This is kinda technical, but here's what I see... And I do not have a solution...
KeWaitForMultipleObjects takes an ObjectArray pointer and a WaitBlockArray pointer. The Object Array can be an array of KTHREAD structures or whatever. In WinDbg, if you look at KeWaitForMultipleObjects+0x23f, it is doing the following (I am pretty sure): *(*(((PUCHAR)&WaitBlockArray) + 0xC) + 0xC).
According to MSDN documentation, the WaitBlockArray does not need to be initialized before being passed to KeWaitForMultipleObjects(). The kernel will init it for you.
So, how did a NULL pointer end up in that structure!?!
I looked at some kernel structures on http://www.nirsoft.net/kernel_struct/vista
and learned the following:
((PUCHAR)&WaitBlockArray) + 0xC = WaitBlockArray.Object.
If you look at the minidumps you can find for this bugcheck on the web, you'll find that the address in WaitBlockArray.Object is the address from an ObjectArray member.
In at least one minidump, I saw that the ObjectArray was a KTHREAD array.
*(*(((PUCHAR)&WaitBlockArray) + 0xC) + 0xC) = *(((PUCHAR)&KThread) + 0xC).
Again, on http://www.nirsoft.net/kernel_struct/vista
, I found the structure definition for KTHREAD.
*(((PUCHAR)&KThread) + 0xC) = KTHREAD.Header.WaitListHead.FLink
This suggests that in the creation of the KTHREADs (or whatever) the structures are not being inserted successfully into a linked list. Or, it could suggest that someone is trampling the stack. I do not know what to think. I find people doing rather different things and having this bugcheck occur. It seems like there is something fragile in KeWaitForMultipleObjects...
describes Vista kernel structures. If any of these structures have changed from XP to Vista, then everything I said is incorrect!
Edited by klopex, 24 August 2009 - 03:16 PM.