Windows Server 2022 Standard (21H2 20348.1547) Crash - HTTP.sys Bug Check in UlpGetSendCacheDataSize - HELP!

EthanFL79 20 Reputation points
2023-03-02T15:37:37.5766667+00:00

I got this crash today on my Windows Server 2022 Standard (21H2 20348.1547) machine, which ended up corrupting my MySQL database in the process because of the crash. I have only gotten this crash once and have yet to reproduce it.

I'm trying to determine if this is a hardware memory fault (either in RAM or in a page file on my SSD), or is this a bug in Microsoft's code that needs to get fixed?

Here's the MEMORY.dmp info:

-----------------------

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)

This is a very common BugCheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Arguments:

Arg1: ffffffffc0000005, The exception code that was not handled

Arg2: fffff80658c0396b, The address that the exception occurred at

Arg3: ffffa988c56ca858, Exception Record Address

Arg4: ffffa988c56ca070, Context Record Address

Debugging Details:


KEY_VALUES_STRING: 1
    Key  : AV.Dereference
    Value: NullClassPtr
    Key  : AV.Fault
    Value: Read
    Key  : Analysis.CPU.mSec
    Value: 18296
    Key  : Analysis.DebugAnalysisManager
    Value: Create
    Key  : Analysis.Elapsed.mSec
    Value: 18370
    Key  : Analysis.Init.CPU.mSec
    Value: 4875
    Key  : Analysis.Init.Elapsed.mSec
    Value: 11694
    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 120
    Key  : WER.OS.Branch
    Value: fe_release_svc_prod2
    Key  : WER.OS.Timestamp
    Value: 2022-07-07T18:32:00Z
    Key  : WER.OS.Version
    Value: 10.0.20348.859

FILE_IN_CAB:  MEMORY.DMP

DUMP_FILE_ATTRIBUTES: 0x1000

BUGCHECK_CODE:  7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff80658c0396b

BUGCHECK_P3: ffffa988c56ca858

BUGCHECK_P4: ffffa988c56ca070

EXCEPTION_RECORD:  ffffa988c56ca858 -- (.exr 0xffffa988c56ca858)
ExceptionAddress: fffff80658c0396b (HTTP!UlpGetSendCacheDataSize+0x0000000000000017)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 000000000000002b
Attempt to read from address 000000000000002b

CONTEXT:  ffffa988c56ca070 -- (.cxr 0xffffa988c56ca070)
rax=00000000762ad002 rbx=ffff930f1b01ad98 rcx=0000000000000003
rdx=00000000762ad002 rsi=ffffc8874af76010 rdi=ffffc88778ee74c0
rip=fffff80658c0396b rsp=ffffa988c56caa98 rbp=ffffa988c56cab20
 r8=0000000000000001  r9=ffffa988c2d419d0 r10=fffff8062ad69b50
r11=0000000000000000 r12=0000000000000000 r13=ffffc88778ee74a0
r14=ffffc8874af76080 r15=ffffc88742bb67c0
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
HTTP!UlpGetSendCacheDataSize+0x17:
fffff806
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1

PROCESS_NAME:  System

READ_ADDRESS:  000000000000002b 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  000000000000002b

EXCEPTION_STR:  0xc0000005

STACK_TEXT:  
ffffa988
ffffa988
ffffa988
ffffa988
ffffa988

SYMBOL_NAME:  HTTP!UlpGetSendCacheDataSize+17

MODULE_NAME: HTTP

IMAGE_NAME:  HTTP.sys

STACK_COMMAND:  .cxr 0xffffa988c56ca070 ; kb

BUCKET_ID_FUNC_OFFSET:  17

FAILURE_BUCKET_ID:  AV_HTTP!UlpGetSendCacheDataSize

OS_VERSION:  10.0.20348.859

BUILDLAB_STR:  fe_release_svc_prod2

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {640925e0-41aa-2deb-fe92-17674389e426}

Followup:     MachineOwner
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,127 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more