Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.x86fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0x8300b000 PsLoadedModuleList = 0x83155850
Debug session time: Wed Apr 20 20:40:55.160 2011 (GMT+8)
System Uptime: 0 days 0:01:09.643
WARNING: Process directory table base B8279100 doesn't match CR3 00185000
WARNING: Process directory table base B8279100 doesn't match CR3 00185000
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.............
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffdd00c). Type ".hh dbgerr001" for details
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7F, {8, 8db03750, 0, 0}
*** ERROR: Symbol file could not be found. Defaulted to export symbols for mfewfpk.sys -
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
PEB is paged out (Peb.Ldr = 7ffdd00c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffdd00c). Type ".hh dbgerr001" for details
Probably caused by : tcpip.sys ( tcpip!WfpAuditEventGeneral+288 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 8db03750
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
Unable to open image file: D:\Program Files\Debugging Tools for Windows (x86)\sym\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe
The system cannot find the file specified.
PEB is paged out (Peb.Ldr = 7ffdd00c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffdd00c). Type ".hh dbgerr001" for details
BUGCHECK_STR: 0x7f_8
TSS: 00000028 -- (.tss 0x28)
eax=85f9bd48 ebx=00000001 ecx=85f9bd48 edx=00000001 esi=85f9bd48 edi=85eca368
eip=830873a5 esp=95f69fbc ebp=95f6a024 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt!KiDeferredReadyThread+0x19:
830873a5 53 push ebx
Resetting default scope
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: lsass.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 8308869d to 830873a5
STACK_TEXT:
95f6a024 8308869d 85f9bd48 00000000 85f9bd48 nt!KiDeferredReadyThread+0x19
95f6a040 8308865b 00000000 8db00120 83144e8c nt!KiReadyThread+0x30
95f6a058 830825b1 00000000 00000001 85f9be08 nt!KiProcessThreadWaitList+0x3f
95f6a094 83042d58 8db00120 00000000 00000001 nt!KiExitDispatcher+0x2a
95f6a0cc 83082493 85f87a20 00000000 00000000 nt!KiInsertQueue+0xf6
95f6a0e8 830cd27b 83144e8c 00000001 b7e94710 nt!ExQueueWorkItem+0x44
95f6a10c 830bb801 01f6a147 85ecac08 95f6a450 nt!SepQueueWorkItem+0x125
95f6a14c 830a8356 95f6a178 00000009 95f6a83c nt!SepAdtLogAuditRecord+0xe0
95f6a410 8beac4a6 00000000 95f6a6d8 00000000 nt!SeReportSecurityEventWithSubCategory+0x1c9
95f6a6ec 8beaccda 95f6a734 95f6a8b8 8beac826 tcpip!WfpAuditEventGeneral+0x288
95f6a6f8 8beac826 95f6a734 9b6df950 95f6ad08 tcpip!KfdAuditEvent+0x38
95f6a8b8 8beacdce 0000002c 95f6ac48 95f6ad08 tcpip!IndicateDropAudit+0x35f
95f6aa78 8bead162 0000002c 0000002d 95f6ac48 tcpip!ShimIndicateDiscard+0x90
95f6aabc 8beaa445 0000002c 95f6ac48 95f6ad08 tcpip!WfpShimIndicateDiscardGeneral+0x54
95f6aae8 8bea8edc 95f6ac48 95f6ad08 9b6df950 tcpip!WfpAleClassify+0xd2
95f6ae74 8beaab5e 82bf6380 0000002c 8bf0f518 tcpip!WfpAlepAuthorizeReceive+0xa63
95f6b040 8beb6d68 82bf6380 00000002 00000011 tcpip!WfpAleAuthorizeReceive+0x32b
95f6b0b0 8beb5b3c 82bf6380 00000002 00000011 tcpip!WfpAleConnectAcceptIndicate+0xbe
95f6b210 8bea9d34 95f6b2c4 00000011 00000002 tcpip!ProcessALEForTransportPacket+0x3a5
95f6b2bc 8bea9ad7 82bf6380 95f6b508 00000011 tcpip!ProcessAleForNonTcpIn+0x92
95f6b51c 8beb572b 00000011 00000002 00008900 tcpip!WfpProcessInTransportStackIndication+0x5e1
95f6b570 8be49b45 82bf6380 00000002 00000011 tcpip!InetInspectReceiveDatagram+0x100
95f6b5b0 8be49879 88793470 88dcbb20 9b6d7284 tcpip!RawBeginMessageIndication+0x3a
95f6b608 8bea2fb8 88793470 88dcbb20 00000000 tcpip!RawDeliverDatagrams+0x1ce
95f6b648 8bea2e97 88793470 00000000 95f6b684 tcpip!RawReceiveDatagrams+0x118
95f6b658 8bea10ab 95f6b66c c000023e 00000000 tcpip!RawNlClientReceiveDatagrams+0x12
95f6b684 8bea09f6 8bf1b2dc 95f6b6e0 c000023e tcpip!IppDeliverListToProtocol+0x49
95f6b6a4 8be9edd7 8bf18da0 00000101 95f6b6e0 tcpip!IppProcessDeliverList+0x2a
95f6b6fc 8be7706c 8bf18da0 95f6b730 8bf18da0 tcpip!IppReceiveHeaderBatch+0x21a
95f6b748 8be76186 86cfabf8 02f18da0 8bf18da0 tcpip!IppLoopbackTransmit+0x226
95f6b76c 8beb88e3 95f6b798 8bf18da0 00000000 tcpip!IppLoopbackEnqueue+0x13d
95f6b7c4 8beb792a 8bf18da0 00000000 00000000 tcpip!IppFragmentPackets+0x309
95f6b7fc 8be95449 8bf18da0 9b74b528 887856c4 tcpip!IppDispatchSendPacketHelper+0x266
95f6b89c 8be95f07 00785628 00000000 00000000 tcpip!IppPacketizeDatagrams+0x8d6
95f6b91c 8bef3a7c 00000000 00000004 8bf18da0 tcpip!IppSendDatagramsCommon+0x652
95f6b9b0 8bf7f9d8 8bf18da0 00000004 8b0c7dd0 tcpip!IppInspectInjectTlSend+0x133
95f6ba18 8bf7fa44 00000000 00000000 9b597c08 fwpkclnt!FwppInjectTransportSendAsync+0x2b4
95f6ba50 8bfaff17 85faa860 00000000 0000004a fwpkclnt!FwpsInjectTransportSendAsync0+0x2d
WARNING: Stack unwind information not available. Following frames may be wrong.
95f6ba90 8bfb0fa9 85faa210 9b89b818 9b89b702 mfewfpk+0x6f17
95f6bab0 8bfb1159 9b89b7f0 00000000 9b89b7f0 mfewfpk+0x7fa9
95f6bac4 8bfb1c86 9b89b7f0 9b6597d8 95f6bcfc mfewfpk+0x8159
95f6baec 8bfb1fd6 95f6bd11 85faa244 8b0c8c00 mfewfpk+0x8c86
95f6bb0c 8bcebede 95f6bd8c 95f6bdbc 8b0c8c00 mfewfpk+0x8fd6
95f6bb30 8bcd5f32 00000000 8bfb1fb0 95f6bd8c NETIO!ProcessNonBufferedCallout+0x23
95f6bb8c 8bcd6ad0 00000018 95f6bd8c 95f6bdbc NETIO!ProcessCallout+0x184
95f6bbc4 8bcd6a6e 00000018 9b6597d8 95f6bd8c NETIO!ProcessFastCalloutClassify+0x30
95f6bcd0 8bee0ea0 00000018 95f6bd8c 95f6bdbc NETIO!KfdClassify+0x115
95f6bf18 8beb769e 00000011 00008900 00008900 tcpip!WFPDatagramDataShimV4+0x3e0
95f6bf74 8beb5c72 9b5e6be0 9b755a78 00000000 tcpip!WfpDatagramDataIndicate+0x67
95f6c0c8 8be97275 95f6c230 00000011 88780002 tcpip!ProcessALEForTransportPacket+0x4db
95f6c144 8bea50e5 95f6c230 00000011 88780002 tcpip!ProcessAleForNonTcpOut+0x57
95f6c1f0 8be95556 00000011 88780002 00008900 tcpip!WfpProcessOutTransportStackIndication+0x26c
95f6c258 8be95e5d 00000000 887d2128 887855e8 tcpip!IppInspectLocalDatagramsOut+0x101
95f6c320 8be93031 00000000 00000004 8bf18da0 tcpip!IppSendDatagramsCommon+0x5a8
95f6c340 8be9b7fe 88795468 95f6c3cc 00000000 tcpip!IpNlpSendDatagrams+0x4b
95f6c51c 8be936e9 00000000 00000000 9b597c08 tcpip!UdpSendMessagesOnPathCreation+0x7c0
95f6c620 8be93895 88791410 00f6c6f8 00000000 tcpip!UdpSendMessages+0x595
95f6c634 83094654 95f6c6c4 b7512bb3 00000000 tcpip!UdpTlProviderSendMessagesCalloutRoutine+0x13
95f6c69c 8be9b93b 8be93882 95f6c6c4 00000000 nt!KeExpandKernelStackAndCalloutEx+0x132
95f6c6dc 93498eb4 9b597c08 95f6c6f8 b7e80d00 tcpip!UdpTlProviderSendMessages+0x67
95f6c728 934a131a 9b633de0 b7e80d00 894dd4c8 tdx!TdxSendDatagramTransportAddress+0x204
95f6c744 83042593 88ac3030 b7e80d00 9b678978 tdx!TdxTdiDispatchInternalDeviceControl+0x5c
95f6c75c 934bae36 934d9f04 8684c998 9b765ce4 nt!IofCallDriver+0x63
95f6c778 934ba6ee 00000000 9b765ce4 00000032 netbt!TdiSendDatagram+0x14e
95f6c7bc 934ba9e9 9b765be8 a9feffff 934ba730 netbt!UdpSendDatagram+0x18c
95f6c804 934bba77 9b765be8 8925af10 00796700 netbt!SendNameServiceRequest+0x2a1
95f6c850 934bb41d 9b40f132 86cf76b8 000002ee netbt!QueryNameOnNet+0x379
95f6c894 934da1c8 9b40f132 9b4f6990 934bd857 netbt!FindNameOrQuery+0x465
95f6c8ec 934da350 9b40f132 00000000 000000a1 netbt!NbtSendDatagram+0x1c3
95f6c930 934bbe30 9b4f6990 00000000 b7e860b0 netbt!NTSendDatagram+0xaa
95f6c94c 83042593 e04f6990 891fcde4 891fcd50 netbt!NbtDispatchInternalCtrl+0x2ee
95f6c964 9cec0823 8e511b20 8abe3ac8 00000017 nt!IofCallDriver+0x63
95f6c99c 9cec09d4 9b755008 95f6ca0c 00000009 bowser!BowserSendDatagram+0x3dd
95f6c9d4 9cec0b70 9b755008 95f6ca0c 00000009 bowser!BowserSendSecondClassMailslot+0xed
95f6ca3c 9cec0ba9 8b0c7f00 8c94e2d0 000000dc bowser!WriteMailslotEx+0x190
STACK_COMMAND: .tss 0x28 ; kb
FOLLOWUP_IP:
tcpip!WfpAuditEventGeneral+288
8beac4a6 395dfc cmp dword ptr [ebp-4],ebx
SYMBOL_STACK_INDEX: 9
SYMBOL_NAME: tcpip!WfpAuditEventGeneral+288
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce789c0
FAILURE_BUCKET_ID: 0x7f_8_tcpip!WfpAuditEventGeneral+288
BUCKET_ID: 0x7f_8_tcpip!WfpAuditEventGeneral+288
Followup: MachineOwner
---------
Sign In
Create Account
