Solved BSOD Windows 8.1 laptops - RDR_FILE_SYSTEM (27)

mcgeezer

New Member
Messages
9
Hi,

First of all apologies but due to security restrictions with the affected laptops I'm not allowed to run executables against them.

I have however, pulled the full memory dump (memory.dmp) and minidumps.

On or around 6 July many of our corporate Windows 8.1 laptops and surface pro's have started randomly BSOD. We initially thought that this could be a missing patch issue but we have subsequently installed all the latest patches and firmware updates to the affected devices. Some devices do not exhibit the problem and I suspect this is because they have came from a slightly different build version.

I've ran an initial analysis of the memory dump to see if there was anything that I could pick out with regard to faultly software but it looks like the failing module is always in mup.sys. These devices are all failing with the same problem, are all connected via Direct Access and are Domain joined.

If anyone can shed any light as to what the problem might be I would be most grateful.
If I need to get any more info to aid in the debugging then I can, if needed I may be able to get authorisation to run the dm_logging utility.

Code:
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


Use !analyze -v to get detailed debugging information.


BugCheck 27, {baad0073, ffffd00023491518, ffffd00023490d20, fffff800456f3be2}


***** Kernel symbols are WRONG. Please fix symbols to do analysis.


*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*** WARNING: Unable to verify timestamp for mup.sys
*** ERROR: Module load completed but symbols could not be loaded for mup.sys
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
Probably caused by : mup.sys ( mup+130d )


Followup: MachineOwner
---------


2: kd> .reload
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
..................................................
2: kd> !analyze -v
ERROR: FindPlugIns 8007007b
ERROR: Some plugins may not be available [8007007b]
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


RDR_FILE_SYSTEM (27)
    If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
    exception record and context record. Do a .cxr on the 3rd parameter and then kb to
    obtain a more informative stack trace.
    The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
    as follows:
     RDBSS_BUG_CHECK_CACHESUP  = 0xca550000,
     RDBSS_BUG_CHECK_CLEANUP   = 0xc1ee0000,
     RDBSS_BUG_CHECK_CLOSE     = 0xc10e0000,
     RDBSS_BUG_CHECK_NTEXCEPT  = 0xbaad0000,
Arguments:
Arg1: 00000000baad0073
Arg2: ffffd00023491518
Arg3: ffffd00023490d20
Arg4: fffff800456f3be2


Debugging Details:
------------------


*** WARNING: Unable to verify timestamp for sk.sys
*** ERROR: Module load completed but symbols could not be loaded for sk.sys


EXCEPTION_RECORD:  ffffd00023491518 -- (.exr 0xffffd00023491518)
ExceptionAddress: fffff800456f3be2 (nt!FsRtlLookupPerFileObjectContext+0x0000000000000056)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 00000000001f82e0
Attempt to read from address 00000000001f82e0


CONTEXT:  ffffd00023490d20 -- (.cxr 0xffffd00023490d20)
rax=0000000000000000 rbx=00000000001f82c0 rcx=ffffe0008fa83a70
rdx=ffffe000873c3b30 rsi=ffffe0008f8a6330 rdi=ffffe0008fa83a70
rip=fffff800456f3be2 rsp=ffffd00023491750 rbp=ffffe000873c3b30
 r8=0000000000000000  r9=ffffd0006b398180 r10=fffff8009d9b4800
r11=fffff78000000008 r12=ffffe0008de70010 r13=ffffc00049acedd0
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010203
nt!FsRtlLookupPerFileObjectContext+0x56:
fffff800`456f3be2 488b5b20        mov     rbx,qword ptr [rbx+20h] ds:002b:00000000`001f82e0=????????????????
Resetting default scope


CUSTOMER_CRASH_COUNT:  1


DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT


PROCESS_NAME:  svchost.exe


CURRENT_IRQL:  0


ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.


EXCEPTION_PARAMETER1:  0000000000000000


EXCEPTION_PARAMETER2:  00000000001f82e0


READ_ADDRESS: fffff800458d1c60: Unable to get special pool info
fffff800458d1c60: Unable to get special pool info
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 00000000001f82e0 


FOLLOWUP_IP: 
mup!MupFindFileContext+1d
fffff800`9ca7930d 4885c0          test    rax,rax


FAULTING_IP: 
nt!FsRtlLookupPerFileObjectContext+56
fffff800`456f3be2 488b5b20        mov     rbx,qword ptr [rbx+20h]


BUGCHECK_STR:  0x27


LAST_CONTROL_TRANSFER:  from fffff8009ca7930d to fffff800456f3be2


STACK_TEXT:  
ffffd000`23491750 fffff800`9ca7930d : 00000000`00000000 ffffc000`49acec50 ffffe000`8f8a6330 ffffc000`49acec50 : nt!FsRtlLookupPerFileObjectContext+0x56
ffffd000`23491790 fffff800`9ca89a70 : 00000000`00000000 ffffc000`4a9fdb00 ffffd000`234919e0 ffffc000`49acec50 : mup!MupFindFileContext+0x1d
ffffd000`234917d0 fffff800`9d9ee86e : ffffc000`49aced08 ffffd000`234919e0 ffffd000`234919e0 ffffc000`4a9fdb00 : mup!MupSurrogateCloneProvider+0x1c
ffffd000`23491800 fffff800`9d9ed621 : ffffe000`8de70010 00000000`00000000 ffffe000`91896500 ffffe000`8de70010 : rdbss!RxMigrationPerFcbFinishMigrationCallback+0x4ea
ffffd000`234918f0 fffff800`9d9ef1c2 : ffffe000`8894ee90 ffffd000`23491a70 ffffd000`23491a08 ffffd000`23491a08 : rdbss!RxIterateOnFcbs+0xc9
ffffd000`23491970 fffff800`9d9eeb7e : ffffe000`8de70010 ffffe000`8894ee90 ffffe000`8894ee90 ffffe000`00000001 : rdbss!RxPerformSingleLogicalViewMigration+0x5fa
ffffd000`23491ad0 fffff800`9d9e4480 : 00000000`00000000 ffffd000`23491c10 ffffe000`8894ee90 ffffe000`8de70010 : rdbss!RxPerformLogicalViewMigration+0x5e
ffffd000`23491b10 fffff800`9d9c3bec : ffffe000`8856f030 ffffe000`95ae4a01 ffffd000`23491d10 ffffd000`23491e58 : rdbss!RxFindOrConstructLogicalView+0x17740
ffffd000`23491c70 fffff800`9d9ed430 : ffffe000`8de70000 ffffe000`8deab3c0 ffffd000`23491e58 fffff800`9d9b4004 : rdbss!RxFindOrConstructVirtualNetRoot+0xa0c
ffffd000`23491dd0 fffff800`9d9c5d96 : 00000000`00000000 ffffd000`23491e90 00000000`00000000 ffffe000`8de70010 : rdbss!RxFindOrConstructVirtualNetRootWithRetry+0xb0
ffffd000`23491e20 fffff800`9d9c4fe7 : ffffe000`8deab520 ffffe000`8deab3c0 ffffe000`8f8a6330 fffff800`9d9bfe04 : rdbss!RxCanonicalizeNameAndObtainNetRoot+0x2d6
ffffd000`23491eb0 fffff800`9d98fcea : ffffe000`8de70010 00000000`00000000 ffffe000`8deab3c0 00007ff6`ee8e0000 : rdbss!RxCommonCreate+0xf7
ffffd000`23491f60 fffff800`9d9c028d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : rdbss!RxFsdCommonDispatch+0x4fa
ffffd000`234920e0 fffff800`9f1a61b3 : 00000000`00000000 ffffe000`8deab301 ffffe000`8deab3c0 fffff800`9ca7f018 : rdbss!RxFsdDispatch+0xed
ffffd000`23492150 fffff800`9ca814c5 : 00000000`00000000 ffffe000`8deab3c0 ffffe000`95d84010 ffffc000`2f69cc90 : mrxsmb!MRxSmbFsdDispatch+0x83
ffffd000`23492190 fffff800`9ca816a2 : ffffc000`2f69cc90 fffff800`9ca78000 ffffd000`23492300 ffffe000`8dffe870 : mup!MupiCallUncProvider+0x1b5
ffffd000`23492200 fffff800`9ca81c8a : 00000000`00000000 ffffd000`23492300 ffffe000`8dffe870 ffffd000`234922c0 : mup!MupStateMachine+0xd2
ffffd000`23492240 fffff800`9c59fb1e : ffffe000`8fb9c010 ffffe000`95d84010 ffffe000`8dffe870 00000000`00000000 : mup!MupCreate+0x166
ffffd000`234922b0 fffff800`9c5c8349 : ffffd000`23492390 ffffe000`8fb9c010 ffffe000`8deab3c0 ffffe000`873c37c0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2ce
ffffd000`23492350 fffff800`9c97d9da : ffffe000`00000000 ffffe000`8deab3c0 ffffe000`8f8a6300 00000000`00000000 : fltmgr!FltpCreate+0x339
ffffd000`23492400 ffffe000`00000000 : ffffe000`8deab3c0 ffffe000`8f8a6300 00000000`00000000 ffffe000`87353d90 : sk+0x659da
ffffd000`23492408 ffffe000`8deab3c0 : ffffe000`8f8a6300 00000000`00000000 ffffe000`87353d90 fffff800`9c97253a : 0xffffe000`00000000
ffffd000`23492410 ffffe000`8f8a6300 : 00000000`00000000 ffffe000`87353d90 fffff800`9c97253a ffffe000`8deab3c0 : 0xffffe000`8deab3c0
ffffd000`23492418 00000000`00000000 : ffffe000`87353d90 fffff800`9c97253a ffffe000`8deab3c0 00000000`00000000 : 0xffffe000`8f8a6300




SYMBOL_STACK_INDEX:  1


SYMBOL_NAME:  mup!MupFindFileContext+1d


FOLLOWUP_NAME:  MachineOwner


MODULE_NAME: mup


IMAGE_NAME:  mup.sys


DEBUG_FLR_IMAGE_TIMESTAMP:  54b0e145


STACK_COMMAND:  .cxr 0xffffd00023490d20 ; kb


BUCKET_ID_FUNC_OFFSET:  1d


FAILURE_BUCKET_ID:  0x27_mup!MupFindFileContext


BUCKET_ID:  0x27_mup!MupFindFileContext


Followup: MachineOwner
---------


2: kd> !process 0 0 
**** NT ACTIVE PROCESS DUMP ****
GetPointerFromAddress: unable to read from fffff8004596e000
Error in reading nt!_EPROCESS at 0000000000000000
2: kd> lm kv m mup.sys
start             end                 module name
2: kd> !process
GetPointerFromAddress: unable to read from fffff8004596e000
Unable to get LeftChild of nt!_MMVAD_SHORT at ffffe0008d1c2830
failed to count VADs
PROCESS ffffe0008b970900
    SessionId: none  Cid: 0194    Peb: 7ff6eea17000  ParentCid: 02c0
    DirBase: 11d2f5000  ObjectTable: ffffc00032a663c0  HandleCount: <Data Not Accessible>
    Image: svchost.exe
    VadRoot ffffe0008d1c2830 Vads 0 Clone 0 Private 7917. Modified 92121. Locked 4.
    DeviceMap ffffc0002f60c220
    Token                             ffffc00032aac060
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
fffff78000000000: Unable to get shared data
    ElapsedTime                       00:00:00.000
    UserTime                          00:00:00.000
    KernelTime                        00:00:00.000
    QuotaPoolUsage[PagedPool]         263184
    QuotaPoolUsage[NonPagedPool]      47136
    Working Set Sizes (now,min,max)  (12915, 50, 345) (51660KB, 200KB, 1380KB)
    PeakWorkingSetSize                26025
    VirtualSize                       2101392 Mb
    PeakVirtualSize                   2101437 Mb
    PageFaultCount                    3735794
    MemoryPriority                    BACKGROUND
    BasePriority                      8
    CommitCharge                      9059


        *** Error in reading nt!_ETHREAD @ ffffe0008bb62080


2: kd> kv
Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffffd000`23490488 fffff800`9d9a316d : 00000000`00000027 00000000`baad0073 ffffd000`23491518 ffffd000`23490d20 : nt!KeBugCheckEx
ffffd000`23490490 fffff800`9d99bf9f : fffff800`9d9ac9a4 ffffd000`23491f60 00000000`00000000 00000000`00000000 : rdbss!RxExceptionFilter+0xed
ffffd000`234904e0 fffff800`4574ab26 : 00000000`00000000 ffffd000`234908f0 ffffe000`8ba0d070 ffffd000`234908f0 : rdbss!RxFsdCommonDispatch$filt$0+0x18
ffffd000`23490550 fffff800`9d99bd5e : fffff800`9d9ac9b4 ffffd000`23491518 ffffd000`23491f60 00000000`00000000 : nt!_C_specific_handler+0x86
ffffd000`234905c0 fffff800`45762eed : 00000000`00000000 ffffd000`23490720 ffffd000`23491518 00000000`00000000 : rdbss!_GSHandlerCheck_SEH+0x76
ffffd000`234905f0 fffff800`456c9b25 : 00000000`00000001 fffff800`9d98e000 ffffd000`23491500 fffff800`00000000 : nt!RtlpExecuteHandlerForException+0xd
ffffd000`23490620 fffff800`456cdede : ffffd000`23491518 ffffd000`23491220 ffffd000`23491518 ffffe000`8fa83a70 : nt!RtlDispatchException+0x1a5
ffffd000`23490cf0 fffff800`457675c2 : ffffe000`88634880 ffffd000`23491480 00000000`00000000 fffff800`45675897 : nt!KiDispatchException+0x646
ffffd000`234913e0 fffff800`45765d14 : 00000000`00000000 00000000`001f82c0 ffffe000`8bdd4700 fffff800`9d9b4a00 : nt!KiExceptionDispatch+0xc2
ffffd000`234915c0 fffff800`456f3be2 : ffffe000`00000082 ffffc000`00000082 ffffd000`234919e0 ffffc000`40d6c770 : nt!KiPageFault+0x214 (TrapFrame @ ffffd000`234915c0)
ffffd000`23491750 fffff800`9ca7930d : 00000000`00000000 ffffc000`49acec50 ffffe000`8f8a6330 ffffc000`49acec50 : nt!FsRtlLookupPerFileObjectContext+0x56
ffffd000`23491790 fffff800`9ca89a70 : 00000000`00000000 ffffc000`4a9fdb00 ffffd000`234919e0 ffffc000`49acec50 : mup!MupFindFileContext+0x1d
ffffd000`234917d0 fffff800`9d9ee86e : ffffc000`49aced08 ffffd000`234919e0 ffffd000`234919e0 ffffc000`4a9fdb00 : mup!MupSurrogateCloneProvider+0x1c
ffffd000`23491800 fffff800`9d9ed621 : ffffe000`8de70010 00000000`00000000 ffffe000`91896500 ffffe000`8de70010 : rdbss!RxMigrationPerFcbFinishMigrationCallback+0x4ea
ffffd000`234918f0 fffff800`9d9ef1c2 : ffffe000`8894ee90 ffffd000`23491a70 ffffd000`23491a08 ffffd000`23491a08 : rdbss!RxIterateOnFcbs+0xc9
ffffd000`23491970 fffff800`9d9eeb7e : ffffe000`8de70010 ffffe000`8894ee90 ffffe000`8894ee90 ffffe000`00000001 : rdbss!RxPerformSingleLogicalViewMigration+0x5fa
ffffd000`23491ad0 fffff800`9d9e4480 : 00000000`00000000 ffffd000`23491c10 ffffe000`8894ee90 ffffe000`8de70010 : rdbss!RxPerformLogicalViewMigration+0x5e
ffffd000`23491b10 fffff800`9d9c3bec : ffffe000`8856f030 ffffe000`95ae4a01 ffffd000`23491d10 ffffd000`23491e58 : rdbss!RxFindOrConstructLogicalView+0x17740
ffffd000`23491c70 fffff800`9d9ed430 : ffffe000`8de70000 ffffe000`8deab3c0 ffffd000`23491e58 fffff800`9d9b4004 : rdbss!RxFindOrConstructVirtualNetRoot+0xa0c
ffffd000`23491dd0 fffff800`9d9c5d96 : 00000000`00000000 ffffd000`23491e90 00000000`00000000 ffffe000`8de70010 : rdbss!RxFindOrConstructVirtualNetRootWithRetry+0xb0
ffffd000`23491e20 fffff800`9d9c4fe7 : ffffe000`8deab520 ffffe000`8deab3c0 ffffe000`8f8a6330 fffff800`9d9bfe04 : rdbss!RxCanonicalizeNameAndObtainNetRoot+0x2d6
ffffd000`23491eb0 fffff800`9d98fcea : ffffe000`8de70010 00000000`00000000 ffffe000`8deab3c0 00007ff6`ee8e0000 : rdbss!RxCommonCreate+0xf7
ffffd000`23491f60 fffff800`9d9c028d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : rdbss!RxFsdCommonDispatch+0x4fa
ffffd000`234920e0 fffff800`9f1a61b3 : 00000000`00000000 ffffe000`8deab301 ffffe000`8deab3c0 fffff800`9ca7f018 : rdbss!RxFsdDispatch+0xed
ffffd000`23492150 fffff800`9ca814c5 : 00000000`00000000 ffffe000`8deab3c0 ffffe000`95d84010 ffffc000`2f69cc90 : mrxsmb!MRxSmbFsdDispatch+0x83
ffffd000`23492190 fffff800`9ca816a2 : ffffc000`2f69cc90 fffff800`9ca78000 ffffd000`23492300 ffffe000`8dffe870 : mup!MupiCallUncProvider+0x1b5
ffffd000`23492200 fffff800`9ca81c8a : 00000000`00000000 ffffd000`23492300 ffffe000`8dffe870 ffffd000`234922c0 : mup!MupStateMachine+0xd2
ffffd000`23492240 fffff800`9c59fb1e : ffffe000`8fb9c010 ffffe000`95d84010 ffffe000`8dffe870 00000000`00000000 : mup!MupCreate+0x166
ffffd000`234922b0 fffff800`9c5c8349 : ffffd000`23492390 ffffe000`8fb9c010 ffffe000`8deab3c0 ffffe000`873c37c0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2ce
ffffd000`23492350 fffff800`9c97d9da : ffffe000`00000000 ffffe000`8deab3c0 ffffe000`8f8a6300 00000000`00000000 : fltmgr!FltpCreate+0x339
ffffd000`23492400 ffffe000`00000000 : ffffe000`8deab3c0 ffffe000`8f8a6300 00000000`00000000 ffffe000`87353d90 : sk+0x659da
ffffd000`23492408 ffffe000`8deab3c0 : ffffe000`8f8a6300 00000000`00000000 ffffe000`87353d90 fffff800`9c97253a : 0xffffe000`00000000
ffffd000`23492410 ffffe000`8f8a6300 : 00000000`00000000 ffffe000`87353d90 fffff800`9c97253a ffffe000`8deab3c0 : 0xffffe000`8deab3c0
ffffd000`23492418 00000000`00000000 : ffffe000`87353d90 fffff800`9c97253a ffffe000`8deab3c0 00000000`00000000 : 0xffffe000`8f8a6300
2: kd> r
rax=fffff800456f3be2 rbx=00000000c0000005 rcx=0000000000000027
rdx=00000000baad0073 rsi=ffffe0008de70010 rdi=ffffd00023490580
rip=fffff8004575b9a0 rsp=ffffd00023490488 rbp=fffff8009d9b4010
 r8=ffffd00023491518  r9=ffffd00023490d20 r10=ffffd00023490d20
r11=ffffd000234904d8 r12=ffffd00023491f60 r13=ffffd00023491518
r14=ffffd000234906a0 r15=fffff8009d98e000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
nt!KeBugCheckEx:
fffff800`4575b9a0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffd000`23490490=2700000000000000
2: kd> lmtn
start             end                 module name
fffff800`43d2b000 fffff800`43d34000   kd       kd.dll       Thu Aug 22 12:40:43 2013 (5215F8BB)
fffff800`4560b000 fffff800`45d9f000   nt       ntkrnlmp.exe Sat Jan 10 06:13:11 2015 (54B0C2F7)
fffff800`45d9f000 fffff800`45e0f000   hal      hal.dll      Sun Jun 01 23:49:12 2014 (538BADE8)
fffff800`9ba00000 fffff800`9ba6a000   usbhub   usbhub.sys   Thu Jul 24 12:45:29 2014 (53D0F1D9)
fffff800`9ba71000 fffff800`9baee000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Fri Jul 04 13:59:36 2014 (53B6A538)
fffff800`9baee000 fffff800`9bafc000   werkernel werkernel.sys Thu Aug 22 12:40:24 2013 (5215F8A8)
fffff800`9bafc000 fffff800`9bb5d000   CLFS     CLFS.SYS     Wed Mar 19 08:12:20 2014 (53295164)
fffff800`9bb5d000 fffff800`9bb7f000   tm       tm.sys       Thu Aug 22 12:39:33 2013 (5215F875)
fffff800`9bb7f000 fffff800`9bb94000   PSHED    PSHED.dll    Sat Sep 14 14:57:19 2013 (52346B3F)
fffff800`9bb94000 fffff800`9bb9e000   BOOTVID  BOOTVID.dll  Thu Aug 22 12:40:26 2013 (5215F8AA)
fffff800`9bc00000 fffff800`9bc4c000   netbt    netbt.sys    Thu Aug 22 12:37:01 2013 (5215F7DD)
fffff800`9bc53000 fffff800`9bcdb000   CI       CI.dll       Sat Feb 22 12:12:12 2014 (5308941C)
fffff800`9bcdb000 fffff800`9bd38000   msrpc    msrpc.sys    Thu Aug 22 12:39:22 2013 (5215F86A)
fffff800`9bd38000 fffff800`9bd80000   pci      pci.sys      Thu Jul 24 12:45:24 2014 (53D0F1D4)
fffff800`9bd80000 fffff800`9bddf000   volmgrx  volmgrx.sys  Thu Aug 22 12:40:23 2013 (5215F8A7)
fffff800`9be00000 fffff800`9be88000   ACPI     ACPI.sys     Tue Oct 07 04:29:50 2014 (54335E2E)
fffff800`9be88000 fffff800`9be92000   WMILIB   WMILIB.SYS   Thu Aug 22 12:40:23 2013 (5215F8A7)
fffff800`9be92000 fffff800`9be9c000   msisadrv msisadrv.sys Thu Aug 22 12:39:03 2013 (5215F857)
fffff800`9beb9000 fffff800`9bf88000   Wdf01000 Wdf01000.sys Thu Aug 22 12:38:56 2013 (5215F850)
fffff800`9bf88000 fffff800`9bf99000   WDFLDR   WDFLDR.SYS   Thu Aug 22 12:39:03 2013 (5215F857)
fffff800`9bf99000 fffff800`9bfb1000   acpiex   acpiex.sys   Thu Aug 22 12:37:47 2013 (5215F80B)
fffff800`9bfb1000 fffff800`9bfbc000   WppRecorder WppRecorder.sys Thu Aug 22 12:39:40 2013 (5215F87C)
fffff800`9bfbc000 fffff800`9bffe000   MpFilter MpFilter.sys Thu Jul 10 03:43:06 2014 (53BDFDBA)
fffff800`9c000000 fffff800`9c069000   spaceport spaceport.sys Wed Oct 29 02:47:03 2014 (54505527)
fffff800`9c069000 fffff800`9c07e000   volmgr   volmgr.sys   Thu Aug 22 12:39:53 2013 (5215F889)
fffff800`9c07e000 fffff800`9c099000   mountmgr mountmgr.sys Tue Oct 07 02:18:16 2014 (54333F58)
fffff800`9c0d1000 fffff800`9c15c000   cng      cng.sys      Wed Oct 29 02:46:55 2014 (5450551F)
fffff800`9c15c000 fffff800`9c188000   tpm      tpm.sys      Thu Aug 22 12:37:21 2013 (5215F7F1)
fffff800`9c193000 fffff800`9c1a0000   vdrvroot vdrvroot.sys Thu Aug 22 12:38:49 2013 (5215F849)
fffff800`9c1a0000 fffff800`9c1bc000   pdc      pdc.sys      Wed Oct 15 05:34:24 2014 (543DF950)
fffff800`9c1bc000 fffff800`9c1d4000   partmgr  partmgr.sys  Wed Oct 08 08:34:42 2014 (5434E912)
fffff800`9c200000 fffff800`9c216000   fileinfo fileinfo.sys Sat Feb 22 12:13:10 2014 (53089456)
fffff800`9c216000 fffff800`9c241000   Wof      Wof.sys      Thu Mar 13 08:27:29 2014 (53216BF1)
fffff800`9c241000 fffff800`9c260000   HIDCLASS HIDCLASS.SYS Thu Mar 06 09:24:40 2014 (53183ED8)
fffff800`9c26b000 fffff800`9c525000   iaStorA  iaStorA.sys  Wed Aug 28 23:13:22 2013 (521E7602)
fffff800`9c525000 fffff800`9c583000   storport storport.sys Thu Sep 25 03:47:07 2014 (5423822B)
fffff800`9c583000 fffff800`9c59d000   EhStorClass EhStorClass.sys Thu Aug 22 12:38:15 2013 (5215F827)
fffff800`9c59d000 fffff800`9c5f9000   fltmgr   fltmgr.sys   Tue Aug 26 03:25:16 2014 (53FBF00C)
fffff800`9c600000 fffff800`9c646000   rdyboost rdyboost.sys Sat Feb 22 12:13:40 2014 (53089474)
fffff800`9c646000 fffff800`9c662000   disk     disk.sys     Thu Aug 22 12:39:47 2013 (5215F883)
fffff800`9c662000 fffff800`9c6b8000   CLASSPNP CLASSPNP.SYS Wed Oct 08 06:22:07 2014 (5434C9FF)
fffff800`9c6b8000 fffff800`9c6cd000   crashdmp crashdmp.sys Thu Aug 22 12:40:03 2013 (5215F893)
fffff800`9c6e7000 fffff800`9c8e1000   Ntfs     Ntfs.sys     Sat Oct 11 01:35:55 2014 (54387B6B)
fffff800`9c8e1000 fffff800`9c8fd000   ksecdd   ksecdd.sys   Wed Oct 29 02:47:36 2014 (54505548)
fffff800`9c8fd000 fffff800`9c90d000   pcw      pcw.sys      Thu Aug 22 09:46:34 2013 (5215CFEA)
fffff800`9c90d000 fffff800`9c918000   Fs_Rec   Fs_Rec.sys   Thu Aug 22 09:46:33 2013 (5215CFE9)
fffff800`9c918000 fffff800`9c9cb000   sk       sk.sys       Fri Sep 20 14:04:23 2013 (523C47D7)
fffff800`9c9cb000 fffff800`9c9e9000   intelppm intelppm.sys Thu Aug 22 09:46:35 2013 (5215CFEB)
fffff800`9ca00000 fffff800`9ca78000   NETIO    NETIO.SYS    Mon Nov 10 02:58:13 2014 (546029C5)
fffff800`9ca78000 fffff800`9ca98000   mup      mup.sys      Sat Jan 10 08:22:29 2015 (54B0E145)
fffff800`9caa6000 fffff800`9cbbd000   ndis     ndis.sys     Sat Oct 11 01:35:46 2014 (54387B62)
fffff800`9cbbd000 fffff800`9cbed000   ksecpkg  ksecpkg.sys  Wed Oct 29 02:46:30 2014 (54505506)
fffff800`9cc00000 fffff800`9cc95000   fvevol   fvevol.sys   Mon Apr 07 23:25:31 2014 (534325DB)
fffff800`9cc95000 fffff800`9cf01000   tcpip    tcpip.sys    Mon Nov 10 02:59:03 2014 (546029F7)
fffff800`9cf01000 fffff800`9cf6d000   fwpkclnt fwpkclnt.sys Mon Nov 10 02:57:40 2014 (546029A4)
fffff800`9cf6d000 fffff800`9cf92000   wfplwfs  wfplwfs.sys  Mon Nov 10 02:57:28 2014 (54602998)
fffff800`9cf92000 fffff800`9cfe1000   volsnap  volsnap.sys  Wed Jun 18 23:41:28 2014 (53A21598)
fffff800`9cfe1000 fffff800`9cff0000   intelpep intelpep.sys Wed Oct 15 07:29:44 2014 (543E1458)
fffff800`9d200000 fffff800`9d263000   dxgmms1  dxgmms1.sys  Wed Oct 29 02:46:30 2014 (54505506)
fffff800`9d263000 fffff800`9d26f000   mssmbios mssmbios.sys Thu Aug 22 12:39:41 2013 (5215F87D)
fffff800`9d26f000 fffff800`9d296000   dfsc     dfsc.sys     Sat Jan 10 08:20:53 2015 (54B0E0E5)
fffff800`9d296000 fffff800`9d550000   dump_iaStorA dump_iaStorA.sys Wed Aug 28 23:13:22 2013 (521E7602)
fffff800`9d56d000 fffff800`9d577000   WirelessButtonDriver64 WirelessButtonDriver64.sys Thu Aug 30 04:11:29 2012 (503ED9E1)
fffff800`9d57e000 fffff800`9d595000   ahcache  ahcache.sys  Thu Aug 22 12:39:54 2013 (5215F88A)
fffff800`9d59b000 fffff800`9d5a4000   Null     Null.SYS     Thu Aug 22 12:40:24 2013 (5215F8A8)
fffff800`9d5a4000 fffff800`9d5ac000   Beep     Beep.SYS     Thu Aug 22 12:40:24 2013 (5215F8A8)
fffff800`9d5ac000 fffff800`9d5c1f00   ctxusbm  ctxusbm.sys  Mon Sep 09 17:02:22 2013 (522DF10E)
fffff800`9d5c2000 fffff800`9d5d0000   BasicRender BasicRender.sys Sat Feb 22 12:14:02 2014 (5308948A)
fffff800`9d5d0000 fffff800`9d5df000   CompositeBus CompositeBus.sys Thu Aug 22 12:38:48 2013 (5215F848)
fffff800`9d5df000 fffff800`9d5ea000   kdnic    kdnic.sys    Thu Aug 22 12:38:26 2013 (5215F832)
fffff800`9d5ea000 fffff800`9d5fb000   umbus    umbus.sys    Thu Aug 22 12:38:59 2013 (5215F853)
fffff800`9d600000 fffff800`9d620000   tdx      tdx.sys      Thu Aug 22 12:36:34 2013 (5215F7C2)
fffff800`9d620000 fffff800`9d62e000   TDI      TDI.SYS      Thu Aug 22 12:39:01 2013 (5215F855)
fffff800`9d62e000 fffff800`9d635f00   HIDPARSE HIDPARSE.SYS Thu Aug 22 12:40:26 2013 (5215F8AA)
fffff800`9d636000 fffff800`9d7b6000   dxgkrnl  dxgkrnl.sys  Wed Oct 29 02:46:45 2014 (54505515)
fffff800`9d7b6000 fffff800`9d7c8000   watchdog watchdog.sys Sat Feb 22 12:14:39 2014 (530894AF)
fffff800`9d7c8000 fffff800`9d7da000   BasicDisplay BasicDisplay.sys Thu Aug 22 12:39:31 2013 (5215F873)
fffff800`9d7da000 fffff800`9d7ee000   Npfs     Npfs.SYS     Thu Aug 22 12:40:25 2013 (5215F8A9)
fffff800`9d7ee000 fffff800`9d7fa000   Msfs     Msfs.SYS     Thu Aug 22 12:40:24 2013 (5215F8A8)
fffff800`9d800000 fffff800`9d88e000   csc      csc.sys      Wed Oct 29 02:46:49 2014 (54505519)
fffff800`9d88e000 fffff800`9d89c000   nsiproxy nsiproxy.sys Wed Oct 29 02:46:03 2014 (545054EB)
fffff800`9d89c000 fffff800`9d8a8000   npsvctrig npsvctrig.sys Thu Aug 22 12:38:22 2013 (5215F82E)
fffff800`9d8a9000 fffff800`9d93b000   afd      afd.sys      Fri May 30 04:03:01 2014 (5387F4E5)
fffff800`9d93b000 fffff800`9d965000   pacer    pacer.sys    Wed Oct 29 02:45:30 2014 (545054CA)
fffff800`9d965000 fffff800`9d97d000   vwififlt vwififlt.sys Wed Apr 30 07:43:46 2014 (53609BA2)
fffff800`9d97d000 fffff800`9d98e000   netbios  netbios.sys  Wed Oct 29 02:47:23 2014 (5450553B)
fffff800`9d98e000 fffff800`9d9fc000   rdbss    rdbss.sys    Sat Jan 10 08:20:59 2015 (54B0E0EB)
fffff800`9da00000 fffff800`9da74000   e1d64x64 e1d64x64.sys Mon Sep 23 00:18:47 2013 (523F7AD7)
fffff800`9da74000 fffff800`9dae1000   RtsPer   RtsPer.sys   Wed Aug 21 08:23:24 2013 (52146AEC)
fffff800`9dae9000 fffff800`9df03000   igdkmd64 igdkmd64.sys Tue Oct 01 18:06:57 2013 (524B0131)
fffff800`9df03000 fffff800`9df1c000   HDAudBus HDAudBus.sys Thu Jul 24 12:45:39 2014 (53D0F1E3)
fffff800`9df1c000 fffff800`9df71000   USBXHCI  USBXHCI.SYS  Tue Oct 07 06:00:56 2014 (54337388)
fffff800`9df71000 fffff800`9dfaa000   fastfat  fastfat.SYS  Thu Aug 22 12:40:18 2013 (5215F8A2)
fffff800`9dfaa000 fffff800`9dfdc000   ucx01000 ucx01000.sys Tue Oct 07 06:00:55 2014 (54337387)
fffff800`9dfdc000 fffff800`9dff8000   TeeDriverx64 TeeDriverx64.sys Thu Sep 05 19:02:18 2013 (5228C72A)
fffff800`9e000000 fffff800`9e00b000   NdisVirtualBus NdisVirtualBus.sys Thu Aug 22 12:36:25 2013 (5215F7B9)
fffff800`9e00b000 fffff800`9e00c600   swenum   swenum.sys   Wed Oct 29 02:47:41 2014 (5450554D)
fffff800`9e00d000 fffff800`9e05b000   ks       ks.sys       Fri Jul 04 13:58:59 2014 (53B6A513)
fffff800`9e05b000 fffff800`9e067000   iwdbus   iwdbus.sys   Thu Sep 26 22:38:04 2013 (5244A93C)
fffff800`9e067000 fffff800`9e072000   rdpbus   rdpbus.sys   Thu Aug 22 12:38:52 2013 (5215F84C)
fffff800`9e0ad000 fffff800`9e434000   NETwbw02 NETwbw02.sys Thu Sep 19 08:40:12 2013 (523AAA5C)
fffff800`9e434000 fffff800`9e441000   vwifibus vwifibus.sys Thu Aug 22 12:39:00 2013 (5215F854)
fffff800`9e441000 fffff800`9e459000   usbehci  usbehci.sys  Sat May 31 07:29:54 2014 (538976E2)
fffff800`9e459000 fffff800`9e4c8000   USBPORT  USBPORT.SYS  Sat May 31 07:30:25 2014 (53897701)
fffff800`9e4c8000 fffff800`9e4e7000   i8042prt i8042prt.sys Tue Nov 04 06:54:54 2014 (5458783E)
fffff800`9e4e7000 fffff800`9e4f1000   ikbevent ikbevent.sys Wed Aug 07 00:41:35 2013 (520189AF)
fffff800`9e4f1000 fffff800`9e57d000   SynTP    SynTP.sys    Thu Jan 23 21:56:28 2014 (52E1900C)
fffff800`9e57d000 fffff800`9e589000   USBD     USBD.SYS     Sat May 31 07:31:17 2014 (53897735)
fffff800`9e589000 fffff800`9e59b000   kbdclass kbdclass.sys Tue Nov 04 06:54:54 2014 (5458783E)
fffff800`9e59b000 fffff800`9e5a6000   imsevent imsevent.sys Wed Aug 07 00:45:57 2013 (52018AB5)
fffff800`9e5a6000 fffff800`9e5b6000   mouclass mouclass.sys Tue Nov 04 06:54:47 2014 (54587837)
fffff800`9e5b6000 fffff800`9e5c3000   Smb_driver_Intel Smb_driver_Intel.sys Thu Jan 23 21:59:05 2014 (52E190A9)
fffff800`9e5c3000 fffff800`9e5c9380   CmBatt   CmBatt.sys   Thu Aug 22 12:39:43 2013 (5215F87F)
fffff800`9e5ca000 fffff800`9e5d6000   BATTC    BATTC.SYS    Thu Aug 22 12:40:04 2013 (5215F894)
fffff800`9e5d6000 fffff800`9e5e0000   wmiacpi  wmiacpi.sys  Thu Aug 22 12:40:04 2013 (5215F894)
fffff800`9e5e0000 fffff800`9e5f1000   ISCTD64  ISCTD64.sys  Tue Nov 27 19:52:34 2012 (50B51A02)
fffff800`9e5f1000 fffff800`9e5f8000   sk_ndis_wan sk_ndis_wan.sys Fri Sep 20 14:08:15 2013 (523C48BF)
fffff800`9e5f8000 fffff800`9e5ff000   sk_ndis  sk_ndis.sys  Fri Sep 20 14:08:15 2013 (523C48BF)
fffff800`9e600000 fffff800`9e673000   IntcDAud IntcDAud.sys Thu Aug 29 15:42:53 2013 (521F5DED)
fffff800`9e6cb000 fffff800`9e712000   portcls  portcls.sys  Wed Oct 29 02:46:35 2014 (5450550B)
fffff800`9e712000 fffff800`9e72e000   drmk     drmk.sys     Wed Oct 29 02:47:38 2014 (5450554A)
fffff800`9e72e000 fffff800`9e733300   ksthunk  ksthunk.sys  Thu Aug 22 12:39:31 2013 (5215F873)
fffff800`9e734000 fffff800`9e7c0000   stwrt64  stwrt64.sys  Thu Nov 07 06:12:44 2013 (527B2F5C)
fffff800`9e800000 fffff800`9e874000   nwifi    nwifi.sys    Wed Oct 29 02:45:41 2014 (545054D5)
fffff800`9e87a000 fffff800`9e8f2000   UsbHub3  UsbHub3.sys  Wed Oct 08 08:32:50 2014 (5434E8A2)
fffff800`9e8f2000 fffff800`9e919000   usbccgp  usbccgp.sys  Thu Jul 24 12:44:51 2014 (53D0F1B3)
fffff800`9e919000 fffff800`9e929000   condrv   condrv.sys   Thu Aug 22 12:40:17 2013 (5215F8A1)
fffff800`9e929000 fffff800`9e961000   mrxsmb20 mrxsmb20.sys Sat Jan 10 08:20:54 2015 (54B0E0E6)
fffff800`9e96f000 fffff800`9e991000   ibtusb   ibtusb.sys   Mon Oct 14 20:07:42 2013 (525C40FE)
fffff800`9e991000 fffff800`9e9dd000   mrxsmb10 mrxsmb10.sys Sat Jan 10 08:19:36 2015 (54B0E098)
fffff800`9ea00000 fffff800`9ea3d000   WUDFRd   WUDFRd.sys   Wed Oct 29 02:46:13 2014 (545054F5)
fffff800`9ea3d000 fffff800`9ea49000   dump_diskdump dump_diskdump.sys Thu Aug 22 12:40:18 2013 (5215F8A2)
fffff800`9ea49000 fffff800`9ea5f000   dump_dumpfve dump_dumpfve.sys Sat Feb 22 12:14:48 2014 (530894B8)
fffff800`9ea6d000 fffff800`9ea91000   luafv    luafv.sys    Sat Feb 22 12:14:25 2014 (530894A1)
fffff800`9ea91000 fffff800`9eab2000   WudfPf   WudfPf.sys   Wed Oct 29 02:46:27 2014 (54505503)
fffff800`9eab2000 fffff800`9eacb000   WinUsb   WinUsb.sys   Thu Aug 22 12:37:55 2013 (5215F813)
fffff800`9eacb000 fffff800`9eadf000   lltdio   lltdio.sys   Thu Aug 22 12:36:18 2013 (5215F7B2)
fffff800`9eadf000 fffff800`9eaf3000   ndisuio  ndisuio.sys  Thu Aug 22 12:37:34 2013 (5215F7FE)
fffff800`9eaf8000 fffff800`9ec50000   btmhsf   btmhsf.sys   Thu Sep 05 13:12:49 2013 (52287541)
fffff800`9ec50000 fffff800`9ec69000   BTHUSB   BTHUSB.sys   Wed Oct 29 02:46:16 2014 (545054F8)
fffff800`9ec69000 fffff800`9ed94000   bthport  bthport.sys  Wed Oct 29 02:45:37 2014 (545054D1)
fffff800`9ed94000 fffff800`9eddc000   wmbclass wmbclass.sys Fri Nov 01 09:06:50 2013 (52736F2A)
fffff800`9eddc000 fffff800`9edf4000   rspndr   rspndr.sys   Thu Aug 22 12:36:34 2013 (5215F7C2)
fffff800`9ee42000 fffff800`9efb2380   SPUVCbv_x64 SPUVCbv_x64.sys Mon Nov 04 03:03:56 2013 (52770E9C)
fffff800`9f000000 fffff800`9f01f000   NisDrvWFP NisDrvWFP.sys Thu Jul 10 03:43:47 2014 (53BDFDE3)
fffff800`9f031000 fffff800`9f12b000   HTTP     HTTP.sys     Mon Jan 27 19:48:02 2014 (52E6B7F2)
fffff800`9f12b000 fffff800`9f14b000   bowser   bowser.sys   Thu Aug 22 12:38:38 2013 (5215F83E)
fffff800`9f14b000 fffff800`9f162000   mpsdrv   mpsdrv.sys   Wed Oct 29 02:45:31 2014 (545054CB)
fffff800`9f162000 fffff800`9f1cf000   mrxsmb   mrxsmb.sys   Sat Jan 10 08:19:58 2015 (54B0E0AE)
fffff800`9f1cf000 fffff800`9f1ec000   Ndu      Ndu.sys      Wed Oct 29 02:45:16 2014 (545054BC)
fffff800`9f200000 fffff800`9f2ad000   srv2     srv2.sys     Wed Oct 08 08:33:30 2014 (5434E8CA)
fffff800`9f2ad000 fffff800`9f2da000   tunnel   tunnel.sys   Thu Aug 22 12:35:45 2013 (5215F791)
fffff800`9f2f4000 fffff800`9f39d000   peauth   peauth.sys   Sat Feb 22 12:09:37 2014 (53089381)
fffff800`9f39d000 fffff800`9f3a8000   secdrv   secdrv.SYS   Wed Sep 13 14:18:38 2006 (4508052E)
fffff800`9f3a8000 fffff800`9f3eb000   srvnet   srvnet.sys   Fri Jun 27 07:22:21 2014 (53AD0D9D)
fffff800`9f3eb000 fffff800`9f3fd000   tcpipreg tcpipreg.sys Thu Mar 06 09:19:59 2014 (53183DBF)
fffff800`9f600000 fffff800`9f61d900   usbaudio usbaudio.sys Fri Dec 13 07:24:20 2013 (52AAB624)
fffff800`9f61e000 fffff800`9f651f00   usbvideo usbvideo.sys Sat Jun 21 08:33:39 2014 (53A53553)
fffff800`9f652000 fffff800`9f65d000   prepdrv  prepdrv.sys  Wed Aug 03 13:56:26 2011 (4E39457A)
fffff800`9f66a000 fffff800`9f6f8000   srv      srv.sys      Thu Jul 24 12:43:27 2014 (53D0F15F)
fffff800`9f6f8000 fffff800`9f720000   mrxdav   mrxdav.sys   Thu Mar 06 09:22:04 2014 (53183E3C)
fffff800`9f725000 fffff800`9f730000   INETMON  INETMON.sys  Wed Mar 13 21:11:58 2013 (5140EB9E)
fffff800`9f730000 fffff800`9f746000   mslldp   mslldp.sys   Wed Oct 29 02:45:39 2014 (545054D3)
fffff800`9f746000 fffff800`9f751000   rdpvideominiport rdpvideominiport.sys Wed Oct 29 02:47:25 2014 (5450553D)
fffff800`9f751000 fffff800`9f785000   rdpdr    rdpdr.sys    Thu Aug 22 12:36:46 2013 (5215F7CE)
fffff800`9f785000 fffff800`9f794000   vwifimp  vwifimp.sys  Wed Apr 30 07:41:59 2014 (53609B37)
fffff800`9f794000 fffff800`9f7b7000   tsusbhub tsusbhub.sys Thu Aug 22 12:35:58 2013 (5215F79E)
fffff800`9f7b7000 fffff800`9f7c5000   monitor  monitor.sys  Thu Aug 22 12:36:37 2013 (5215F7C5)
fffff800`9f7c5000 fffff800`9f7d3000   hidusb   hidusb.sys   Thu Mar 06 09:24:14 2014 (53183EBE)
fffff800`9f7d3000 fffff800`9f7e1000   kbdhid   kbdhid.sys   Tue Nov 04 06:54:47 2014 (54587837)
fffff800`9f7e1000 fffff800`9f7ee000   mouhid   mouhid.sys   Tue Nov 04 06:54:47 2014 (54587837)
fffff960`000da000 fffff960`004f2000   win32k   win32k.sys   Tue Oct 07 04:29:46 2014 (54335E2A)
fffff960`00722000 fffff960`0072b000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff960`0090a000 fffff960`00944000   cdd      cdd.dll      unavailable (00000000)


Unloaded modules:
fffff800`9f2ad000 fffff800`9f2da000   tunnel.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0002D000
fffff800`9f65d000 fffff800`9f669000   hiber_storpo
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`9f8e9000 fffff800`9fba3000   hiber_iaStor
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`9fba3000 fffff800`9fbb9000   hiber_dumpfv
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`9f7f0000 fffff800`9f7fb000   prepdrv.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000B000
fffff800`9f2ad000 fffff800`9f2da000   tunnel.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0002D000
fffff800`9f63b000 fffff800`9f668000   tunnel.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0002D000
fffff800`9f62d000 fffff800`9f63b000   monitor.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff800`9e600000 fffff800`9e673000   IntcDAud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00073000
fffff800`9f600000 fffff800`9f62d000   tunnel.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0002D000
fffff800`9f63b000 fffff800`9f649000   hidusb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff800`9f649000 fffff800`9f657000   kbdhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff800`9f657000 fffff800`9f664000   mouhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000D000
fffff800`9f7b7000 fffff800`9f7d5000   usbaudio.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0001E000
fffff800`9f2ad000 fffff800`9f2e1000   usbvideo.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00034000
fffff800`9f62d000 fffff800`9f63b000   monitor.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff800`9f600000 fffff800`9f62d000   tunnel.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0002D000
fffff800`9f7d5000 fffff800`9f7e1000   hiber_storpo
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`9f840000 fffff800`9fafa000   hiber_iaStor
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`9fafa000 fffff800`9fb10000   hiber_dumpfv
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`9f600000 fffff800`9f62d000   tunnel.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0002D000
fffff800`9f649000 fffff800`9f657000   monitor.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff800`9f7b7000 fffff800`9f7e4000   tunnel.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0002D000
fffff800`9e600000 fffff800`9e673000   IntcDAud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00073000
fffff800`9f61c000 fffff800`9f649000   tunnel.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0002D000
fffff800`9f7b7000 fffff800`9f7c5000   hidusb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff800`9f7c5000 fffff800`9f7d2000   mouhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000D000
fffff800`9f2ad000 fffff800`9f2e1000   usbvideo.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00034000
fffff800`9f7d2000 fffff800`9f7f0000   usbaudio.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0001E000
fffff800`9f60e000 fffff800`9f61c000   kbdhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff800`9f600000 fffff800`9f60e000   monitor.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff800`9f63b000 fffff800`9f668000   tunnel.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0002D000
fffff800`9e658000 fffff800`9e6cb000   IntcDAud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00073000
fffff800`9f60e000 fffff800`9f63b000   tunnel.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0002D000
fffff800`9f7c3000 fffff800`9f7f0000   tunnel.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0002D000
fffff800`9efb3000 fffff800`9efc1000   hidusb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff800`9efc1000 fffff800`9eff5000   usbvideo.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00034000
fffff800`9ee00000 fffff800`9ee1e000   usbaudio.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0001E000
fffff800`9ee1e000 fffff800`9ee2c000   kbdhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff800`9ee2c000 fffff800`9ee39000   mouhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000D000
fffff800`9ea5f000 fffff800`9ea6d000   monitor.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff800`9f6f8000 fffff800`9f725000   tunnel.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0002D000
fffff800`9f7b7000 fffff800`9f7c3000   hiber_storpo
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`9f86f000 fffff800`9fb29000   hiber_iaStor
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`9fb29000 fffff800`9fb3f000   hiber_dumpfv
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`9cff0000 fffff800`9cffc000   dump_storpor
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff800`9d29d000 fffff800`9d557000   dump_iaStorA
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  002BA000
fffff800`9d557000 fffff800`9d56d000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00016000
fffff800`9eddc000 fffff800`9edf5000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00019000
fffff800`9ea00000 fffff800`9ea3d000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0003D000
2: kd> lmvm mup.sys
start             end                 module name
 

My Computer

System One

  • OS
    Windows 8.1
Hi,




I am extremely sorry that this thread was not attended to. There are not many people in this field.




In case you still require help, kindly respond to this thread and I will be notified via email and you should expect a response from me in 48 hours.




Regards,
Pranav
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Hi there, no worries. Yes, any help or assistance you can give would be really helpful. This one has been with the Microsoft dump analysis team for over a week now and they still haven't got to the bottom of it. We are seeing this crash on a regular basis now.

I can upload the actual crash dump to my cloud server if you need to down load it.

Thanks,
mcgeezer
 

My Computer

System One

  • OS
    Windows 8.1
Hi mcgeezer,

We appreciate it if you read the BSOD Posting Instructions.
This so you can provide us more information about the problem so we can offer better help, without guessing in the wild as we don't know anything of drivers, software and other stuff on the computer that could cause problems.
 

My Computer

System One

  • OS
    Windows 10 Pro
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Custom build
    CPU
    i5-6500 @3.20GHz
    Motherboard
    Gigabyte B150-HD3P-CF
    Memory
    16GB DDR4 2133 Crucial Ballistix Sport LT
    Graphics Card(s)
    MSI GeForce GTX 1060 GAMING X 6G
    Sound Card
    Built-in
    Monitor(s) Displays
    Liyama ProLite XB2483HSU-B2
    Screen Resolution
    1920 x 1080
    Hard Drives
    Crucial MX200 500GB & Toshiba DT01ACA300 3TB
    PSU
    Corsair RM550x
    Case
    Fractal Design Define S
    Cooling
    Cooler Master TX3 i
    Keyboard
    Func KB-460 (MX Red)
    Mouse
    Corsair Gaming M65 RGB
    Browser
    Google Chrome
    Antivirus
    Bitdefender Total Security 2017 + MBAM Pro + MBAE Pro
    Other Info
    Creative Sound Blaster Tactic3D Rage V2 headset
Hi, As I noted in my initial question I'm operating in a high security environment where I simply cannot run un-approved executables. I can pull event logs, pull crash dumps etc but I cannot run the required exe. If you can't help further then that's fine, but I'm more than happy to put the time in to work around the security enforcements.

Thanks,
mcgeezer
 

My Computer

System One

  • OS
    Windows 8.1
We can help you with only dump files, but the help would be much better with the information provided via the tool.
 

My Computer

System One

  • OS
    Windows 10 Pro
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Custom build
    CPU
    i5-6500 @3.20GHz
    Motherboard
    Gigabyte B150-HD3P-CF
    Memory
    16GB DDR4 2133 Crucial Ballistix Sport LT
    Graphics Card(s)
    MSI GeForce GTX 1060 GAMING X 6G
    Sound Card
    Built-in
    Monitor(s) Displays
    Liyama ProLite XB2483HSU-B2
    Screen Resolution
    1920 x 1080
    Hard Drives
    Crucial MX200 500GB & Toshiba DT01ACA300 3TB
    PSU
    Corsair RM550x
    Case
    Fractal Design Define S
    Cooling
    Cooler Master TX3 i
    Keyboard
    Func KB-460 (MX Red)
    Mouse
    Corsair Gaming M65 RGB
    Browser
    Google Chrome
    Antivirus
    Bitdefender Total Security 2017 + MBAM Pro + MBAE Pro
    Other Info
    Creative Sound Blaster Tactic3D Rage V2 headset
Hi, As I noted in my initial question I'm operating in a high security environment where I simply cannot run un-approved executables. I can pull event logs, pull crash dumps etc but I cannot run the required exe. If you can't help further then that's fine, but I'm more than happy to put the time in to work around the security enforcements.

Thanks,
mcgeezer
Greetings Mcgeezer ^_^,

Kindly upload the latest DUMP files after Zipping them up so that those could be analysed. I can understand that you are operating in a high security environment as well :)


-Pranav

-Pranav
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Hi, As I noted in my initial question I'm operating in a high security environment where I simply cannot run un-approved executables. I can pull event logs, pull crash dumps etc but I cannot run the required exe. If you can't help further then that's fine, but I'm more than happy to put the time in to work around the security enforcements.

Thanks,
mcgeezer
Greetings Mcgeezer ^_^,

Kindly upload the latest DUMP files after Zipping them up so that those could be analysed. I can understand that you are operating in a high security environment as well :)


-Pranav

-Pranav

Thanks - Please check your PM's!

mcgeezer
 

My Computer

System One

  • OS
    Windows 8.1
Problem has been solved. Issue seemed that the user was running an old version of the security software. Please mark this as solved ^_^


-Pranav
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Back
Top