Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\011311-14695-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a01000 PsLoadedModuleList = 0xfffff800`02c3ee50
Debug session time: Thu Jan 13 09:44:48.048 2011 (UTC - 5:00)
System Uptime: 0 days 1:21:22.828
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffad10507f684, 0, fffff80002a8054f, 5}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!PoIdle+4f )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffad10507f684, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002a8054f, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ca90e0
fffffad10507f684
FAULTING_IP:
nt!PoIdle+4f
fffff800`02a8054f 41f6460402 test byte ptr [r14+4],2
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: System
CURRENT_IRQL: 0
TRAP_FRAME: fffff88002f1bb10 -- (.trap 0xfffff88002f1bb10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88002f1bd78 rbx=0000000000000000 rcx=fffff880009e6180
rdx=00000c7800000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002a8054f rsp=fffff88002f1bca0 rbp=0000000000000000
r8=fffffa8003907050 r9=0000000000000000 r10=fffff880009e6180
r11=fffffa80058d3400 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di ng nz na pe nc
nt!PoIdle+0x4f:
fffff800`02a8054f 41f6460402 test byte ptr [r14+4],2 ds:f670:00000000`00000004=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002af0b91 to fffff80002a72f00
STACK_TEXT:
fffff880`02f1b9a8 fffff800`02af0b91 : 00000000`00000050 fffffad1`0507f684 00000000`00000000 fffff880`02f1bb10 : nt!KeBugCheckEx
fffff880`02f1b9b0 fffff800`02a70fee : 00000000`00000000 fffff880`009e6180 00000000`00000000 00000000`00000002 : nt! ?? ::FNODOBFM::`string'+0x40f5b
fffff880`02f1bb10 fffff800`02a8054f : 00000000`0029d77a 00000000`00000000 fffffa80`0518f670 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`02f1bca0 fffff800`02a7b6cc : fffff880`009e6180 fffff880`00000000 00000000`00000000 fffff880`01445c50 : nt!PoIdle+0x4f
fffff880`02f1bd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x2c
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!PoIdle+4f
fffff800`02a8054f 41f6460402 test byte ptr [r14+4],2
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!PoIdle+4f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
FAILURE_BUCKET_ID: X64_0x50_nt!PoIdle+4f
BUCKET_ID: X64_0x50_nt!PoIdle+4f
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\011311-14227-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a18000 PsLoadedModuleList = 0xfffff800`02c55e50
Debug session time: Thu Jan 13 08:13:33.711 2011 (UTC - 5:00)
System Uptime: 0 days 0:51:42.490
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {ffffe2001ae05421, 2, 1, fffff80002a93b92}
Probably caused by : ntkrnlmp.exe ( nt!KiTimerWaitTest+252 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffe2001ae05421, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002a93b92, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc00e0
ffffe2001ae05421
CURRENT_IRQL: 2
FAULTING_IP:
nt!KiTimerWaitTest+252
fffff800`02a93b92 49898e88200000 mov qword ptr [r14+2088h],rcx
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff80003fb43d0 -- (.trap 0xfffff80003fb43d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8006080100
rdx=0000000000000102 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002a93b92 rsp=fffff80003fb4560 rbp=fffffa8006080128
r8=fffff80002c05001 r9=0000000000000002 r10=00000000000000dc
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KiTimerWaitTest+0x252:
fffff800`02a93b92 49898e88200000 mov qword ptr [r14+2088h],rcx ds:0001:00000000`00002088=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002a89469 to fffff80002a89f00
STACK_TEXT:
fffff800`03fb4288 fffff800`02a89469 : 00000000`0000000a ffffe200`1ae05421 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`03fb4290 fffff800`02a880e0 : 00000000`00000000 fffffa80`06080128 fffff800`02c02e80 fffff800`03fb4c58 : nt!KiBugCheckDispatch+0x69
fffff800`03fb43d0 fffff800`02a93b92 : ffffffff`fffb6c20 fffff800`02a95fa6 fffff800`0000000f fffff800`00000000 : nt!KiPageFault+0x260
fffff800`03fb4560 fffff800`02a952cd : fffffa80`06080120 fffffa80`06080168 fffffa80`06080168 00000000`00000102 : nt!KiTimerWaitTest+0x252
fffff800`03fb45e0 fffff800`02a95e7e : 00000007`393a8a64 fffff800`03fb4c58 00000000`000308dc fffff800`02c06e08 : nt!KiProcessExpiredTimerList+0x6d
fffff800`03fb4c30 fffff800`02a95697 : 00000001`fb234ac1 00000001`000308dc 00000001`fb234a36 00000000`000000dc : nt!KiTimerExpiration+0x1be
fffff800`03fb4cd0 fffff800`02a926fa : fffff800`02c02e80 fffff800`02c10c40 00000000`00000000 fffff880`03e97db0 : nt!KiRetireDpcList+0x277
fffff800`03fb4d80 00000000`00000000 : fffff800`03fb5000 fffff800`03faf000 fffff800`03fb4d40 00000000`00000000 : nt!KiIdleLoop+0x5a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiTimerWaitTest+252
fffff800`02a93b92 49898e88200000 mov qword ptr [r14+2088h],rcx
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KiTimerWaitTest+252
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
FAILURE_BUCKET_ID: X64_0xA_nt!KiTimerWaitTest+252
BUCKET_ID: X64_0xA_nt!KiTimerWaitTest+252
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\011211-14898-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a1e000 PsLoadedModuleList = 0xfffff800`02c5be50
Debug session time: Wed Jan 12 09:18:49.899 2011 (UTC - 5:00)
System Uptime: 0 days 1:16:44.678
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {ffffcaafffffffe0, 2, 1, fffff80002ad6e89}
Probably caused by : memory_corruption ( nt!MmZeroPageThread+3d4 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffcaafffffffe0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ad6e89, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc60e0
ffffcaafffffffe0
CURRENT_IRQL: 2
FAULTING_IP:
nt!MmZeroPageThread+3d4
fffff800`02ad6e89 f0410fba6d1000 lock bts dword ptr [r13+10h],0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff880009a9a80 -- (.trap 0xfffff880009a9a80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000000f8 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ad6e89 rsp=fffff880009a9c10 rbp=00000000000000ff
r8=0000000000000000 r9=0000058000000000 r10=0000000000000002
r11=fffff880009a9c08 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!MmZeroPageThread+0x3d4:
fffff800`02ad6e89 f0410fba6d1000 lock bts dword ptr [r13+10h],0 ds:1040:00000000`00000010=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002a8f469 to fffff80002a8ff00
STACK_TEXT:
fffff880`009a9938 fffff800`02a8f469 : 00000000`0000000a ffffcaaf`ffffffe0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`009a9940 fffff800`02a8e0e0 : 00000000`00000000 ffffff00`ffffffff 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`009a9a80 fffff800`02ad6e89 : 00000000`000000ff 00000000`000000c6 00000000`00000008 00000000`00000000 : nt!KiPageFault+0x260
fffff880`009a9c10 fffff800`02d33166 : fffffa80`039d1040 00000000`00000080 fffffa80`03973890 fffff800`02a6e479 : nt!MmZeroPageThread+0x3d4
fffff880`009a9d40 fffff800`02a6e486 : fffff800`02c08e80 fffffa80`039d1040 fffff800`02c16c40 43b60f44`2877894c : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a99b0 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MmZeroPageThread+3d4
fffff800`02ad6e89 f0410fba6d1000 lock bts dword ptr [r13+10h],0
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MmZeroPageThread+3d4
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xA_nt!MmZeroPageThread+3d4
BUCKET_ID: X64_0xA_nt!MmZeroPageThread+3d4
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\010911-19593-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a02000 PsLoadedModuleList = 0xfffff800`02c3fe50
Debug session time: Sun Jan 9 13:28:40.087 2011 (UTC - 5:00)
System Uptime: 0 days 0:19:42.866
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {ffffcaafffffffe0, 2, 1, fffff80002abae89}
Probably caused by : memory_corruption ( nt!MmZeroPageThread+3d4 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffcaafffffffe0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002abae89, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002caa0e0
ffffcaafffffffe0
CURRENT_IRQL: 2
FAULTING_IP:
nt!MmZeroPageThread+3d4
fffff800`02abae89 f0410fba6d1000 lock bts dword ptr [r13+10h],0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff880009a9a80 -- (.trap 0xfffff880009a9a80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000000c8 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002abae89 rsp=fffff880009a9c10 rbp=00000000000000ff
r8=0000000000000000 r9=0000058000000000 r10=0000000000000002
r11=fffff880009a9c08 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!MmZeroPageThread+0x3d4:
fffff800`02abae89 f0410fba6d1000 lock bts dword ptr [r13+10h],0 ds:1040:00000000`00000010=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002a73469 to fffff80002a73f00
STACK_TEXT:
fffff880`009a9938 fffff800`02a73469 : 00000000`0000000a ffffcaaf`ffffffe0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`009a9940 fffff800`02a720e0 : 00000000`00000000 ffffff00`ffffffff 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`009a9a80 fffff800`02abae89 : 00000000`000000ff 00000000`000000a5 00000000`00000007 00000000`00000000 : nt!KiPageFault+0x260
fffff880`009a9c10 fffff800`02d17166 : fffffa80`039d1040 00000000`00000080 fffffa80`03973890 fffff800`02a52479 : nt!MmZeroPageThread+0x3d4
fffff880`009a9d40 fffff800`02a52486 : fffff800`02bece80 fffffa80`039d1040 fffff800`02bfac40 8b4c7024`7c8b4868 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a99b0 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MmZeroPageThread+3d4
fffff800`02abae89 f0410fba6d1000 lock bts dword ptr [r13+10h],0
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MmZeroPageThread+3d4
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xA_nt!MmZeroPageThread+3d4
BUCKET_ID: X64_0xA_nt!MmZeroPageThread+3d4
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\010911-14742-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a09000 PsLoadedModuleList = 0xfffff800`02c46e50
Debug session time: Sun Jan 9 19:38:35.105 2011 (UTC - 5:00)
System Uptime: 0 days 2:02:42.619
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41201, fffff68000173b78, f5f00000a8108867, fffffa8004059310}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+13bf2 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041201, The subtype of the bugcheck.
Arg2: fffff68000173b78
Arg3: f5f00000a8108867
Arg4: fffffa8004059310
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41201
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: SC2.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002adb1ee to fffff80002a7af00
STACK_TEXT:
fffff880`03cec9b8 fffff800`02adb1ee : 00000000`0000001a 00000000`00041201 fffff680`00173b78 f5f00000`a8108867 : nt!KeBugCheckEx
fffff880`03cec9c0 fffff800`02a4940e : fffffa80`05d76e10 fffff800`02d933b7 fffffa80`04993500 f5f00000`a8108867 : nt! ?? ::FNODOBFM::`string'+0x13bf2
fffff880`03ceca00 fffff800`02a490aa : fffffa80`04059310 fffffa80`04b3f060 fffffa80`04b3f060 00000000`2e76f000 : nt!MiQueryAddressState+0x2ae
fffff880`03ceca50 fffff800`02d5f798 : fffffa80`00000004 00000000`2e770000 fffffa80`04059310 fffffa80`04993500 : nt!MiQueryAddressSpan+0xaa
fffff880`03cecac0 fffff800`02a7a153 : ffffffff`ffffffff fffffa80`04b44060 fffff880`03cecbc8 00000000`0008e298 : nt!NtQueryVirtualMemory+0x386
fffff880`03cecbb0 00000000`775a00ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008e278 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x775a00ea
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+13bf2
fffff800`02adb1ee cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+13bf2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
FAILURE_BUCKET_ID: X64_0x1a_41201_nt!_??_::FNODOBFM::_string_+13bf2
BUCKET_ID: X64_0x1a_41201_nt!_??_::FNODOBFM::_string_+13bf2
Followup: MachineOwner
---------