Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini122308-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.080814-1236
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
Debug session time: Tue Dec 23 14:00:03.625 2008 (GMT+7)
System Uptime: 0 days 0:36:41.190
Loading Kernel Symbols
...............................................................
..............................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {20, 89d4d578, 89d4e160, 897daa80}
Probably caused by : ntkrnlpa.exe ( nt!ExFreePoolWithTag+2a0 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 89d4d578, The pool entry we were looking for within the page.
Arg3: 89d4e160, The next pool entry.
Arg4: 897daa80, (reserved)
Debugging Details:
------------------
BUGCHECK_STR: 0x19_20
POOL_ADDRESS: 89d4d578
CUSTOMER_CRASH_COUNT: 4
DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 80544b06 to 804f8cc5
STACK_TEXT:
bad0bb50 80544b06 00000019 00000020 89d4d578 nt!KeBugCheckEx+0x1b
bad0bba0 80544ef7 89d4d580 00000000 bad0bbbc nt!ExFreePoolWithTag+0x2a0
bad0bbb0 804e7a8c 89d4d580 bad0bbd0 804e8636 nt!ExFreePool+0xf
bad0bbbc 804e8636 8054b780 89d4d580 e15dd948 nt!ExFreeToNPagedLookasideList+0x1e
bad0bbd0 ba6d1e04 e15dd9ec e15dd948 89dca598 nt!FsRtlUninitializeLargeMcb+0x1a
bad0bbe8 ba6cc0be bad0bc04 e15dd948 00000002 Fastfat!FatDeleteFcb_Real+0x7f
bad0bc78 ba6cb848 89dca598 e15dd948 e15dc4c0 Fastfat!FatCommonClose+0x1f5
bad0bcdc 804ee129 89dca4a0 89645cd8 89645cd8 Fastfat!FatFsdClose+0xbd
bad0bcec 80578f6a 89d4d670 00000000 00000000 nt!IopfCallDriver+0x31
bad0bd24 805b0b16 00d4d688 89d4d670 00000000 nt!IopDeleteFile+0x132
bad0bd40 80522bd1 89d4d688 00000000 00000000 nt!ObpRemoveObjectRoutine+0xe0
bad0bd64 80507e8c 805586d4 89d4d700 00000000 nt!ObfDereferenceObject+0x5f
bad0bd8c 8050963e e15dc480 00000000 89e31520 nt!MiSegmentDelete+0xdc
bad0bdac 805c61ec 00000000 00000000 00000000 nt!MiDereferenceSegmentThread+0x9e
bad0bddc 80541de2 805095a0 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExFreePoolWithTag+2a0
80544b06 8b45f8 mov eax,dword ptr [ebp-8]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExFreePoolWithTag+2a0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlpa.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48a3fbd8
FAILURE_BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2a0
BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2a0
Followup: MachineOwner
---------
kd> lmvm nt
start end module name
804d7000 806cf680 nt (pdb symbols) c:\websymbols\ntkrnlpa.pdb\FD7B256CD2D14BC0B35BA9B89F6913461\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: c:\websymbols\ntkrnlpa.exe\48A3FBD81f8680\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Thu Aug 14 16:33:12 2008 (48A3FBD8)
CheckSum: 00206065
ImageSize: 001F8680
File version: 5.1.2600.5657
Product version: 5.1.2600.5657
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5657
FileVersion: 5.1.2600.5657 (xpsp_sp3_gdr.080814-1236)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.