Windows Server 2012 R2 Blue Screen

Question

Hi all,

Please help to find the root cause of blue screen, 

here is the error code.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: ffffe0007002de50, The pool entry we were looking for within the page.
Arg3: ffffe0007002dec0, The next pool entry.
Arg4: 0000000004070006, (reserved)

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 2202

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 3850

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 1031

    Key  : Analysis.Init.Elapsed.mSec
    Value: 10699

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 89

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x19

    Key  : Bugcheck.Code.KiBugCheckData
    Value: 0x19

    Key  : Bugcheck.Code.Register
    Value: 0x19

    Key  : WER.OS.Branch
    Value: winblue_ltsb_escrow

    Key  : WER.OS.Timestamp
    Value: 2023-01-09T17:17:00Z

    Key  : WER.OS.Version
    Value: 8.1.9600.20815


FILE_IN_CAB:  MEMORY.DMP

BUGCHECK_CODE:  19

BUGCHECK_P1: 20

BUGCHECK_P2: ffffe0007002de50

BUGCHECK_P3: ffffe0007002dec0

BUGCHECK_P4: 4070006

POOL_ADDRESS:  ffffe0007002de50 Nonpaged pool

PROCESS_NAME:  System

STACK_TEXT:  
ffffd001`b7bf50f8 fffff801`24313bb3     : 00000000`00000019 00000000`00000020 ffffe000`7002de50 ffffe000`7002dec0 : nt!KeBugCheckEx
ffffd001`b7bf5100 fffff801`5a5cd8dc     : 00000000`00000000 00000000`00000086 ffffd001`00000000 ffffe000`00000007 : nt!ExFreePoolWithTag+0xbb3
ffffd001`b7bf51a0 fffff801`5a5ca874     : ffffe000`701fa6b0 ffffe000`6c00ce50 ffffd001`b7bf5202 ffffe000`6c00ce50 : CysecaFlt+0x58dc
ffffd001`b7bf51d0 fffff801`5a59c0e8     : fffff801`5a59c07c 00000000`00000000 ffffe000`67c9ac70 ffffe000`67c9ac70 : CysecaFlt+0x2874
ffffd001`b7bf5390 fffff801`240b2e7f     : fffff801`240d1200 fffff801`5a59c07c ffffe000`694ce408 00000000`00000000 : fltmgr!FltpProcessGenericWorkItem+0x6c
ffffd001`b7bf5410 fffff801`24156ed2     : ffffe000`72968030 ffffd001`ad7d1180 00000000`00000080 ffffe000`67020040 : nt!ExpWorkerThread+0x69f
ffffd001`b7bf54c0 fffff801`241ce2e6     : ffffd001`ad7d1180 ffffe000`72dd9880 ffffd001`ad7e1880 00000000`0057dc63 : nt!PspSystemThreadStartup+0x18a
ffffd001`b7bf5520 00000000`00000000     : ffffd001`b7bf6000 ffffd001`b7bef000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_NAME:  CysecaFlt+58dc

MODULE_NAME: CysecaFlt

IMAGE_NAME:  CysecaFlt.sys

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  58dc

FAILURE_BUCKET_ID:  0x19_20_CysecaFlt!unknown_function

OS_VERSION:  8.1.9600.20815

BUILDLAB_STR:  winblue_ltsb_escrow

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 8.1

FAILURE_ID_HASH:  {47a9ca47-358e-774f-92d2-a7d2d2395208}

Followup:     MachineOwner
---------

Answer 1

Do you still need help?

If you need help please run the DM log collector and post a share link into this thread using one drive, drop box, or google drive.

If the server is able to run the V2 log collector it will collect more useful logs for troubleshooting.

https://www.tenforums.com/bsod-crashes-debugging/2198-bsod-posting-instructions.html

https://www.elevenforum.com/t/bsod-posting-instructions.103/