000
83b3574c 00000000
83b35750 83b36000 nt!P0BootStack
83b35754 00000000
83b35758 00000000
83b3575c 00000004
83b35760 00000000
83b35764 83b42380 nt!KiInitialThread
83b35768 00000000
83b3576c 83b35b24 nt!KiDoubleFaultStack+0x2b24
83b35770 83b33000 nt!KiDoubleFaultStack
83b35774 00000003
83b35778 00000258
83b3577c 83b36000 nt!P0BootStack
83b35780 00010001
83b35784 ffffffff
83b35788 0000000e
83b3578c 86768858
83b35790 00010007
83b35794 00000000
83b35798 00000000
83b3579c 00000000
83b357a0 00000000
83b357a4 00000000
83b357a8 00000000
83b357ac 00000000
83b357b0 00000000
83b357b4 00000000
83b357b8 00000000
83b357bc 00000000
83b357c0 00000000
83b357c4 00000000
83b357c8 00000000
83b357cc 00000000
83b357d0 00000000
83b357d4 00000000
83b357d8 00000000
83b357dc 00000000
83b357e0 00000000
83b357e4 00000000
83b357e8 00000000
83b357ec 00000000
83b357f0 00000000
83b357f4 00000000
83b357f8 00000000
83b357fc 00000000
83b35800 00000000
83b35804 00000000
83b35808 00000000
83b3580c 00000000
83b35810 00000000
83b35814 00000000
83b35818 00000000
83b3581c 00000000
83b35820 00000030
83b35824 00000023
83b35828 00000023
83b3582c 00000000
83b35830 83b38d20 nt!KiInitialPCR+0x120
83b35834 83b42302 nt!KiNode0+0x2
83b35838 00000000
83b3583c 07b9da37
83b35840 83b45f84 nt!KiHardwareTrigger
83b35844 83b35b04 nt!KiDoubleFaultStack+0x2b04
83b35848 83aecbfc nt!KeBugCheckEx+0x1e
83b3584c 00000008
83b35850 00000202
83b35854 83b35ae8 nt!KiDoubleFaultStack+0x2ae8
83b35858 00000010
83b3585c 00000000
83b35860 00000000
83b35864 00000000
83b35868 00000000
83b3586c 00000000
83b35870 00000000
83b35874 00000000
83b35878 00000000
83b3587c 00000000
83b35880 00000000
83b35884 00000000
83b35888 00000000
83b3588c 00000000
83b35890 00000000
83b35894 00000000
83b35898 00000000
83b3589c 00000000
83b358a0 00000000
83b358a4 00000000
83b358a8 00000000
83b358ac 00000000
83b358b0 00000000
83b358b4 00000000
83b358b8 00000000
83b358bc 00000000
83b358c0 00000000
83b358c4 00000000
83b358c8 00000000
83b358cc 00000000
83b358d0 00000000
83b358d4 00000000
83b358d8 00000000
83b358dc 00000000
83b358e0 00000000
83b358e4 00000000
83b358e8 00000000
83b358ec 00000000
83b358f0 00000000
83b358f4 00000000
83b358f8 00000000
83b358fc 00000000
83b35900 00000000
83b35904 00000000
83b35908 00000000
83b3590c 00000000
83b35910 00000000
83b35914 00000000
83b35918 00000000
83b3591c 00000000
83b35920 00000000
83b35924 00000000
83b35928 00000000
83b3592c 00000000
83b35930 00000000
83b35934 00000000
83b35938 00000000
83b3593c 00000000
83b35940 00000000
83b35944 00000000
83b35948 00000000
83b3594c 00000000
83b35950 00000000
83b35954 00000000
83b35958 00000000
83b3595c 00000000
83b35960 00000000
83b35964 00000000
83b35968 00000000
83b3596c 00000000
83b35970 00000000
83b35974 00000000
83b35978 00000000
83b3597c 00000000
83b35980 00000000
83b35984 00000000
83b35988 00000000
83b3598c 00000000
83b35990 00000000
83b35994 00000000
83b35998 00000000
83b3599c 00000000
83b359a0 00000000
83b359a4 00000000
83b359a8 00000000
83b359ac 00000000
83b359b0 00000000
83b359b4 00000000
83b359b8 00000000
83b359bc 00000000
83b359c0 00000000
83b359c4 00000000
83b359c8 00000000
83b359cc 00000000
83b359d0 00000000
83b359d4 00000000
83b359d8 00000000
83b359dc 00000000
83b359e0 00000000
83b359e4 00000000
83b359e8 00000000
83b359ec 00000000
83b359f0 00000000
83b359f4 00000000
83b359f8 00000000
83b359fc 00000000
83b35a00 00000000
83b35a04 00000000
83b35a08 00000000
83b35a0c 00000000
83b35a10 00000000
83b35a14 00000000
83b35a18 00000000
83b35a1c 00000000
83b35a20 00000000
83b35a24 00000000
83b35a28 00000000
83b35a2c 00000000
83b35a30 00000000
83b35a34 00000000
83b35a38 00000000
83b35a3c 00000000
83b35a40 00000000
83b35a44 00000000
83b35a48 00000000
83b35a4c 00000000
83b35a50 00000000
83b35a54 00000000
83b35a58 00000000
83b35a5c 00000002
83b35a60 83a8a300 nt!KiDeferredReadyThread+0x8d4
83b35a64 83a86f51 nt!KiTryUnwaitThread+0x48
83b35a68 89625590
83b35a6c 89625590
83b35a70 89625524
83b35a74 83b35a94 nt!KiDoubleFaultStack+0x2a94
83b35a78 40820088
83b35a7c 00000002
83b35a80 000008e1
83b35a84 000008e1
83b35a88 a004d88b
83b35a8c 0000007f
83b35a90 89625590
83b35a94 83b38d20 nt!KiInitialPCR+0x120
83b35a98 89625524
83b35a9c 00000001
83b35aa0 83b3b2f4 nt!KiInitialPCR+0x26f4
83b35aa4 83b3b2f0 nt!KiInitialPCR+0x26f0
83b35aa8 00000000
83b35aac 00000f07
83b35ab0 83b35ac4 nt!KiDoubleFaultStack+0x2ac4
83b35ab4 83a88bce nt!KiInsertOrSignalTimer+0x14
83b35ab8 89625590
83b35abc 83b35af0 nt!KiDoubleFaultStack+0x2af0
83b35ac0 00000000
83b35ac4 8f3c2ae0
83b35ac8 83b38d20 nt!KiInitialPCR+0x120
83b35acc 00000001
83b35ad0 00000000
83b35ad4 00000002
83b35ad8 89625590
83b35adc 83b42380 nt!KiInitialThread
83b35ae0 83b35b04 nt!KiDoubleFaultStack+0x2b04
83b35ae4 83aecbfc nt!KeBugCheckEx+0x1e
83b35ae8 0000009f
83b35aec 00000004
83b35af0 00000258
83b35af4 86768858
83b35af8 83b35b24 nt!KiDoubleFaultStack+0x2b24
83b35afc 00000000
83b35b00 00000000
83b35b04 83b35b30 nt!KiDoubleFaultStack+0x2b30
83b35b08 83ae9dd7 nt!PnpBugcheckPowerTimeout+0x57
83b35b0c 0000009f
83b35b10 00000004
83b35b14 00000258
83b35b18 86768858
83b35b1c 83b35b24 nt!KiDoubleFaultStack+0x2b24
83b35b20 83b35bac nt!KiDoubleFaultStack+0x2bac
83b35b24 00018001
83b35b28 83b74aa0 nt!PnpDeviceCompletionQueue
83b35b2c 83b493bc nt!ExWorkerQueue+0x3c
83b35b30 83b35b38 nt!KiDoubleFaultStack+0x2b38
83b35b34 83d38fb5 nt!PopBuildDeviceNotifyListWatchdog+0x16
83b35b38 83b35b7c nt!KiDoubleFaultStack+0x2b7c
83b35b3c 83a874d9 nt!KiProcessTimerDpcTable+0x50
83b35b40 8f3c2ac0
83b35b44 8f3c2ae0
83b35b48 eceff1da
83b35b4c 01ceadf1
83b35b50 83b35bbc nt!KiDoubleFaultStack+0x2bbc
83b35b54 83b38d20 nt!KiInitialPCR+0x120
83b35b58 83b3a6c0 nt!KiInitialPCR+0x1ac0
83b35b5c 86903030
83b35b60 00000001
83b35b64 86903030
83b35b68 83b35b80 nt!KiDoubleFaultStack+0x2b80
83b35b6c 83a8acff nt!KiProcessThreadWaitList+0x3f
83b35b70 83b35bbc nt!KiDoubleFaultStack+0x2bbc
83b35b74 00b38d20
83b35b78 83b3a6c0 nt!KiInitialPCR+0x1ac0
83b35b7c 83b35c68 nt!KiDoubleFaultStack+0x2c68
83b35b80 83a8747d nt!KiProcessExpiredTimerList+0x101
83b35b84 83b38d20 nt!KiInitialPCR+0x120
83b35b88 83b35ca8 nt!KiDoubleFaultStack+0x2ca8
83b35b8c 00000001
83b35b90 83b3a680 nt!KiInitialPCR+0x1a80
83b35b94 83b3b2f4 nt!KiInitialPCR+0x26f4
83b35b98 83b3b2f0 nt!KiInitialPCR+0x26f0
83b35b9c 00000009
83b35ba0 89625524
83b35ba4 82c018a4*** WARNING: Unable to verify timestamp for Accelern.sys
*** ERROR: Module load completed but symbols could not be loaded for Accelern.sys
Accelern+0x18a4
83b35ba8 896254b0
83b35bac 8f3c2ac0
83b35bb0 83d38f9f nt!PopBuildDeviceNotifyListWatchdog
83b35bb4 8f3c2ae0
83b35bb8 89625524
83b35bbc 82c018a4 Accelern+0x18a4
83b35bc0 896254b0
83b35bc4 89625524
83b35bc8 82c018a4 Accelern+0x18a4
83b35bcc 83b38d20 nt!KiInitialPCR+0x120
83b35bd0 0003865a
83b35bd4 83a88f9d nt!KeAccumulateTicks+0xc8
83b35bd8 0003865a
83b35bdc 00000000
83b35be0 00026161
83b35be4 00000000
83b35be8 83b3a654 nt!KiInitialPCR+0x1a54
83b35bec 00026161
83b35bf0 83b35c0c nt!KiDoubleFaultStack+0x2c0c
83b35bf4 00000001
83b35bf8 83b3b2dc nt!KiInitialPCR+0x26dc
83b35bfc 83b42380 nt!KiInitialThread
83b35c00 a001b3da
83b35c04 00000000
83b35c08 83b35c48 nt!KiDoubleFaultStack+0x2c48
83b35c0c 83a88763 nt!KeUpdateRunTime+0x145
83b35c10 00026161
83b35c14 00000000
83b35c18 00359d00
83b35c1c 00000002
83b35c20 00000006
83b35c24 00000000
83b35c28 00000006
83b35c2c 00000001
83b35c30 00359d82
83b35c34 00359d00
83b35c38 83b35cb4 nt!KiDoubleFaultStack+0x2cb4
83b35c3c 00000002
83b35c40 a004153b
83b35c44 0000007f
83b35c48 83b35ca0 nt!KiDoubleFaultStack+0x2ca0
83b35c4c 83a88610 nt!KeUpdateSystemTime+0x613
83b35c50 83a852da nt!KiIdleLoop+0x1a
83b35c54 b2a740d2
83b35c58 00000000
83b35c5c 83b40300 nt!KiPendingTimers+0x2040
83b35c60 00000010
83b35c64 00000002
83b35c68 83b35cdc nt!KiDoubleFaultStack+0x2cdc
83b35c6c 83a872ee nt!KiTimerExpiration+0x210
83b35c70 83b38d20 nt!KiInitialPCR+0x120
83b35c74 83b35ca8 nt!KiDoubleFaultStack+0x2ca8
83b35c78 00000000
83b35c7c 00000010
83b35c80 83b42380 nt!KiInitialThread
83b35c84 83b38d20 nt!KiInitialPCR+0x120
83b35c88 00000008
83b35c8c 00000010
83b35c90 00000000
83b35c94 83b38d20 nt!KiInitialPCR+0x120
83b35c98 00359d82
83b35c9c 83b3b2b0 nt!KiInitialPCR+0x26b0
83b35ca0 00000082
83b35ca4 83b3b2f0 nt!KiInitialPCR+0x26f0
83b35ca8 eceff1da
83b35cac 01ceadf1
83b35cb0 a004153b
83b35cb4 0000007f
83b35cb8 c0a852da
83b35cbc badb0d00
83b35cc0 00000000
83b35cc4 00000000
83b35cc8 80000000
83b35ccc 00000002
83b35cd0 d67ccb2a
83b35cd4 0000001d
83b35cd8 00008c58
83b35cdc 83b35d20 nt!KiDoubleFaultStack+0x2d20
83b35ce0 83a854ce nt!KiRetireDpcList+0xcb
83b35ce4 00359d82
83b35ce8 8c88b778
83b35cec 83b42380 nt!KiInitialThread
83b35cf0 83b38c00 nt!KiInitialPCR
83b35cf4 0000007f
83b35cf8 00000000
83b35cfc 00000008
83b35d00 ffffffff
83b35d04 0000485c
83b35d08 8c88b778
83b35d0c 00000000
83b35d10 b2a74327
83b35d14 00003bc0
83b35d18 00000000
83b35d1c 0000485c
83b35d20 86762c40
83b35d24 83a852f8 nt!KiIdleLoop+0x38
83b35d28 00000000
83b35d2c 0000000e
83b35d30 00000000
83b35d34 00000000
83b35d38 00000000
83b35d3c 00000000
83b35d40 00000000
83b35d44 00000000
83b35d48 00000000
83b35d4c 00000000
83b35d50 00000000
83b35d54 00000000
83b35d58 00000000
83b35d5c 00000000
83b35d60 00000000
83b35d64 00000000
83b35d68 00000000
83b35d6c 00000000
83b35d70 00000000
83b35d74 00000000
83b35d78 00000000
83b35d7c 00000000
83b35d80 00000000
83b35d84 ffffffff
83b35d88 00000001
83b35d8c 83abe540 nt!KiThreadStartup
83b35d90 83b35d90 nt!KiDoubleFaultStack+0x2d90
83b35d94 83a852c0 nt!KiIdleLoop
83b35d98 00000000

This almost made me lost my mind once as well, though it’s just an artifact
of the implementation in the x86 O/S confused by the symbolic debug info
(TL;DR: nothing to see here, move along :)).

As a disclaimer, all of the following is of course implementation specific
detail that is subject to change. I think it’s an interesting exercise
though so worth the effort.

To start, let’s look at how the double fault stack is registered with the
processor. IDT entry 8 is where the double fault handler lives, so let’s
dump that:

kd> !idt 8

Dumping IDT: 80b95400

08: Task Selector = 0x0050

This points off to a task selector in the GDT, which we can dump with dg:

kd> dg 50
P Si Gr Pr Lo
Sel Base Limit Type l ze an es ng Flags


0050 82932000 00000068 TSS32 Avl 0 Nb By P Nl 00000089

The base address points to a TSS, which is a KTSS on the x86:

kd> dt nt!_ktss 82932000

+0x038 Esp : 0x8292f000

The ESP value is what the processor will use as a stack pointer on a double
fault and we see that it does match the symbol nt!KiDoubleFaultStack:

kd> ln 0x8292f000
Exact matches:
nt!KiDoubleFaultStack =

Important to note at this point that stacks grown down. This means that
the symbol nt!KiDoubleFaultStack is the TOP of the double fault stack. Thus,
the valid range of the double fault stack on the x86 would be
nt!KiDoubleFaultStack through nt!KiDoubleFaultStack-0x3000. Anything that is
nt!KiDoubleFaultStack+X is just stuff that happens to be located in memory
near the symbol nt!KiDoubleFaultStack.

This is where things get interesting. Now let’s look at the Idle thread on
processor zero:

kd> !prcb
PRCB for Processor 0 at 82934d20:
Current IRQL – 2
Threads-- Current 8a5e72a0 Next 00000000 Idle 8293e280


kd> !thread 8293e280

Win32 Start Address nt!KiIdleLoop (0x82873000)
Stack Init 82931fd0 Current 82931d1c Base 82932000 Limit 8292f000 Call 0


Again, stacks grow down, so we see that the base address of this thread’s
stack is 82932000 and the limit is 8292f000 (which is lower in memory). Note
that we have seen this address before:

kd> ln 0x8292f000
Exact matches:
nt!KiDoubleFaultStack =

Thus, the processor zero Idle thread stack lives just above the double fault
stack in memory. If I dump some location in the Idle thread’s stack, the
debugger is going to “help me out” by finding the nearest symbol which
happens to be nt!KiDoubleFaultStack (even though it doesn’t have anything to
actually do with that symbol):

kd> ln 0x8292f000+1000
(8292f000) nt!KiDoubleFaultStack+0x1000

Now, back to your original raw dump. Mostly what you’re seeing are some
leftover EBP chains where the EBP values are on the Idle thread stack.
Normally these wouldn’t be given names (stack pointers don’t have symbolic
names), but in this case they happen to be near the double fault stack so
you get confusing names.

For example:


83b350cc 83b350d8 nt!KiDoubleFaultStack+0x20d8
83b350d0 8d4a8e0d tcpip!IpSecGetSecurityContext+0xd

83b350d8 83b35148 nt!KiDoubleFaultStack+0x2148
83b350dc 8d4a9208 tcpip!IPSecTLPacketsInProcessing+0x19

As for why you’re seeing these here, one of the jobs of the Idle thread is
to drain any entries on the DPC queue. So, you see some DPC processing occur
in the context of an Idle thread. There’s further evidence of this way down
at the end of the output where we have an EBP chain of the Idle thread
calling KiRetireDpcList:

83b35cdc 83b35d20 nt!KiDoubleFaultStack+0x2d20
83b35ce0 83a854ce nt!KiRetireDpcList+0xcb

83b35d20 86762c40
83b35d24 83a852f8 nt!KiIdleLoop+0x38

-scott
OSR

Awesome, thanks for the great guidance Scott. I will certainly walk it!