BugCheck D1, {ca32b7d72b, 2, 8, ca32b7d72b}
Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 000000ca32b7d72b, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 000000ca32b7d72b, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80311b6d168
GetUlongFromAddress: unable to read from fffff80311b6d1f8
000000ca32b7d72b Nonpaged pool
CURRENT_IRQL: 2
FAULTING_IP:
+59f6000ff9
000000ca`32b7d72b ?? ???
PROCESS_NAME: System
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
DPC_STACK_BASE: FFFFF880009F3FB0
TRAP_FRAME: fffff880009f3ca0 -- (.trap 0xfffff880009f3ca0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=1db04f3acaed0000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=000000ca32b7d72b rsp=fffff880009f3e38 rbp=0000000000000008
r8=000000000000082f r9=000000000000002f r10=00000000000000ff
r11=fffff880009c3180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
000000ca`32b7d72b ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8031186e769 to fffff8031186f440
FAILED_INSTRUCTION_ADDRESS:
+59f6000ff9
000000ca`32b7d72b ?? ???
STACK_TEXT:
fffff880`009f3b58 fffff803`1186e769 : 00000000`0000000a 000000ca`32b7d72b 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff880`009f3b60 fffff803`1186cfe0 : 00000000`00000008 fffff880`009c3180 00000000`00000000 fffff880`009f3ca0 : nt!KiBugCheckDispatch+0x69
fffff880`009f3ca0 000000ca`32b7d72b : fffff803`11897a06 fffff880`009c3180 fffff880`04747a50 fffffa80`10bfb040 : nt!KiPageFault+0x260
fffff880`009f3e38 fffff803`11897a06 : fffff880`009c3180 fffff880`04747a50 fffffa80`10bfb040 00000000`00000004 : 0x000000ca`32b7d72b
fffff880`009f3e40 fffff803`118693a5 : 055dc471`0e50cd7f fffff880`009c3180 fffff880`06e24ac0 fffffa80`0d600210 : nt!KiRetireDpcList+0x1f6
fffff880`009f3fb0 fffff803`118691a9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxRetireDpcList+0x5
fffff880`06e24a00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiPageFault+260
fffff803`1186cfe0 440f20c0 mov rax,cr8
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiPageFault+260
FOLLOWUP_NAME: MachineOwner
Use !analyze -v to get detailed debugging information.
BugCheck D1, {fffff87fe1cbeac2, 2, 8, fffff87fe1cbeac2}
Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff87fe1cbeac2, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: fffff87fe1cbeac2, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80057dd1168
GetUlongFromAddress: unable to read from fffff80057dd11f8
fffff87fe1cbeac2 Nonpaged pool
CURRENT_IRQL: 2
FAULTING_IP:
+57f6000ff9
fffff87f`e1cbeac2 ?? ???
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: System
ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
DPC_STACK_BASE: FFFFF80056667FB0
TRAP_FRAME: fffff80056661720 -- (.trap 0xfffff80056661720)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff80057d71180
rdx=fffffa8014d27c20 rsi=0000000000000000 rdi=0000000000000000
rip=fffff87fe1cbeac2 rsp=fffff800566618b0 rbp=0000000000000000
r8=00000134f88f82ed r9=0000000000000023 r10=fffff80057a79000
r11=fffff80056661818 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
fffff87f`e1cbeac2 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80057ad2769 to fffff80057ad3440
FAILED_INSTRUCTION_ADDRESS:
+57f6000ff9
fffff87f`e1cbeac2 ?? ???
STACK_TEXT:
fffff800`566615d8 fffff800`57ad2769 : 00000000`0000000a fffff87f`e1cbeac2 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff800`566615e0 fffff800`57ad0fe0 : 00000000`00000008 fffffa80`0ef67d78 00000000`00000000 fffff800`56661720 : nt!KiBugCheckDispatch+0x69
fffff800`56661720 fffff87f`e1cbeac2 : fffffa80`00000001 00000000`00000000 fffffa80`0ee22100 fffffa80`0ef67d78 : nt!KiPageFault+0x260
fffff800`566618b0 fffffa80`00000001 : 00000000`00000000 fffffa80`0ee22100 fffffa80`0ef67d78 00000000`00000000 : 0xfffff87f`e1cbeac2
fffff800`566618b8 00000000`00000000 : fffffa80`0ee22100 fffffa80`0ef67d78 00000000`00000000 00000000`00000000 : 0xfffffa80`00000001
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiPageFault+260
fffff800`57ad0fe0 440f20c0 mov rax,cr8
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiPageFault+260
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 51a966cd
IMAGE_VERSION: 6.2.9200.16628
BUCKET_ID_FUNC_OFFSET: 260
FAILURE_BUCKET_ID: AV_CODE_AV_BAD_IP_nt!KiPageFault
BUCKET_ID: AV_CODE_AV_BAD_IP_nt!KiPageFault
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_code_av_bad_ip_nt!kipagefault
FAILURE_ID_HASH: {73cd60cc-83fa-6b76-df08-1961c31d7403}
Followup: MachineOwner