none
BSOD csrss.exe crash (sxs.dll cause) RRS feed

  • Question

  • We're having random BSOD's from our computers.  Only user dump files are created.  Here's a snippet of the file, I'm wondering if anyone has any ideas what might be the cause?

    PROCESS_NAME:  csrss.exe
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    EXCEPTION_PARAMETER1:  0000000000000000
    EXCEPTION_PARAMETER2:  00000000027be0b8
    READ_ADDRESS:  00000000027be0b8
    FOLLOWUP_IP:
    sxs!BufferedStream::getLineBuf+1f
    000007fe`fcc41b2f 410fb702        movzx   eax,word ptr [r10]
    NTGLOBALFLAG:  0
    APPLICATION_VERIFIER_FLAGS:  0
    APP:  csrss.exe
    ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
    FAULTING_THREAD:  0000000000001170
    BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ_STACK_POINTER_MISMATCH
    PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ_STACK_POINTER_MISMATCH
    DEFAULT_BUCKET_ID:  INVALID_POINTER_READ_STACK_POINTER_MISMATCH
    LAST_CONTROL_TRANSFER:  from 000007fefcc41aea to 000007fefcc41b2f

    SYMBOL_STACK_INDEX:  0
    SYMBOL_NAME:  sxs!BufferedStream::getLineBuf+1f
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: sxs
    IMAGE_NAME:  sxs.dll
    DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7c9cc
    FAILURE_BUCKET_ID:  INVALID_POINTER_READ_STACK_POINTER_MISMATCH_c0000005_sxs.dll!BufferedStream::getLineBuf
    BUCKET_ID:  X64_APPLICATION_FAULT_INVALID_POINTER_READ_STACK_POINTER_MISMATCH_sxs!BufferedStream::getLineBuf+1f
    ANALYSIS_SOURCE:  UM
    FAILURE_ID_HASH_STRING:  um:invalid_pointer_read_stack_pointer_mismatch_c0000005_sxs.dll!bufferedstream::getlinebuf
    FAILURE_ID_HASH:  {558625b4-41c0-b4dc-930c-c09d8e328e35}

    Thursday, March 6, 2014 6:22 PM

Answers

  • This hotfix is from June 2012?  Our machines receive updates later than those posted, so I'd guess we already have that installed.  We actually found an issue with our SMART software on our PC's, after removing the software, the BSOD's disappear.  We'll be engaging our vendor.  Thanks for the help!
    • Marked as answer by aacajo Monday, March 31, 2014 9:37 PM
    Monday, March 31, 2014 9:36 PM

All replies

  • Aacajo

    The error 0xc0000005 is a memory exception which is probably caused by a driver.  You can run driver verifier to find the mis-behaving driver



    Please run this test to find which driver is causing the problem.  

    If you are overclocking (pushing the components beyond their design) you should revert to default at least until the crashing is solved. If you don't know what it is you probably are not overclocking.


    Driver verifier (for complete directions see our wiki here)
    Co-Authored by  JMH3143


    Wanikiya and Dyami--Team Zigzag

    Thursday, March 6, 2014 6:26 PM
    Moderator
  • Ran verifier as per the article and rebooted, everything seems fine.  The blue screens still happen at random during the night with only user dump files created.  Seems to be when the machine is idle.  A good chunk of the user dump files happen at 12:30AM so I'm trying to isolate what might be running at that time, but nothing apparent.  Any other ideas?
    Wednesday, March 12, 2014 2:10 PM
  • Aacajo

    We need the DMPS to be able to tell.


    Wanikiya and Dyami--Team Zigzag

    Wednesday, March 12, 2014 4:32 PM
    Moderator
  • Dumps

    Let me know how those look.  Thanks.

    • Edited by aacajo Wednesday, March 12, 2014 6:33 PM
    Wednesday, March 12, 2014 6:32 PM
  • I'm having the same issue at my company and it's driving me crazy. These BSOD happens so randomly and there was no dump file generated. 2 machines BSOD at 12:30 AM yesterday. Our machines are running Windows 7 x64 and we also running SCCM 2012 R2 and also System Center Endpoint Protection 2012.  Please let me know if you were able to fix it. I'm working with Microsoft support on this issue and will keep you guys updated.

    Message was: "STOP:
    C000021a [fatal system error].  The Windows subsystem process terminate
    unexpectedly with a status of 0xC0000005 (0xfd171b2f 0x00dbe5c0).  

    Friday, March 21, 2014 12:01 AM
  • This is what I got so far and you can get the dump file from %windir%\system32\config\systemprofile\appdata\local\crashdumps

    - Event Type : Stopped working (APPCRASH)

          Application Name: Client Server Runtime Process

          Path:             C:\windows\system32\csrss.exe

          Event Time      : 03/20/2014 12:30:24 AM

              Application Name: csrss.exe

              Application Version: 6.1.7600.16385

              Application Timestamp: 4a5bc115

              Fault Module Name: sxs.dll

              Fault Module Version: 6.1.7601.17514

              Fault Module Timestamp: 4ce7c9cc

              Exception Code: c0000005

              Exception Offset: 0000000000011b2f

          Memory dump     : Not created

    Friday, March 21, 2014 12:17 AM
  • I'm currently running Procdump –i –e –ma csrss.exe and hoping to catch a dump file soon.
    Friday, March 21, 2014 12:38 AM
  • Good news. Microsoft Support gave me a hotfix to update the sxs.dll file. Since my is just created, I cannot post any links or pictures on this forum. Accajo, please leave me your e-mail and I will send you the link for the hotfix.

    You can use Wusa.exe MSU_File.msu /quiet /norestart

    This should update the sxs.dll to 6.1.7601.17777

    I will give this a try and will come back with the result soon.

    Friday, March 21, 2014 2:33 AM
  • Description
    Faulting Application Path:    C:\Windows\System32\csrss.exe

    Problem signature
    Problem Event Name:    APPCRASH
    Application Name:    csrss.exe
    Application Version:    6.1.7600.16385
    Application Timestamp:    4a5bc115
    Fault Module Name:    sxs.dll
    Fault Module Version:    6.1.7601.17514
    Fault Module Timestamp:    4ce7c9cc
    Exception Code:    c0000005
    Exception Offset:    0000000000011b2f
    OS Version:    6.1.7601.2.1.0.256.48
    Locale ID:    1033
    Additional Information 1:    368c
    Additional Information 2:    368ce17d91cb55fbed042765b9f58805
    Additional Information 3:    2057
    Additional Information 4:    20576f97c28c1005c3d58ce2e2169030

    Looks like I have problems with that sxs.dll too.

    Wednesday, March 26, 2014 5:07 PM
  • Please donwload this patch Windows6.1-KB2675806-x64. I have tested at my firm and it seems to resolve the BSOD issue. We haven't have any call about BSOD for 2 days already. Since, my account is still waiting for verification, I cannot post any links here.

    support.microsoft.com/kb/2675806/en-us

    Wednesday, March 26, 2014 5:38 PM
  • This hotfix is from June 2012?  Our machines receive updates later than those posted, so I'd guess we already have that installed.  We actually found an issue with our SMART software on our PC's, after removing the software, the BSOD's disappear.  We'll be engaging our vendor.  Thanks for the help!
    • Marked as answer by aacajo Monday, March 31, 2014 9:37 PM
    Monday, March 31, 2014 9:36 PM
  • This hotfix resolved the problem for us. No BSOD call for about a week now. You should try to push it out. It will update sxs.dll file. This hotfix is not in the Windows Updates.

    Check your sxs.dll file for a release date. If it's created in 2010, then it's not updated. The updated version of sxs.dll should be created in 2012 to revision 6.1.7601.17777.

    Tuesday, April 1, 2014 12:50 AM
  • This hotfix is from June 2012?  Our machines receive updates later than those posted, so I'd guess we already have that installed.  We actually found an issue with our SMART software on our PC's, after removing the software, the BSOD's disappear.  We'll be engaging our vendor.  Thanks for the help!
    Curious if you mean Smarttech's Smartboard software?  We are having issues in our school right now and I'm trying to run down a restart issue with sxs.dll as well.  No dumps are occurring, they just flash blue screen and then restart.  We just upgraded this past summer from XP to Win 7 and now we're seeing this issue reported.  Any extra info would be appreciated.
    Thursday, September 18, 2014 5:07 PM
  • tanveer.bakshi@hotmail.com
    Tuesday, April 3, 2018 1:16 AM