1 Reply Latest reply on Sep 24, 2013 3:17 PM by wwarren

    bsod in mfeavfk.sys


      running vse8.8 patch 1 and patch 2 on windows 7 pro 32bit, and finding bugchecks in the event logs of some of the systems and found 1 memory dump.


      the windbg !analyze -v contents are below, i can make the memory dump available as well, it appears to be too big to attach.


      any insight would be very much appreciated.





      Loading Dump File [Z:\Engineering\Errorlogs\2013.09.19 BPAA2\MEMORY.DMP]

      Kernel Summary Dump File: Only kernel address space is available



      Symbol search path is: srv*c:\mss*http://msdl.microsoft.com/download/symbols

      Executable search path is:

      Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible

      Product: WinNt, suite: TerminalServer SingleUserTS

      Built by: 7601.18205.x86fre.win7sp1_gdr.130708-1532

      Machine Name:

      Kernel base = 0x82e53000 PsLoadedModuleList = 0x82f9c4d0

      Debug session time: Fri Sep 13 01:13:11.314 2013 (UTC - 7:00)

      System Uptime: 0 days 1:26:20.157

      Loading Kernel Symbols




      Loading User Symbols

      PEB is paged out (Peb.Ldr = 7ffdf00c).  Type ".hh dbgerr001" for details

      Loading unloaded module list



      *                                                                             *

      *                        Bugcheck Analysis                                    *

      *                                                                             *




      Use !analyze -v to get detailed debugging information.



      BugCheck 8E, {c0000005, 9277bfaf, b6e576c4, 0}



      *** ERROR: Module load completed but symbols could not be loaded for mfeavfk.sys

      *** ERROR: Symbol file could not be found.  Defaulted to export symbols for mfehidk.sys -

      Probably caused by : hardware ( mfeavfk+12faf )



      Followup: MachineOwner




      3: kd> !analyze -v


      *                                                                             *

      *                        Bugcheck Analysis                                    *

      *                                                                             *





      This is a very common bugcheck.  Usually the exception address pinpoints

      the driver/function that caused the problem.  Always note this address

      as well as the link date of the driver/image that contains this address.

      Some common problems are exception code 0x80000003.  This means a hard

      coded breakpoint or assertion was hit, but this system was booted

      /NODEBUG.  This is not supposed to happen as developers should never have

      hardcoded breakpoints in retail code, but ...

      If this happens, make sure a debugger gets connected, and the

      system is booted /DEBUG.  This will let us see why this breakpoint is



      Arg1: c0000005, The exception code that was not handled

      Arg2: 9277bfaf, The address that the exception occurred at

      Arg3: b6e576c4, Trap Frame

      Arg4: 00000000



      Debugging Details:






      EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.





      9277bfaf a7              cmps    dword ptr [esi],dword ptr es:[edi]



      TRAP_FRAME:  b6e576c4 -- (.trap 0xffffffffb6e576c4)

      ErrCode = 00000000

      eax=00000023 ebx=00000000 ecx=00000017 edx=8a4b0690 esi=8a52cab0 edi=00000000

      eip=9277bfaf esp=b6e57738 ebp=b6e57744 iopl=0         nv up ei pl zr na pe nc

      cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246


      9277bfaf a7              cmps    dword ptr [esi],dword ptr es:[edi] ds:0023:8a52cab0=b86c528a es:0023:00000000=????????

      Resetting default scope






      BUGCHECK_STR:  0x8E



      PROCESS_NAME:  explorer.exe



      CURRENT_IRQL:  0





      9277bfaf a7              cmps    dword ptr [esi],dword ptr es:[edi]



      LAST_CONTROL_TRANSFER:  from 82f073ce to 82f31bfc




      b6e57234 82f073ce 0000008e c0000005 9277bfaf nt!KeBugCheckEx+0x1e

      b6e57654 82e914a6 b6e57670 00000000 b6e576c4 nt!KiDispatchException+0x1ac

      b6e576bc 82e9145a b6e57744 9277bfaf badb0d00 nt!CommonDispatchException+0x4a

      b6e576d4 82e21ba9 88bfba58 88bfba00 b6e576f4 nt!Kei386EoiHelper+0x192

      b6e57744 9277efb4 8a52cab4 00000000 00000000 hal!KfLowerIrql+0x61

      WARNING: Stack unwind information not available. Following frames may be wrong.

      b6e577a8 927713e0 8a4b0690 8a52c0d8 89057670 mfeavfk+0x15fb4

      b6e57808 9276e431 89057670 8a40cd70 00000000 mfeavfk+0x83e0

      b6e57844 8bfa90d9 00000000 8a40cd70 8a40ce34 mfeavfk+0x5431

      b6e57864 8bfcfc82 00000002 8a40cd70 8a40ce34 mfehidk+0x200d9

      b6e57880 8bf46324 8908baa0 b6e578a4 8a40cd70 mfehidk+0x46c82

      b6e578e8 8bf49512 0008ba40 8908ba40 0000000c fltmgr!FltpPerformPostCallbacks+0x24a

      b6e578fc 8bf49b46 8908ba40 859d4e00 b6e5793c fltmgr!FltpProcessIoCompletion+0x10

      b6e5790c 8bf4a29c 886c1c08 859d4e00 8908ba40 fltmgr!FltpPassThroughCompletion+0x98

      b6e5793c 8bf5d8c9 b6e5795c 00000000 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x33a

      b6e57988 82e89c1e 886c1c08 886c16c8 88b354ec fltmgr!FltpCreate+0x2db

      b6e579a0 830994f6 9e3d7747 b6e57b48 00000000 nt!IofCallDriver+0x63

      b6e57a78 83078d0e 886738d0 858e7900 859ded20 nt!IopParseDevice+0xee6

      b6e57af4 83089137 00000000 b6e57b48 00000040 nt!ObpLookupObjectName+0x4fa

      b6e57b50 8307fc15 022bdf34 858e7900 00000001 nt!ObOpenObjectByName+0x165

      b6e57bcc 83085d9b 022bdf78 00100001 022bdf34 nt!IopCreateFile+0x673

      b6e57c14 82e908c6 022bdf78 00100001 022bdf34 nt!NtOpenFile+0x2a

      b6e57c14 771670f4 022bdf78 00100001 022bdf34 nt!KiSystemServicePostCall

      022bdf80 00000000 00000000 00000000 00000000 0x771670f4





      STACK_COMMAND:  kb





      9277bfaf a7              cmps    dword ptr [esi],dword ptr es:[edi]






      SYMBOL_NAME:  mfeavfk+12faf



      FOLLOWUP_NAME:  MachineOwner



      IMAGE_NAME:  hardware






      MODULE_NAME: hardware






      BUCKET_ID:  IP_MISALIGNED_mfeavfk.sys



      Followup: MachineOwner