Re: A bluescreen caused by tcpip.sys.

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Just looking at the call stack, it is difficult to say what is wrong.

You should enable driver verifier on tcpip and your IM driver and attach a kernel debugger for live debugging. Also once you break in the debugger due to this bugcheck, run !analyze -v and then post that output here.

--
Pankaj Garg
2007-09-08 at 9:58am
http://www.intellectualheaven.com


On Fri, 7 Sep 2007, martin_stangel wrote:


Hi all,
we are developing an application that includes an NDIS 5.0 intermediate
filter driver. It works ok on Windows XP but we regularily experience
bluescreens on Vista caused by tcpip.sys (especially when connecting to a
network). Windbg analysis of the crashdump always shows the following
callstack:

8419ec38 81c49304 00000000 dfdfdfff 00000000 nt!MmAccessFault+0x14b
8419ec38 8a09c1c8 00000000 dfdfdfff 00000000 nt!KiTrap0E+0xdc
8419ecf8 8a09b877 b2664f88 91dd09e4 8419ed2c tcpip
IppNotifyRouteChangeAtPassive+0x21
8419ed08 83dca4cd aaba8fd8 81cf55fc 837903d8
tcpip!IppCompartmentNotificationWorker+0x11
8419ed2c 81e18fa4 837903d8 91dd09e4 941befe0
NETIO!NetiopIoWorkItemRoutine+0x2f
8419ed44 81c6b8aa 941befe0 00000000 82f4c2d8 nt!IopProcessWorkItem+0x2d
8419ed7c 81dafbfd 941befe0 84195680 00000000 nt!ExpWorkerThread+0xfd
8419edc0 81c9a396 81c6b7ad 00000001 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

The callstack is always almost the same regardless whether we turn the
Driver Verifier on or off. The bluescreen happens both on 32bit and 64bit
versions of Vista.

We think that our application or driver triggers a bug in tcpip.sys, but it
is impossible for us to determine how. Could someone from Microsoft please
comment on this and provide us confirmation of this bug and perhaps some
workarounds for it? We can provide full memory dumps on demand.
Thank you,
Martin Stangel

.

Relevant Pages

  • Re: How is possible that NDIS_PACKET->Head->MappedSystemVa is page
    ... Double-check your code in the crashing path; you probably have a bug. ... Also try and enable NDIS debug tracing, ... "NDIS Driver Debugging Guidelines" ... NDIS Debug Tracing and Kernel Debugger Extensions" ...
    (microsoft.public.development.device.drivers)
  • Re: Driver IRQL Not Less an Eaqual!!
    ... How long did you permit the Driver Verifier to run? ... BSOD, if even possible. ... I asked about Vista vs. XP b/c it matters when running SFC. ...
    (microsoft.public.windows.vista.general)
  • Re: How is possible that NDIS_PACKET->Head->MappedSystemVa is page
    ... I dont tell that I have not bug but confirming above info is important for me. ... Also try and enable NDIS debug tracing, ... "NDIS Driver Debugging Guidelines" ... NDIS Debug Tracing and Kernel Debugger Extensions" ...
    (microsoft.public.development.device.drivers)
  • RE: 0x000000c4 error
    ... I am nass; you are filthy TROLL ... driver verifier manager which I think added to this problem. ... 0x000000C4 If Deadlock Detection in Driver Verifier Is ... Then click on Advanced tab and scroll down to under the Browsing Option: ...
    (microsoft.public.windowsxp.perform_maintain)
  • RE: 0x000000c4 error
    ... "nass impersonator by Mick Murphy" wrote: ... driver verifier manager which I think added to this problem. ... 0x000000C4 If Deadlock Detection in Driver Verifier Is ... Then click on Advanced tab and scroll down to under the Browsing Option: ...
    (microsoft.public.windowsxp.perform_maintain)