Windows Server 2012 R2 Hyper-V BSOD (vhdmp.sys)

Hi,

our Microsoft Windows Server 2012 R2 with Hyper-V crashed today.

According to the dumpfile it seems to be something with vhdmp.sys

Any idea what could have been causing this?

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {b500190637, ffffd001577c63b8, ffffd001577c5bc0, fffff801ccc12154}

Probably caused by : vhdmp.sys ( vhdmp!ExFreeToNPagedLookasideList+3c )

Followup: MachineOwner
---------

18: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 000000b500190637
Arg2: ffffd001577c63b8
Arg3: ffffd001577c5bc0
Arg4: fffff801ccc12154

Debugging Details:
------------------


EXCEPTION_RECORD:  ffffd001577c63b8 -- (.exr 0xffffd001577c63b8)
ExceptionAddress: fffff801ccc12154 (vhdmp!ExFreeToNPagedLookasideList+0x000000000000003c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  ffffd001577c5bc0 -- (.cxr 0xffffd001577c5bc0;r)
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Last set context:
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80284dc4138
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 ffffffffffffffff 

FOLLOWUP_IP: 
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

FAULTING_IP: 
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

BUGCHECK_STR:  0x24

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER:  from fffff801ccc3bd98 to fffff801ccc12154

STACK_TEXT:  
ffffd001`577c65f0 fffff801`ccc3bd98 : ffffd001`577c6660 ffffe800`5b4de000 00000000`00000010 ffffc001`f9c91d00 : vhdmp!ExFreeToNPagedLookasideList+0x3c
ffffd001`577c6620 fffff802`84b0f378 : ffffe000`5d429810 ffffe000`5d429800 ffffe000`5d429adb ffffc001`f9c91da0 : vhdmp!VhdmpiCTFlushBuffersIOCompletion+0x18c
ffffd001`577c6690 fffff801`cb670130 : ffffe800`5eb64b00 00000000`00000001 ffffe800`5eb64bc8 ffffe000`5d429810 : nt!IopfCompleteRequest+0x588
ffffd001`577c67a0 fffff801`cb66ca58 : 00000000`00000000 ffffd001`577c6a40 ffffc002`01b57c30 00000000`00000048 : Ntfs!NtfsExtendedCompleteRequestInternal+0x150
ffffd001`577c67d0 fffff801`cb65ca89 : ffffe800`5eb64bc8 ffffd001`577c6a40 00000000`00000000 ffffe800`5eb64bc8 : Ntfs!NtfsCommonWrite+0x2e2d
ffffd001`577c6a00 fffff802`84ac3adb : fffff801`cb65d424 fffff801`cb65c860 ffffe800`5eb64bc8 ffffe800`5f705040 : Ntfs!NtfsFspDispatch+0x229
ffffd001`577c6b50 fffff802`84b3f794 : 00000000`00000000 ffffe800`5f705040 ffffe800`5f705040 ffffe000`57455900 : nt!ExpWorkerThread+0x293
ffffd001`577c6c00 fffff802`84bca5c6 : ffffd001`54600180 ffffe800`5f705040 ffffe800`5f74e540 00000000`00000246 : nt!PspSystemThreadStartup+0x58
ffffd001`577c6c60 00000000`00000000 : ffffd001`577c7000 ffffd001`577c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  vhdmp!ExFreeToNPagedLookasideList+3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vhdmp

IMAGE_NAME:  vhdmp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52e848da

IMAGE_VERSION:  6.3.9600.16521

STACK_COMMAND:  .cxr 0xffffd001577c5bc0 ; kb

BUCKET_ID_FUNC_OFFSET:  3c

FAILURE_BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x24_vhdmp!exfreetonpagedlookasidelist

FAILURE_ID_HASH:  {9c4ed974-e3f7-aed7-e34e-cf68671dc0ce}

Followup: MachineOwner
---------

18: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 000000b500190637
Arg2: ffffd001577c63b8
Arg3: ffffd001577c5bc0
Arg4: fffff801ccc12154

Debugging Details:
------------------


EXCEPTION_RECORD:  ffffd001577c63b8 -- (.exr 0xffffd001577c63b8)
ExceptionAddress: fffff801ccc12154 (vhdmp!ExFreeToNPagedLookasideList+0x000000000000003c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  ffffd001577c5bc0 -- (.cxr 0xffffd001577c5bc0;r)
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Last set context:
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS:  ffffffffffffffff 

FOLLOWUP_IP: 
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

FAULTING_IP: 
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

BUGCHECK_STR:  0x24

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER:  from fffff801ccc3bd98 to fffff801ccc12154

STACK_TEXT:  
ffffd001`577c65f0 fffff801`ccc3bd98 : ffffd001`577c6660 ffffe800`5b4de000 00000000`00000010 ffffc001`f9c91d00 : vhdmp!ExFreeToNPagedLookasideList+0x3c
ffffd001`577c6620 fffff802`84b0f378 : ffffe000`5d429810 ffffe000`5d429800 ffffe000`5d429adb ffffc001`f9c91da0 : vhdmp!VhdmpiCTFlushBuffersIOCompletion+0x18c
ffffd001`577c6690 fffff801`cb670130 : ffffe800`5eb64b00 00000000`00000001 ffffe800`5eb64bc8 ffffe000`5d429810 : nt!IopfCompleteRequest+0x588
ffffd001`577c67a0 fffff801`cb66ca58 : 00000000`00000000 ffffd001`577c6a40 ffffc002`01b57c30 00000000`00000048 : Ntfs!NtfsExtendedCompleteRequestInternal+0x150
ffffd001`577c67d0 fffff801`cb65ca89 : ffffe800`5eb64bc8 ffffd001`577c6a40 00000000`00000000 ffffe800`5eb64bc8 : Ntfs!NtfsCommonWrite+0x2e2d
ffffd001`577c6a00 fffff802`84ac3adb : fffff801`cb65d424 fffff801`cb65c860 ffffe800`5eb64bc8 ffffe800`5f705040 : Ntfs!NtfsFspDispatch+0x229
ffffd001`577c6b50 fffff802`84b3f794 : 00000000`00000000 ffffe800`5f705040 ffffe800`5f705040 ffffe000`57455900 : nt!ExpWorkerThread+0x293
ffffd001`577c6c00 fffff802`84bca5c6 : ffffd001`54600180 ffffe800`5f705040 ffffe800`5f74e540 00000000`00000246 : nt!PspSystemThreadStartup+0x58
ffffd001`577c6c60 00000000`00000000 : ffffd001`577c7000 ffffd001`577c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  vhdmp!ExFreeToNPagedLookasideList+3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vhdmp

IMAGE_NAME:  vhdmp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52e848da

IMAGE_VERSION:  6.3.9600.16521

STACK_COMMAND:  .cxr 0xffffd001577c5bc0 ; kb

BUCKET_ID_FUNC_OFFSET:  3c

FAILURE_BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x24_vhdmp!exfreetonpagedlookasidelist

FAILURE_ID_HASH:  {9c4ed974-e3f7-aed7-e34e-cf68671dc0ce}

Followup: MachineOwner
---------

18: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 000000b500190637
Arg2: ffffd001577c63b8
Arg3: ffffd001577c5bc0
Arg4: fffff801ccc12154

Debugging Details:
------------------


EXCEPTION_RECORD:  ffffd001577c63b8 -- (.exr 0xffffd001577c63b8)
ExceptionAddress: fffff801ccc12154 (vhdmp!ExFreeToNPagedLookasideList+0x000000000000003c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  ffffd001577c5bc0 -- (.cxr 0xffffd001577c5bc0;r)
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Last set context:
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS:  ffffffffffffffff 

FOLLOWUP_IP: 
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

FAULTING_IP: 
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

BUGCHECK_STR:  0x24

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER:  from fffff801ccc3bd98 to fffff801ccc12154

STACK_TEXT:  
ffffd001`577c65f0 fffff801`ccc3bd98 : ffffd001`577c6660 ffffe800`5b4de000 00000000`00000010 ffffc001`f9c91d00 : vhdmp!ExFreeToNPagedLookasideList+0x3c
ffffd001`577c6620 fffff802`84b0f378 : ffffe000`5d429810 ffffe000`5d429800 ffffe000`5d429adb ffffc001`f9c91da0 : vhdmp!VhdmpiCTFlushBuffersIOCompletion+0x18c
ffffd001`577c6690 fffff801`cb670130 : ffffe800`5eb64b00 00000000`00000001 ffffe800`5eb64bc8 ffffe000`5d429810 : nt!IopfCompleteRequest+0x588
ffffd001`577c67a0 fffff801`cb66ca58 : 00000000`00000000 ffffd001`577c6a40 ffffc002`01b57c30 00000000`00000048 : Ntfs!NtfsExtendedCompleteRequestInternal+0x150
ffffd001`577c67d0 fffff801`cb65ca89 : ffffe800`5eb64bc8 ffffd001`577c6a40 00000000`00000000 ffffe800`5eb64bc8 : Ntfs!NtfsCommonWrite+0x2e2d
ffffd001`577c6a00 fffff802`84ac3adb : fffff801`cb65d424 fffff801`cb65c860 ffffe800`5eb64bc8 ffffe800`5f705040 : Ntfs!NtfsFspDispatch+0x229
ffffd001`577c6b50 fffff802`84b3f794 : 00000000`00000000 ffffe800`5f705040 ffffe800`5f705040 ffffe000`57455900 : nt!ExpWorkerThread+0x293
ffffd001`577c6c00 fffff802`84bca5c6 : ffffd001`54600180 ffffe800`5f705040 ffffe800`5f74e540 00000000`00000246 : nt!PspSystemThreadStartup+0x58
ffffd001`577c6c60 00000000`00000000 : ffffd001`577c7000 ffffd001`577c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  vhdmp!ExFreeToNPagedLookasideList+3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vhdmp

IMAGE_NAME:  vhdmp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52e848da

IMAGE_VERSION:  6.3.9600.16521

STACK_COMMAND:  .cxr 0xffffd001577c5bc0 ; kb

BUCKET_ID_FUNC_OFFSET:  3c

FAILURE_BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x24_vhdmp!exfreetonpagedlookasidelist

FAILURE_ID_HASH:  {9c4ed974-e3f7-aed7-e34e-cf68671dc0ce}

Followup: MachineOwner
---------

18: kd> lmvm vhdmp
start             end                 module name
fffff801`ccc09000 fffff801`ccc98000   vhdmp      (pdb symbols)          c:\symbols\vhdmp.pdb\264A69A11D4744DDAE6F46BEFACB46EC1\vhdmp.pdb
    Loaded symbol image file: vhdmp.sys
    Mapped memory image file: c:\symbols\vhdmp.sys\52E848DA8f000\vhdmp.sys
    Image path: \SystemRoot\System32\drivers\vhdmp.sys
    Image name: vhdmp.sys
    Timestamp:        Wed Jan 29 01:18:34 2014 (52E848DA)
    CheckSum:         00092FA0
    ImageSize:        0008F000
    File version:     6.3.9600.16521
    Product version:  6.3.9600.16521
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0000.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft Windows Operating System
    InternalName:     vhdmp.sys
    OriginalFilename: vhdmp.sys
    ProductVersion:   6.3.9600.16521
    FileVersion:      6.3.9600.16521 (winblue_gdr.140128-1545)
    FileDescription:  VHD Miniport Driver
    LegalCopyright:    Microsoft Corporation. All rights reserved.


  • Edited by rssvanbergs Thursday, October 16, 2014 2:07 PM Updated title
October 16th, 2014 2:06pm

Hi Sir ,

Regarding to bug check 0x24 , please refer to the link below:

http://msdn.microsoft.com/en-us/library/windows/hardware/ff557433(v=vs.85).aspx

 
Also please try to perform a clean boot to check the result .

By the way, it is not effective for us to debug the crash dump file here in the forum. If this issues is a state of emergency for you. Please contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.

To obtain the phone numbers for specific technology request, please refer to the web site listed below:

http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607

 

Best Regards

Elton Ji

Free Windows Admin Tool Kit Click here and download it now
October 20th, 2014 3:08am
Are you running Hyper-V replication by any chance?
November 26th, 2014 1:42pm

Hi,

our Microsoft Windows Server 2012 R2 with Hyper-V crashed today.

According to the dumpfile it seems to be something with vhdmp.sys

Any idea what could have been causing this?

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {b500190637, ffffd001577c63b8, ffffd001577c5bc0, fffff801ccc12154}

Probably caused by : vhdmp.sys ( vhdmp!ExFreeToNPagedLookasideList+3c )

Followup: MachineOwner
---------

18: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 000000b500190637
Arg2: ffffd001577c63b8
Arg3: ffffd001577c5bc0
Arg4: fffff801ccc12154

Debugging Details:
------------------


EXCEPTION_RECORD:  ffffd001577c63b8 -- (.exr 0xffffd001577c63b8)
ExceptionAddress: fffff801ccc12154 (vhdmp!ExFreeToNPagedLookasideList+0x000000000000003c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  ffffd001577c5bc0 -- (.cxr 0xffffd001577c5bc0;r)
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Last set context:
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80284dc4138
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 ffffffffffffffff 

FOLLOWUP_IP: 
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

FAULTING_IP: 
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

BUGCHECK_STR:  0x24

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER:  from fffff801ccc3bd98 to fffff801ccc12154

STACK_TEXT:  
ffffd001`577c65f0 fffff801`ccc3bd98 : ffffd001`577c6660 ffffe800`5b4de000 00000000`00000010 ffffc001`f9c91d00 : vhdmp!ExFreeToNPagedLookasideList+0x3c
ffffd001`577c6620 fffff802`84b0f378 : ffffe000`5d429810 ffffe000`5d429800 ffffe000`5d429adb ffffc001`f9c91da0 : vhdmp!VhdmpiCTFlushBuffersIOCompletion+0x18c
ffffd001`577c6690 fffff801`cb670130 : ffffe800`5eb64b00 00000000`00000001 ffffe800`5eb64bc8 ffffe000`5d429810 : nt!IopfCompleteRequest+0x588
ffffd001`577c67a0 fffff801`cb66ca58 : 00000000`00000000 ffffd001`577c6a40 ffffc002`01b57c30 00000000`00000048 : Ntfs!NtfsExtendedCompleteRequestInternal+0x150
ffffd001`577c67d0 fffff801`cb65ca89 : ffffe800`5eb64bc8 ffffd001`577c6a40 00000000`00000000 ffffe800`5eb64bc8 : Ntfs!NtfsCommonWrite+0x2e2d
ffffd001`577c6a00 fffff802`84ac3adb : fffff801`cb65d424 fffff801`cb65c860 ffffe800`5eb64bc8 ffffe800`5f705040 : Ntfs!NtfsFspDispatch+0x229
ffffd001`577c6b50 fffff802`84b3f794 : 00000000`00000000 ffffe800`5f705040 ffffe800`5f705040 ffffe000`57455900 : nt!ExpWorkerThread+0x293
ffffd001`577c6c00 fffff802`84bca5c6 : ffffd001`54600180 ffffe800`5f705040 ffffe800`5f74e540 00000000`00000246 : nt!PspSystemThreadStartup+0x58
ffffd001`577c6c60 00000000`00000000 : ffffd001`577c7000 ffffd001`577c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  vhdmp!ExFreeToNPagedLookasideList+3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vhdmp

IMAGE_NAME:  vhdmp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52e848da

IMAGE_VERSION:  6.3.9600.16521

STACK_COMMAND:  .cxr 0xffffd001577c5bc0 ; kb

BUCKET_ID_FUNC_OFFSET:  3c

FAILURE_BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x24_vhdmp!exfreetonpagedlookasidelist

FAILURE_ID_HASH:  {9c4ed974-e3f7-aed7-e34e-cf68671dc0ce}

Followup: MachineOwner
---------

18: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 000000b500190637
Arg2: ffffd001577c63b8
Arg3: ffffd001577c5bc0
Arg4: fffff801ccc12154

Debugging Details:
------------------


EXCEPTION_RECORD:  ffffd001577c63b8 -- (.exr 0xffffd001577c63b8)
ExceptionAddress: fffff801ccc12154 (vhdmp!ExFreeToNPagedLookasideList+0x000000000000003c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  ffffd001577c5bc0 -- (.cxr 0xffffd001577c5bc0;r)
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Last set context:
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS:  ffffffffffffffff 

FOLLOWUP_IP: 
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

FAULTING_IP: 
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

BUGCHECK_STR:  0x24

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER:  from fffff801ccc3bd98 to fffff801ccc12154

STACK_TEXT:  
ffffd001`577c65f0 fffff801`ccc3bd98 : ffffd001`577c6660 ffffe800`5b4de000 00000000`00000010 ffffc001`f9c91d00 : vhdmp!ExFreeToNPagedLookasideList+0x3c
ffffd001`577c6620 fffff802`84b0f378 : ffffe000`5d429810 ffffe000`5d429800 ffffe000`5d429adb ffffc001`f9c91da0 : vhdmp!VhdmpiCTFlushBuffersIOCompletion+0x18c
ffffd001`577c6690 fffff801`cb670130 : ffffe800`5eb64b00 00000000`00000001 ffffe800`5eb64bc8 ffffe000`5d429810 : nt!IopfCompleteRequest+0x588
ffffd001`577c67a0 fffff801`cb66ca58 : 00000000`00000000 ffffd001`577c6a40 ffffc002`01b57c30 00000000`00000048 : Ntfs!NtfsExtendedCompleteRequestInternal+0x150
ffffd001`577c67d0 fffff801`cb65ca89 : ffffe800`5eb64bc8 ffffd001`577c6a40 00000000`00000000 ffffe800`5eb64bc8 : Ntfs!NtfsCommonWrite+0x2e2d
ffffd001`577c6a00 fffff802`84ac3adb : fffff801`cb65d424 fffff801`cb65c860 ffffe800`5eb64bc8 ffffe800`5f705040 : Ntfs!NtfsFspDispatch+0x229
ffffd001`577c6b50 fffff802`84b3f794 : 00000000`00000000 ffffe800`5f705040 ffffe800`5f705040 ffffe000`57455900 : nt!ExpWorkerThread+0x293
ffffd001`577c6c00 fffff802`84bca5c6 : ffffd001`54600180 ffffe800`5f705040 ffffe800`5f74e540 00000000`00000246 : nt!PspSystemThreadStartup+0x58
ffffd001`577c6c60 00000000`00000000 : ffffd001`577c7000 ffffd001`577c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  vhdmp!ExFreeToNPagedLookasideList+3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vhdmp

IMAGE_NAME:  vhdmp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52e848da

IMAGE_VERSION:  6.3.9600.16521

STACK_COMMAND:  .cxr 0xffffd001577c5bc0 ; kb

BUCKET_ID_FUNC_OFFSET:  3c

FAILURE_BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x24_vhdmp!exfreetonpagedlookasidelist

FAILURE_ID_HASH:  {9c4ed974-e3f7-aed7-e34e-cf68671dc0ce}

Followup: MachineOwner
---------

18: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 000000b500190637
Arg2: ffffd001577c63b8
Arg3: ffffd001577c5bc0
Arg4: fffff801ccc12154

Debugging Details:
------------------


EXCEPTION_RECORD:  ffffd001577c63b8 -- (.exr 0xffffd001577c63b8)
ExceptionAddress: fffff801ccc12154 (vhdmp!ExFreeToNPagedLookasideList+0x000000000000003c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  ffffd001577c5bc0 -- (.cxr 0xffffd001577c5bc0;r)
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Last set context:
rax=000000000840542f rbx=ffffe8005b4df080 rcx=ffffe8005a81d220
rdx=ffffe8005a81d220 rsi=ffffe8005b4de000 rdi=ffffe8005a81d220
rip=fffff801ccc12154 rsp=ffffd001577c65f0 rbp=ffffd001577c6670
 r8=0000000000000001  r9=000000000000002f r10=fffff80284a065b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8005c2d2440 r15=ffffe8005c2b94f0
iopl=0         nv up ei ng nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010292
vhdmp!ExFreeToNPagedLookasideList+0x3c:
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`5b4df0b8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS:  ffffffffffffffff 

FOLLOWUP_IP: 
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

FAULTING_IP: 
vhdmp!ExFreeToNPagedLookasideList+3c
fffff801`ccc12154 ff5338          call    qword ptr [rbx+38h]

BUGCHECK_STR:  0x24

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER:  from fffff801ccc3bd98 to fffff801ccc12154

STACK_TEXT:  
ffffd001`577c65f0 fffff801`ccc3bd98 : ffffd001`577c6660 ffffe800`5b4de000 00000000`00000010 ffffc001`f9c91d00 : vhdmp!ExFreeToNPagedLookasideList+0x3c
ffffd001`577c6620 fffff802`84b0f378 : ffffe000`5d429810 ffffe000`5d429800 ffffe000`5d429adb ffffc001`f9c91da0 : vhdmp!VhdmpiCTFlushBuffersIOCompletion+0x18c
ffffd001`577c6690 fffff801`cb670130 : ffffe800`5eb64b00 00000000`00000001 ffffe800`5eb64bc8 ffffe000`5d429810 : nt!IopfCompleteRequest+0x588
ffffd001`577c67a0 fffff801`cb66ca58 : 00000000`00000000 ffffd001`577c6a40 ffffc002`01b57c30 00000000`00000048 : Ntfs!NtfsExtendedCompleteRequestInternal+0x150
ffffd001`577c67d0 fffff801`cb65ca89 : ffffe800`5eb64bc8 ffffd001`577c6a40 00000000`00000000 ffffe800`5eb64bc8 : Ntfs!NtfsCommonWrite+0x2e2d
ffffd001`577c6a00 fffff802`84ac3adb : fffff801`cb65d424 fffff801`cb65c860 ffffe800`5eb64bc8 ffffe800`5f705040 : Ntfs!NtfsFspDispatch+0x229
ffffd001`577c6b50 fffff802`84b3f794 : 00000000`00000000 ffffe800`5f705040 ffffe800`5f705040 ffffe000`57455900 : nt!ExpWorkerThread+0x293
ffffd001`577c6c00 fffff802`84bca5c6 : ffffd001`54600180 ffffe800`5f705040 ffffe800`5f74e540 00000000`00000246 : nt!PspSystemThreadStartup+0x58
ffffd001`577c6c60 00000000`00000000 : ffffd001`577c7000 ffffd001`577c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  vhdmp!ExFreeToNPagedLookasideList+3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vhdmp

IMAGE_NAME:  vhdmp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52e848da

IMAGE_VERSION:  6.3.9600.16521

STACK_COMMAND:  .cxr 0xffffd001577c5bc0 ; kb

BUCKET_ID_FUNC_OFFSET:  3c

FAILURE_BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

BUCKET_ID:  0x24_vhdmp!ExFreeToNPagedLookasideList

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x24_vhdmp!exfreetonpagedlookasidelist

FAILURE_ID_HASH:  {9c4ed974-e3f7-aed7-e34e-cf68671dc0ce}

Followup: MachineOwner
---------

18: kd> lmvm vhdmp
start             end                 module name
fffff801`ccc09000 fffff801`ccc98000   vhdmp      (pdb symbols)          c:\symbols\vhdmp.pdb\264A69A11D4744DDAE6F46BEFACB46EC1\vhdmp.pdb
    Loaded symbol image file: vhdmp.sys
    Mapped memory image file: c:\symbols\vhdmp.sys\52E848DA8f000\vhdmp.sys
    Image path: \SystemRoot\System32\drivers\vhdmp.sys
    Image name: vhdmp.sys
    Timestamp:        Wed Jan 29 01:18:34 2014 (52E848DA)
    CheckSum:         00092FA0
    ImageSize:        0008F000
    File version:     6.3.9600.16521
    Product version:  6.3.9600.16521
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0000.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft Windows Operating System
    InternalName:     vhdmp.sys
    OriginalFilename: vhdmp.sys
    ProductVersion:   6.3.9600.16521
    FileVersion:      6.3.9600.16521 (winblue_gdr.140128-1545)
    FileDescription:  VHD Miniport Driver
    LegalCopyright:    Microsoft Corporation. All rights reserved.


Hi!

Same thing happened here a few days ago. Also running Hyper-V on Windows Server 2012 R2.
Replication is enabled.

Exact same error reported in dumpfile.

Any idea?

Free Windows Admin Tool Kit Click here and download it now
December 9th, 2014 10:23am

Have had two crashes that look the same.. did Microsoft help?

BugCheck 24, {b500190637, ffffd000255353b8, ffffd00025534bc0, fffff80044eae154}

MODULE_NAME: vhdmp

FAULTING_MODULE: fffff801dce0a000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  52e848da

EXCEPTION_RECORD:  ffffd000255353b8 -- (.exr 0xffffd000255353b8)
ExceptionAddress: fffff80044eae154 (vhdmp+0x0000000000009154)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  ffffd00025534bc0 -- (.cxr 0xffffd00025534bc0;r)
rax=00000000726f6673 rbx=ffffe8002eb6e080 rcx=ffffe800258ed4b0
rdx=ffffe800258ed4b0 rsi=ffffe8002eb6d000 rdi=ffffe800258ed4b0
rip=fffff80044eae154 rsp=ffffd000255355f0 rbp=ffffd00025535670
 r8=510000000000082f  r9=000000000000002f r10=fffff801dd5995b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8002615d040 r15=ffffe80025980750
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
vhdmp+0x9154:
fffff800`44eae154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`2eb6e0b8=????????????????
Last set context:
rax=00000000726f6673 rbx=ffffe8002eb6e080 rcx=ffffe800258ed4b0
rdx=ffffe800258ed4b0 rsi=ffffe8002eb6d000 rdi=ffffe800258ed4b0
rip=fffff80044eae154 rsp=ffffd000255355f0 rbp=ffffd00025535670
 r8=510000000000082f  r9=000000000000002f r10=fffff801dd5995b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=ffffe8002615d040 r15=ffffe80025980750
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
vhdmp+0x9154:
fffff800`44eae154 ff5338          call    qword ptr [rbx+38h] ds:002b:ffffe800`2eb6e0b8=????????????????
Resetting default scope

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0x24

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

LAST_CONTROL_TRANSFER:  from fffff80044ed7d98 to fffff80044eae154

STACK_TEXT:  
ffffd000`255355f0 fffff800`44ed7d98 : ffffd000`25535660 ffffe800`2eb6d000 00000000`00000010 ffffc001`206c644d : vhdmp+0x9154
ffffd000`25535620 fffff801`dcea9378 : ffffe800`26bc7730 ffffe800`26bc7700 ffffe800`26bc79fb ffffc001`6bbe0010 : vhdmp+0x32d98
ffffd000`25535690 fffff800`43422130 : ffffe800`2ef1b000 00000000`00000001 ffffe800`2ef1b018 ffffe800`26bc7730 : nt!IofCompleteRequest+0x594
ffffd000`255357a0 fffff800`4341ea58 : 00000000`00000000 ffffd000`25535a40 ffffc001`734fd140 00000000`00000048 : Ntfs+0x1b130
ffffd000`255357d0 fffff800`4340ea89 : ffffe800`2ef1b018 ffffd000`25535a40 00000000`00000000 ffffe800`2ef1b018 : Ntfs+0x17a58
ffffd000`25535a00 fffff801`dce5dadb : fffff800`430cb100 fffff800`4340e860 ffffe800`2ef1b018 ffffe800`28e2f540 : Ntfs+0x7a89
ffffd000`25535b50 fffff801`dced9794 : 00000000`00000000 ffffe800`28e2f540 ffffe800`28e2f540 ffffe000`5de2a380 : nt!RtlSidHashLookup+0x228f
ffffd000`25535c00 fffff801`dcf645c6 : ffffd001`64a80180 ffffe800`28e2f540 ffffd001`64a8c7c0 00000000`00000000 : nt!KeAcquireSpinLockRaiseToDpc+0x1a4
ffffd000`25535c60 00000000`00000000 : ffffd000`25536000 ffffd000`25530000 00000000`00000000 00000000`00000000 : nt!KeSynchronizeExecution+0x59d6


FOLLOWUP_IP: 
vhdmp+9154
fffff800`44eae154 ff5338          call    qword ptr [rbx+38h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  vhdmp+9154

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  vhdmp.sys

STACK_COMMAND:  .cxr 0xffffd00025534bc0 ; kb

BUCKET_ID:  WRONG_SYMBOLS

FAILURE_BUCKET_ID:  WRONG_SYMBOLS

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:wrong_symbols

FAILURE_ID_HASH:  {70b057e8-2462-896f-28e7-ac72d4d365f8}

Followup: MachineOwner
---------

December 30th, 2014 2:00am
Guys I have had the same exact issue with server 2012r2 with replication enabled. It can fine for months and months and then all of a sudden here comes 0x24. I will be contacting Microsoft Customer Service and Support about this issue. I believe this is a replication issue with hyperv and that most people running hyperv don't experience this issue because they either are able to do updates every single month and reboot before this issues builds up or they are not running extremely dense hyperv. I will let you guys know the outcome and solution
Free Windows Admin Tool Kit Click here and download it now
March 10th, 2015 8:18am
Microsoft has informed me that they are releasing a fix this this specific issue in next months round of updates.
March 14th, 2015 4:04pm
Where is this updated?  I didn't see it released in the April 2015 Microsoft patches.
Free Windows Admin Tool Kit Click here and download it now
April 16th, 2015 6:51pm

Ok here is the Hotfix that Microsoft has created for me https://support.microsoft.com/en-us/kb/3036173.

FYI

This hotfix talks about 0x50 with clustering but the article is only mentioning V1.0 of this hotfix. When you go to download the hotfix you will note that this is V3 of this hotfix which resolves our 0x24 issue with replication as well as what the article talks about.

I have installed this hotfix on all my server 2012r2 hyperv servers. Both the replica sending server and the server receiving the replicas. So far I haven't had a crash since I installed the hotfixes as of 4/22/2015. Its hard to say if it actually fixed the issue yet since it would happen to me on a very spread out time period. I went 6 months without a crash and then all of a sudden two times in one month. I hope this fixes it but again I personally haven't had the hotfix installed log enough to determine if it actually fixed the issue.

May 6th, 2015 8:54pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics