Have a citrix metaframe xp server that has crashed twice recently (6/23 and
6/26) with the same "bad pool caller" error. Debugger analysis is saying
error is probably caused by hardware. . This is a ProLiant btw; the
integrated management log viewer shows the bugchecks, but no other hardware
issues. I'm no WinDbg expert, but I can usually figure out a problematic
driver; just not sure how to interpret this one. Suggestions appreciated.
Should I start looking at RAM?
Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Dumps\KERNEL.DMP]
Kernel Summary Dump File: Only kernel address space is available
************************************************************************
WARNING: Dump file has inconsistent set-bit count. Data may be missing.
************************************************************************
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86
compatible
Product: Server, suite: TerminalServer
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
Debug session time: Fri Jun 26 16:27:29.927 2009 (GMT-4)
System Uptime: 0 days 15:52:09.171
Loading Kernel Symbols
......................................................................................................Page
62aca not present in the dump file. Type ".hh dbgerr004" for details
.....
Loading User Symbols
................................................................................................
Loading unloaded module list
........................
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {40, 0, 80000000, 0}
Page 113b5 not present in the dump file. Type ".hh dbgerr004" for details
Page 78 not present in the dump file. Type ".hh dbgerr004" for details
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*** WARNING: nt!MmPoisonedTb is non-zero:
*** The machine has been manipulated using the kernel debugger.
*** MachineOwner should be contacted first
Probably caused by : hardware ( nt!GUID_DEVCLASS_GPS+1 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad
IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000040, Attempt to free usermode address to kernel pool
Arg2: 00000000, Starting address
Arg3: 80000000, Start of system address space
Arg4: 00000000, 0
Debugging Details:
------------------
Page 113b5 not present in the dump file. Type ".hh dbgerr004" for details
Page 78 not present in the dump file. Type ".hh dbgerr004" for details
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
POISONED_TB: nt!MmPoisonedTb is non-zero:
BUGCHECK_STR: 0xc2_40
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
PROCESS_NAME:
MISALIGNED_IP:
nt!GUID_DEVCLASS_GPS+1
8046f259 33c9 xor ecx,ecx
LAST_CONTROL_TRANSFER: from 8046e331 to 8046f259
STACK_TEXT:
ab7086fc 8046e331 00000000 eafacee8 8046e1c2 nt!GUID_DEVCLASS_GPS+0x1
ab708728 8046e1cd 00000000 00000000 eb3f0fbe
nt!ExpGetLookasideInformation+0x207
ab708788 80468389 00000000 e695ab40 00000000
nt!ExpGetProcessInformation+0x317
ab708794 00000000 8743e308 8049408f 8743e308 nt!MiChargeCommitment+0x8c
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!GUID_DEVCLASS_GPS+1
8046f259 33c9 xor ecx,ecx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!GUID_DEVCLASS_GPS+1
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: hardware
FAILURE_BUCKET_ID: IP_MISALIGNED
BUCKET_ID: IP_MISALIGNED
*** WARNING: nt!MmPoisonedTb is non-zero:
*** The machine has been manipulated using the kernel debugger.
*** MachineOwner should be contacted first
Followup: MachineOwner
---------
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
