So I was thinking that I would like to start digging deeper and (try!) understanding the causes of crashes. I know that some times it is not possible to find the cause.\n\nDebug trace 1 attachment.\n\nSo given the kp command:\n\n\n0: kd> kp\nChild-SP RetAddr Call Site\nfffff880`03a4f5d8 fffff800`02946a23 nt!KeBugCheckEx\nfffff880`03a4f5e0 fffff800`028f43d2 nt! ?? ::FNODOBFM::`string'+0x29ac2\nfffff880`03a4f6d0 fffff800`028f2421 nt!MiDispatchFault+0x8c2\nfffff880`03a4f7e0 fffff800`028d612e nt!MmAccessFault+0x8f1\nfffff880`03a4f940 fffff800`028cef5b nt!KiPageFault+0x16e\nfffff880`03a4fad8 fffff800`02cf63f3 nt!memcpy+0x20b\nfffff880`03a4fae0 fffff800`02d44810 nt!PfTCreateTraceDump+0x2e3\nfffff880`03a4fbe0 fffff800`02d4a403 nt!PfTGenerateTrace+0x10\nfffff880`03a4fc10 fffff800`02b776e6 nt!PfTLoggingWorker+0x113\nfffff880`03a4fd40 fffff800`028b6566 nt!PspSystemThreadStartup+0x5a\nfffff880`03a4fd80 00000000`00000000 nt!KiStartSystemThread+0x16\n\n\n\nSo what I understand is that they are Native API calls as apposed to User API (Win32K) calls.\n\n1\/ How do I locate the meaning of PfTLoggingWorker in Microsoft documentation? I can't find it.\n\n2\/ How do I trace it back off the stack in to memory? Is that possible with kernel dump?\n\n\nDebug trace 2 attachment.\n\nWhat does the following mean and what impact does it have on the crash dump file?\n\n\nDbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?fffff8a0`00225382?\nDbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?fffff8a0`02dfbc32?\nDbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?fffff800`00b9c3c0?\n\n\n\n\nAny help would be greatly appreciated.