Server 2012 BSOD


  • Server 2012 Standard is blue screening intermittently. Can someone help find the culprit?  Here is the mini dump data:

    Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\Users\sshea\Desktop\111413-55156-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Symbol search path is:
    Executable search path is: 
    Windows 8 Kernel Version 9200 MP (4 procs) Free x64
    Product: LanManNt, suite: TerminalServer SingleUserTS
    Built by: 9200.16581.amd64fre.win8_gdr.130410-1505
    Machine Name:
    Kernel base = 0xfffff801`52489000 PsLoadedModuleList = 0xfffff801`52755a20
    Debug session time: Thu Nov 14 07:47:20.577 2013 (UTC - 5:00)
    System Uptime: 9 days 23:07:26.225
    Loading Kernel Symbols
    Loading User Symbols
    Loading unloaded module list
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    Use !analyze -v to get detailed debugging information.
    BugCheck 19, {21, fffff9010067f000, 1060, 0}
    Probably caused by : win32k.sys ( win32k!EngFreeMem+21 )
    Followup: MachineOwner
    2: kd> !analyze -v
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    The pool is already corrupt at the time of the current request.
    This may or may not be due to the caller.
    The internal pool links must be walked to figure out a possible cause of
    the problem, and then special pool applied to the suspect tags or the driver
    verifier to a suspect driver.
    Arg1: 0000000000000021, the data following the pool block being freed is corrupt.  Typically this means the consumer (call stack ) has overrun the block.
    Arg2: fffff9010067f000, The pool pointer being freed.
    Arg3: 0000000000001060, The number of bytes allocated for the pool block.
    Arg4: 0000000000000000, The corrupted value found following the pool block.
    Debugging Details:

    BUGCHECK_STR:  0x19_21
    POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff801527e1168
    GetUlongFromAddress: unable to read from fffff801527e11f8
    Unable to get PFN database address fffff801527e1170
    PROCESS_NAME:  csrss.exe
    ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
    LAST_CONTROL_TRANSFER:  from fffff801526fb8a0 to fffff801524e3440
    fffff880`1403b148 fffff801`526fb8a0 : 00000000`00000019 00000000`00000021 fffff901`0067f000 00000000`00001060 : nt!KeBugCheckEx
    fffff880`1403b150 fffff960`001fa821 : fffff901`0067f000 00000000`00000000 fffff901`00000001 00000000`64667454 : nt!ExFreePool+0x792
    fffff880`1403b230 fffff960`0020b07d : fffff901`001b1438 fffff901`00890030 fffff901`0067f020 fffff880`1403b2e0 : win32k!EngFreeMem+0x21
    fffff880`1403b260 fffff960`0020a88f : fffff901`00890030 00000000`00000003 00000000`00000000 fffff901`001b13e0 : win32k!bLoadGlyphSet+0xe5
    fffff880`1403b290 fffff960`0020bf0d : 00000000`00000003 00000000`00000001 00000000`00000000 fffff880`1403b5e0 : win32k!bReloadGlyphSet+0x18f
    fffff880`1403b420 fffff960`0020be44 : fffff901`001b13e0 fffff880`00000001 00000000`00000001 fffff880`1403b5e0 : win32k!ttfdQueryFontTree+0x61
    fffff880`1403b480 fffff960`0020c140 : fffff960`0020bdcc fffff901`001b1720 00000000`00000000 00000000`00000000 : win32k!ttfdSemQueryFontTree+0x78
    fffff880`1403b4b0 fffff960`00219fa3 : 00000000`00000000 00000000`00000001 fffff880`1403b630 fffffa80`261e8610 : win32k!PDEVOBJ::QueryFontTree+0x6c
    fffff880`1403b560 fffff960`0021904e : fffff901`0008a010 fffff960`001f1895 00000000`00000000 fffff880`1403b830 : win32k!PFEOBJ::pfdg+0xdf
    fffff880`1403b5d0 fffff960`001ad1e9 : ffffffff`ffffffff fffff880`1403b898 fffff880`1403b798 fffff880`00000000 : win32k!RFONTOBJ::bRealizeFont+0x4e
    fffff880`1403b730 fffff960`002ccffe : 00000000`00000000 00045910`00000000 00000000`322f534f 00000000`00000000 : win32k!RFONTOBJ::bInit+0x737
    fffff880`1403b8f0 fffff960`002ccf7f : 00000000`00000000 00000000`00045910 fffff880`1403ba20 000007ff`bb133a59 : win32k!ulGetFontData2+0x46
    fffff880`1403b9e0 fffff960`002cce68 : fffff901`00081000 00000000`00000040 00000000`ffffffff ffff208b`0d90682d : win32k!ulGetFontData+0x5b
    fffff880`1403ba30 fffff801`524e2453 : 00000000`00000000 00000000`0087d858 fffff880`1403baa8 00000000`630105fc : win32k!NtGdiGetFontData+0x84
    fffff880`1403ba90 000007ff`bd892f1a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0087d838 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007ff`bd892f1a

    fffff960`001fa821 4883c420        add     rsp,20h
    SYMBOL_NAME:  win32k!EngFreeMem+21
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: win32k
    IMAGE_NAME:  win32k.sys
    IMAGE_VERSION:  6.2.9200.16699
    FAILURE_BUCKET_ID:  0x19_21_win32k!EngFreeMem
    BUCKET_ID:  0x19_21_win32k!EngFreeMem
    FAILURE_ID_HASH_STRING:  km:0x19_21_win32k!engfreemem
    FAILURE_ID_HASH:  {4ff5a1b4-ce59-aaed-3114-634ac3a0942b}
    Followup: MachineOwner

    Monday, November 18, 2013 6:23 PM


  • Hi,

    According to the error message, Error code 19 may be related to the device driver.  Please update all your drivers.

    For details about this error, please refer to the following article.

    Bug Check 0x19: BAD_POOL_HEADER

    Meanwhile, would you please let me know what the anti-virus program you use? Please scan your computer for computer viruses. And then temporarily disable all the third party security programs and boot in Clean Boot and Safe Mode to check if there are some software conflicts.

    By the way, troubleshoot this kind of kernel crash issue, we need to analyze the crash dump file to narrow down the root cause of the issue. Actually, it is not effective for us to debug the crash dump file here in the forum. If this issues is a state of emergency for you, and the issue can’t be solved by above ways. Please contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.

    To obtain the phone numbers for specific technology request, please refer to the web site listed below:;EN-US;OfferProPhone#faq607

    Hope this helps.

    Best regards,

    Justin Gu
    Thursday, November 21, 2013 5:42 AM