Okay, looks like we have one those horrible Stop 0x24 bugchecks which provide very little information.
Code:
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8801b13fa08 << Exception Record
Arg3: fffff8801b13f270 << Context Record
Arg4: fffff800032627d4 << Instruction which caused the crash
Let's begin by dumping the exception record to understand why we crashed to begin with:
Code:
9: kd> .exr 0xfffff8801b13fa08
ExceptionAddress: fffff800032627d4 (nt!RtlSplay+0x000000000000005c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
Okay, looks like we've referenced an invalid memory address.
Code:
9: kd> !error c0000005
Error code: (NTSTATUS) 0xc0000005 (3221225477) - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
Let's dump the context record and the stack trace as the bugcheck suggests.
Code:
9: kd> .cxr fffff880`1b13f270
rax=fffff8a0236063f8 rbx=fffff8a01901c3e8 rcx=fffff8a0148e14a0
rdx=fffff8a02366ef28 rsi=0000000000000088 rdi=fffff8a0148e1490
rip=fffff800032627d4 rsp=fffff8801b13fc48 rbp=fffff8a0148e14a0
r8=fffdf8a023658f30 r9=fffdf8a023658f28 r10=000000000000035c
r11=fffff8801b13fca0 r12=fffff8a014a00350 r13=fffff8a014a00140
r14=0000000000621dae r15=fffffa801b17f180
iopl=0 nv up ei ng nz na po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010287
nt!RtlSplay+0x5c:
fffff800`032627d4 493910 cmp qword ptr [r8],rdx ds:002b:fffdf8a0`23658f30=????????????????
It seems like we were referencing the r8 register and the pointer dereferenced to an invalid memory address.
I've dumped out the entire kernel stack and the only third-party driver I could find which may have caused the crash is an Intel storage port driver.
Code:
9: kd> lmvm iaStorA
Browse full module list
start end module name
fffff880`0103f000 fffff880`012f2000 iaStorA T (no symbols)
Loaded symbol image file: iaStorA.sys
Image path: \SystemRoot\system32\DRIVERS\iaStorA.sys
Image name: iaStorA.sys
Browse all global symbols functions data
Timestamp: Thu Jun 27 14:18:45 2013 (51CCAC35)
CheckSum: 000AE0B1
ImageSize: 002B3000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
Could you please check for any available updates using the Intel support assistant -
Intel® Driver & Support Assistant
