RE: Stream.sys error when connecting capture pin to rende r pin on SAME filter


I didn’t see any reply to this in the 70 odd messages fromt this list this
morning, but here’s my take on it:

The bugcheck code says it, really: You have accessed a buffer that is either
not locked (i.e. it can be paged out) or invalid.

In reality, this means that you either used the wrong memory allocation
flags (didn’t ask for it to be non-pageable) when you allocated the memory
for the buffer. Or, perhaps, you’re accessing outside the allocated buffer.

You can probably build a check for each of those: Add a little piece of code
to “check if non-paged”. The easy way to do this is to:

  1. Add a function to do memory allocation/free.
  2. In your memory allocation/free function, maintain a list of allocated
    memory and the “non-page” status. Also keep track of size of each
  3. When you get called in the StreamClassDmaCallback, call a function to
    check the status of the memory allocated. Also pass the offset into the
    buffer and check that it’s within the valid size. If not a valid
    combination, then print error message and stop.

Of course, you may not have the source code for the “stream.sys”, in which
case you’ll have to track what you send in to Stream.sys instead.

Thinking a bit more about it, it’s unlikely that it’s a “wrong allocation”
type, it’s more likely that you’re accessing outside the buffer, or that the
buffer gets de-allocated during the process.

Try using !pool and/or !pte on the memory address. This will show you what
the status is of the memory that was used. !pool will show who allocated the
buffer, and what size it is (at least, it will show the tag, which following
some of the other messages, can be traced back to the original owner). !pte
will show if it’s a valid address or not.

Best of luck.


-----Original Message-----
From: Sam Tertzakian []
Sent: Friday, December 12, 2003 6:38 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Stream.sys error when connecting capture pin
to render
pin on SAME filter


I have a KS Filter driver which exposes a video capture pin
and a video render pin.

Driver passes all WHQL tests.

But when I connect the capture pin to the render pin the
driver crashes after a couple of minutes.

If I have driver verifier installed this is what I see after
a few minutes:


BugCheck D1, {a2bf5000, 2, 1, f9954d16}

Probably caused by : STREAM.SYS ( STREAM!StreamClassDmaCallback+56 )

Followup: MachineOwner

80515aa4 cc int 3
kd> !analyze -v
* Bugcheck Analysis

An attempt was made to access a pageable (or completely
invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arg1: a2bf5000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: f9954d16, address which referenced memory

Debugging Details:

WRITE_ADDRESS: a2bf5000 Special pool


f9954d16 8908 mov [eax],ecx



LAST_CONTROL_TRANSFER: from 8062d1a4 to f9954d16

TRAP_FRAME: f9c3fa3c – (.trap fffffffff9c3fa3c)
ErrCode = 00000002
eax=a2bf5000 ebx=a2bf4ff8 ecx=00057c08 edx=00000000
esi=a2bf4a50 edi=810df558
eip=f9954d16 esp=f9c3fab0 ebp=f9c3fad4 iopl=0 nv up
ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
f9954d16 8908 mov [eax],ecx
Resetting default scope

f9c3fad4 8062d1a4 81468768 00000000 deadf00d
f9c3faf8 806a039e 81468768 00000000 00000000 nt!VfAdapterCallback+0x4e
f9c3fb24 804e5bfa 814803d8 8146879c 00000051
f9c3fb3c 8062d831 814803d8 81468768 00000051
f9c3fb68 f9954fd0 814803d8 81468768 00000051
f9c3fb88 f99554c7 81468768 a2bf4a50 9c69ae00 STREAM!SCSetUpForDMA+0x28
f9c3fba8 f9959364 00468820 9c69ae00 a2bf4a50
f9c3fbe8 f995c03d 81468820 9b816f90 00000001
f9c3fc30 f9537a95 81468768 a3f80f00 f9c3fc64
f9c3fc40 f9955859 81468768 a3f80f00 81468768 ks!KsDispatchIrp+0xa3
f9c3fc64 804e6185 81468768 a3f80f00 8069d454
f9c3fc74 80624d10 a3f80fd4 a3f80ff8 8147b2f0 nt!IopfCallDriver+0x31
f9c3fc98 8062eee5 8147b238 81373040 80510e00 nt!IovCallDriver+0x9e
f9c3fca8 804e6185 8147b238 a3f80f00 8069d454
f9c3fcb8 80624d10 814005a8 a3f80f00 80510e38 nt!IopfCallDriver+0x31
f9c3fcdc f9533006 9c80afb0 9b816f58 00000000 nt!IovCallDriver+0x9e
f9c3fcf0 f9957b99 8147b238 9b816f68 00000000 ks!KsStreamIo+0x160
f9c3fd50 f9957c11 9c80ae00 00000000 f9534ac0 STREAM!IoWorker+0x135
f9c3fd5c f9534ac0 9c80ae00 81080f78 80541000 STREAM!IoWorkerRead+0xb
f9c3fd74 8052089e 81080f78 00000000 81560020 ks!WorkerThread+0x1e
f9c3fdac 805a2ec8 81080f78 00000000 00000000 nt!ExpWorkerThread+0xfe
f9c3fddc 8052c6a2 805207a0 00000000 00000000
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


In my driver I have turned off synchronization. Besides this
problem there are no other issues and everything works.

This problem occurs both when I connect capture to render on
the same instance of the filter, or if I create two instances
of the same filter in GraphEdt.

Is there a problem in my code or is having render and capture
pin on same filter not supported in non AVStream model?

Thank you for your help

Questions? First check the Kernel Driver FAQ at

You are currently subscribed to ntdev as:
To unsubscribe send a blank email to