We have a Lenovo X201 Tablet experiencing randoM BSOD's. It is running Windows 7 Professional SP1. From the memory dump we get the following:
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MiRemoveNode+204
fffff800`02f01d34 49395808 cmp qword ptr [r8+8],rbx
CONTEXT: fffff8800aa110b0 -- (.cxr 0xfffff8800aa110b0)
rax=000007b80000b73d rbx=fffff8a00911e5b0 rcx=000007b80000b73d
rdx=fffff80003095dff rsi=fffff8a00911e5b0 rdi=fffff8a00911e5b0
rip=fffff80002f01d34 rsp=fffff8800aa11a90 rbp=fffff80003095da0
r8=000063cc007465c0 r9=0000000000000018 r10=fffffa8006c2dd50
r11=00000000001f0001 r12=0000000000000001 r13=0000000000000000
r14=00000000ffffffff r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!MiRemoveNode+0x204:
fffff800`02f01d34 49395808 cmp qword ptr [r8+8],rbx ds:002b:000063cc`007465c8=????????????????
Resetting default scope
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff8000313291b to fffff80002f01d34
STACK_TEXT:
fffff880`0aa11a90 fffff800`0313291b : fffffa80`0735f5d0 fffffa80`083ea060 00000000`00000001 fffff8a0`0911e5b0 : nt!MiRemoveNode+0x204
fffff880`0aa11ac0 fffff800`02ed93d4 : 00000000`00000000 00000000`00000000 fffffa80`06c628e0 00000000`00000701 : nt! ?? ::NNGAKEGL::`string'+0x3395d
fffff880`0aa11b00 fffff800`0316b075 : 00000000`00000000 fffff8a0`02753780 00000000`00000000 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`0aa11b60 fffff800`031d8a18 : fffff8a0`02753760 00000000`00000001 fffff8a0`02753780 00000000`00000000 : nt!AlpcpSectionDestroyProcedure+0x39
fffff880`0aa11b90 fffff800`0315dd9c : fffff8a0`02753780 00000000`ffffffff 00000000`ffffffff 00000000`00000000 : nt!AlpcpDestroyBlob+0x28
fffff880`0aa11bc0 fffff800`02ecf453 : fffffa80`083ea060 fffff880`0aa11ca0 00000000`03fa55f0 fffffa80`0a440950 : nt!NtAlpcDeletePortSection+0x110
fffff880`0aa11c20 00000000`77691aba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`04cdf4e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77691aba
FOLLOWUP_IP:
nt!MiRemoveNode+204
fffff800`02f01d34 49395808 cmp qword ptr [r8+8],rbx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiRemoveNode+204
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4fa390f3
STACK_COMMAND: .cxr 0xfffff8800aa110b0 ; kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x3B_nt!MiRemoveNode+204
BUCKET_ID: X64_0x3B_nt!MiRemoveNode+204
Followup: MachineOwner
---------
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MiRemoveNode+204
fffff800`02f01d34 49395808 cmp qword ptr [r8+8],rbx
CONTEXT: fffff8800aa110b0 -- (.cxr 0xfffff8800aa110b0)
rax=000007b80000b73d rbx=fffff8a00911e5b0 rcx=000007b80000b73d
rdx=fffff80003095dff rsi=fffff8a00911e5b0 rdi=fffff8a00911e5b0
rip=fffff80002f01d34 rsp=fffff8800aa11a90 rbp=fffff80003095da0
r8=000063cc007465c0 r9=0000000000000018 r10=fffffa8006c2dd50
r11=00000000001f0001 r12=0000000000000001 r13=0000000000000000
r14=00000000ffffffff r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!MiRemoveNode+0x204:
fffff800`02f01d34 49395808 cmp qword ptr [r8+8],rbx ds:002b:000063cc`007465c8=????????????????
Resetting default scope
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff8000313291b to fffff80002f01d34
STACK_TEXT:
fffff880`0aa11a90 fffff800`0313291b : fffffa80`0735f5d0 fffffa80`083ea060 00000000`00000001 fffff8a0`0911e5b0 : nt!MiRemoveNode+0x204
fffff880`0aa11ac0 fffff800`02ed93d4 : 00000000`00000000 00000000`00000000 fffffa80`06c628e0 00000000`00000701 : nt! ?? ::NNGAKEGL::`string'+0x3395d
fffff880`0aa11b00 fffff800`0316b075 : 00000000`00000000 fffff8a0`02753780 00000000`00000000 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`0aa11b60 fffff800`031d8a18 : fffff8a0`02753760 00000000`00000001 fffff8a0`02753780 00000000`00000000 : nt!AlpcpSectionDestroyProcedure+0x39
fffff880`0aa11b90 fffff800`0315dd9c : fffff8a0`02753780 00000000`ffffffff 00000000`ffffffff 00000000`00000000 : nt!AlpcpDestroyBlob+0x28
fffff880`0aa11bc0 fffff800`02ecf453 : fffffa80`083ea060 fffff880`0aa11ca0 00000000`03fa55f0 fffffa80`0a440950 : nt!NtAlpcDeletePortSection+0x110
fffff880`0aa11c20 00000000`77691aba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`04cdf4e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77691aba
FOLLOWUP_IP:
nt!MiRemoveNode+204
fffff800`02f01d34 49395808 cmp qword ptr [r8+8],rbx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiRemoveNode+204
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4fa390f3
STACK_COMMAND: .cxr 0xfffff8800aa110b0 ; kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x3B_nt!MiRemoveNode+204
BUCKET_ID: X64_0x3B_nt!MiRemoveNode+204
Followup: MachineOwner
---------