L’ordinateur a redémarré après une vérification d’erreur. La vérification d’erreur était : 0x00000050 (0xfffff900c213c890, 0x0000000000000000, 0xfffff960002008bd, 0x0000000000000000).
Le traitement des fichiers minidump montre les erreurs suivantes avec l'outil WinDBG :
BugCheck AB, {6, 350, 0, 1} Probably caused by : memory_corruption ( nt!MiCheckSessionPoolAllocations+13f )Followup: MachineOwner
ou
BugCheck 50, {fffff900c213c890, 0, fffff960002008bd, 0} Could not read faulting driver name Probably caused by : RDPDD.dll ( RDPDD!DDDisableSurface+18 )
Le lancement d'!analyze -v de memory.dmp (1,6 Go) ou d'un minidump d'une erreur 0x000000ab affiche :
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffdc018). Type ".hh dbgerr001" for details
Loading unloaded module list
...............
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck AB, {3, 350, 0, 1}
Probably caused by : memory_corruption ( nt!MiCheckSessionPoolAllocations+13f )
Followup: MachineOwner
---------
12: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload. This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000000000003, session ID
Arg2: 0000000000000350, number of paged pool bytes that are leaking
Arg3: 0000000000000000, number of nonpaged pool bytes that are leaking
Arg4: 0000000000000001, total number of paged and nonpaged allocations that are leaking.
nonpaged allocations are in the upper half of this word,
paged allocations are in the lower half of this word.
Debugging Details:
------------------
Use !poolused 8 to dump allocation info for leaked session pooltags.
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 7601.24093.amd64fre.win7sp1_ldr_escrow.180327-2230
SYSTEM_MANUFACTURER: HP
SYSTEM_PRODUCT_NAME: ProLiant DL180 G6
SYSTEM_SKU: 590638-421
BIOS_VENDOR: HP
BIOS_VERSION: O20
BIOS_DATE: 09/01/2011
DUMP_TYPE: 1
BUGCHECK_P1: 3
BUGCHECK_P2: 350
BUGCHECK_P3: 0
BUGCHECK_P4: 1
BUGCHECK_STR: 0xAB_Pool
SESSION_POOL_TAG: Pool
CPU_COUNT: 10
CPU_MHZ: 960
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 2c
CPU_STEPPING: 2
CPU_MICROCODE: 6,2c,2,0 (F,M,S,R) SIG: 14'00000000 (cache) 14'00000000 (init)
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: GFI525518
ANALYSIS_SESSION_TIME: 04-16-2018 14:50:47.0438
ANALYSIS_VERSION: 10.0.16299.15 amd64fre
LAST_CONTROL_TRANSFER: from fffff80001fef1cf to fffff80001cae4a0
STACK_TEXT:
fffff880`0e3c3af8 fffff800`01fef1cf : 00000000`000000ab 00000000`00000003 00000000`00000350 00000000`00000000 : nt!KeBugCheckEx
fffff880`0e3c3b00 fffff800`01ebad50 : 00000000`00000000 fffffa80`16785b00 fffffa80`16785b00 fffffa80`16785b00 : nt!MiCheckSessionPoolAllocations+0x13f
fffff880`0e3c3b40 fffff800`01f923d5 : fffff880`0e3c3be8 fffffa80`2be0bb00 00000000`00000000 fffffa80`2be0bb00 : nt!MiDereferenceSessionFinal+0x130
fffff880`0e3c3bf0 fffff800`01c484c7 : ffffffff`ffffffff fffff8a0`06a31c10 00000000`001d7a1e 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x25635
fffff880`0e3c3c20 fffff800`02041d94 : fffff8a0`06a31c10 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCleanProcessAddressSpace+0x957
fffff880`0e3c3c70 fffff800`01f276fd : 00000000`00000000 fffff800`01f52a01 00000000`00000000 fffffa80`2be12060 : nt!PspExitThread+0x944
fffff880`0e3c3d30 fffff800`01cb4916 : fffff880`023d8180 00000000`00000080 fffffa80`16785b00 00000000`00000000 : nt!PspTerminateThreadByPointer+0x4d
fffff880`0e3c3d80 00000000`00000000 : fffff880`0e3c4000 fffff880`0e3be000 fffff880`0e3c3440 00000000`00000000 : nt!KxStartSystemThread+0x16
THREAD_SHA1_HASH_MOD_FUNC: e2e4b223f7df6f09a4c6efcc82bd3ea2ae6cd188
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 1f0db9632facd55165121f2c8ab9d4a28015ec38
THREAD_SHA1_HASH_MOD: cb5f414824c2521bcc505eaa03e92fa10922dad8
FOLLOWUP_IP:
nt!MiCheckSessionPoolAllocations+13f
fffff800`01fef1cf cc int 3
FAULT_INSTR_CODE: cccccccc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiCheckSessionPoolAllocations+13f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 5abb4370
IMAGE_VERSION: 6.1.7601.24093
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_LEAKED_SESSION_POOLTAG_Pool
BUCKET_ID: X64_LEAKED_SESSION_POOLTAG_Pool
PRIMARY_PROBLEM_CLASS: X64_LEAKED_SESSION_POOLTAG_Pool
TARGET_TIME: 2018-04-12T11:26:16.000Z
OSBUILD: 7601
OSSERVICEPACK: 1000
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 16
PRODUCT_TYPE: 3
OSPLATFORM_TYPE: x64
OSNAME: Windows 7
OSEDITION: Windows 7 Server (Service Pack 1) TerminalServer
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2018-03-28 09:25:36
BUILDDATESTAMP_STR: 180327-2230
BUILDLAB_STR: win7sp1_ldr_escrow
BUILDOSVER_STR: 6.1.7601.24093.amd64fre.win7sp1_ldr_escrow.180327-2230
ANALYSIS_SESSION_ELAPSED_TIME: 945
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_leaked_session_pooltag_pool
FAILURE_ID_HASH: {9650ff51-11f4-b11b-e151-128a2efd0412}
Followup: MachineOwner
Ecran bleu = 0x000000ab (SESSION_HAS_VALID_POOL_ON_EXIT).
