Share via

Frequent crash of Windows Server 2008 R2 virtual server

Ahmed Omer 0 Reputation points
2023-01-26T07:04:03.41+00:00

I have a Windows 2008 R2 Virtual Server (my exchange mail server) which seems to crash every 1-2 days.

Looking at the minidump files, it looks to be caused by ntoskrnl.exe but with a different bug each time? Below I've pasted the last four instances.

Tried the usual scans (sfc, memory diagnostics, etc.) Nothing shows up

Hope someone can help with this. Thanks

Instance 1:

Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\ahmed.omer\Desktop\012523-30888-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (16 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Edition build lab: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`01c4a000 PsLoadedModuleList = 0xfffff800`01e8e650
Debug session time: Wed Jan 25 12:34:40.827 2023 (UTC + 2:00)
System Uptime: 1 days 20:57:25.685
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`01cc6d40 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`0637e860=0000000000000019
12: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffffa800b83ce90, the pool entry being checked.
Arg3: 0000000000000000, the read back flink freelist value (should be the same as 2).
Arg4: fffffa800b83ce90, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 828

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 7867

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 218

    Key  : Analysis.Init.Elapsed.mSec
    Value: 4045

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 78

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x19

    Key  : Bugcheck.Code.Register
    Value: 0x19

    Key  : WER.OS.Branch
    Value: win7sp1_gdr

    Key  : WER.OS.Timestamp
    Value: 2011-11-18T23:30:00Z

    Key  : WER.OS.Version
    Value: 7.1.7601.17727


FILE_IN_CAB:  012523-30888-01.dmp

VIRTUAL_MACHINE:  VMware

BUGCHECK_CODE:  19

BUGCHECK_P1: 3

BUGCHECK_P2: fffffa800b83ce90

BUGCHECK_P3: 0

BUGCHECK_P4: fffffa800b83ce90

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  MSExchangeHMWo

STACK_TEXT:  
fffff880`0637e858 fffff800`01df370f     : 00000000`00000019 00000000`00000003 fffffa80`0b83ce90 00000000`00000000 : nt!KeBugCheckEx
fffff880`0637e860 fffff800`01df51a1     : 00000000`00000000 fffffa80`0b6188f0 00000000`00000000 00000000`00000070 : nt!ExDeferredFreePool+0xcbb
fffff880`0637e8f0 fffff800`01cd000c     : fffffa80`0b618920 fffffa80`073e9320 fffffa80`6e657645 00000000`00000000 : nt!ExFreePoolWithTag+0x411
fffff880`0637e9a0 fffff800`01fbcc84     : fffffa80`073e9320 00000000`00000000 fffffa80`0b056060 00000000`00000000 : nt!ObfDereferenceObject+0xdc
fffff880`0637ea00 fffff800`01fbd234     : 00000000`00002a18 fffffa80`073e9320 fffff8a0`02e75f90 00000000`00002a18 : nt!ObpCloseHandleTableEntry+0xc4
fffff880`0637ea90 fffff800`01cc5fd3     : fffffa80`0b056060 fffff880`0637eb60 00000000`00002a18 fffffa80`0b055770 : nt!ObpCloseHandle+0x94
fffff880`0637eae0 00000000`76d7140a     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0110f308 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d7140a


SYMBOL_NAME:  nt!ExDeferredFreePool+cbb

IMAGE_NAME:  Pool_Corruption

IMAGE_VERSION:  6.1.7601.17727

MODULE_NAME: Pool_Corruption

STACK_COMMAND:  .cxr; .ecxr ; kb

FAILURE_BUCKET_ID:  0x19_3_nt!ExDeferredFreePool+cbb

OS_VERSION:  7.1.7601.17727

BUILDLAB_STR:  win7sp1_gdr

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

FAILURE_ID_HASH:  {ebfd3007-6aaa-3363-cac8-a4a1b5eda7ec}

Followup:     Pool_corruption
---------

Instance 2:

Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\ahmed.omer\Desktop\012323-30123-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (16 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Edition build lab: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`01c19000 PsLoadedModuleList = 0xfffff800`01e5d650
Debug session time: Mon Jan 23 06:09:48.357 2023 (UTC + 2:00)
System Uptime: 0 days 22:16:49.697
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`01c95d40 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`084de930=000000000000000a
12: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80001c72e2e, address which referenced memory

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 765

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 10613

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 358

    Key  : Analysis.Init.Elapsed.mSec
    Value: 2682

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 80

    Key  : Bugcheck.Code.DumpHeader
    Value: 0xa

    Key  : Bugcheck.Code.Register
    Value: 0xa

    Key  : WER.OS.Branch
    Value: win7sp1_gdr

    Key  : WER.OS.Timestamp
    Value: 2011-11-18T23:30:00Z

    Key  : WER.OS.Version
    Value: 7.1.7601.17727


FILE_IN_CAB:  012323-30123-01.dmp

VIRTUAL_MACHINE:  VMware

BUGCHECK_CODE:  a

BUGCHECK_P1: 0

BUGCHECK_P2: 2

BUGCHECK_P3: 1

BUGCHECK_P4: fffff80001c72e2e

WRITE_ADDRESS: Unable to get MmSystemRangeStart
GetUlongPtrFromAddress: unable to read from fffff80001ec72e8
GetUlongPtrFromAddress: unable to read from fffff80001ec7490
 0000000000000000 

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff880084dea70 -- (.trap 0xfffff880084dea70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000009 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001c72e2e rsp=fffff880084dec00 rbp=fffffa800c5227e0
 r8=0000000000000000  r9=0000000000000000 r10=fffffa800e46c450
r11=fffffa80061c2950 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!ExDeleteResourceLite+0xce:
fffff800`01c72e2e 488908          mov     qword ptr [rax],rcx ds:00000000`00000000=????????????????
Resetting default scope

STACK_TEXT:  
fffff880`084de928 fffff800`01c952e9     : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`084de930 fffff800`01c93f60     : fffffa80`08a41010 fffff800`01ca6b9c 00000000`00000000 fffffa80`0608d188 : nt!KiBugCheckDispatch+0x69
fffff880`084dea70 fffff800`01c72e2e     : fffffa80`0608d188 00000000`00000005 00000000`00000020 fffffa80`0608d170 : nt!KiPageFault+0x260
fffff880`084dec00 fffff880`03e6f5ac     : fffffa80`0c5225d0 fffffa80`0c5227e0 00000000`00000000 fffffa80`0608d188 : nt!ExDeleteResourceLite+0xce
fffff880`084dec60 fffff880`03e6f3c3     : fffffa80`0c5225d0 fffffa80`0c5225d0 fffffa80`0608d170 00000000`00000000 : termdd!IcaDereferenceChannel+0x8c
fffff880`084deca0 fffff880`03e6ee01     : fffffa80`061eb3e0 fffffa80`0e103901 fffff8a0`09308000 fffff880`084deee0 : termdd!IcaChannelInputInternal+0x5af
fffff880`084ded80 fffff880`0793e188     : fffff8a0`03788010 fffff880`03e73d6c fffffa80`0691c010 fffffa80`08a41010 : termdd!IcaChannelInput+0xdd
fffff880`084dedc0 fffff880`0791b6f8     : 00000000`00000000 fffff800`00000001 00000000`00000000 00000000`00000000 : RDPWD!SignalBrokenConnection+0x54
fffff880`084dee20 fffff880`03e6ed8f     : fffffa80`061eb3e0 fffffa80`0691c2f0 fffffa80`0691c010 00000000`c000013c : RDPWD!WDLIB_MCSIcaChannelInput+0x90
fffff880`084dee70 fffff880`061bd6a4     : fffffa80`0691c2f0 fffffa80`0691c2f0 fffffa80`0691c010 fffffa80`0691c2f0 : termdd!IcaChannelInput+0x6b
fffff880`084deeb0 fffff880`03e72f3e     : fffffa80`0bc7db70 fffffa80`0e1039a0 fffffa80`0e46c450 fffffa80`0beac900 : tdtcp!TdInputThread+0x64c
fffff880`084df730 fffff880`03e71ae3     : fffffa80`061c4340 fffffa80`0beac900 fffffa80`05b79c10 fffffa80`0e46c450 : termdd!IcaDriverThread+0x5a
fffff880`084df760 fffff880`03e709e9     : fffffa80`0b9af6b0 fffff880`084df898 fffff880`084df8a0 00000000`00000000 : termdd!IcaDeviceControlStack+0x827
fffff880`084df840 fffff880`03e70689     : 00000000`00000000 fffffa80`0beac900 00000000`00000000 00000000`00000000 : termdd!IcaDeviceControl+0x75
fffff880`084df890 fffff800`01faf7e7     : fffffa80`0c3f35c0 fffffa80`0c3f35c0 fffff880`084dfb60 fffffa80`0c3f35c0 : termdd!IcaDispatch+0x215
fffff880`084df8d0 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607


SYMBOL_NAME:  termdd!IcaDereferenceChannel+8c

MODULE_NAME: termdd

IMAGE_NAME:  termdd.sys

IMAGE_VERSION:  6.1.7601.17514

STACK_COMMAND:  .cxr; .ecxr ; kb

FAILURE_BUCKET_ID:  0xA_termdd!IcaDereferenceChannel+8c

OS_VERSION:  7.1.7601.17727

BUILDLAB_STR:  win7sp1_gdr

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

FAILURE_ID_HASH:  {3b196f0d-a457-473d-a421-a6861914b3ad}

Followup:     MachineOwner
---------

Instance 3:

Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\ahmed.omer\Desktop\012223-29109-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (16 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Edition build lab: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`01c54000 PsLoadedModuleList = 0xfffff800`01e98650
Debug session time: Sun Jan 22 07:50:06.753 2023 (UTC + 2:00)
System Uptime: 0 days 5:29:22.242
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
.....
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`01cd0d40 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`09921690=000000000000003b
4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff80001cb0a70, Address of the instruction which caused the BugCheck
Arg3: fffff88009921f50, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 780

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 5851

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 342

    Key  : Analysis.Init.Elapsed.mSec
    Value: 2538

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 78

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x3b

    Key  : Bugcheck.Code.Register
    Value: 0x3b

    Key  : WER.OS.Branch
    Value: win7sp1_gdr

    Key  : WER.OS.Timestamp
    Value: 2011-11-18T23:30:00Z

    Key  : WER.OS.Version
    Value: 7.1.7601.17727


FILE_IN_CAB:  012223-29109-01.dmp

VIRTUAL_MACHINE:  VMware

BUGCHECK_CODE:  3b

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff80001cb0a70

BUGCHECK_P3: fffff88009921f50

BUGCHECK_P4: 0

CONTEXT:  fffff88009921f50 -- (.cxr 0xfffff88009921f50)
rax=fffff88009922968 rbx=fffffa8007296288 rcx=fffffa8007296288
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000001000
rip=fffff80001cb0a70 rsp=fffff88009922930 rbp=0000000000000001
 r8=0000000000000000  r9=0000000000000000 r10=fffffa8009468450
r11=fffffa80060d8650 r12=0000000000000000 r13=fffff88002753180
r14=0000000000000002 r15=0000000000010224
iopl=0         nv up di pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010006
nt!ExpCheckForIoPriorityBoost+0x5c:
fffff800`01cb0a70 8b8748040000    mov     eax,dword ptr [rdi+448h] ds:002b:00000000`00001448=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  svchost.exe

STACK_TEXT:  
fffff880`09922930 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExpCheckForIoPriorityBoost+0x5c


SYMBOL_NAME:  nt!ExpCheckForIoPriorityBoost+5c

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  6.1.7601.17727

STACK_COMMAND:  .cxr 0xfffff88009921f50 ; kb

FAILURE_BUCKET_ID:  0x3B_nt!ExpCheckForIoPriorityBoost+5c

OS_VERSION:  7.1.7601.17727

BUILDLAB_STR:  win7sp1_gdr

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

FAILURE_ID_HASH:  {073faf5a-952d-48cb-6bdc-11afe31c3775}

Followup:     MachineOwner
---------

Instance 4:

Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\ahmed.omer\Desktop\012223-29078-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (16 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Edition build lab: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`01c03000 PsLoadedModuleList = 0xfffff800`01e47650
Debug session time: Sun Jan 22 02:17:51.944 2023 (UTC + 2:00)
System Uptime: 0 days 20:32:38.719
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`01c7fd40 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`08be28c0=000000000000000a
8: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 000000000018001e, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80001c5fcf6, address which referenced memory

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 796

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 7677

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 311

    Key  : Analysis.Init.Elapsed.mSec
    Value: 6379

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 80

    Key  : Bugcheck.Code.DumpHeader
    Value: 0xa

    Key  : Bugcheck.Code.Register
    Value: 0xa

    Key  : WER.OS.Branch
    Value: win7sp1_gdr

    Key  : WER.OS.Timestamp
    Value: 2011-11-18T23:30:00Z

    Key  : WER.OS.Version
    Value: 7.1.7601.17727


FILE_IN_CAB:  012223-29078-01.dmp

VIRTUAL_MACHINE:  VMware

BUGCHECK_CODE:  a

BUGCHECK_P1: 18001e

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80001c5fcf6

READ_ADDRESS: Unable to get MmSystemRangeStart
GetUlongPtrFromAddress: unable to read from fffff80001eb12e8
GetUlongPtrFromAddress: unable to read from fffff80001eb1490
 000000000018001e 

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff88008be2a00 -- (.trap 0xfffff88008be2a00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=0000000000000000
rdx=00000000000007ff rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001c5fcf6 rsp=fffff88008be2b90 rbp=0000000000000000
 r8=fffffa8008bd6bb8  r9=0000000000000000 r10=fffffa800e7cd8b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!ExpWaitForResource+0x166:
fffff800`01c5fcf6 8b4708          mov     eax,dword ptr [rdi+8] ds:00000000`00000008=????????
Resetting default scope

STACK_TEXT:  
fffff880`08be28b8 fffff800`01c7f2e9     : 00000000`0000000a 00000000`0018001e 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`08be28c0 fffff800`01c7df60     : fffff880`08be2a00 00000000`00000000 00000008`00000000 fffffa80`0b476c48 : nt!KiBugCheckDispatch+0x69
fffff880`08be2a00 fffff800`01c5fcf6     : fffffa80`0b476c00 00000000`0000001b 00000000`00000000 fffff880`02922100 : nt!KiPageFault+0x260
fffff880`08be2b90 fffff800`01c84fbc     : ffffffff`fd9da600 fffffa80`0e7cd8b0 fffffa80`0b476c48 fffff880`08be2df0 : nt!ExpWaitForResource+0x166
fffff880`08be2c00 fffff800`01c88c9b     : fffff880`08be2df0 fffffa80`0ed1fce0 fffffa80`0b476c30 00000000`00000000 : nt!ExAcquireResourceExclusiveLite+0x14f
fffff880`08be2c70 fffff880`03e02f4b     : fffffa80`0ed1fce0 00000000`0000001f 00000000`00000000 fffff880`08be2d30 : nt!ExEnterCriticalRegionAndAcquireResourceExclusive+0x1b
fffff880`08be2ca0 fffff880`03e02e01     : fffffa80`0b2a5500 fffffa80`0b285a01 fffff8a0`0aa8c000 fffff880`08be2ee0 : termdd!IcaChannelInputInternal+0x137
fffff880`08be2d80 fffff880`0626e188     : fffff8a0`0ac85010 fffff880`03e07d6c fffffa80`0b2cfcb0 fffffa80`0e932c60 : termdd!IcaChannelInput+0xdd
fffff880`08be2dc0 fffff880`0624b6f8     : 00000000`00000000 fffff800`00000001 00000000`00000000 00000000`00000000 : RDPWD!SignalBrokenConnection+0x54
fffff880`08be2e20 fffff880`03e02d8f     : fffffa80`0b2a5500 fffffa80`0b2cff90 fffffa80`0b2cfcb0 00000000`c000013c : RDPWD!WDLIB_MCSIcaChannelInput+0x90
fffff880`08be2e70 fffff880`062306a4     : fffffa80`0b2cff90 fffffa80`0b2cff90 fffffa80`0b2cfcb0 fffffa80`0b2cff90 : termdd!IcaChannelInput+0x6b
fffff880`08be2eb0 fffff880`03e06f3e     : fffffa80`0dc81b70 fffffa80`0b285a20 fffffa80`0b681010 fffffa80`0856c2a0 : tdtcp!TdInputThread+0x64c
fffff880`08be3730 fffff880`03e05ae3     : fffffa80`0ea70690 fffffa80`0856c2a0 fffffa80`05b175c0 fffffa80`0b681010 : termdd!IcaDriverThread+0x5a
fffff880`08be3760 fffff880`03e049e9     : fffffa80`0e7a6930 fffff880`08be3898 fffff880`08be38a0 00000000`00000000 : termdd!IcaDeviceControlStack+0x827
fffff880`08be3840 fffff880`03e04689     : 00000000`00000000 fffffa80`0856c2a0 00000000`00000000 00000000`00000000 : termdd!IcaDeviceControl+0x75
fffff880`08be3890 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : termdd!IcaDispatch+0x215


SYMBOL_NAME:  termdd!IcaChannelInputInternal+137

MODULE_NAME: termdd

IMAGE_NAME:  termdd.sys

IMAGE_VERSION:  6.1.7601.17514

STACK_COMMAND:  .cxr; .ecxr ; kb

FAILURE_BUCKET_ID:  0xA_termdd!IcaChannelInputInternal+137

OS_VERSION:  7.1.7601.17727

BUILDLAB_STR:  win7sp1_gdr

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

FAILURE_ID_HASH:  {23313b78-5fca-2dc5-f787-f33798678202}

Followup:     MachineOwner
---------
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,564 questions
0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.