Frequent crash of Windows Server R2 due to ntoskrnl.exe

Ahmed Omer 0

We have a frequent crash on our Windows Server 2008 R2 (our exchange server) due to ntoskrnl.exe with different error strings (BAD POOL HEADER, IRQL_NOT_LESS_OR_EQUAL, SYSTEM_SERVICE_EXCEPTION).

Tried the usual scans/checks (sfc, memory checks, etc.) and nothing shows up

Can paste dump file analyses if helps.

Thanks

Thameur-BOURBITA 32,506 Reputation points

2023-01-26T11:51:17.7433333+00:00

Hi

Yes dump file can give more details about the problem.

Ahmed Omer 0

Sure, below are the last four instances

First:

Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\ahmed.omer\Desktop\Exchange Errors\New folder\012623-30466-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (16 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Edition build lab: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`01c4e000 PsLoadedModuleList = 0xfffff800`01e92650
Debug session time: Thu Jan 26 16:14:28.655 2023 (UTC + 2:00)
System Uptime: 0 days 5:51:55.030
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
....
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`01ccad40 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`0a4dd7f0=0000000000000050
10: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffffffffff80001, memory referenced.
Arg2: 0000000000000001, X64: bit 0 set if the fault was due to a not-present PTE.
	bit 1 is set if the fault was due to a write, clear if a read.
	bit 3 is set if the processor decided the fault was due to a corrupted PTE.
	bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
	- ARM64: bit 1 is set if the fault was due to a write, clear if a read.
	bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: fffffa8008a7ff98, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : AV.Type
    Value: Write

    Key  : Analysis.CPU.mSec
    Value: 796

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 7042

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 281

    Key  : Analysis.Init.Elapsed.mSec
    Value: 2291

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 80

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x50

    Key  : Bugcheck.Code.Register
    Value: 0x50

    Key  : WER.OS.Branch
    Value: win7sp1_gdr

    Key  : WER.OS.Timestamp
    Value: 2011-11-18T23:30:00Z

    Key  : WER.OS.Version
    Value: 7.1.7601.17727


FILE_IN_CAB:  012623-30466-01.dmp

VIRTUAL_MACHINE:  VMware

BUGCHECK_CODE:  50

BUGCHECK_P1: fffffffffff80001

BUGCHECK_P2: 1

BUGCHECK_P3: fffffa8008a7ff98

BUGCHECK_P4: 0

WRITE_ADDRESS: Unable to get MmSystemRangeStart
GetUlongPtrFromAddress: unable to read from fffff80001efc2e8
GetUlongPtrFromAddress: unable to read from fffff80001efc490
 fffffffffff80001 

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff8800a4dd950 -- (.trap 0xfffff8800a4dd950)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8008a7fef0 rbx=0000000000000000 rcx=fffffa8008a7fef0
rdx=fffff8800a4ddc40 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa8008a7ff98 rsp=fffff8800a4ddae8 rbp=fffffa8008a7fea0
 r8=0000000000000020  r9=fffff8800a4ddb48 r10=fffffa8006ee2450
r11=fffffa800bb0a060 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
fffffa80`08a7ff98 c895db06        enter   0DB95h,6
Resetting default scope

STACK_TEXT:  
fffff880`0a4dd7e8 fffff800`01c7725c     : 00000000`00000050 ffffffff`fff80001 00000000`00000001 fffff880`0a4dd950 : nt!KeBugCheckEx
fffff880`0a4dd7f0 fffff800`01cc8e6e     : 00000000`00000001 ffffffff`fff80001 00000000`00000000 fffffa80`06b2d5d0 : nt! ?? ::FNODOBFM::`string'+0x456cf
fffff880`0a4dd950 fffffa80`08a7ff98     : fffff880`03fe9f93 fffffa80`06b2d5d0 00000000`0000001f 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0a4ddae8 fffff880`03fe9f93     : fffffa80`06b2d5d0 00000000`0000001f 00000000`00000000 00000000`00000000 : 0xfffffa80`08a7ff98
fffff880`0a4ddaf0 fffff880`03fe9e01     : fffffa80`0e272360 00000000`00000000 00000000`00000000 fffffa80`0bb794a0 : termdd!IcaChannelInputInternal+0x17f
fffff880`0a4ddbd0 fffff880`082d7188     : fffff8a0`0c233010 fffffa80`0bb794a0 00000000`00000025 fffff880`05a0fa4d : termdd!IcaChannelInput+0xdd
fffff880`0a4ddc10 fffff880`082d7ff4     : 00000001`0000000b fffffa80`0bb794a5 00000006`00000015 fffff880`05a0f079 : RDPWD!SignalBrokenConnection+0x54
fffff880`0a4ddc70 fffff880`03fed1f8     : fffff8a0`0c193000 fffffa80`0e272360 fffffa80`06fa5b10 fffff880`05a0de00 : RDPWD!MCSIcaRawInputWorker+0x454
fffff880`0a4ddd10 fffff880`05a0d8d0     : 00000000`00000000 fffff880`0a4dde30 fffff880`0a4dde28 fffff880`0219fb8a : termdd!IcaRawInput+0x50
fffff880`0a4ddd40 fffff880`05a0cd85     : fffffa80`0dd7d820 fffffa80`0bb0a168 00000000`00000000 00000000`00000000 : tssecsrv!CRawInputDM::PassDataToServer+0x2c
fffff880`0a4ddd70 fffff880`05a0c7c2     : fffffa80`0dc0bfa8 fffffa80`00000000 00000000`0000000b fffff800`00000000 : tssecsrv!CFilter::FilterIncomingData+0xc9
fffff880`0a4dde10 fffff880`03fed1f8     : fffff800`01e3fe80 fffffa80`0dc0bcb0 00000000`00000000 00000000`00000000 : tssecsrv!ScrRawInput+0x82
fffff880`0a4dde80 fffff880`05a024bd     : fffffa80`0dc0bf90 fffffa80`0bb79268 00000000`00000000 fffffa80`0dc0bf90 : termdd!IcaRawInput+0x50
fffff880`0a4ddeb0 fffff880`03fedf3e     : fffffa80`0bb79230 fffffa80`0e283a60 fffffa80`06ee2450 fffffa80`064cd3c0 : tdtcp!TdInputThread+0x465
fffff880`0a4de730 fffff880`03fecae3     : fffffa80`0df7f310 fffffa80`064cd3c0 fffffa80`05b7d7e0 fffffa80`06ee2450 : termdd!IcaDriverThread+0x5a
fffff880`0a4de760 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : termdd!IcaDeviceControlStack+0x827


SYMBOL_NAME:  termdd!IcaChannelInputInternal+17f

MODULE_NAME: termdd

IMAGE_NAME:  termdd.sys

IMAGE_VERSION:  6.1.7601.17514

STACK_COMMAND:  .cxr; .ecxr ; kb

FAILURE_BUCKET_ID:  0x50_W_(null)_termdd!IcaChannelInputInternal+17f

OS_VERSION:  7.1.7601.17727

BUILDLAB_STR:  win7sp1_gdr

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

FAILURE_ID_HASH:  {c3279df0-96bd-67bb-307b-94ca2f743a62}

Followup:     MachineOwner
---------

Second:

Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\ahmed.omer\Desktop\Exchange Errors\New folder\012623-30607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (16 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Edition build lab: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`01c06000 PsLoadedModuleList = 0xfffff800`01e4a650
Debug session time: Thu Jan 26 10:18:21.412 2023 (UTC + 2:00)
System Uptime: 0 days 21:41:31.961
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
..........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`01c82d40 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`08822700=000000000000003b
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff80001c62abb, Address of the instruction which caused the BugCheck
Arg3: fffff88008822fc0, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 843

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 18714

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 312

    Key  : Analysis.Init.Elapsed.mSec
    Value: 7165

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 78

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x3b

    Key  : Bugcheck.Code.Register
    Value: 0x3b

    Key  : WER.OS.Branch
    Value: win7sp1_gdr

    Key  : WER.OS.Timestamp
    Value: 2011-11-18T23:30:00Z

    Key  : WER.OS.Version
    Value: 7.1.7601.17727


FILE_IN_CAB:  012623-30607-01.dmp

VIRTUAL_MACHINE:  VMware

BUGCHECK_CODE:  3b

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff80001c62abb

BUGCHECK_P3: fffff88008822fc0

BUGCHECK_P4: 0

CONTEXT:  fffff88008822fc0 -- (.cxr 0xfffff88008822fc0)
rax=fffff880088239d8 rbx=fffffa800b94f268 rcx=fffffa800b94f268
rdx=0000000000000002 rsi=00000308000000a6 rdi=0000000000000000
rip=fffff80001c62abb rsp=fffff880088239a0 rbp=0000000000000001
 r8=0000000000000000  r9=fffff88000800160 r10=fffff88000800008
r11=0000000000000000 r12=0000000000000000 r13=fffff80001df7e80
r14=0000000000000002 r15=0000000000010224
iopl=0         nv up di pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010006
nt!ExpCheckForIoPriorityBoost+0xa7:
fffff800`01c62abb 448b6608        mov     r12d,dword ptr [rsi+8] ds:002b:00000308`000000ae=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  svchost.exe

STACK_TEXT:  
fffff880`088239a0 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExpCheckForIoPriorityBoost+0xa7


SYMBOL_NAME:  nt!ExpCheckForIoPriorityBoost+a7

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  6.1.7601.17727

STACK_COMMAND:  .cxr 0xfffff88008822fc0 ; kb

FAILURE_BUCKET_ID:  0x3B_nt!ExpCheckForIoPriorityBoost+a7

OS_VERSION:  7.1.7601.17727

BUILDLAB_STR:  win7sp1_gdr

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

FAILURE_ID_HASH:  {cec5177e-77fe-0607-24a0-e4f7adc2a8ae}

Followup:     MachineOwner
---------

Third:

Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\ahmed.omer\Desktop\Exchange Errors\New folder\012623-31122-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (16 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Edition build lab: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`01c59000 PsLoadedModuleList = 0xfffff800`01e9d650
Debug session time: Thu Jan 26 18:27:18.494 2023 (UTC + 2:00)
System Uptime: 0 days 2:09:38.660
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`01cd5d40 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`07dcf7e0=000000000000003b
8: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff88003e1e006, Address of the instruction which caused the BugCheck
Arg3: fffff88007dd00a0, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 827

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 7193

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 343

    Key  : Analysis.Init.Elapsed.mSec
    Value: 2038

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 80

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x3b

    Key  : Bugcheck.Code.Register
    Value: 0x3b

    Key  : WER.OS.Branch
    Value: win7sp1_gdr

    Key  : WER.OS.Timestamp
    Value: 2011-11-18T23:30:00Z

    Key  : WER.OS.Version
    Value: 7.1.7601.17727


FILE_IN_CAB:  012623-31122-01.dmp

VIRTUAL_MACHINE:  VMware

BUGCHECK_CODE:  3b

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff88003e1e006

BUGCHECK_P3: fffff88007dd00a0

BUGCHECK_P4: 0

CONTEXT:  fffff88007dd00a0 -- (.cxr 0xfffff88007dd00a0)
rax=0000000000000002 rbx=fffffa800eb8d190 rcx=0301a8c00601a8c0
rdx=0000000000000000 rsi=0000000000000000 rdi=fffffa800eb921f0
rip=fffff88003e1e006 rsp=fffff88007dd0a80 rbp=fffffa8006058830
 r8=0000000000000000  r9=0000000000000000 r10=fffffa800eb921f0
r11=fffffa8006058958 r12=0000000000000020 r13=fffff88007dd0bd0
r14=0000000000000005 r15=0000000000000000
iopl=0         nv up ei pl nz ac pe cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010213
termdd!IcaChannelInputInternal+0x1f2:
fffff880`03e1e006 488b01          mov     rax,qword ptr [rcx] ds:002b:0301a8c0`0601a8c0=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  svchost.exe

STACK_TEXT:  
fffff880`07dd0a80 fffff880`03e1de01     : fffffa80`0bbbb570 fffff880`03e21100 00000000`00000000 fffffa80`098b5de0 : termdd!IcaChannelInputInternal+0x1f2
fffff880`07dd0b60 fffff880`066991ee     : fffff8a0`04b82010 fffff8a0`04b82010 ffff0000`00000008 fffff8a0`04b821e8 : termdd!IcaChannelInput+0xdd
fffff880`07dd0ba0 fffff880`0669838c     : 00000000`00000000 fffffa80`0b5e5bb8 00000000`00000001 fffffa80`098b5de0 : RDPWD!HandleDisconnectProviderUlt+0xe2
fffff880`07dd0c30 fffff880`06697f74     : 00000000`00000009 fffffa80`098b5de5 00000006`00000017 fffff880`0678f079 : RDPWD!RecognizeMCSFrame+0x50
fffff880`07dd0c70 fffff880`03e211f8     : fffff8a0`0a987000 fffffa80`0bbbb570 fffffa80`0b53f4f0 fffff880`0678de00 : RDPWD!MCSIcaRawInputWorker+0x3d4
fffff880`07dd0d10 fffff880`0678d8d0     : 00000000`00000000 fffff880`07dd0e30 fffff880`07dd0e28 fffff880`01e71b8a : termdd!IcaRawInput+0x50
fffff880`07dd0d40 fffff880`0678cd85     : fffffa80`0bc2fc30 fffffa80`0bce6768 00000000`00000000 00000000`00000000 : tssecsrv!CRawInputDM::PassDataToServer+0x2c
fffff880`07dd0d70 fffff880`0678c7c2     : fffffa80`0ec46fa8 fffffa80`00000000 00000000`00000009 fffff800`00000000 : tssecsrv!CFilter::FilterIncomingData+0xc9
fffff880`07dd0e10 fffff880`03e211f8     : fffff880`02922180 fffffa80`0ec46cb0 00000000`00000000 00000000`00000000 : tssecsrv!ScrRawInput+0x82
fffff880`07dd0e80 fffff880`067824bd     : fffffa80`0ec46f90 fffffa80`098b5ba8 00000000`00000000 fffffa80`0ec46f90 : termdd!IcaRawInput+0x50
fffff880`07dd0eb0 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tdtcp!TdInputThread+0x465


SYMBOL_NAME:  termdd!IcaChannelInputInternal+1f2

MODULE_NAME: termdd

IMAGE_NAME:  termdd.sys

IMAGE_VERSION:  6.1.7601.17514

STACK_COMMAND:  .cxr 0xfffff88007dd00a0 ; kb

FAILURE_BUCKET_ID:  0x3B_termdd!IcaChannelInputInternal+1f2

OS_VERSION:  7.1.7601.17727

BUILDLAB_STR:  win7sp1_gdr

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

FAILURE_ID_HASH:  {9350313b-1cc4-5d38-d237-82d94c760c66}

Followup:     MachineOwner
---------

Fourth:

Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\ahmed.omer\Desktop\Exchange Errors\New folder\012723-44725-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (16 procs) Free x64
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Edition build lab: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`01c66000 PsLoadedModuleList = 0xfffff800`01eaa650
Debug session time: Fri Jan 27 05:06:41.195 2023 (UTC + 2:00)
System Uptime: 0 days 10:36:25.297
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`01ce2d40 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`0910d6c0=000000000000000a
8: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000004b1856b, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80001c92766, address which referenced memory

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 858

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 9539

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 311

    Key  : Analysis.Init.Elapsed.mSec
    Value: 1883

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 81

    Key  : Bugcheck.Code.DumpHeader
    Value: 0xa

    Key  : Bugcheck.Code.Register
    Value: 0xa

    Key  : WER.OS.Branch
    Value: win7sp1_gdr

    Key  : WER.OS.Timestamp
    Value: 2011-11-18T23:30:00Z

    Key  : WER.OS.Version
    Value: 7.1.7601.17727


FILE_IN_CAB:  012723-44725-01.dmp

VIRTUAL_MACHINE:  VMware

BUGCHECK_CODE:  a

BUGCHECK_P1: 4b1856b

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff80001c92766

READ_ADDRESS: Unable to get MmSystemRangeStart
GetUlongPtrFromAddress: unable to read from fffff80001f142e8
GetUlongPtrFromAddress: unable to read from fffff80001f14490
 0000000004b1856b 

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff8800910d800 -- (.trap 0xfffff8800910d800)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000bfb7ec0 rbx=0000000000000000 rcx=0000000004b184f0
rdx=000000000000000e rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001c92766 rsp=fffff8800910d990 rbp=0000000000000000
 r8=00000000ffffff02  r9=0000000000000000 r10=fffffa800c26e860
r11=00000000fffffffe r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!KeSetPriorityBoost+0x22:
fffff800`01c92766 0fbe497b        movsx   ecx,byte ptr [rcx+7Bh] ds:00000000`04b1856b=??
Resetting default scope

STACK_TEXT:  
fffff880`0910d6b8 fffff800`01ce22e9     : 00000000`0000000a 00000000`04b1856b 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0910d6c0 fffff800`01ce0f60     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`04b184f0 : nt!KiBugCheckDispatch+0x69
fffff880`0910d800 fffff800`01c92766     : 00000000`02092890 00000000`00000000 00000000`00000000 fffffa80`0e9c4060 : nt!KiPageFault+0x260
fffff880`0910d990 fffff800`01cc2d2b     : 00000000`00000000 fffffa80`0bfb7eb8 00000000`00000000 fffff880`02922100 : nt!KeSetPriorityBoost+0x22
fffff880`0910d9e0 fffff800`01ce7fbc     : ffffffff`fd9da600 fffffa80`0c26e860 fffffa80`0bfb7eb8 fffff880`0910dc40 : nt!ExpWaitForResource+0x19b
fffff880`0910da50 fffff800`01cebc9b     : fffff880`0910dc40 fffffa80`0b1c62c0 fffffa80`0bfb7ea0 00000000`00012553 : nt!ExAcquireResourceExclusiveLite+0x14f
fffff880`0910dac0 fffff880`03e6ef4b     : fffffa80`0b1c62c0 00000000`0000001f 00000000`00000000 00000000`00000000 : nt!ExEnterCriticalRegionAndAcquireResourceExclusive+0x1b
fffff880`0910daf0 fffff880`03e6ee01     : fffffa80`0e43aa90 00000000`00000000 00000000`00000000 fffffa80`0e6fb660 : termdd!IcaChannelInputInternal+0x137
fffff880`0910dbd0 fffff880`07b06188     : fffff8a0`02f051d0 fffff8a0`02f057f8 00000000`00000025 fffff880`065c9a4d : termdd!IcaChannelInput+0xdd
fffff880`0910dc10 fffff880`07b06ff4     : 00000001`0000000b fffffa80`0e6fb665 00000006`00000015 fffff880`065c9079 : RDPWD!SignalBrokenConnection+0x54
fffff880`0910dc70 fffff880`03e721f8     : fffff8a0`0137b000 fffffa80`0e43aa90 fffffa80`0afd5690 fffff880`065c7e00 : RDPWD!MCSIcaRawInputWorker+0x454
fffff880`0910dd10 fffff880`065c78d0     : 00000000`00000000 fffff880`0910de30 fffff880`0910de28 fffff880`03831b8a : termdd!IcaRawInput+0x50
fffff880`0910dd40 fffff880`065c6d85     : fffffa80`0b304120 fffffa80`0e9c4168 00000000`00000000 00000000`00000000 : tssecsrv!CRawInputDM::PassDataToServer+0x2c
fffff880`0910dd70 fffff880`065c67c2     : fffffa80`0e15eb68 fffffa80`00000000 00000000`0000000b fffff800`00000000 : tssecsrv!CFilter::FilterIncomingData+0xc9
fffff880`0910de10 fffff880`03e721f8     : fffff880`02922180 fffffa80`0e15e870 00000000`00000000 00000000`00000000 : tssecsrv!ScrRawInput+0x82
fffff880`0910de80 fffff880`065bc4bd     : fffffa80`0e15eb50 fffffa80`0e6fb428 00000000`00000000 fffffa80`0e15eb50 : termdd!IcaRawInput+0x50
fffff880`0910deb0 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tdtcp!TdInputThread+0x465


SYMBOL_NAME:  termdd!IcaChannelInputInternal+137

MODULE_NAME: termdd

IMAGE_NAME:  termdd.sys

IMAGE_VERSION:  6.1.7601.17514

STACK_COMMAND:  .cxr; .ecxr ; kb

FAILURE_BUCKET_ID:  0xA_termdd!IcaChannelInputInternal+137

OS_VERSION:  7.1.7601.17727

BUILDLAB_STR:  win7sp1_gdr

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

FAILURE_ID_HASH:  {23313b78-5fca-2dc5-f787-f33798678202}

Followup:     MachineOwner
---------

2 answers

Limitless Technology 43,931 Reputation points

2023-02-01T10:46:22.0066667+00:00

Hello there,

Ntoskrnl.exe (Short for Windows NT operating system kernel,) also known as kernel image, provides the kernel and executive layers of the Windows NT kernel space, and is responsible for various system services such as hardware virtualization, process and memory management, thus making it a fundamental part of the system. It contains the cache manager, the executive, the kernel, the security reference monitor, the memory manager, and the scheduler.

If you've experienced this error, it might also be related to a driver related issues. We suggest updating all the drivers on your device. You can also run the troubleshooter for blue screen errors.

https://support.microsoft.com/en-us/sbs/windows/troubleshoot-blue-screen-errors-5c62726c-6489-52da-a372-3f73142c14ad

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Limitless Technology 43,931 Reputation points

2023-02-01T10:46:31.45+00:00

Double post
Please sign in to rate this answer.

0 comments No comments
Sign in to comment