|
Question : BSOD on Windows 2000 server Bug Check UNEXPECTED_KERNEL_MODE_TRA<wbr />P (7f)
|
|
My Windows 2000 server is getting rebooted automatically. Here below the Windbg log. Can any one please help me to understand the real issues. I guess the culprit could be bad processor or RAM but I am not sure. Can anyone help me understand the below log please....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
TSS: 00000028 -- (.tss 28)
.tss 28
eax=e3ea45e8 ebx=00000000 ecx=6a980000 edx=6a970001 esi=8904e348 edi=8908a000
eip=80467280 esp=beef6950 ebp=bee7697c iopl=0 nv up ei pl zr ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010256
nt!ExpInterlockedPopEntrySListFault+0xa:
80467280 5b pop ebx
.trap
Resetting default scope
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
PROCESS_NAME: quenetd.exe
LAST_CONTROL_TRANSFER: from 00000000 to 80467280
STACK_TEXT:
00000000 80467280 00000000 00000000 00000000 nt!KiTrap08+0x41
bee7697c 00000000 00000001 00000005 64536553 nt!ExpInterlockedPopEntrySListFault+0xa
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiTrap08+41
8046a18f ebef jmp nt!KiTrap08+0x32 (8046a180)
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KiTrap08+41
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 45ec3c8f
FAILURE_BUCKET_ID: 0x7f_8_nt!KiTrap08+41
BUCKET_ID: 0x7f_8_nt!KiTrap08+41
Followup: MachineOwner
---------
eax=8905413c ebx=0000007f ecx=89058008 edx=00000000 esi=00000000 edi=00000000
eip=8046a18f esp=89053fe8 ebp=00000000 iopl=0 nv up di ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000086
nt!KiTrap08+0x41:
8046a18f ebef jmp nt!KiTrap08+0x32 (8046a180)
ChildEBP RetAddr Args to Child
00000000 80467280 00000000 00000000 00000000 nt!KiTrap08+0x41 (FPO: TSS 28:0)
bee7697c 00000000 00000001 00000005 64536553 nt!ExpInterlockedPopEntrySListFault+0xa (FPO: [0,0,0])
start end module name
80062000 80076f80 hal halmacpi.dll Fri Dec 03 08:59:15 2004 (41AFDD8B)
80400000 805a2940 nt ntkrnlmp.exe Mon Mar 05 21:21:43 2007 (45EC3C8F)
a0000000 a0191000 win32k win32k.sys unavailable (FFFFFFFE)
a019c000 a019e000 rp32mmth rp32mmth.dll unavailable (FFFFFFFE)
a019e000 a01b3000 VGA_a019e000 VGA.dll unavailable (FFFFFFFE)
bd78d000 bd78f3c0 NMSCFG NMSCFG.SYS Sat May 04 01:06:43 2002 (3CD2E6CB)
bdb49000 bdb4c000 lm78_32 lm78_32.sys Fri Sep 16 21:10:51 2005 (432AE783)
bdc89000 bdc9cac0 ipsec ipsec.sys Mon Apr 21 23:49:40 2003 (3EA4363C)
bdc9d000 bdcb2f20 RDPWD RDPWD.SYS Fri Jun 17 12:11:40 2005 (42B270A4)
be59b000 be5a3a60 termdd termdd.sys Sat Mar 22 03:13:08 2003 (3E7B876C)
be843000 be865ac0 Fastfat Fastfat.SYS Fri Dec 03 09:03:50 2004 (41AFDE9E)
be8f6000 be905600 Cdfs Cdfs.SYS Sat Apr 02 06:53:36 2005 (424DF418)
be9ce000 bea085a0 srv srv.sys Fri Aug 11 19:46:58 2006 (44DC915A)
beb49000 beb4ba00 lm78nt lm78nt.sys Wed Dec 05 16:48:54 2001 (3C0E029E)
bee59000 bee61240 Fips Fips.SYS Tue May 09 20:58:29 2000 (39182E9D)
befb3000 befd2140 afd afd.sys Tue Apr 12 03:01:21 2005 (425AECA9)
beffb000 bf026480 ino_fltr ino_fltr.sys Thu Apr 26 05:58:11 2007 (462FF21B)
bf083000 bf085dc0 ndisuio ndisuio.sys Thu Jan 16 01:25:21 2003 (3E25BCA9)
bf18f000 bf1f4620 mrxsmb mrxsmb.sys Wed May 31 12:44:13 2006 (447D4245)
bf207000 bf230a20 rdbss rdbss.sys Tue Jul 19 11:12:03 2005 (42DC92AB)
bf231000 bf25bd00 netbt netbt.sys Sat Apr 02 06:53:24 2005 (424DF40C)
bf25c000 bf2aa240 tcpip tcpip.sys Tue Apr 25 19:08:49 2006 (444E2669)
bf2db000 bf2df8c0 TDTCP TDTCP.SYS Sat Mar 22 03:13:08 2003 (3E7B876C)
bf2eb000 bf2f1240 AsfAlrt AsfAlrt.sys Wed Dec 18 18:01:05 2002 (3E006A89)
bfc03000 bfc2d3a0 update update.sys Wed Apr 16 09:52:01 2003 (3E9CDA69)
bfc2e000 bfc49b40 ks ks.sys Wed Apr 16 09:32:11 2003 (3E9CD5C3)
bfc84000 bfca7060 rdpdr rdpdr.sys Sat Mar 22 03:13:14 2003 (3E7B8772)
bfca8000 bfcbeba0 ndiswan ndiswan.sys Wed Apr 30 04:35:01 2003 (3EAF051D)
bfcbf000 bfcd0800 iansw2k iansw2k.sys Tue Apr 09 20:23:37 2002 (3CB30071)
bfcd1000 bfce9fc0 b57w2k b57w2k.sys Mon Feb 17 15:55:43 2003 (3E50B8A7)
bfcea000 bfd6f700 ati2mtag ati2mtag.sys Thu Dec 19 09:13:58 2002 (3E01407E)
bfd78000 bfd7b4a0 kbdhid kbdhid.sys Tue Oct 05 04:34:19 1999 (37F93273)
bfd80000 bfd82c60 mouhid mouhid.sys Thu Jan 16 01:13:39 2003 (3E25B9EB)
bfd88000 bfd8b540 hidusb hidusb.sys Tue Oct 05 04:33:30 1999 (37F93242)
bfdb0000 bfdb2b60 headlessbus headlessbus.sys Thu Jun 28 00:39:29 2001 (3B3A2F69)
bfdb8000 bfdbb6c0 dump_diskdump dump_diskdump.sys Wed Feb 26 00:48:04 2003 (3E5BC16C)
bfdcc000 bfdcfe60 TDI TDI.SYS Thu Jan 16 01:26:26 2003 (3E25BCEA)
bfdd8000 bfdda2e0 ndistapi ndistapi.sys Thu Jan 16 01:24:15 2003 (3E25BC67)
bfde8000 bfdeb640 serenum serenum.sys Thu Jan 16 01:17:01 2003 (3E25BAB5)
bfdf4000 bfdf6220 usbkbex5 usbkbex5.sys Tue Nov 20 00:38:02 2001 (3BF95892)
bfdf8000 bfdfb580 vga vga.sys Sun Sep 26 00:07:40 1999 (37ED1674)
bfe58000 bfe6dbe0 Mup Mup.sys Fri Dec 03 09:07:23 2004 (41AFDF73)
bfe6e000 bfe97aa0 NDIS NDIS.sys Wed Apr 30 04:35:01 2003 (3EAF051D)
bfe98000 bff15480 Ntfs Ntfs.sys Tue May 10 14:50:29 2005 (42807CDD)
bff16000 bff277c0 KSecDD KSecDD.sys Sun Sep 21 06:02:19 2003 (3F6CF193)
bff28000 bff3a1c0 Dfs Dfs.sys Wed Feb 12 07:49:06 2003 (3E49AF1A)
bff3b000 bff4d500 drvmcdb drvmcdb.sys Sat Dec 22 12:03:52 2001 (3C242950)
bff4e000 bff6f5a0 fltmgr fltmgr.sys Thu Apr 14 12:29:00 2005 (425E14B4)
bff70000 bff82180 SCSIPORT SCSIPORT.SYS Thu Dec 30 11:23:36 2004 (41D397E0)
bff83000 bff98180 atapi atapi.sys Tue Apr 01 23:38:25 2003 (3E89D599)
bff99000 bffba9c0 dmio dmio.sys Thu Jan 16 01:17:04 2003 (3E25BAB8)
bffbb000 bffd75a0 ftdisk ftdisk.sys Fri Dec 03 08:59:58 2004 (41AFDDB6)
bffd8000 bffffc20 ACPI ACPI.sys Thu Jan 16 01:14:22 2003 (3E25BA16)
f6000000 f600e6a0 pci pci.sys Thu Jan 16 01:14:07 2003 (3E25BA07)
f6010000 f601b680 isapnp isapnp.sys Thu Jan 16 01:13:47 2003 (3E25B9F3)
f6020000 f60290a0 symmpi symmpi.sys Tue Nov 12 04:02:18 2002 (3DD02FF2)
f6030000 f6038700 CLASSPNP CLASSPNP.SYS Thu Jan 16 01:12:51 2003 (3E25B9BB)
f6040000 f604b480 vsp vsp.sys Wed Nov 09 00:15:43 2005 (4370F257)
f6090000 f609c4c0 VIDEOPRT VIDEOPRT.SYS Thu Jan 16 01:17:20 2003 (3E25BAC8)
f60a0000 f60ab680 i8042prt i8042prt.sys Wed Apr 16 09:30:59 2003 (3E9CD57B)
f60b0000 f60bf400 serial serial.sys Wed Apr 16 09:49:39 2003 (3E9CD9DB)
f60c0000 f60cca80 rasl2tp rasl2tp.sys Wed Apr 30 04:35:06 2003 (3EAF0522)
f60d0000 f60dbc40 raspptp raspptp.sys Thu May 15 05:17:00 2003 (3EC2D574)
f6110000 f6119be0 usbhub usbhub.sys Wed Mar 19 05:00:41 2003 (3E77AC21)
f6130000 f6139ce0 NDProxy NDProxy.SYS Fri Oct 01 04:55:35 1999 (37F3F16F)
f6140000 f6148fa0 Npfs Npfs.SYS Sun Oct 10 05:28:07 1999 (37FFD68F)
f6150000 f6158680 msgpc msgpc.sys Thu Jan 16 01:24:25 2003 (3E25BC71)
f6160000 f61681a0 netbios netbios.sys Wed Oct 13 01:04:19 1999 (38038D3B)
f61a0000 f61a90a0 dump_symmpi dump_symmpi.sys Tue Nov 12 04:02:18 2002 (3DD02FF2)
f6280000 f6285520 PCIIDEX PCIIDEX.SYS Wed Feb 26 00:01:08 2003 (3E5BB66C)
f6288000 f628f5a0 MountMgr MountMgr.sys Fri Dec 03 09:03:01 2004 (41AFDE6D)
f6290000 f6297720 disk disk.sys Thu Jan 16 01:13:05 2003 (3E25B9C9)
f6298000 f629d100 ino_flpy ino_flpy.sys Fri Dec 22 22:52:05 2006 (458C143D)
f62b0000 f62b5fa0 HIDCLASS HIDCLASS.SYS Thu Jan 16 01:15:26 2003 (3E25BA56)
f62c0000 f62c6200 i2cnt i2cnt.sys Wed Dec 05 16:59:21 2001 (3C0E0511)
f62c8000 f62cdec0 kbdclass kbdclass.sys Thu Feb 20 22:07:30 2003 (3E55044A)
f62d0000 f62d5900 HIDPARSE HIDPARSE.SYS Tue Apr 08 23:04:46 2003 (3E930836)
f62d8000 f62dd400 mouclass mouclass.sys Thu Feb 20 22:07:45 2003 (3E550459)
Page b0a2 not present in the dump file. Type ".hh dbgerr004" for details
f62e8000 f62ef000 fdc fdc.sys unavailable (FFFFFFFE)
f6300000 f6306c40 cdrom cdrom.sys Thu Jan 16 01:13:04 2003 (3E25B9C8)
f6308000 f630d240 Msfs Msfs.SYS Wed Oct 27 04:51:32 1999 (3816377C)
f6310000 f6315fc0 openhci openhci.sys Sat Mar 01 05:58:59 2003 (3E5FFECB)
f6328000 f632cfc0 USBD USBD.SYS Wed Jan 22 22:35:33 2003 (3E2ECF5D)
f6338000 f633fd00 wanarp wanarp.sys Fri Aug 16 17:55:01 2002 (3D5CEF1D)
f6340000 f63442a0 halfinch halfinch.sys Thu Oct 18 20:56:40 2001 (3BCEF4B0)
f6348000 f6350000 TWGGrab TWGGrab.SYS Sat Dec 01 10:57:26 2001 (3C086A3E)
f6360000 f6364400 ptilink ptilink.sys Thu Jan 16 01:17:15 2003 (3E25BAC3)
f6370000 f63740e0 raspti raspti.sys Sat Oct 09 02:15:10 1999 (37FE57D6)
f6378000 f637e000 TWGSYSIN TWGSYSIN.SYS Sat Dec 01 10:34:34 2001 (3C0864E2)
f6388000 f638ca60 flpydisk flpydisk.sys Thu Jan 16 01:12:52 2003 (3E25B9BC)
f6398000 f639ea20 EFS EFS.SYS Thu Jan 16 01:16:55 2003 (3E25BAAF)
f6410000 f6412a20 BOOTVID BOOTVID.dll Thu Nov 04 06:54:33 1999 (3820E051)
f6414000 f6416d00 PartMgr PartMgr.sys Thu Jan 16 01:13:07 2003 (3E25B9CB)
f6500000 f6501d20 Diskperf Diskperf.sys Thu Feb 13 03:04:38 2003 (3E4ABDEE)
f6502000 f6503b80 dmload dmload.sys Thu Jan 16 01:17:06 2003 (3E25BABA)
f6506000 f6507fc0 usbmoux5 usbmoux5.sys Tue Nov 20 00:38:05 2001 (3BF95895)
f6514000 f6515ca0 Fs_Rec Fs_Rec.SYS Thu Jan 16 01:23:30 2003 (3E25BC3A)
f651c000 f651de40 rasacd rasacd.sys Sun Sep 26 00:11:23 1999 (37ED1753)
f6520000 f6521ae0 Rp32Spin Rp32Spin.sys Wed Nov 06 15:29:27 2002 (3DC8E7FF)
f6552000 f6553400 pmemnt pmemnt.sys Wed Dec 05 16:40:57 2001 (3C0E00C1)
f6576000 f6577660 Rp32Wire Rp32Wire.sys Wed Nov 06 15:29:28 2002 (3DC8E800)
f65c8000 f65c8f80 WMILIB WMILIB.SYS Sun Sep 26 00:06:47 1999 (37ED163F)
f65c9000 f65c9b00 pciide pciide.sys Thu Jan 16 01:13:03 2003 (3E25B9C7)
f65f3000 f65f3a40 audstub audstub.sys Sun Sep 26 00:05:33 1999 (37ED15F5)
f65fd000 f65fdd80 swenum swenum.sys Sun Sep 26 00:06:31 1999 (37ED162F)
f6610000 f66109e0 Null Null.SYS Sun Sep 26 00:04:58 1999 (37ED15D2)
f6612000 f6612ee0 Beep Beep.SYS Thu Oct 21 03:48:59 1999 (380E3FD3)
f6615000 f6615f80 mnmdd mnmdd.SYS Sun Sep 26 00:07:40 1999 (37ED1674)
Unloaded modules:
f6580000 f6582000 pmemnt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f6368000 f636f000 Parport.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f6170000 f6179000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f62f0000 f62f5000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
bfd70000 bfd73000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt
|
|
|
Answer : BSOD on Windows 2000 server Bug Check UNEXPECTED_KERNEL_MODE_TRA<wbr />P (7f)
|
|
Here is the memory dump debug
: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
TSS: 00000028 -- (.tss 0x28)
eax=e3ea45e8 ebx=00000000 ecx=6a980000 edx=6a970001 esi=8904e348 edi=8908a000
eip=80467280 esp=beef6950 ebp=bee7697c iopl=0 nv up ei pl zr ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010256
nt!ExpInterlockedPopEntrySListFault+0xa:
80467280 5b pop ebx
Resetting default scope
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
PROCESS_NAME: quenetd.exe
LAST_CONTROL_TRANSFER: from 00000000 to 80467280
STACK_TEXT:
00000000 80467280 00000000 00000000 00000000 nt!KiTrap08+0x41
bee7697c 00000000 00000001 00000005 64536553 nt!ExpInterlockedPopEntrySListFault+0xa
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiTrap08+41
8046a18f ebef jmp nt!KiTrap08+0x32 (8046a180)
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KiTrap08+41
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 45ec3c8f
FAILURE_BUCKET_ID: 0x7f_8_nt!KiTrap08+41
BUCKET_ID: 0x7f_8_nt!KiTrap08+41
Followup: MachineOwner
---------
3: kd> !thread
THREAD 88943b80 Cid 380.3e4 Teb: 7ffd8000 Win32Thread: 00000000 RUNNING
Not impersonating
Owning Process 8895f020
Wait Start TickCount 4229109 Elapsed Ticks: 0
Context Switch Count 15697
UserTime 0:00:00.0118
KernelTime 0:00:00.0221
Start Address 0x7c57b740
Win32 Start Address 0x780083d2
Stack Init bee77000 Current bee76ca0 Base bee77000 Limit bee74000 Call 0
Priority 14 BasePriority 13 PriorityDecrement 0 DecrementCount 0
ChildEBP RetAddr Args to Child
00000000 80467280 00000000 00000000 00000000 nt!KiTrap08+0x41
bee7697c 00000000 00000001 00000005 64536553 nt!ExpInterlockedPopEntrySListFault+0xa
3: kd> kb 100
ChildEBP RetAddr Args to Child
00000000 80467280 00000000 00000000 00000000 nt!KiTrap08+0x41
bee7697c 00000000 00000001 00000005 64536553 nt!ExpInterlockedPopEntrySListFault+0xa
3: kd> !thread
THREAD 88943b80 Cid 380.3e4 Teb: 7ffd8000 Win32Thread: 00000000 RUNNING
Not impersonating
Owning Process 8895f020
Wait Start TickCount 4229109 Elapsed Ticks: 0
Context Switch Count 15697
UserTime 0:00:00.0118
KernelTime 0:00:00.0221
Start Address 0x7c57b740
Win32 Start Address 0x780083d2
Stack Init bee77000 Current bee76ca0 Base bee77000 Limit bee74000 Call 0
Priority 14 BasePriority 13 PriorityDecrement 0 DecrementCount 0
ChildEBP RetAddr Args to Child
00000000 80467280 00000000 00000000 00000000 nt!KiTrap08+0x41
bee7697c 00000000 00000001 00000005 64536553 nt!ExpInterlockedPopEntrySListFault+0xa
3: kd> r
eax=8905413c ebx=0000007f ecx=89058008 edx=00000000 esi=00000000 edi=00000000
eip=8046a18f esp=89053fe8 ebp=00000000 iopl=0 nv up di ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000086
nt!KiTrap08+0x41:
8046a18f ebef jmp nt!KiTrap08+0x32 (8046a180)
3: kd> u
nt!KiTrap08+0x41:
8046a18f ebef jmp nt!KiTrap08+0x32 (8046a180)
8046a191 8d4900 lea ecx,[ecx]
nt!Dr_kit9_a:
8046a194 f7457000000200 test dword ptr [ebp+70h],20000h
8046a19b 750d jne nt!Dr_kit9_a+0x16 (8046a1aa)
8046a19d f7456c01000000 test dword ptr [ebp+6Ch],1
8046a1a4 0f84e3000000 je nt!KiTrap09+0x51 (8046a28d)
8046a1aa 0f21c3 mov ebx,dr0
8046a1ad 0f21c9 mov ecx,dr1
3: kd> !cpuinfo
CP F/M/S Manufacturer MHz Update Signature Features
0 15,2,7 GenuineIntel 3059 0000000000000000 00002fff
1 15,2,9 GenuineIntel 3059 0000000000000000 00002fff
2 15,2,7 GenuineIntel 3059 0000000000000000 00002fff
3 15,2,9 GenuineIntel 3059>0000000000000000<00002fff
3: kd> ln 89053fe8
3: kd> dd 89053fe8
89053fe8 0000007f 00000008 00000000 00000000
89053ff8 00000000 00000000 bee76cb4 bee76df0
89054008 bee74000 00000000 00000000 00000000
89054018 7ffd8000 89054000 89054120 00000000
89054028 00000000 00000000 ffffffff 00000000
89054038 890587e8 89058008 89064488 00010001
89054048 00000008 00000bf4 00000300 00000000
89054058 00000000 00000000 00000000 00000000
3: kd> .tss 28
eax=e3ea45e8 ebx=00000000 ecx=6a980000 edx=6a970001 esi=8904e348 edi=8908a000
eip=80467280 esp=beef6950 ebp=bee7697c iopl=0 nv up ei pl zr ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010256
nt!ExpInterlockedPopEntrySListFault+0xa:
80467280 5b pop ebx
3: kd> .formats esp ^ ebp
Evaluate expression:
Hex: 0008002c
Decimal: 524332
Octal: 00002000054
Binary: 00000000 00001000 00000000 00101100
Chars: ...,
Time: Wed Jan 07 01:38:52 1970
Float: low 7.34746e-040 high 0
Double: 2.59054e-318
3: kd> dd beef6950
beef6950 ???????? ???????? ???????? ????????
beef6960 ???????? ???????? ???????? ????????
beef6970 ???????? ???????? ???????? ????????
beef6980 ???????? ???????? ???????? ????????
beef6990 ???????? ???????? ???????? ????????
beef69a0 ???????? ???????? ???????? ????????
beef69b0 ???????? ???????? ???????? ????????
beef69c0 ???????? ???????? ???????? ????????
3: kd> r
Last set context:
eax=e3ea45e8 ebx=00000000 ecx=6a980000 edx=6a970001 esi=8904e348 edi=8908a000
eip=80467280 esp=beef6950 ebp=bee7697c iopl=0 nv up ei pl zr ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010256
nt!ExpInterlockedPopEntrySListFault+0xa:
80467280 5b pop ebx
3: kd> dd beef6950
beef6950 ???????? ???????? ???????? ????????
beef6960 ???????? ???????? ???????? ????????
beef6970 ???????? ???????? ???????? ????????
beef6980 ???????? ???????? ???????? ????????
beef6990 ???????? ???????? ???????? ????????
beef69a0 ???????? ???????? ???????? ????????
beef69b0 ???????? ???????? ???????? ????????
beef69c0 ???????? ???????? ???????? ????????
\\ End of memory debug\\
----------------------
Recommendation:
-----------------------
More details refer to this MSKB : http://support.microsoft.com/default.aspx?scid=kb;EN-US;842465
The crash has occured due a single bit error this has caused by the CPU on the box. I do understand this will be difficlut to digest since this machine will be performing fine before and all of a sudden the culprit appears to be CPU on the box. I hop this analysis will help.
Cheers,
Nikhil
|
|
|
|
|
