none
Windows Server 2008 Enterprise SP2 64bit BugCheck 3B Probably caused by : win32k.sys ( win32k!PFFOBJ::pPvtDataMatch+12 )

    Question

  • Hi Guys,

    Has anyone come across this BSOD error and found a fix, as I'm at a lost as to what is causing the BSOD

    Please see Windows Debugger output below:-


    Microsoft (R) Windows Debugger Version 6.2.9200.16384 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Transfer\Minidumps\Mini051414-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (8 procs) Free x64
    Product: Server, suite: Enterprise TerminalServer
    Built by: 6002.23154.amd64fre.vistasp2_ldr.130707-1535
    Machine Name:
    Kernel base = 0xfffff800`01c18000 PsLoadedModuleList = 0xfffff800`01dd7e30
    Debug session time: Wed May 14 12:01:16.178 2014 (UTC + 1:00)
    System Uptime: 3 days 7:15:01.532
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..................
    Loading User Symbols
    Loading unloaded module list
    ...........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 3B, {c0000005, fffff9600030271e, fffffa603d967ec0, 0}

    Probably caused by : win32k.sys ( win32k!PFFOBJ::pPvtDataMatch+12 )

    Followup: MachineOwner
    ---------

    7: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff9600030271e, Address of the instruction which caused the bugcheck
    Arg3: fffffa603d967ec0, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP:
    win32k!PFFOBJ::pPvtDataMatch+12
    fffff960`0030271e f6430804        test    byte ptr [rbx+8],4

    CONTEXT:  fffffa603d967ec0 -- (.cxr 0xfffffa603d967ec0)
    rax=fffff900c277dd10 rbx=6364735523080013 rcx=fffffa603d968790
    rdx=fffff900c2cc92a0 rsi=fffff900c2ade350 rdi=fffffa80369f6680
    rip=fffff9600030271e rsp=fffffa603d968720 rbp=0000000000000000
     r8=0000000000000000  r9=fffffa80369f6680 r10=fffffa803b6cdc48
    r11=fffffa603d9687c8 r12=fffffa603d968810 r13=0000000000000000
    r14=000000000000301f r15=0000000000000001
    iopl=0         nv up ei pl nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
    win32k!PFFOBJ::pPvtDataMatch+0x12:
    fffff960`0030271e f6430804        test    byte ptr [rbx+8],4 ds:002b:63647355`2308001b=??
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT_SERVER

    BUGCHECK_STR:  0x3B

    PROCESS_NAME:  chrome.exe

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from fffff960003009b1 to fffff9600030271e

    STACK_TEXT: 
    fffffa60`3d968720 fffff960`003009b1 : 00000000`0000301f 00000000`00004fbc 00000000`00000000 fffffa80`3b6cdbb0 : win32k!PFFOBJ::pPvtDataMatch+0x12
    fffffa60`3d968750 fffff960`001aacb6 : fffff900`c2ade350 fffff900`c3fa59e0 00000000`00000000 fffffa80`369f6680 : win32k!PFTOBJ::bUnloadWorkhorse+0x55
    fffffa60`3d9687d0 fffff960`001ab8d8 : fffff900`c2ade2d0 00000000`00000000 00000000`00000001 00000000`00000001 : win32k!vCleanupPrivateFonts+0x72
    fffffa60`3d968810 fffff960`0019fbc0 : 00000000`00000000 fffff800`01ebfe00 fffff900`c277dd10 fffffa80`38d5b800 : win32k!NtGdiCloseProcess+0x4a8
    fffffa60`3d968870 fffff960`0019f423 : 00000000`00000000 fffff900`c277dd10 00000000`00000000 fffff800`01ebfe48 : win32k!GdiProcessCallout+0x1f4
    fffffa60`3d9688f0 fffff800`01ecc924 : 00000000`00000000 00000000`00000000 fffff800`01db6ec0 00000000`00000000 : win32k!W32pProcessCallout+0x6f
    fffffa60`3d968920 fffff800`01ebfe65 : fffffa60`00000000 fffff800`01c89701 fffffa80`57c73810 00000000`78457350 : nt!PspExitThread+0x41c
    fffffa60`3d968a10 fffff800`01c89881 : fffffa60`3d968ad8 00000000`00000000 fffffa80`382fe430 00000000`00000000 : nt!PsExitSpecialApc+0x1d
    fffffa60`3d968a40 fffff800`01c8d935 : fffffa60`3d968ca0 fffffa60`3d968ae0 fffff800`01ebfe74 00000000`00000001 : nt!KiDeliverApc+0x441
    fffffa60`3d968ae0 fffff800`01c6721d : fffffa80`3b6cdbb0 00000000`0038f2f4 fffffa60`3d968bf8 fffffa80`597301e0 : nt!KiInitiateUserApc+0x75
    fffffa60`3d968c20 00000000`74c93d09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0xa2
    00000000`000eebd8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74c93d09


    FOLLOWUP_IP:
    win32k!PFFOBJ::pPvtDataMatch+12
    fffff960`0030271e f6430804        test    byte ptr [rbx+8],4

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  win32k!PFFOBJ::pPvtDataMatch+12

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME:  win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  52f4cf4d

    STACK_COMMAND:  .cxr 0xfffffa603d967ec0 ; kb

    FAILURE_BUCKET_ID:  X64_0x3B_win32k!PFFOBJ::pPvtDataMatch+12

    BUCKET_ID:  X64_0x3B_win32k!PFFOBJ::pPvtDataMatch+12

    Followup: MachineOwner
    ---------

    7: kd> lmvm win32k
    start             end                 module name
    fffff960`000e0000 fffff960`0039a000   win32k     (pdb symbols)          c:\symbols\win32k.pdb\E3E9D4C3813E470A90F52FAEC6461A252\win32k.pdb
        Loaded symbol image file: win32k.sys
        Mapped memory image file: c:\symbols\win32k.sys\52F4CF4D2ba000\win32k.sys
        Image path: win32k.sys
        Image name: win32k.sys
        Timestamp:        Fri Feb 07 12:19:25 2014 (52F4CF4D)
        CheckSum:         002AD344
        ImageSize:        002BA000
        File version:     6.0.6002.23325
        Product version:  6.0.6002.23325
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        3.7 Driver
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     win32k.sys
        OriginalFilename: win32k.sys
        ProductVersion:   6.0.6002.23325
        FileVersion:      6.0.6002.23325 (vistasp2_ldr.140207-0038)
        FileDescription:  Multi-User Win32 Driver
        LegalCopyright:   © Microsoft Corporation. All rights reserved.
    7: kd> .cxr 0xfffffa603d967ec0
    rax=fffff900c277dd10 rbx=6364735523080013 rcx=fffffa603d968790
    rdx=fffff900c2cc92a0 rsi=fffff900c2ade350 rdi=fffffa80369f6680
    rip=fffff9600030271e rsp=fffffa603d968720 rbp=0000000000000000
     r8=0000000000000000  r9=fffffa80369f6680 r10=fffffa803b6cdc48
    r11=fffffa603d9687c8 r12=fffffa603d968810 r13=0000000000000000
    r14=000000000000301f r15=0000000000000001
    iopl=0         nv up ei pl nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
    win32k!PFFOBJ::pPvtDataMatch+0x12:
    fffff960`0030271e f6430804        test    byte ptr [rbx+8],4 ds:002b:63647355`2308001b=??

    Thanks

    JT

    Thursday, May 15, 2014 11:24 AM

Answers

  • Hi JT,

    Sorry for my delay.

    Regarding to Bug Check 0x3B, it indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code. For more details, please refer to the following article.

    Bug Check 0x3B: SYSTEM_SERVICE_EXCEPTION

    Would you please let me confirm whether any operation had been done before this issue occurred? Or this BSOD issue just occurred suddenly?

    Please install all necessary updates, and update all possible drivers. Then monitor the result. Meanwhile, please perform a clean boot to eliminate software conflicts. Then check if this BSOD issue still persists.

    In addition, did you have another good Windows Server 2008 Enterprise (SP2 and 64-bit) without this BSOD issue? If has, please open C:\Windows\System32 folder and navigate to win32k.sys file. And right click it and select Properties. Then please compare details of win32k.sys file in this problematic server with a good one. Any difference?

    By the way, if this issues is a state of emergency for you. Please contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.

    To obtain the phone numbers for specific technology request, please refer to the web site listed below:

    http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607

    Hope this helps.

    Best regards,

    Justin Gu


    Tuesday, May 20, 2014 3:10 AM

All replies

  • Hi JT,

    Sorry for my delay.

    Regarding to Bug Check 0x3B, it indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code. For more details, please refer to the following article.

    Bug Check 0x3B: SYSTEM_SERVICE_EXCEPTION

    Would you please let me confirm whether any operation had been done before this issue occurred? Or this BSOD issue just occurred suddenly?

    Please install all necessary updates, and update all possible drivers. Then monitor the result. Meanwhile, please perform a clean boot to eliminate software conflicts. Then check if this BSOD issue still persists.

    In addition, did you have another good Windows Server 2008 Enterprise (SP2 and 64-bit) without this BSOD issue? If has, please open C:\Windows\System32 folder and navigate to win32k.sys file. And right click it and select Properties. Then please compare details of win32k.sys file in this problematic server with a good one. Any difference?

    By the way, if this issues is a state of emergency for you. Please contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.

    To obtain the phone numbers for specific technology request, please refer to the web site listed below:

    http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607

    Hope this helps.

    Best regards,

    Justin Gu


    Tuesday, May 20, 2014 3:10 AM
  • Getting BSOD's pointing to this dll also. Started at around the same date as Jitinder's post. Maybe a new issue introduced has been introduced?

    7: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff9600011fda0, Address of the instruction which caused the bugcheck
    Arg3: fffffa6027acd1d0, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.

    Debugging Details:
    ------------------


    "kernel32.dll" was not found in the image list.
    Debugger will attempt to load "kernel32.dll" at given base 00000000`00000000.

    Please provide the full image name, including the extension (i.e. kernel32.dll)
    for more reliable results.Base address and size overrides can be given as
    .reload <image.ext>=<base>,<size>.
    Unable to add module at 00000000`00000000

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP: 
    win32k!PFEOBJ::vFreepfdg+e8
    fffff960`0011fda0 0fba60300f      bt      dword ptr [rax+30h],0Fh

    CONTEXT:  fffffa6027acd1d0 -- (.cxr 0xfffffa6027acd1d0)
    rax=00000000014c0000 rbx=0000000000000000 rcx=fffff900c009c2a0
    rdx=fffffa802735ab80 rsi=fffff900c0b9b010 rdi=fffffa6027acda80
    rip=fffff9600011fda0 rsp=fffffa6027acda30 rbp=0000000000000000
     r8=0000000000000000  r9=0000000000000000 r10=fffffa802800a288
    r11=fffffa802800a060 r12=0000000000000000 r13=0000000000000000
    r14=000000001539ed50 r15=0000000000000001
    iopl=0         nv up ei pl nz na po cy
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010207
    win32k!PFEOBJ::vFreepfdg+0xe8:
    fffff960`0011fda0 0fba60300f      bt      dword ptr [rax+30h],0Fh ds:002b:00000000`014c0030=????????
    Resetting default scope

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x3B

    PROCESS_NAME:  iexplore.exe

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from fffff960002e66d4 to fffff9600011fda0

    STACK_TEXT:  
    fffffa60`27acda30 fffff960`002e66d4 : 00000000`00000000 fffffa80`2735ab50 00000000`00000001 00000000`746e6647 : win32k!PFEOBJ::vFreepfdg+0xe8
    fffffa60`27acda60 fffff960`002f0cb7 : 00000000`00000000 fffff900`c008f000 fffff900`c0010000 00000000`00000000 : win32k!RFONTOBJ::vDeleteRFONT+0x210
    fffffa60`27acdac0 fffff960`002f0926 : 00000000`00000000 fffff900`c2bfcca0 fffff900`c0ae4010 00000000`00000000 : win32k!vRestartKillRFONTList+0xab
    fffffa60`27acdb10 fffff960`00275c79 : 00000000`00000000 00000000`00000001 fffffa80`235762b0 fffff900`00000002 : win32k!PFTOBJ::bUnloadWorkhorse+0x196
    fffffa60`27acdb90 fffff960`002978e2 : fffffa80`2800a060 fffff900`c0b932a0 fffffa60`27acdca0 00000000`7457c444 : win32k!GreRemoveFontMemResourceEx+0xad
    fffffa60`27acdbf0 fffff800`01a64173 : fffffa80`2800a060 fffffa60`27acdca0 00000000`7ee9f000 fffffa80`25803040 : win32k!NtGdiRemoveFontMemResourceEx+0x12
    fffffa60`27acdc20 00000000`74513d09 : 00000000`74513cc5 00000023`77300682 00000000`00000023 00000000`00000202 : nt!KiSystemServiceCopyEnd+0x13
    00000000`1539ed48 00000000`74513cc5 : 00000023`77300682 00000000`00000023 00000000`00000202 00000000`1767d5e0 : wow64cpu!CpupSyscallStub+0x9
    00000000`1539ed50 00000000`7457ab36 : 00000000`77120000 00000000`1539fd20 00000000`60c8f022 00000000`1539f450 : wow64cpu!Thunk0Arg+0x5
    00000000`1539edc0 00000000`7457a13a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : wow64!RunCpuSimulation+0xa
    00000000`1539edf0 00000000`771847c8 : 00000000`00000000 00000000`00000000 00000000`7efdf000 00000000`00000000 : wow64!Wow64LdrpInitialize+0x4b6
    00000000`1539f350 00000000`771461be : 00000000`1539f450 00000000`00000000 00000000`7efdf000 00000000`00000000 : ntdll! ?? ::FNODOBFM::`string'+0x1fba1
    00000000`1539f400 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!LdrInitializeThunk+0xe


    FOLLOWUP_IP: 
    win32k!PFEOBJ::vFreepfdg+e8
    fffff960`0011fda0 0fba60300f      bt      dword ptr [rax+30h],0Fh

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  win32k!PFEOBJ::vFreepfdg+e8

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME:  win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  5202fc4d

    STACK_COMMAND:  .cxr 0xfffffa6027acd1d0 ; kb

    FAILURE_BUCKET_ID:  X64_0x3B_win32k!PFEOBJ::vFreepfdg+e8

    BUCKET_ID:  X64_0x3B_win32k!PFEOBJ::vFreepfdg+e8

    Followup: MachineOwner
    ---------

    7: kd> lmv m win32k
    start             end                 module name
    fffff960`000d0000 fffff960`00389000   win32k     (pdb symbols)          c:\symcache\win32k.pdb\54B8C53009264F08A9D8CF1B4B56BCDC2\win32k.pdb
        Loaded symbol image file: win32k.sys
        Image path: \SystemRoot\System32\win32k.sys
        Image name: win32k.sys
        Timestamp:        Thu Aug 08 04:02:53 2013 (5202FC4D)
        CheckSum:         002B126B
        ImageSize:        002B9000
        File version:     6.0.6002.18912
        Product version:  6.0.6002.18912
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        3.7 Driver
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     win32k.sys
        OriginalFilename: win32k.sys
        ProductVersion:   6.0.6002.18912
        FileVersion:      6.0.6002.18912 (vistasp2_gdr.130807-1537)
        FileDescription:  Multi-User Win32 Driver
        LegalCopyright:   © Microsoft Corporation. All rights reserved.

    7: kd> .cxr 0xfffffa6027acd1d0
    rax=00000000014c0000 rbx=0000000000000000 rcx=fffff900c009c2a0
    rdx=fffffa802735ab80 rsi=fffff900c0b9b010 rdi=fffffa6027acda80
    rip=fffff9600011fda0 rsp=fffffa6027acda30 rbp=0000000000000000
     r8=0000000000000000  r9=0000000000000000 r10=fffffa802800a288
    r11=fffffa802800a060 r12=0000000000000000 r13=0000000000000000
    r14=000000001539ed50 r15=0000000000000001
    iopl=0         nv up ei pl nz na po cy
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010207
    win32k!PFEOBJ::vFreepfdg+0xe8:
    fffff960`0011fda0 0fba60300f      bt      dword ptr [rax+30h],0Fh ds:002b:00000000`014c0030=????????


    Wednesday, May 21, 2014 7:48 AM