Getting a BSOD on my Server 2003 R2 SP2 box
Here is the last minidump
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini081610-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: Server, suite: TerminalServer
Built by: 3790.srv03_sp2_gdr.100216-1301
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Mon Aug 16 17:30:12.354 2010 (GMT-4)
System Uptime: 1 days 1:53:47.348
Loading Kernel Symbols
...............................................................
...................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck CB, {f5f1a2f2, f5f1b933, 888a0b00, 6}
Probably caused by : afd.sys ( afd!AfdAllocateMdlChain+bf )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (cb)
Caused by a driver not cleaning up completely after an I/O.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: f5f1a2f2, The calling address in the driver that locked the pages or if the
IO manager locked the pages this points to the dispatch routine of
the top driver on the stack to which the IRP was sent.
Arg2: f5f1b933, The caller of the calling address in the driver that locked the
pages. If the IO manager locked the pages this points to the device
object of the top driver on the stack to which the IRP was sent.
Arg3: 888a0b00, A pointer to the MDL containing the locked pages.
Arg4: 00000006, The number of locked pages.
Debugging Details:
------------------
FAULTING_IP:
afd!AfdAllocateMdlChain+bf
f5f1a2f2 8b45dc mov eax,dword ptr [ebp-24h]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
BUGCHECK_STR: 0xCB
PROCESS_NAME: java.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 8084cc87 to 80827c83
STACK_TEXT:
aed9ec54 8084cc87 000000cb f5f1a2f2 f5f1b933 nt!KeBugCheckEx+0x1b
aed9ec84 8094c5c9 ffffff04 88371810 88371a50 nt!MmCleanProcessAddressSpace+0x551
aed9ed0c 8094c71d 00000000 00000000 8831dd88 nt!PspExitThread+0x5f1
aed9ed24 8094c917 88371810 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b
aed9ed54 808897cc 00000000 00000000 02fefbf8 nt!NtTerminateProcess+0x125
aed9ed54 7c82860c 00000000 00000000 02fefbf8 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
02fefbf8 00000000 00000000 00000000 00000000 0x7c82860c
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
afd!AfdAllocateMdlChain+bf
f5f1a2f2 8b45dc mov eax,dword ptr [ebp-24h]
SYMBOL_NAME: afd!AfdAllocateMdlChain+bf
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: afd
IMAGE_NAME: afd.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 48a40d20
FAILURE_BUCKET_ID: 0xCB_afd!AfdAllocateMdlChain+bf
BUCKET_ID: 0xCB_afd!AfdAllocateMdlChain+bf
Followup: MachineOwner
---------
0: kd> lmvm afd
start end module name
f5f0b000 f5f35000 afd (pdb symbols) c:\websymbols\afd.pdb\58290F5DE8594177A0C88B7AD053A8C32\afd.pdb
Loaded symbol image file: afd.sys
Mapped memory image file: c:\websymbols\afd.sys\48A40D202a000\afd.sys
Image path: \SystemRoot\System32\drivers\afd.sys
Image name: afd.sys
Timestamp: Thu Aug 14 06:46:56 2008 (48A40D20)
CheckSum: 00029DE7
ImageSize: 0002A000
File version: 5.2.3790.4355
Product version: 5.2.3790.4355
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: afd.sys
OriginalFilename: afd.sys
ProductVersion: 5.2.3790.4355
FileVersion: 5.2.3790.4355 (srv03_sp2_gdr.080814-1204)
FileDescription: Ancillary Function Driver for WinSock
LegalCopyright: © Microsoft Corporation. All rights reserved.
August 17th, 2010 4:52am
These ones may help.
Bug Check 0xCB: DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS
http://msdn.microsoft.com/en-us/library/ff560212(VS.85).aspx
The version of AFD.SYS that is released together with security update 953230 (MS08-037) and security update 956803 (MS08-066) has an application compatibility issue
http://support.microsoft.com/kb/958752
Regards, Dave Patrick .... Microsoft Certified Professional -Microsoft MVP [Windows]
Free Windows Admin Tool Kit Click here and download it now
August 17th, 2010 5:23am
Hi,
Please understand that to troubleshoot the blue screen issues, we usually need to perform debugging. However, in this forum, we do not provide debugging support.
If you would like to perform debugging, please contact Microsoft Customer Support Service (CSS).
To obtain the phone numbers for specific technology request, please refer to the website listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS
If you are outside the US, please refer to
http://support.microsoft.com for regional support phone numbers.
Tim Quan
August 17th, 2010 6:05am