Our new (not yet production) file server (W2k12) crashed last night due to an access violation in dfsc.sys. Afaik it happened the first time, but I am not totally sure. I also was unable to find out whether this is a common problem with a known fix. Windbg output is:
MODULE_NAME: dfsc FAULTING_MODULE: fffff80363a82000 nt DEBUG_FLR_IMAGE_TIMESTAMP: 5010aaed EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden. FAULTING_IP: nt!RtlRemoveUnicodePrefix+7d fffff803`63e5e6fd 483919 cmp qword ptr [rcx],rbx CONTEXT: fffff88008692870 -- (.cxr 0xfffff88008692870) rax=0000000000000000 rbx=fffff8a068545920 rcx=0000000000000008 rdx=fffff8a068545920 rsi=0000000000000801 rdi=0000000000000802 rip=fffff80363e5e6fd rsp=fffff88008693270 rbp=fffffa804478eec0 r8=fffff8a068545920 r9=0000000000000053 r10=0000000000000005 r11=fffff8a05f0fc5f0 r12=fffffa804478ee58 r13=0000000000400000 r14=0000000000000000 r15=fffff88001c19110 iopl=0 nv up ei ng nz ac po cy cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010297 nt!RtlRemoveUnicodePrefix+0x7d: fffff803`63e5e6fd 483919 cmp qword ptr [rcx],rbx ds:002b:00000000`00000008=???????????????? Resetting default scope DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT BUGCHECK_STR: 0x3B CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff88001c2be61 to fffff80363e5e6fd STACK_TEXT: fffff880`08693270 fffff880`01c2be61 : fffff8a0`685458e0 fffffa80`4478ee20 fffffa80`4478eec0 fffffa80`4478ee20 : nt!RtlRemoveUnicodePrefix+0x7d fffff880`086932a0 fffff880`01c1b604 : fffff8a0`31531340 fffffa80`4478ee20 fffffa80`4478eec0 fffffa80`4478ee20 : dfsc+0x1ae61 fffff880`086932e0 fffff880`01c29799 : 00000000`00000000 fffff880`08693380 fffff8a0`0ac77d18 00000000`00000000 : dfsc+0xa604 fffff880`08693340 fffff880`01c1d7ef : fffff880`01c19140 fffff880`08693500 00000000`ffffffff fffff8a0`31531340 : dfsc+0x18799 fffff880`086933b0 fffff880`01c1dd01 : fffff880`01c19140 fffff880`08693470 00000000`ffffffff fffff880`08693508 : dfsc+0xc7ef fffff880`08693410 fffff880`01c1d9f9 : 00000000`00000000 fffff880`08693500 00000000`ffffffff fffff8a0`62436644 : dfsc+0xcd01 fffff880`086934a0 fffff880`01c1dd01 : fffff8a0`f93fb250 fffff880`01c19130 00000000`00000009 fffff8a0`0ac77d18 : dfsc+0xc9f9 fffff880`086934d0 fffff880`01c1ca72 : fffff8a0`f93fb250 fffff8a0`0ac77d10 00000000`00000009 fffff8a0`304b6590 : dfsc+0xcd01 fffff880`08693560 fffff880`01c20151 : 00000000`00000001 fffff880`01c19110 00000000`00000000 fffff880`01c19110 : dfsc+0xba72 fffff880`086935a0 fffff880`0205c411 : fffffa80`ac0495c0 fffff8a0`0ac77d10 00000000`00000000 fffff803`63b6c967 : dfsc+0xf151 fffff880`08693620 fffff880`0205d4b6 : fffff880`086937a0 00000000`00000000 00000000`00000000 fffff880`086936d0 : mup!MupSurrogatePurgeNegativeCacheEntry+0x4975 fffff880`08693680 fffff880`00a694ee : fffffa80`57593960 00000000`00000000 00000000`0000003e 00000000`00000270 : mup!MupSurrogateGetUncProviderDeviceObject+0x806 fffff880`08693750 fffff880`00a9335d : fffffa80`590ed2e0 fffffa80`6c4b6d10 fffffa80`446fe0f0 00000000`00000801 : fltmgr!FltReleaseContext+0x90e fffff880`086937f0 fffff803`63eae818 : 00000000`00000000 00000000`00000005 fffffa80`575939f8 00000000`000007ff : fltmgr!FltGetRequestorProcessIdEx+0x189c1 fffff880`086938a0 fffff803`63eab8c5 : fffffa80`4acf6cd0 fffffa80`4acf6cd0 00000000`00000000 fffffa80`44700190 : nt!NtAllocateVirtualMemory+0x5c98 fffff880`08693a80 fffff803`63ebb238 : 00000000`00000000 fffff880`08693c48 00000001`00000040 fffffa80`4304b080 : nt!NtAllocateVirtualMemory+0x2d45 fffff880`08693bd0 fffff803`63eb63de : 00000000`00000000 00000000`00000000 fffff8a1`b9575e01 ffffc0f0`7729e80a : nt!ObOpenObjectByName+0x258 fffff880`08693ca0 fffff803`63ec48d9 : 000000a1`34a3e430 ffffc0f0`00100080 000000a1`34a3e438 00000000`00000000 : nt!ObCreateObject+0x6ee fffff880`08693d40 fffff803`63adb453 : 00000000`00000340 fffff803`63efa0c6 fffff880`08693df8 00000000`00000000 : nt!NtCreateFile+0x79 fffff880`08693dd0 000007ff`345f313a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeSaveStateForHibernate+0x2a33 000000a1`34a3e3c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007ff`345f313a FOLLOWUP_IP: dfsc+1ae61 fffff880`01c2be61 41bbfeff0000 mov r11d,0FFFEh SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: dfsc+1ae61 FOLLOWUP_NAME: MachineOwner IMAGE_NAME: dfsc.sys STACK_COMMAND: .cxr 0xfffff88008692870 ; kb
Does anyone know about this problem and its cause?
Thanks in advance,
Christoph