Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [E:\Temp\Rar$DI00.809\110110-26395-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0205a000 PsLoadedModuleList = 0xfffff800`02297e50
Debug session time: Mon Nov 1 19:21:11.312 2010 (UTC - 4:00)
System Uptime: 0 days 0:35:57.187
Loading Kernel Symbols
...............................................................
.....................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800668b218, fffff8800668aa80, fffff800020d45c6}
Probably caused by : Ntfs.sys ( Ntfs!NtfsFlushUserStream+16f )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800668b218
Arg3: fffff8800668aa80
Arg4: fffff800020d45c6
Debugging Details:
------------------
OVERLAPPED_MODULE: Address regions for 'hidusb' and 'USBD.SYS' overlap
EXCEPTION_RECORD: fffff8800668b218 -- (.exr 0xfffff8800668b218)
ExceptionAddress: fffff800020d45c6 (nt!ExpReleaseResourceForThreadLite+0x0000000000000046)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8800668aa80 -- (.cxr 0xfffff8800668aa80)
rax=fffffa8007632b70 rbx=fffdfa8007525690 rcx=fffdfa8007525690
rdx=fffffa80076bf060 rsi=0000000000000000 rdi=fffff8a003acc6e0
rip=fffff800020d45c6 rsp=fffff8800668b450 rbp=fffffa80076bf060
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=fffffa8007632b70 r12=fffff88001e5d180 r13=fffffa80076bf060
r14=0000000000000700 r15=0000000000000000
iopl=0 nv up di pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010046
nt!ExpReleaseResourceForThreadLite+0x46:
fffff800`020d45c6 f0480fba696000 lock bts qword ptr [rcx+60h],0 ds:002b:fffdfa80`075256f0=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: DiskDefrag.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800023020e0
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsFlushUserStream+16f
fffff880`012e471f eb99 jmp Ntfs!NtfsFlushUserStream+0x10a (fffff880`012e46ba)
FAULTING_IP:
nt!ExpReleaseResourceForThreadLite+46
fffff800`020d45c6 f0480fba696000 lock bts qword ptr [rcx+60h],0
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff880012e471f to fffff800020d45c6
STACK_TEXT:
fffff880`0668b450 fffff880`012e471f : fffff8a0`03acc6e0 00000000`00000000 00000000`00000000 00000000`00000001 : nt!ExpReleaseResourceForThreadLite+0x46
fffff880`0668b4b0 fffff880`012939e7 : 00000000`00000000 fffff8a0`03acc6e0 00000000`00000000 00000000`00000001 : Ntfs!NtfsFlushUserStream+0x16f
fffff880`0668b530 fffff880`01235b7c : fffffa80`07632a20 fffffa80`07aa1180 00000000`00000001 00000000`00005000 : Ntfs!NtfsFlushVolume+0x2c7
fffff880`0668b660 fffff880`01229bed : fffffa80`07632a20 fffff880`0108fd01 fffffa80`0919a980 fffff880`0668b700 : Ntfs!NtfsVolumeDasdIo+0x1dc
fffff880`0668b710 fffff880`0122af78 : fffffa80`07632a20 fffffa80`07642010 fffff880`0668b801 fffffa80`07650100 : Ntfs!NtfsCommonRead+0x1e61
fffff880`0668b8b0 fffff880`0108323f : fffffa80`076423f8 fffffa80`07642010 fffffa80`07650160 00000000`00000000 : Ntfs!NtfsFsdRead+0x1b8
fffff880`0668b960 fffff880`010816df : fffffa80`098d22c0 00000000`00000001 fffffa80`098d2200 fffffa80`07642010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0668b9f0 fffff800`023e0ca9 : 00000000`00000000 fffffa80`07659d20 00000000`00000001 fffffa80`07642010 : fltmgr!FltpDispatch+0xcf
fffff880`0668ba50 fffff800`023e84a3 : fffffa80`07659d20 fffffa80`07659d20 fffffa80`07659d20 fffff880`01e5d180 : nt!IopSynchronousServiceTail+0xf9
fffff880`0668bac0 fffff800`020c9993 : 00000000`000005e0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x631
fffff880`0668bbb0 00000000`74432dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0289f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74432dd9
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: Ntfs!NtfsFlushUserStream+16f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff8800668aa80 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsFlushUserStream+16f
BUCKET_ID: X64_0x24_Ntfs!NtfsFlushUserStream+16f
Followup: MachineOwner
---------