Dietmar

@George King Now I get a very similar Bsod Dietmar Break instruction exception - code 80000003 (first chance) nt!DbgBreakPoint: 8052b718 cc int 3 kd> g *** Fatal System Error: 0x0000007e (0xC0000005,0xB79B0DFB,0xB84C7454,0xB84C7150) Break instruction exception - code 80000003 (first chance) A fatal system error has occurred. Debugger entered on first try; Bugcheck callbacks have not been invoked. A fatal system error has occurred. Connected to Windows XP 2600 x86 compatible target at (Tue May 3 00:24:59.796 2022 (UTC + 2:00)), ptr64 FALSE Loading Kernel Symbols ................................................... Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 7E, {c0000005, b79b0dfb, b84c7454, b84c7150} *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnx.exe - *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrn8.sys - *** ERROR: Symbol file could not be found. Defaulted to export symbols for NETIO.SYS - Probably caused by : ntoskrnx.exe ( ntoskrnx!ExAllocatePoolWithTag+389 ) Followup: MachineOwner --------- nt!RtlpBreakWithStatusInstruction: 8052b724 cc int 3 11: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: b79b0dfb, The address that the exception occurred at Arg3: b84c7454, Exception Record Address Arg4: b84c7150, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung "0x%08lx" verweist auf Speicher bei "0x%08lx". Die Daten wurden wegen eines E/A-Fehlers in "0x%081x" nicht in den Arbeitsspeicher bertragen. FAULTING_IP: ntoskrnx!ExAllocatePoolWithTag+389 b79b0dfb 8b761c mov esi,dword ptr [esi+1Ch] EXCEPTION_RECORD: b84c7454 -- (.exr 0xffffffffb84c7454) ExceptionAddress: b79b0dfb (ntoskrnx!ExAllocatePoolWithTag+0x00000389) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 0000001c Attempt to read from address 0000001c CONTEXT: b84c7150 -- (.cxr 0xffffffffb84c7150;r) eax=00000001 ebx=00000000 ecx=00000002 edx=00000002 esi=00000000 edi=80557180 eip=b79b0dfb esp=b84c751c ebp=b84c7570 iopl=0 nv up ei pl nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202 ntoskrnx!ExAllocatePoolWithTag+0x389: b79b0dfb 8b761c mov esi,dword ptr [esi+1Ch] ds:0023:0000001c=???????? Last set context: eax=00000001 ebx=00000000 ecx=00000002 edx=00000002 esi=00000000 edi=80557180 eip=b79b0dfb esp=b84c751c ebp=b84c7570 iopl=0 nv up ei pl nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202 ntoskrnx!ExAllocatePoolWithTag+0x389: b79b0dfb 8b761c mov esi,dword ptr [esi+1Ch] ds:0023:0000001c=???????? Resetting default scope ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung "0x%08lx" verweist auf Speicher bei "0x%08lx". Die Daten wurden wegen eines E/A-Fehlers in "0x%081x" nicht in den Arbeitsspeicher bertragen. EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 0000001c READ_ADDRESS: 0000001c FOLLOWUP_IP: ntoskrnx!ExAllocatePoolWithTag+389 b79b0dfb 8b761c mov esi,dword ptr [esi+1Ch] BUGCHECK_STR: 0x7E DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre LAST_CONTROL_TRANSFER: from b7a60bce to b79b0dfb STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. b84c7570 b7a60bce 00000001 ffdff120 67727453 ntoskrnx!ExAllocatePoolWithTag+0x389 b84c759c b7a08389 b84c75cc b84c7604 00000001 ntoskrnx!ExfReleasePushLock+0x352 b84c75dc b792b599 b84c7604 00000000 00000000 ntoskrnx!MmGetSystemRoutineAddress+0x49 b84c75f0 b766443d b84c7604 98969b06 00000000 ntoskrn8!MmGetSystemRoutineAddress+0x19 b84c7610 b766a01c 98969b06 805ad41e b84c7630 NETIO!RtlInvokeStartRoutines+0x73 b84c7640 8069de4c b766a005 80084000 80084000 NETIO!DllInitialize+0x17 b84c7690 8069af70 80084000 b84c76ac 00034000 nt!IopInitializeBootDrivers+0xd4 b84c7838 806993d3 80084000 00000000 989a89b0 nt!IoInitSystem+0x712 b84c7dac 805cffee 80084000 00000000 00000000 nt!Phase1Initialization+0xac7 b84c7ddc 8054623e 8069890c 80084000 00000000 nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: ntoskrnx!ExAllocatePoolWithTag+389 FOLLOWUP_NAME: MachineOwner MODULE_NAME: ntoskrnx IMAGE_NAME: ntoskrnx.exe DEBUG_FLR_IMAGE_TIMESTAMP: 6134229e IMAGE_VERSION: 5.1.2600.16384 STACK_COMMAND: .cxr 0xffffffffb84c7150 ; kb FAILURE_BUCKET_ID: 0x7E_ntoskrnx!ExAllocatePoolWithTag+389 BUCKET_ID: 0x7E_ntoskrnx!ExAllocatePoolWithTag+389 ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0x7e_ntoskrnx!exallocatepoolwithtag+389 FAILURE_ID_HASH: {a448a1a7-43f8-ac55-b1fd-a5ed200a631a} Followup: MachineOwner --------- 11: kd> lm start end module name 80100000 8012a000 KDSTUB (deferred) 80289000 80299a80 pci (deferred) 804d7000 806e5000 nt (pdb symbols) C:\Programme\Windows Kits\8.1\Debuggers\x86\sym\ntkrpamp.pdb\270E083F57714738A1895FE542CFB8DE1\ntkrpamp.pdb 806e5000 80705d00 hal (deferred) 80706000 8072e000 kdcom (deferred) b7616000 b762fe80 Mup (deferred) b7630000 b766f000 NETIO (export symbols) NETIO.SYS b766f000 b7699000 msrpc (deferred) b7699000 b7751000 NDIS (deferred) b7751000 b77ddd00 Ntfs (deferred) b77de000 b783b000 UsbHub3 (deferred) b783b000 b7880000 USBXHCI (deferred) b7880000 b7896b80 KSecDD (deferred) b7897000 b78a8f00 sr (deferred) b78a9000 b78c8b00 fltMgr (deferred) b78c9000 b78e0880 SCSIPORT (deferred) b78e1000 b792a000 storport (deferred) b792a000 b794db80 ntoskrn8 (export symbols) ntoskrn8.sys b794e000 b7b25e80 ntoskrnx (export symbols) ntoskrnx.exe b7b26000 b7b39000 storahci (deferred) b7b39000 b7b50900 atapi (deferred) b7b51000 b7e06000 iaStor (deferred) b7e06000 b7e2ba00 dmio (deferred) b7e2c000 b7e4ad80 ftdisk (deferred) b7e4b000 b7e7a000 ucx01000 (deferred) b7e7a000 b7ea9d80 ACPI (deferred) b7eaa000 b7f2c000 WDF01_W8 (deferred) b7f2c000 b7f4b000 asmthub3 (deferred) b7f4b000 b7fa7000 asmtxhci (deferred) b80a8000 b80b6000 WDFLDR8 (deferred) b80b8000 b80c1300 isapnp (deferred) b80c8000 b80d2000 WppRecorder (deferred) b80d8000 b80e2580 MountMgr (deferred) b80e8000 b80f5200 VolSnap (deferred) b80f8000 b8106000 stornvme (deferred) b8108000 b8118000 asahci32 (deferred) b8118000 b8120e00 disk (deferred) b8128000 b8134180 CLASSPNP (deferred) b8138000 b8141000 USBD_W8 (deferred) b8148000 b8157100 ohci1394 (deferred) b8158000 b8165080 1394BUS (deferred) b8328000 b832e780 USBSTOR (deferred) b8330000 b8336180 PCIIDEX (deferred) b8338000 b833cd00 PartMgr (deferred) b8340000 b8344c00 storpor8 (deferred) b84b8000 b84bb000 BOOTVID (deferred) b84bc000 b84bef80 ACPIEC (deferred) b85a8000 b85a9100 WMILIB (deferred) b85aa000 b85ab500 USBD (deferred) b85ac000 b85ad700 dmload (deferred) b8670000 b8670d00 pciide (deferred) b8671000 b8671d80 OPRGHDLR (deferred)

@George King With the 5048 msrpc.sys and the "original" netio.sys I get other Bsod Dietmar Microsoft (R) Windows Debugger Version 6.3.9600.17200 X86 Copyright (c) Microsoft Corporation. All rights reserved. Using NET for debugging Opened WinSock 2.0 Waiting to reconnect... Connected to target 192.168.2.102 on port 50000 on local IP 192.168.2.101. Connected to Windows XP 2600 x86 compatible target at (Tue May 3 00:04:50.531 2022 (UTC + 2:00)), ptr64 FALSE Kernel Debugger connection established. ************* Symbol Path validation summary ************** Response Time (ms) Location OK C:\Symbols ************* Symbol Path validation summary ************** Response Time (ms) Location OK C:\symbolssss Symbol search path is: C:\symbolssss Executable search path is: C:\Symbols Windows XP Kernel Version 2600 MP (1 procs) Checked x86 compatible Built by: 2600.xpsp.080413-2133 Machine Name: Kernel base = 0x80a02000 PsLoadedModuleList = 0x80b019e8 System Uptime: not available ************* Symbol Path validation summary ************** Response Time (ms) Location OK E:\binaries.x86fre\Symbols ************* Symbol Path validation summary ************** Response Time (ms) Location OK C:\Symbols ************* Symbol Path validation summary ************** Response Time (ms) Location OK C:\symbolssss OK C:\symbols OK C:\symbolss OK C:\symbolsss OK E:\binaries.x86fre\Symbols Deferred https://msdl.microsoft.com/download/symbols Deferred srv* Break instruction exception - code 80000003 (first chance) nt!DbgBreakPoint: 80ac37e0 cc int 3 kd> g MM: Loader/HAL memory block indicates large pages cannot be used for 80100000->8012777F MTRR feature disabled. KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled PS: Unhandled Kernel Mode Exception Pointers = 0xB84C6F94 Code c0000005 Addr B79B0DFB Info0 00000000 Info1 0000001C Info2 0000001C Info3 80AD6560 *** Fatal System Error: 0x0000007e (0xC0000005,0xB79B0DFB,0xB84C7448,0xB84C7144) Break instruction exception - code 80000003 (first chance) A fatal system error has occurred. Debugger entered on first try; Bugcheck callbacks have not been invoked. A fatal system error has occurred. Connected to Windows XP 2600 x86 compatible target at (Tue May 3 00:04:55.859 2022 (UTC + 2:00)), ptr64 FALSE Loading Kernel Symbols ................................................... Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 7E, {c0000005, b79b0dfb, b84c7448, b84c7144} *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnx.exe - *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrn8.sys - *** ERROR: Symbol file could not be found. Defaulted to export symbols for NETIO.SYS - Probably caused by : ntoskrnx.exe ( ntoskrnx!ExAllocatePoolWithTag+389 ) Followup: MachineOwner --------- nt!RtlpBreakWithStatusInstruction: 80ac37ec cc int 3 11: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: b79b0dfb, The address that the exception occurred at Arg3: b84c7448, Exception Record Address Arg4: b84c7144, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung "0x%08lx" verweist auf Speicher bei "0x%08lx". Die Daten wurden wegen eines E/A-Fehlers in "0x%081x" nicht in den Arbeitsspeicher bertragen. FAULTING_IP: ntoskrnx!ExAllocatePoolWithTag+389 b79b0dfb 8b761c mov esi,dword ptr [esi+1Ch] EXCEPTION_RECORD: b84c7448 -- (.exr 0xffffffffb84c7448) ExceptionAddress: b79b0dfb (ntoskrnx!ExAllocatePoolWithTag+0x00000389) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 0000001c Attempt to read from address 0000001c CONTEXT: b84c7144 -- (.cxr 0xffffffffb84c7144;r) eax=00000001 ebx=00000000 ecx=00000002 edx=00000002 esi=00000000 edi=80af8280 eip=b79b0dfb esp=b84c7510 ebp=b84c7564 iopl=0 nv up ei pl nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202 ntoskrnx!ExAllocatePoolWithTag+0x389: b79b0dfb 8b761c mov esi,dword ptr [esi+1Ch] ds:0023:0000001c=???????? Last set context: eax=00000001 ebx=00000000 ecx=00000002 edx=00000002 esi=00000000 edi=80af8280 eip=b79b0dfb esp=b84c7510 ebp=b84c7564 iopl=0 nv up ei pl nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202 ntoskrnx!ExAllocatePoolWithTag+0x389: b79b0dfb 8b761c mov esi,dword ptr [esi+1Ch] ds:0023:0000001c=???????? Resetting default scope PROCESS_NAME: System ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung "0x%08lx" verweist auf Speicher bei "0x%08lx". Die Daten wurden wegen eines E/A-Fehlers in "0x%081x" nicht in den Arbeitsspeicher bertragen. EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 0000001c READ_ADDRESS: 0000001c FOLLOWUP_IP: ntoskrnx!ExAllocatePoolWithTag+389 b79b0dfb 8b761c mov esi,dword ptr [esi+1Ch] BUGCHECK_STR: 0x7E DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre LAST_CONTROL_TRANSFER: from b7a60bce to b79b0dfb STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. b84c7564 b7a60bce 00000001 ffdff120 67727453 ntoskrnx!ExAllocatePoolWithTag+0x389 b84c7590 b7a08389 b84c75c0 b84c75f8 00000001 ntoskrnx!ExfReleasePushLock+0x352 b84c75d0 b792b599 b84c75f8 b84c7608 00000000 ntoskrnx!MmGetSystemRoutineAddress+0x49 b84c75e4 b766443d b84c75f8 8b30e1d6 00000000 ntoskrn8!MmGetSystemRoutineAddress+0x19 b84c7604 b766a01c 8b30e1d6 80b97c38 b84c7624 NETIO!RtlInvokeStartRoutines+0x73 b84c7634 80d37c99 b766a005 80084000 80084000 NETIO!DllInitialize+0x17 b84c7684 80d341f1 80084000 b84c76a0 00034000 nt!IopInitializeBootDrivers+0xe1 b84c7830 80d31940 80084000 00000000 8b343670 nt!IoInitSystem+0x82d b84c7dac 80bd81ac 80084000 00000000 00000000 nt!Phase1Initialization+0xb12 b84c7ddc 80ae4212 80d30e2e 80084000 00000000 nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: ntoskrnx!ExAllocatePoolWithTag+389 FOLLOWUP_NAME: MachineOwner MODULE_NAME: ntoskrnx IMAGE_NAME: ntoskrnx.exe DEBUG_FLR_IMAGE_TIMESTAMP: 6134229e IMAGE_VERSION: 5.1.2600.16384 STACK_COMMAND: .cxr 0xffffffffb84c7144 ; kb FAILURE_BUCKET_ID: 0x7E_ntoskrnx!ExAllocatePoolWithTag+389 BUCKET_ID: 0x7E_ntoskrnx!ExAllocatePoolWithTag+389 ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0x7e_ntoskrnx!exallocatepoolwithtag+389 FAILURE_ID_HASH: {a448a1a7-43f8-ac55-b1fd-a5ed200a631a} Followup: MachineOwner --------- 11: kd> lm start end module name 80100000 80127780 HAL3 (deferred) 80128000 80150000 kdcom (deferred) 80150000 8017a000 KDSTUB (deferred) 802d9000 802e9a80 pci (deferred) 80a02000 80da3000 nt (pdb symbols) C:\Programme\Windows Kits\8.1\Debuggers\x86\sym\ntkrpamp.pdb\5B9E8A586D3D49D98927B5D5117577231\ntkrpamp.pdb b7616000 b762fe80 Mup (deferred) b7630000 b766f000 NETIO (export symbols) NETIO.SYS b766f000 b7699000 msrpc (deferred) b7699000 b7751000 NDIS (deferred) b7751000 b77ddd00 Ntfs (deferred) b77de000 b783b000 UsbHub3 (deferred) b783b000 b7880000 USBXHCI (deferred) b7880000 b7896b80 KSecDD (deferred) b7897000 b78a8f00 sr (deferred) b78a9000 b78c8b00 fltMgr (deferred) b78c9000 b78e0880 SCSIPORT (deferred) b78e1000 b792a000 storport (deferred) b792a000 b794db80 ntoskrn8 (export symbols) ntoskrn8.sys b794e000 b7b25e80 ntoskrnx (export symbols) ntoskrnx.exe b7b26000 b7b39000 storahci (deferred) b7b39000 b7b50900 atapi (deferred) b7b51000 b7e06000 iaStor (deferred) b7e06000 b7e2ba00 dmio (deferred) b7e2c000 b7e4ad80 ftdisk (deferred) b7e4b000 b7e7a000 ucx01000 (deferred) b7e7a000 b7ea9d80 ACPI (deferred) b7eaa000 b7f2c000 WDF01_W8 (deferred) b7f2c000 b7f4b000 asmthub3 (deferred) b7f4b000 b7fa7000 asmtxhci (deferred) b80a8000 b80b6000 WDFLDR8 (deferred) b80b8000 b80c1300 isapnp (deferred) b80c8000 b80d2000 WppRecorder (deferred) b80d8000 b80e2580 MountMgr (deferred) b80e8000 b80f5200 VolSnap (deferred) b80f8000 b8106000 stornvme (deferred) b8108000 b8118000 asahci32 (deferred) b8118000 b8120e00 disk (deferred) b8128000 b8134180 CLASSPNP (deferred) b8138000 b8141000 USBD_W8 (deferred) b8148000 b8157100 ohci1394 (deferred) b8158000 b8165080 1394BUS (deferred) b8328000 b832e780 USBSTOR (deferred) b8330000 b8336180 PCIIDEX (deferred) b8338000 b833cd00 PartMgr (deferred) b8340000 b8344c00 storpor8 (deferred) b84b8000 b84bb000 BOOTVID (deferred) b84bc000 b84bef80 ACPIEC (deferred) b85a8000 b85a9100 WMILIB (deferred) b85aa000 b85ab500 USBD (deferred) b85ac000 b85ad700 dmload (deferred) b8670000 b8670d00 pciide (deferred) b8671000 b8671d80 OPRGHDLR (deferred)

@George King I never used this tool. Can you disable all calls for msrpc.sys in all the files Dietmar

@Damnation May be, that it is possible to enable NDIS6 without msrpc.sys Dietmar

@George King I try this msrpc.sys from Vista, but gives the same Bsod FAILURE_BUCKET_ID: 0xc2_0_msrpc!I_RpcGetCompleteAndFreeRoutine+22 Dietmar

@George King The dependencies are all fullfilled, but I got Bsod after installing this driver Dietmar Microsoft (R) Windows Debugger Version 6.3.9600.17200 X86 Copyright (c) Microsoft Corporation. All rights reserved. Using NET for debugging Opened WinSock 2.0 Waiting to reconnect... Connected to target 192.168.2.102 on port 50000 on local IP 192.168.2.101. Connected to Windows XP 2600 x86 compatible target at (Mon May 2 22:39:36.687 2022 (UTC + 2:00)), ptr64 FALSE Kernel Debugger connection established. ************* Symbol Path validation summary ************** Response Time (ms) Location OK C:\Symbols ************* Symbol Path validation summary ************** Response Time (ms) Location OK C:\symbolssss Symbol search path is: C:\symbolssss Executable search path is: C:\Symbols Windows XP Kernel Version 2600 MP (1 procs) Checked x86 compatible Built by: 2600.xpsp.080413-2133 Machine Name: Kernel base = 0x80a02000 PsLoadedModuleList = 0x80b019e8 System Uptime: not available ************* Symbol Path validation summary ************** Response Time (ms) Location OK E:\binaries.x86fre\Symbols ************* Symbol Path validation summary ************** Response Time (ms) Location OK C:\Symbols ************* Symbol Path validation summary ************** Response Time (ms) Location OK C:\symbolssss OK C:\symbols OK C:\symbolss OK C:\symbolsss OK E:\binaries.x86fre\Symbols Deferred https://msdl.microsoft.com/download/symbols Deferred srv* Break instruction exception - code 80000003 (first chance) nt!DbgBreakPoint: 80ac37e0 cc int 3 kd> g MM: Loader/HAL memory block indicates large pages cannot be used for 80100000->8012777F MTRR feature disabled. KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled *** Assertion failed: NumberOfBytes != 0 *** Source File: d:\xpsp\base\ntos\ex\pool.c, line 1174 Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? i i *** Fatal System Error: 0x000000c2 (0x00000000,0x00000000,0x00000001,0xCD637052) Break instruction exception - code 80000003 (first chance) A fatal system error has occurred. Debugger entered on first try; Bugcheck callbacks have not been invoked. A fatal system error has occurred. Connected to Windows XP 2600 x86 compatible target at (Mon May 2 22:39:48.875 2022 (UTC + 2:00)), ptr64 FALSE Loading Kernel Symbols ................................................... Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck C2, {0, 0, 1, cd637052} *** ERROR: Symbol file could not be found. Defaulted to export symbols for msrpc.sys - Probably caused by : msrpc.sys ( msrpc!I_RpcGetCompleteAndFreeRoutine+22 ) Followup: MachineOwner --------- nt!RtlpBreakWithStatusInstruction: 80ac37ec cc int 3 11: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BAD_POOL_CALLER (c2) The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc. Arguments: Arg1: 00000000, The caller is requesting a zero byte pool allocation. Arg2: 00000000, zero. Arg3: 00000001, the pool type being allocated. Arg4: cd637052, the pool tag being used. Debugging Details: ------------------ FAULTING_IP: msrpc!I_RpcGetCompleteAndFreeRoutine+22 b7673119 5d pop ebp BUGCHECK_STR: 0xc2_0 DEFAULT_BUCKET_ID: DRIVER_FAULT PROCESS_NAME: System ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre LAST_CONTROL_TRANSFER: from 80a30d7b to 80ac37ec STACK_TEXT: b84c70e8 80a30d7b 00000003 b84c7444 00000000 nt!RtlpBreakWithStatusInstruction b84c7134 80a319e6 00000003 00000000 00000000 nt!KiBugCheckDebugBreak+0x19 b84c7514 80a31f77 000000c2 00000000 00000000 nt!KeBugCheck2+0x574 b84c7534 80aed772 000000c2 00000000 00000000 nt!KeBugCheckEx+0x1b b84c75ac 80ad36a4 00000001 00000000 cd637052 nt!ExAllocatePoolWithTag+0xe86 b84c75c8 b7673119 00000001 00000000 cd637052 nt!ExAllocatePoolWithTagPriority+0x58 WARNING: Stack unwind information not available. Following frames may be wrong. b84c75e0 b7673e8a 00000000 b84c7608 b767825b msrpc!I_RpcGetCompleteAndFreeRoutine+0x22 b84c75ec b767825b 00000000 8b3101d6 00000000 msrpc!UuidEqual+0x16a b84c7608 b7696024 80b97c38 b84c7624 80084000 msrpc!UuidEqual+0x453b b84c7634 80d37c99 b7696014 80084000 80084000 msrpc!DllInitialize+0x10 b84c7684 80d341f1 80084000 b84c76a0 00034000 nt!IopInitializeBootDrivers+0xe1 b84c7830 80d31940 80084000 00000000 8b345670 nt!IoInitSystem+0x82d b84c7dac 80bd81ac 80084000 00000000 00000000 nt!Phase1Initialization+0xb12 b84c7ddc 80ae4212 80d30e2e 80084000 00000000 nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 STACK_COMMAND: kb FOLLOWUP_IP: msrpc!I_RpcGetCompleteAndFreeRoutine+22 b7673119 5d pop ebp SYMBOL_STACK_INDEX: 6 SYMBOL_NAME: msrpc!I_RpcGetCompleteAndFreeRoutine+22 FOLLOWUP_NAME: MachineOwner MODULE_NAME: msrpc IMAGE_NAME: msrpc.sys DEBUG_FLR_IMAGE_TIMESTAMP: 61b814df IMAGE_VERSION: 6.1.7601.25822 FAILURE_BUCKET_ID: 0xc2_0_msrpc!I_RpcGetCompleteAndFreeRoutine+22 BUCKET_ID: 0xc2_0_msrpc!I_RpcGetCompleteAndFreeRoutine+22 ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0xc2_0_msrpc!i_rpcgetcompleteandfreeroutine+22 FAILURE_ID_HASH: {7bd0e304-b158-484e-2d37-b2035b12b23c} Followup: MachineOwner --------- 11: kd> lm start end module name 80100000 80127780 HAL3 (deferred) 80128000 80150000 kdcom (deferred) 80150000 8017a000 KDSTUB (deferred) 802d9000 802e9a80 pci (deferred) 80a02000 80da3000 nt (pdb symbols) C:\Programme\Windows Kits\8.1\Debuggers\x86\sym\ntkrpamp.pdb\5B9E8A586D3D49D98927B5D5117577231\ntkrpamp.pdb b7614000 b762de80 Mup (deferred) b762e000 b766d000 NETIO (deferred) b766d000 b7699000 msrpc (export symbols) msrpc.sys b7699000 b7751000 NDIS (deferred) b7751000 b77ddd00 Ntfs (deferred) b77de000 b783b000 UsbHub3 (deferred) b783b000 b7880000 USBXHCI (deferred) b7880000 b7896b80 KSecDD (deferred) b7897000 b78a8f00 sr (deferred) b78a9000 b78c8b00 fltMgr (deferred) b78c9000 b78e0880 SCSIPORT (deferred) b78e1000 b792a000 storport (deferred) b792a000 b794db80 ntoskrn8 (deferred) b794e000 b7b25e80 ntoskrnx (deferred) b7b26000 b7b39000 storahci (deferred) b7b39000 b7b50900 atapi (deferred) b7b51000 b7e06000 iaStor (deferred) b7e06000 b7e2ba00 dmio (deferred) b7e2c000 b7e4ad80 ftdisk (deferred) b7e4b000 b7e7a000 ucx01000 (deferred) b7e7a000 b7ea9d80 ACPI (deferred) b7eaa000 b7f2c000 WDF01_W8 (deferred) b7f2c000 b7f4b000 asmthub3 (deferred) b7f4b000 b7fa7000 asmtxhci (deferred) b80a8000 b80b6000 WDFLDR8 (deferred) b80b8000 b80c1300 isapnp (deferred) b80c8000 b80d2000 WppRecorder (deferred) b80d8000 b80e2580 MountMgr (deferred) b80e8000 b80f5200 VolSnap (deferred) b80f8000 b8106000 stornvme (deferred) b8108000 b8118000 asahci32 (deferred) b8118000 b8120e00 disk (deferred) b8128000 b8134180 CLASSPNP (deferred) b8138000 b8141000 USBD_W8 (deferred) b8148000 b8157100 ohci1394 (deferred) b8158000 b8165080 1394BUS (deferred) b8328000 b832e780 USBSTOR (deferred) b8330000 b8336180 PCIIDEX (deferred) b8338000 b833cd00 PartMgr (deferred) b8340000 b8344c00 storpor8 (deferred) b84b8000 b84bb000 BOOTVID (deferred) b84bc000 b84bef80 ACPIEC (deferred) b85a8000 b85a9100 WMILIB (deferred) b85aa000 b85ab500 USBD (deferred) b85ac000 b85ad700 dmload (deferred) b8670000 b8670d00 pciide (deferred) b8671000 b8671d80 OPRGHDLR (deferred) 11: kd> !devnode 0 1 Dumping IopRootDeviceNode (= 0x8b314ed8) DevNode 0x8b314ed8 for PDO 0x8b3672c0 InstancePath is "HTREE\ROOT\0" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b314b00 for PDO 0x8b314c60 InstancePath is "Root\ACPI_HAL\0000" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b35e650 for PDO 0x8b30d480 InstancePath is "ACPI_HAL\PNP0C08\0" ServiceName is "ACPI" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b314788 for PDO 0x8b3148e8 InstancePath is "Root\dmio\0000" ServiceName is "dmio" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b314530 for PDO 0x8b314690 InstancePath is "Root\ftdisk\0000" ServiceName is "ftdisk" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b366008 for PDO 0x8b314438 InstancePath is "Root\LEGACY_AFD\0000" ServiceName is "AFD" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b366db0 for PDO 0x8b366f10 InstancePath is "Root\LEGACY_AMPA\0000" ServiceName is "ampa" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b366b58 for PDO 0x8b366cb8 InstancePath is "Root\LEGACY_ARP1394\0000" ServiceName is "Arp1394" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b366900 for PDO 0x8b366a60 InstancePath is "Root\LEGACY_ASMTHUB3\0000" ServiceName is "asmthub3" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b3666a8 for PDO 0x8b366808 InstancePath is "Root\LEGACY_ASMTXHCI\0000" ServiceName is "asmtxhci" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b366450 for PDO 0x8b3665b0 InstancePath is "Root\LEGACY_BEEP\0000" ServiceName is "Beep" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b313008 for PDO 0x8b366278 InstancePath is "Root\LEGACY_COMMONFX.SYS\0000" ServiceName is "COMMONFX.SYS" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b313db0 for PDO 0x8b313f10 InstancePath is "Root\LEGACY_CPUZ135\0000" ServiceName is "cpuz135" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b313b58 for PDO 0x8b313cb8 InstancePath is "Root\LEGACY_CTAC32K\0000" ServiceName is "ctac32k" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b313900 for PDO 0x8b313a60 InstancePath is "Root\LEGACY_CTAUDFX.SYS\0000" ServiceName is "CTAUDFX.SYS" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b3136a8 for PDO 0x8b313808 InstancePath is "Root\LEGACY_CTPRXY2K\0000" ServiceName is "ctprxy2k" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b313450 for PDO 0x8b3135b0 InstancePath is "Root\LEGACY_CTSBLFX.SYS\0000" ServiceName is "CTSBLFX.SYS" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b3131f8 for PDO 0x8b313358 InstancePath is "Root\LEGACY_CTSFM2K\0000" ServiceName is "ctsfm2k" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b365ed8 for PDO 0x8b365038 InstancePath is "Root\LEGACY_DMBOOT\0000" ServiceName is "dmboot" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b365c80 for PDO 0x8b365de0 InstancePath is "Root\LEGACY_DMLOAD\0000" ServiceName is "dmload" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b365a28 for PDO 0x8b365b88 InstancePath is "Root\LEGACY_ELBYCDIO\0000" ServiceName is "ElbyCDIO" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b3657d0 for PDO 0x8b365930 InstancePath is "Root\LEGACY_EMUPIA\0000" ServiceName is "emupia" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b365578 for PDO 0x8b3656d8 InstancePath is "Root\LEGACY_FIPS\0000" ServiceName is "Fips" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b365320 for PDO 0x8b365480 InstancePath is "Root\LEGACY_GPC\0000" ServiceName is "Gpc" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b312008 for PDO 0x8b365228 InstancePath is "Root\LEGACY_HA10KX2K\0000" ServiceName is "ha10kx2k" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b312db0 for PDO 0x8b312f10 InstancePath is "Root\LEGACY_HAP17V2K\0000" ServiceName is "hap17v2k" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b312b58 for PDO 0x8b312cb8 InstancePath is "Root\LEGACY_HTTP\0000" ServiceName is "HTTP" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b312900 for PDO 0x8b312a60 InstancePath is "Root\LEGACY_IPNAT\0000" ServiceName is "IpNat" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b3126a8 for PDO 0x8b312808 InstancePath is "Root\LEGACY_IPSEC\0000" ServiceName is "IPSec" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b312450 for PDO 0x8b3125b0 InstancePath is "Root\LEGACY_KSECDD\0000" ServiceName is "ksecdd" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b3121f8 for PDO 0x8b312358 InstancePath is "Root\LEGACY_MNMDD\0000" ServiceName is "mnmdd" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b364ed8 for PDO 0x8b364038 InstancePath is "Root\LEGACY_MOUNTMGR\0000" ServiceName is "mountmgr" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b364c80 for PDO 0x8b364de0 InstancePath is "Root\LEGACY_NDIS\0000" ServiceName is "NDIS" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b364a28 for PDO 0x8b364b88 InstancePath is "Root\LEGACY_NDISTAPI\0000" ServiceName is "NdisTapi" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b3647d0 for PDO 0x8b364930 InstancePath is "Root\LEGACY_NDISUIO\0000" ServiceName is "Ndisuio" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b364578 for PDO 0x8b3646d8 InstancePath is "Root\LEGACY_NDPROXY\0000" ServiceName is "NDProxy" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b364320 for PDO 0x8b364480 InstancePath is "Root\LEGACY_NETBT\0000" ServiceName is "NetBT" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b311008 for PDO 0x8b364228 InstancePath is "Root\LEGACY_NULL\0000" ServiceName is "Null" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b311db0 for PDO 0x8b311f10 InstancePath is "Root\LEGACY_OSSRV\0000" ServiceName is "ossrv" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b311b58 for PDO 0x8b311cb8 InstancePath is "Root\LEGACY_PARPORT\0000" ServiceName is "Parport" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b311900 for PDO 0x8b311a60 InstancePath is "Root\LEGACY_PARTMGR\0000" ServiceName is "PartMgr" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b3116a8 for PDO 0x8b311808 InstancePath is "Root\LEGACY_PARVDM\0000" ServiceName is "ParVdm" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b311450 for PDO 0x8b3115b0 InstancePath is "Root\LEGACY_RASACD\0000" ServiceName is "RasAcd" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b3111f8 for PDO 0x8b311358 InstancePath is "Root\LEGACY_RDPCDD\0000" ServiceName is "RDPCDD" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b363ed8 for PDO 0x8b363038 InstancePath is "Root\LEGACY_TCPIP\0000" ServiceName is "Tcpip" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b363c80 for PDO 0x8b363de0 InstancePath is "Root\LEGACY_UCX01000\0000" ServiceName is "UCX01000" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b363a28 for PDO 0x8b363b88 InstancePath is "Root\LEGACY_USBSTOR\0000" ServiceName is "USBSTOR" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b3637d0 for PDO 0x8b363930 InstancePath is "Root\LEGACY_VBOXDRV\0000" ServiceName is "VBoxDrv" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b363578 for PDO 0x8b3636d8 InstancePath is "Root\LEGACY_VBOXUSBMON\0000" ServiceName is "VBoxUSBMon" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b363320 for PDO 0x8b363480 InstancePath is "Root\LEGACY_VGASAVE\0000" ServiceName is "VgaSave" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b310008 for PDO 0x8b363228 InstancePath is "Root\LEGACY_VOLSNAP\0000" ServiceName is "VolSnap" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b310db0 for PDO 0x8b310f10 InstancePath is "Root\LEGACY_WANARP\0000" ServiceName is "Wanarp" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b310b58 for PDO 0x8b310cb8 InstancePath is "Root\LEGACY_WDF01_W8\0000" ServiceName is "WDF01_W8" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0x8b310900 for PDO 0x8b310a60 InstancePath is "Root\MEDIA\MS_MMACM" ServiceName is "audstub" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b3106a8 for PDO 0x8b310808 InstancePath is "Root\MEDIA\MS_MMDRV" ServiceName is "audstub" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b310450 for PDO 0x8b3105b0 InstancePath is "Root\MEDIA\MS_MMMCI" ServiceName is "audstub" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b3101f8 for PDO 0x8b310358 InstancePath is "Root\MEDIA\MS_MMVCD" ServiceName is "audstub" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b362ed8 for PDO 0x8b362038 InstancePath is "Root\MEDIA\MS_MMVID" ServiceName is "audstub" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b362c80 for PDO 0x8b362de0 InstancePath is "Root\MS_L2TPMINIPORT\0000" ServiceName is "Rasl2tp" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b362a28 for PDO 0x8b362b88 InstancePath is "Root\MS_NDISWANIP\0000" ServiceName is "NdisWan" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b3627d0 for PDO 0x8b362930 InstancePath is "Root\MS_PPPOEMINIPORT\0000" ServiceName is "RasPppoe" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b362578 for PDO 0x8b3626d8 InstancePath is "Root\MS_PPTPMINIPORT\0000" ServiceName is "PptpMiniport" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b362320 for PDO 0x8b362480 InstancePath is "Root\MS_PSCHEDMP\0000" ServiceName is "PSched" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30f008 for PDO 0x8b362228 InstancePath is "Root\MS_PSCHEDMP\0001" ServiceName is "PSched" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30fdb0 for PDO 0x8b30ff10 InstancePath is "Root\MS_PSCHEDMP\0002" ServiceName is "PSched" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30fb58 for PDO 0x8b30fcb8 InstancePath is "Root\MS_PSCHEDMP\0003" ServiceName is "PSched" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30f900 for PDO 0x8b30fa60 InstancePath is "Root\MS_PSCHEDMP\0004" ServiceName is "PSched" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30f6a8 for PDO 0x8b30f808 InstancePath is "Root\MS_PSCHEDMP\0005" ServiceName is "PSched" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30f450 for PDO 0x8b30f5b0 InstancePath is "Root\MS_PSCHEDMP\0006" ServiceName is "PSched" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30f1f8 for PDO 0x8b30f358 InstancePath is "Root\MS_PSCHEDMP\0007" ServiceName is "PSched" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b361ed8 for PDO 0x8b361038 InstancePath is "Root\MS_PSCHEDMP\0008" ServiceName is "PSched" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b361c80 for PDO 0x8b361de0 InstancePath is "Root\MS_PSCHEDMP\0009" ServiceName is "PSched" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b361a28 for PDO 0x8b361b88 InstancePath is "Root\MS_PSCHEDMP\0010" ServiceName is "PSched" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b3617d0 for PDO 0x8b361930 InstancePath is "Root\MS_PSCHEDMP\0011" ServiceName is "PSched" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b361578 for PDO 0x8b3616d8 InstancePath is "Root\MS_PTIMINIPORT\0000" ServiceName is "Raspti" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b361320 for PDO 0x8b361480 InstancePath is "Root\NET\0000" ServiceName is "VBoxNetAdp" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30e008 for PDO 0x8b361228 InstancePath is "Root\RDPDR\0000" ServiceName is "rdpdr" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30edb0 for PDO 0x8b30ef10 InstancePath is "Root\RDP_KBD\0000" ServiceName is "TermDD" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30eb58 for PDO 0x8b30ecb8 InstancePath is "Root\RDP_MOU\0000" ServiceName is "TermDD" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30e900 for PDO 0x8b30ea60 InstancePath is "Root\SCSIADAPTER\0000" ServiceName is "VClone" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30e6a8 for PDO 0x8b30e808 InstancePath is "Root\SUN_VBOXNETFLTMP\0000" ServiceName is "VBoxNetFlt" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30e450 for PDO 0x8b30e5b0 InstancePath is "Root\SUN_VBOXNETFLTMP\0001" ServiceName is "VBoxNetFlt" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30e1f8 for PDO 0x8b30e358 InstancePath is "Root\SUN_VBOXNETFLTMP\0002" ServiceName is "VBoxNetFlt" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b360ed8 for PDO 0x8b360038 InstancePath is "Root\SUN_VBOXNETFLTMP\0003" ServiceName is "VBoxNetFlt" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b360c80 for PDO 0x8b360de0 InstancePath is "Root\SUN_VBOXNETFLTMP\0004" ServiceName is "VBoxNetFlt" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b360a28 for PDO 0x8b360b88 InstancePath is "Root\SUN_VBOXNETFLTMP\0005" ServiceName is "VBoxNetFlt" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b3607d0 for PDO 0x8b360930 InstancePath is "Root\SUN_VBOXNETFLTMP\0006" ServiceName is "VBoxNetFlt" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b360578 for PDO 0x8b3606d8 InstancePath is "Root\SUN_VBOXNETFLTMP\0007" ServiceName is "VBoxNetFlt" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b360320 for PDO 0x8b360480 InstancePath is "Root\SUN_VBOXNETFLTMP\0008" ServiceName is "VBoxNetFlt" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30d008 for PDO 0x8b360228 InstancePath is "Root\SUN_VBOXNETFLTMP\0009" ServiceName is "VBoxNetFlt" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30ddb0 for PDO 0x8b30df10 InstancePath is "Root\SYSTEM\0000" ServiceName is "swenum" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30db58 for PDO 0x8b30dcb8 InstancePath is "Root\SYSTEM\0001" ServiceName is "update" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301) DevNode 0x8b30d900 for PDO 0x8b30da60 InstancePath is "Root\SYSTEM\0002" ServiceName is "mssmbios" State = DeviceNodeInitialized (0x302) Previous State = DeviceNodeUninitialized (0x301)

@Damnation The link is for the same ntoskrn8.sys as before. Do you already integrate the 11 functions which Dependency Walker shows for e1d6232.sys (only to ntoskrnl.exe) into the new ntoskrn8.sys and change name in e1d6232.sys from ntoskrnl.exe ---> ntoskrn8.sys Dietmar

@George King Until now I cant work with the Extender. So we have to wait for @Damnation for new ntoskrn8.sys for Intel Lan NDIS6 for the i219 device Dietmar

@George King There are 11 dependencies from Intel Lan driver for i219 e1d6232.sys, which have to be integrated in ntoskrn8.sys too and then also the change of ntoskrnl.exe ---> ntoskrn8.sys in e1d6232.sys Dietmar PS: Maybe, that in this night we get a working NDIS6 driver for XP SP3.

@Damnation Thanks a lot! Now the only thing is missed I think, is to do the same for the intel Lan driver for the i219 device. It has also some unsolved dependecies to ntoskrnl.exe from XP SP3 Dietmar PS: Here is the driver e1d6232.sys . It has also 11 unsolved dependencies to the original ntoskrnl.exe from XP SP3, may be most you integrate already. https://ufile.io/exw6n4cm Then, we only need to modd its *.inf. May be, I can do an extract from the registry of this driver running under Win7 SP1 bit32 for the i219 device.

@Damnation I never worked before with the Kernel Extender from @Mov AX, 0xDEAD. Can you tell me, at which places I have to change via Ida Pro the name of ntoskrnl.exe ---> ntoskrn8.sys Dietmar PS: Or can you do this for me? First test with the free versions of ndis.sys, netio.sys, msrpc.sys from win7 SP1 bit32.

@Damnation What have I to do with my original 5512 ntkrnlpa.exe, so that your files are all recogniced? And do you use ndis.sys, netio.sys, msrpc.sys from win7 SP1 bit32 ? Which storport.sys I should use Dietmar PS: Anyway nice work EDIT: I think, you forget the following "Make corrections to target driver XXX.sys so that it loads ntoskrn8.sys instead of the original ntoskrnl.exe"

@sookoop Even Win10 bit 32 you cant install on the MSI z690 A, I have this board also. But with the files from Ramsey you can install XP SP3 there. http://www.zone94.com/downloads/software/operating-systems/123-windows-xp-professional-sp3-x86-integral-edition Dietmar PS: Choose (2) (3) 4 (6) (7) G . I test also the Msi pro z690-a ddr4 board with 12900k cpu for XP SP3. Only with the very first Bios 7D25v10 2021-09-15 I succeed to boot XP SP3 (only after CMOS reset). On the PS/2 slot keyboard and mouse do not work together, only one each.

Here is another report about TZ10 on a Gigabyte 450 board Dietmar ACPI thermal zone - does my pc think it’s overheating? Open I’ve had some issues with my computer recently. From the most recent breaking point, I was playing PUBG when big black lines started appearing through the game world, then the game just shut down and other apps starting freezing and shutting down. No error messages etc of any kind. Since then, I could log into windows for a bit but the same thing would happen - apps just shut down and nothing would really work. The screen would flicker black and eventually just go fully black. However, it does work in safe mode - although stuff starts shutting down if anything is “intensive”, like scrolling around a google search in chrome. I’ve had a look through event logs and there’s a lot to see, none of which I really understand. I can post lots more if that’d be helpful and if one issue in particular that I think could be relevant turns out to be wrong. So that specific log is ACPI TZ.TZ10 thermal zone has been enumerated. What I understand is it’s just saying how hot it is, but it also lists CRT and HOT values for when it starts throttling/shutting down? (But if that’s wrong please do say, then I can move onto the next theory) For that log, the HOT and CRT values are 292 and 291 kelvin, which is about 19 degrees Celsius, so my thought was that the computer starts throttling things way earlier than it really should. Am I completely wrong or maybe onto something?? I also flashed the BIOS, thinking maybe that was the issue, no help. The computers specs are: Motherboard: Gigabyte 450M S2H CPU: Ryzen 1600X GPU: NVIDIA 1050ti RAM: 8gb hyperx/fusion/Kingston (whichever it is..) PSU: NAXN 500W

Win10 seems to have this problem also Dietmar Windows 10 BSOD Help This is a brand new computer minus the GPU. Fresh windows 10 install. Display would freeze for a few seconds and the PC would reboot. Was wondering if it was a riser cable issue or PSU issue or driver issue. AMD 5900x EKWB 240 Basic AIO Gigabyte x570 I 1TB Sabrent Rocket NVMe 4.0 32GB DDR4 Corsair SF600 Gold with Corsair SF sleeved cables RX 580 /w 3.0 Riser Cable In the event viewer I see: ACPI thermal zone \_TZ.TZ10 has been enumerated. _PSV = 290K _TC1 = 0 _TC2 = 0 _TSP = 1000ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _CRT = 294K _HOT = 293K minimum throttle = 0 _CR3 = 0K

@LanXing Make try to disable something like "thermal zone" in Bios and try acpi.sys V4 again Dietmar PS: I just take a look into the DSDT table from my Asus ROG STRIX B450-F GAMING II board. There is no device TZ10.

@LanXing The Bsod 0x000000A5 (0x00000003, xxx, 0xC0000034, yyy) happens in acpi.sys, when ACPIBuildCompleteMustSucceed fails. We need a log file via Windbg, to find the reason for this. A first check with Ida Pro shows this error 0xC0000034 at 11 different places, always with mov ..., C0000034 Dietmar

@Andalu There is also USB debug for XP. All try to mix USB with Lan is waste of time Dietmar

@genieautravail Make try with to disable the HD3000 in Bios. BUT may be risk, if the other graphikscard does not work at all, that you dont see anything on screen from the moment(!) when you disable HD3000 in Bios Dietmar

@Mov AX, 0xDEAD Until now, I do not find a single board, where acpi.sys V4 does not work and full XP SP3 installation. But I have not tested all because of small time Dietmar

@Damnation The link for the Source file of your new acpi.sys V4 for bit64 is broken. Can you upload it on ufile.io again Dietmar

@George King @Mov AX, 0xDEAD I build acpi.sys V4 also without the _OSI modd, but now I test "full" acpi.sys V4 Dietmar PS: I think, this acpi error is different from all the others. It appears first time on all >= Skylake boards when using asl.exe for loading a DSDT table to Bios. Very easy way but this special Bsod destroys until now its possibility for to use with sense. Here is the loong output, about 1 Mbyte. I load new version up because it is better readable ottoASL5.7z

@Mov AX, 0xDEAD Just now I am prepairing the loong !amli output and hope, that it says something to you Dietmar

But a quick test with Windbg and the debug version of acpi.sys V4 shows something other Dietmar Break instruction exception - code 80000003 (first chance) nt!DbgBreakPoint: 80ac37e0 cc int 3 kd> g MM: Loader/HAL memory block indicates large pages cannot be used for 80100000->8012777F MTRR feature disabled. KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled KiInitializeMTRR: OS support for MTRRs disabled *** Assertion failed: (Pfn1->u3.e2.ReferenceCount != 0) || ((Pfn1->u3.e1.Rom == 1) && (CacheType == MmCached)) *** Source File: d:\xpsp\base\ntos\mm\iosup.c, line 6745 Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? i i *** Assertion failed: (Pfn1->u4.PteFrame == MI_MAGIC_AWE_PTEFRAME) || (Pfn1->PteAddress == (PVOID) (ULONG_PTR)(X64K | 0x1)) || (Pfn1->u4.PteFrame == MI_MAGIC_4GB_RECLAIM) *** Source File: d:\xpsp\base\ntos\mm\iosup.c, line 6810 Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? i i *** Fatal System Error: 0x000000a5 (0x00000003,0x314C5054,0xC0140004,0x494E495F) Break instruction exception - code 80000003 (first chance) A fatal system error has occurred. Debugger entered on first try; Bugcheck callbacks have not been invoked. A fatal system error has occurred. Connected to Windows XP 2600 x86 compatible target at (Sun Apr 24 23:33:12.187 2022 (UTC + 2:00)), ptr64 FALSE Loading Kernel Symbols ................................................ Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A5, {3, 314c5054, c0140004, 494e495f} Probably caused by : ACPI.sys ( ACPI!ACPIBuildCompleteMustSucceed+43 ) Followup: MachineOwner --------- nt!RtlpBreakWithStatusInstruction: 80ac37ec cc int 3 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* ACPI_BIOS_ERROR (a5) The ACPI Bios in the system is not fully compliant with the ACPI specification. The first value indicates where the incompatibility lies: This bug check covers a great variety of ACPI problems. If a kernel debugger is attached, use "!analyze -v". This command will analyze the precise problem, and display whatever information is most useful for debugging the specific error. Arguments: Arg1: 00000003, ACPI_FAILED_MUST_SUCCEED_METHOD ACPI tried to run a control method while creating device extensions to represent the ACPI namespace, but this control method failed. Arg2: 314c5054, The ACPI Object that was being run Arg3: c0140004, return value from the interpreter Arg4: 494e495f, Name of the control method (in ULONG format) Debugging Details: ------------------ ACPI_OBJECT: 314c5054 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0xA5 PROCESS_NAME: System ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre LAST_CONTROL_TRANSFER: from 80a30d7b to 80ac37ec STACK_TEXT: b8583858 80a30d7b 00000003 b8583bb4 00000000 nt!RtlpBreakWithStatusInstruction b85838a4 80a319e6 00000003 8b15c888 8b113000 nt!KiBugCheckDebugBreak+0x19 b8583c84 80a31f77 000000a5 00000003 314c5054 nt!KeBugCheck2+0x574 b8583ca4 b7e3f953 000000a5 00000003 314c5054 nt!KeBugCheckEx+0x1b b8583cc0 b7e65fdd 8b1bba20 c0140004 00000000 ACPI!ACPIBuildCompleteMustSucceed+0x43 [c:\nt\base\busdrv\acpi\driver\nt\buildsrc.c @ 433] b8583cf8 b7e63e3d b7e3f910 c0140004 00000000 ACPI!AsyncCallBack+0xe5 [c:\nt\base\busdrv\acpi\driver\amlinew\sync.c @ 82] b8583d1c b7e66dbb c0140004 4556414c 8b113000 ACPI!RunContext+0x1f5 [c:\nt\base\busdrv\acpi\driver\amlinew\ctxt.c @ 649] b8583d44 b7e66ee7 8b113000 00000000 b7e85408 ACPI!InsertReadyQueue+0x15a [c:\nt\base\busdrv\acpi\driver\amlinew\sched.c @ 275] b8583d64 b7e57fdf 8b15b468 00000000 8b272020 ACPI!RestartCtxtPassive+0x54 [c:\nt\base\busdrv\acpi\driver\amlinew\sched.c @ 384] b8583dac 80bd81ac 00000000 00000000 00000000 ACPI!ACPIWorker+0xbf [c:\nt\base\busdrv\acpi\driver\nt\worker.c @ 302] b8583ddc 80ae4212 b7e57f20 00000000 00000000 nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 STACK_COMMAND: kb FOLLOWUP_IP: ACPI!ACPIBuildCompleteMustSucceed+43 [c:\nt\base\busdrv\acpi\driver\nt\buildsrc.c @ 433] b7e3f953 c7401802000000 mov dword ptr [eax+18h],2 FAULTING_SOURCE_LINE: c:\nt\base\busdrv\acpi\driver\nt\buildsrc.c FAULTING_SOURCE_FILE: c:\nt\base\busdrv\acpi\driver\nt\buildsrc.c FAULTING_SOURCE_LINE_NUMBER: 433 FAULTING_SOURCE_CODE: 429: // Note: we don't have a race condition here because only one 430: // routine can be processing a request at any given time. Thus it 431: // is safe for us to specify a new next phase 432: // > 433: buildRequest->NextWorkDone = WORK_DONE_FAILURE; 434: 435: // 436: // Transition to the next stage 437: // 438: ACPIBuildCompleteCommon( SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: ACPI!ACPIBuildCompleteMustSucceed+43 FOLLOWUP_NAME: MachineOwner MODULE_NAME: ACPI IMAGE_NAME: ACPI.sys DEBUG_FLR_IMAGE_TIMESTAMP: 626570df IMAGE_VERSION: 5.1.2600.7777 FAILURE_BUCKET_ID: 0xA5_ACPI!ACPIBuildCompleteMustSucceed+43 BUCKET_ID: 0xA5_ACPI!ACPIBuildCompleteMustSucceed+43 ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0xa5_acpi!acpibuildcompletemustsucceed+43 FAILURE_ID_HASH: {5ff4cd30-9433-c4e0-8096-0615b3b5c98a} Followup: MachineOwner ---------

I just make the test for the new acpi.sys V4 and asl.exe version 5. I change the DSDT table on the Asrock z370 gaming k6 board against its own(!) one. But on next reboot I got this Bsod which looks very similar to the famous 0x7E(c0000005, ...) error in AcpiArbCrackPRT() Dietmar