BSOD Windows 2008 R2
I had a system blue screen with the following information. Can someone please help with resolving this issue. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_CORRUPTED_EXPOOL (c5) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is caused by drivers that have corrupted the system pool. Run the driver verifier against any new (or suspect) drivers, and if that doesn't turn up the culprit, then use gflags to enable special pool. Arguments: Arg1: 0000000000000008, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff80001bee000, address which referenced memory Debugging Details: ------------------ BUGCHECK_STR: 0xC5_2 CURRENT_IRQL: 2 FAULTING_IP: nt!ExDeferredFreePool+174 fffff800`01bee000 4c395008 cmp qword ptr [rax+8],r10 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP PROCESS_NAME: System TRAP_FRAME: fffff8800225b310 -- (.trap 0xfffff8800225b310) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=fffff880008001c0 rdx=fffffa80636ef110 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80001bee000 rsp=fffff8800225b4a0 rbp=0000000000000000 r8=fffffa806890e990 r9=fffffa80636ef0a0 r10=fffffa80636ef0b0 r11=0000000000000001 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz ac po cy nt!ExDeferredFreePool+0x174: fffff800`01bee000 4c395008 cmp qword ptr [rax+8],r10 ds:00000000`00000008=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80001ab9b69 to fffff80001aba600 STACK_TEXT: fffff880`0225b1c8 fffff800`01ab9b69 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx fffff880`0225b1d0 fffff800`01ab87e0 : 00000000`00000001 00000000`00000000 00000000`00000e9b 00000000`00000000 : nt!KiBugCheckDispatch+0x69 fffff880`0225b310 fffff800`01bee000 : fffffa80`680d6000 fffffa80`dd8b27f0 fffffa80`680e1f80 fffff880`0611df5c : nt!KiPageFault+0x260 fffff880`0225b4a0 fffff800`01bef4c1 : fffff880`00000001 fffffa80`690dc5f0 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x174 fffff880`0225b530 fffff880`00e77c44 : fffffa80`680e2320 fffffa80`00000000 fffffa80`626c6670 00000000`00000000 : nt!ExFreePoolWithTag+0x411 fffff880`0225b5e0 fffff880`0611e91e : fffffa80`680d6990 00000000`00000000 00000000`00000000 fffff880`0225b840 : NDIS!NdisFreeNetBufferListContext+0x54 fffff880`0225b610 fffffa80`680d6990 : 00000000`00000000 00000000`00000000 fffff880`0225b840 fffffa80`680d6000 : basp+0x1291e fffff880`0225b618 00000000`00000000 : 00000000`00000000 fffff880`0225b840 fffffa80`680d6000 fffff880`01a71260 : 0xfffffa80`680d6990 STACK_COMMAND: kb FOLLOWUP_IP: nt!ExDeferredFreePool+174 fffff800`01bee000 4c395008 cmp qword ptr [rax+8],r10 SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: nt!ExDeferredFreePool+174 FOLLOWUP_NAME: Pool_corruption IMAGE_NAME: Pool_Corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MODULE_NAME: Pool_Corruption FAILURE_BUCKET_ID: X64_0xC5_2_nt!ExDeferredFreePool+174 BUCKET_ID: X64_0xC5_2_nt!ExDeferredFreePool+174 Followup: Pool_corruption ---------
September 8th, 2010 7:12am

Hi, Is this the only blue screen that you have received? Have you recently installed any new drivers, updated BIOS/Firmware, or installed an application that works with a driver such as an antivirus? -- Mike Burr
Free Windows Admin Tool Kit Click here and download it now
September 8th, 2010 9:08am

Hi, I would like to confirm the following questions first: 1. When did the issue start to occur? 2. Is there any change made on this system? 3. What were you doing or which program was running when BSOD occurred? 4. Is it reproducible? Based on the following information, the BSOD issue can be caused by the network card. NDIS means this issue may relate to network components and Basp can be the network card driver from Broadcom. ------------------------------------------------------------------------ fffff880`0225b5e0 fffff880`0611e91e : fffffa80`680d6990 00000000`00000000 00000000`00000000 fffff880`0225b840 : NDIS!NdisFreeNetBufferListContext+0x54 fffff880`0225b610 fffffa80`680d6990 : 00000000`00000000 00000000`00000000 fffff880`0225b840 fffffa80`680d6000 : basp+0x1291e ------------------------------------------------------------------------ If you do have Broadcom network adapter installed, please try to update the network card driver to test the issue. If the issue persists, would you please send me more minidump files for analyzing. For your convenience, I have created a workspace for you. You can upload the information files to the following link. (Please choose "Send Files to Microsoft") Workspace URL: https://sftasia.one.microsoft.com/choosetransfer.aspx?key=ca806d59-13cf-44d6-b09b-f46a0626232b Password: epjVICi3jn!No4 Note: Due to differences in text formatting with various email clients, the workspace link above may appear to be broken. Please be sure to include all text between '(' and ')' when typing or copying the workspace link into your browser. Meanwhile, please note that files uploaded for more than 72 hours will be deleted automatically. Please ensure to notify me timely after you have uploaded the files. Thank you for your understanding. Collect Minidump Files ================= 1. Click "Start", input "SYSDM.CPL" (without quotation marks) in the “Search” bar and press “Enter”. 2. Switch to the "Advanced" tab and click the "Settings" button under "Startup and Recovery". 3. Under "Write debugging information" section, make sure the "Small memory dump (128KB)" option is selected. 4. Make sure "%SystemRoot%\Minidump" is in the "Small dump directory" open box and click “OK”. If the Blue Screen appears again, please refer to the following steps to collect memory dump files: 1. Click “Start”, type “%SystemRoot%\Minidump" (without quotation marks) in “Search” bar and press “Enter”. 2. Go to your Desktop, right-click on it and create a new folder named "Dump". 3. Copy all the memory dump files (looks like [Mini092008-01.dmp]) in Minidump to this folder. 4. Right-click on the Dump folder, click "Send To", and click "Compressed (zipped) Folder". 5. Please send the ZIP file to us. For more information, please read the Microsoft KB Article: How to read the small memory dump files that Windows creates for debugging. If no more clues can be found, you may contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request. To troubleshoot this kind of kernel crash issue, we need to debug the crashed system dump. Unfortunately, debugging is beyond what we can do in the forum. Please be advised that contacting phone support will be a charged call. To obtain the phone numbers for specific technology request please take a look at the web site listed below: http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607 Regards, Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
September 8th, 2010 12:30pm

I upload the minidump, the issue happened once, and I wasn't in front of the system when this happened. There was a firmware installation prior to this, but I am trying to detemine this. Thanks, Stephen Robinson
Free Windows Admin Tool Kit Click here and download it now
September 8th, 2010 7:09pm

Hi, I would like to confirm that have you fixed the issue? If not, what is the current situation? If there is anything that I can do for you, please do not hesitate to let me know, and I will be happy to help. Regards, Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
September 14th, 2010 9:44pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics