Bsod irql_not_less_or_equal

From: RichTaylor1974 <guest@xxxxxxxxxxxxxxxxx>
Date: Sat, 25 Oct 2008 05:36:48 -0500

Hi,

Thanks in advance for any help.

I've copied the Memory.dmp file below. The only pattern appears to be
when I'm opening or using significant memory, e.g copying or moving
images, playing Command and Conquer etc.

I've added an external USB HDD, a few software apps and I've loaded the
latest drivers for NVidia and Creative because (in my experience) most
issues relate to one or the other.

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Code:
--------------------

Symbol search path is: SRV*c:\symbols*'Symbol information' (http://msdl.microsoft.com/download/symbols)
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18145.amd64fre.vistasp1_gdr.080917-1612
Kernel base = 0xfffff800`02601000 PsLoadedModuleList = 0xfffff800`027c6db0
Debug session time: Fri Oct 24 23:13:06.585 2008 (GMT+1)
System Uptime: 0 days 0:07:10.413
Loading Kernel Symbols
.........................................................................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffdd018). Type ".hh dbgerr001" for details
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffffa6000a0e248, 0, ffffffffffffffff}

Page aa9ba not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 000007ff`fffdd018). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 000007ff`fffdd018). Type ".hh dbgerr001" for details
Probably caused by : Unknown_Image ( PAGE_NOT_ZERO_VISTA )

Followup: MachineOwner
---------

*** Memory manager detected 2 instance(s) of page corruption, target is likely to have memory corruption.

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffffa6000a0e248, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------

Page aa9ba not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 000007ff`fffdd018). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 000007ff`fffdd018). Type ".hh dbgerr001" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
fltmgr!TreeFindNodeOrParent+8
fffffa60`00a0e248 498b4220 mov rax,qword ptr [r10+20h]

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: ffffffffffffffff

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x1E

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 1

BAD_PAGES_DETECTED: 2

LAST_CONTROL_TRANSFER: from fffff8000262fe47 to fffff80002656350

STACK_TEXT:
fffffa60`0f231378 fffff800`0262fe47 : 00000000`0000001e ffffffff`c0000005 fffffa60`00a0e248 00000000`00000000 : nt!KeBugCheckEx
fffffa60`0f231380 fffff800`026561a9 : fffffa60`0f231ab8 fffffa80`043abbb8 fffffa60`0f231b60 fffffa80`0447c360 : nt! ?? ::FNODOBFM::`string'+0x29317
fffffa60`0f231980 fffff800`02654d8d : fffffa80`04eac060 80000000`100bc963 00000000`00000002 fffffa60`0101b97f : nt!KiExceptionDispatch+0xa9
fffffa60`0f231b60 fffffa60`00a0e248 : fffffa60`00a0e1cb fffffa80`04c4c010 fffffa80`04c4c028 fffffa80`04c4c010 : nt!KiGeneralProtectionFault+0xcd
fffffa60`0f231cf8 fffffa60`00a0e1cb : fffffa80`04c4c010 fffffa80`04c4c028 fffffa80`04c4c010 fffffa80`052af040 : fltmgr!TreeFindNodeOrParent+0x8
fffffa60`0f231d00 fffffa60`00a3e027 : 00000000`00000000 fffffa80`043abb20 fffffa80`043abb20 00000000`00000001 : fltmgr!TreeInsert+0x2b
fffffa60`0f231d30 fffffa60`00a10c4a : fffffa80`04c4c010 fffffa80`043abb20 fffffa80`0447c300 fffffa80`052afe10 : fltmgr!FltpCacheCreateNames+0x2f7
fffffa60`0f231db0 fffffa60`00a2726c : fffffa80`052af040 fffffa80`052af8d0 fffffa80`041e4c00 fffffa60`0f231e70 : fltmgr! ?? ::FNODOBFM::`string'+0x236f
fffffa60`0f231e20 fffff800`028dbd83 : 00000000`00000060 00000000`00000240 fffffa80`04b3a628 fffff880`098a0210 : fltmgr!FltpCreate+0x25d
fffffa60`0f231ed0 fffff800`028d5672 : fffffa80`052af040 00000000`00000000 fffffa80`0a65eb10 00000000`00000000 : nt!IopParseDevice+0x5e3
fffffa60`0f232070 fffff800`028d9944 : ffffffff`800025cc fffffa80`0a6bcb00 fffffa80`00000240 00000000`00000000 : nt!ObpLookupObjectName+0x202
fffffa60`0f232180 fffff800`028e5ee0 : 00000000`00000081 fffffa60`0f232630 00000000`00000000 fffffa80`0488ca00 : nt!ObOpenObjectByName+0x2f4
fffffa60`0f232250 fffff800`028b261a : fffffa60`0f232518 00000000`00000081 fffff880`098a0210 fffffa60`0f232550 : nt!IopCreateFile+0x290
fffffa60`0f2322f0 fffffa60`00a28dc9 : 00000000`00000000 fffffa60`0f232620 00000000`00000000 00000000`00000081 : nt!IoCreateFileEx+0xfa
fffffa60`0f232390 fffffa60`00a59f50 : 00000000`00000007 00000000`00000000 fffffa60`0f232518 fffffa60`0f232508 : fltmgr!FltCreateFileEx2+0x169
fffffa60`0f232480 fffff800`0295b217 : fffffa80`039c6501 fffff800`0265d201 00000000`00000000 fffffa80`05ccbd60 : fileinfo!FIPfInterfaceOpen+0x400
fffffa60`0f232600 fffff800`02a03aa7 : 00000000`00000081 ffffffff`ffe91ca0 fffffa60`0f232718 fffffa80`00000000 : nt!PfpOpenHandleCreate+0x117
fffffa60`0f2326d0 fffff800`02a05dc6 : 00000000`00000000 fffff880`0da0b980 fffff880`0da00000 fffffa60`00000060 : nt!PfpFileBuildReadSupport+0xe7
fffffa60`0f2327c0 fffff800`02a2f7a9 : fffff880`00000000 00000000`00000001 00000000`000003d9 00000000`00000000 : nt!PfpPrefetchFilesTrickle+0x126
fffffa60`0f2328c0 fffff800`02a2fa62 : 00000000`00000000 fffffa60`0f232ca0 fffffa60`0f232a08 fffff880`0da00001 : nt!PfpPrefetchRequestPerform+0x2f9
fffffa60`0f232960 fffff800`02a2fcc6 : fffffa60`0f232a08 00000000`00000001 fffffa80`0a23bc80 00000000`00000000 : nt!PfpPrefetchRequest+0x171
fffffa60`0f2329d0 fffff800`02a423f8 : 00000000`00000000 00000000`00000004 00000000`00000000 00000000`05ffef01 : nt!PfSetSuperfetchInformation+0x1a5
fffffa60`0f232ab0 fffff800`02655df3 : fffffa80`04eac060 00000000`05fff790 fffffa80`048ea201 00000000`000a47f6 : nt!NtSetSystemInformation+0x8fb
fffffa60`0f232c20 00000000`773370ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`05fff6e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x773370ea

STACK_COMMAND: kb

SYMBOL_NAME: PAGE_NOT_ZERO_VISTA

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: PAGE_NOT_ZERO_VISTA

Followup: MachineOwner
---------

*** Memory manager detected 2 instance(s) of page corruption, target is likely to have memory corruption.

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffffa6000a0e248, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------

Page aa9ba not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 000007ff`fffdd018). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 000007ff`fffdd018). Type ".hh dbgerr001" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
fltmgr!TreeFindNodeOrParent+8
fffffa60`00a0e248 498b4220 mov rax,qword ptr [r10+20h]

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: ffffffffffffffff

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x1E

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 1

BAD_PAGES_DETECTED: 2

LAST_CONTROL_TRANSFER: from fffff8000262fe47 to fffff80002656350

STACK_TEXT:
fffffa60`0f231378 fffff800`0262fe47 : 00000000`0000001e ffffffff`c0000005 fffffa60`00a0e248 00000000`00000000 : nt!KeBugCheckEx
fffffa60`0f231380 fffff800`026561a9 : fffffa60`0f231ab8 fffffa80`043abbb8 fffffa60`0f231b60 fffffa80`0447c360 : nt! ?? ::FNODOBFM::`string'+0x29317
fffffa60`0f231980 fffff800`02654d8d : fffffa80`04eac060 80000000`100bc963 00000000`00000002 fffffa60`0101b97f : nt!KiExceptionDispatch+0xa9
fffffa60`0f231b60 fffffa60`00a0e248 : fffffa60`00a0e1cb fffffa80`04c4c010 fffffa80`04c4c028 fffffa80`04c4c010 : nt!KiGeneralProtectionFault+0xcd
fffffa60`0f231cf8 fffffa60`00a0e1cb : fffffa80`04c4c010 fffffa80`04c4c028 fffffa80`04c4c010 fffffa80`052af040 : fltmgr!TreeFindNodeOrParent+0x8
fffffa60`0f231d00 fffffa60`00a3e027 : 00000000`00000000 fffffa80`043abb20 fffffa80`043abb20 00000000`00000001 : fltmgr!TreeInsert+0x2b
fffffa60`0f231d30 fffffa60`00a10c4a : fffffa80`04c4c010 fffffa80`043abb20 fffffa80`0447c300 fffffa80`052afe10 : fltmgr!FltpCacheCreateNames+0x2f7
fffffa60`0f231db0 fffffa60`00a2726c : fffffa80`052af040 fffffa80`052af8d0 fffffa80`041e4c00 fffffa60`0f231e70 : fltmgr! ?? ::FNODOBFM::`string'+0x236f
fffffa60`0f231e20 fffff800`028dbd83 : 00000000`00000060 00000000`00000240 fffffa80`04b3a628 fffff880`098a0210 : fltmgr!FltpCreate+0x25d
fffffa60`0f231ed0 fffff800`028d5672 : fffffa80`052af040 00000000`00000000 fffffa80`0a65eb10 00000000`00000000 : nt!IopParseDevice+0x5e3
fffffa60`0f232070 fffff800`028d9944 : ffffffff`800025cc fffffa80`0a6bcb00 fffffa80`00000240 00000000`00000000 : nt!ObpLookupObjectName+0x202
fffffa60`0f232180 fffff800`028e5ee0 : 00000000`00000081 fffffa60`0f232630 00000000`00000000 fffffa80`0488ca00 : nt!ObOpenObjectByName+0x2f4
fffffa60`0f232250 fffff800`028b261a : fffffa60`0f232518 00000000`00000081 fffff880`098a0210 fffffa60`0f232550 : nt!IopCreateFile+0x290
fffffa60`0f2322f0 fffffa60`00a28dc9 : 00000000`00000000 fffffa60`0f232620 00000000`00000000 00000000`00000081 : nt!IoCreateFileEx+0xfa
fffffa60`0f232390 fffffa60`00a59f50 : 00000000`00000007 00000000`00000000 fffffa60`0f232518 fffffa60`0f232508 : fltmgr!FltCreateFileEx2+0x169
fffffa60`0f232480 fffff800`0295b217 : fffffa80`039c6501 fffff800`0265d201 00000000`00000000 fffffa80`05ccbd60 : fileinfo!FIPfInterfaceOpen+0x400
fffffa60`0f232600 fffff800`02a03aa7 : 00000000`00000081 ffffffff`ffe91ca0 fffffa60`0f232718 fffffa80`00000000 : nt!PfpOpenHandleCreate+0x117
fffffa60`0f2326d0 fffff800`02a05dc6 : 00000000`00000000 fffff880`0da0b980 fffff880`0da00000 fffffa60`00000060 : nt!PfpFileBuildReadSupport+0xe7
fffffa60`0f2327c0 fffff800`02a2f7a9 : fffff880`00000000 00000000`00000001 00000000`000003d9 00000000`00000000 : nt!PfpPrefetchFilesTrickle+0x126
fffffa60`0f2328c0 fffff800`02a2fa62 : 00000000`00000000 fffffa60`0f232ca0 fffffa60`0f232a08 fffff880`0da00001 : nt!PfpPrefetchRequestPerform+0x2f9
fffffa60`0f232960 fffff800`02a2fcc6 : fffffa60`0f232a08 00000000`00000001 fffffa80`0a23bc80 00000000`00000000 : nt!PfpPrefetchRequest+0x171
fffffa60`0f2329d0 fffff800`02a423f8 : 00000000`00000000 00000000`00000004 00000000`00000000 00000000`05ffef01 : nt!PfSetSuperfetchInformation+0x1a5
fffffa60`0f232ab0 fffff800`02655df3 : fffffa80`04eac060 00000000`05fff790 fffffa80`048ea201 00000000`000a47f6 : nt!NtSetSystemInformation+0x8fb
fffffa60`0f232c20 00000000`773370ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`05fff6e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x773370ea

STACK_COMMAND: kb

SYMBOL_NAME: PAGE_NOT_ZERO_VISTA

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: PAGE_NOT_ZERO_VISTA

Followup: MachineOwner
---------

--------------------

*** Memory manager detected 2 instance(s) of page corruption, target is
likely to have memory corruption.

--
RichTaylor1974
.

Follow-Ups:
- Re: Bsod irql_not_less_or_equal
  - From: RichTaylor1974
- Re: Bsod irql_not_less_or_equal
  - From: jcgriff2
- Re: Bsod irql_not_less_or_equal
  - From: Mark H
- Re: Bsod irql_not_less_or_equal
  - From: Rick Rogers

Prev by Date: Windows Experience Index of 4.1
Next by Date: Re: Windows Experience Index of 4.1
Previous by thread: Windows Experience Index of 4.1
Next by thread: Re: Bsod irql_not_less_or_equal
Index(es):
- Date
- Thread

Relevant Pages

Re: Bsod irql_not_less_or_equal
... *** Memory manager detected 2 instanceof page corruption, ... likely to have memory corruption. ... the driver/function that caused the problem. ... The exception code that was not handled ...
(microsoft.public.windows.vista.performance_maintenance)
Re: Bsod irql_not_less_or_equal
... Your reads indicate memory corruption in the pagefile, and this is most frequently used during more memory intensive operations. ... Bugcheck Analysis * ... The exception code that was not handled ...
(microsoft.public.windows.vista.performance_maintenance)
Re: How to debug Explorer crash on logoff
... I managed to get a crash dump (actually, two of them, one for the "first chance exception" and one for the "second change exception"). ... User Mini Dump File: Only registers, stack and portions of memory are available ...
(microsoft.public.win32.programmer.kernel)
Re: How to troubleshoot bugchecks on my own?
... not a memory problem. ... From that exception record and context, ... execute the instruction - without a problem. ...
(microsoft.public.win32.programmer.kernel)
Re: Strange sudden shutdown issue with CF app
... Phone devices are notoriously low on virtual memory right out of the box because the OEMs decide to put every little thing into its own DLL and then have 25 processes launched at boot. ... Chris Tacke, Embedded MVP ... We have created an app that basically connects to a web service gets data, then stores it locally on the device, and when a record needs to be modified/added the system first tries to connect the web server sees if its availible, if not then it stores in locally on the device until the connection comes back, now I noticed that if the device does not mess around with the data connection then the application sits nicely as long as its open, and never gets shut down. ... But again most of the time I get no exception at all but just simply disappears. ...
(microsoft.public.dotnet.framework.compactframework)