Please HELP - Analyzing IRQL_NOT_LESS_OR_EQUAL

NTDEV
1

Hi

My driver works ok but crashes only on a specific computer - IBM
thinkpad laptop. I did a kernel memory dump but didn’t find my driver
in the stack. Also, it crashes on different functions every time! here
is a WinDbg analyze output… Any help ?

******************************?******************************?*******************
*
*
* Bugcheck Analysis
*
*
*
******************************?******************************?*******************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid)
address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000016, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804dc352, address which referenced memory

Debugging Details:

READ_ADDRESS: 00000016

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiWaitTest+30
804dc352 6683781601 cmp word ptr [eax+0x16],0x1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 804e3f72 to 804dc352

IRP_ADDRESS: 824818b8

DEVICE_OBJECT: 82f3ba68

DRIVER_OBJECT: 82f562b8

IMAGE_NAME: ftdisk.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8419

MODULE_NAME: ftdisk

FAULTING_MODULE: f85f3000 ftdisk

TRAP_FRAME: eecebb70 – (.trap ffffffffeecebb70)
ErrCode = 00000000
eax=00000000 ebx=eeceaf48 ecx=eecebbf0 edx=00000000 esi=eeceaf40
edi=00000000
eip=804dc352 esp=eecebbe4 ebp=eecebc00 iopl=0 nv up ei pl nz ac
po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010217
nt!KiWaitTest+0x30:
804dc352 6683781601 cmp word ptr [eax+0x16],0x1
ds:0023:00000016=???
Resetting default scope

STACK_TEXT:
eecebc00 804e3f72 00000000 00000000 824818b8 nt!KiWaitTest+0x30
eecebc14 804ed1e2 eeceaf40 00000000 00000000 nt!KeSetEvent+0x58
eecebc6c 804ed15a 824818f8 eecebcb8 eecebcac
nt!IopCompleteRequest+0x22f
eecebcbc 804ed199 00000000 00000000 00000000 nt!KiDeliverApc+0xb3
eecebcd4 804dc6f2 000024ff e334e7e0 00000000 nt!KiSwapThread+0x64
eecebcfc bf802ec4 00000001 0000000d 00000001
nt!KeWaitForSingleObject+0x1c2
eecebd38 bf8036ca 000024ff 00000000 00000001
win32k!xxxSleepThread+0x192
eecebd4c bf8036e7 000024ff 00000000 00c3ff1c
win32k!xxxRealWaitMessageEx+0x?12
eecebd5c 804df06b 00c3ff44 7c90eb94 badb0d00
win32k!NtUserWaitMessage+0x14
eecebd5c 7c90eb94 00c3ff44 7c90eb94 badb0d00 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be
wrong.
00c3ff10 00000000 00000000 00000000 00000000 0x7c90eb94

SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

STACK_COMMAND: .trap ffffffffeecebb70 ; kb

FAILURE_BUCKET_ID: 0xA_IMAGE_ftdisk.sys_DATE_8_17?_2001

BUCKET_ID: 0xA_IMAGE_ftdisk.sys_DATE_8_17?_2001

Followup: MachineOwner

2

refer to INFO: Different Ways of Handling IRPs - Cheat Sheet (Part 1
of 2)(http://support.microsoft.com/default.aspx?scid=kb;en-us;320275).
Maybe find any clues.

On 7/3/05, Omer B wrote:
> Hi
>
>
> My driver works ok but crashes only on a specific computer - IBM
> thinkpad laptop. I did a kernel memory dump but didn’t find my driver
> in the stack. Also, it crashes on different functions every time! here
> is a WinDbg analyze output… Any help ?
>
>
> ??
>
>
> * Bugcheck Analysis
>
>
>
>******? ***********?
>
>
> IRQL_NOT_LESS_OR_EQUAL (a)
> An attempt was made to access a pageable (or completely invalid)
> address at an
> interrupt request level (IRQL) that is too high. This is usually
> caused by drivers using improper addresses.
> If a kernel debugger is available get the stack backtrace.
> Arguments:
> Arg1: 00000016, memory referenced
> Arg2: 00000002, IRQL
> Arg3: 00000000, value 0 = read operation, 1 = write operation
> Arg4: 804dc352, address which referenced memory
>
>
> Debugging Details:
> ------------------
>
>
> READ_ADDRESS: 00000016
>
>
> CURRENT_IRQL: 2
>
>
> FAULTING_IP:
> nt!KiWaitTest+30
> 804dc352 6683781601 cmp word ptr [eax+0x16],0x1
>
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT
>
>
> BUGCHECK_STR: 0xA
>
>
> LAST_CONTROL_TRANSFER: from 804e3f72 to 804dc352
>
>
> IRP_ADDRESS: 824818b8
>
>
> DEVICE_OBJECT: 82f3ba68
>
>
> DRIVER_OBJECT: 82f562b8
>
>
> IMAGE_NAME: ftdisk.sys
>
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8419
>
>
> MODULE_NAME: ftdisk
>
>
> FAULTING_MODULE: f85f3000 ftdisk
>
>
> TRAP_FRAME: eecebb70 – (.trap ffffffffeecebb70)
> ErrCode = 00000000
> eax=00000000 ebx=eeceaf48 ecx=eecebbf0 edx=00000000 esi=eeceaf40
> edi=00000000
> eip=804dc352 esp=eecebbe4 ebp=eecebc00 iopl=0 nv up ei pl nz ac
> po cy
> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> efl=00010217
> nt!KiWaitTest+0x30:
> 804dc352 6683781601 cmp word ptr [eax+0x16],0x1
> ds:0023:00000016=???
> Resetting default scope
>
>
> STACK_TEXT:
> eecebc00 804e3f72 00000000 00000000 824818b8 nt!KiWaitTest+0x30
> eecebc14 804ed1e2 eeceaf40 00000000 00000000 nt!KeSetEvent+0x58
> eecebc6c 804ed15a 824818f8 eecebcb8 eecebcac
> nt!IopCompleteRequest+0x22f
> eecebcbc 804ed199 00000000 00000000 00000000 nt!KiDeliverApc+0xb3
> eecebcd4 804dc6f2 000024ff e334e7e0 00000000 nt!KiSwapThread+0x64
> eecebcfc bf802ec4 00000001 0000000d 00000001
> nt!KeWaitForSingleObject+0x1c2
> eecebd38 bf8036ca 000024ff 00000000 00000001
> win32k!xxxSleepThread+0x192
> eecebd4c bf8036e7 000024ff 00000000 00c3ff1c
> win32k!xxxRealWaitMessageEx+0x?12
> eecebd5c 804df06b 00c3ff44 7c90eb94 badb0d00
> win32k!NtUserWaitMessage+0x14
> eecebd5c 7c90eb94 00c3ff44 7c90eb94 badb0d00 nt!KiFastCallEntry+0xf8
> WARNING: Frame IP not in any known module. Following frames may be
> wrong.
> 00c3ff10 00000000 00000000 00000000 00000000 0x7c90eb94
>
>
> SYMBOL_STACK_INDEX: 2
>
>
> FOLLOWUP_NAME: MachineOwner
>
>
> STACK_COMMAND: .trap ffffffffeecebb70 ; kb
>
>
> FAILURE_BUCKET_ID: 0xA_IMAGE_ftdisk.sys_DATE_8_17?_2001
>
>
> BUCKET_ID: 0xA_IMAGE_ftdisk.sys_DATE_8_17?_2001
>
>
> Followup: MachineOwner
> ---------
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

3

Can you please explain the connetion between the crash and IRP handling ?

On 7/3/05, Leo wrote:
> refer to INFO: Different Ways of Handling IRPs - Cheat Sheet (Part 1
> of 2)(http://support.microsoft.com/default.aspx?scid=kb;en-us;320275).
> Maybe find any clues.
>
>
> On 7/3/05, Omer B wrote:
> > Hi
> >
> >
> > My driver works ok but crashes only on a specific computer - IBM
> > thinkpad laptop. I did a kernel memory dump but didn’t find my driver
> > in the stack. Also, it crashes on different functions every time! here
> > is a WinDbg analyze output… Any help ?
> >
> >
> > ??
> >
> >
> > * Bugcheck Analysis
> >
> >
> >
> >******? ***********?
> >
> >
> > IRQL_NOT_LESS_OR_EQUAL (a)
> > An attempt was made to access a pageable (or completely invalid)
> > address at an
> > interrupt request level (IRQL) that is too high. This is usually
> > caused by drivers using improper addresses.
> > If a kernel debugger is available get the stack backtrace.
> > Arguments:
> > Arg1: 00000016, memory referenced
> > Arg2: 00000002, IRQL
> > Arg3: 00000000, value 0 = read operation, 1 = write operation
> > Arg4: 804dc352, address which referenced memory
> >
> >
> > Debugging Details:
> > ------------------
> >
> >
> > READ_ADDRESS: 00000016
> >
> >
> > CURRENT_IRQL: 2
> >
> >
> > FAULTING_IP:
> > nt!KiWaitTest+30
> > 804dc352 6683781601 cmp word ptr [eax+0x16],0x1
> >
> >
> > DEFAULT_BUCKET_ID: DRIVER_FAULT
> >
> >
> > BUGCHECK_STR: 0xA
> >
> >
> > LAST_CONTROL_TRANSFER: from 804e3f72 to 804dc352
> >
> >
> > IRP_ADDRESS: 824818b8
> >
> >
> > DEVICE_OBJECT: 82f3ba68
> >
> >
> > DRIVER_OBJECT: 82f562b8
> >
> >
> > IMAGE_NAME: ftdisk.sys
> >
> >
> > DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8419
> >
> >
> > MODULE_NAME: ftdisk
> >
> >
> > FAULTING_MODULE: f85f3000 ftdisk
> >
> >
> > TRAP_FRAME: eecebb70 – (.trap ffffffffeecebb70)
> > ErrCode = 00000000
> > eax=00000000 ebx=eeceaf48 ecx=eecebbf0 edx=00000000 esi=eeceaf40
> > edi=00000000
> > eip=804dc352 esp=eecebbe4 ebp=eecebc00 iopl=0 nv up ei pl nz ac
> > po cy
> > cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> > efl=00010217
> > nt!KiWaitTest+0x30:
> > 804dc352 6683781601 cmp word ptr [eax+0x16],0x1
> > ds:0023:00000016=???
> > Resetting default scope
> >
> >
> > STACK_TEXT:
> > eecebc00 804e3f72 00000000 00000000 824818b8 nt!KiWaitTest+0x30
> > eecebc14 804ed1e2 eeceaf40 00000000 00000000 nt!KeSetEvent+0x58
> > eecebc6c 804ed15a 824818f8 eecebcb8 eecebcac
> > nt!IopCompleteRequest+0x22f
> > eecebcbc 804ed199 00000000 00000000 00000000 nt!KiDeliverApc+0xb3
> > eecebcd4 804dc6f2 000024ff e334e7e0 00000000 nt!KiSwapThread+0x64
> > eecebcfc bf802ec4 00000001 0000000d 00000001
> > nt!KeWaitForSingleObject+0x1c2
> > eecebd38 bf8036ca 000024ff 00000000 00000001
> > win32k!xxxSleepThread+0x192
> > eecebd4c bf8036e7 000024ff 00000000 00c3ff1c
> > win32k!xxxRealWaitMessageEx+0x?12
> > eecebd5c 804df06b 00c3ff44 7c90eb94 badb0d00
> > win32k!NtUserWaitMessage+0x14
> > eecebd5c 7c90eb94 00c3ff44 7c90eb94 badb0d00 nt!KiFastCallEntry+0xf8
> > WARNING: Frame IP not in any known module. Following frames may be
> > wrong.
> > 00c3ff10 00000000 00000000 00000000 00000000 0x7c90eb94
> >
> >
> > SYMBOL_STACK_INDEX: 2
> >
> >
> > FOLLOWUP_NAME: MachineOwner
> >
> >
> > STACK_COMMAND: .trap ffffffffeecebb70 ; kb
> >
> >
> > FAILURE_BUCKET_ID: 0xA_IMAGE_ftdisk.sys_DATE_8_17?_2001
> >
> >
> > BUCKET_ID: 0xA_IMAGE_ftdisk.sys_DATE_8_17?_2001
> >
> >
> > Followup: MachineOwner
> > ---------
> >
> > —
> > Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

4

I had encountered a BSOD like this. That was caused by used
KeWaitSingalObject when the IRQL was greater than PASS_LEAVLE.

On 7/3/05, Omer B wrote:
> Can you please explain the connetion between the crash and IRP handling ?
>
> On 7/3/05, Leo wrote:
> > refer to INFO: Different Ways of Handling IRPs - Cheat Sheet (Part 1
> > of 2)(http://support.microsoft.com/default.aspx?scid=kb;en-us;320275).
> > Maybe find any clues.
> >
> >
> > On 7/3/05, Omer B wrote:
> > > Hi
> > >
> > >
> > > My driver works ok but crashes only on a specific computer - IBM
> > > thinkpad laptop. I did a kernel memory dump but didn’t find my driver
> > > in the stack. Also, it crashes on different functions every time! here
> > > is a WinDbg analyze output… Any help ?
> > >
> > >
> > > ??
> > >
> > >
> > > * Bugcheck Analysis
> > >
> > >
> > >
> > >******? ***********?
> > >
> > >
> > > IRQL_NOT_LESS_OR_EQUAL (a)
> > > An attempt was made to access a pageable (or completely invalid)
> > > address at an
> > > interrupt request level (IRQL) that is too high. This is usually
> > > caused by drivers using improper addresses.
> > > If a kernel debugger is available get the stack backtrace.
> > > Arguments:
> > > Arg1: 00000016, memory referenced
> > > Arg2: 00000002, IRQL
> > > Arg3: 00000000, value 0 = read operation, 1 = write operation
> > > Arg4: 804dc352, address which referenced memory
> > >
> > >
> > > Debugging Details:
> > > ------------------
> > >
> > >
> > > READ_ADDRESS: 00000016
> > >
> > >
> > > CURRENT_IRQL: 2
> > >
> > >
> > > FAULTING_IP:
> > > nt!KiWaitTest+30
> > > 804dc352 6683781601 cmp word ptr [eax+0x16],0x1
> > >
> > >
> > > DEFAULT_BUCKET_ID: DRIVER_FAULT
> > >
> > >
> > > BUGCHECK_STR: 0xA
> > >
> > >
> > > LAST_CONTROL_TRANSFER: from 804e3f72 to 804dc352
> > >
> > >
> > > IRP_ADDRESS: 824818b8
> > >
> > >
> > > DEVICE_OBJECT: 82f3ba68
> > >
> > >
> > > DRIVER_OBJECT: 82f562b8
> > >
> > >
> > > IMAGE_NAME: ftdisk.sys
> > >
> > >
> > > DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8419
> > >
> > >
> > > MODULE_NAME: ftdisk
> > >
> > >
> > > FAULTING_MODULE: f85f3000 ftdisk
> > >
> > >
> > > TRAP_FRAME: eecebb70 – (.trap ffffffffeecebb70)
> > > ErrCode = 00000000
> > > eax=00000000 ebx=eeceaf48 ecx=eecebbf0 edx=00000000 esi=eeceaf40
> > > edi=00000000
> > > eip=804dc352 esp=eecebbe4 ebp=eecebc00 iopl=0 nv up ei pl nz ac
> > > po cy
> > > cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> > > efl=00010217
> > > nt!KiWaitTest+0x30:
> > > 804dc352 6683781601 cmp word ptr [eax+0x16],0x1
> > > ds:0023:00000016=???
> > > Resetting default scope
> > >
> > >
> > > STACK_TEXT:
> > > eecebc00 804e3f72 00000000 00000000 824818b8 nt!KiWaitTest+0x30
> > > eecebc14 804ed1e2 eeceaf40 00000000 00000000 nt!KeSetEvent+0x58
> > > eecebc6c 804ed15a 824818f8 eecebcb8 eecebcac
> > > nt!IopCompleteRequest+0x22f
> > > eecebcbc 804ed199 00000000 00000000 00000000 nt!KiDeliverApc+0xb3
> > > eecebcd4 804dc6f2 000024ff e334e7e0 00000000 nt!KiSwapThread+0x64
> > > eecebcfc bf802ec4 00000001 0000000d 00000001
> > > nt!KeWaitForSingleObject+0x1c2
> > > eecebd38 bf8036ca 000024ff 00000000 00000001
> > > win32k!xxxSleepThread+0x192
> > > eecebd4c bf8036e7 000024ff 00000000 00c3ff1c
> > > win32k!xxxRealWaitMessageEx+0x?12
> > > eecebd5c 804df06b 00c3ff44 7c90eb94 badb0d00
> > > win32k!NtUserWaitMessage+0x14
> > > eecebd5c 7c90eb94 00c3ff44 7c90eb94 badb0d00 nt!KiFastCallEntry+0xf8
> > > WARNING: Frame IP not in any known module. Following frames may be
> > > wrong.
> > > 00c3ff10 00000000 00000000 00000000 00000000 0x7c90eb94
> > >
> > >
> > > SYMBOL_STACK_INDEX: 2
> > >
> > >
> > > FOLLOWUP_NAME: MachineOwner
> > >
> > >
> > > STACK_COMMAND: .trap ffffffffeecebb70 ; kb
> > >
> > >
> > > FAILURE_BUCKET_ID: 0xA_IMAGE_ftdisk.sys_DATE_8_17?_2001
> > >
> > >
> > > BUCKET_ID: 0xA_IMAGE_ftdisk.sys_DATE_8_17?_2001
> > >
> > >
> > > Followup: MachineOwner
> > > ---------
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

5

The address passed into KeSetEvent is a bit suspicious.

Based upon the address, this is either a piece of paged pool memory that
has been used for a dispatcher object (try “!pool eeceaf40” which is the
address of the KEVENT passed into KeSetEvent) or possibly a stack
address that has passed out of scope and been reused (try “!thread
eeceaf40” to see if you can find a thread using that region as stack) or
perhaps an uninitialized KEVENT object.

It is clearly being passed in via the IRP (the first parameter to
IopCompleteRequest is the APC object address, and the APC is embedded in
the IRP. Use “dt nt!_IRP” to find the offset to the APC object and then
use "dt nt!_IRP

- " to get a dump of the
raw IRP. The IRP is still on the IRP queue for the thread, so you
should also be able to find it using "!thread" - the IRP will still be
listed against this thread. Most likely, Irp->UserEvent is the event
being signaled. If that isn't the address you see passed into
KeSetEvent, then you will need to look at the event in the file object
passed in via this IRP. Depending upon which KEVENT is improperly
initialized or used, it is going to point you in substantially different
directions.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Omer B
Sent: Sunday, July 03, 2005 5:17 AM
To: ntdev redirect
Subject: [ntdev] Please HELP - Analyzing IRQL_NOT_LESS_OR_EQUAL

Hi

My driver works ok but crashes only on a specific computer - IBM
thinkpad laptop. I did a kernel memory dump but didn't find my driver
in the stack. Also, it crashes on different functions every time! here
is a WinDbg analyze output... Any help ?

******************************-****************************** - **********
*********
*
*
* Bugcheck Analysis
*
*
*
******************************-****************************** - **********
*********

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid)
address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000016, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804dc352, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: 00000016

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiWaitTest+30
804dc352 6683781601 cmp word ptr [eax+0x16],0x1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 804e3f72 to 804dc352

IRP_ADDRESS: 824818b8

DEVICE_OBJECT: 82f3ba68

DRIVER_OBJECT: 82f562b8

IMAGE_NAME: ftdisk.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8419

MODULE_NAME: ftdisk

FAULTING_MODULE: f85f3000 ftdisk

TRAP_FRAME: eecebb70 -- (.trap ffffffffeecebb70)
ErrCode = 00000000
eax=00000000 ebx=eeceaf48 ecx=eecebbf0 edx=00000000 esi=eeceaf40
edi=00000000
eip=804dc352 esp=eecebbe4 ebp=eecebc00 iopl=0 nv up ei pl nz ac
po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010217
nt!KiWaitTest+0x30:
804dc352 6683781601 cmp word ptr [eax+0x16],0x1
ds:0023:00000016=????
Resetting default scope

STACK_TEXT:
eecebc00 804e3f72 00000000 00000000 824818b8 nt!KiWaitTest+0x30
eecebc14 804ed1e2 eeceaf40 00000000 00000000 nt!KeSetEvent+0x58
eecebc6c 804ed15a 824818f8 eecebcb8 eecebcac
nt!IopCompleteRequest+0x22f
eecebcbc 804ed199 00000000 00000000 00000000 nt!KiDeliverApc+0xb3
eecebcd4 804dc6f2 000024ff e334e7e0 00000000 nt!KiSwapThread+0x64
eecebcfc bf802ec4 00000001 0000000d 00000001
nt!KeWaitForSingleObject+0x1c2
eecebd38 bf8036ca 000024ff 00000000 00000001
win32k!xxxSleepThread+0x192
eecebd4c bf8036e7 000024ff 00000000 00c3ff1c
win32k!xxxRealWaitMessageEx+0x-12
eecebd5c 804df06b 00c3ff44 7c90eb94 badb0d00
win32k!NtUserWaitMessage+0x14
eecebd5c 7c90eb94 00c3ff44 7c90eb94 badb0d00 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be
wrong.
00c3ff10 00000000 00000000 00000000 00000000 0x7c90eb94

SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

STACK_COMMAND: .trap ffffffffeecebb70 ; kb

FAILURE_BUCKET_ID: 0xA_IMAGE_ftdisk.sys_DATE_8_17-_2001

BUCKET_ID: 0xA_IMAGE_ftdisk.sys_DATE_8_17-_2001

Followup: MachineOwner
---------

---
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
''
To unsubscribe send a blank email to xxxxx@lists.osr.com