Random BSOD due to Pool_Corruption

D

DaShooter

New Member
Messages
4
Hello, I'm running Windows 8.1 on a computer I built myself. I hadn't had any problems for the first month or two, but two weeks ago I started getting BSOD's popping up every now and then. I ran a disk check, and the returned log said the problem was caused by "Pool_Corruption ( nt!ExFreePool+485 )". I attached that file "error" and the requested SF Diagnostic zip file. Please let me know if anyone can help solve this or if you need more information.
 

My Computer

System One

  • OS
    Windows 8.1
The system pool area, as I understand it, is a memory glob used by the kernel for its own purposes.
This could be a memory issue, so I suggest running the memory diagnostics for a few hours.

You could also change the pool area parameters in the System control panel under:

System Properties-> Advanced-> Performance settings-> Advanced->Adjust for best performance

At that point you probably have Programs checked, but you could switch to Background services, restart and then switch back.

I believe Background services allocates a larger pool area.
 

My Computer

System One

  • OS
    Windows 8.1 Pro with Media Center (64-bit)
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Custom-build
    CPU
    Intel Core i7-2600K @ 4.3 GHz
    Motherboard
    ASUS P8P67 PRO Rev 3.0
    Memory
    16 GB G.SKILL Ripjaws X DDR3 SDRAM DDR3 1600 (4 banks 4GB DIMM DDR3 8-8-8-24 5-32-12-7 1T 1.5V)
    Graphics Card(s)
    NVIDIA GeForce GT 440
    Sound Card
    Firewire Focusrite Saffire Pro 14
    Monitor(s) Displays
    LG W2353V
    Screen Resolution
    1920x1080
    Hard Drives
    2 of Seagate Barracuda XT ST32000641AS (2TB ea.);
    1 of Seagate Barracuda Green ST2000DL003 (2TB);
    1 of Hitachi Deskstar HDS722020ALA330 (2TB);
    2 of Seagate Desktop ST4000DM000-1F2168 (4TB)
    PSU
    Corsair AX850 Gold
    Case
    Cooler Master HAF 932 Advanced
    Cooling
    ThermalTake Silent 1156
    Keyboard
    Logitech K520
    Mouse
    Logitech M310
    Internet Speed
    7Mbps
    Browser
    Chrome
    Antivirus
    Kaspersky
    Other Info
    Event Studio Precision 6 powered audio monitors;
    Boston Acoustics CS Sub 10 Powered Subwoofer;
    NI Kore controller;
    NI Maschine controller;
    M-Audio Axiom 61 keyboard controller; expression pedal; sustain pedal;

    ... and tons of audio software ...

    I also keep two USB 3 thumb drives (A: and B:) attached with boot recovery and security stuff that I can boot into from BIOS in case of emergency
I did run memtest86 last night, it came up with no errors found. I'd attach the results it found, but I'm not sure where they were saved.
 

My Computer

System One

  • OS
    Windows 8.1
This is interesting.

Code: 
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: ffffc000b0695010, the pool entry being checked.
Arg3: ffffc000b0695010, the read back flink freelist value (should be the same as 2).
Arg4: dead000000000000, the read back blink freelist value (should be the same as 2).

//Linked list corruption, an address has been corrupt

2: kd> dc dead000000000000
dead0000`00000000  ???????? ???????? ???????? ????????  ???????????????? 
dead0000`00000010  ???????? ???????? ???????? ????????  ????????????????
dead0000`00000020  ???????? ???????? ???????? ????????  ????????????????
dead0000`00000030  ???????? ???????? ???????? ????????  ????????????????
dead0000`00000040  ???????? ???????? ???????? ????????  ????????????????
dead0000`00000050  ???????? ???????? ???????? ????????  ????????????????
dead0000`00000060  ???????? ???????? ???????? ????????  ????????????????
dead0000`00000070  ???????? ???????? ???????? ????????  ????????????????

//The address has been written over with 'dead', not the typical behaviour of bad RAM

2: kd> dt nt!_LIST_ENTRY ffffc000b0695010
 [ 0xffffe000`a6202790 - 0xffffe000`a6602790 ]
   +0x000 Flink            : 0xffffe000`a6202790 _LIST_ENTRY [ 0xffffc000`b0695010 - 0xffffc000`b0695010 ]
   +0x008 Blink            : 0xffffe000`a6602790 _LIST_ENTRY [ 0xdead0000`00000000 - 0x00800001`40001000 ]

//The linked list has indeed been corrupted, the address has been overwritten

Can I have a Kernel / Complete memory dump?
A minidump will not suffice here.

It will be located in C:\Windows\MEMORY.dmp
Copy it to the desktop, compress it in a .zip folder and upload it to Onedrive/Dropbox.

Then can you change your options to create a Complete Memory Dump.
Go the Start
Right click My Computer
Select Properties
Click Advanced system settings
Click on the Advanced tab
Select Settings under Startup and Recovery
Then under Write debugging information select Complete memory dump.

Once a dump is created go to:

Code: 
C:\Windows\memory.dmp

Copy the file to the desktop, zip it up and upload it to a file sharing site like Onedrive. After the upload is done post the download link in your next reply.
 

My Computer

System One

  • OS
    Windows 7
Code: 
2: kd> dt nt!_LIST_ENTRY ffffc000b0695010
 [ 0xffffe000`a6202790 - 0xffffe000`a6602790 ]
   +0x000 Flink            : 0xffffe000`a6202790 _LIST_ENTRY [ 0xffffc000`b0695010 - 0xffffc000`b0695010 ]
   +0x008 Blink            : 0xffffe000`a6602790 _LIST_ENTRY [ 0xdead0000`00000000 - 0x00800001`40001000 ] [COLOR=#800080]//Blink is wrong[/COLOR]

2: kd> !pool ffffe000`a6602790
Pool page ffffe000a6602790 region is Unknown
 ffffe000a6602000 size:   b0 previous size:    0  (Allocated)  NVRM
 ffffe000a66020b0 size:   50 previous size:   b0  (Free )  NVRM
 ffffe000a6602100 size:   60 previous size:   50  (Allocated)  NVRM
 ffffe000a6602160 size:   60 previous size:   60  (Allocated)  NVRM
 ffffe000a66021c0 size:   60 previous size:   60  (Allocated)  NVRM
 ffffe000a6602220 size:   e0 previous size:   60  (Allocated)  NVRM
 ffffe000a6602300 size:   e0 previous size:   e0  (Allocated)  NVRM
 ffffe000a66023e0 size:   b0 previous size:   e0  (Allocated)  NVRM
 ffffe000a6602490 size:   e0 previous size:   b0  (Allocated)  NVRM
 ffffe000a6602570 size:   e0 previous size:   e0  (Allocated)  NVRM
 ffffe000a6602650 size:   90 previous size:   e0  (Allocated)  NVRM
 ffffe000a66026e0 size:   50 previous size:   90  (Allocated)  NVRM
*ffffe000a6602730 size:   b0 previous size:   50  (Allocated) *NVRM [COLOR=#800080]//Certainly doesn't look free to me[/COLOR]
        Owning component : Unknown (update pooltag.txt)
 ffffe000a66027e0 size:  110 previous size:   b0  (Allocated)  NVRM
 ffffe000a66028f0 size:   60 previous size:  110  (Allocated)  NVRM
 ffffe000a6602950 size:  110 previous size:   60  (Allocated)  NVRM
 ffffe000a6602a60 size:   b0 previous size:  110  (Allocated)  NVRM
 ffffe000a6602b10 size:   e0 previous size:   b0  (Allocated)  NVRM
 ffffe000a6602bf0 size:   60 previous size:   e0  (Allocated)  NVRM
 ffffe000a6602c50 size:  110 previous size:   60  (Allocated)  NVRM
 ffffe000a6602d60 size:   10 previous size:  110  (Free)       Free
 ffffe000a6602d70 size:   b0 previous size:   10  (Allocated)  NVRM
 ffffe000a6602e20 size:  100 previous size:   b0  (Allocated)  NVRM
 ffffe000a6602f20 size:   e0 previous size:  100  (Allocated)  NVRM

2: kd> dc ffffe000`a6602590 ffffe000`a6602890
ffffe000`a6602590  00000001 00000000 00000000 00000000  ................
ffffe000`a66025a0  00001000 00000000 00001000 00000000  ................
ffffe000`a66025b0  00000000 00000000 00000000 00000000  ................
ffffe000`a66025c0  00000000 00000000 00000000 00000000  ................
ffffe000`a66025d0  00000000 00000000 00000002 00000000  ................
ffffe000`a66025e0  00000001 00000001 00000000 00000000  ................
ffffe000`a66025f0  00000001 00000001 00000001 00000000  ................
ffffe000`a6602600  00000000 00000000 00000000 00000000  ................
ffffe000`a6602610  00000000 00000000 00000000 00000000  ................
ffffe000`a6602620  00000000 00000000 00000000 00000000  ................
ffffe000`a6602630  00000000 00000000 00000000 00000000  ................
ffffe000`a6602640  00000000 dead0000 00000000 00000000  ................
ffffe000`a6602650  0209000e 4d52564e 785972ff c7cb8820  ....NVRM.rYx ...
ffffe000`a6602660  a64ae940 ffffe000 a6710a20 ffffe000  @.J..... .q.....
ffffe000`a6602670  00000000 00000000 a969de80 ffffe000  ..........i.....
ffffe000`a6602680  00000004 000090f1 00000000 00006030  ............0`..
ffffe000`a6602690  00000000 00000000 00000000 00000000  ................
ffffe000`a66026a0  00000000 00000000 000003ff 00000000  ................
ffffe000`a66026b0  ffffffff 0000000f 00000001 00000000  ................
ffffe000`a66026c0  a673a4d0 ffffe000 00000000 00000000  ..s.............
ffffe000`a66026d0  a91e96e0 ffffe000 00000000 00000000  ................
ffffe000`a66026e0  02050009 4d52564e 7859724f c7cb8820  ....NVRMOrYx ...
ffffe000`a66026f0  a6780df0 ffffe000 fc7b0000 0000000f  ..x.......{.....
ffffe000`a6602700  fc7cdfff 0000000f 00000001 00000000  ..|.............
ffffe000`a6602710  a6429720 ffffe000 00000000 00000000   .B.............
ffffe000`a6602720  00000000 00000000 00000000 00000000  ................
ffffe000`a6602730  020b0005 4d52564e 7859739f c7cb8820  ....NVRM.sYx ... [COLOR=#800080]//Current allocation[/COLOR]
ffffe000`a6602740  00000000 00000000 a89713e0 ffffe000  ................
ffffe000`a6602750  00000002 00000000 00000008 00000040  ............@...
ffffe000`a6602760  00000040 00000000 00020000 00000000  @...............
ffffe000`a6602770  00000fff 00000000 00000000 00000000  ................
ffffe000`a6602780  00000000 00000000 00000000 00000000  ................
ffffe000`a6602790  00000000 dead0000 40001000 00800001  ...........@....
ffffe000`a66027a0  00000005 00800001 00000005 00000000  ................
ffffe000`a66027b0  00000000 00000000 c1d00001 ff010000  ................
ffffe000`a66027c0  00000000 00000000 00000000 00000000  ................
ffffe000`a66027d0  00000000 00000005 00000000 00000002  ................
ffffe000`a66027e0  0211000b 4d52564e 7859734f c7cb8820  ....NVRMOsYx ...
ffffe000`a66027f0  c1d006b1 caf00061 ff020000 000050a0  ....a........P..
ffffe000`a6602800  00040000 00000000 4c44444d 00000000  ........MDDL....
ffffe000`a6602810  a90f7010 ffffe000 a64841a0 ffffe000  .p.......AH.....
ffffe000`a6602820  00000001 00000000 a6602828 ffffe000  ........((`.....
ffffe000`a6602830  a6602828 ffffe000 00000000 00000000  ((`.............
ffffe000`a6602840  00000000 00000000 00000000 00000000  ................
ffffe000`a6602850  00000000 00000000 00000000 00000000  ................
ffffe000`a6602860  00000000 00000000 00000000 00000000  ................
ffffe000`a6602870  00000000 00000000 a66027f0 ffffe000  .........'`.....
ffffe000`a6602880  caf00061 00000000 caf00061 00000000  a.......a.......

2: kd> dc ffffe000`a6202790 ffffe000`a6202890
ffffe000`a6202790  b0695010 ffffc000 b0695010 ffffc000  .Pi......Pi.....
ffffe000`a62027a0  a62027a0 ffffe000 a62027a0 ffffe000  .' ......' .....
ffffe000`a62027b0  a62027b0 ffffe000 a62027b0 ffffe000  .' ......' .....
ffffe000`a62027c0  a62027c0 ffffe000 a62027c0 ffffe000  .' ......' .....
ffffe000`a62027d0  a62027d0 ffffe000 a62027d0 ffffe000  .' ......' .....
ffffe000`a62027e0  a62027e0 ffffe000 a62027e0 ffffe000  .' ......' .....
ffffe000`a62027f0  a62027f0 ffffe000 a62027f0 ffffe000  .' ......' .....
ffffe000`a6202800  a6202800 ffffe000 a6202800 ffffe000  .( ......( .....
ffffe000`a6202810  a6202810 ffffe000 a6202810 ffffe000  .( ......( .....
ffffe000`a6202820  a6202820 ffffe000 a6202820 ffffe000   ( ..... ( .....
ffffe000`a6202830  a6202830 ffffe000 a6202830 ffffe000  0( .....0( .....
ffffe000`a6202840  a6202840 ffffe000 a6202840 ffffe000  @( .....@( .....
ffffe000`a6202850  a6202850 ffffe000 a6202850 ffffe000  P( .....P( .....
ffffe000`a6202860  a6202860 ffffe000 a6202860 ffffe000  `( .....`( .....
ffffe000`a6202870  a6202870 ffffe000 a6202870 ffffe000  p( .....p( .....
ffffe000`a6202880  a6202880 ffffe000 a6202880 ffffe000  .( ......( .....

[COLOR=#800080]//Freed memory, waiting to be zeroed by the memory manager[/COLOR]

2: kd> !pool ffffe000`a6202790
Pool page ffffe000a6202790 region is Unknown
*ffffe000a6200000 : large page allocation, Tag is Pool, size is 0x5640 bytes
        Pooltag Pool : Pool tables, etc.
[COLOR=#800080]
//The flink is correct, large pool allocation, pool free list[/COLOR]

Special Pool should help, enable it in Driver Verifier.
 

My Computer

System One

  • OS
    Windows 7
You must log in or register to reply here.
Back
Top