Jeff- If you can enable Driver Verifier with Special Pool on this box and wait for it to crash again, that would be great:
Start>run>verifier Goto Settings Sort on the Provider column Select all the non Microosft ones, check Speal Pool (on the right), select Verify Select Apply Reboot Thanks, Brian Desmond br...@briandesmond.com c - 312.731.3132 Active Directory, 4th Ed - http://www.briandesmond.com/ad4/ Microsoft MVP - https://mvp.support.microsoft.com/profile/Brian From: Jeff Bunting [mailto:bunting.j...@gmail.com] Sent: Tuesday, June 30, 2009 11:23 AM To: NT System Admin Issues Subject: system crash Have a citrix metaframe xp server that has crashed twice recently (6/23 and 6/26) with the same "bad pool caller" error. Debugger analysis is saying error is probably caused by hardware. . This is a ProLiant btw; the integrated management log viewer shows the bugchecks, but no other hardware issues. I'm no WinDbg expert, but I can usually figure out a problematic driver; just not sure how to interpret this one. Suggestions appreciated. Should I start looking at RAM? Microsoft (R) Windows Debugger Version 6.9.0003.113 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Dumps\KERNEL.DMP] Kernel Summary Dump File: Only kernel address space is available ************************************************************************ WARNING: Dump file has inconsistent set-bit count. Data may be missing. ************************************************************************ Symbol search path is: C:\WINDOWS\Symbols Executable search path is: Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86 compatible Product: Server, suite: TerminalServer Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80 Debug session time: Fri Jun 26 16:27:29.927 2009 (GMT-4) System Uptime: 0 days 15:52:09.171 Loading Kernel Symbols ......................................................................................................Page 62aca not present in the dump file. Type ".hh dbgerr004" for details ..... Loading User Symbols ................................................................................................ Loading unloaded module list ........................ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck C2, {40, 0, 80000000, 0} Page 113b5 not present in the dump file. Type ".hh dbgerr004" for details Page 78 not present in the dump file. Type ".hh dbgerr004" for details ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: kernel32!pNlsUserInfo *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: kernel32!pNlsUserInfo *** *** *** ************************************************************************* *** WARNING: nt!MmPoisonedTb is non-zero: *** The machine has been manipulated using the kernel debugger. *** MachineOwner should be contacted first Probably caused by : hardware ( nt!GUID_DEVCLASS_GPS+1 ) Followup: MachineOwner --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BAD_POOL_CALLER (c2) The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc. Arguments: Arg1: 00000040, Attempt to free usermode address to kernel pool Arg2: 00000000, Starting address Arg3: 80000000, Start of system address space Arg4: 00000000, 0 Debugging Details: ------------------ Page 113b5 not present in the dump file. Type ".hh dbgerr004" for details Page 78 not present in the dump file. Type ".hh dbgerr004" for details ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: kernel32!pNlsUserInfo *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: kernel32!pNlsUserInfo *** *** *** ************************************************************************* POISONED_TB: nt!MmPoisonedTb is non-zero: BUGCHECK_STR: 0xc2_40 DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO PROCESS_NAME: MISALIGNED_IP: nt!GUID_DEVCLASS_GPS+1 8046f259 33c9 xor ecx,ecx LAST_CONTROL_TRANSFER: from 8046e331 to 8046f259 STACK_TEXT: ab7086fc 8046e331 00000000 eafacee8 8046e1c2 nt!GUID_DEVCLASS_GPS+0x1 ab708728 8046e1cd 00000000 00000000 eb3f0fbe nt!ExpGetLookasideInformation+0x207 ab708788 80468389 00000000 e695ab40 00000000 nt!ExpGetProcessInformation+0x317 ab708794 00000000 8743e308 8049408f 8743e308 nt!MiChargeCommitment+0x8c STACK_COMMAND: kb FOLLOWUP_IP: nt!GUID_DEVCLASS_GPS+1 8046f259 33c9 xor ecx,ecx SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!GUID_DEVCLASS_GPS+1 FOLLOWUP_NAME: MachineOwner IMAGE_NAME: hardware DEBUG_FLR_IMAGE_TIMESTAMP: 0 MODULE_NAME: hardware FAILURE_BUCKET_ID: IP_MISALIGNED BUCKET_ID: IP_MISALIGNED *** WARNING: nt!MmPoisonedTb is non-zero: *** The machine has been manipulated using the kernel debugger. *** MachineOwner should be contacted first Followup: MachineOwner --------- ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~