Blue Screens: multiple stop codes.

Question

Original Title: Win 7 64 great amount of BSOD's (ntoskrnl.exe)

Hi

I'm running win7 64 bit on a ASUS p5b-vm MB, Intel Q6600 and 4GB of ram.

It seems like surpassing a certain treshold of memory usage causes my

windows to give me a BSOD.  I parsed out the specifics from my last BSOD

using Blue Screen View (they all seem alike):

Dump File Crash Time Bug Check String Bug Check Code Parameter 1 Parameter 2 Parameter 3 Parameter 4 Caused By Driver Caused By Address File Description Product Name Company File Version Processor Crash Address Stack Address 1 Stack Address 2 Stack Address 3 Computer Name Full Path Processors Count Major Version Minor Version Dump File Size 053111-14539-01.dmp 31-5-2011 19:51:41 SYSTEM_SERVICE_EXCEPTION 0x0000003b 00000000c0000046 fffff80002c9f0b4 fffff88005e6fe50 0000000000000000 ntoskrnl.exe ntoskrnl.exe+70700 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7600.16792 (win7_gdr.110408-1633) x64 ntoskrnl.exe+70700         C:\Windows\Minidump\053111-14539-01.dmp 4 15 7600 275.592

Answer 1

Hello MaartenSlagter,

I pulled down the latest minidump and took a quick look at it.

It should be noted that it is completely different from its predecessor.

In addition to my advise, I would also like to get YowanR's input.

It appears that the emusba10.sys driver is the culprit and needs to be updated.  If updating it does not work, we can disable it.  We would, of course, want to get a new dump if it continued to fail.

This is an EMU USB audio driver.

Following is what I saw. My comments are in bold:

Windows 7 Kernel Version 7600 MP (4 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Built by: 7600.16792.amd64fre.win7_gdr.110408-1633

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000046, fffff80002c9f0b4, fffff88005e6fe50, 0}

Unable to load image \SystemRoot\system32\DRIVERS\emusba10.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for emusba10.sys

*** ERROR: Module load completed but symbols could not be loaded for emusba10.sys

Probably caused by : emusba10.sys ( emusba10+1882a ) <-- debugger blames emusba10.sys

Followup: MachineOwner

---

0: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)   <-- stop code.  Parameters follow

An exception happened while executing a system service routine.

Arguments:

Arg1: 00000000c0000046, Exception code that caused the bugcheck

Arg2: fffff80002c9f0b4, Address of the instruction which caused the bugcheck 

Arg3: fffff88005e6fe50, Address of the context record for the exception that caused the bugcheck

Arg4: 0000000000000000, zero.

Debugging Details:

---

EXCEPTION_CODE: (NTSTATUS) 0xc0000046 - An attempt to release a mutant object was made by a thread that was not the owner of the mutant object.

FAULTING_IP:

nt!RtlRaiseStatus+18

fffff800`02c9f0b4 488b8424b8010000 mov     rax,qword ptr [rsp+1B8h]

CONTEXT:  fffff88005e6fe50 -- (.cxr 0xfffff88005e6fe50)

rax=0000000000000000 rbx=00000000c0000046 rcx=fffff88005e6fe50

rdx=0000000000000001 rsi=0000000000000001 rdi=fffff80002deae80

rip=fffff80002c9f0b4 rsp=fffff88005e6fd90 rbp=0000000000000000

 r8=0000000000000000  r9=00000000000afd00 r10=0000000000000000

r11=fffffa8002348000 r12=0000000000000000 r13=0000000000000000

r14=fffffa80024f2060 r15=0000000000000000

iopl=0         nv up ei ng nz na po nc

cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000286

nt!RtlRaiseStatus+0x18:

fffff80002c9f0b4 488b8424b8010000 mov     rax,qword ptr [rsp+1B8h] ss:0018:fffff88005e6ff48=fffff80002c9f0b4

Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  reaper.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002c79610 to fffff80002c9f0b4

STACK_TEXT: 

fffff88005e6fd90 fffff80002c79610 : fffff880006d6457 0000000000000000 fffffa8002348000 0000000000000000 : nt!RtlRaiseStatus+0x18

fffff88005e70330 fffff8800534682a : fffff88000000001 fffffa8000000001 fffff88004013100 fffffa80047c2e00 : nt!KeReleaseMutant+0x260

fffff88005e703e0 fffff88000000001 : fffffa8000000001 fffff88004013100 fffffa80047c2e00 0000000000000000 : emusba10+0x1882a    <--- this is the only 3rd party driver in the stack

fffff88005e703e8 fffffa8000000001 : fffff88004013100 fffffa80047c2e00 0000000000000000 0000000000000000 : 0xfffff880`00000001

fffff88005e703f0 fffff88004013100 : fffffa80047c2e00 0000000000000000 0000000000000000 0000000000000001 : 0xfffffa80`00000001

fffff88005e703f8 fffffa80047c2e00 : 0000000000000000 0000000000000000 0000000000000001 fffff8800532e44d : ks!__security_cookie

fffff88005e70400 0000000000000000 : 0000000000000000 0000000000000001 fffff8800532e44d fffffa8002746340 : 0xfffffa80`047c2e00

FOLLOWUP_IP:

emusba10+1882a

fffff880`0534682a ??              ???

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  emusba10+1882a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: emusba10

IMAGE_NAME:  emusba10.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  474a71f8

STACK_COMMAND:  .cxr 0xfffff88005e6fe50 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_emusba10+1882a

BUCKET_ID:  X64_0x3B_emusba10+1882a

Followup: MachineOwner

---

<snip for brevity>

0: kd> lm vm emusba10

start             end                 module name

fffff8800532e000 fffff88005360700   emusba10 T (no symbols)          

    Loaded symbol image file: emusba10.sys

    Image path: \SystemRoot\system32\DRIVERS\emusba10.sys

    Image name: emusba10.sys

    Timestamp:        Mon Nov 26 01:12:56 2007 (474A71F8)       <--- driver is from 2007

    CheckSum:         0003EA51                                                     Definately needs updating

    ImageSize:        00032700

    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

=======================================

=======================================

Let us know if you have any questions.

Best regards,

Matthew_Ha

Answer 2

Hello Matthew,

Thank you very much for your help! It seems very likely to me that the EMU is causing the problems, as its driver is noticeably buggy (e.g. random drop outs, fixable by turning the device off and on again). Unfortunately, the old drivers I'm running now are the most recent ones! I just requested the EMU staff to write a new, dedicated Win7 set.

I ran the MPS utility and uploaded it's output here:

http://cid-57ae8730e5b7617f.office.live.com/embedicon.aspx/.Documents/MAARTEN-PC^\_MpsReports.cab

Thanks!

Answer 3

In addition, it may be helpful to have you run the x64 version of MPS Reports and put it on the skydrive as well.

This will give us a lot of data on the machine that could be useful.

It can be downloaded at the following link:

http://www.microsoft.com/downloads/en/details.aspx?familyid=cebf3c7c-7ca5-408f-88b7-f9c79b7306c0&displaylang=en

Best regards,

Matthew_Ha

Answer 4

Hi!

Thanks for the quick reply! I uploaded a zip of all the minidumps here:

http://cid-57ae8730e5b7617f.office.live.com/embedicon.aspx/.Documents/Crash%20Dump.zip

Answer 5

It may help to look at the minidump files from the crash(es) with a debugger.

Can you zip up the minidump files in the C:\Windows\Minidump folder and make available (provide link) via Windows Live SkyDrive or similar site?