locked
BSOD due to ntkrnlmp.exe. Need to do further analyze to get the cause. RRS feed

  • Question

  • Hi,

    BSOD due to ntkrnlmp.exe. Need to do further analyze to get the cause. Please try to analyze the problem and let me know the steps involved.

    Mini Dump analyze report pasted below,

    Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Program Files\Debugging Tools for Windows (x86)\Minidump\012213-21512-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: srv*C:\Program Files\Debugging Tools for Windows (x86)\Symbol*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: LanManNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
    Machine Name:
    Kernel base = 0xfffff800`0160d000 PsLoadedModuleList = 0xfffff800`01851670
    Debug session time: Tue Jan 22 08:55:35.334 2013 (UTC + 5:30)
    System Uptime: 0 days 6:53:19.458
    Loading Kernel Symbols
    ....................................................
    Loading User Symbols
    Loading unloaded module list
    ...........
    ERROR: FindPlugIns 8007007b
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1, {fffff800016d0c8c, 0, ffff, 1}

    Probably caused by : ntkrnlmp.exe ( nt!CcWorkerThread+0 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    ERROR: FindPlugIns 8007007b
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    APC_INDEX_MISMATCH (1)
    This is a kernel internal error. The most common reason to see this
    bugcheck is when a filesystem or a driver has a mismatched number of
    calls to disable and re-enable APCs. The key data item is the
    Thread->KernelApcDisable field. A negative value indicates that a driver
    has disabled APC calls without re-enabling them.  A positive value indicates
    that the reverse is true. This check is made on exit from a system call.
    Arguments:
    Arg1: fffff800016d0c8c, address of system function (system call)
    Arg2: 0000000000000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex
    Arg3: 000000000000ffff, Thread->KernelApcDisable
    Arg4: 0000000000000001, Previous KernelApcDisable

    Debugging Details:
    ------------------


    FAULTING_IP:
    nt!CcWorkerThread+0
    fffff800`016d0c8c 488bc4          mov     rax,rsp

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

    BUGCHECK_STR:  0x1

    PROCESS_NAME:  System

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from fffff80001694ae9 to fffff880039b3c61

    STACK_TEXT:  
    fffff800`02e26c98 fffff800`01694ae9 : 00000000`0023c0f2 fffffa80`07d884f0 00000000`00000000 00000000`00000000 : 0xfffff880`039b3c61
    fffff800`02e26ca0 fffff800`01683c9c : fffff800`017fee80 fffff800`00000001 00000000`00000001 fffff880`00000000 : nt!PoIdle+0x52a
    fffff800`02e26d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x2c


    STACK_COMMAND:  .bugcheck ; kb

    FOLLOWUP_IP:
    nt!CcWorkerThread+0
    fffff800`016d0c8c 488bc4          mov     rax,rsp

    SYMBOL_NAME:  nt!CcWorkerThread+0

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

    FAILURE_BUCKET_ID:  X64_0x1_SysCallNum_0_nt!CcWorkerThread+0

    BUCKET_ID:  X64_0x1_SysCallNum_0_nt!CcWorkerThread+0

    Followup: MachineOwner
    ---------

    Tuesday, February 25, 2014 9:49 AM

Answers

  • Hi,

    This is a kernel internal error. A possible cause for this bug check is when a file system or driver has a mismatched sequence of system calls.

    Have you add new hardware recently? please check its related driver and update to the latest version.

    To detect issues with Windows drivers, try using Driver Verifier tool.

    verifier.exe /all   Verifies all the drivers in the system

    http://support.microsoft.com/kb/244617


    Andy Altmann
    TechNet Community Support

    • Marked as answer by Karen Hu Thursday, March 6, 2014 5:43 AM
    Thursday, February 27, 2014 9:07 AM

All replies

  • Hi,

    This is a kernel internal error. A possible cause for this bug check is when a file system or driver has a mismatched sequence of system calls.

    Have you add new hardware recently? please check its related driver and update to the latest version.

    To detect issues with Windows drivers, try using Driver Verifier tool.

    verifier.exe /all   Verifies all the drivers in the system

    http://support.microsoft.com/kb/244617


    Andy Altmann
    TechNet Community Support

    • Marked as answer by Karen Hu Thursday, March 6, 2014 5:43 AM
    Thursday, February 27, 2014 9:07 AM
  • Hi,

    Thanks for your reply. Let me get back to you once verified. Thanks.

    Regards,

    Ramasamy R S

    Thursday, June 26, 2014 7:26 PM