I
ianzfang
Hi,
I need some help here. we are running a chromatography workstation on windows 7 for a while since last year. Recently, we captured several restart / BSOD during our running the workstation. We used debug tool to analyze and got the reason: memory corruption.
but we cannot understand more details. all the DMP files' content are pretty similar, so i pasted it here to see if anybody can help understand it with more details:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\ianzfang\Downloads\Desktop\080620-21730-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.24520.amd64fre.win7sp1_ldr_escrow.190828-1732
Machine Name:
Kernel base = 0xfffff800`03055000 PsLoadedModuleList = 0xfffff800`0328ec90
Debug session time: Thu Aug 6 15:16:41.762 2020 (UTC - 7:00)
System Uptime: 2 days 7:18:34.073
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7A, {fffff6fc40007fa8, ffffffffc000000e, 2000680e7860, fffff88000ff5630}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
GetPointerFromAddress: unable to read from fffff800032f2280
Probably caused by : memory_corruption
Followup: memory_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in. Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: fffff6fc40007fa8, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc000000e, error status (normally i/o status code)
Arg3: 00002000680e7860, current process (virtual address for lock type 3, or PTE)
Arg4: fffff88000ff5630, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)
Debugging Details:
------------------
ERROR_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was specified.
DISK_HARDWARE_ERROR: There was error with disk hardware
BUGCHECK_STR: 0x7a_c000000e
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: System
CURRENT_IRQL: 0
TRAP_FRAME: fffff88003bf05a0 -- (.trap 0xfffff88003bf05a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800462f8b0
rdx=fffffa800969fd30 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000ff5630 rsp=fffff88003bf0738 rbp=fffffa800969fed8
r8=fffff88000ff17c0 r9=0000000000000001 r10=0000000000000000
r11=fffff88003bf0710 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
partmgr!PmSurpriseRemoval:
fffff880`00ff5630 0000 add byte ptr [rax],al ds:0001:00000000`00000000=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800031b1cbe to fffff800030e8ca0
STACK_TEXT:
fffff880`03bf0298 fffff800`031b1cbe : 00000000`0000007a fffff6fc`40007fa8 ffffffff`c000000e 00002000`680e7860 : nt!KeBugCheckEx
fffff880`03bf02a0 fffff800`031bdde8 : fffffa80`03c49010 fffff880`03bf0400 fffff800`032f5540 ffffffff`ffffffff : nt!MiWaitForInPageComplete+0x63e
fffff880`03bf0370 fffff800`031c4ca0 : ffffffff`ffffffff 00000000`00000008 00000000`c0033333 ffffffff`ffffffff : nt!MiIssueHardFault+0x4b8
fffff880`03bf0450 fffff800`030f4ddc : 00000000`00000008 fffff880`00ff5630 fffffa80`0462fe00 fffffa80`0969fd30 : nt!MmAccessFault+0x4820
fffff880`03bf05a0 fffff880`00ff5630 : fffff880`00ff72c4 00000000`00000000 fffffa80`0969fd30 fffffa80`0969fed8 : nt!KiPageFault+0x35c
fffff880`03bf0738 fffff880`00ff72c4 : 00000000`00000000 fffffa80`0969fd30 fffffa80`0969fed8 00000000`c00000bb : partmgr!PmSurpriseRemoval
fffff880`03bf0740 fffff800`03447391 : fffffa80`0462f8b0 fffff880`03bf0848 00000000`c00000bb fffffa80`0969fd30 : partmgr!PmPnp+0xb4
fffff880`03bf0790 fffff800`03472f81 : fffffa80`04276060 00000000`00000000 fffffa80`04276a00 00000000`00000000 : nt!IopSynchronousCall+0xe1
fffff880`03bf0800 fffff800`034717a8 : fffff880`03bf09c0 fffffa80`04276060 00000000`0000030a 00000000`00000308 : nt!IopRemoveDevice+0x101
fffff880`03bf08c0 fffff800`03472ac7 : fffffa80`04276a00 00000000`00000000 00000000`00000003 00000000`00000373 : nt!PnpSurpriseRemoveLockedDeviceNode+0x128
fffff880`03bf0900 fffff800`03472be0 : 00000000`00000000 fffff8a0`04289400 fffff8a0`005bd5f0 fffff880`03bf0a58 : nt!PnpDeleteLockedDeviceNode+0x37
fffff880`03bf0930 fffff800`035398ef : 00000000`00000002 00000000`00000000 fffffa80`04276a00 00000000`00000000 : nt!PnpDeleteLockedDeviceNodes+0xa0
fffff880`03bf09a0 fffff800`0353a4ac : fffff880`03bf0b78 00000000`00000000 fffff8a0`04d44a00 fffffa80`00000000 : nt!PnpProcessQueryRemoveAndEject+0x6cf
fffff880`03bf0ae0 fffff800`033ef05b : 00000000`00000000 fffffa80`03c647f0 fffff8a0`04289430 00000000`00000001 : nt!PnpProcessTargetDeviceEvent+0x4c
fffff880`03bf0b10 fffff800`030985f9 : fffff800`0337c114 fffff8a0`04289430 fffff800`032657f8 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x3ea6b
fffff880`03bf0b70 fffff800`03395578 : 00000000`00000000 fffff880`0397b180 00000000`00000080 00000000`00000001 : nt!ExpWorkerThread+0x111
fffff880`03bf0c00 fffff800`030eecc6 : fffff880`0397b180 fffffa80`036cdb50 fffff880`0398a140 00000000`00000000 : nt!PspSystemThreadStartup+0x194
fffff880`03bf0c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !partmgr
fffff88000ff5000-fffff88000ff5007 8 bytes - partmgr!PmTakePartition+80
[ 48 8b 48 28 48 8b 82 b8:00 00 00 00 00 00 00 00 ]
fffff88000ff500b - partmgr!PmTakePartition+8b (+0x0b)
[ c6:00 ]
fffff88000ff500d-fffff88000ff5014 8 bytes - partmgr!PmTakePartition+8d (+0x02)
[ 0f 4c 89 42 18 83 60 08:00 00 00 00 00 00 00 00 ]
fffff88000ff5016-fffff88000ff5019 4 bytes - partmgr!PmTakePartition+96 (+0x09)
[ c7 40 10 10:00 00 00 00 ]
fffff88000ff501d-fffff88000ff5020 4 bytes - partmgr!PmTakePartition+9d (+0x07)
[ c7 40 18 04:00 00 00 00 ]
fffff88000ff5022 - partmgr!PmTakePartition+a2 (+0x05)
[ 76:00 ]
fffff88000ff5024-fffff88000ff5035 18 bytes - partmgr!PmTakePartition+a4 (+0x02)
[ ff 15 ee 8f ff ff 4c 8b:00 00 00 00 00 00 00 00 ]
fffff88000ff5037-fffff88000ff5039 3 bytes - partmgr!PmTakePartition+b7 (+0x13)
[ 83 7b 2c:00 00 00 ]
fffff88000ff503b-fffff88000ff5040 6 bytes - partmgr!PmTakePartition+bb (+0x04)
[ 74 13 83 87 0c 01:00 00 00 00 00 00 ]
fffff88000ff5043-fffff88000ff504c 10 bytes - partmgr!PmTakePartition+c3 (+0x08)
[ ff 8d 45 01 0f 44 c5 83:00 00 00 00 00 00 00 00 ]
fffff88000ff504e-fffff88000ff505a 13 bytes - partmgr!PmTakePartition+ce (+0x0b)
[ eb 05 b8 fe ff ff ff f0:00 00 00 00 00 00 00 00 ]
fffff88000ff505d-fffff88000ff50a3 71 bytes - partmgr!PmTakePartition+dd (+0x0f)
[ f6 43 28 04 74 08 48 8b:00 00 00 00 00 00 00 00 ]
fffff88000ff50a7-fffff88000ff50b5 15 bytes - partmgr!PmIsRedundantPath+17 (+0x4a)
[ 48 8b 05 52 a0 ff ff 48:00 00 00 00 00 00 00 00 ]
fffff88000ff50b9-fffff88000ff50bc 4 bytes - partmgr!PmIsRedundantPath+29 (+0x12)
[ 83 64 24 70:00 00 00 00 ]
fffff88000ff50be-fffff88000ff50da 29 bytes - partmgr!PmIsRedundantPath+2e (+0x05)
[ 48 8b ea 33 d2 4d 8b f0:00 00 00 00 00 00 00 00 ]
fffff88000ff50dc-fffff88000ff50f8 29 bytes - partmgr!PmIsRedundantPath+4c (+0x1e)
[ 33 c0 f3 0f 6f 05 ea 91:00 00 00 00 00 00 00 00 ]
fffff88000ff50fc-fffff88000ff5111 22 bytes - partmgr!PmIsRedundantPath+6c (+0x20)
[ 89 44 24 44 48 89 44 24:00 00 00 00 00 00 00 00 ]
fffff88000ff5114-fffff88000ff511b 8 bytes - partmgr!PmIsRedundantPath+84 (+0x18)
[ 48 8b 4d 10 8b b4 24 84:00 00 00 00 00 00 00 00 ]
fffff88000ff511f-fffff88000ff5130 18 bytes - partmgr!PmIsRedundantPath+8f (+0x0b)
[ 48 8d 54 24 70 e8 c7 e4:00 00 00 00 00 00 00 00 ]
fffff88000ff5133-fffff88000ff5136 4 bytes - partmgr!PmIsRedundantPath+a3 (+0x14)
[ 39 b4 24 84:00 00 00 00 ]
fffff88000ff513a-fffff88000ff513d 4 bytes - partmgr!PmIsRedundantPath+aa (+0x07)
[ 0f 85 21 03:00 00 00 00 ]
fffff88000ff5140 - partmgr!PmIsRedundantPath+b0 (+0x06)
[ b9:00 ]
fffff88000ff5142 - partmgr!PmIsRedundantPath+b2 (+0x02)
[ 10:00 ]
fffff88000ff5145-fffff88000ff5166 34 bytes - partmgr!PmIsRedundantPath+b5 (+0x03)
[ 8d 04 76 41 b8 50 6d 49:00 00 00 00 00 00 00 00 ]
fffff88000ff5169-fffff88000ff516c 4 bytes - partmgr!PmIsRedundantPath+d9 (+0x24)
[ c0 e9 e2 02:00 00 00 00 ]
fffff88000ff516f-fffff88000ff5173 5 bytes - partmgr!PmIsRedundantPath+df (+0x06)
[ 48 83 64 24 50:00 00 00 00 00 ]
fffff88000ff5175-fffff88000ff51aa 54 bytes - partmgr!PmIsRedundantPath+e5 (+0x06)
[ 48 8d 4c 24 58 45 33 c0:00 00 00 00 00 00 00 00 ]
fffff88000ff51ae-fffff88000ff51c4 23 bytes - partmgr!PmIsRedundantPath+11e (+0x39)
[ 48 89 44 24 20 ff 15 4f:00 00 00 00 00 00 00 00 ]
fffff88000ff51c8-fffff88000ff51da 19 bytes - partmgr!PmIsRedundantPath+138 (+0x1a)
[ 80 48 ba 02 49 8b 4c 24:00 00 00 00 00 00 00 00 ]
fffff88000ff51dd-fffff88000ff51e8 12 bytes - partmgr!PmIsRedundantPath+14d (+0x15)
[ 8b d8 41 3b c5 75 1d 48:00 00 00 00 00 00 00 00 ]
fffff88000ff51ea-fffff88000ff5206 29 bytes - partmgr!PmIsRedundantPath+15a (+0x0d)
[ 48 8d 4c 24 58 45 33 c9:00 00 00 00 00 00 00 00 ]
fffff88000ff5209-fffff88000ff5243 59 bytes - partmgr!PmIsRedundantPath+179 (+0x1f)
[ 48 8d 4c 24 58 45 33 c0:00 00 00 00 00 00 00 00 ]
fffff88000ff5247-fffff88000ff525c 22 bytes - partmgr!PmIsRedundantPath+1b7 (+0x3e)
[ ff 15 bb 8f ff ff 48 8b:00 00 00 00 00 00 00 00 ]
fffff88000ff5260-fffff88000ff5279 26 bytes - partmgr!PmIsRedundantPath+1d0 (+0x19)
[ 80 48 ba 02 48 8b 4d 10:00 00 00 00 00 00 00 00 ]
fffff88000ff527b-fffff88000ff5297 29 bytes - partmgr!PmIsRedundantPath+1eb (+0x1b)
[ 48 8d 4c 24 58 45 33 c9:00 00 00 00 00 00 00 00 ]
fffff88000ff529a-fffff88000ff529e 5 bytes - partmgr!PmIsRedundantPath+20a (+0x1f)
[ 0f b7 9f bc 01:00 00 00 00 00 ]
fffff88000ff52a1-fffff88000ff52a5 5 bytes - partmgr!PmIsRedundantPath+211 (+0x07)
[ 48 8d 8c 24 88:00 00 00 00 00 ]
fffff88000ff52a9-fffff88000ff52bf 23 bytes - partmgr!PmIsRedundantPath+219 (+0x08)
[ ff 15 b9 8d ff ff 85 c0:00 00 00 00 00 00 00 00 ]
fffff88000ff52c3-fffff88000ff52c9 7 bytes - partmgr!PmIsRedundantPath+233 (+0x1a)
[ eb 08 48 8b 84 24 88:00 00 00 00 00 00 00 ]
fffff88000ff52cd-fffff88000ff52d1 5 bytes - partmgr!PmIsRedundantPath+23d (+0x0a)
[ 66 33 84 24 8a:00 00 00 00 00 ]
fffff88000ff52d5-fffff88000ff52d9 5 bytes - partmgr!PmIsRedundantPath+245 (+0x08)
[ 66 33 84 24 8c:00 00 00 00 00 ]
fffff88000ff52dd-fffff88000ff52e1 5 bytes - partmgr!PmIsRedundantPath+24d (+0x08)
[ 66 33 84 24 8e:00 00 00 00 00 ]
fffff88000ff52e5-fffff88000ff52e9 5 bytes - partmgr!PmIsRedundantPath+255 (+0x08)
[ 66 33 84 24 90:00 00 00 00 00 ]
fffff88000ff52ed-fffff88000ff52f1 5 bytes - partmgr!PmIsRedundantPath+25d (+0x08)
[ 66 33 84 24 92:00 00 00 00 00 ]
fffff88000ff52f5-fffff88000ff52f9 5 bytes - partmgr!PmIsRedundantPath+265 (+0x08)
[ 66 33 84 24 94:00 00 00 00 00 ]
fffff88000ff52fd-fffff88000ff5301 5 bytes - partmgr!PmIsRedundantPath+26d (+0x08)
[ 66 33 84 24 96:00 00 00 00 00 ]
fffff88000ff5305-fffff88000ff5309 5 bytes - partmgr!PmIsRedundantPath+275 (+0x08)
[ 66 89 87 bc 01:00 00 00 00 00 ]
fffff88000ff530c-fffff88000ff5346 59 bytes - partmgr!PmIsRedundantPath+27c (+0x07)
[ 66 3b c3 74 90 48 8d 4c:00 00 00 00 00 00 00 00 ]
fffff88000ff534a-fffff88000ff5364 27 bytes - partmgr!PmIsRedundantPath+2ba (+0x3e)
[ 48 89 44 24 20 ff 15 b3:00 00 00 00 00 00 00 00 ]
fffff88000ff5368-fffff88000ff5382 27 bytes - partmgr!PmIsRedundantPath+2d8 (+0x1e)
[ 80 48 ba 12 49 8b 4c 24:00 00 00 00 01 00 00 00 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output.
3792 errors : !partmgr (fffff88000ff5000-fffff88000ff5fff)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE_4096
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_LARGE_4096
BUCKET_ID: X64_MEMORY_CORRUPTION_LARGE_4096
Followup: memory_corruption
---------
0: kd> !process
GetPointerFromAddress: unable to read from fffff800032f2000
PROCESS fffffa80036b8040
SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase: 00187000 ObjectTable: fffff8a000001670 HandleCount: <Data Not Accessible>
Image: System
VadRoot fffffa80036b8f70 Vads 126 Clone 0 Private 82. Modified 1895697. Locked 1312.
DeviceMap fffff8a000008a70
Token fffff8a000004a50
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
fffff78000000000: Unable to get shared data
ElapsedTime 00:00:00.000
UserTime 00:00:00.000
KernelTime 00:00:00.000
QuotaPoolUsage[PagedPool] 0
QuotaPoolUsage[NonPagedPool] 0
Working Set Sizes (now,min,max) (4464, 0, 0) (17856KB, 0KB, 0KB)
PeakWorkingSetSize 4813
VirtualSize 23 Mb
PeakVirtualSize 29 Mb
PageFaultCount 37904
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 114
*** Error in reading nt!_ETHREAD @ fffffa80036b8ab0
Continue reading...
I need some help here. we are running a chromatography workstation on windows 7 for a while since last year. Recently, we captured several restart / BSOD during our running the workstation. We used debug tool to analyze and got the reason: memory corruption.
but we cannot understand more details. all the DMP files' content are pretty similar, so i pasted it here to see if anybody can help understand it with more details:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\ianzfang\Downloads\Desktop\080620-21730-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.24520.amd64fre.win7sp1_ldr_escrow.190828-1732
Machine Name:
Kernel base = 0xfffff800`03055000 PsLoadedModuleList = 0xfffff800`0328ec90
Debug session time: Thu Aug 6 15:16:41.762 2020 (UTC - 7:00)
System Uptime: 2 days 7:18:34.073
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7A, {fffff6fc40007fa8, ffffffffc000000e, 2000680e7860, fffff88000ff5630}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
GetPointerFromAddress: unable to read from fffff800032f2280
Probably caused by : memory_corruption
Followup: memory_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in. Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: fffff6fc40007fa8, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc000000e, error status (normally i/o status code)
Arg3: 00002000680e7860, current process (virtual address for lock type 3, or PTE)
Arg4: fffff88000ff5630, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)
Debugging Details:
------------------
ERROR_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was specified.
DISK_HARDWARE_ERROR: There was error with disk hardware
BUGCHECK_STR: 0x7a_c000000e
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: System
CURRENT_IRQL: 0
TRAP_FRAME: fffff88003bf05a0 -- (.trap 0xfffff88003bf05a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800462f8b0
rdx=fffffa800969fd30 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000ff5630 rsp=fffff88003bf0738 rbp=fffffa800969fed8
r8=fffff88000ff17c0 r9=0000000000000001 r10=0000000000000000
r11=fffff88003bf0710 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
partmgr!PmSurpriseRemoval:
fffff880`00ff5630 0000 add byte ptr [rax],al ds:0001:00000000`00000000=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800031b1cbe to fffff800030e8ca0
STACK_TEXT:
fffff880`03bf0298 fffff800`031b1cbe : 00000000`0000007a fffff6fc`40007fa8 ffffffff`c000000e 00002000`680e7860 : nt!KeBugCheckEx
fffff880`03bf02a0 fffff800`031bdde8 : fffffa80`03c49010 fffff880`03bf0400 fffff800`032f5540 ffffffff`ffffffff : nt!MiWaitForInPageComplete+0x63e
fffff880`03bf0370 fffff800`031c4ca0 : ffffffff`ffffffff 00000000`00000008 00000000`c0033333 ffffffff`ffffffff : nt!MiIssueHardFault+0x4b8
fffff880`03bf0450 fffff800`030f4ddc : 00000000`00000008 fffff880`00ff5630 fffffa80`0462fe00 fffffa80`0969fd30 : nt!MmAccessFault+0x4820
fffff880`03bf05a0 fffff880`00ff5630 : fffff880`00ff72c4 00000000`00000000 fffffa80`0969fd30 fffffa80`0969fed8 : nt!KiPageFault+0x35c
fffff880`03bf0738 fffff880`00ff72c4 : 00000000`00000000 fffffa80`0969fd30 fffffa80`0969fed8 00000000`c00000bb : partmgr!PmSurpriseRemoval
fffff880`03bf0740 fffff800`03447391 : fffffa80`0462f8b0 fffff880`03bf0848 00000000`c00000bb fffffa80`0969fd30 : partmgr!PmPnp+0xb4
fffff880`03bf0790 fffff800`03472f81 : fffffa80`04276060 00000000`00000000 fffffa80`04276a00 00000000`00000000 : nt!IopSynchronousCall+0xe1
fffff880`03bf0800 fffff800`034717a8 : fffff880`03bf09c0 fffffa80`04276060 00000000`0000030a 00000000`00000308 : nt!IopRemoveDevice+0x101
fffff880`03bf08c0 fffff800`03472ac7 : fffffa80`04276a00 00000000`00000000 00000000`00000003 00000000`00000373 : nt!PnpSurpriseRemoveLockedDeviceNode+0x128
fffff880`03bf0900 fffff800`03472be0 : 00000000`00000000 fffff8a0`04289400 fffff8a0`005bd5f0 fffff880`03bf0a58 : nt!PnpDeleteLockedDeviceNode+0x37
fffff880`03bf0930 fffff800`035398ef : 00000000`00000002 00000000`00000000 fffffa80`04276a00 00000000`00000000 : nt!PnpDeleteLockedDeviceNodes+0xa0
fffff880`03bf09a0 fffff800`0353a4ac : fffff880`03bf0b78 00000000`00000000 fffff8a0`04d44a00 fffffa80`00000000 : nt!PnpProcessQueryRemoveAndEject+0x6cf
fffff880`03bf0ae0 fffff800`033ef05b : 00000000`00000000 fffffa80`03c647f0 fffff8a0`04289430 00000000`00000001 : nt!PnpProcessTargetDeviceEvent+0x4c
fffff880`03bf0b10 fffff800`030985f9 : fffff800`0337c114 fffff8a0`04289430 fffff800`032657f8 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x3ea6b
fffff880`03bf0b70 fffff800`03395578 : 00000000`00000000 fffff880`0397b180 00000000`00000080 00000000`00000001 : nt!ExpWorkerThread+0x111
fffff880`03bf0c00 fffff800`030eecc6 : fffff880`0397b180 fffffa80`036cdb50 fffff880`0398a140 00000000`00000000 : nt!PspSystemThreadStartup+0x194
fffff880`03bf0c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !partmgr
fffff88000ff5000-fffff88000ff5007 8 bytes - partmgr!PmTakePartition+80
[ 48 8b 48 28 48 8b 82 b8:00 00 00 00 00 00 00 00 ]
fffff88000ff500b - partmgr!PmTakePartition+8b (+0x0b)
[ c6:00 ]
fffff88000ff500d-fffff88000ff5014 8 bytes - partmgr!PmTakePartition+8d (+0x02)
[ 0f 4c 89 42 18 83 60 08:00 00 00 00 00 00 00 00 ]
fffff88000ff5016-fffff88000ff5019 4 bytes - partmgr!PmTakePartition+96 (+0x09)
[ c7 40 10 10:00 00 00 00 ]
fffff88000ff501d-fffff88000ff5020 4 bytes - partmgr!PmTakePartition+9d (+0x07)
[ c7 40 18 04:00 00 00 00 ]
fffff88000ff5022 - partmgr!PmTakePartition+a2 (+0x05)
[ 76:00 ]
fffff88000ff5024-fffff88000ff5035 18 bytes - partmgr!PmTakePartition+a4 (+0x02)
[ ff 15 ee 8f ff ff 4c 8b:00 00 00 00 00 00 00 00 ]
fffff88000ff5037-fffff88000ff5039 3 bytes - partmgr!PmTakePartition+b7 (+0x13)
[ 83 7b 2c:00 00 00 ]
fffff88000ff503b-fffff88000ff5040 6 bytes - partmgr!PmTakePartition+bb (+0x04)
[ 74 13 83 87 0c 01:00 00 00 00 00 00 ]
fffff88000ff5043-fffff88000ff504c 10 bytes - partmgr!PmTakePartition+c3 (+0x08)
[ ff 8d 45 01 0f 44 c5 83:00 00 00 00 00 00 00 00 ]
fffff88000ff504e-fffff88000ff505a 13 bytes - partmgr!PmTakePartition+ce (+0x0b)
[ eb 05 b8 fe ff ff ff f0:00 00 00 00 00 00 00 00 ]
fffff88000ff505d-fffff88000ff50a3 71 bytes - partmgr!PmTakePartition+dd (+0x0f)
[ f6 43 28 04 74 08 48 8b:00 00 00 00 00 00 00 00 ]
fffff88000ff50a7-fffff88000ff50b5 15 bytes - partmgr!PmIsRedundantPath+17 (+0x4a)
[ 48 8b 05 52 a0 ff ff 48:00 00 00 00 00 00 00 00 ]
fffff88000ff50b9-fffff88000ff50bc 4 bytes - partmgr!PmIsRedundantPath+29 (+0x12)
[ 83 64 24 70:00 00 00 00 ]
fffff88000ff50be-fffff88000ff50da 29 bytes - partmgr!PmIsRedundantPath+2e (+0x05)
[ 48 8b ea 33 d2 4d 8b f0:00 00 00 00 00 00 00 00 ]
fffff88000ff50dc-fffff88000ff50f8 29 bytes - partmgr!PmIsRedundantPath+4c (+0x1e)
[ 33 c0 f3 0f 6f 05 ea 91:00 00 00 00 00 00 00 00 ]
fffff88000ff50fc-fffff88000ff5111 22 bytes - partmgr!PmIsRedundantPath+6c (+0x20)
[ 89 44 24 44 48 89 44 24:00 00 00 00 00 00 00 00 ]
fffff88000ff5114-fffff88000ff511b 8 bytes - partmgr!PmIsRedundantPath+84 (+0x18)
[ 48 8b 4d 10 8b b4 24 84:00 00 00 00 00 00 00 00 ]
fffff88000ff511f-fffff88000ff5130 18 bytes - partmgr!PmIsRedundantPath+8f (+0x0b)
[ 48 8d 54 24 70 e8 c7 e4:00 00 00 00 00 00 00 00 ]
fffff88000ff5133-fffff88000ff5136 4 bytes - partmgr!PmIsRedundantPath+a3 (+0x14)
[ 39 b4 24 84:00 00 00 00 ]
fffff88000ff513a-fffff88000ff513d 4 bytes - partmgr!PmIsRedundantPath+aa (+0x07)
[ 0f 85 21 03:00 00 00 00 ]
fffff88000ff5140 - partmgr!PmIsRedundantPath+b0 (+0x06)
[ b9:00 ]
fffff88000ff5142 - partmgr!PmIsRedundantPath+b2 (+0x02)
[ 10:00 ]
fffff88000ff5145-fffff88000ff5166 34 bytes - partmgr!PmIsRedundantPath+b5 (+0x03)
[ 8d 04 76 41 b8 50 6d 49:00 00 00 00 00 00 00 00 ]
fffff88000ff5169-fffff88000ff516c 4 bytes - partmgr!PmIsRedundantPath+d9 (+0x24)
[ c0 e9 e2 02:00 00 00 00 ]
fffff88000ff516f-fffff88000ff5173 5 bytes - partmgr!PmIsRedundantPath+df (+0x06)
[ 48 83 64 24 50:00 00 00 00 00 ]
fffff88000ff5175-fffff88000ff51aa 54 bytes - partmgr!PmIsRedundantPath+e5 (+0x06)
[ 48 8d 4c 24 58 45 33 c0:00 00 00 00 00 00 00 00 ]
fffff88000ff51ae-fffff88000ff51c4 23 bytes - partmgr!PmIsRedundantPath+11e (+0x39)
[ 48 89 44 24 20 ff 15 4f:00 00 00 00 00 00 00 00 ]
fffff88000ff51c8-fffff88000ff51da 19 bytes - partmgr!PmIsRedundantPath+138 (+0x1a)
[ 80 48 ba 02 49 8b 4c 24:00 00 00 00 00 00 00 00 ]
fffff88000ff51dd-fffff88000ff51e8 12 bytes - partmgr!PmIsRedundantPath+14d (+0x15)
[ 8b d8 41 3b c5 75 1d 48:00 00 00 00 00 00 00 00 ]
fffff88000ff51ea-fffff88000ff5206 29 bytes - partmgr!PmIsRedundantPath+15a (+0x0d)
[ 48 8d 4c 24 58 45 33 c9:00 00 00 00 00 00 00 00 ]
fffff88000ff5209-fffff88000ff5243 59 bytes - partmgr!PmIsRedundantPath+179 (+0x1f)
[ 48 8d 4c 24 58 45 33 c0:00 00 00 00 00 00 00 00 ]
fffff88000ff5247-fffff88000ff525c 22 bytes - partmgr!PmIsRedundantPath+1b7 (+0x3e)
[ ff 15 bb 8f ff ff 48 8b:00 00 00 00 00 00 00 00 ]
fffff88000ff5260-fffff88000ff5279 26 bytes - partmgr!PmIsRedundantPath+1d0 (+0x19)
[ 80 48 ba 02 48 8b 4d 10:00 00 00 00 00 00 00 00 ]
fffff88000ff527b-fffff88000ff5297 29 bytes - partmgr!PmIsRedundantPath+1eb (+0x1b)
[ 48 8d 4c 24 58 45 33 c9:00 00 00 00 00 00 00 00 ]
fffff88000ff529a-fffff88000ff529e 5 bytes - partmgr!PmIsRedundantPath+20a (+0x1f)
[ 0f b7 9f bc 01:00 00 00 00 00 ]
fffff88000ff52a1-fffff88000ff52a5 5 bytes - partmgr!PmIsRedundantPath+211 (+0x07)
[ 48 8d 8c 24 88:00 00 00 00 00 ]
fffff88000ff52a9-fffff88000ff52bf 23 bytes - partmgr!PmIsRedundantPath+219 (+0x08)
[ ff 15 b9 8d ff ff 85 c0:00 00 00 00 00 00 00 00 ]
fffff88000ff52c3-fffff88000ff52c9 7 bytes - partmgr!PmIsRedundantPath+233 (+0x1a)
[ eb 08 48 8b 84 24 88:00 00 00 00 00 00 00 ]
fffff88000ff52cd-fffff88000ff52d1 5 bytes - partmgr!PmIsRedundantPath+23d (+0x0a)
[ 66 33 84 24 8a:00 00 00 00 00 ]
fffff88000ff52d5-fffff88000ff52d9 5 bytes - partmgr!PmIsRedundantPath+245 (+0x08)
[ 66 33 84 24 8c:00 00 00 00 00 ]
fffff88000ff52dd-fffff88000ff52e1 5 bytes - partmgr!PmIsRedundantPath+24d (+0x08)
[ 66 33 84 24 8e:00 00 00 00 00 ]
fffff88000ff52e5-fffff88000ff52e9 5 bytes - partmgr!PmIsRedundantPath+255 (+0x08)
[ 66 33 84 24 90:00 00 00 00 00 ]
fffff88000ff52ed-fffff88000ff52f1 5 bytes - partmgr!PmIsRedundantPath+25d (+0x08)
[ 66 33 84 24 92:00 00 00 00 00 ]
fffff88000ff52f5-fffff88000ff52f9 5 bytes - partmgr!PmIsRedundantPath+265 (+0x08)
[ 66 33 84 24 94:00 00 00 00 00 ]
fffff88000ff52fd-fffff88000ff5301 5 bytes - partmgr!PmIsRedundantPath+26d (+0x08)
[ 66 33 84 24 96:00 00 00 00 00 ]
fffff88000ff5305-fffff88000ff5309 5 bytes - partmgr!PmIsRedundantPath+275 (+0x08)
[ 66 89 87 bc 01:00 00 00 00 00 ]
fffff88000ff530c-fffff88000ff5346 59 bytes - partmgr!PmIsRedundantPath+27c (+0x07)
[ 66 3b c3 74 90 48 8d 4c:00 00 00 00 00 00 00 00 ]
fffff88000ff534a-fffff88000ff5364 27 bytes - partmgr!PmIsRedundantPath+2ba (+0x3e)
[ 48 89 44 24 20 ff 15 b3:00 00 00 00 00 00 00 00 ]
fffff88000ff5368-fffff88000ff5382 27 bytes - partmgr!PmIsRedundantPath+2d8 (+0x1e)
[ 80 48 ba 12 49 8b 4c 24:00 00 00 00 01 00 00 00 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output.
3792 errors : !partmgr (fffff88000ff5000-fffff88000ff5fff)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE_4096
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_LARGE_4096
BUCKET_ID: X64_MEMORY_CORRUPTION_LARGE_4096
Followup: memory_corruption
---------
0: kd> !process
GetPointerFromAddress: unable to read from fffff800032f2000
PROCESS fffffa80036b8040
SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase: 00187000 ObjectTable: fffff8a000001670 HandleCount: <Data Not Accessible>
Image: System
VadRoot fffffa80036b8f70 Vads 126 Clone 0 Private 82. Modified 1895697. Locked 1312.
DeviceMap fffff8a000008a70
Token fffff8a000004a50
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
fffff78000000000: Unable to get shared data
ElapsedTime 00:00:00.000
UserTime 00:00:00.000
KernelTime 00:00:00.000
QuotaPoolUsage[PagedPool] 0
QuotaPoolUsage[NonPagedPool] 0
Working Set Sizes (now,min,max) (4464, 0, 0) (17856KB, 0KB, 0KB)
PeakWorkingSetSize 4813
VirtualSize 23 Mb
PeakVirtualSize 29 Mb
PageFaultCount 37904
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 114
*** Error in reading nt!_ETHREAD @ fffffa80036b8ab0
Continue reading...