Win2003 SP1 BSOD - STOP 0xab - more info

I previously posted about a BSOD I've been seeing since SP1, caused
by a session pool leak (see below dump analysis). I've since figured
out how to reproduce the problem on demand - by printing a particular
document such as [1] from Word or Word Viewer in a Terminal Services
session, and then logging out. On affected machines *this happens
regardless of which printer driver is used*, and even when using
"fake" printer drivers like Adobe PDF Writer... *but* this only
happens on certain machines, and I haven't been able to determine
what the distinguishing factor is.

Note that this problem is separate from KB901150 and is not solved by
installing win32k.sys from that patch. In this case the leaking pool
tag is "Gump", which I think is to do with the GDI shim for user-mode
printer drivers, and the size of the leaking chunks is always 0x18
(24) bytes.

I'd like to know if anyone else has seen this, can reproduce it with
the below document, or has any suggestions on how to track it down
further.

Matt

[1] Exhibit 1: http://www.cse.unsw.edu.au/~matthewc/files/win2k3.doc

---

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload. This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 00000012, session ID
Arg2: 000001e0, number of paged pool bytes that are leaking
Arg3: 00000000, number of nonpaged pool bytes that are leaking
Arg4: 00000014, total number of paged and nonpaged allocations that are leaking.
nonpaged allocations are in the upper half of this word,
paged allocations are in the lower half of this word.

[...]

0: kd> !poolused 8
Sorting by Session Tag

Pool Used:
NonPaged Paged
Tag Allocs Used Allocs Used
Gump 0 0 20 480
TOTAL 0 0 20 480

.

Relevant Pages

  • Re: Win2003 SP1 BSOD - STOP 0xab - DIAGNOSIS
    ... session unload. ... rdpdd.dll or a video driver. ... number of paged pool bytes that are leaking ... total number of paged and nonpaged allocations that are ...
    (microsoft.public.windows.server.general)
  • Re: Slow Response for ASP.NET page
    ... the application pool level. ... application went down any session state was lost. ... On the Recycling tab, ... That causes the JITted assemblies to unload ...
    (microsoft.public.dotnet.framework.aspnet)
  • ASP.NET High memory usage
    ... We also grouped low level sites into 2 application pool. ... The main object is kept in session, and we also have some more tiny ... How can we measure the total session memory consumption for a worker ... Will it help us to have a session state server & web gardening? ...
    (microsoft.public.dotnet.framework.performance)
  • Win2003 SP1 TS blue screens (session pool leak)
    ... I have a busy terminal server which has repeatedly crashed with ... session unload. ... number of paged pool bytes that are leaking ... number of nonpaged pool bytes that are leaking ...
    (microsoft.public.windows.terminal_services)
  • =?iso-8859-1?q?Re:_Pl=F6tzliche_regelm._Reboots_bei_Windows_Server_2003_R2_(Termi?=
    ... session unload. ... number of paged pool bytes that are leaking ... number of nonpaged pool bytes that are leaking ... total number of paged and nonpaged allocations that are ...
    (microsoft.public.de.german.windows.server.general)