BSOD, 0x18, "Reference by Pointer"

Question

Hey guys,

Just got a BSOD, with the "reference by pointer" error 0x18:

On Thu 10/7/2010 10:52:09 PM your computer crashed

This was likely caused by the following module: ntoskrnl.exe

Bugcheck code: 0x18 (0x0, 0xFFFFFA800E510060, 0x2, 0xFFFFF88002129B00)

Error: REFERENCE_BY_POINTER

Dump file: C:\Windows\Minidump\100710-24835-01.dmp

file path: C:\Windows\system32\ntoskrnl.exe

product: Microsoft® Windows® Operating System

company: Microsoft Corporation

description: NT Kernel & System

The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.

I know my RAM is good as I ran testing for 7 passes very recently.

Windows 7 x64.  Dump is here: http://www.crookedpathfilms.com/Sharing/minidump.zip

Any help is appreciated!

Rich

Answer 1

Now, the dmp is ok. In the description of the BSOD there is a way told to debug it. I did what was written there, but the Commands doesn't show an result.

Follow the steps here:

http://support.microsoft.com/kb/929135

maybe a 3rd party tool causes it.

---

"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/

Answer 2

Okay, re-uploaded the file.  This link for the MEMORY.zip: http://www.zumodrive.com/share/7KFeODc0Nz

Answer 3

As I said...the Ram was tested and is fine. I'll look into the kernel dump and post.

Answer 4

Bug Check 0x18: REFERENCE_BY_POINTER

This indicates that the reference count of an object is illegal for the current state of the object.

http://msdn.microsoft.com/en-us/library/ff557386%28VS.85%29.aspx

Test your RAM for errors. If it's ok, configure your Windows to create a kernel dump [1] and upload the zipped dump (C:\Windows\memory.dmp).

André

[1] http://www.brighthub.com/computing/windows-platform/articles/81867.aspx

REFERENCE_BY_POINTER (18)Arguments:Arg1: 0000000000000000, Object type of the object whose reference count is being loweredArg2: fffffa800e510060, Object whose reference count is being loweredArg3: 0000000000000002, ReservedArg4: fffff88002129b00, Reserved    The reference count of an object is illegal for the current state of the object.    Each time a driver uses a pointer to an object the driver calls a kernel routine    to increment the reference count of the object. When the driver is done with the    pointer the driver calls another kernel routine to decrement the reference count.    Drivers must match calls to the increment and decrement routines. This bugcheck    can occur because an object's reference count goes to zero while there are still    open handles to the object, in which case the fourth parameter indicates the number    of opened handles. It may also occur when the object’s reference count drops below zero    whether or not there are open handles to the object, and in that case the fourth parameter    contains the actual value of the pointer references count.STACK_TEXT:  fffff88008e3a688 fffff8000324f34c : 0000000000000018 0000000000000000 fffffa800e510060 0000000000000002 : nt!KeBugCheckExfffff88008e3a690 fffff80003546c8f : fffff88008e3aca0 fffff88002129b20 fffff88002129f40 0000000000268440 : nt! ?? ::FNODOBFM::string'+0x339d1fffff88008e3a6f0 fffff800035acc36 : 0000000000253530 0000000000028400 fffff88008e3a880 0000000000000000 : nt!ExpGetProcessInformation+0x4f1fffff88008e3a840 fffff800035add0d : 0000000000253530 0000000000007ffd 0000000000000005 00000200001f12d5 : nt!ExpQuerySystemInformation+0xf14fffff88008e3abe0 fffff800032ae7d3 : fffffa800d93c060 000000007efa1000 0000000000000020 000000007efa1000 : nt!NtQuerySystemInformation+0x4dfffff88008e3ac20 0000000077b500ba : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13000000000239e708 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 00000000`00000000 : 0x77b500baFAILURE_BUCKET_ID:  X64_0x18_CORRUPT_REF_COUNT_nt!_??_::FNODOBFM::_string_+339d1BUCKET_ID:  X64_0x18_CORRUPT_REF_COUNT _nt!_??_::FNODOBFM::_string_+339d1

---

"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/