• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

VISTA : SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION

M

miamiparis

Member
Since 2 weeks, I have blue screen that appear once a day inaverage with SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION. I'm beginner in debugging blue screens.
I used windbg on the same PC and below is the result. I called Dell and they advised me to reinstall all the operating system and Dell programs. I prefer to come here and try to pinpoint the problem.
I had 2 sticks of 512 MB and 2 slots. I had the blue screen problem. I bought 2 sticks of 2 GB each and installed them. I had the same blue screen.

I hope you can help me.

Here is the log:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV**http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11e10
Debug session time: Sat Feb 23 16:28:58.285 2008 (GMT+1)
System Uptime: 0 days 0:03:47.066
Loading Kernel Symbols
........................................................................... ........................................................................... .................
Loading User Symbols

Loading unloaded module list
....
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

Use !analyze -v to get detailed debugging information.

BugCheck C1, {b47e2ff8, b47e2008, 0, 23}





Probably caused by : memory_corruption ( nt!MmFreeSpecialPool+69 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: b47e2ff8, address trying to free
Arg2: b47e2008, address where bits are corrupted
Arg3: 00000000, (reserved)
Arg4: 00000023, caller is freeing an address where nearby bytes within the same page have been corrupted

Debugging Details:
------------------






BUGCHECK_STR: 0xC1_23

SPECIAL_POOL_CORRUPTION_TYPE: 23

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 81ce1ca5 to 81cd8681

STACK_TEXT:
83463bcc 81ce1ca5 000000c1 b47e2ff8 b47e2008 nt!KeBugCheckEx+0x1e
83463c44 81ce7c54 b47e2ff8 b69f4fe0 00000000 nt!MmFreeSpecialPool+0x69
83463ca8 81d9830d b47e2ff8 00000000 00000000 nt!ExFreePoolWithTag+0xeb
83463cc8 81d95173 00000000 863b3cd8 00000000 nt!IopDeleteFileObjectExtension+0x78
83463d0c 81ded505 863b3d00 00000000 863b3d00 nt!IopDeleteFile+0x26a
83463d28 81ded3d0 863b3d00 00000001 81cfde40 nt!ObpRemoveObjectRoutine+0x100
83463d44 81c78fa0 00000000 00000000 85d4b470 nt!ObpProcessRemoveObjectQueue+0x39
83463d7c 81e254e0 00000000 83468680 00000000 nt!ExpWorkerThread+0xfd
83463dc0 81c9159e 81c78ea3 00000000 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmFreeSpecialPool+69
81ce1ca5 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MmFreeSpecialPool+69

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 471ea39c

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xC1_23_VRF_nt!MmFreeSpecialPool+69

BUCKET_ID: 0xC1_23_VRF_nt!MmFreeSpecialPool+69

Followup: MachineOwner
---------

1: kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: b47e2ff8, address trying to free
Arg2: b47e2008, address where bits are corrupted
Arg3: 00000000, (reserved)
Arg4: 00000023, caller is freeing an address where nearby bytes within the same page have been corrupted

Debugging Details:
------------------






BUGCHECK_STR: 0xC1_23

SPECIAL_POOL_CORRUPTION_TYPE: 23

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 81ce1ca5 to 81cd8681

STACK_TEXT:
83463bcc 81ce1ca5 000000c1 b47e2ff8 b47e2008 nt!KeBugCheckEx+0x1e
83463c44 81ce7c54 b47e2ff8 b69f4fe0 00000000 nt!MmFreeSpecialPool+0x69
83463ca8 81d9830d b47e2ff8 00000000 00000000 nt!ExFreePoolWithTag+0xeb
83463cc8 81d95173 00000000 863b3cd8 00000000 nt!IopDeleteFileObjectExtension+0x78
83463d0c 81ded505 863b3d00 00000000 863b3d00 nt!IopDeleteFile+0x26a
83463d28 81ded3d0 863b3d00 00000001 81cfde40 nt!ObpRemoveObjectRoutine+0x100
83463d44 81c78fa0 00000000 00000000 85d4b470 nt!ObpProcessRemoveObjectQueue+0x39
83463d7c 81e254e0 00000000 83468680 00000000 nt!ExpWorkerThread+0xfd
83463dc0 81c9159e 81c78ea3 00000000 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmFreeSpecialPool+69
81ce1ca5 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MmFreeSpecialPool+69

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 471ea39c

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xC1_23_VRF_nt!MmFreeSpecialPool+69

BUCKET_ID: 0xC1_23_VRF_nt!MmFreeSpecialPool+69

Followup: MachineOwner
---------

1: kd> lmvm nt
start end module name
81c00000 81fa1000 nt (pdb symbols) C:\Program Files\Debugging Tools for Windows\sym\ntkrpamp.pdb\03D7DBF252F448A484A9E17FB7734EE62\ntkrpamp.pdb
Loaded symbol image file: ntkrpamp.exe
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Wed Oct 24 03:45:00 2007 (471EA39C)
CheckSum: 00363BFB
ImageSize: 003A1000
File version: 6.0.6000.16584
Product version: 6.0.6000.16584
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 6.0.6000.16584
FileVersion: 6.0.6000.16584 (vista_gdr.071023-1545)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
 
Here's the MS article with info on what to do: Enable driver verifier: http://support.microsoft.com/kb/244617

Basically, this will make your system slightly more likely to crash (if it is a driver issue) and then you'll be able to analyze the resulting new dump files (made after you make the verifier changes) and you may be able to track down the culprit/problem.

Run verifier.exe. Click driver settings (for code developers). Select individual settings. Select "Special Pool", "Pool tracking", "Force IRQL checking", "Enhanced IO Verification", and that should do it. Click Next, and select any non-signed drivers (the top/first option). If you don't have any non-signed drivers, it's possible a signed driver is the problem, and you can individually select all your non-Microsoft drivers, and then click FINISH. (If you do have non-signed drivers in use, simply select all of them).

Reboot.

Wait for a crash, analyze the dumpfile, post the results. Hopefully this will tell us more.

The dump file you posted tells us there is no clear culprit, so I went into the windbg helpfile, read what a C1 dump was, and then saw that driver verifier can be used to turn on enhanced checks for driver flaws; when those checks are on the debugger output is more useful. Remember to turn them off (or boot in safe mode and run verifier again) when you're done with this - the system will be a bit more likely to bluescreen (which is ok in this case.)
 
To turn off the checks for driver flaws, I have to run verifier and select "delete existing settings" ?
Below is the new debugger output, so inort.exe is the culprit, right? It's etrust antivirus 7.1, it's a version for XP and I have Windows Vista.
Log:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV**http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11e10
Debug session time: Sun Feb 24 00:39:01.762 2008 (GMT+1)
System Uptime: 0 days 4:17:29.822
Loading Kernel Symbols
........................................................................................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C1, {a9fe2e28, 0, 1d8, 22}

*** ERROR: Module load completed but symbols could not be loaded for ino_fltr.sys
Page ae829 not present in the dump file. Type ".hh dbgerr004" for details
windbg> .hh dbgerr004

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details
Probably caused by : memory_corruption ( nt!MmFreeSpecialPool+69 )

Followup: MachineOwner
---------

0: kd> .ignore_missing_pages 1
Suppress kernel summary dump missing page error message
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: a9fe2e28, address trying to free
Arg2: 00000000, bytes requested
Arg3: 000001d8, bytes calculated
Arg4: 00000022, caller is trying to free a bad address

Debugging Details:
------------------


PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

BUGCHECK_STR: 0xC1_22

SPECIAL_POOL_CORRUPTION_TYPE: 22

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: InoRT.exe

CURRENT_IRQL: 1

IRP_ADDRESS: 00fe2e28

LAST_CONTROL_TRANSFER: from 81ce1ca5 to 81cd8681

STACK_TEXT:
af87a70c 81ce1ca5 000000c1 a9fe2e28 00000000 nt!KeBugCheckEx+0x1e
af87a784 81ce7c54 a9fe2e28 af87a834 87b96f58 nt!MmFreeSpecialPool+0x69
af87a7ec 81ed5995 a9fe2e28 00000000 af87a814 nt!ExFreePoolWithTag+0xeb
af87a7fc 81ed5b9b a9fe2e28 a9fe2e28 89bec9b0 nt!VfIrpFree+0x15
af87a814 81ece111 81cb1217 89beca14 a9fe2e28 nt!VerifierIoFreeIrp+0x11d
af87a82c 81cb1217 a9fe2e28 af87133c a9fe2e68 nt!IovFreeIrpPrivate+0x4c
af87a87c 81cb1302 00fe2e68 af87a8a8 af87a8b4 nt!IopCompleteRequest+0x862
af87a8d4 81fa72eb 00000000 00000000 00000000 nt!KiDeliverApc+0xce
af87a8f4 81fa7500 89a8f001 00000000 81cf4820 hal!HalpDispatchSoftwareInterrupt+0x49
af87a910 81fa75a4 89bec901 89a8f000 af87a954 hal!HalpCheckForSoftwareInterrupt+0x64
af87a920 81ca9db4 89a8f030 a9fe2e68 89bec901 hal!KfLowerIrql+0x64
af87a954 81cb1554 89a8f000 a9fe2e68 a9fe2e28 nt!KiExitDispatcher+0x1a2
af87a978 81cace2d a9fe2e68 89bec9b0 00000000 nt!KeInsertQueueApc+0x61
af87a9b4 81eceb53 a9fe2e28 a9fe2f94 c000009a nt!IopfCompleteRequest+0x42b
af87aa24 82b0c55c 00000000 cff35548 00020000 nt!IovCompleteRequest+0x11c
af87aa3c 82b07386 863e6ee8 a9fe2e28 00000000 Ntfs!NtfsExtendedCompleteRequest+0x104
af87ab08 82b06284 863e6ee8 a9fe2e28 af0518ae Ntfs!NtfsCommonRead+0x1040
af87ab78 81ece681 882f6020 a9fe2e28 00000000 Ntfs!NtfsFsdRead+0x273
af87ab9c 81c27f3a 829d4a5c a9fe2e28 882f6020 nt!IovCallDriver+0x252
af87abb0 829d4a5c 85d13c08 a9fe2e28 00000000 nt!IofCallDriver+0x1b
af87abd4 829d4c18 af87abf4 85d13c08 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x22a
af87ac0c 81ece681 85d13c08 a9fe2e28 a9fe2e28 fltmgr!FltpDispatch+0xc2
af87ac30 81c27f3a a8761764 898e54d0 85d13c08 nt!IovCallDriver+0x252
af87ac44 a8761764 a9fe2e28 898e5418 8a759ec0 nt!IofCallDriver+0x1b
WARNING: Stack unwind information not available. Following frames may be wrong.
af87ac78 81c27f3a 81d88f37 a9fe2e28 898e5418 ino_fltr+0x7764
af87ac8c 81d88f37 a9fe2e28 a9fe2fdc 89bec9b0 nt!IofCallDriver+0x1b
af87acac 81d93669 898e5418 89bec9b0 00000001 nt!IopSynchronousServiceTail+0x1e0
af87ad38 81c8caaa 898e5418 a9fe2e28 00000000 nt!NtReadFile+0x646
af87ad38 77ba0f34 898e5418 a9fe2e28 00000000 nt!KiFastCallEntry+0x12a
0403e810 00000000 00000000 00000000 00000000 0x77ba0f34


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmFreeSpecialPool+69
81ce1ca5 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MmFreeSpecialPool+69

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 471ea39c

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xC1_22_VRF_nt!MmFreeSpecialPool+69

BUCKET_ID: 0xC1_22_VRF_nt!MmFreeSpecialPool+69

Followup: MachineOwner
---------

 
To turn it off, yes, do as you stated.

Yes, I'd completely uninstall the inort product, and you should then be bluescreen free.

Much easier than just reinstalling and hope that fixes it, isn't it? 🙂
 
I uninstall etrust antivirus and installed AVG (latest version, compatible with Vista). I also installed Roxio easy media creator 9, with the CD that came with my laptop, also compatible with Vista. And this morning, I saw a blue screen: BAD_POOL_CALLER.
So I did the same thing with verifier and now, I wait for the next crash.
 
Below is the new log. This time, I don't know who is the culprit.


Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV**http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11e10
Debug session time: Mon Feb 25 14:41:40.438 2008 (GMT+1)
System Uptime: 0 days 2:16:48.715
Loading Kernel Symbols
.........................................................................................................................................................................
Loading User Symbols

Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C1, {c9dfafe0, 0, 20, 22}





Probably caused by : memory_corruption ( nt!MmFreeSpecialPool+69 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: c9dfafe0, address trying to free
Arg2: 00000000, bytes requested
Arg3: 00000020, bytes calculated
Arg4: 00000022, caller is trying to free a bad address

Debugging Details:
------------------






BUGCHECK_STR: 0xC1_22

SPECIAL_POOL_CORRUPTION_TYPE: 22

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 81ce1ca5 to 81cd8681

STACK_TEXT:
83423b54 81ce1ca5 000000c1 c9dfafe0 00000000 nt!KeBugCheckEx+0x1e
83423bcc 81ce7c54 c9dfafe0 c9dfafe0 8689b208 nt!MmFreeSpecialPool+0x69
83423c30 81d98337 c9dfafe0 00000000 00000000 nt!ExFreePoolWithTag+0xeb
83423c50 81d95173 00000000 8689b1e0 00000000 nt!IopDeleteFileObjectExtension+0xa2
83423c94 81ded505 8689b208 81fa7104 8689b1f0 nt!IopDeleteFile+0x26a
83423cb0 81c478c8 8689b208 00000000 8689b5a0 nt!ObpRemoveObjectRoutine+0x100
83423cd8 81dd3759 00000000 00000000 8689b5a0 nt!ObfDereferenceObject+0xa1
83423d04 81c1194e 8689b5a0 00000000 00000000 nt!MiSegmentDelete+0xd2
83423d58 81c1153e 85d152d8 00000000 81d121a0 nt!MiProcessDereferenceList+0x32
83423d7c 81e254e0 00000000 83428680 00000000 nt!MiDereferenceSegmentThread+0xaa
83423dc0 81c9159e 81c11492 00000000 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmFreeSpecialPool+69
81ce1ca5 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MmFreeSpecialPool+69

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 471ea39c

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xC1_22_VRF_nt!MmFreeSpecialPool+69

BUCKET_ID: 0xC1_22_VRF_nt!MmFreeSpecialPool+69

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: c9dfafe0, address trying to free
Arg2: 00000000, bytes requested
Arg3: 00000020, bytes calculated
Arg4: 00000022, caller is trying to free a bad address

Debugging Details:
------------------






BUGCHECK_STR: 0xC1_22

SPECIAL_POOL_CORRUPTION_TYPE: 22

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 81ce1ca5 to 81cd8681

STACK_TEXT:
83423b54 81ce1ca5 000000c1 c9dfafe0 00000000 nt!KeBugCheckEx+0x1e
83423bcc 81ce7c54 c9dfafe0 c9dfafe0 8689b208 nt!MmFreeSpecialPool+0x69
83423c30 81d98337 c9dfafe0 00000000 00000000 nt!ExFreePoolWithTag+0xeb
83423c50 81d95173 00000000 8689b1e0 00000000 nt!IopDeleteFileObjectExtension+0xa2
83423c94 81ded505 8689b208 81fa7104 8689b1f0 nt!IopDeleteFile+0x26a
83423cb0 81c478c8 8689b208 00000000 8689b5a0 nt!ObpRemoveObjectRoutine+0x100
83423cd8 81dd3759 00000000 00000000 8689b5a0 nt!ObfDereferenceObject+0xa1
83423d04 81c1194e 8689b5a0 00000000 00000000 nt!MiSegmentDelete+0xd2
83423d58 81c1153e 85d152d8 00000000 81d121a0 nt!MiProcessDereferenceList+0x32
83423d7c 81e254e0 00000000 83428680 00000000 nt!MiDereferenceSegmentThread+0xaa
83423dc0 81c9159e 81c11492 00000000 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmFreeSpecialPool+69
81ce1ca5 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MmFreeSpecialPool+69

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 471ea39c

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xC1_22_VRF_nt!MmFreeSpecialPool+69

BUCKET_ID: 0xC1_22_VRF_nt!MmFreeSpecialPool+69

Followup: MachineOwner
---------

1: kd> lmvm nt
start end module name
81c00000 81fa1000 nt (pdb symbols) C:\Program Files\Debugging Tools for Windows\sym\ntkrpamp.pdb\03D7DBF252F448A484A9E17FB7734EE62\ntkrpamp.pdb
Loaded symbol image file: ntkrpamp.exe
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Wed Oct 24 03:45:00 2007 (471EA39C)
CheckSum: 00363BFB
ImageSize: 003A1000
File version: 6.0.6000.16584
Product version: 6.0.6000.16584
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 6.0.6000.16584
FileVersion: 6.0.6000.16584 (vista_gdr.071023-1545)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
 
I had another blue screen and here is the new log:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV**http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11e10
Debug session time: Tue Feb 26 13:40:45.916 2008 (GMT+1)
System Uptime: 0 days 2:40:49.015
Loading Kernel Symbols
.........................................................................................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C1, {b4134f68, 0, 98, 22}


PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details
Probably caused by : memory_corruption ( nt!MmFreeSpecialPool+69 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: b4134f68, address trying to free
Arg2: 00000000, bytes requested
Arg3: 00000098, bytes calculated
Arg4: 00000022, caller is trying to free a bad address

Debugging Details:
------------------


PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details

PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details

BUGCHECK_STR: 0xC1_22

SPECIAL_POOL_CORRUPTION_TYPE: 22

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: lsass.exe

CURRENT_IRQL: 0

IRP_ADDRESS: 00134f68

LAST_CONTROL_TRANSFER: from 81ce1ca5 to 81cd8681

STACK_TEXT:
c2e49ac4 81ce1ca5 000000c1 b4134f68 00000000 nt!KeBugCheckEx+0x1e
c2e49b3c 81ce7c54 b4134f68 c2e49bec 87a1f330 nt!MmFreeSpecialPool+0x69
c2e49ba4 81ed5995 b4134f68 00000000 c2e49bcc nt!ExFreePoolWithTag+0xeb
c2e49bb4 81ed5b9b b4134f68 b4134f68 8634f038 nt!VfIrpFree+0x15
c2e49bcc 81ece111 81cb1217 8634f09c b4134f68 nt!VerifierIoFreeIrp+0x11d
c2e49be4 81cb1217 b4134f68 c2e42774 002c49a8 nt!IovFreeIrpPrivate+0x4c
c2e49c34 81ccc1a7 00134fa8 c2e49c64 c2e49c60 nt!IopCompleteRequest+0x862
c2e49c80 81d8ba01 c2e49c9c c2e42784 00000001 nt!IopPostProcessIrp+0xdc
c2e49cc4 81d8b705 00000001 c2e49cfc c2e49d14 nt!IoRemoveIoCompletion+0xa2
c2e49d48 81c8caaa 000000b4 011bfb48 011bfb38 nt!NtRemoveIoCompletion+0x106
c2e49d48 776a0f34 000000b4 011bfb48 011bfb38 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
011bfb20 00000000 00000000 00000000 00000000 0x776a0f34


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmFreeSpecialPool+69
81ce1ca5 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MmFreeSpecialPool+69

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 471ea39c

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xC1_22_VRF_nt!MmFreeSpecialPool+69

BUCKET_ID: 0xC1_22_VRF_nt!MmFreeSpecialPool+69

Followup: MachineOwner
---------
 
Finally, I did a Microsoft Windows Memory test and I saw an error. So I removed my 2 memry sticks of 2 GB each, and put back the 2 orginal Dell memory sticks of 512 MB each.
My laptop ran for a while and then I saw again a blue screen!
Can a blue screen come because I have only 1GB of RAM and sometimes memory comes at 100% ?
Anyway, I did another windbg with this original memory sticks and below is the log, can you tell me what you think?

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV**http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11e10
Debug session time: Wed Mar 5 22:19:49.534 2008 (GMT+1)
System Uptime: 0 days 9:39:19.661
Loading Kernel Symbols
.........................................................................................................................................................................
Loading User Symbols

Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C1, {af5b6f48, 0, b8, 22}

*** ERROR: Module load completed but symbols could not be loaded for iastor.sys




Probably caused by : CLASSPNP.SYS ( CLASSPNP!DestroyTransferPacket+53 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: af5b6f48, address trying to free
Arg2: 00000000, bytes requested
Arg3: 000000b8, bytes calculated
Arg4: 00000022, caller is trying to free a bad address

Debugging Details:
------------------






BUGCHECK_STR: 0xC1_22

SPECIAL_POOL_CORRUPTION_TYPE: 22

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: Idle

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from 81ce1ca5 to 81cd8681

STACK_TEXT:
81cf18e4 81ce1ca5 000000c1 af5b6f48 00000000 nt!KeBugCheckEx+0x1e
81cf195c 81ce7c54 af5b6f48 81cf1a08 8638fb60 nt!MmFreeSpecialPool+0x69
81cf19c0 81ed5995 af5b6f48 00000000 81cf19e8 nt!ExFreePoolWithTag+0xeb
81cf19d0 81ed5b9b af5b6f48 af5b6f48 864b98c0 nt!VfIrpFree+0x15
81cf19e8 81ece111 82a2df59 b70378b8 8b82e620 nt!VerifierIoFreeIrp+0x11d
81cf1a00 82a2df59 af5b6f48 864b97c8 864b986c nt!IovFreeIrpPrivate+0x4c
81cf1a18 82a2da04 8b82e620 00000001 b22d73b0 CLASSPNP!DestroyTransferPacket+0x53
81cf1a34 82a2d4a5 863b6768 022d73b0 b5dc6f48 CLASSPNP!EnqueueFreeTransferPacket+0x116
81cf1a5c 81ecec69 00000000 b5dc6f48 012d73b0 CLASSPNP!TransferPktComplete+0x3d7
81cf1a94 81cacb3b 00000000 b5dc6f48 81cf1b04 nt!IovpLocalCompletionRoutine+0xcc
81cf1acc 81eceb53 00000000 858f3000 b22d745c nt!IopfCompleteRequest+0x13d
81cf1b3c 80648856 00000000 858f5000 b22d745c nt!IovCompleteRequest+0x11c
WARNING: Stack unwind information not available. Following frames may be wrong.
81cf1ba4 8067d970 858f3000 b22d745c 08000000 iastor+0x5856
81cf1c44 8067e4db 00000001 858f3730 81cf4820 iastor+0x3a970
81cf1cdc 806488a3 858f5000 00000000 81ca93ae iastor+0x3b4db
81cf1d50 81c913ee 00000000 0000000e 00000000 iastor+0x58a3
81cf1d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x46


STACK_COMMAND: kb

FOLLOWUP_IP:
CLASSPNP!DestroyTransferPacket+53
82a2df59 8b1dc891a382 mov ebx,dword ptr [CLASSPNP!_imp__ExFreePoolWithTag (82a391c8)]

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: CLASSPNP!DestroyTransferPacket+53

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: CLASSPNP

IMAGE_NAME: CLASSPNP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 4549b196

FAILURE_BUCKET_ID: 0xC1_22_VRF_CLASSPNP!DestroyTransferPacket+53

BUCKET_ID: 0xC1_22_VRF_CLASSPNP!DestroyTransferPacket+53

Followup: MachineOwner
---------

0: kd> lmvm CLASSPNP
start end module name
82a28000 82a49000 CLASSPNP (pdb symbols) C:\Program Files\Debugging Tools for Windows\sym\classpnp.pdb\7A81FB9837764DE48E40D71AD33DEDEE2\classpnp.pdb
Loaded symbol image file: CLASSPNP.SYS
Image path: \SystemRoot\system32\drivers\CLASSPNP.SYS
Image name: CLASSPNP.SYS
Timestamp: Thu Nov 02 09:51:34 2006 (4549B196)
CheckSum: 00028767
ImageSize: 00021000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0


 
It blames iastor and classpnp. The chances of both of those modules having a problem is essentially zero so at this point I'd look into hardware.
 
So you advise me to do like Dell said: resinstall the operating system with the restore CD. And then if the same blue screen appear, contact them again and then they will know it's a hardware problem and they can replace some hardware (maybe the motherboard)?
My laptop is still under warranty until october 2008.
 
Has running memtest86 or memtest86+ been overlooked? Sure, the bluescreen is occurring with two different sets of memory but maybe the bios settings are incorrect for the memory. Check that the bios settings are at their default settings or the memory timings are at their maximum values. Also, set the memory divider from 400MHz down to 333MHz, then run memtest. Checking the memory settings first may be easier than reinstalling the system.
 
I want to inform you that I foudn what was the problem.
I had a Dell Inspiron 1705 laptop. Its monitor didn't work so Dell sent me the Inspiron 1720 laptop in replacement (because I was under warranty). I removed the internal bluetooth adapter (model 350) from the 1705. Then I saw on Dell web site that the model 355 was required for the Inspiron 1720. But I thought "let's try the 350". I put it inside the new laptop and bluetooth was working fine so I thought it was good and forgot about it.
When I contacted Dell, they asked me the usual question "did you install new hardware and software?" and I forgot the internal bluetooth adapter.
After troubleshooting here, I saw that the reason was not memory so I thought again to the Dell question so I removed the internal bluetooth and there is no blue screen since 3 days! (while usually, it was once a day).
So it should be ok now. But this case took me so much time to troubleshoot!
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top