Windows Server 2008 R2 SP1 频繁蓝屏 RRS feed

  • 问题

  • Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\Users\td\Desktop\121918-31403-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*C:\websymbols*
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (32 procs) Free x64
    Product: LanManNt, suite: Enterprise TerminalServer SingleUserTS
    Built by: 7601.24308.amd64fre.win7sp1_ldr.181111-0600
    Machine Name:
    Kernel base = 0xfffff800`01e1f000 PsLoadedModuleList = 0xfffff800`02058c90
    Debug session time: Wed Dec 19 21:40:07.390 2018 (GMT+8)
    System Uptime: 0 days 0:47:34.659
    Loading Kernel Symbols
    Loading User Symbols
    Loading unloaded module list
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *

    Use !analyze -v to get detailed debugging information.

    BugCheck D1, {1c, 2, 1, fffff88001865476}

    Probably caused by : tcpip.sys ( tcpip!TcpBeginTcbSend+b76 )

    Followup: MachineOwner

    0: kd> !analyze -v
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *

    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arg1: 000000000000001c, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
    Arg4: fffff88001865476, address which referenced memory

    Debugging Details:

    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800020bc100


    fffff880`01865476 f083401c01      lock add dword ptr [rax+1Ch],1




    PROCESS_NAME:  System

    TRAP_FRAME:  fffff80001c598e0 -- (.trap 0xfffff80001c598e0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000010 rcx=fffffa80377217f0
    rdx=fffff80001c59b10 rsi=0000000000000078 rdi=fffff80001c59b60
    rip=fffff88001865476 rsp=fffff80001c59a70 rbp=fffffa80377218a8
     r8=fffffa80377215f0  r9=fffffa80377217f0 r10=fffffa8037721720
    r11=8000080000000004 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    fffff880`01865476 f083401c01      lock add dword ptr [rax+1Ch],1 ds:0001:00000000`0000001c=????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff80001ec0d69 to fffff80001eb29a0

    fffff800`01c59798 fffff800`01ec0d69 : 00000000`0000000a 00000000`0000001c 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffff800`01c597a0 fffff800`01ebeb88 : 00000000`00000001 00000000`0000001c 00000000`00000000 fffffa80`3783c210 : nt!KiBugCheckDispatch+0x69
    fffff800`01c598e0 fffff880`01865476 : fffffa80`3783c210 fffffa80`3783c210 00000000`00000003 fffff880`018687cf : nt!KiPageFault+0x448
    fffff800`01c59a70 fffff880`01869b60 : 00000000`00000000 fffffa80`344047ac fffffa80`8d9a5e00 00000000`00000001 : tcpip!TcpBeginTcbSend+0xb76
    fffff800`01c59ca0 fffff880`0188da06 : 00000000`00000000 fffff880`0196ea01 fffff880`01968128 fffff880`018594b2 : tcpip!TcpTcbSend+0x1e0
    fffff800`01c59f20 fffff880`018646e5 : fffffa80`34404700 00000000`00000000 00000000`00000000 fffffa80`33b33000 : tcpip!TcpFlushDelay+0x316
    fffff800`01c5a000 fffff880`018454bc : fffffa80`33bf4500 00000000`00000000 fffffa80`00005000 fffffa80`343cc160 : tcpip!TcpPreValidatedReceive+0x3e5
    fffff800`01c5a0d0 fffff880`018573f2 : fffffa80`33a1fe90 fffffa80`33b30200 fffffa80`33b30006 00001f80`00000006 : tcpip!IpFlcReceivePreValidatedPackets+0x5bc
    fffff800`01c5a230 fffff800`01e49969 : 00000000`00000000 00000000`00000000 fffffa80`338fe860 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xa2
    fffff800`01c5a280 fffff880`01857b22 : fffff880`01857350 fffff800`01c5a3a0 00000000`00000000 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x2c9
    fffff800`01c5a370 fffff880`00f680eb : fffffa80`33a1a8c0 00000000`00000000 fffffa80`342eb1a0 00000000`00000000 : tcpip!FlReceiveNetBufferListChain+0xb2
    fffff800`01c5a3e0 fffff880`00f31ad6 : fffffa80`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : NDIS!ndisMIndicateNetBufferListsToOpen+0xdb
    fffff800`01c5a450 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : NDIS!ndisMDispatchReceiveNetBufferLists+0x1d6


    fffff880`01865476 f083401c01      lock add dword ptr [rax+1Ch],1


    SYMBOL_NAME:  tcpip!TcpBeginTcbSend+b76

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: tcpip

    IMAGE_NAME:  tcpip.sys


    FAILURE_BUCKET_ID:  X64_0xD1_tcpip!TcpBeginTcbSend+b76

    BUCKET_ID:  X64_0xD1_tcpip!TcpBeginTcbSend+b76

    Followup: MachineOwner
    2018年12月21日 10:49


  • Hi,

    Thanks for posting your query here.

    According to the call stack, this issue may related to tcpip.sys. we can update it and check if the issue still persists.

    please firstly install the latest SSU KB3177467 before we install KB4471318 to update tcpip.sys.

    If the issue persists, please refer to the following screenshot to configure the machine to collect full dump, upload the dump to OneDrive and paste the link here.

    Best regards,

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact

    2018年12月24日 8:08
  • 在出现问题之前,KB3177467 和  KB4471318这两个更新已经安装了。


    2018年12月25日 8:18
  • 您好,


    mini dump 包含的信息较少,可能看不问题所在。您可以把mini dump 上传到OneDrive,我可以查看是否可以找到原因。

    请您按照以下步骤配置memory dump:

    Best regards,

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact

    2018年12月26日 8:32