VM restarted. The bugcheck was: 0x0000007f (0x0000000000000008,...) A dump was saved in: C:\Windows\MEMORY.DMP.

Question

Microsoft (R) Windows Debugger Version 10.0.16299.15 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 8.1 Kernel Version 9600 MP (4 procs) Free x64
Product: Server, suite: TerminalServer SingleUserTS
Built by: 9600.19538.amd64fre.winblue_ltsb_escrow.191014-1700
Machine Name:
Kernel base = 0xfffff80098409000 PsLoadedModuleList = 0xfffff800986ce5d0
Debug session time: Sun Dec 27 12:29:42.361 2020 (UTC + 2:00)
System Uptime: 8 days 15:28:49.819
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols

Loading unloaded module list
.....

---

• *
• Bugcheck Analysis *
• *

  ---

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, ffffd00129d511f0, ffffd00021c47ff0, fffff801de626efc}

*** ERROR: Module load completed but symbols could not be loaded for klif.sys
Probably caused by : dedup.sys

Followup: MachineOwner

---

3: kd> !analyze -v

---

• *
• Bugcheck Analysis *
• *

  ---

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a portion of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffffd00129d511f0
Arg3: ffffd00021c47ff0
Arg4: fffff801de626efc

Debugging Details:

---

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 9600.19538.amd64fre.winblue_ltsb_escrow.191014-1700

SYSTEM_MANUFACTURER: Microsoft Corporation

VIRTUAL_MACHINE: HyperV

SYSTEM_PRODUCT_NAME: Virtual Machine

SYSTEM_SKU: None

SYSTEM_VERSION: Hyper-V UEFI Release v1.0

BIOS_VENDOR: Microsoft Corporation

BIOS_VERSION: Hyper-V UEFI Release v1.0

BIOS_DATE: 11/26/2012

BASEBOARD_MANUFACTURER: Microsoft Corporation

BASEBOARD_PRODUCT: Virtual Machine

BASEBOARD_VERSION: Hyper-V UEFI Release v1.0

DUMP_TYPE: 1

BUGCHECK_P1: 8

BUGCHECK_P2: ffffd00129d511f0

BUGCHECK_P3: ffffd00021c47ff0

BUGCHECK_P4: fffff801de626efc

BUGCHECK_STR: 0x7f_8

TRAP_FRAME: ffffd00129d511f0 -- (.trap 0xffffd00129d511f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd00021c480f0 rbx=0000000000000000 rcx=ffffd00021c485f0
rdx=ffffe0014c9e6bc0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff801de626efc rsp=ffffd00021c47ff0 rbp=0000000000001000
r8=000000000000048d r9=ffffd00021c480f8 r10=ffffe0017819c010
r11=0000000100000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
Ntfs!NtfsLookupAllocation+0x58:
fffff801de626efc e8df530000 call Ntfs!NtfsLookupRealAllocation (fffff801de62c2e0)
Resetting default scope

CPU_COUNT: 4

CPU_MHZ: a8c

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 2d

CPU_STEPPING: 7

CPU_MICROCODE: 6,2d,7,0 (F,M,S,R) SIG: FFFFFFFF'00000000 (cache) FFFFFFFF'00000000 (init)

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: ICTCTR02-PC

ANALYSIS_SESSION_TIME: 12-29-2020 15:08:51.0160

ANALYSIS_VERSION: 10.0.16299.15 amd64fre

STACK_OVERFLOW: Stack Limit: ffffd00021c48000. Use (kF) and (!stackusage) to investigate stack usage.

STACKUSAGE_IMAGE: The module at base 0xFFFFF801DF092000 was blamed for the stack overflow. It is using 3120 bytes of stack.

STACK_COMMAND: .trap 0xffffd00129d511f0 ; kb

THREAD_SHA1_HASH_MOD_FUNC: aaf0ca245995e08e1c0b69775fc5c73bc9d3012e

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 223155ddf9d683a19b7788d4c5ee374888ccd144

THREAD_SHA1_HASH_MOD: 68f4be81c17faac3037d06648286d04f1c48538d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: dedup

IMAGE_NAME: dedup.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5c12e14d

FAILURE_BUCKET_ID: 0x7f_8_STACK_USAGE_IMAGE_dedup.sys

BUCKET_ID: 0x7f_8_STACK_USAGE_IMAGE_dedup.sys

PRIMARY_PROBLEM_CLASS: 0x7f_8_STACK_USAGE_IMAGE_dedup.sys

TARGET_TIME: 2020-12-27T10:29:42.000Z

OSBUILD: 9600

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 3

OSPLATFORM_TYPE: x64

OSNAME: Windows 8.1

OSEDITION: Windows 8.1 Server TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2019-10-15 04:04:17

BUILDDATESTAMP_STR: 191014-1700

BUILDLAB_STR: winblue_ltsb_escrow

BUILDOSVER_STR: 6.3.9600.19538.amd64fre.winblue_ltsb_escrow.191014-1700

ANALYSIS_SESSION_ELAPSED_TIME: 63c

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x7f_8_stack_usage_image_dedup.sys

FAILURE_ID_HASH: {0f4f791d-54fa-e39c-02dc-301d1bb852c9}

Followup: MachineOwner

---

3: kd> kF
*** Stack trace for last set context - .thread/.cxr resets it

Memory Child-SP RetAddr Call Site

00 ffffd00021c47ff0 fffff801de621a2f Ntfs!NtfsLookupAllocation+0x58
01 b0 ffffd00021c480a0 fffff801de621756 Ntfs!NtfsPrepareSimpleBuffers+0x16f
02 b0 ffffd00021c48150 fffff801de620845 Ntfs!NtfsPrepareBuffers+0xb6
03 70 ffffd00021c481c0 fffff801de6202a4 Ntfs!NtfsNonCachedIo+0x325
04 280 ffffd00021c48440 fffff801de626bde Ntfs!NtfsCommonRead+0x16a9
05 180 ffffd00021c485c0 fffff801de4db0da Ntfs!NtfsFsdRead+0x1ee
06 260 ffffd00021c48820 fffff801de4d90c2 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x25a
07 a0 ffffd00021c488c0 fffff80098446a10 fltmgr!FltpDispatch+0xb2
08 60 ffffd00021c48920 fffff80098446772 nt!IoPageRead+0x234
09 50 ffffd00021c48970 fffff800985da013 nt!MiIssueHardFaultIO+0xda
0a 40 ffffd00021c489b0 fffff80098454492 nt!MiIssueHardFault+0x1ab
0b 80 ffffd00021c48a30 fffff800984e60b7 nt!MmAccessFault+0x6f2
0c 100 ffffd00021c48b30 fffff80098449328 nt!MmCheckCachedPageStates+0x727
0d 1b0 ffffd00021c48ce0 fffff800987c0b5d nt!CcMapAndRead+0xcc
0e 60 ffffd00021c48d40 fffff801de6d8474 nt!CcMapData+0x91
0f 70 ffffd00021c48db0 fffff801de6d87f4 Ntfs!NtfsReadMftRecord+0xe4
10 110 ffffd00021c48ec0 fffff801de6b8e88 Ntfs!NtfsReadFileRecord+0x74
11 f0 ffffd00021c48fb0 fffff801de6d834e Ntfs!NtfsLookupExternalAttribute+0x194
12 d0 ffffd00021c49080 fffff801de62c655 Ntfs!NtfsLookupInFileRecord+0x27e
13 90 ffffd00021c49110 fffff801de626f01 Ntfs!NtfsLookupRealAllocation+0x375
14 180 ffffd00021c49290 fffff801de621a2f Ntfs!NtfsLookupAllocation+0x5d
15 b0 ffffd00021c49340 fffff801de621756 Ntfs!NtfsPrepareSimpleBuffers+0x16f
16 b0 ffffd00021c493f0 fffff801de620845 Ntfs!NtfsPrepareBuffers+0xb6
17 70 ffffd00021c49460 fffff801de6202a4 Ntfs!NtfsNonCachedIo+0x325
18 280 ffffd00021c496e0 fffff801de626bde Ntfs!NtfsCommonRead+0x16a9
19 180 ffffd00021c49860 fffff801de4db0da Ntfs!NtfsFsdRead+0x1ee
1a 260 ffffd00021c49ac0 fffff801de4de388 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x25a
1b a0 ffffd00021c49b60 fffff801de4ed5ad fltmgr!FltPerformSynchronousIo+0x2b8
1c b0 ffffd00021c49c10 fffff801de4ed151 fltmgr!FltReadFileEx+0x451
1d f0 ffffd00021c49d00 fffff801df0bddf4 fltmgr!FltReadFile+0x51
1e 70 ffffd00021c49d70 fffff801df0bdba3 dedup!DdpChunkContainerPoolBufferReadSync+0x1bc
1f d0 ffffd00021c49e40 fffff801df0bbbea dedup!DdpChunkContainerReadBlock+0x143
20 a0 ffffd00021c49ee0 fffff801df0bb3ae dedup!DdpChunkContainerReadGenericChunk+0x58a
21 c0 ffffd00021c49fa0 fffff801df0b7a67 dedup!DdpChunkContainerReadChunk+0x21a
22 b0 ffffd00021c4a050 fffff801df0b81bf dedup!DdpChunkStoreReadChunkSync+0x20b
23 170 ffffd00021c4a1c0 fffff801df0b8a36 dedup!DdpChunkStoreCreateChunkHeaderInfo+0xf7
24 90 ffffd00021c4a250 fffff801df0b6ec0 dedup!DdpChunkStoreGetChunkHeaderInfo+0x112
25 a0 ffffd00021c4a2f0 fffff801df0b4dc9 dedup!DdpChunkStoreReadChunks+0x21c
26 100 ffffd00021c4a3f0 fffff801df0b025c dedup!DdpStreamStoreReadChunks+0x195
27 140 ffffd00021c4a530 fffff801df0acfa6 dedup!DdpTLCacheRead+0xa3c
28 2e0 ffffd00021c4a810 fffff801df0ad194 dedup!DdpReadCleanDedupFile+0x3be
29 80 ffffd00021c4a890 fffff801df0ae981 dedup!DdpPatchCleanRanges+0x170
2a b0 ffffd00021c4a940 fffff801de4dbab7 dedup!DdpPostRead+0xf9
2b 60 ffffd00021c4a9a0 fffff801de4dc41d fltmgr!FltpPerformPostCallbacks+0x2d7
2c d0 ffffd00021c4aa70 fffff801de4db20b fltmgr!FltpPassThroughCompletionWorker+0x7d
2d 70 ffffd00021c4aae0 fffff801de4d90c2 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x38b
2e a0 ffffd00021c4ab80 fffff80098446a10 fltmgr!FltpDispatch+0xb2
2f 60 ffffd00021c4abe0 fffff80098446772 nt!IoPageRead+0x234
30 50 ffffd00021c4ac30 fffff800985da013 nt!MiIssueHardFaultIO+0xda
31 40 ffffd00021c4ac70 fffff80098454492 nt!MiIssueHardFault+0x1ab
32 80 ffffd00021c4acf0 fffff800984e60b7 nt!MmAccessFault+0x6f2
33 100 ffffd00021c4adf0 fffff80098449328 nt!MmCheckCachedPageStates+0x727
34 1b0 ffffd00021c4afa0 fffff800987c0b5d nt!CcMapAndRead+0xcc
35 60 ffffd00021c4b000 fffff801de6b9168 nt!CcMapData+0x91
36 70 ffffd00021c4b070 fffff801de613d51 Ntfs!NtfsMapStream+0x60
37 40 ffffd00021c4b0b0 fffff801de6210b6 Ntfs!NtfsLockFileRange+0xa9
38 a0 ffffd00021c4b150 fffff801de622c44 Ntfs!NtfsNonCachedIo+0xb93
39 280 ffffd00021c4b3d0 fffff801de626077 Ntfs!NtfsCommonWrite+0xd54
3a 240 ffffd00021c4b610 fffff801de4db0da Ntfs!NtfsFsdWrite+0x203
3b 2d0 ffffd00021c4b8e0 fffff801de4d90c2 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x25a
3c a0 ffffd00021c4b980 fffff8009842e568 fltmgr!FltpDispatch+0xb2
3d 60 ffffd00021c4b9e0 fffff8009842e1de nt!IoSynchronousPageWrite+0x138
3e 40 ffffd00021c4ba20 fffff800984f32c5 nt!MiIssueSynchronousFlush+0x66
3f 70 ffffd00021c4ba90 fffff80098487ab2 nt!MiFlushSectionInternal+0x7cd
40 210 ffffd00021c4bca0 fffff8009848b06b nt!MmFlushSection+0x1a2
41 c0 ffffd00021c4bd60 fffff800984da1f5 nt!CcFlushCachePriv+0x493
42 110 ffffd00021c4be70 fffff801de6b7c68 nt!CcFlushCache+0x11
43 40 ffffd00021c4beb0 fffff801de6b761c Ntfs!NtfsFlushUserStream+0xac
44 80 ffffd00021c4bf30 fffff801de6b7b91 Ntfs!NtfsCommonFlushBuffers+0x4c8
45 100 ffffd00021c4c030 fffff800984599a9 Ntfs!NtfsCommonFlushBuffersCallout+0x19
46 30 ffffd00021c4c060 fffff801de6b7122 nt!KeExpandKernelStackAndCalloutInternal+0x2d9
47 e0 ffffd00021c4c140 fffff801de6b7061 Ntfs!NtfsCommonFlushBuffersOnNewStack+0x52
48 70 ffffd00021c4c1b0 fffff801de4db0da Ntfs!NtfsFsdFlushBuffers+0xb9
49 70 ffffd00021c4c220 fffff801de4de388 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x25a
4a a0 ffffd00021c4c2c0 fffff801df0f1953 fltmgr!FltPerformSynchronousIo+0x2b8
4b b0 ffffd00021c4c370 fffff801df0f0fbb dedup!DdpFlushBuffersSync+0x16b
4c 70 ffffd00021c4c3e0 fffff801df0d365d dedup!DdpCommitRecallBitmapIntoReparsePointEx+0x2bf
4d a0 ffffd00021c4c480 fffff801df0d3901 dedup!DdpProcessPreCleanup+0x2b5
4e 90 ffffd00021c4c510 fffff801de4da0ba dedup!DdpPreCleanup+0xa9
4f 40 ffffd00021c4c550 fffff801de4dad0c fltmgr!FltpPerformPreCallbacks+0x31a
50 110 ffffd00021c4c660 fffff801de4d9934 fltmgr!FltpPassThroughInternal+0x8c
51 30 ffffd00021c4c690 fffff801de4d90aa fltmgr!FltpPassThrough+0x2b5
52 b0 ffffd00021c4c740 fffff800987eba35 fltmgr!FltpDispatch+0x9a
53 60 ffffd00021c4c7a0 fffff800987ee4f3 nt!IopCloseFile+0x12d
54 90 ffffd00021c4c830 fffff800985593e3 nt!NtClose+0x1c3
55 120 ffffd00021c4c950 fffff8009854d480 nt!KiSystemServiceCopyEnd+0x13
56 198 ffffd00021c4cae8 fffff801df128f4c nt!KiServiceLinkage
57 8 ffffd00021c4caf0 fffff801df112dfb klif+0x1ff4c
58 110 ffffd00021c4cc00 fffff801de4e13e3 klif+0x9dfb
59 a90 ffffd00021c4d690 fffff801de506098 fltmgr!FltpFilterMessage+0xb3
5a 50 ffffd00021c4d6e0 fffff801de505f03 fltmgr!FltpMsgDeviceControl+0x128
5b 60 ffffd00021c4d740 fffff801de4d90d5 fltmgr!FltpMsgDispatch+0x9b
5c 70 ffffd00021c4d7b0 fffff8009888e00f fltmgr!FltpDispatch+0xc5
5d 60 ffffd00021c4d810 fffff8009888ef78 nt!IopSynchronousServiceTail+0x32b
5e d0 ffffd00021c4d8e0 fffff80098860276 nt!IopXxxControlFile+0xdb8
5f 140 ffffd00021c4da20 fffff800985593e3 nt!NtDeviceIoControlFile+0x56
60 70 ffffd00021c4da90 00000000779b2352 nt!KiSystemServiceCopyEnd+0x13
61 000000000e2defa8 0000000000000000 0x779b2352

Answer 1

Hi,
It looks like it will be associated with Data Deduplication. Did you Configure Data Deduplication on your machine？
Have you found some error in event log?

Did the problem occur after backup?
Best Regards,
Carl