okozar

Hi, I've this somewhat older batch of computer parts sitting around for a while and I finally got around to slapping them and a couple new ones together for a stronger (secondary) computer. At the same time I decided to make the move for my new computer and this older newer one to Vista X64 Ultimate The Computer has all the vista updates.. All clocks are stock x2 4200 x1800xt 512 1 GB PC 3200 Kingston Hyper-x (2x512mb) (Ya I know for Vista this badly needs to move to two DFI Lanparty NF4 UT-D Mobo I slapped this together on the 17th (last Tuesday night) and have since received NINE! BSOD Anyway here they are, I've read 80% of Blue Screens are caused by drivers so I guess I find it alarming that as far as I can tell these are mostly program, not driver related. The first one clearly appears to be the Hard drive as far as I can tell, but it doesn't concern me since it's A) Brand new and B) only occurred once. 17A .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904aa, fffffa600179d6e8, fffffa600179d0c0, fffffa60011109bc} Probably caused by : Ntfs.sys ( Ntfs!EfsCleanup+4c ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904aa Arg2: fffffa600179d6e8 Arg3: fffffa600179d0c0 Arg4: fffffa60011109bc Debugging Details: ------------------ EXCEPTION_RECORD: fffffa600179d6e8 -- (.exr 0xfffffa600179d6e8) ExceptionAddress: fffffa60011109bc (Ntfs!EfsCleanup+0x000000000000004c) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000001 Parameter[1]: 000000000030e000 Attempt to write to address 000000000030e000 CONTEXT: fffffa600179d0c0 -- (.cxr 0xfffffa600179d0c0) rax=0000000000000000 rbx=0000000000300000 rcx=000000004c5828f9 rdx=0000000000300000 rsi=fffff88000aaed68 rdi=000000000030e000 rip=fffffa60011109bc rsp=fffffa600179d920 rbp=fffffa8001d23180 r8=0000000000000004 r9=0000000000000019 r10=ffffffffffee4bc0 r11=00000000000007ff r12=0000000000000000 r13=0000000000000000 r14=fffffa8002d29cc0 r15=fffffa8001d23180 iopl=0 nv up ei pl nz ac pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010212 Ntfs!EfsCleanup+0x4c: fffffa60`011109bc f3aa rep stos byte ptr [rdi] Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a30080 000000000030e000 BUGCHECK_STR: 0x24 EXCEPTION_DOESNOT_MATCH_CODE: This indicates a hardware error. Instruction at fffffa60011109bc does not read/write to 000000000030e000 LAST_CONTROL_TRANSFER: from fffffa60010fa4e9 to fffffa60011109bc STACK_TEXT: fffffa60`0179d920 fffffa60`010fa4e9 : fffffa60`0179d9e8 00000000`00000703 00000000`00000018 fffff880`6f66744e : Ntfs!EfsCleanup+0x4c fffffa60`0179d950 fffffa60`0100d579 : 00000000`00000000 00000000`00000001 00000000`00000000 fffff880`00aaeaa0 : Ntfs! ?? ::NNGAKEGL::`string'+0x47fd fffffa60`0179d990 fffffa60`0100d9d3 : 00000000`00000000 fffff880`00aaebd0 fffff880`00aaeaa0 fffffa60`0179da88 : Ntfs!NtfsPrepareFcbForRemoval+0x89 fffffa60`0179d9e0 fffffa60`010bd6d8 : fffffa80`02d29cc0 fffffa80`01d23180 fffff880`07607010 fffff880`07607448 : Ntfs!NtfsTeardownFromLcb+0x393 fffffa60`0179da80 fffffa60`01014b92 : fffffa80`02d29cc0 fffffa60`0179dc70 00000000`00000000 fffff880`07607010 : Ntfs!NtfsTeardownStructures+0xd8 fffffa60`0179db10 fffffa60`010c8e18 : fffffa60`0179dc70 fffff800`019998a0 fffff880`07607010 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2 fffffa60`0179db50 fffffa60`010b1e0e : fffffa80`02d29cc0 fffff880`07607140 fffff880`07607010 fffffa80`01d23180 : Ntfs!NtfsCommonClose+0x348 fffffa60`0179dc20 fffff800`01869066 : 00000000`00000000 fffff800`01a05800 fffff800`01999801 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15e fffffa60`0179dcf0 fffff800`01a7fde3 : fffffa60`01062ee8 00000000`004e0046 fffffa80`00c81720 00000000`00000080 : nt!ExpWorkerThread+0x11a fffffa60`0179dd50 fffff800`01896536 : fffffa60`005ec180 fffffa80`00c81720 fffffa60`005f5d40 00000000`00000001 : nt!PspSystemThreadStartup+0x57 fffffa60`0179dd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16 FOLLOWUP_IP: Ntfs!EfsCleanup+4c fffffa60`011109bc f3aa rep stos byte ptr [rdi] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Ntfs!EfsCleanup+4c FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 479190d1 STACK_COMMAND: .cxr 0xfffffa600179d0c0; kb FAILURE_BUCKET_ID: X64_0x24_CODE_ADDRESS_MISMATCH_Ntfs!EfsCleanup+4c BUCKET_ID: X64_0x24_CODE_ADDRESS_MISMATCH_Ntfs!EfsCleanup+4c Followup: MachineOwner --------- 18A .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {4, c, 0, fffff80001868f3e} Probably caused by : fileinfo.sys ( fileinfo!FIPfInterfaceOpen+803 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 0000000000000004, memory referenced Arg2: 000000000000000c, IRQL Arg3: 0000000000000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80001868f3e, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a31080 0000000000000004 CURRENT_IRQL: c FAULTING_IP: nt!ExpReleaseResourceForThreadLite+16e fffff800`01868f3e 8b4e04 mov ecx,dword ptr [rsi+4] CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xA PROCESS_NAME: svchost.exe TRAP_FRAME: fffffa600643ac40 -- (.trap 0xfffffa600643ac40) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff80001a33440 rbx=01c8d1c91abb2851 rcx=fffff8000197ccf0 rdx=0000000000000000 rsi=fffffa8001250210 rdi=0000000000000000 rip=fffff80001868f3e rsp=fffffa600643add0 rbp=0000000000000000 r8=0000000000000000 r9=01c8d1c91abb2801 r10=0000000000000070 r11=0000000000008000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!ExpReleaseResourceForThreadLite+0x16e: fffff800`01868f3e 8b4e04 mov ecx,dword ptr [rsi+4] ds:0008:fffffa80`01250214=???????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff8000185d12e to fffff8000185d390 STACK_TEXT: fffffa60`0643aaf8 fffff800`0185d12e : 00000000`0000000a 00000000`00000004 00000000`0000000c 00000000`00000000 : nt!KeBugCheckEx fffffa60`0643ab00 fffff800`0185c00b : 00000000`00000000 fffffa80`01638db0 fffffa80`01638e00 fffffa80`01334860 : nt!KiBugCheckDispatch+0x6e fffffa60`0643ac40 fffff800`01868f3e : fffffa80`01f29010 00000000`00000000 01c85bd8`33275f11 01c85bd8`33275f11 : nt!KiPageFault+0x20b fffffa60`0643add0 fffffa60`01016c05 : fffffa60`0643afa0 00000000`00000000 fffffa60`0643af00 fffffa60`00a0a2ee : nt!ExpReleaseResourceForThreadLite+0x16e fffffa60`0643ae50 fffffa60`01018c04 : fffffa80`0159f470 00000000`00000000 fffffa80`03d27760 00000000`00000001 : Ntfs!NtfsCleanupIrpContext+0x3d5 fffffa60`0643aea0 fffffa60`010cea8a : fffffa80`0159f470 fffffa80`0159f470 00000000`00000000 fffffa80`0159f400 : Ntfs!NtfsExtendedCompleteRequest+0xd4 fffffa60`0643aee0 fffffa60`01017a46 : fffffa80`0159f470 fffffa80`03d27760 fffffa80`02b29401 fffffa80`01250200 : Ntfs!NtfsCommonSetInformation+0xe40 fffffa60`0643afc0 fffffa60`00a07e17 : 00000000`00000801 fffffa80`03d27760 fffffa80`00ceba01 fffffa80`01d15180 : Ntfs!NtfsFsdSetInformation+0x316 fffffa60`0643b070 fffffa60`00a070dd : fffffa80`00d02440 fffffa80`03d27760 fffffa80`01f2a400 00000000`00000000 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x227 fffffa60`0643b0e0 fffff800`01aac8df : 00000000`00000028 fffffa80`01250260 00000000`00000028 fffffa80`00ceba00 : fltmgr!FltpDispatch+0xcd fffffa60`0643b140 fffff800`0185ce33 : ffffffff`80000978 fffffa80`03d89060 fffffa60`0643b498 fffffa60`00000028 : nt!NtSetInformationFile+0x5fb fffffa60`0643b270 fffff800`0185d340 : fffffa60`00a57353 00000000`00000000 00000000`00000000 fffffa80`02b299a0 : nt!KiSystemServiceCopyEnd+0x13 fffffa60`0643b478 fffffa60`00a57353 : 00000000`00000000 00000000`00000000 fffffa80`02b299a0 00000000`00000000 : nt!KiServiceLinkage fffffa60`0643b480 fffff800`01b62097 : fffffa80`00c86501 fffff800`01864f01 00000000`00000000 fffffa80`02b299a0 : fileinfo!FIPfInterfaceOpen+0x803 fffffa60`0643b600 fffff800`01c0a907 : 00000000`00000020 ffffffff`ffe91ca0 fffffa60`0643b718 fffffa80`00000000 : nt!PfpOpenHandleCreate+0x117 fffffa60`0643b6d0 fffff800`01c0cc26 : 00000000`00000000 fffff880`09140178 fffff880`0913e000 fffffa60`00000060 : nt!PfpFileBuildReadSupport+0xe7 fffffa60`0643b7c0 fffff800`01c36609 : fffff880`00000000 00000000`00000005 00000000`000000af 00000000`00000000 : nt!PfpPrefetchFilesTrickle+0x126 fffffa60`0643b8c0 fffff800`01c368c2 : 00000000`00000000 fffffa60`0643bca0 fffffa60`0643ba08 fffff880`0913e001 : nt!PfpPrefetchRequestPerform+0x2f9 fffffa60`0643b960 fffff800`01c36b26 : fffffa60`0643ba08 00000000`00000001 fffffa80`039d0930 00000000`00000000 : nt!PfpPrefetchRequest+0x171 fffffa60`0643b9d0 fffff800`01c49258 : 00000000`00000000 00000000`00000004 fffffa80`00d35000 00000000`00000001 : nt!PfSetSuperfetchInformation+0x1a5 fffffa60`0643bab0 fffff800`0185ce33 : fffffa80`03d89060 00000000`00000000 00000000`00000001 00000000`05195e50 : nt!NtSetSystemInformation+0x8fb fffffa60`0643bc20 00000000`777770ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0343f7b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777770ea STACK_COMMAND: kb FOLLOWUP_IP: fileinfo!FIPfInterfaceOpen+803 fffffa60`00a57353 8a8c2488010000 mov cl,byte ptr [rsp+188h] SYMBOL_STACK_INDEX: d SYMBOL_NAME: fileinfo!FIPfInterfaceOpen+803 FOLLOWUP_NAME: MachineOwner MODULE_NAME: fileinfo IMAGE_NAME: fileinfo.sys DEBUG_FLR_IMAGE_TIMESTAMP: 47919323 FAILURE_BUCKET_ID: X64_0xA_fileinfo!FIPfInterfaceOpen+803 BUCKET_ID: X64_0xA_fileinfo!FIPfInterfaceOpen+803 Followup: MachineOwner --------- 18B .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1E, {ffffffffc0000005, fffff80001db338a, 1, 38} Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29317 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff80001db338a, The address that the exception occurred at Arg3: 0000000000000001, Parameter 0 of the exception Arg4: 0000000000000038, Parameter 1 of the exception Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: +fffff80001db338a fffff800`01db338a ?? ??? EXCEPTION_PARAMETER1: 0000000000000001 EXCEPTION_PARAMETER2: 0000000000000038 WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a80080 0000000000000038 CUSTOMER_CRASH_COUNT: 2 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x1E PROCESS_NAME: hl2.exe CURRENT_IRQL: 0 TRAP_FRAME: fffffa6005dc79a0 -- (.trap 0xfffffa6005dc79a0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000 rdx=00000000000007ff rsi=fffff800019cb680 rdi=0000000000000000 rip=fffff80001db338a rsp=fffffa6005dc7b30 rbp=fffffa80036e1440 r8=0000000000000000 r9=0000000000007e00 r10=0000000000000008 r11=fffffa8000fc1794 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc fffff800`01db338a ?? ??? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80001885e67 to fffff800018ac390 STACK_TEXT: fffffa60`05dc71b8 fffff800`01885e67 : 00000000`0000001e ffffffff`c0000005 fffff800`01db338a 00000000`00000001 : nt!KeBugCheckEx fffffa60`05dc71c0 fffff800`018ac1e9 : fffffa60`05dc78f8 00000000`00000000 fffffa60`05dc79a0 fffffa80`03f83ca8 : nt! ?? ::FNODOBFM::`string'+0x29317 fffffa60`05dc77c0 fffff800`018aafe5 : 00000000`00000001 fffffa60`0300c743 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xa9 fffffa60`05dc79a0 fffff800`01db338a : 00000000`00000468 00000000`00400000 00000000`00000000 00000000`00000008 : nt!KiPageFault+0x1e5 fffffa60`05dc7b30 00000000`00000468 : 00000000`00400000 00000000`00000000 00000000`00000008 fffff800`019cb680 : 0xfffff800`01db338a fffffa60`05dc7b38 00000000`00400000 : 00000000`00000000 00000000`00000008 fffff800`019cb680 00000000`00000000 : 0x468 fffffa60`05dc7b40 00000000`00000000 : 00000000`00000008 fffff800`019cb680 00000000`00000000 00000000`00000000 : 0x400000 fffffa60`05dc7b48 00000000`00000008 : fffff800`019cb680 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0 fffffa60`05dc7b50 fffff800`019cb680 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x8 fffffa60`05dc7b58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInitialPCR+0x180 fffffa60`05dc7b60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0 fffffa60`05dc7b68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0 fffffa60`05dc7b70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000001 : 0x0 fffffa60`05dc7b78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000000 : 0x0 fffffa60`05dc7b80 00000000`00000000 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : 0x0 fffffa60`05dc7b88 00000000`00000000 : 00000000`00000001 00000000`00000000 00000000`00000000 fffffa60`05dc7ca0 : 0x0 fffffa60`05dc7b90 00000000`00000001 : 00000000`00000000 00000000`00000000 fffffa60`05dc7ca0 fffffa80`036e1440 : 0x0 fffffa60`05dc7b98 00000000`00000000 : 00000000`00000000 fffffa60`05dc7ca0 fffffa80`036e1440 fffff800`01b27e38 : 0x1 fffffa60`05dc7ba0 00000000`00000000 : fffffa60`05dc7ca0 fffffa80`036e1440 fffff800`01b27e38 00000000`00000000 : 0x0 fffffa60`05dc7ba8 fffffa60`05dc7ca0 : fffffa80`036e1440 fffff800`01b27e38 00000000`00000000 fffff800`00000006 : 0x0 fffffa60`05dc7bb0 fffffa80`036e1440 : fffff800`01b27e38 00000000`00000000 fffff800`00000006 00000000`00000001 : 0xfffffa60`05dc7ca0 fffffa60`05dc7bb8 fffff800`01b27e38 : 00000000`00000000 fffff800`00000006 00000000`00000001 fffffa60`05dc7c00 : 0xfffffa80`036e1440 fffffa60`05dc7bc0 fffff800`018abe33 : fffffa80`03f83bb0 00000000`00000000 00000000`00000000 fffffa80`036e1440 : nt!NtWaitForSingleObject+0x98 fffffa60`05dc7c20 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+29317 fffff800`01885e67 cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+29317 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 479192b7 FAILURE_BUCKET_ID: X64_0x1E_W_nt!_??_::FNODOBFM::_string_+29317 BUCKET_ID: X64_0x1E_W_nt!_??_::FNODOBFM::_string_+29317 Followup: MachineOwner --------- 19A ... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 19, {22, d00000, 0, 0} Probably caused by : win32k.sys ( win32k!UserDeleteW32Thread+6c ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BAD_POOL_HEADER (19) The pool is already corrupt at the time of the current request. This may or may not be due to the caller. The internal pool links must be walked to figure out a possible cause of the problem, and then special pool applied to the suspect tags or the driver verifier to a suspect driver. Arguments: Arg1: 0000000000000022, Arg2: 0000000000d00000 Arg3: 0000000000000000 Arg4: 0000000000000000 Debugging Details: ------------------ BUGCHECK_STR: 0x19_22 POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a48080 0000000000d00000 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: RivaTuner.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff800018c3635 to fffff80001874390 STACK_TEXT: fffffa60`06af4908 fffff800`018c3635 : 00000000`00000019 00000000`00000022 00000000`00d00000 00000000`00000000 : nt!KeBugCheckEx fffffa60`06af4910 fffff800`0195307b : fffff800`0181f000 00000000`00000000 fffff800`019b2160 fffff800`0187bfa9 : nt! ?? ::FNODOBFM::`string'+0x37e6 fffffa60`06af4970 fffff960`00109da0 : fffffa80`018ba810 fffffa80`00c79930 fffffa80`00000000 fffffa80`016059e0 : nt!ExFreePoolWithTag+0x4bb fffffa60`06af4a20 fffff960`00108bad : fffffa80`016059e0 fffffa80`044e6660 fffffa80`016059e0 fffff900`c08bfc60 : win32k!UserDeleteW32Thread+0x6c fffffa60`06af4a50 fffff960`00104e90 : fffffa80`04527830 fffffa80`016059e0 00000000`00000000 00000000`00000000 : win32k!DereferenceW32Thread+0x15 fffffa60`06af4a80 fffff800`01b1c877 : fffffa80`04527830 00000000`00000000 00000000`00000000 fffffa80`016059e0 : win32k!W32pThreadCallout+0x94 fffffa60`06af4ab0 fffff800`01b1cd3d : 00000000`00000000 fffffa80`01605901 00000000`00000000 00000000`00000000 : nt!PspExitThread+0x523 fffffa60`06af4b70 fffff800`01ad3c7a : 00000000`00000000 00000000`0000000c 00000000`7efdd000 fffff880`0000000c : nt!PspTerminateThreadByPointer+0x4d fffffa60`06af4bc0 fffff800`01873e33 : fffffa80`018ba810 fffffa80`016059e0 fffffa60`06af4ca0 00000000`7efdd000 : nt!NtTerminateProcess+0xfa fffffa60`06af4c20 00000000`77765d3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0007e598 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77765d3a STACK_COMMAND: kb FOLLOWUP_IP: win32k!UserDeleteW32Thread+6c fffff960`00109da0 488b8bb0000000 mov rcx,qword ptr [rbx+0B0h] SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: win32k!UserDeleteW32Thread+6c FOLLOWUP_NAME: MachineOwner MODULE_NAME: win32k IMAGE_NAME: win32k.sys DEBUG_FLR_IMAGE_TIMESTAMP: 47c78e35 FAILURE_BUCKET_ID: X64_0x19_22_win32k!UserDeleteW32Thread+6c BUCKET_ID: X64_0x19_22_win32k!UserDeleteW32Thread+6c Followup: MachineOwner 19B .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffffa8004fc5ad0, 0, fffff8000194dc03, 0} Could not read faulting driver name Probably caused by : dxgkrnl.sys ( dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215 ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffffa8004fc5ad0, memory referenced. Arg2: 0000000000000000, value 0 = read operation, 1 = write operation. Arg3: fffff8000194dc03, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000000, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a43080 fffffa8004fc5ad0 FAULTING_IP: nt!ExFreePoolWithTag+43 fffff800`0194dc03 418b45f0 mov eax,dword ptr [r13-10h] MM_INTERNAL_CODE: 0 CUSTOMER_CRASH_COUNT: 2 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: 3DMark06.exe CURRENT_IRQL: 0 TRAP_FRAME: fffffa6007ded5e0 -- (.trap 0xfffffa6007ded5e0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=fffff88000000174 rcx=fffffa8004fc5ae0 rdx=0000000000000000 rsi=fffffa8004326500 rdi=000000006d4d6956 rip=fffff8000194dc03 rsp=fffffa6007ded770 rbp=0000000000000000 r8=0000000000000003 r9=0000000000000175 r10=00000000005b5ac0 r11=fffffa6007ded800 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na pe nc nt!ExFreePoolWithTag+0x43: fffff800`0194dc03 418b45f0 mov eax,dword ptr [r13-10h] ds:ffffffff`fffffff0=???????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff8000187e371 to fffff8000186f390 STACK_TEXT: fffffa60`07ded4e8 fffff800`0187e371 : 00000000`00000050 fffffa80`04fc5ad0 00000000`00000000 fffffa60`07ded5e0 : nt!KeBugCheckEx fffffa60`07ded4f0 fffff800`0186df19 : 00000000`00000000 fffff800`01874f8a fffffa80`0423ba00 fffffa80`04b4f5c0 : nt!MmAccessFault+0x1371 fffffa60`07ded5e0 fffff800`0194dc03 : fffff880`07fb3010 00000000`00000001 fffff880`05f173d0 fffffa60`028c4ce3 : nt!KiPageFault+0x119 fffffa60`07ded770 fffffa60`028c0515 : 00000000`00000000 00000000`00000000 fffff880`07fb3010 00000000`00000000 : nt!ExFreePoolWithTag+0x43 fffffa60`07ded820 fffffa60`028c02c4 : 00000000`00000000 fffffa60`00000000 00000000`00000001 00000000`00000000 : dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+0x215 fffffa60`07ded8f0 fffffa60`02844f29 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : dxgkrnl!VIDMM_GLOBAL::CloseAllocation+0x44 fffffa60`07ded920 fffffa60`02848e07 : 00000000`00000000 fffff880`07f1b1d0 00000000`00000000 00000000`00000000 : dxgkrnl!DXGDEVICE::DestroyAllocations+0x41d fffffa60`07deda10 fffffa60`0284b235 : fffff880`06e20000 fffffa60`07dedb30 fffff880`06e20001 fffffa60`07dedc01 : dxgkrnl!DXGDEVICE::DestroyAllocation+0x3e3 fffffa60`07dedab0 fffff960`00262516 : fffffa60`00000000 fffffa80`01887a70 00000000`7efda000 00000000`00000020 : dxgkrnl!DxgkDestroyAllocation+0x8dd fffffa60`07dedbf0 fffff800`0186ee33 : fffffa80`01887a70 00000000`00000000 00000000`00000000 fffffa80`0283c4b0 : win32k!NtGdiDdDDIDestroyAllocation+0x12 fffffa60`07dedc20 00000000`75d2b5ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`035de7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75d2b5ca STACK_COMMAND: kb FOLLOWUP_IP: dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215 fffffa60`028c0515 488b4b20 mov rcx,qword ptr [rbx+20h] SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215 FOLLOWUP_NAME: MachineOwner MODULE_NAME: dxgkrnl IMAGE_NAME: dxgkrnl.sys DEBUG_FLR_IMAGE_TIMESTAMP: 479193e6 FAILURE_BUCKET_ID: X64_0x50_dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215 BUCKET_ID: X64_0x50_dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215 Followup: MachineOwner 19C .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffff88007d0a0b0, 0, fffff80001b0b093, 2} Could not read faulting driver name Probably caused by : ntkrnlmp.exe ( nt!CmpCacheLookup+193 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffff88007d0a0b0, memory referenced. Arg2: 0000000000000000, value 0 = read operation, 1 = write operation. Arg3: fffff80001b0b093, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000002, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a70080 fffff88007d0a0b0 FAULTING_IP: nt!CmpCacheLookup+193 fffff800`01b0b093 3819 cmp byte ptr [rcx],bl MM_INTERNAL_CODE: 2 CUSTOMER_CRASH_COUNT: 3 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: AirPlusCFG.exe CURRENT_IRQL: 0 TRAP_FRAME: fffffa6005069060 -- (.trap 0xfffffa6005069060) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000091ec4f9a rbx=fffffa6005069db0 rcx=fffff88007d0a0b0 rdx=0000000010650760 rsi=0006010704020503 rdi=fffffa6005069678 rip=fffff80001b0b093 rsp=fffffa60050691f0 rbp=fffffa60050693c0 r8=00000000de532e42 r9=0000000000000008 r10=0000000000000000 r11=fffffa60050691e0 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!CmpCacheLookup+0x193: fffff800`01b0b093 3819 cmp byte ptr [rcx],bl ds:8060:fffff880`07d0a0b0=?? Resetting default scope LAST_CONTROL_TRANSFER: from fffff800018aa534 to fffff8000189c390 STACK_TEXT: fffffa60`05068f68 fffff800`018aa534 : 00000000`00000050 fffff880`07d0a0b0 00000000`00000000 fffffa60`05069060 : nt!KeBugCheckEx fffffa60`05068f70 fffff800`0189af19 : 00000000`00000000 fffff880`057c0a58 00000000`10650700 00000000`00000000 : nt!MmAccessFault+0x534 fffffa60`05069060 fffff800`01b0b093 : fffffa60`05069750 fffffa60`05069330 fffffa60`05069840 fffffa60`05069768 : nt!KiPageFault+0x119 fffffa60`050691f0 fffff800`01b0bcc5 : fffffa60`05069330 fffffa60`00000007 fffffa60`05069770 fffffa60`05069750 : nt!CmpCacheLookup+0x193 fffffa60`050692d0 fffff800`01b0c69a : fffffa60`05069b70 fffffa60`05069750 fffffa60`05069740 fffffa60`05069758 : nt!CmpBuildHashStackAndLookupCache+0x276 fffffa60`05069670 fffff800`01b1d999 : 00000000`00000040 00000000`00000104 fffffa80`012a8b10 fffff880`069b6601 : nt!CmpParseKey+0x20a fffffa60`05069910 fffff800`01b21884 : 00000000`00000000 fffffa80`04bffa01 00000000`00000040 fffffa80`00c70080 : nt!ObpLookupObjectName+0x5eb fffffa60`05069a20 fffff800`01b0786f : fffffa80`00020019 00000000`75f53300 fffffa80`04c13001 00000000`00020006 : nt!ObOpenObjectByName+0x2f4 fffffa60`05069af0 fffff800`0189be33 : 00000000`005fe828 00000000`00020019 00000000`005fe8d0 00000000`00000000 : nt!CmOpenKey+0x25d fffffa60`05069c20 00000000`77c75b9a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`005fc108 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c75b9a STACK_COMMAND: kb FOLLOWUP_IP: nt!CmpCacheLookup+193 fffff800`01b0b093 3819 cmp byte ptr [rcx],bl SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: nt!CmpCacheLookup+193 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 479192b7 FAILURE_BUCKET_ID: X64_0x50_nt!CmpCacheLookup+193 BUCKET_ID: X64_0x50_nt!CmpCacheLookup+193 Followup: MachineOwner -------- 20A .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff960001a5fdb, fffffa6005b5d760, 0} Probably caused by : win32k.sys ( win32k!NextTopWindow+193 ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff960001a5fdb, Address of the exception record for the exception that caused the bugcheck Arg3: fffffa6005b5d760, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: win32k!NextTopWindow+193 fffff960`001a5fdb 488b4110 mov rax,qword ptr [rcx+10h] CONTEXT: fffffa6005b5d760 -- (.cxr 0xfffffa6005b5d760) rax=fffffa8004924e60 rbx=fffff900c0c7f3d0 rcx=ff7ec9a0ff7ec9a0 rdx=fffff900c0c00a60 rsi=fffff900c0c16d60 rdi=fffff900c0c25be0 rip=fffff960001a5fdb rsp=fffffa6005b5dfc0 rbp=fffff900c0c7f3d0 r8=0000000000000000 r9=fffff900c2e2b160 r10=fffff900c0c7f3d0 r11=fffff900c0c0f290 r12=0000000000000001 r13=0000000000000002 r14=fffff900c2e2b160 r15=0000000000000001 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286 win32k!NextTopWindow+0x193: fffff960`001a5fdb 488b4110 mov rax,qword ptr [rcx+10h] ds:002b:ff7ec9a0`ff7ec9b0=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: speedfan.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff96000175f2e to fffff960001a5fdb STACK_TEXT: fffffa60`05b5dfc0 fffff960`00175f2e : fffff900`c0c7f3d0 fffff900`c0c7f3d0 00000000`00000002 fffff900`c2e2b160 : win32k!NextTopWindow+0x193 fffffa60`05b5e000 fffff960`0016488b : fffff900`c0c7f3d0 00000000`00000018 00000000`00000083 00000000`00000000 : win32k!xxxActivateWindow+0x122 fffffa60`05b5e060 fffff960`00183c63 : 00000000`00000001 fffff900`c0c7f3d0 fffff900`c0c7f3d0 00000000`00000000 : win32k!xxxShowWindow+0x41b fffffa60`05b5e0d0 fffff960`001923cc : 00000000`00000001 fffff900`c0c7f3d0 00000000`00000018 fffff800`01cc8911 : win32k!xxxRealDefWindowProc+0x5b7 fffffa60`05b5e220 fffff960`00166567 : fffff900`c0c7f3d0 00000000`00000001 00000000`0000029e fffff900`c0c7f3d0 : win32k!xxxWrapRealDefWindowProc+0x3c fffffa60`05b5e250 fffff960`001917d8 : 00000000`00040454 00000000`0000029e fffffa60`05b5e5d0 00000000`00000000 : win32k!NtUserfnNCDESTROY+0x27 fffffa60`05b5e290 fffff800`01a5ae33 : fffffa80`01263bb0 fffffa60`05b5e3f0 00000000`0007d588 fffffa60`05b5e318 : win32k!NtUserMessageCall+0x130 fffffa60`05b5e300 00000000`75209fea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0007d568 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75209fea FOLLOWUP_IP: win32k!NextTopWindow+193 fffff960`001a5fdb 488b4110 mov rax,qword ptr [rcx+10h] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: win32k!NextTopWindow+193 FOLLOWUP_NAME: MachineOwner MODULE_NAME: win32k IMAGE_NAME: win32k.sys DEBUG_FLR_IMAGE_TIMESTAMP: 47c78e35 STACK_COMMAND: .cxr 0xfffffa6005b5d760; kb FAILURE_BUCKET_ID: X64_0x3B_win32k!NextTopWindow+193 BUCKET_ID: X64_0x3B_win32k!NextTopWindow+193 Followup: MachineOwner --------- 20B .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, 1386af, 0, 0} Probably caused by : memory_corruption ( nt!MiBadShareCount+4b ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 00000000001386af, page frame number Arg3: 0000000000000000, current page state Arg4: 0000000000000000, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 2 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: windbg.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff80001ad43db to fffff80001a5d390 STACK_TEXT: fffffa60`06cc8778 fffff800`01ad43db : 00000000`0000004e 00000000`00000099 00000000`001386af 00000000`00000000 : nt!KeBugCheckEx fffffa60`06cc8780 fffff800`01a999a5 : fffff6fb`7dbed000 fffffa80`00a3f2f0 00000000`00000002 fffff6fb`7da00000 : nt!MiBadShareCount+0x4b fffffa60`06cc87c0 fffff800`01a91a65 : 00000000`00000008 00000000`002a0000 00000000`00000000 fffff800`01bce850 : nt!MiDeletePageTableHierarchy+0x245 fffffa60`06cc88d0 fffff800`01a41696 : fffff6fb`7dbed011 00000000`0029ffff fffffa80`00000000 fffffa80`00000000 : nt!MiDeleteVirtualAddresses+0x736 fffffa60`06cc8a60 fffff800`01d0584c : fffff880`06ee4ab0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCleanProcessAddressSpace+0x6ae fffffa60`06cc8ab0 fffff800`01d05d3d : 00000000`00000000 fffffa80`04fb7b01 000007ff`fffda000 00000000`00000000 : nt!PspExitThread+0x4f8 fffffa60`06cc8b70 fffff800`01cbcc7a : 00000000`00000000 00000000`0000000c 00000000`00000000 fffff880`0000000c : nt!PspTerminateThreadByPointer+0x4d fffffa60`06cc8bc0 fffff800`01a5ce33 : fffffa80`01417040 fffffa80`04fb7bb0 fffffa60`06cc8ca0 00000000`00000000 : nt!NtTerminateProcess+0xfa fffffa60`06cc8c20 00000000`77cb5d3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`043ff838 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77cb5d3a STACK_COMMAND: kb FOLLOWUP_IP: nt!MiBadShareCount+4b fffff800`01ad43db cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiBadShareCount+4b FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 479192b7 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4b BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4b Followup: MachineOwner --------- 20C .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff80001a5f316, fffffa6005183eb0, 0} Probably caused by : afd.sys ( afd! ?? ::GFJBLGFE::`string'+33e4 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff80001a5f316, Address of the exception record for the exception that caused the bugcheck Arg3: fffffa6005183eb0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!RtlpInterlockedPushEntrySList+26 fffff800`01a5f316 4c8902 mov qword ptr [rdx],r8 CONTEXT: fffffa6005183eb0 -- (.cxr 0xfffffa6005183eb0) rax=0000000000000000 rbx=0000000000ec0000 rcx=fffffa80041863d0 rdx=0000000000ec0000 rsi=fffffa80041873d0 rdi=fffffa800143aae0 rip=fffff80001a5f316 rsp=fffffa6005184718 rbp=fffffa6000f5d220 r8=0000000000000000 r9=00001d8000000000 r10=0000000000000000 r11=00000000000007ff r12=fffffa8001804650 r13=fffffa80026fc700 r14=fffffa80042ae9a0 r15=fffffa8001804670 iopl=0 nv up ei pl zr ac po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010256 nt!RtlpInterlockedPushEntrySList+0x26: fffff800`01a5f316 4c8902 mov qword ptr [rdx],r8 ds:002b:00000000`00ec0000=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 3 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: WoW-1.12.x-to-2 CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffffa600424eaf5 to fffff80001a5f316 STACK_TEXT: fffffa60`05184718 fffffa60`0424eaf5 : 00000000`00ec0000 fffffa80`042ae9a0 fffffa80`026fc700 fffffa80`0156d010 : nt!RtlpInterlockedPushEntrySList+0x26 fffffa60`05184720 fffffa60`04209192 : 00000000`00000000 fffffa80`0143aae0 00000000`00000000 fffffa80`45656c41 : afd! ?? ::GFJBLGFE::`string'+0x33e4 fffffa60`05184760 fffffa60`00e62d86 : fffffa80`01306010 00000000`00000000 fffffa80`0272bc10 fffffa80`0263a010 : afd!AfdFreeConnectionEx+0x22 fffffa60`05184790 fffffa60`00e70ed8 : fffffa80`01306010 00000000`00000000 00000000`00000000 fffff800`01a93700 : tcpip!TcpCleanupTcbWorkQueueRoutine+0xd6 fffffa60`051847d0 fffffa60`00e713c8 : 00000000`00000000 fffffa60`0425a0be fffffa80`01306010 fffffa80`0159e102 : tcpip!TcpCloseTcbOlmNotifyTerminateComplete+0x78 fffffa60`05184870 fffffa60`00e713e9 : fffffa80`03ea4200 fffffa80`0143aae0 00000004`1000000e 80000000`00000000 : tcpip!TcpCloseTcb+0x78 fffffa60`051848d0 fffffa60`0423e01a : fffff800`01b81b00 fffff800`01b1fde9 fffff800`01b81b80 fffffa80`026fc710 : tcpip!TcpTlConnectionCloseEndpoint+0x9 fffffa60`05184900 fffffa60`0422c8f0 : fffffa80`0263a010 00000000`00000001 00000000`00000000 80000000`00000000 : afd!AfdCloseConnection+0x7a fffffa60`05184940 fffffa60`0423c498 : 00000000`00000000 fffffa80`042ae9a0 fffffa80`026fc710 00000000`00000001 : afd!AfdCloseCore+0x180 fffffa60`051849d0 fffff800`01cda53e : fffffa80`01572cd0 fffffa80`01572cd0 00000000`00000004 fffffa60`05184a70 : afd!AfdDispatch+0x78 fffffa60`05184a10 fffff800`01a64e93 : 00000000`00000000 fffffa80`01572cd0 fffffa80`01572ca0 fffffa60`005ec180 : nt!IopDeleteFile+0x17e fffffa60`05184aa0 fffff800`01cdbc5e : fffff880`07209510 fffffa80`00000001 fffffa80`0272bc10 00000000`00000002 : nt!ObfDereferenceObject+0x103 fffffa60`05184b30 fffff800`01cdbe04 : fffff880`07a829b0 fffff880`07a82900 00000000`00000001 00000000`00000544 : nt!ObpCloseHandleTableEntry+0xce fffffa60`05184bd0 fffff800`01a5ce33 : fffffa80`026fc710 fffffa60`05184ca0 00000000`7efaf000 fffffa80`04231420 : nt!ObpCloseHandle+0x94 fffffa60`05184c20 00000000`76f95b6a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0060e848 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f95b6a FOLLOWUP_IP: afd! ?? ::GFJBLGFE::`string'+33e4 fffffa60`0424eaf5 90 nop SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: afd! ?? ::GFJBLGFE::`string'+33e4 FOLLOWUP_NAME: MachineOwner MODULE_NAME: afd IMAGE_NAME: afd.sys DEBUG_FLR_IMAGE_TIMESTAMP: 47919ad7 STACK_COMMAND: .cxr 0xfffffa6005183eb0; kb FAILURE_BUCKET_ID: X64_0x3B_afd!_??_::GFJBLGFE::_string_+33e4 BUCKET_ID: X64_0x3B_afd!_??_::GFJBLGFE::_string_+33e4 Followup: MachineOwner ---------