It doesn’t happen all the time but I’ve been getting some system crashes when my isolation filter is loaded and the system resumes from hibernate. My filter isn’t in the call stack so I’m not sure how to debug the problem. The only thing I can think of is that I may be missing a FileObject which then makes its way down the stack but the call stack doesn’t show that. Here’s an !analyze-v output from a Windows 8.1 system.
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffe000c2286ee0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80373b3db5a, address which referenced memory
Debugging Details:
DUMP_CLASS: 1
DUMP_QUALIFIER: 402
BUILD_VERSION_STRING: 9600.18505.amd64fre.winblue_ltsb.160930-0600
SYSTEM_MANUFACTURER: Gateway
SYSTEM_PRODUCT_NAME: NE56R
SYSTEM_SKU: NE56R_0649_V2.01
SYSTEM_VERSION: V2.01
BIOS_VENDOR: Gateway
BIOS_VERSION: V2.01
BIOS_DATE: 08/06/2012
BASEBOARD_MANUFACTURER: Gateway
BASEBOARD_PRODUCT: EG50_HC_HR
BASEBOARD_VERSION: Type2 - Board Version
DUMP_TYPE: 0
BUGCHECK_P1: ffffe000c2286ee0
BUGCHECK_P2: 2
BUGCHECK_P3: 1
BUGCHECK_P4: fffff80373b3db5a
WRITE_ADDRESS: ffffe000c2286ee0 Nonpaged pool
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiClearFilePointer+62
fffff803`73b3db5a 48832000 and qword ptr [rax],0
CPU_COUNT: 2
CPU_MHZ: 704
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 2a
CPU_STEPPING: 7
CPU_MICROCODE: 6,2a,7,0 (F,M,S,R) SIG: 28’00000000 (cache) 28’00000000 (init)
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: System
TRAP_FRAME: ffffd001e3d307e0 – (.trap 0xffffd001e3d307e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe000c2286ee0 rbx=0000000000000000 rcx=0000000080000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80373b3db5a rsp=ffffd001e3d30970 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000001 r10=0000007ffffffff8
r11=0000098000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiClearFilePointer+0x62:
fffff80373b3db5a 48832000 and qword ptr [rax],0 ds:ffffe000
c2286ee0=???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80373bdbee9 to fffff80373bd03a0
STACK_TEXT:
ffffd001e3d30698 fffff803
73bdbee9 : 000000000000000a ffffe000
c2286ee0 0000000000000002 00000000
00000001 : nt!KeBugCheckEx
ffffd001e3d306a0 fffff803
73bda73a : 0000000000000001 00000000
00000000 ffffe000c2701800 fffff803
00000003 : nt!KiBugCheckDispatch+0x69
ffffd001e3d307e0 fffff803
73b3db5a : 0000000000000001 00000000
00000000 0000000000000001 fffff803
73b1851c : nt!KiPageFault+0x23a
ffffd001e3d30970 fffff803
73b3b3d5 : ffffe000c1ea9750 ffffe000
c1ea9750 0000000000000002 ffffe000
c1ea97c8 : nt!MiClearFilePointer+0x62
ffffd001e3d309a0 fffff803
73b3b321 : ffffe000c1ea97c8 00000000
00000000 ffffe000c1ea9750 00001f80
00000001 : nt!MiCheckForControlAreaDeletion+0x45
ffffd001e3d309d0 fffff803
73b3af54 : fffffa800481c230 ffffd001
e3d30b10 ffffd001e3600000 fffffa80
03f481e0 : nt!MiDereferenceControlAreaPfn+0x95
ffffd001e3d30a10 fffff803
73b97783 : fffffa800481c230 fffffa80
0481c230 0000000000000000 fffff803
73dd7288 : nt!MiRestoreTransitionPte+0x20c
ffffd001e3d30b50 fffff803
73b975a9 : fffffa8004816a70 fffff803
73dd72d8 0000000000000000 00000000
0018078d : nt!MiRemoveLowestPriorityStandbyPage+0x1b7
ffffd001e3d30be0 fffff803
73b973f1 : fffff80373b973e4 ffffe000
be9a4880 fffff80373d55858 ffffe000
be9a4880 : nt!MiPurgeTransitionList+0x81
ffffd001e3d30c20 fffff803
73ac0d6f : fffff80373f02d78 ffffe000
be9a49c0 ffffe000be9a4880 00000000
00000000 : nt!MiFinishResume+0xd
ffffd001e3d30c50 fffff803
73ab2f34 : fffff80373dd6e02 ffffe000
be9a4880 0000000000000080 ffffe000
be9a4880 : nt!ExpWorkerThread+0x69f
ffffd001e3d30d00 fffff803
73bd69c6 : ffffd001e8241180 ffffe000
be9a4880 ffffe000c27f3880 00000000
00000000 : nt!PspSystemThreadStartup+0x58
ffffd001e3d30d60 00000000
00000000 : ffffd001e3d31000 ffffd001
e3d2b000 0000000000000000 00000000
00000000 : nt!KiStartSystemThread+0x16