BAD_POOL_HEADER while Opneing While with NotePad/Explorer

NTFSD
1

I am beginner in FS developmenet. In my file system when i read a file with CMD it is showing the content of file Correctly but when I try to open while with explorer or NotePad it is crashing.

BugCheck 19, {20, 97700910, 97700938, 18050004}

Probably caused by : ntkrpamp.exe ( nt!IopSynchronousServiceTail+281 )

I used !pool 97700910 it is shows
Pool page 97700910 region is Nonpaged pool
97700000 size: 148 previous size: 0 (Allocated) ALPC
97700148 size: 30 previous size: 148 (Allocated) VadS
97700178 size: 50 previous size: 30 (Allocated) Vad
977001c8 size: 20 previous size: 50 (Allocated) ReTa
977001e8 size: a0 previous size: 20 (Allocated) FMsl
97700288 size: c8 previous size: a0 (Allocated) Ntfx
97700350 size: 8 previous size: c8 (Free) Free
97700358 size: a0 previous size: 8 (Allocated) MmCa
977003f8 size: 18 previous size: a0 (Allocated) WfpH
97700410 size: 30 previous size: 18 (Allocated) VadS
97700440 size: 50 previous size: 30 (Allocated) Vad
97700490 size: 18 previous size: 50 (Free) Free
977004a8 size: 28 previous size: 18 (Allocated) FSro
977004d0 size: a0 previous size: 28 (Allocated) MmCa
97700570 size: a0 previous size: a0 (Allocated) MmCa
97700610 size: a0 previous size: a0 (Allocated) FMsl
977006b0 size: 40 previous size: a0 (Allocated) Even
977006f0 size: c8 previous size: 40 (Allocated) Ntfx
977007b8 size: 30 previous size: c8 (Allocated) EtwR
977007e8 size: 100 previous size: 30 (Allocated) Driv
977008e8 size: 8 previous size: 100 (Free) Free
977008f0 size: 20 previous size: 8 (Allocated) ReTa
*97700910 size: 28 previous size: 20 (Free ) *Io Process: 53373ac0
Pooltag Io : general IO allocations, Binary : nt!io

The Stack Trace is

nt!RtlpBreakWithStatusInstruction C / C++ / ASM
nt!KiBugCheckDebugBreak + 0x1f C / C++ / ASM
nt!KeBugCheck2 + 0x676 C / C++ / ASM
nt!KiBugCheck2 + 0xc6 C / C++ / ASM
nt!KeBugCheckEx + 0x19 C / C++ / ASM
nt!ExFreePool + 0x8aa C / C++ / ASM
nt!IopCompleteRequest + 0x9d C / C++ / ASM
nt!IopSynchronousServiceTail + 0x281 C / C++ / ASM
nt!NtQueryVolumeInformationFile + 0x2c4 C / C++ / ASM
nt!KiSystemServicePostCall C / C++ / ASM
ntdll!KiFastSystemCallRet C / C++ / ASM
ntdll!NtQueryVolumeInformationFile + 0xa C / C++ / ASM
KERNELBASE!GetFileInformationByHandle + 0x37 C / C++ / ASM
SHELL32!GetFindDataFromFileInformationByHandle + 0x98 C / C++ / ASM
SHELL32!CShellLink::_GetFindDataAndTracker + 0x48 C / C++ / ASM
SHELL32!CShellLink::_SetPIDLPath + 0x147 C / C++ / ASM
SHELL32!CShellLink::SetIDList + 0x33 C / C++ / ASM
SHELL32!CDestinationCategory::AppendDestination + 0xe9 C / C++ / ASM
SHELL32!CAutoDestList::GetMatchingEntryIndex + 0xa1 C / C++ / ASM
SHELL32!CAutomaticDestinationList::_EnsureItemGetIndex + 0x86 C / C++ / ASM
SHELL32!CAutomaticDestinationList::AddUsagePoint + 0x6f C / C++ / ASM
SHELL32!AddPointToItem + 0x4c C / C++ / ASM
SHELL32!AddToAutoDestList + 0x1d0 C / C++ / ASM
SHELL32!CTaskAddDoc::_AddToRecentDocs + 0x10d C / C++ / ASM
SHELL32!CTaskAddDoc::InternalResumeRT + 0xdc C / C++ / ASM
SHELL32!CRunnableTask::Run + 0x78 C / C++ / ASM
SHELL32!CShellTaskThread::ThreadProc + 0x240 C / C++ / ASM
SHELL32!CShellTaskThread::s_ThreadProc + 0x2b C / C++ / ASM
SHCORE!ExecuteWorkItemThreadProc + 0xe C / C++ / ASM
ntdll!RtlpTpWorkCallback + 0xe6 C / C++ / ASM
ntdll!TppWorkerThread + 0x733 C / C++ / ASM
KERNEL32!BaseThreadInitThunk + 0xe C / C++ / ASM
ntdll!__RtlUserThreadStart + 0x20 C / C++ / ASM
ntdll!_RtlUserThreadStart + 0x1b C / C++ / ASM

Please Help to figure out what is happening here.

2

> I am beginner in FS developmenet.
Welcome!

You want to start by saying !analyze -v that should give more detail
(probably “double free” or some such).

This indicated to my mind that you have started using pool after you have
freed it. If you are not already you *must* run under verifier because that
will fid the bugs for you much earlier.

/Rod

3

These pool are not allocated by my driver it is managed by windows itself and i think i ma correct because pool tagged with this info.

Pooltag Io : general IO allocations, Binary : nt!io

And result of !analyze -v are here. May be it can help you

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 97700910, The pool entry we were looking for within the page.
Arg3: 97700938, The next pool entry.
Arg4: 18050004, (reserved)

Debugging Details:

BUGCHECK_STR: 0x19_20

POOL_ADDRESS: 97700910 Nonpaged pool

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: explorer.exe

CURRENT_IRQL: 1

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

IRP_ADDRESS: 9778c4a8

LAST_CONTROL_TRANSFER: from 817de6d9 to 81761754

STACK_TEXT:
a0fef5c4 817de6d9 00000003 1f353869 00000065 nt!RtlpBreakWithStatusInstruction
a0fef618 817de1f3 801ff340 a0fefa14 a0fefab8 nt!KiBugCheckDebugBreak+0x1f
a0fef9e8 81760326 00000019 00000020 97700910 nt!KeBugCheck2+0x676
a0fefa0c 8176025d 00000019 00000020 97700910 nt!KiBugCheck2+0xc6
a0fefa2c 8183b6f0 00000019 00000020 97700910 nt!KeBugCheckEx+0x19
a0fefab8 816c3bdd 97700918 00000000 1f353571 nt!ExFreePool+0x8aa
a0fefb00 818d2771 9778c4e8 a0fefb2c a0fefb38 nt!IopCompleteRequest+0x9d
a0fefb70 818c7184 9778c4e8 00000001 00000001 nt!IopSynchronousServiceTail+0x281
a0fefbf8 81771377 8ab97eb0 00000001 0c48d93c nt!NtQueryVolumeInformationFile+0x2c4
a0fefbf8 77072da4 8ab97eb0 00000001 0c48d93c nt!KiSystemServicePostCall
0c48d8d4 7707114a 74d87bfe 00001ac4 0c48d900 ntdll!KiFastSystemCallRet
0c48d8d8 74d87bfe 00001ac4 0c48d900 0c48d93c ntdll!NtQueryVolumeInformationFile+0xa
0c48d9c0 75c411cb 00001ac4 0c48d9e4 00000000 KERNELBASE!GetFileInformationByHandle+0x37
0c48da1c 75c41454 0c48da38 0ddd8aa8 0dbbd5c8 SHELL32!GetFindDataFromFileInformationByHandle+0x98
0c48dcac 75c41402 0c48df20 0c48e1ec 0ddd8aac SHELL32!CShellLink::_GetFindDataAndTracker+0x48
0c48e130 75d5aa83 0dbbd590 00000000 00000001 SHELL32!CShellLink::_SetPIDLPath+0x147
0c48e148 75d61452 0ddd8aac 0dbbd590 80070057 SHELL32!CShellLink::SetIDList+0x33
0c48e174 75dc390d 00000001 0c48e264 00000000 SHELL32!CDestinationCategory::AppendDestination+0xe9
0c48e1fc 75d5e20f 0dba3324 0dd3af50 0c48e228 SHELL32!CAutoDestList::GetMatchingEntryIndex+0xa1
0c48e234 75d5ddfa 0dba3324 0c48e268 00000001 SHELL32!CAutomaticDestinationList::_EnsureItemGetIndex+0x86
0c48e2a4 75d5d40c 0c48e2d4 75d5d41c 00fa19b0 SHELL32!CAutomaticDestinationList::AddUsagePoint+0x6f
0c48e2d4 75d939b4 00000000 046a0046 0dc62f78 SHELL32!AddPointToItem+0x4c
0c48e518 75d5d995 00000000 046a00d8 0c48e550 SHELL32!AddToAutoDestList+0x1d0
0c48f9b4 75d5d865 046a0054 046a0040 00000000 SHELL32!CTaskAddDoc::_AddToRecentDocs+0x10d
0c48fa1c 75d58a84 0dc62f78 00200000 fffffffe SHELL32!CTaskAddDoc::InternalResumeRT+0xdc
0c48fa38 75b87935 00c62f78 00f72d50 0dab98f8 SHELL32!CRunnableTask::Run+0x78
0c48fae8 75b87ae3 02a227c8 0c48fb04 76e81fb1 SHELL32!CShellTaskThread::ThreadProc+0x240
0c48faf4 76e81fb1 0dab98f8 0c8f02e8 0c48fb80 SHELL32!CShellTaskThread::s_ThreadProc+0x2b
0c48fb04 7701ce0a 02a227c8 c740a6c3 00f721c4 SHCORE!ExecuteWorkItemThreadProc+0xe
0c48fb80 7703a403 02a227c8 0c8f02e8 c740a037 ntdll!RtlpTpWorkCallback+0xe6
0c48fd74 757a17ad 00f72d50 0c48fdc4 77053af4 ntdll!TppWorkerThread+0x733
0c48fd80 77053af4 00f72d50 c740a087 00000000 KERNEL32!BaseThreadInitThunk+0xe
0c48fdc4 77053acd ffffffff 770842cf 00000000 ntdll!__RtlUserThreadStart+0x20
0c48fdd4 00000000 77039cd0 00f72d50 00000000 ntdll!_RtlUserThreadStart+0x1b

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!IopSynchronousServiceTail+281
818d2771 8acb mov cl,bl

SYMBOL_STACK_INDEX: 7

SYMBOL_NAME: nt!IopSynchronousServiceTail+281

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 53085a16

BUCKET_ID_FUNC_OFFSET: 281

FAILURE_BUCKET_ID: 0x19_20_nt!IopSynchronousServiceTail

BUCKET_ID: 0x19_20_nt!IopSynchronousServiceTail

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x19_20_nt!iopsynchronousservicetail

FAILURE_ID_HASH: {467a9357-6e63-e08e-b322-960c7d496903}

Followup: MachineOwner

4

I am giving here further details regarding the crash. I am suspecting that ExfreePool is called with System buffer supplied in IRP_MJ_QUERY_VOLUME_INFORMATION when IocompleteRequest is called but it is happening only in some cases Example when i open a file.

0: kd> !thread
THREAD 88b16a80 Cid 0890.0fa8 Teb: 7f06c000 Win32Thread: 98f1b850 RUNNING on processor 0
IRP List:
9d3c22c0: (0006,0094) Flags: 00060870 Mdl: 00000000
Not impersonating
DeviceMap 99296c08
Owning Process 99960700 Image: explorer.exe
Attached Process N/A Image: N/A
Wait Start TickCount 73694 Ticks: 2 (0:00:00:00.031)
Context Switch Count 115 IdealProcessor: 3
UserTime 00:00:00.015
KernelTime 00:00:00.046
Win32 Start Address ntdll!TppWorkerThread (0x77039cd0)
Stack Init a2e29ca0 Current a2e29870 Base a2e2a000 Limit a2e27000 Call 0
Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr Args to Child
a2e295c4 817de6d9 00000003 1d295869 00000065 nt!RtlpBreakWithStatusInstruction (FPO: [1,0,0])
a2e29618 817de1f3 801fe340 a2e29a14 a2e29ab8 nt!KiBugCheckDebugBreak+0x1f (FPO: [Non-Fpo])
a2e299e8 81760326 00000019 00000020 8a6e7660 nt!KeBugCheck2+0x676 (FPO: [6,239,4])
a2e29a0c 8176025d 00000019 00000020 8a6e7660 nt!KiBugCheck2+0xc6
a2e29a2c 8183b6f0 00000019 00000020 8a6e7660 nt!KeBugCheckEx+0x19
a2e29ab8 816c3bdd 8a6e7668 00000000 1d295571 nt!ExFreePool+0x8aa
a2e29b00 818d2771 a3b7adb8 a2e29b2c a2e29b38 nt!IopCompleteRequest+0x9d (FPO: [Non-Fpo])
a2e29b70 818c7184 a3b7adb8 00000001 00000001 nt!IopSynchronousServiceTail+0x281 (FPO: [Non-Fpo])
a2e29bf8 81771377 9d3c22c0 00000001 028fda04 nt!NtQueryVolumeInformationFile+0x2c4 (FPO: [Non-Fpo])
a2e29bf8 77072da4 9d3c22c0 00000001 028fda04 nt!KiSystemServicePostCall (FPO: [0,3] TrapFrame @ a2e29c14)
028fd99c 7707114a 74d87bfe 00001660 028fd9c8 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
028fd9a0 74d87bfe 00001660 028fd9c8 028fda04 ntdll!NtQueryVolumeInformationFile+0xa (FPO: [5,0,0])
028fda88 75c411cb 00001660 028fdaac 00000000 KERNELBASE!GetFileInformationByHandle+0x37 (FPO: [Non-Fpo])
028fdae4 75c41454 028fdb00 0dae0df8 03e839b8 SHELL32!GetFindDataFromFileInformationByHandle+0x98 (FPO: [Non-Fpo])
028fdd74 75c41402 028fdfe8 028fe2b4 0dae0dfc SHELL32!CShellLink::_GetFindDataAndTracker+0x48 (FPO: [Non-Fpo])
028fe1f8 75d5aa83 03e838d8 00000000 00000001 SHELL32!CShellLink::_SetPIDLPath+0x147 (FPO: [3,283,4])
028fe210 75d61452 0dae0dfc 03e838d8 80070057 SHELL32!CShellLink::SetIDList+0x33 (FPO: [Non-Fpo])
028fe23c 75dc390d 00000001 028fe32c 00000000 SHELL32!CDestinationCategory::AppendDestination+0xe9 (FPO: [Non-Fpo])
028fe2c4 75d5e20f 0d7d4a84 0d7fb270 028fe2f0 SHELL32!CAutoDestList::GetMatchingEntryIndex+0xa1 (FPO: [Non-Fpo])
028fe2fc 75d5ddfa 0d7d4a84 028fe330 00000001 SHELL32!CAutomaticDestinationList::_EnsureItemGetIndex+0x86 (FPO: [Non-Fpo])
028fe370 75d5d41c 0daf1630 0d7d4a84 759638d0 SHELL32!CAutomaticDestinationList::AddUsagePoint+0x6f (FPO: [2,19,4])
028fe398 75d939b4 00000000 026c0046 0c82c620 SHELL32!AddPointToItem+0x5c (FPO: [Non-Fpo])
028fe5dc 75d5d995 00000000 026c00d8 028fe614 SHELL32!AddToAutoDestList+0x1d0 (FPO: [Non-Fpo])
028ffa78 75d5d865 026c0054 026c0040 00000000 SHELL32!CTaskAddDoc::_AddToRecentDocs+0x10d (FPO: [Non-Fpo])
028ffae0 75d58a84 0c82c620 00200000 fffffffe SHELL32!CTaskAddDoc::InternalResumeRT+0xdc (FPO: [Non-Fpo])
028ffafc 75b87935 0082c620 00f72d50 0dab98f8 SHELL32!CRunnableTask::Run+0x78 (FPO: [Non-Fpo])
028ffbac 75b87ae3 02a22750 028ffbc8 76e81fb1 SHELL32!CShellTaskThread::ThreadProc+0x240 (FPO: [Non-Fpo])
028ffbb8 76e81fb1 0dab98f8 0c8f01a8 028ffc44 SHELL32!CShellTaskThread::s_ThreadProc+0x2b (FPO: [Non-Fpo])
028ffbc8 7701ce0a 02a22750 c987a107 00f721c4 SHCORE!ExecuteWorkItemThreadProc+0xe (FPO: [Non-Fpo])
028ffc44 7703a403 02a22750 0c8f01a8 c987a37b ntdll!RtlpTpWorkCallback+0xe6 (FPO: [SEH])
028ffe38 757a17ad 00f72d50 028ffe88 77053af4 ntdll!TppWorkerThread+0x733 (FPO: [Non-Fpo])
028ffe44 77053af4 00f72d50 c987a3cb 00000000 KERNEL32!BaseThreadInitThunk+0xe (FPO: [Non-Fpo])
028ffe88 77053acd ffffffff 770842cf 00000000 ntdll!__RtlUserThreadStart+0x20 (FPO: [Non-Fpo])
028ffe98 00000000 77039cd0 00f72d50 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])

0: kd> !irp 9d3c22c0
Irp is active with 1 stacks 3 is current (= 0x9d3c2378)
No Mdl: System buffer=8a6e7668: Thread 88b16a80: Irp is completed.
cmd flg cl Device File Completion-Context
[a, 0] 0 0 9d2f2300 00000000 00000000-00000000
\Driver\AFSKernelMode
Args: 00000000 00000000 00000000 000000

5

Pool corruption means that you may have corrupted someone else’s datastructures, meaning that they may suffer the crash from your bug.

It is much more likely that you have introduced a pool corruption issue into your driver than that you have found a bug in the iomgr’s IRP allocation/deallocation logic in the released product (a very frequent code path that is well exercised on any machine running the OS).

Consider running your driver code with driver verifier (special pool) to expose pool corruption issues closer to the point of the problem.

  • S (Msft)

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Tuesday, March 31, 2015 5:45 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] BAD_POOL_HEADER while Opneing While with NotePad/Explorer

These pool are not allocated by my driver it is managed by windows itself and i think i ma correct because pool tagged with this info.

Pooltag Io : general IO allocations, Binary : nt!io

And result of !analyze -v are here. May be it can help you

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of the problem, and then special pool applied to the suspect tags or the driver verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 97700910, The pool entry we were looking for within the page.
Arg3: 97700938, The next pool entry.
Arg4: 18050004, (reserved)

Debugging Details:

BUGCHECK_STR: 0x19_20

POOL_ADDRESS: 97700910 Nonpaged pool

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: explorer.exe

CURRENT_IRQL: 1

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

IRP_ADDRESS: 9778c4a8

LAST_CONTROL_TRANSFER: from 817de6d9 to 81761754

STACK_TEXT:
a0fef5c4 817de6d9 00000003 1f353869 00000065 nt!RtlpBreakWithStatusInstruction
a0fef618 817de1f3 801ff340 a0fefa14 a0fefab8 nt!KiBugCheckDebugBreak+0x1f
a0fef9e8 81760326 00000019 00000020 97700910 nt!KeBugCheck2+0x676 a0fefa0c 8176025d 00000019 00000020 97700910 nt!KiBugCheck2+0xc6 a0fefa2c 8183b6f0 00000019 00000020 97700910 nt!KeBugCheckEx+0x19
a0fefab8 816c3bdd 97700918 00000000 1f353571 nt!ExFreePool+0x8aa
a0fefb00 818d2771 9778c4e8 a0fefb2c a0fefb38 nt!IopCompleteRequest+0x9d
a0fefb70 818c7184 9778c4e8 00000001 00000001 nt!IopSynchronousServiceTail+0x281
a0fefbf8 81771377 8ab97eb0 00000001 0c48d93c nt!NtQueryVolumeInformationFile+0x2c4
a0fefbf8 77072da4 8ab97eb0 00000001 0c48d93c nt!KiSystemServicePostCall
0c48d8d4 7707114a 74d87bfe 00001ac4 0c48d900 ntdll!KiFastSystemCallRet
0c48d8d8 74d87bfe 00001ac4 0c48d900 0c48d93c ntdll!NtQueryVolumeInformationFile+0xa
0c48d9c0 75c411cb 00001ac4 0c48d9e4 00000000 KERNELBASE!GetFileInformationByHandle+0x37
0c48da1c 75c41454 0c48da38 0ddd8aa8 0dbbd5c8 SHELL32!GetFindDataFromFileInformationByHandle+0x98
0c48dcac 75c41402 0c48df20 0c48e1ec 0ddd8aac SHELL32!CShellLink::_GetFindDataAndTracker+0x48
0c48e130 75d5aa83 0dbbd590 00000000 00000001 SHELL32!CShellLink::_SetPIDLPath+0x147
0c48e148 75d61452 0ddd8aac 0dbbd590 80070057 SHELL32!CShellLink::SetIDList+0x33
0c48e174 75dc390d 00000001 0c48e264 00000000 SHELL32!CDestinationCategory::AppendDestination+0xe9
0c48e1fc 75d5e20f 0dba3324 0dd3af50 0c48e228 SHELL32!CAutoDestList::GetMatchingEntryIndex+0xa1
0c48e234 75d5ddfa 0dba3324 0c48e268 00000001 SHELL32!CAutomaticDestinationList::_EnsureItemGetIndex+0x86
0c48e2a4 75d5d40c 0c48e2d4 75d5d41c 00fa19b0 SHELL32!CAutomaticDestinationList::AddUsagePoint+0x6f
0c48e2d4 75d939b4 00000000 046a0046 0dc62f78 SHELL32!AddPointToItem+0x4c
0c48e518 75d5d995 00000000 046a00d8 0c48e550 SHELL32!AddToAutoDestList+0x1d0
0c48f9b4 75d5d865 046a0054 046a0040 00000000 SHELL32!CTaskAddDoc::_AddToRecentDocs+0x10d
0c48fa1c 75d58a84 0dc62f78 00200000 fffffffe SHELL32!CTaskAddDoc::InternalResumeRT+0xdc
0c48fa38 75b87935 00c62f78 00f72d50 0dab98f8 SHELL32!CRunnableTask::Run+0x78
0c48fae8 75b87ae3 02a227c8 0c48fb04 76e81fb1 SHELL32!CShellTaskThread::ThreadProc+0x240
0c48faf4 76e81fb1 0dab98f8 0c8f02e8 0c48fb80 SHELL32!CShellTaskThread::s_ThreadProc+0x2b
0c48fb04 7701ce0a 02a227c8 c740a6c3 00f721c4 SHCORE!ExecuteWorkItemThreadProc+0xe
0c48fb80 7703a403 02a227c8 0c8f02e8 c740a037 ntdll!RtlpTpWorkCallback+0xe6
0c48fd74 757a17ad 00f72d50 0c48fdc4 77053af4 ntdll!TppWorkerThread+0x733
0c48fd80 77053af4 00f72d50 c740a087 00000000 KERNEL32!BaseThreadInitThunk+0xe
0c48fdc4 77053acd ffffffff 770842cf 00000000 ntdll!__RtlUserThreadStart+0x20
0c48fdd4 00000000 77039cd0 00f72d50 00000000 ntdll!_RtlUserThreadStart+0x1b

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!IopSynchronousServiceTail+281
818d2771 8acb mov cl,bl

SYMBOL_STACK_INDEX: 7

SYMBOL_NAME: nt!IopSynchronousServiceTail+281

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 53085a16

BUCKET_ID_FUNC_OFFSET: 281

FAILURE_BUCKET_ID: 0x19_20_nt!IopSynchronousServiceTail

BUCKET_ID: 0x19_20_nt!IopSynchronousServiceTail

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x19_20_nt!iopsynchronousservicetail

FAILURE_ID_HASH: {467a9357-6e63-e08e-b322-960c7d496903}

Followup: MachineOwner

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer