kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c00000e8, The exception code that was not handled
Arg2: 82a9d140, The address that the exception occurred at
Arg3: 80daaa64, Exception Record Address
Arg4: 80daa794, Context Record Address
Debugging Details:
EXCEPTION_CODE: (NTSTATUS) 0xc00000e8 - An access to a user buffer failed at an “expected” point in time. This code is defined since the caller does not want to accept STATUS_ACCESS_VIOLATION in its filter.
FAULTING_IP:
nt!CcMapAndCopyFromCache+11d
82a9d140 f6476008 test byte ptr [edi+60h],8
EXCEPTION_RECORD: 80daaa64 – (.exr 0xffffffff80daaa64)
ExceptionAddress: 82a9d140 (nt!CcMapAndCopyFromCache+0x0000011d)
ExceptionCode: c00000e8
ExceptionFlags: 00000001
NumberParameters: 0
CONTEXT: 80daa794 – (.cxr 0xffffffff80daa794)
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=00040000 edi=849c8778
eip=82a9d140 esp=80daaac0 ebp=80daaae0 iopl=0 nv up ei pl zr na pe nc
cs=0009 ss=0013 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
nt!CcMapAndCopyFromCache+0x11d:
0009:82a9d140 f6476008 test byte ptr [edi+60h],8 ds:0023:849c87d8=08
Resetting default scope
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
BUGCHECK_STR: 0x7E
PROCESS_NAME: System
CURRENT_IRQL: 2
ERROR_CODE: (NTSTATUS) 0xc00000e8 - An access to a user buffer failed at an “expected” point in time. This code is defined since the caller does not want to accept STATUS_ACCESS_VIOLATION in its filter.
LAST_CONTROL_TRANSFER: from 82a93120 to 82a9d140
STACK_TEXT:
80daaae0 82a93120 849c3458 00000000 00000000 nt!CcMapAndCopyFromCache+0x11d
80daab20 91181301 849c3458 80daac04 00000008 nt!CcCopyRead+0x107
80daac4c 911817b2 849933a8 849c3458 865b60e8 mydriver!mydriverReadFile+0x821 [c:\users\driver\read.c @ 734]
80daaca8 9117e654 849933a8 00000003 865b6030 mydriver!mydriverRead+0x162 [c:\users\driver\read.c @ 890]
80daacc4 9117e948 849933a8 11c3a5de 849933ba mydriver!mydriverDispatchRequest+0x84 [c:\users\driver\irp.c @ 1102]
80daad00 82895173 849933a8 00000000 8488dd48 mydriver!mydriverDequeueRequest+0xd8 [c:\users\driver\irp.c @ 1212]
80daad50 82a2246a 00000000 1977396d 00000000 nt!ExpWorkerThread+0x10d
80daad90 828c3989 82895066 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
FOLLOWUP_IP:
mydriver!mydriverReadFile+821 [c:\users\driver\read.c @ 734]
91181301 0fb6c8 movzx ecx,al
FAULTING_SOURCE_CODE:
730: (PLARGE_INTEGER)&nByteOffset,
731: nBytesRead,
732: bCanWait,
733: pBuffer,
734: &Irp->IoStatus)) {
735: nStatus = STATUS_PENDING;
736: __leave;
737: }
738:
739: nStatus = Irp->IoStatus.Status;
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: mydriver!mydriverReadFile+821
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: mydriver
IMAGE_NAME: mydriver.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 50444c17
STACK_COMMAND: .cxr 0xffffffff80daa794 ; kb
FAILURE_BUCKET_ID: 0x7E_mydriver!mydriverReadFile+821
BUCKET_ID: 0x7E_mydriver!mydriverReadFile+821
Followup: MachineOwner