Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 7 SP1 + BthAudioHF.sys 5.0.0.14 = BUGCHECK 3B


  • Please log in to reply
3 replies to this topic

#1 JakFrost

JakFrost

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:48 PM

Posted 02 March 2011 - 11:10 PM

I'm posting here to look for correlation of this crash against what other people have seen.

This crash started after SP1 install and it only happens during boot-up. I haven't used any of the Bluetooth functionality of this dongle for a while so I pulled it out today to see if it reoccurs. This dongle is connected to the built-in USB hub on my monitor along with my Logitech Fusion web camera and they have been plugged in like this for over a year without ever experiencing a single crash.

Windows 7 Kernel Version 7601 [b](Service Pack 1)[/b] MP (8 procs) Free x64
BugCheck 3B, {c0000005, fffff800030e8651, fffff88009d9fb80, 0}

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x3B

ks!CKsFilterFactory::SetDeviceClassesState+0x69
BthAudioHF+0x6ede
0xfffffa80`0e2ff9b0

I now have three bugcheck dumps from this.

02/25/2011  08:54 AM           303,201 022511-19328-01.dmp
02/28/2011  08:53 PM           303,201 022811-19874-01.dmp
03/02/2011  04:57 PM           303,201 030211-19827-01.dmp

The driver is for this product below and it was installed from Microsoft Update web site automatically and it is the latest one available by the manufacturer right now.

AZiO BTD-V201 USB 2.0 Micro Bluetooth Adapter (Class 1, V2.1 + EDR)
Posted Image


BthAudioHF.sys Version

OriginalFilename : BthAudioHF.sys
FileDescription  : Bluetooth Hands-free Audio Device Driver
ProductName      : Bluetooth Hands-free Audio Device Driver
Comments         : 
CompanyName      : CSR, plc
FileName         : C:\Windows\System32\drivers\BthAudioHF.sys
FileVersion      : 5.0.14 built by: WinDDK
ProductVersion   : 5.0.14
IsDebug          : False
IsPatched        : False
IsPreRelease     : False
IsPrivateBuild   : True
IsSpecialBuild   : False
Language         : Language Neutral
LegalCopyright   : Copyright © 2008 CSR, plc
LegalTrademarks  : 
PrivateBuild     : 
SpecialBuild     : 

RunScanner.com - Device Driver Information

Link: http://www.runscanner.net/lib/bthaudiohf.sys.html

File versions in our database

  	Company  	Version  	Size 
	CSR, plc  	5.0.14 built by: WinDDK  	52224 
	CSR, plc  	5.0.14 built by: WinDDK  	48024 
	CSR, plc  	4.0.57 built by: WinDDK  	46952 
	CSR, plc  	5.0.14 built by: WinDDK  	43008 
	CSR, plc  	5.0.11 built by: WinDDK  	41472 
	CSR, plc  	5.0.7 built by: WinDDK  	36200 
	CSR, plc  	3.0.0.183 built by: WinDDK  	35840 
	CSR, plc  	2.0.0.127 built by: WinDDK  	30208 
	CSR, plc  	2.0.0.140 built by: WinDDK  	30208 
	CSR, plc  	3.0.0.183 built by: WinDDK  	30208 
	CSR, plc  	1.0.0.376 built by: WinDDK  	29184 
	CSR, plc  	1.0.0.380 built by: WinDDK  	29184 

Digital signatures found for this file

  	Signer of certificate  	Issuer of certificate 
	Cambridge Silicon Radio Ltd.  	VeriSign Time Stamping Services Signer - G2
	CSR India Pvt Ltd  	VeriSign Time Stamping Services Signer - G2
	Microsoft Windows Hardware Compatibility Publisher  	Microsoft Time-Stamp Service
	Microsoft Windows Hardware Compatibility Publisher  	Microsoft Timestamping Service
	Microsoft Windows Hardware Compatibility Publisher  	VeriSign Time Stamping Services Signer

Windows Debugger Output

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\030211-19827-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: %SystemRoot%\Symbols;SRV*%SystemRoot%\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`03066000 PsLoadedModuleList = 0xfffff800`032abe90
Debug session time: Wed Mar  2 16:52:05.103 2011 (UTC - 6:00)
System Uptime: 0 days 0:00:43.898
Loading Kernel Symbols
...............................................................
................................................................
...........................................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800030e8651, fffff88009d9fb80, 0}

Unable to load image BthAudioHF.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for BthAudioHF.sys
*** ERROR: Module load completed but symbols could not be loaded for BthAudioHF.sys
Probably caused by : ks.sys ( ks!KspSetDeviceInterfacesState+57 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800030e8651, Address of the instruction which caused the bugcheck
Arg3: fffff88009d9fb80, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!RtlCompareMemory+41
fffff800`030e8651 f348a7          repe cmps qword ptr [rsi],qword ptr [rdi]

CONTEXT:  fffff88009d9fb80 -- (.cxr 0xfffff88009d9fb80)
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000000 rsi=0031003100310030 rdi=fffff800033e7310
rip=fffff800030e8651 rsp=fffff88009da0568 rbp=0000000000000000
 r8=0000000000000000  r9=fffff800033e7310 r10=ffffffffffffffef
r11=fffff88009da0718 r12=0000000000000001 r13=0000000000000000
r14=fffff88009da06d8 r15=0000000000000028
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!RtlCompareMemory+0x41:
fffff800`030e8651 f348a7          repe cmps qword ptr [rsi],qword ptr [rdi]
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003461b18 to fffff800030e8651

STACK_TEXT:  
fffff880`09da0568 fffff800`03461b18 : fffffa80`09d9c320 00000000`00000000 00000000`1a76ab83 fffff800`030ee1af : nt!RtlCompareMemory+0x41
fffff880`09da0580 fffff800`034beb92 : fffffa80`0e2ff900 fffff8a0`02290958 fffff800`032e22a0 fffff800`030c71de : nt!IopParseSymbolicLinkName+0x88
fffff880`09da0620 fffff800`034bf181 : 00000000`00000001 fffff8a0`02290958 fffffa80`09e4c010 00000000`00000001 : nt!IopProcessSetInterfaceState+0x72
fffff880`09da0720 fffff880`04d51bfb : fffff8a0`02290940 fffffa80`0e2ff901 fffffa80`09e4c010 fffff880`06fd5c90 : nt!IoSetDeviceInterfaceState+0x41
fffff880`09da0750 fffff880`04d51b81 : fffffa80`0e30f650 fffffa80`0e2ff9b0 fffffa80`0e2ffd38 fffff800`03190164 : ks!KspSetDeviceInterfacesState+0x57
fffff880`09da0780 fffff880`06fd9ede : fffffa80`0e2ff9b0 fffff800`030fa57c 00000000`00000004 00000000`c0000001 : ks!CKsFilterFactory::SetDeviceClassesState+0x69
fffff880`09da07b0 fffffa80`0e2ff9b0 : fffff800`030fa57c 00000000`00000004 00000000`c0000001 fffffa80`0e8d4440 : BthAudioHF+0x6ede
fffff880`09da07b8 fffff800`030fa57c : 00000000`00000004 00000000`c0000001 fffffa80`0e8d4440 fffff880`06fdb00d : 0xfffffa80`0e2ff9b0
fffff880`09da07c0 fffff880`04d4258f : fffffa80`09e4c010 fffffa80`0e8d4438 fffffa80`0bf0c980 fffff880`09da09a0 : nt!ExAllocatePoolWithQuotaTag+0xbc
fffff880`09da0810 fffff880`04d42b47 : fffffa80`09e4c010 00000000`00000008 fffff8a0`02298010 fffffa80`0e8d4428 : ks!KspPropertyHandler+0x71f
fffff880`09da0880 fffff880`04d46ca3 : fffffa80`09e4c010 fffffa80`09e4c3b0 fffffa80`0e7df780 fffffa80`09e4c010 : ks!KspHandleAutomationIoControl+0x2c7
fffff880`09da0900 fffff880`04d427bb : fffffa80`0e2f8bc0 fffff880`06b535fb fffffa80`0e30f470 00000000`00000000 : ks!CKsFilter::DispatchDeviceIoControl+0x7b
fffff880`09da0940 fffff880`04d29560 : fffff880`09da0a20 fffff880`06b53a87 fffffa80`09e4c00a fffffa80`09e4c010 : ks!KsDispatchIrp+0xdb
fffff880`09da0970 fffff880`06b53825 : fffffa80`09e4c368 fffffa80`0e303160 fffffa80`0e303160 fffffa80`09e4c010 : ks!CKsDevice::PassThroughIrp+0xc0
fffff880`09da09b0 fffff800`03400f97 : fffffa80`0e65fe50 fffff880`09da0ca0 fffffa80`00000000 fffffa80`0e65fe50 : ksthunk!CKernelFilterDevice::DispatchIrp+0x11d
fffff880`09da0a10 fffff800`034017f6 : 00000000`0176f5f8 00000000`00000230 00000000`00000000 00000000`0176f778 : nt!IopXxxControlFile+0x607
fffff880`09da0b40 fffff800`030e58d3 : fffffa80`0e80c060 00000000`0176f5d8 fffff880`09da0bc8 00000000`00000000 : nt!NtDeviceIoControlFile+0x56
fffff880`09da0bb0 00000000`774a138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0176f588 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774a138a


FOLLOWUP_IP: 
ks!KspSetDeviceInterfacesState+57
fffff880`04d51bfb 488b1b          mov     rbx,qword ptr [rbx]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  ks!KspSetDeviceInterfacesState+57

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ks

IMAGE_NAME:  ks.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7a3f3

STACK_COMMAND:  .cxr 0xfffff88009d9fb80 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_ks!KspSetDeviceInterfacesState+57

BUCKET_ID:  X64_0x3B_ks!KspSetDeviceInterfacesState+57

Followup: MachineOwner
---------


BC AdBot (Login to Remove)

 


#2 dc3

dc3

    Bleeping Treehugger


  • Members
  • 30,601 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Sierra Foothills of Northern Ca.
  • Local time:10:48 PM

Posted 03 March 2011 - 10:57 AM

Please download BlueScreenView
No installation required.
Double click on BlueScreenView.exe file to run the program.
When scanning is done, go Edit>Select All.
Go File>Save Selected Items, and save the report as BSOD.txt.
Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

Family and loved ones will always be a priority in my daily life.  You never know when one will leave you.

 

 

 

 


#3 JakFrost

JakFrost
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:48 PM

Posted 03 March 2011 - 10:46 PM

Here's the requested output. I'm also going to refresh my WinDbg skills to look deeper into my minidumps to find out why is BthAudioHF.sys always showing up in the middle of the call stack even through NirSoft's BlueScreenView attributes the crashes to other loaded modules (drivers).

NirSoft.com - BlueScreenView.exe

030211-19827-01.dmp	3/2/2011 4:57:46 PM	SYSTEM_SERVICE_EXCEPTION	0x0000003b	00000000`c0000005	fffff800`030e8651	fffff880`09d9fb80	00000000`00000000	NisDrvWFP.sys	NisDrvWFP.sys+2f9fb80					x64		C:\Windows\Minidump\030211-19827-01.dmp	8	15	7601	303,201	
022811-19874-01.dmp	2/28/2011 8:53:32 PM	KMODE_EXCEPTION_NOT_HANDLED	0x0000001e	ffffffff`c0000005	fffff800`030cb1d5	00000000`00000000	00000000`00000110	BthAudioHF.sys	BthAudioHF.sys+4ae3060					x64		C:\Windows\Minidump\022811-19874-01.dmp	8	15	7601	303,201	
022511-19328-01.dmp	2/25/2011 8:54:14 AM	SYSTEM_SERVICE_EXCEPTION	0x0000003b	00000000`c0000005	fffff800`0309f651	fffff880`0a0c1b80	00000000`00000000	ASACPI.sys	ASACPI.sys+535db80					x64		C:\Windows\Minidump\022511-19328-01.dmp	8	15	7601	303,201	

122310-25521-01.dmp	12/23/2010 10:04:57 PM	SYSTEM_THREAD_EXCEPTION_NOT_HANDLED	0x0000007e	ffffffff`c0000005	fffff880`0906b486	fffff880`03562178	fffff880`035619e0	Null.SYS	Null.SYS+497f486					x64		C:\Windows\Minidump\122310-25521-01.dmp	8	15	7600	303,201	

030210-31715-01.dmp	3/2/2010 12:14:05 AM	PAGE_FAULT_IN_NONPAGED_AREA	0x00000050	fffffa90`09cd0270	00000000`00000000	fffff800`032016c6	00000000`00000005	dump_dumpfve.sys	dump_dumpfve.sys+23d8870					x64		C:\Windows\Minidump\030210-31715-01.dmp	8	15	7600	289,417	
030110-31574-01.dmp	3/1/2010 1:05:53 AM		0x00000101	00000000`00000019	00000000`00000000	fffff880`009b2180	00000000`00000004	NDProxy.SYS	NDProxy.SYS+5c0aa18					x64		C:\Windows\Minidump\030110-31574-01.dmp	8	15	7600	303,097	
030110-74724-01.dmp	3/1/2010 1:00:13 AM	PAGE_FAULT_IN_NONPAGED_AREA	0x00000050	fffff980`01e79000	00000000`00000000	fffff800`033c05f1	00000000`00000007	crashdmp.sys	crashdmp.sys+1d5b260					x64		C:\Windows\Minidump\030110-74724-01.dmp	8	15	7600	289,417	
021210-29827-01.dmp	2/12/2010 11:03:33 PM	SYSTEM_THREAD_EXCEPTION_NOT_HANDLED	0x0000007e	ffffffff`c0000005	fffff800`030d486e	fffff880`037ef7d8	fffff880`037ef030	discache.sys	discache.sys+2b917d8					x64		C:\Windows\Minidump\021210-29827-01.dmp	8	15	7600	303,097	
122409-27783-01.dmp	12/24/2009 12:20:30 AM	DRIVER_POWER_STATE_FAILURE	0x0000009f	00000000`00000004	00000000`00000258	fffffa80`09d62680	fffff800`0468c510	ntoskrnl.exe	ntoskrnl.exe+71f00	NT Kernel & System	Microsoft® Windows® Operating System	Microsoft Corporation	6.1.7601.17514 (win7sp1_rtm.101119-1850)	x64		C:\Windows\Minidump\122409-27783-01.dmp	8	15	7600	303,185	
122209-26332-01.dmp	12/22/2009 9:28:21 PM	DRIVER_POWER_STATE_FAILURE	0x0000009f	00000000`00000004	00000000`00000258	fffffa80`09d64680	fffff800`04698510	ntoskrnl.exe	ntoskrnl.exe+71f00	NT Kernel & System	Microsoft® Windows® Operating System	Microsoft Corporation	6.1.7601.17514 (win7sp1_rtm.101119-1850)	x64		C:\Windows\Minidump\122209-26332-01.dmp	8	15	7600	303,441	



Post SP1 BugChecks

==================================================
Dump File         : 030211-19827-01.dmp
Crash Time        : 3/2/2011 4:57:46 PM
Bug Check String  : SYSTEM_SERVICE_EXCEPTION
Bug Check Code    : 0x0000003b
Parameter 1       : 00000000`c0000005
Parameter 2       : fffff800`030e8651
Parameter 3       : fffff880`09d9fb80
Parameter 4       : 00000000`00000000
Caused By Driver  : NisDrvWFP.sys
Caused By Address : NisDrvWFP.sys+2f9fb80
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Computer Name     : 
Full Path         : C:\Windows\Minidump\030211-19827-01.dmp
Processors Count  : 8
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 303,201
==================================================

==================================================
Dump File         : 022811-19874-01.dmp
Crash Time        : 2/28/2011 8:53:32 PM
Bug Check String  : KMODE_EXCEPTION_NOT_HANDLED
Bug Check Code    : 0x0000001e
Parameter 1       : ffffffff`c0000005
Parameter 2       : fffff800`030cb1d5
Parameter 3       : 00000000`00000000
Parameter 4       : 00000000`00000110
Caused By Driver  : BthAudioHF.sys
Caused By Address : BthAudioHF.sys+4ae3060
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Computer Name     : 
Full Path         : C:\Windows\Minidump\022811-19874-01.dmp
Processors Count  : 8
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 303,201
==================================================

==================================================
Dump File         : 022511-19328-01.dmp
Crash Time        : 2/25/2011 8:54:14 AM
Bug Check String  : SYSTEM_SERVICE_EXCEPTION
Bug Check Code    : 0x0000003b
Parameter 1       : 00000000`c0000005
Parameter 2       : fffff800`0309f651
Parameter 3       : fffff880`0a0c1b80
Parameter 4       : 00000000`00000000
Caused By Driver  : ASACPI.sys
Caused By Address : ASACPI.sys+535db80
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Computer Name     : 
Full Path         : C:\Windows\Minidump\022511-19328-01.dmp
Processors Count  : 8
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 303,201
==================================================



PowerShell - VersionInfo

"NisDrvWFP.sys", "BthAudioHF.sys", "ASACPI.sys" | ForEach-Object { Get-Item C:\Windows\System32\drivers\$_ | Select-Object -ExpandProperty VersionInfo } | Format-List

OriginalFilename : NisDrvWFP.sys
FileDescription  : Microsoft Network Inspection System Driver
ProductName      : Microsoft Forefront System
Comments         : 
CompanyName      : Microsoft Corporation
FileName         : C:\Windows\System32\drivers\NisDrvWFP.sys
FileVersion      : 3.0.8007.0
ProductVersion   : 3.0.8007.0
IsDebug          : False
IsPatched        : False
IsPreRelease     : False
IsPrivateBuild   : False
IsSpecialBuild   : False
Language         : English (United States)
LegalCopyright   : © Microsoft Corporation.  All rights reserved.
LegalTrademarks  : 
PrivateBuild     : 
SpecialBuild     : 

OriginalFilename : BthAudioHF.sys
FileDescription  : Bluetooth Hands-free Audio Device Driver
ProductName      : Bluetooth Hands-free Audio Device Driver
Comments         : 
CompanyName      : CSR, plc
FileName         : C:\Windows\System32\drivers\BthAudioHF.sys
FileVersion      : 5.0.14 built by: WinDDK
ProductVersion   : 5.0.14
IsDebug          : False
IsPatched        : False
IsPreRelease     : False
IsPrivateBuild   : True
IsSpecialBuild   : False
Language         : Language Neutral
LegalCopyright   : Copyright © 2008 CSR, plc
LegalTrademarks  : 
PrivateBuild     : 
SpecialBuild     : 

OriginalFilename : ATK0110
FileDescription  : ATK0110 ACPI Utility
ProductName      : ATK0110 ACPI Utility
Comments         : 
CompanyName      : 
FileName         : C:\Windows\System32\drivers\ASACPI.sys
FileVersion      : 1043, 5, 0, 0
ProductVersion   : 1043, 5, 0, 0
IsDebug          : False
IsPatched        : False
IsPreRelease     : False
IsPrivateBuild   : True
IsSpecialBuild   : True
Language         : English (United States)
LegalCopyright   : 
LegalTrademarks  : 
PrivateBuild     : 
SpecialBuild     :



WinDbg - 022811-19874-01.dmp

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\022811-19874-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: %SystemRoot%\Symbols;SRV*%SystemRoot%\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`03054000 PsLoadedModuleList = 0xfffff800`03299e90
Debug session time: Mon Feb 28 20:50:51.698 2011 (UTC - 6:00)
System Uptime: 0 days 0:00:43.603
Loading Kernel Symbols
...............................................................
................................................................
...........................................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff800030cb1d5, 0, 110}

Unable to load image BthAudioHF.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for BthAudioHF.sys
*** ERROR: Module load completed but symbols could not be loaded for BthAudioHF.sys
Probably caused by : ks.sys ( ks!KspSetDeviceInterfacesState+57 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800030cb1d5, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000110, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!memcpy+1e5
fffff800`030cb1d5 8b040a          mov     eax,dword ptr [rdx+rcx]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000110

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800033050e8
 0000000000000110 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88008ec4e90 -- (.trap 0xfffff88008ec4e90)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a002295c80 rbx=0000000000000000 rcx=fffff8a002295cc8
rdx=0000075ffdd6a448 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030cb1d5 rsp=fffff88008ec5028 rbp=fffff88008ec5550
 r8=000000000000004c  r9=0000000000000001 r10=fffffa8009da8730
r11=fffff8a002295c80 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!memcpy+0x1e5:
fffff800`030cb1d5 8b040a          mov     eax,dword ptr [rdx+rcx] ds:7a80:00000000`00000110=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003120028 to fffff800030d4640

STACK_TEXT:  
fffff880`08ec4608 fffff800`03120028 : 00000000`0000001e ffffffff`c0000005 fffff800`030cb1d5 00000000`00000000 : nt!KeBugCheckEx
fffff880`08ec4610 fffff800`030d3cc2 : fffff880`08ec4de8 00000000`0000004c fffff880`08ec4e90 fffff8a0`02295c80 : nt! ?? ::FNODOBFM::`string'+0x4987d
fffff880`08ec4cb0 fffff800`030d283a : 00000000`00000000 00000000`00000110 00000000`00f80000 00000000`0000004c : nt!KiExceptionDispatch+0xc2
fffff880`08ec4e90 fffff800`030cb1d5 : fffff800`033d0632 fffffa80`09ce2b30 fffff8a0`022c6de0 fffffa80`0e94dc00 : nt!KiPageFault+0x23a
fffff880`08ec5028 fffff800`033d0632 : fffffa80`09ce2b30 fffff8a0`022c6de0 fffffa80`0e94dc00 00000000`00000240 : nt!memcpy+0x1e5
fffff880`08ec5030 fffff800`033cdc9b : fffffa80`0e94dbb0 fffff880`08ec55f0 fffff8a0`000040d0 00000000`00000000 : nt!ObpCaptureObjectName+0x102
fffff880`08ec50b0 fffff800`033cfd0b : fffffa80`0e94db10 fffffa80`09d697d0 00000000`00000000 fffffa80`09d6ea00 : nt!ObpCaptureObjectCreateInformation+0x279
fffff880`08ec5130 fffff800`033a382c : fffff8a0`00024010 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByName+0xbb
fffff880`08ec5200 fffff800`033ae922 : fffff880`08ec55d0 fffffa80`00020019 fffff880`08ec5550 fffff800`00000000 : nt!CmOpenKey+0x28a
fffff880`08ec5350 fffff800`030d38d3 : fffff8a0`00000006 fffff800`00000000 fffffa80`0e5ceb30 00000000`00000000 : nt!NtOpenKey+0x12
fffff880`08ec5390 fffff800`030cfe70 : fffff800`0334502c 11d08f56`65e8773e 963122c9`a000b9a3 ffffd502`30c692ac : nt!KiSystemServiceCopyEnd+0x13
fffff880`08ec5528 fffff800`0334502c : 11d08f56`65e8773e 963122c9`a000b9a3 ffffd502`30c692ac fffff880`004c004c : nt!KiServiceLinkage
fffff880`08ec5530 fffff800`03495183 : 00000000`00000000 00000000`00000000 fffff880`08ec5690 fffff800`0309fa38 : nt!IopOpenRegistryKeyEx+0x38
fffff880`08ec5590 fffff800`034acbf6 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`030b51de : nt!IopDeviceInterfaceKeysFromSymbolicLink+0xc3
fffff880`08ec5620 fffff800`034ad181 : 00000000`00000001 fffff8a0`021c4c18 fffffa80`0d4e6010 00000000`00000001 : nt!IopProcessSetInterfaceState+0xd6
fffff880`08ec5720 fffff880`04063bfb : fffff8a0`021c4c00 fffffa80`0e7ce901 fffffa80`0d4e6010 fffff880`089e7c90 : nt!IoSetDeviceInterfaceState+0x41
fffff880`08ec5750 fffff880`04063b81 : fffffa80`0e7ce820 fffffa80`0e7ce9b0 fffffa80`0e7ced38 fffff800`0317e164 : ks!KspSetDeviceInterfacesState+0x57
fffff880`08ec5780 fffff880`089ebede : fffffa80`0e7ce9b0 fffff800`030e857c 00000000`00000004 00000000`c0000001 : ks!CKsFilterFactory::SetDeviceClassesState+0x69
fffff880`08ec57b0 fffffa80`0e7ce9b0 : fffff800`030e857c 00000000`00000004 00000000`c0000001 fffffa80`0e862cd0 : BthAudioHF+0x6ede
fffff880`08ec57b8 fffff800`030e857c : 00000000`00000004 00000000`c0000001 fffffa80`0e862cd0 fffff880`089ed00d : 0xfffffa80`0e7ce9b0
fffff880`08ec57c0 fffff880`0405458f : fffffa80`0d4e6010 fffffa80`0e862cc8 fffffa80`0d3a9140 fffff880`08ec59a0 : nt!ExAllocatePoolWithQuotaTag+0xbc
fffff880`08ec5810 fffff880`04054b47 : fffffa80`0d4e6010 00000000`00000008 fffff8a0`021dd010 fffffa80`0e862cb8 : ks!KspPropertyHandler+0x71f
fffff880`08ec5880 fffff880`04058ca3 : fffffa80`0d4e6010 fffffa80`0d4e63b0 fffffa80`0e8eb120 fffffa80`0d4e6010 : ks!KspHandleAutomationIoControl+0x2c7
fffff880`08ec5900 fffff880`040547bb : fffffa80`0e4a5810 fffff880`06d485fb fffffa80`0e75c930 00000000`00000000 : ks!CKsFilter::DispatchDeviceIoControl+0x7b
fffff880`08ec5940 fffff880`0403b560 : fffff880`08ec5a20 fffff880`06d48a87 fffffa80`0d4e600a fffffa80`0d4e6010 : ks!KsDispatchIrp+0xdb
fffff880`08ec5970 fffff880`06d48825 : fffffa80`0d4e6368 fffffa80`0e8eb060 fffffa80`0e8eb060 fffffa80`0d4e6010 : ks!CKsDevice::PassThroughIrp+0xc0
fffff880`08ec59b0 fffff800`033eef97 : fffffa80`0dbb1b20 fffff880`08ec5ca0 fffffa80`00000000 fffffa80`0dbb1b20 : ksthunk!CKernelFilterDevice::DispatchIrp+0x11d
fffff880`08ec5a10 fffff800`033ef7f6 : 00000000`0166f878 00000000`00000230 00000000`00000000 00000000`0166f9f8 : nt!IopXxxControlFile+0x607
fffff880`08ec5b40 fffff800`030d38d3 : fffffa80`0e8c2310 00000000`0166f858 fffff880`08ec5bc8 00000000`00000000 : nt!NtDeviceIoControlFile+0x56
fffff880`08ec5bb0 00000000`7781138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0166f808 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7781138a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ks!KspSetDeviceInterfacesState+57
fffff880`04063bfb 488b1b          mov     rbx,qword ptr [rbx]

SYMBOL_STACK_INDEX:  10

SYMBOL_NAME:  ks!KspSetDeviceInterfacesState+57

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ks

IMAGE_NAME:  ks.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7a3f3

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_ks!KspSetDeviceInterfacesState+57

BUCKET_ID:  X64_0x1E_c0000005_ks!KspSetDeviceInterfacesState+57

Followup: MachineOwner
---------



WinDbg - 022511-19328-01.dmp


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\022511-19328-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: %SystemRoot%\Symbols;SRV*%SystemRoot%\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`0301d000 PsLoadedModuleList = 0xfffff800`03262e90
Debug session time: Fri Feb 25 08:52:06.058 2011 (UTC - 6:00)
System Uptime: 0 days 0:00:42.964
Loading Kernel Symbols
...............................................................
................................................................
...........................................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff8000309f651, fffff8800a0c1b80, 0}

Unable to load image BthAudioHF.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for BthAudioHF.sys
*** ERROR: Module load completed but symbols could not be loaded for BthAudioHF.sys
Probably caused by : ks.sys ( ks!KspSetDeviceInterfacesState+57 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8000309f651, Address of the instruction which caused the bugcheck
Arg3: fffff8800a0c1b80, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!RtlCompareMemory+41
fffff800`0309f651 f348a7          repe cmps qword ptr [rsi],qword ptr [rdi]

CONTEXT:  fffff8800a0c1b80 -- (.cxr 0xfffff8800a0c1b80)
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000000 rsi=0031003100310030 rdi=fffff8000339e310
rip=fffff8000309f651 rsp=fffff8800a0c2568 rbp=0000000000000000
 r8=0000000000000000  r9=fffff8000339e310 r10=fffffffffffffff7
r11=fffff8800a0c2718 r12=0000000000000001 r13=0000000000000000
r14=fffff8800a0c26d8 r15=0000000000000028
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!RtlCompareMemory+0x41:
fffff800`0309f651 f348a7          repe cmps qword ptr [rsi],qword ptr [rdi]
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003418b18 to fffff8000309f651

STACK_TEXT:  
fffff880`0a0c2568 fffff800`03418b18 : fffffa80`09d79190 00000000`00000000 00000000`19e81761 fffff800`030a51af : nt!RtlCompareMemory+0x41
fffff880`0a0c2580 fffff800`03475b92 : fffffa80`0cd6e000 fffff8a0`02409ef8 fffff800`032992a0 fffff800`0307e1de : nt!IopParseSymbolicLinkName+0x88
fffff880`0a0c2620 fffff800`03476181 : 00000000`00000001 fffff8a0`02409ef8 fffffa80`0cd3d010 00000000`00000001 : nt!IopProcessSetInterfaceState+0x72
fffff880`0a0c2720 fffff880`050d1bfb : fffff8a0`02409ee0 fffffa80`0cd6e001 fffffa80`0cd3d010 fffff880`09660c90 : nt!IoSetDeviceInterfaceState+0x41
fffff880`0a0c2750 fffff880`050d1b81 : fffffa80`0cd6e6a0 fffffa80`0cd6e010 fffffa80`0cd6e398 fffff800`03147164 : ks!KspSetDeviceInterfacesState+0x57
fffff880`0a0c2780 fffff880`09664ede : fffffa80`0cd6e010 fffff800`030b157c 00000000`00000004 00000000`c0000001 : ks!CKsFilterFactory::SetDeviceClassesState+0x69
fffff880`0a0c27b0 fffffa80`0cd6e010 : fffff800`030b157c 00000000`00000004 00000000`c0000001 fffffa80`0cda5430 : BthAudioHF+0x6ede
fffff880`0a0c27b8 fffff800`030b157c : 00000000`00000004 00000000`c0000001 fffffa80`0cda5430 fffff880`0966600d : 0xfffffa80`0cd6e010
fffff880`0a0c27c0 fffff880`050c258f : fffffa80`0cd3d010 fffffa80`0cda5428 fffffa80`0dcaeba0 fffff880`0a0c29a0 : nt!ExAllocatePoolWithQuotaTag+0xbc
fffff880`0a0c2810 fffff880`050c2b47 : fffffa80`0cd3d010 00000000`00000008 fffff8a0`02405010 fffffa80`0cda5418 : ks!KspPropertyHandler+0x71f
fffff880`0a0c2880 fffff880`050c6ca3 : fffffa80`0cd3d010 fffffa80`0cd3d3b0 fffffa80`0cd25630 fffffa80`0cd3d010 : ks!KspHandleAutomationIoControl+0x2c7
fffff880`0a0c2900 fffff880`050c27bb : fffffa80`0cd72010 fffff880`07cf35fb fffffa80`0cd72650 00000000`00000000 : ks!CKsFilter::DispatchDeviceIoControl+0x7b
fffff880`0a0c2940 fffff880`050a9560 : fffff880`0a0c2a20 fffff880`07cf3a87 fffffa80`0cd3d00a fffffa80`0cd3d010 : ks!KsDispatchIrp+0xdb
fffff880`0a0c2970 fffff880`07cf3825 : fffffa80`0cd3d368 fffffa80`0ccfc360 fffffa80`0ccfc360 fffffa80`0cd3d010 : ks!CKsDevice::PassThroughIrp+0xc0
fffff880`0a0c29b0 fffff800`033b7f97 : fffffa80`0cd9b440 fffff880`0a0c2ca0 fffffa80`00000000 fffffa80`0cd9b440 : ksthunk!CKernelFilterDevice::DispatchIrp+0x11d
fffff880`0a0c2a10 fffff800`033b87f6 : 00000000`00d9fa68 00000000`0000022c 00000000`00000000 00000000`00d9fbe8 : nt!IopXxxControlFile+0x607
fffff880`0a0c2b40 fffff800`0309c8d3 : fffffa80`0cd79060 00000000`00d9fa48 fffff880`0a0c2bc8 00000000`00000000 : nt!NtDeviceIoControlFile+0x56
fffff880`0a0c2bb0 00000000`7759138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00d9f9f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7759138a


FOLLOWUP_IP: 
ks!KspSetDeviceInterfacesState+57
fffff880`050d1bfb 488b1b          mov     rbx,qword ptr [rbx]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  ks!KspSetDeviceInterfacesState+57

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ks

IMAGE_NAME:  ks.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7a3f3

STACK_COMMAND:  .cxr 0xfffff8800a0c1b80 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_ks!KspSetDeviceInterfacesState+57

BUCKET_ID:  X64_0x3B_ks!KspSetDeviceInterfacesState+57

Followup: MachineOwner
---------


#4 JakFrost

JakFrost
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:48 PM

Posted 04 March 2011 - 12:31 AM


kd> lm v

fffff880`06fd3000 fffff880`06fe5000   BthAudioHF T (no symbols)           

    Loaded symbol image file: BthAudioHF.sys

    Image path: BthAudioHF.sys

    Image name: BthAudioHF.sys

    Timestamp:        Mon Dec 21 04:43:35 2009 (4B2F5157)

    CheckSum:         00015531

    ImageSize:        00012000

    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4



4: kd> kv n

 # Child-SP          RetAddr           : Args to Child                                                           : Call Site

0e fffff880`09da07b0 fffffa80`0e2ff9b0 : fffff800`030fa57c 00000000`00000004 00000000`c0000001 fffffa80`0e8d4440 : BthAudioHF+0x6ede






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users