*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
0000000000000000
CURRENT_IRQL: 0
FAULTING_IP:
+67bfcd074889359
00000000`00000000 0000 add byte ptr [rax],al
PROCESS_NAME: System
ADDITIONAL_DEBUG_TEXT: The trap occurred when interrupts are disabled on the target.
BUGCHECK_STR: DISABLED_INTERRUPT_FAULT
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
DPC_STACK_BASE: FFFF8289EF83EFB0
TRAP_FRAME: ffff8289ef837750 -- (.trap 0xffff8289ef837750)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ffffffff rbx=0000000000000000 rcx=0000000000000002
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000000 rsp=ffff8289ef8378e0 rbp=ffff8289ef837a10
r8=00000000ffffffff r9=0000000000000000 r10=ffffcf8e5d7d4600
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di ng nz na pe nc
00000000`00000000 0000 add byte ptr [rax],al ds:00000000`ffffffff=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff807403efe29 to fffff807403ddf40
FAILED_INSTRUCTION_ADDRESS:
+67bfcd074889359
00000000`00000000 0000 add byte ptr [rax],al
STACK_TEXT:
ffff8289`ef837608 fffff807`403efe29 : 00000000`0000000a 00000000`00000000 00000000`000000ff 00000000`00000000 : nt!KeBugCheckEx
ffff8289`ef837610 fffff807`403ec129 : 00000002`00001000 fffff807`00000002 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffff8289`ef837750 00000000`00000000 : ffffcf8e`5d6301f8 00000000`00000000 00000000`00000002 ffff8289`ef837a10 : nt!KiPageFault+0x469
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff8074038516e-fffff80740385171 4 bytes - nt!MiFreeUltraMapping+32
[ a0 7d fb f6:20 7e fc f8 ]
fffff807403dfab8-fffff807403dfab9 2 bytes - nt!KiInterruptDispatch+b8 (+0x5a94a)
[ 48 ff:4c 8b ]
fffff807403dfabf-fffff807403dfac2 4 bytes - nt!KiInterruptDispatch+bf (+0x07)
[ 0f 1f 44 00:e8 5c 59 64 ]
10 errors : !nt (fffff8074038516e-fffff807403dfac2)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_large
FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c}
Followup: memory_corruption
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000008, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ExceptionRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ContextRecord ***
*** ***
*************************************************************************
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x1E
PROCESS_NAME: System
CURRENT_IRQL: 1
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
EXCEPTION_RECORD: ffffdd808c1b83f0 -- (.exr 0xffffdd808c1b83f0)
ExceptionAddress: 9e360001031500aa
ExceptionCode: 00000000
ExceptionFlags: 00000000
NumberParameters: 825491511
Parameter[0]: 226400729e966eb0
Parameter[1]: 1e961d780181807a
Parameter[2]: 00129e9601100023
Parameter[3]: 5db400371e96009c
Parameter[4]: 0000000000000000
Parameter[5]: 0000000000000000
Parameter[6]: 0000000000000000
Parameter[7]: ffff950f06104380
Parameter[8]: ffff950eff477d60
Parameter[9]: ffffdd808c1b8460
Parameter[10]: 000000fc00000040
Parameter[11]: ffff950eff477d60
Parameter[12]: ffff950f06069b30
Parameter[13]: ffff950f06104380
Parameter[14]: 0000000000000000
TRAP_FRAME: ffffdd808c1b8370 -- (.trap 0xffffdd808c1b8370)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=000000000000008e
rdx=0000000000000051 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000000 rsp=ffffdd808c1b8500 rbp=ffff950f059ab4d0
r8=ffff950f04f8805a r9=0000000000000002 r10=00000000ffffffff
r11=0000000000000005 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
00000000`00000000 0000 add byte ptr [rax],al ds:00000000`00000001=00
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8023582efc5 to fffff802357ddf40
STACK_TEXT:
ffffdd80`8c1b7ac8 fffff802`3582efc5 : 00000000`0000001e ffffffff`c0000005 00000000`00000000 00000000`00000008 : nt!KeBugCheckEx
ffffdd80`8c1b7ad0 fffff802`357eff6c : ffffdd80`8c1b83f0 00000000`00001000 ffffdd80`8c1b8370 ffff8000`00000000 : nt!KiDispatchException+0x1b4955
ffffdd80`8c1b8190 fffff802`357ec103 : ffff950f`05f1a010 fffff802`34708b99 ffff950f`05f1a000 ffffdd80`00000000 : nt!KiExceptionDispatch+0x12c
ffffdd80`8c1b8370 00000000`00000000 : ffff950e`f9010340 00000000`000000ff 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x443
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !FLTMGR
fffff802347048fa-fffff802347048fb 2 bytes - FLTMGR!FltpDispatch+ca
[ 48 ff:4c 8b ]
fffff80234704901-fffff80234704904 4 bytes - FLTMGR!FltpDispatch+d1 (+0x07)
[ 0f 1f 44 00:e8 ea 23 f4 ]
fffff80234705ed8-fffff80234705ed9 2 bytes - FLTMGR!FltpPerformPreCallbacksWorker+1b8 (+0x15d7)
[ 48 ff:4c 8b ]
fffff80234705edf-fffff80234705ee2 4 bytes - FLTMGR!FltpPerformPreCallbacksWorker+1bf (+0x07)
[ 0f 1f 44 00:e8 6c db f6 ]
fffff80234705ef1-fffff80234705ef2 2 bytes - FLTMGR!FltpPerformPreCallbacksWorker+1d1 (+0x12)
[ 48 ff:4c 8b ]
fffff80234705ef8-fffff80234705efb 4 bytes - FLTMGR!FltpPerformPreCallbacksWorker+1d8 (+0x07)
[ 0f 1f 44 00:e8 53 f6 f1 ]
fffff80234705efd-fffff80234705efe 2 bytes - FLTMGR!FltpPerformPreCallbacksWorker+1dd (+0x05)
[ 48 ff:4c 8b ]
fffff80234705f04-fffff80234705f07 4 bytes - FLTMGR!FltpPerformPreCallbacksWorker+1e4 (+0x07)
[ 0f 1f 44 00:e8 87 4f ff ]
fffff80234705f45-fffff80234705f46 2 bytes - FLTMGR!FltpPerformPreCallbacksWorker+225 (+0x41)
[ 48 ff:4c 8b ]
fffff80234705f4c-fffff80234705f4e 3 bytes - FLTMGR!FltpPerformPreCallbacksWorker+22c (+0x07)
[ 0f 1f 44:e8 6f bc ]
fffff80234705f50 - FLTMGR!FltpPerformPreCallbacksWorker+230 (+0x04)
[ 00:01 ]
fffff80234708bb6-fffff80234708bb7 2 bytes - FLTMGR!FltpPostFsFilterOperation+196 (+0x2c66)
[ 48 ff:4c 8b ]
fffff80234708bbd-fffff80234708bc1 5 bytes - FLTMGR!FltpPostFsFilterOperation+19d (+0x07)
[ 0f 1f 44 00 00:e8 4e 94 6b 01 ]
fffff80234708c0d-fffff80234708c0e 2 bytes - FLTMGR!FltpPostFsFilterOperation+1ed (+0x50)
[ 48 ff:4c 8b ]
fffff80234708c14-fffff80234708c17 4 bytes - FLTMGR!FltpPostFsFilterOperation+1f4 (+0x07)
[ 0f 1f 44 00:e8 57 e5 f2 ]
fffff8023473b9a4-fffff8023473b9a5 2 bytes - FLTMGR!FltpCreate+f4
[ 48 ff:4c 8b ]
fffff8023473b9ab-fffff8023473b9ae 4 bytes - FLTMGR!FltpCreate+fb (+0x07)
[ 0f 1f 44 00:e8 50 37 ee ]
fffff8023473cd05-fffff8023473cd06 2 bytes - FLTMGR!DeleteStreamListCtrlCallback+35 (+0x135a)
[ 48 ff:4c 8b ]
fffff8023473cd0c-fffff8023473cd0f 4 bytes - FLTMGR!DeleteStreamListCtrlCallback+3c (+0x07)
[ 0f 1f 44 00:e8 cf 50 fd ]
fffff8023473cd1a-fffff8023473cd1b 2 bytes - FLTMGR!DeleteStreamListCtrlCallback+4a (+0x0e)
[ 48 ff:4c 8b ]
fffff8023473cd21-fffff8023473cd24 4 bytes - FLTMGR!DeleteStreamListCtrlCallback+51 (+0x07)
[ 0f 1f 44 00:e8 fa 63 ee ]
fffff8023473cd6a-fffff8023473cd6b 2 bytes - FLTMGR!DeleteStreamListCtrlCallback+9a (+0x49)
[ 48 ff:4c 8b ]
fffff8023473cd71-fffff8023473cd74 4 bytes - FLTMGR!DeleteStreamListCtrlCallback+a1 (+0x07)
[ 0f 1f 44 00:e8 fa 5b ee ]
fffff8023473cd76-fffff8023473cd77 2 bytes - FLTMGR!DeleteStreamListCtrlCallback+a6 (+0x05)
[ 48 ff:4c 8b ]
fffff8023473cd7d-fffff8023473cd80 4 bytes - FLTMGR!DeleteStreamListCtrlCallback+ad (+0x07)
[ 0f 1f 44 00:e8 0e e1 fb ]
fffff8023474bf6f-fffff8023474bf70 2 bytes - FLTMGR!FltpWatchForRegistryChanges+6f (+0xf1f2)
[ 48 ff:4c 8b ]
fffff8023474bf76-fffff8023474bf7a 5 bytes - FLTMGR!FltpWatchForRegistryChanges+76 (+0x07)
[ 0f 1f 44 00 00:e8 f5 e6 08 01 ]
fffff8023474bf93-fffff8023474bf94 2 bytes - FLTMGR!FltpWatchForRegistryChanges+93 (+0x1d)
[ 48 ff:4c 8b ]
fffff8023474bf9a-fffff8023474bf9e 5 bytes - FLTMGR!FltpWatchForRegistryChanges+9a (+0x07)
[ 0f 1f 44 00 00:e8 91 60 67 01 ]
fffff8023474bfbf-fffff8023474bfc0 2 bytes - FLTMGR!FltpWatchForRegistryChanges+bf (+0x25)
[ 48 ff:4c 8b ]
fffff8023474bfc6-fffff8023474bfca 5 bytes - FLTMGR!FltpWatchForRegistryChanges+c6 (+0x07)
[ 0f 1f 44 00 00:e8 65 60 67 01 ]
fffff8023474bfdf-fffff8023474bfe0 2 bytes - FLTMGR!FltpWatchForRegistryChanges+df (+0x19)
[ 48 ff:4c 8b ]
fffff8023474bfe6-fffff8023474bfe9 4 bytes - FLTMGR!FltpWatchForRegistryChanges+e6 (+0x07)
[ 0f 1f 44 00:e8 35 bf ef ]
100 errors : !FLTMGR (fffff802347048fa-fffff8023474bfe9)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_large
FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c}
Followup: memory_corruption
---------