Forum

Bildirimler

Hepsini Temizle

WINDOWS 2008 R2 - TCPIP.SYS ve NETIO.SYS - Random BSOD Sorunu...

Windows Server

Son Cevaplar gön: Hakan Uzuner 11 yıl önce

7 Yazılar

2 Üyeler

0 Reactions

1,161 Görüntüleme

RSS

Mert Yücel

(@MertYucel)

Gönderiler: 33

Trusted Member

Konu başlatıcı

Merhaba ;

Yaklasık 3 sene önce tarafımdan kurulan bir sistemde son 3-4 gundur 2 kere BSOD problemi yaşadım. Cihazda kurulduktan sonra herhangi bir değisiklik yapılmadı. rutin guncellemeler vs yapılıyor. sistem üzerine Ipswitch Imail mail server calisiyor. tek yapılan değisiklik sistem üzerindeki asırı yük nedeniyle TCP Dynamic Port sayısı standart olan 5000'den 59999'a cıkarıldı. bu islemlenden yaklasık 1 hafta sonra bu problem bas gösterdi . bir baglantıcı varmı su an bilemiyorum. minidump bilgisis asagidaki gibi ..

*******************************************************************************

* *

* Bugcheck Analysis *

* *

****************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 0, fffff8800188fd5a}

** Kernel symbols are WRONG. Please fix symbols to do analysis.

**********************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

WARNING: Unable to verify timestamp for tcpip.sys

ERROR: Module load completed but symbols could not be loaded for tcpip.sys

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Probably caused by : tcpip.sys ( tcpip+8fd5a )

Followup: MachineOwner

---------

7: kd> !analyze -v

****************************************************************************

* *

* Bugcheck Analysis *

* *

****************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 0000000000000000, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000000, value 0 = read operation, 1 = write operation

Arg4: fffff8800188fd5a, address which referenced memory

Debugging Details:

------------------

** Kernel symbols are WRONG. Please fix symbols to do analysis.

**********************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

**********************************************************************

ADDITIONAL_DEBUG_TEXT:

You can run '.symfix; .reload' to try to fix the symbol path and load symbols.

MODULE_NAME: tcpip

FAULTING_MODULE: fffff8000184b000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 5189c381

READ_ADDRESS: unable to get nt!MmSpecialPoolStart

unable to get nt!MmSpecialPoolEnd

unable to get nt!MmPagedPoolEnd

unable to get nt!MmNonPagedPoolStart

unable to get nt!MmSizeOfNonPagedPoolInBytes

0000000000000000

CURRENT_IRQL: 0

FAULTING_IP:

tcpip+8fd5a

fffff880`0188fd5a 488b08 mov rcx,qword ptr [rax]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT_SERVER

BUGCHECK_STR: 0xD1

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER: from fffff800018c01a9 to fffff800018c0c00

STACK_TEXT:

fffff880`020cc288 fffff800`018c01a9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt+0x75c00

fffff880`020cc290 00000000`0000000a : 00000000`00000000 00000000`00000002 00000000`00000000 fffff880`0188fd5a : nt+0x751a9

fffff880`020cc298 00000000`00000000 : 00000000`00000002 00000000`00000000 fffff880`0188fd5a fffff800`018c621a : 0xa

STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:

tcpip+8fd5a

fffff880`0188fd5a 488b08 mov rcx,qword ptr [rax]

SYMBOL_NAME: tcpip+8fd5a

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: tcpip.sys

BUCKET_ID: WRONG_SYMBOLS

FAILURE_BUCKET_ID: WRONG_SYMBOLS

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:wrong_symbols

FAILURE_ID_HASH: {70b057e8-2462-896f-28e7-ac72d4d365f8}

Followup: MachineOwner

---------

Gönderildi : 05/11/2013 13:50

Mert Yücel

(@MertYucel)

Gönderiler: 33

Trusted Member

Konu başlatıcı

Memory.dMP bilgiside asagidaki gibi.

*******************************************************************************

* *

* Bugcheck Analysis *

* *

****************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 0, fffff8800188fd5a}

ERROR: Module load completed but symbols could not be loaded for tcpip.sys

ERROR: Symbol file could not be found. Defaulted to export symbols for NETIO.SYS -

ERROR: Symbol file could not be found. Defaulted to export symbols for NDIS.SYS -

ERROR: Module load completed but symbols could not be loaded for bxnd60a.sys

ERROR: Module load completed but symbols could not be loaded for bxvbda.sys

** Kernel symbols are WRONG. Please fix symbols to do analysis.

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

*******************************************************************

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

Type referenced: nt!_KPRCB

**********************************************************************

Probably caused by : NETIO.SYS ( NETIO!NetioDereferenceNetBufferListChain+132 )

Followup: MachineOwner

---------

Gönderildi : 05/11/2013 13:52

Hakan Uzuner

(@hakanuzuner)

Gönderiler: 33322

Illustrious Member Yönetici

Merhaba

DUMP çıktısını bize değil symbol veri tabanına vermeniz gerekli, o size hatayı özetler.

Bu konuda portal üzerinde Hakan' ın yazmış olduğu güzel bir makale var.

Danışman - ITSTACK Bilgi Sistemleri
****************************************************************
Probleminiz Çözüldüğünde Sonucu Burada Paylaşırsanız.
Sizde Aynı Problemi Yaşayanlar İçin Yardım Etmiş Olursunuz.
Eğer sorununuz çözüldü ise lütfen "çözüldü" olarak işaretlerseniz diğer üyeler için çok büyük kolaylık sağlayacaktır.
*****************************************************************

Gönderildi : 05/11/2013 13:53

Mert Yücel

(@MertYucel)

Gönderiler: 33

Trusted Member

Konu başlatıcı

mümkünse ilgili makale linkini yollayabilir misiniz ???

Gönderildi : 05/11/2013 14:11

Hakan Uzuner

(@hakanuzuner)

Gönderiler: 33322

Illustrious Member Yönetici

http://www.cozumpark.com/search/SearchResults.aspx?q=DUMP&s=70

Gönderildi : 05/11/2013 14:27

Mert Yücel

(@MertYucel)

Gönderiler: 33

Trusted Member

Konu başlatıcı

Symbol files konusunada dikkat ederek asagidaki cıktıyı aldım. konuyla ilgili bir fikri olan ???? NETIO.SYS bir sistem dosyası ..sizce sebep ne olabilir.. sistem mail sunucu olarak calistiği icin memory testi hemen yapamadım .ama haftasonu yapmayı planlıyorum.

Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64

Loading Dump File [C:\Windows\Minidump\110413-32807-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

********** Symbol Path validation summary ***********

Response Time (ms) Location

Deferred SRV*c:\websymbols* http://msdl.microsoft.com/download/symbols

Symbol search path is: SRV*c:\websymbols* http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows 7 Kernel Version 7601 (Service Pack 1) MP (12 procs) Free x64

Product: Server, suite: Enterprise TerminalServer SingleUserTS

Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533

Machine Name:

Kernel base = 0xfffff800`0184b000 PsLoadedModuleList = 0xfffff800`01a8e670

Debug session time: Mon Nov 4 16:15:34.981 2013 (UTC + 2:00)

System Uptime: 2 days 22:40:28.150

Loading Kernel Symbols

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.

Run !sym noisy before .reload to track down problems loading symbols.

..............................................................

................................................................

.............

Loading User Symbols

Loading unloaded module list

.....

*******************************************************************************

* *

* Bugcheck Analysis *

* *

****************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 0, fffff8800188fd5a}

WARNING: Unable to verify timestamp for bxnd60a.sys

ERROR: Module load completed but symbols could not be loaded for bxnd60a.sys

Probably caused by : NETIO.SYS ( NETIO!NetioDereferenceNetBufferListChain+132 )

Followup: MachineOwner

---------

7: kd> !analyze -v

****************************************************************************

* *

* Bugcheck Analysis *

* *

****************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 0000000000000000, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000000, value 0 = read operation, 1 = write operation

Arg4: fffff8800188fd5a, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001af8100

GetUlongFromAddress: unable to read from fffff80001af81c0

0000000000000000 Nonpaged pool

CURRENT_IRQL: 2

FAULTING_IP:

tcpip! ?? ::FNODOBFM::`string'+2954

fffff880`0188fd5a 488b08 mov rcx,qword ptr [rax]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT_SERVER

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

DPC_STACK_BASE: FFFFF880020D3FB0

TRAP_FRAME: fffff880020cc3d0 -- (.trap 0xfffff880020cc3d0)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8019d7f010

rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000

rip=fffff8800188fd5a rsp=fffff880020cc568 rbp=0000000000000000

r8=fffff880020cc590 r9=0000000000000000 r10=fffffa8019d7f010

r11=0000000000000021 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei pl zr na po nc

tcpip! ?? ::FNODOBFM::`string'+0x2954:

fffff880`0188fd5a 488b08 mov rcx,qword ptr [rax] ds:00000000`00000000=????????????????

Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800018c01a9 to fffff800018c0c00

STACK_TEXT:

fffff880`020cc288 fffff800`018c01a9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx

fffff880`020cc290 fffff800`018bee20 : fffff880`020cc502 fffff880`0178c02b fffffa80`15281200 fffffa80`19d7f010 : nt!KiBugCheckDispatch+0x69

fffff880`020cc3d0 fffff880`0188fd5a : fffff880`018095b9 00000000`00000000 fffffa80`185208f0 fffffa80`18520900 : nt!KiPageFault+0x260

fffff880`020cc568 fffff880`018095b9 : 00000000`00000000 fffffa80`185208f0 fffffa80`18520900 00000000`000003f3 : tcpip! ?? ::FNODOBFM::`string'+0x2954

fffff880`020cc570 fffff880`018eb810 : fffffa80`1456f390 fffff800`018cb777 fffffa80`1450fc10 fffffa80`1450fc58 : tcpip!TcpUpdateTcbSend+0x19

fffff880`020cc5d0 fffff880`0187bdcd : fffffa80`176be3e0 00000000`0000004e fffffa80`1a10a8c0 00000000`00000000 : tcpip!TcpEndProbeTcbSend+0xb0

fffff880`020cc630 fffff880`019248ab : fffffa80`1aa9fe20 00000000`00000000 fffffa80`19d7f010 fffffa80`19d7f010 : tcpip!TcpFinAcknowledged+0xcd

fffff880`020cc6a0 fffff880`00e02872 : fffffa80`15f41000 00000000`00000001 00000000`00000001 00000000`00000001 : tcpip!TcpOffloadDisconnectRequestComplete+0xfb

fffff880`020cc6d0 fffff880`018dd0ee : fffff880`020cc720 fffff880`00e67600 fffff880`020cc720 fffff880`00e93201 : NETIO!NetioDereferenceNetBufferListChain+0x132

fffff880`020cc7a0 fffff880`00e93141 : 00000000`00000000 fffffa80`1762c010 fffffa80`08c34010 fffffa80`13646010 : tcpip!FlForwardOffloadComplete+0x2e

fffff880`020cc7d0 fffff880`044925f4 : 00000000`00000000 fffff880`0178de8b 00000000`00000000 fffffa80`1cfb7010 : NDIS!NdisMTcpOffloadDisconnectComplete+0x21

fffff880`020cc800 00000000`00000000 : fffff880`0178de8b 00000000`00000000 fffffa80`1cfb7010 00000000`00000000 : bxnd60a+0x125f4

STACK_COMMAND: kb

FOLLOWUP_IP:

NETIO!NetioDereferenceNetBufferListChain+132

fffff880`00e02872 4c8bb42490000000 mov r14,qword ptr [rsp+90h]

SYMBOL_STACK_INDEX: 8

SYMBOL_NAME: NETIO!NetioDereferenceNetBufferListChain+132

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 5034f6a0

IMAGE_VERSION: 6.1.7601.17939

FAILURE_BUCKET_ID: X64_0xD1_NETIO!NetioDereferenceNetBufferListChain+132

BUCKET_ID: X64_0xD1_NETIO!NetioDereferenceNetBufferListChain+132

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0xd1_netio!netiodereferencenetbufferlistchain+132

FAILURE_ID_HASH: {a256ae0e-2d16-44d2-458b-e00676d4f6f5}

Followup: MachineOwner

---------

7: kd> lmvm NETIO

start end module name

fffff880`00e00000 fffff880`00e60000 NETIO (pdb symbols) c:\websymbols\netio.pdb\76E292820E9A4B67A41B1C5BDB269DEE2\netio.pdb

Loaded symbol image file: NETIO.SYS

Mapped memory image file: c:\websymbols\NETIO.SYS\5034F6A060000\NETIO.SYS

Image path: \SystemRoot\system32\DRIVERS\NETIO.SYS

Image name: NETIO.SYS

Timestamp: Wed Aug 22 18:11:28 2012 (5034F6A0)

CheckSum: 00067D76

ImageSize: 00060000

File version: 6.1.7601.17939

Product version: 6.1.7601.17939

File flags: 0 (Mask 3F)

File OS: 40004 NT Win32

File type: 3.6 Driver

File date: 00000000.00000000

Translations: 0409.04b0

CompanyName: Microsoft Corporation

ProductName: Microsoft® Windows® Operating System

InternalName: netio.sys

OriginalFilename: netio.sys

ProductVersion: 6.1.7601.17939

FileVersion: 6.1.7601.17939 (win7sp1_gdr.120822-0331)

FileDescription: Network I/O Subsystem

7: kd> !analyze -vv

****************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 0000000000000000, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000000, value 0 = read operation, 1 = write operation

Arg4: fffff8800188fd5a, address which referenced memory

Debugging Details:

------------------

BUILD_VERSION_STRING: 7601.18113.amd64fre.win7sp1_gdr.130318-1533

SYSTEM_MANUFACTURER: Dell Inc.

SYSTEM_PRODUCT_NAME: Dell Inc.

BIOS_VENDOR: Dell Inc.

BIOS_VERSION: 2.2.11

BASEBOARD_MANUFACTURER: Dell Inc.

READ_ADDRESS: 0000000000000000 Nonpaged pool

CURRENT_IRQL: 2

FAULTING_IP:

tcpip! ?? ::FNODOBFM::`string'+2954

fffff880`0188fd5a 488b08 mov rcx,qword ptr [rax]

CPU_MICROCODE: 6,2c,2,0 (F,M,S,R) SIG: 13'00000000 (cache) 13'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT_SERVER

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

ANALYSIS_SESSION_HOST: MAIL

ANALYSIS_SESSION_TIME: 11-07-2013 22:30:23.0121