Crash dump after Win 8.1 to Win 10 upgrade

NTFSD
1

Hello folks,

We have observed BSOD after OS upgrade (Windows 8.1 to Windows 10 build : 10154)
while accessing the network location.

Does anyone observed the same BSOD? Please help us to understand the reason behind this.

Here is output of !analyze -v command,

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: d7613043, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 817ef929, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000002, (reserved)

Debugging Details:

ADDITIONAL_DEBUG_TEXT:
You can run ‘.symfix; .reload’ to try to fix the symbol path and load symbols.

MODULE_NAME: ahcache

FAULTING_MODULE: 81461000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 55866ccf

READ_ADDRESS: GetPointerFromAddress: unable to read from 00000000
GetPointerFromAddress: unable to read from 00000000
unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
d7613043

FAULTING_IP:
nt!LdrResSearchResource+ba7
817ef929 8b10 mov edx,dword ptr [eax]

MM_INTERNAL_CODE: 2

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER: from 81528537 to 81593e44

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b0b95dc4 81528537 00000050 d7613043 00000000 nt!KeBugCheckEx
b0b95e20 814cc187 b0b95f50 814cc187 b0b95f50 nt!MmSetAddressRangeModified+0x2b07
b0b95eb8 815a61c8 00000000 d7613043 00000000 nt!PfFileInfoNotify+0x8157
b0b95f50 817ef929 badb0d00 0164f008 00000000 nt!Kei386EoiHelper+0x29fc
b0b96074 81565d2c 00010000 7f648000 7f6100e0 nt!LdrResSearchResource+0xba7
b0b963fc 817eef26 00002210 b0b9645c 00000003 nt!AlpcGetHeaderSize+0xba8
b0b96488 8d94f0c3 7f610000 b0b96500 00000003 nt!LdrResSearchResource+0x1a4
b0b9652c 8d94e8c3 bafab008 00000400 0000000a ahcache+0xf0c3
b0b96550 8d94bd3d 000374d6 bafbc008 00000014 ahcache+0xe8c3
b0b96570 8d94b885 00000400 00000000 00000000 ahcache+0xbd3d
b0b965bc 8d94bea1 7f83c9de 000374c8 bafab008 ahcache+0xb885
b0b96600 8d94b318 b0b96638 bafb3580 bafbc008 ahcache+0xbea1
b0b9663c 8d94aedc bafbc008 0003747e b0b96748 ahcache+0xb318
b0b96670 8d94afc6 0003747e b0b96748 b0b9669c ahcache+0xaedc
b0b966a0 8d94ad12 0003747e b0b9671c b0b96748 ahcache+0xafc6
b0b96720 8d948e87 fffbd728 b0b96748 b0b967c4 ahcache+0xad12
b0b96864 8d948930 fffbd728 bafaaa48 ab6163d0 ahcache+0x8e87
b0b96898 8d9492a0 b0b9697c b0b96950 b0b96948 ahcache+0x8930
b0b968fc 8d94f34a b0b9697c b0b96950 b0b96948 ahcache+0x92a0
b0b96980 8d94cfc1 8cafa300 baf9d158 800010a4 ahcache+0xf34a
b0b96a0c 8d94c6d5 8cafa300 b0b96a50 800010a4 ahcache+0xcfc1
b0b96a70 8d94c2db 00000000 0ec1f630 00001000 ahcache+0xc6d5
b0b96b90 8d94c136 00000001 00000000 8b78c398 ahcache+0xc2db
b0b96ba4 814e2c13 8b78c398 b27a7be8 00000000 ahcache+0xc136
b0b96bc0 81778243 00000000 05bde1d0 8177819c nt!IofCallDriver+0x43
b0b96c04 815a2bdb 00000000 05bde1e0 05bde548 nt!RtlVolumeDeviceToDosName+0x2ad
b0b96c14 77bd45f0 badb0d00 02000000 00000000 nt!ExfUnblockPushLock+0x14f9
b0b96c18 badb0d00 02000000 00000000 00000000 0x77bd45f0
b0b96c1c 02000000 00000000 00000000 00000000 0xbadb0d00
b0b96c20 00000000 00000000 00000000 00000000 0x2000000

STACK_COMMAND: kb

FOLLOWUP_IP:
ahcache+f0c3
8d94f0c3 8bf0 mov esi,eax

SYMBOL_STACK_INDEX: 7
SYMBOL_NAME: ahcache+f0c3
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ahcache.sys
BUCKET_ID: WRONG_SYMBOLS
FAILURE_BUCKET_ID: WRONG_SYMBOLS
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:wrong_symbols
FAILURE_ID_HASH: {70b057e8-2462-896f-28e7-ac72d4d365f8}
Followup: MachineOwner

Thanks in advance.

2

Some kind of bad pointer deref. You need to fix your symbols before anyone
can help you further (.symfix;.reload)

-scott
OSR
@OSRDrivers

wrote in message news:xxxxx@ntfsd…

Hello folks,

We have observed BSOD after OS upgrade (Windows 8.1 to Windows 10 build :
10154)
while accessing the network location.

Does anyone observed the same BSOD? Please help us to understand the reason
behind this.

Here is output of !analyze -v command,

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain bad or
it
is pointing at freed memory.
Arguments:
Arg1: d7613043, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 817ef929, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000002, (reserved)

Debugging Details:

ADDITIONAL_DEBUG_TEXT:
You can run ‘.symfix; .reload’ to try to fix the symbol path and load
symbols.

MODULE_NAME: ahcache

FAULTING_MODULE: 81461000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 55866ccf

READ_ADDRESS: GetPointerFromAddress: unable to read from 00000000
GetPointerFromAddress: unable to read from 00000000
unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
d7613043

FAULTING_IP:
nt!LdrResSearchResource+ba7
817ef929 8b10 mov edx,dword ptr [eax]

MM_INTERNAL_CODE: 2

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER: from 81528537 to 81593e44

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
b0b95dc4 81528537 00000050 d7613043 00000000 nt!KeBugCheckEx
b0b95e20 814cc187 b0b95f50 814cc187 b0b95f50
nt!MmSetAddressRangeModified+0x2b07
b0b95eb8 815a61c8 00000000 d7613043 00000000 nt!PfFileInfoNotify+0x8157
b0b95f50 817ef929 badb0d00 0164f008 00000000 nt!Kei386EoiHelper+0x29fc
b0b96074 81565d2c 00010000 7f648000 7f6100e0 nt!LdrResSearchResource+0xba7
b0b963fc 817eef26 00002210 b0b9645c 00000003 nt!AlpcGetHeaderSize+0xba8
b0b96488 8d94f0c3 7f610000 b0b96500 00000003 nt!LdrResSearchResource+0x1a4
b0b9652c 8d94e8c3 bafab008 00000400 0000000a ahcache+0xf0c3
b0b96550 8d94bd3d 000374d6 bafbc008 00000014 ahcache+0xe8c3
b0b96570 8d94b885 00000400 00000000 00000000 ahcache+0xbd3d
b0b965bc 8d94bea1 7f83c9de 000374c8 bafab008 ahcache+0xb885
b0b96600 8d94b318 b0b96638 bafb3580 bafbc008 ahcache+0xbea1
b0b9663c 8d94aedc bafbc008 0003747e b0b96748 ahcache+0xb318
b0b96670 8d94afc6 0003747e b0b96748 b0b9669c ahcache+0xaedc
b0b966a0 8d94ad12 0003747e b0b9671c b0b96748 ahcache+0xafc6
b0b96720 8d948e87 fffbd728 b0b96748 b0b967c4 ahcache+0xad12
b0b96864 8d948930 fffbd728 bafaaa48 ab6163d0 ahcache+0x8e87
b0b96898 8d9492a0 b0b9697c b0b96950 b0b96948 ahcache+0x8930
b0b968fc 8d94f34a b0b9697c b0b96950 b0b96948 ahcache+0x92a0
b0b96980 8d94cfc1 8cafa300 baf9d158 800010a4 ahcache+0xf34a
b0b96a0c 8d94c6d5 8cafa300 b0b96a50 800010a4 ahcache+0xcfc1
b0b96a70 8d94c2db 00000000 0ec1f630 00001000 ahcache+0xc6d5
b0b96b90 8d94c136 00000001 00000000 8b78c398 ahcache+0xc2db
b0b96ba4 814e2c13 8b78c398 b27a7be8 00000000 ahcache+0xc136
b0b96bc0 81778243 00000000 05bde1d0 8177819c nt!IofCallDriver+0x43
b0b96c04 815a2bdb 00000000 05bde1e0 05bde548
nt!RtlVolumeDeviceToDosName+0x2ad
b0b96c14 77bd45f0 badb0d00 02000000 00000000 nt!ExfUnblockPushLock+0x14f9
b0b96c18 badb0d00 02000000 00000000 00000000 0x77bd45f0
b0b96c1c 02000000 00000000 00000000 00000000 0xbadb0d00
b0b96c20 00000000 00000000 00000000 00000000 0x2000000

STACK_COMMAND: kb

FOLLOWUP_IP:
ahcache+f0c3
8d94f0c3 8bf0 mov esi,eax

SYMBOL_STACK_INDEX: 7
SYMBOL_NAME: ahcache+f0c3
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ahcache.sys
BUCKET_ID: WRONG_SYMBOLS
FAILURE_BUCKET_ID: WRONG_SYMBOLS
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:wrong_symbols
FAILURE_ID_HASH: {70b057e8-2462-896f-28e7-ac72d4d365f8}
Followup: MachineOwner

Thanks in advance.

3

Thanks Scott for the reply,

Below is the output of !analyze -v command after fixing symbols.

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: d7613043, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 817ef929, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000002, (reserved)

Debugging Details:

Page 87cd not present in the dump file. Type “.hh dbgerr004” for details

READ_ADDRESS: GetPointerFromAddress: unable to read from 00000000
GetPointerFromAddress: unable to read from 00000000
unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
d7613043

FAULTING_IP:
nt!LdrpResSearchResourceInsideDirectory+6df
817ef929 8b10 mov edx,dword ptr [eax]

MM_INTERNAL_CODE: 2

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

PROCESS_NAME: explorer.exe

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

TRAP_FRAME: b0b95f50 – (.trap 0xffffffffb0b95f50)
ErrCode = 00000000
eax=d7613043 ebx=00006000 ecx=7f610278 edx=7f610278 esi=00000000 edi=7f610000
eip=817ef929 esp=b0b95fc4 ebp=b0b96074 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!LdrpResSearchResourceInsideDirectory+0x6df:
817ef929 8b10 mov edx,dword ptr [eax] ds:0023:d7613043=???
Resetting default scope

LAST_CONTROL_TRANSFER: from 81528537 to 81593e44

STACK_TEXT:
b0b95dc4 81528537 00000050 d7613043 00000000 nt!KeBugCheckEx
b0b95e28 814cc187 b0b95f50 d7613043 b0b95e98 nt!MiSystemFault+0xe37
b0b95eb8 815a61c8 00000000 d7613043 00000000 nt!MmAccessFault+0x117
b0b95eb8 817ef929 00000000 d7613043 00000000 nt!KiTrap0E+0xec
b0b96074 81565d2c 00010000 7f648000 7f6100e0 nt!LdrpResSearchResourceInsideDirectory+0x6df
b0b963fc 817eef26 00002210 b0b9645c 00000003 nt!LdrpResSearchResourceMappedFile+0x2a4
b0b96488 8d94f0c3 7f610000 b0b96500 00000003 nt!LdrResSearchResource+0x1a4
b0b9652c 8d94e8c3 bafab008 00000400 0000000a ahcache!AslpFileGetVersionBlock+0xcd
b0b96550 8d94bd3d 000374d6 bafbc008 00000014 ahcache!AslpFileGetVersionAttributes+0x21
b0b96570 8d94b885 00000400 00000000 00000000 ahcache!AslFileAllocAndGetAttributes+0x8d
b0b965bc 8d94bea1 7f83c9de 000374c8 bafab008 ahcache!SdbpCheckAllAttributes+0x295
b0b96600 8d94b318 b0b96638 bafb3580 bafbc008 ahcache!SdbpCheckMatchingFiles+0x79
b0b9663c 8d94aedc bafbc008 0003747e b0b96748 ahcache!SdbpMatchList+0x68
b0b96670 8d94afc6 0003747e b0b96748 b0b9669c ahcache!SdbpCheckForMatch+0x50
b0b966a0 8d94ad12 0003747e b0b9671c b0b96748 ahcache!SdbpCheckExe+0x7c
b0b96720 8d948e87 fffbd728 b0b96748 b0b967c4 ahcache!SdbpSearchDB+0x94
b0b96864 8d948930 fffbd728 bafaaa48 ab6163d0 ahcache!SdbGetMatchingExeEx+0x20d
b0b96898 8d9492a0 b0b9697c b0b96950 b0b96948 ahcache!AhcpSdbQueryLookupExe+0x58
b0b968fc 8d94f34a b0b9697c b0b96950 b0b96948 ahcache!AhcSdbQueryLookup+0x5a
b0b96980 8d94cfc1 8cafa300 baf9d158 800010a4 ahcache!AhcpCacheBuildSdbInfo+0x12e
b0b96a0c 8d94c6d5 8cafa300 b0b96a50 800010a4 ahcache!AhcCacheLookup+0x7e1
b0b96a70 8d94c2db 00000000 0ec1f630 00001000 ahcache!AhcApiLookup+0xa5
b0b96b90 8d94c136 00000001 00000000 8b78c398 ahcache!AhcDispatch+0x17b
b0b96ba4 814e2c13 8b78c398 b27a7be8 00000000 ahcache!AhcDriverDispatchDeviceControl+0x36
b0b96bc0 81778243 00000000 05bde1d0 8177819c nt!IofCallDriver+0x43
b0b96c04 815a2bdb 00000000 05bde1e0 05bde548 nt!NtApphelpCacheControl+0xa7
b0b96c04 77bd45f0 00000000 05bde1e0 05bde548 nt!KiSystemServicePostCall
WARNING: Frame IP not in any known module. Following frames may be wrong.
05bde548 00000000 00000000 00000000 00000000 0x77bd45f0

STACK_COMMAND: kb

FOLLOWUP_IP:
ahcache!AslpFileGetVersionBlock+cd
8d94f0c3 8bf0 mov esi,eax

SYMBOL_STACK_INDEX: 7

SYMBOL_NAME: ahcache!AslpFileGetVersionBlock+cd

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ahcache

IMAGE_NAME: ahcache.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 55866ccf

BUCKET_ID_FUNC_OFFSET: cd

FAILURE_BUCKET_ID: AV_ahcache!AslpFileGetVersionBlock

BUCKET_ID: AV_ahcache!AslpFileGetVersionBlock

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:av_ahcache!aslpfilegetversionblock

FAILURE_ID_HASH: {d54b07be-ba38-a0cf-544f-acbf511f22df}

Followup: MachineOwner

4

Looks like someone tripped over a bad address while trying to parse a PE
file’s version resource. You should be able to determine the PE file with
the following command: !vad 7f610000 1.

Is this reproducible? Does it always crash in the same place? Also, what
kind of driver have you written that is loaded on this machine?

-scott
OSR
@OSRDrivers

wrote in message news:xxxxx@ntfsd…

Thanks Scott for the reply,

Below is the output of !analyze -v command after fixing symbols.

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain bad or
it
is pointing at freed memory.
Arguments:
Arg1: d7613043, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 817ef929, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000002, (reserved)

Debugging Details:

Page 87cd not present in the dump file. Type “.hh dbgerr004” for details

READ_ADDRESS: GetPointerFromAddress: unable to read from 00000000
GetPointerFromAddress: unable to read from 00000000
unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
d7613043

FAULTING_IP:
nt!LdrpResSearchResourceInsideDirectory+6df
817ef929 8b10 mov edx,dword ptr [eax]

MM_INTERNAL_CODE: 2

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

PROCESS_NAME: explorer.exe

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

TRAP_FRAME: b0b95f50 – (.trap 0xffffffffb0b95f50)
ErrCode = 00000000
eax=d7613043 ebx=00006000 ecx=7f610278 edx=7f610278 esi=00000000
edi=7f610000
eip=817ef929 esp=b0b95fc4 ebp=b0b96074 iopl=0 nv up ei pl nz na pe
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010206
nt!LdrpResSearchResourceInsideDirectory+0x6df:
817ef929 8b10 mov edx,dword ptr [eax]
ds:0023:d7613043=???
Resetting default scope

LAST_CONTROL_TRANSFER: from 81528537 to 81593e44

STACK_TEXT:
b0b95dc4 81528537 00000050 d7613043 00000000 nt!KeBugCheckEx
b0b95e28 814cc187 b0b95f50 d7613043 b0b95e98 nt!MiSystemFault+0xe37
b0b95eb8 815a61c8 00000000 d7613043 00000000 nt!MmAccessFault+0x117
b0b95eb8 817ef929 00000000 d7613043 00000000 nt!KiTrap0E+0xec
b0b96074 81565d2c 00010000 7f648000 7f6100e0
nt!LdrpResSearchResourceInsideDirectory+0x6df
b0b963fc 817eef26 00002210 b0b9645c 00000003
nt!LdrpResSearchResourceMappedFile+0x2a4
b0b96488 8d94f0c3 7f610000 b0b96500 00000003 nt!LdrResSearchResource+0x1a4
b0b9652c 8d94e8c3 bafab008 00000400 0000000a
ahcache!AslpFileGetVersionBlock+0xcd
b0b96550 8d94bd3d 000374d6 bafbc008 00000014
ahcache!AslpFileGetVersionAttributes+0x21
b0b96570 8d94b885 00000400 00000000 00000000
ahcache!AslFileAllocAndGetAttributes+0x8d
b0b965bc 8d94bea1 7f83c9de 000374c8 bafab008
ahcache!SdbpCheckAllAttributes+0x295
b0b96600 8d94b318 b0b96638 bafb3580 bafbc008
ahcache!SdbpCheckMatchingFiles+0x79
b0b9663c 8d94aedc bafbc008 0003747e b0b96748 ahcache!SdbpMatchList+0x68
b0b96670 8d94afc6 0003747e b0b96748 b0b9669c ahcache!SdbpCheckForMatch+0x50
b0b966a0 8d94ad12 0003747e b0b9671c b0b96748 ahcache!SdbpCheckExe+0x7c
b0b96720 8d948e87 fffbd728 b0b96748 b0b967c4 ahcache!SdbpSearchDB+0x94
b0b96864 8d948930 fffbd728 bafaaa48 ab6163d0
ahcache!SdbGetMatchingExeEx+0x20d
b0b96898 8d9492a0 b0b9697c b0b96950 b0b96948
ahcache!AhcpSdbQueryLookupExe+0x58
b0b968fc 8d94f34a b0b9697c b0b96950 b0b96948 ahcache!AhcSdbQueryLookup+0x5a
b0b96980 8d94cfc1 8cafa300 baf9d158 800010a4
ahcache!AhcpCacheBuildSdbInfo+0x12e
b0b96a0c 8d94c6d5 8cafa300 b0b96a50 800010a4 ahcache!AhcCacheLookup+0x7e1
b0b96a70 8d94c2db 00000000 0ec1f630 00001000 ahcache!AhcApiLookup+0xa5
b0b96b90 8d94c136 00000001 00000000 8b78c398 ahcache!AhcDispatch+0x17b
b0b96ba4 814e2c13 8b78c398 b27a7be8 00000000
ahcache!AhcDriverDispatchDeviceControl+0x36
b0b96bc0 81778243 00000000 05bde1d0 8177819c nt!IofCallDriver+0x43
b0b96c04 815a2bdb 00000000 05bde1e0 05bde548 nt!NtApphelpCacheControl+0xa7
b0b96c04 77bd45f0 00000000 05bde1e0 05bde548 nt!KiSystemServicePostCall
WARNING: Frame IP not in any known module. Following frames may be wrong.
05bde548 00000000 00000000 00000000 00000000 0x77bd45f0

STACK_COMMAND: kb

FOLLOWUP_IP:
ahcache!AslpFileGetVersionBlock+cd
8d94f0c3 8bf0 mov esi,eax

SYMBOL_STACK_INDEX: 7

SYMBOL_NAME: ahcache!AslpFileGetVersionBlock+cd

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ahcache

IMAGE_NAME: ahcache.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 55866ccf

BUCKET_ID_FUNC_OFFSET: cd

FAILURE_BUCKET_ID: AV_ahcache!AslpFileGetVersionBlock

BUCKET_ID: AV_ahcache!AslpFileGetVersionBlock

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:av_ahcache!aslpfilegetversionblock

FAILURE_ID_HASH: {d54b07be-ba38-a0cf-544f-acbf511f22df}

Followup: MachineOwner