Windows 8.1 Bad Pool Caller/Header


  • Hello,

    I've recently been encountering these two errors at random intervals. I've Googled the solutions, but could not find a definite fix. I've run a crash dump and have this file:

    Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\Windows\MEMORY.DMP]
    Kernel Bitmap Dump File: Only kernel address space is available

    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*C:\Windows\symbol_cashe*
    Symbol search path is: SRV*C:\Windows\symbol_cashe*
    Executable search path is: 
    Windows 8 Kernel Version 9600 MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 9600.17085.amd64fre.winblue_gdr.140330-1035
    Machine Name:
    Kernel base = 0xfffff802`0f48c000 PsLoadedModuleList = 0xfffff802`0f7562d0
    Debug session time: Sun Aug  3 00:16:14.168 2014 (UTC - 4:00)
    System Uptime: 2 days 2:10:01.968
    Loading Kernel Symbols
    Loading User Symbols

    Loading unloaded module list
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *

    Use !analyze -v to get detailed debugging information.

    BugCheck C2, {b, ffffe000ae84fdd8, 0, ffffe000ae8501e8}

    *** ERROR: Module load completed but symbols could not be loaded for klwfp.sys
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for klflt.sys - 
    Probably caused by : NETIO.SYS ( NETIO! ?? ::FNODOBFM::`string'+797c )

    Followup: MachineOwner

    0: kd> !analyze -v
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *

    The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
    Arg1: 000000000000000b, type of pool violation the caller is guilty of.
    Arg2: ffffe000ae84fdd8
    Arg3: 0000000000000000
    Arg4: ffffe000ae8501e8

    Debugging Details:

    NETIO! ?? ::FNODOBFM::`string'+797c
    fffff800`1fe35f67 90              nop

    BUGCHECK_STR:  0xc2_b


    PROCESS_NAME:  System


    ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

    LAST_CONTROL_TRANSFER:  from fffff8020f7224ce to fffff8020f5dffa0

    ffffd000`87a94068 fffff802`0f7224ce : 00000000`000000c2 00000000`0000000b ffffe000`ae84fdd8 00000000`00000000 : nt!KeBugCheckEx
    ffffd000`87a94070 fffff800`1fe35f67 : 00000000`00000000 00000000`00000000 00000000`00000002 fffff800`2052b5ea : nt!ExFreePoolWithTag+0x11ee
    ffffd000`87a94140 fffff800`203a7b6c : ffffe000`a5be4102 ffffe000`a8723ca0 00000000`00000001 fffff800`2052c165 : NETIO! ?? ::FNODOBFM::`string'+0x797c
    ffffd000`87a94190 fffff800`1fe04501 : ffffe000`aa9dc3d0 00000000`00000000 00000000`00000000 ffffe000`a5be4190 : tcpip!FlpReturnNetBufferListChain+0xbe38c
    ffffd000`87a941e0 fffff800`1fe013e7 : ffffe000`b2270030 00000000`00000000 00000000`00000000 ffffe000`aa9dc3d0 : NETIO!NetioDereferenceNetBufferList+0xb1
    ffffd000`87a94250 fffff800`202f6b5c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : NETIO!NetioDereferenceNetBufferListChain+0x2a7
    ffffd000`87a94310 fffff800`202f3b74 : 00000000`00000000 ffffe000`b2270030 fffff800`2046e180 fffff802`0f76a908 : tcpip!IppReceiveHeaderBatch+0x40c
    ffffd000`87a94440 fffff800`20410cf8 : ffffe000`a6ee1430 00000000`00000000 00000000`00000001 00000000`00000000 : tcpip!IppFlcReceivePacketsCore+0x6a9
    ffffd000`87a947c0 fffff800`2051defd : ffffe000`b2270002 ffffe000`a23ce610 ffffd000`87a94a99 ffffd000`87a8f000 : tcpip!IppInspectInjectReceive+0x148
    ffffd000`87a94820 fffff802`0f566256 : ffffe000`a35e6e00 fffff800`00000000 ffffe000`b2270030 fffff800`1fe3df4b : fwpkclnt!FwppInjectionStackCallout+0xe5
    ffffd000`87a948b0 fffff800`2052f62a : fffff800`2051de18 ffffd000`87a94a20 00000000`00000010 00000000`00000001 : nt!KeExpandKernelStackAndCalloutInternal+0xe6
    ffffd000`87a949a0 fffff800`21353f20 : ffffe000`a5be4190 ffffe000`a8723c00 01cfaed1`aa113400 ffffe000`a8723c00 : fwpkclnt!FwpsInjectTransportReceiveAsync0+0x2ea
    ffffd000`87a94ae0 fffff800`21354133 : ffffe000`a8723c00 00000000`00000080 ffffe000`a8723c00 fffff800`20f15110 : klwfp+0x4f20
    ffffd000`87a94b50 fffff800`21356902 : fffff800`00000000 ffffe000`00000000 00000000`00000000 00000000`00000001 : klwfp+0x5133
    ffffd000`87a94ba0 fffff800`20f2ef51 : ffffe000`a19ffa60 ffffc001`78175000 ffffe000`a34bc850 ffffe000`a26633f0 : klwfp+0x7902
    ffffd000`87a94bd0 fffff802`0f55b794 : fffff800`20f16d60 ffffe000`a5bbb880 ffffe000`a5bbb880 ffffe000`a1791040 : klflt!TmngReset+0xbd
    ffffd000`87a94c00 fffff802`0f5e65c6 : ffffd000`8552a180 ffffe000`a5bbb880 ffffd000`855363c0 00000200`00000000 : nt!PspSystemThreadStartup+0x58
    ffffd000`87a94c60 00000000`00000000 : ffffd000`87a95000 ffffd000`87a8f000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


    NETIO! ?? ::FNODOBFM::`string'+797c
    fffff800`1fe35f67 90              nop


    SYMBOL_NAME:  NETIO! ?? ::FNODOBFM::`string'+797c

    FOLLOWUP_NAME:  MachineOwner





    FAILURE_BUCKET_ID:  0xc2_b_NETIO!_??_::FNODOBFM::_string_

    BUCKET_ID:  0xc2_b_NETIO!_??_::FNODOBFM::_string_


    FAILURE_ID_HASH_STRING:  km:0xc2_b_netio!_??_::fnodobfm::_string_

    FAILURE_ID_HASH:  {2004c761-2953-7123-0c48-7c23e2563df0}

    Followup: MachineOwner

    If anyone could potentially help me fix this error, it'd be greatly appreciated!

    Tuesday, August 12, 2014 12:06 AM

All replies

  •  We do need the actual log file (called a DMP file) as they contain the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.  
    We prefer at least 2 DMP files to spot trends and confirm the cause.

    Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
    If you have any questions about the procedure please ask

    If you are using Blue screen view, who crashed, or a similar application, don't.  They are wrong at least as often as they are correct

    Wanikiya and Dyami--Team Zigzag

    Tuesday, August 12, 2014 12:07 AM
  • I'm in the process of getting the DMP File using your instructions, but I can't seem to compress or open the Minidump files. They're all unreadable. Not sure what I should do.
    Tuesday, August 12, 2014 12:53 AM
  • AP

    There is no user readable information in the DMP files.  You don't need to zip them or open them.  Simply upload to onedrive or another file sharing service and put a link to them in your next post.

    Wanikiya and Dyami--Team Zigzag

    Tuesday, August 12, 2014 2:16 AM