locked
BSOD - EXCEPTION_CODE: (NTSTATUS) 0xc0000005 RRS feed

  • Question

  • Hi,

    I keep getting crashes while using VMWare with SMB2.1 protocol.

    Debugging details:

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff88009025a92, The address that the exception occurred at
    Arg3: fffff880092fb858, Exception Record Address
    Arg4: fffff880092fb0b0, Context Record Address
    
    Debugging Details:
    ------------------
    
    TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
    
    FAULTING_IP: 
    srv2!Smb2LeaseAcknowledge+182
    fffff880`09025a92 488b4920        mov     rcx,qword ptr [rcx+20h]
    
    EXCEPTION_RECORD:  fffff880092fb858 -- (.exr 0xfffff880092fb858)
    ExceptionAddress: fffff88009025a92 (srv2!Smb2LeaseAcknowledge+0x0000000000000182)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000020
    Attempt to read from address 0000000000000020

    Here is the MiniDump

    How do I solve it?

    Tuesday, June 16, 2015 6:13 PM

Answers

  • Related to srv2.sys Smb 2.0 Server driver from Microsoft Corporation but I believe the underlying issue is a 6 year old Cisco VPN client driver (dne64x.sys)

    Update the Cisco driver and if that does not fix the issue I would run driver verifier to find the underlying issue

    These crashes were related to memory corruption (probably caused by a driver). 

    Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier first.  You do not need to run memtest yet unless verifier does not find the cause, or you want to.


    If you are over-clocking anything reset to default before running these tests.
    In other words STOP!!!  If you do not know what this means you probably are not


    1-Driver verifier (for complete directions see our wiki here)

    2-Memtest. (You can read more about running memtest here)


    Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\061615-6817-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
    Machine Name:
    Kernel base = 0xfffff800`03263000 PsLoadedModuleList = 0xfffff800`034aa730
    Debug session time: Tue Jun 16 12:41:02.511 2015 (UTC - 4:00)
    System Uptime: 0 days 3:08:09.791
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ........................................................
    Loading User Symbols
    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1000007E, {ffffffffc0000005, fffff88009025a92, fffff8800ccb9858, fffff8800ccb90b0}
    
    Probably caused by : srv2.sys ( srv2!Smb2LeaseAcknowledge+182 )
    
    Followup: MachineOwner
    ---------
    
    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff88009025a92, The address that the exception occurred at
    Arg3: fffff8800ccb9858, Exception Record Address
    Arg4: fffff8800ccb90b0, Context Record Address
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    FAULTING_IP: 
    srv2!Smb2LeaseAcknowledge+182
    fffff880`09025a92 488b4920        mov     rcx,qword ptr [rcx+20h]
    
    EXCEPTION_RECORD:  fffff8800ccb9858 -- (.exr 0xfffff8800ccb9858)
    ExceptionAddress: fffff88009025a92 (srv2!Smb2LeaseAcknowledge+0x0000000000000182)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000020
    Attempt to read from address 0000000000000020
    
    CONTEXT:  fffff8800ccb90b0 -- (.cxr 0xfffff8800ccb90b0;r)
    rax=fffff8800902f400 rbx=fffffa80175ccfb8 rcx=0000000000000000
    rdx=0000000000000002 rsi=0000000000000001 rdi=fffffa8016acb020
    rip=fffff88009025a92 rsp=fffff8800ccb9a90 rbp=0000000000000003
     r8=fffffa801dcba660  r9=0000000000000000 r10=0000000000000000
    r11=fffffa802052e220 r12=fffffa80129dfd51 r13=00000000000000ff
    r14=fffffa80175ccc60 r15=fffff78000000300
    iopl=0         nv up ei ng nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
    srv2!Smb2LeaseAcknowledge+0x182:
    fffff880`09025a92 488b4920        mov     rcx,qword ptr [rcx+20h] ds:002b:00000000`00000020=????????????????
    Last set context:
    rax=fffff8800902f400 rbx=fffffa80175ccfb8 rcx=0000000000000000
    rdx=0000000000000002 rsi=0000000000000001 rdi=fffffa8016acb020
    rip=fffff88009025a92 rsp=fffff8800ccb9a90 rbp=0000000000000003
     r8=fffffa801dcba660  r9=0000000000000000 r10=0000000000000000
    r11=fffffa802052e220 r12=fffffa80129dfd51 r13=00000000000000ff
    r14=fffffa80175ccc60 r15=fffff78000000300
    iopl=0         nv up ei ng nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
    srv2!Smb2LeaseAcknowledge+0x182:
    fffff880`09025a92 488b4920        mov     rcx,qword ptr [rcx+20h] ds:002b:00000000`00000020=????????????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  0000000000000020
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003514100
    GetUlongFromAddress: unable to read from fffff800035141c0
     0000000000000020 Nonpaged pool
    
    FOLLOWUP_IP: 
    srv2!Smb2LeaseAcknowledge+182
    fffff880`09025a92 488b4920        mov     rcx,qword ptr [rcx+20h]
    
    BUGCHECK_STR:  0x7E
    
    DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE
    
    ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff8800901a384 to fffff88009025a92
    
    STACK_TEXT:  
    fffff880`0ccb9a90 fffff880`0901a384 : fffffa80`0d978d30 fffffa80`129dfa30 fffffa80`129dfce0 fffffa80`10a4f490 : srv2!Smb2LeaseAcknowledge+0x182
    fffff880`0ccb9af0 fffff880`090345d0 : fffffa80`129dfa30 fffffa80`129dfa30 fffff880`0902e110 fffffa80`10a4f490 : srv2! ?? ::FNODOBFM::`string'+0x3f1d
    fffff880`0ccb9b40 fffff880`0903439a : 00000000`0000000d fffffa80`0d9a9b80 fffffa80`0d9a9b80 fffffa80`129dfa40 : srv2!SrvProcessPacket+0xa0
    fffff880`0ccb9b80 fffff800`03571456 : fffffa80`10bda010 fffffa80`21d2b530 00000000`00000080 fffffa80`0cfde9c0 : srv2!SrvProcWorkerThread+0x15a
    fffff880`0ccb9c00 fffff800`032c92c6 : fffff800`03456e80 fffffa80`21d2b530 fffffa80`0d9ab040 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`0ccb9c40 00000000`00000000 : fffff880`0ccba000 fffff880`0ccb4000 fffff880`0ccb9870 00000000`00000000 : nt!KxStartSystemThread+0x16
    
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  srv2!Smb2LeaseAcknowledge+182
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: srv2
    
    IMAGE_NAME:  srv2.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4dba2b0a
    
    IMAGE_VERSION:  6.1.7601.17608
    
    STACK_COMMAND:  .cxr 0xfffff8800ccb90b0 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x7E_srv2!Smb2LeaseAcknowledge+182
    
    BUCKET_ID:  X64_0x7E_srv2!Smb2LeaseAcknowledge+182
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0x7e_srv2!smb2leaseacknowledge+182
    
    FAILURE_ID_HASH:  {1c531bfc-dab2-cdb3-b1ca-acf4f6225d0f}
    
    Followup: MachineOwner
    ---------
    
    2: kd> lmvm srv2
    start             end                 module name
    fffff880`0900c000 fffff880`09075000   srv2       (pdb symbols)          d:\symbols\srv2.pdb\214F1ABF28114C90B206815633D167CF2\srv2.pdb
        Loaded symbol image file: srv2.sys
        Mapped memory image file: d:\symbols\srv2.sys\4DBA2B0A69000\srv2.sys
        Image path: \SystemRoot\System32\DRIVERS\srv2.sys
        Image name: srv2.sys
        Timestamp:        Thu Apr 28 23:05:46 2011 (4DBA2B0A)
        CheckSum:         0006CA1E
        ImageSize:        00069000
        File version:     6.1.7601.17608
        Product version:  6.1.7601.17608
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        3.6 Driver
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     SRV2.SYS
        OriginalFilename: SRV2.SYS
        ProductVersion:   6.1.7601.17608
        FileVersion:      6.1.7601.17608 (win7sp1_gdr.110428-1525)
        FileDescription:  Smb 2.0 Server driver
        LegalCopyright:   © Microsoft Corporation. All rights reserved.
    2: kd> .exr 0xfffff8800ccb9858
    ExceptionAddress: fffff88009025a92 (srv2!Smb2LeaseAcknowledge+0x0000000000000182)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000020
    Attempt to read from address 0000000000000020
    2: kd> .cxr 0xfffff8800ccb90b0;r
    rax=fffff8800902f400 rbx=fffffa80175ccfb8 rcx=0000000000000000
    rdx=0000000000000002 rsi=0000000000000001 rdi=fffffa8016acb020
    rip=fffff88009025a92 rsp=fffff8800ccb9a90 rbp=0000000000000003
     r8=fffffa801dcba660  r9=0000000000000000 r10=0000000000000000
    r11=fffffa802052e220 r12=fffffa80129dfd51 r13=00000000000000ff
    r14=fffffa80175ccc60 r15=fffff78000000300
    iopl=0         nv up ei ng nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
    srv2!Smb2LeaseAcknowledge+0x182:
    fffff880`09025a92 488b4920        mov     rcx,qword ptr [rcx+20h] ds:002b:00000000`00000020=????????????????
    Last set context:
    rax=fffff8800902f400 rbx=fffffa80175ccfb8 rcx=0000000000000000
    rdx=0000000000000002 rsi=0000000000000001 rdi=fffffa8016acb020
    rip=fffff88009025a92 rsp=fffff8800ccb9a90 rbp=0000000000000003
     r8=fffffa801dcba660  r9=0000000000000000 r10=0000000000000000
    r11=fffffa802052e220 r12=fffffa80129dfd51 r13=00000000000000ff
    r14=fffffa80175ccc60 r15=fffff78000000300
    iopl=0         nv up ei ng nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
    srv2!Smb2LeaseAcknowledge+0x182:
    fffff880`09025a92 488b4920        mov     rcx,qword ptr [rcx+20h] ds:002b:00000000`00000020=????????????????
    


    Wanikiya and Dyami--Team Zigzag

    • Proposed as answer by Deason Wu Monday, June 22, 2015 3:00 AM
    • Marked as answer by Richardwilly98 Monday, June 29, 2015 3:13 PM
    Tuesday, June 16, 2015 6:24 PM

All replies

  • Related to srv2.sys Smb 2.0 Server driver from Microsoft Corporation but I believe the underlying issue is a 6 year old Cisco VPN client driver (dne64x.sys)

    Update the Cisco driver and if that does not fix the issue I would run driver verifier to find the underlying issue

    These crashes were related to memory corruption (probably caused by a driver). 

    Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier first.  You do not need to run memtest yet unless verifier does not find the cause, or you want to.


    If you are over-clocking anything reset to default before running these tests.
    In other words STOP!!!  If you do not know what this means you probably are not


    1-Driver verifier (for complete directions see our wiki here)

    2-Memtest. (You can read more about running memtest here)


    Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\061615-6817-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
    Machine Name:
    Kernel base = 0xfffff800`03263000 PsLoadedModuleList = 0xfffff800`034aa730
    Debug session time: Tue Jun 16 12:41:02.511 2015 (UTC - 4:00)
    System Uptime: 0 days 3:08:09.791
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ........................................................
    Loading User Symbols
    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1000007E, {ffffffffc0000005, fffff88009025a92, fffff8800ccb9858, fffff8800ccb90b0}
    
    Probably caused by : srv2.sys ( srv2!Smb2LeaseAcknowledge+182 )
    
    Followup: MachineOwner
    ---------
    
    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff88009025a92, The address that the exception occurred at
    Arg3: fffff8800ccb9858, Exception Record Address
    Arg4: fffff8800ccb90b0, Context Record Address
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    FAULTING_IP: 
    srv2!Smb2LeaseAcknowledge+182
    fffff880`09025a92 488b4920        mov     rcx,qword ptr [rcx+20h]
    
    EXCEPTION_RECORD:  fffff8800ccb9858 -- (.exr 0xfffff8800ccb9858)
    ExceptionAddress: fffff88009025a92 (srv2!Smb2LeaseAcknowledge+0x0000000000000182)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000020
    Attempt to read from address 0000000000000020
    
    CONTEXT:  fffff8800ccb90b0 -- (.cxr 0xfffff8800ccb90b0;r)
    rax=fffff8800902f400 rbx=fffffa80175ccfb8 rcx=0000000000000000
    rdx=0000000000000002 rsi=0000000000000001 rdi=fffffa8016acb020
    rip=fffff88009025a92 rsp=fffff8800ccb9a90 rbp=0000000000000003
     r8=fffffa801dcba660  r9=0000000000000000 r10=0000000000000000
    r11=fffffa802052e220 r12=fffffa80129dfd51 r13=00000000000000ff
    r14=fffffa80175ccc60 r15=fffff78000000300
    iopl=0         nv up ei ng nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
    srv2!Smb2LeaseAcknowledge+0x182:
    fffff880`09025a92 488b4920        mov     rcx,qword ptr [rcx+20h] ds:002b:00000000`00000020=????????????????
    Last set context:
    rax=fffff8800902f400 rbx=fffffa80175ccfb8 rcx=0000000000000000
    rdx=0000000000000002 rsi=0000000000000001 rdi=fffffa8016acb020
    rip=fffff88009025a92 rsp=fffff8800ccb9a90 rbp=0000000000000003
     r8=fffffa801dcba660  r9=0000000000000000 r10=0000000000000000
    r11=fffffa802052e220 r12=fffffa80129dfd51 r13=00000000000000ff
    r14=fffffa80175ccc60 r15=fffff78000000300
    iopl=0         nv up ei ng nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
    srv2!Smb2LeaseAcknowledge+0x182:
    fffff880`09025a92 488b4920        mov     rcx,qword ptr [rcx+20h] ds:002b:00000000`00000020=????????????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  0000000000000020
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003514100
    GetUlongFromAddress: unable to read from fffff800035141c0
     0000000000000020 Nonpaged pool
    
    FOLLOWUP_IP: 
    srv2!Smb2LeaseAcknowledge+182
    fffff880`09025a92 488b4920        mov     rcx,qword ptr [rcx+20h]
    
    BUGCHECK_STR:  0x7E
    
    DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE
    
    ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff8800901a384 to fffff88009025a92
    
    STACK_TEXT:  
    fffff880`0ccb9a90 fffff880`0901a384 : fffffa80`0d978d30 fffffa80`129dfa30 fffffa80`129dfce0 fffffa80`10a4f490 : srv2!Smb2LeaseAcknowledge+0x182
    fffff880`0ccb9af0 fffff880`090345d0 : fffffa80`129dfa30 fffffa80`129dfa30 fffff880`0902e110 fffffa80`10a4f490 : srv2! ?? ::FNODOBFM::`string'+0x3f1d
    fffff880`0ccb9b40 fffff880`0903439a : 00000000`0000000d fffffa80`0d9a9b80 fffffa80`0d9a9b80 fffffa80`129dfa40 : srv2!SrvProcessPacket+0xa0
    fffff880`0ccb9b80 fffff800`03571456 : fffffa80`10bda010 fffffa80`21d2b530 00000000`00000080 fffffa80`0cfde9c0 : srv2!SrvProcWorkerThread+0x15a
    fffff880`0ccb9c00 fffff800`032c92c6 : fffff800`03456e80 fffffa80`21d2b530 fffffa80`0d9ab040 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`0ccb9c40 00000000`00000000 : fffff880`0ccba000 fffff880`0ccb4000 fffff880`0ccb9870 00000000`00000000 : nt!KxStartSystemThread+0x16
    
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  srv2!Smb2LeaseAcknowledge+182
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: srv2
    
    IMAGE_NAME:  srv2.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4dba2b0a
    
    IMAGE_VERSION:  6.1.7601.17608
    
    STACK_COMMAND:  .cxr 0xfffff8800ccb90b0 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x7E_srv2!Smb2LeaseAcknowledge+182
    
    BUCKET_ID:  X64_0x7E_srv2!Smb2LeaseAcknowledge+182
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0x7e_srv2!smb2leaseacknowledge+182
    
    FAILURE_ID_HASH:  {1c531bfc-dab2-cdb3-b1ca-acf4f6225d0f}
    
    Followup: MachineOwner
    ---------
    
    2: kd> lmvm srv2
    start             end                 module name
    fffff880`0900c000 fffff880`09075000   srv2       (pdb symbols)          d:\symbols\srv2.pdb\214F1ABF28114C90B206815633D167CF2\srv2.pdb
        Loaded symbol image file: srv2.sys
        Mapped memory image file: d:\symbols\srv2.sys\4DBA2B0A69000\srv2.sys
        Image path: \SystemRoot\System32\DRIVERS\srv2.sys
        Image name: srv2.sys
        Timestamp:        Thu Apr 28 23:05:46 2011 (4DBA2B0A)
        CheckSum:         0006CA1E
        ImageSize:        00069000
        File version:     6.1.7601.17608
        Product version:  6.1.7601.17608
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        3.6 Driver
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     SRV2.SYS
        OriginalFilename: SRV2.SYS
        ProductVersion:   6.1.7601.17608
        FileVersion:      6.1.7601.17608 (win7sp1_gdr.110428-1525)
        FileDescription:  Smb 2.0 Server driver
        LegalCopyright:   © Microsoft Corporation. All rights reserved.
    2: kd> .exr 0xfffff8800ccb9858
    ExceptionAddress: fffff88009025a92 (srv2!Smb2LeaseAcknowledge+0x0000000000000182)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000020
    Attempt to read from address 0000000000000020
    2: kd> .cxr 0xfffff8800ccb90b0;r
    rax=fffff8800902f400 rbx=fffffa80175ccfb8 rcx=0000000000000000
    rdx=0000000000000002 rsi=0000000000000001 rdi=fffffa8016acb020
    rip=fffff88009025a92 rsp=fffff8800ccb9a90 rbp=0000000000000003
     r8=fffffa801dcba660  r9=0000000000000000 r10=0000000000000000
    r11=fffffa802052e220 r12=fffffa80129dfd51 r13=00000000000000ff
    r14=fffffa80175ccc60 r15=fffff78000000300
    iopl=0         nv up ei ng nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
    srv2!Smb2LeaseAcknowledge+0x182:
    fffff880`09025a92 488b4920        mov     rcx,qword ptr [rcx+20h] ds:002b:00000000`00000020=????????????????
    Last set context:
    rax=fffff8800902f400 rbx=fffffa80175ccfb8 rcx=0000000000000000
    rdx=0000000000000002 rsi=0000000000000001 rdi=fffffa8016acb020
    rip=fffff88009025a92 rsp=fffff8800ccb9a90 rbp=0000000000000003
     r8=fffffa801dcba660  r9=0000000000000000 r10=0000000000000000
    r11=fffffa802052e220 r12=fffffa80129dfd51 r13=00000000000000ff
    r14=fffffa80175ccc60 r15=fffff78000000300
    iopl=0         nv up ei ng nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
    srv2!Smb2LeaseAcknowledge+0x182:
    fffff880`09025a92 488b4920        mov     rcx,qword ptr [rcx+20h] ds:002b:00000000`00000020=????????????????
    


    Wanikiya and Dyami--Team Zigzag

    • Proposed as answer by Deason Wu Monday, June 22, 2015 3:00 AM
    • Marked as answer by Richardwilly98 Monday, June 29, 2015 3:13 PM
    Tuesday, June 16, 2015 6:24 PM
  • Thank you my laptop is a lot more stable since I uninstall the old Cisco Driver.

    I had only one  crash last week MiniDump the stacktrace seems to be different.

    I did not get a true bluescreen see screen-shot

    How do I solve this other issue?

    Monday, June 29, 2015 3:12 PM
  • This crash was inconclusive and the screen shot could have been a video issue  I would re-enable verifier if you continue to crash and upload those DMPS


    Wanikiya and Dyami--Team Zigzag

    Monday, June 29, 2015 3:50 PM