Hi,
Generally I don't debug XP dumps as my expertise is mostly in Vista / 7 / 8's architecture, but let's give this a whirl :+) We have a few varying bugchecks here:
IRQL_NOT_LESS_OR_EQUAL (a)
This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high. The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.
Let's take a look at our busy call stack here:
Code:
1: kd> kv
ChildEBP RetAddr Args to Child
a31130b8 8054b4b7 e4116000 e4116000 80659138 nt!VfDeadlockDeleteMemoryRange+0x6e (FPO: [Non-Fpo])
a31130fc a2df0602 e4116000 00000000 88b0e000 nt!ExFreePoolWithTag+0x1d7 (FPO: [Non-Fpo])
a3113114 a2de7d8a e3c59808 88b0e000 88fb5c00 kmixer!DisableSRC+0x42 (FPO: [Non-Fpo])
a31131cc a2dfad8f 88fb5be8 00000000 88b0e000 kmixer!ChangeSrc+0x35a (FPO: [Non-Fpo])
a3113280 a2dfb0a5 88fb5be8 88b0e000 88b0e000 kmixer!ChangeOutputRate+0x1ff (FPO: [Non-Fpo])
a31132a4 a2dec08b 88fb5be8 88f17c30 88e55c68 kmixer!OptimizeMix+0x2d5 (FPO: [Non-Fpo])
a31132d4 a2dec7ba 88fb5ca0 88e4ca20 00000008 kmixer!CreateSinkPin+0x9eb (FPO: [Non-Fpo])
a3113300 b64adfdb 893f4ae8 88e4ca20 893f4ae8 kmixer!PinDispatchCreate+0xca (FPO: [Non-Fpo])
a3113324 804ef19f 893f4ae8 00000000 806e6428 ks!DispatchCreate+0xc7 (FPO: [Non-Fpo])
a3113334 80658128 88f17c40 88f17c30 88d75888 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
a3113358 805831fa 88e55c68 89210608 a3113528 nt!IovCallDriver+0xa0 (FPO: [Non-Fpo])
a3113438 8058361c 893f4ae8 00000000 88fd5628 nt!IopParseDevice+0xa12 (FPO: [Non-Fpo])
a3113470 805bf02d 88e55c68 00000000 88fd5628 nt!IopParseFile+0x46 (FPO: [Non-Fpo])
a31134e8 805bb9dc 800010d8 a3113528 00000240 nt!ObpLookupObjectName+0x119 (FPO: [Non-Fpo])
a311353c 80576033 00000000 00000000 00096300 nt!ObOpenObjectByName+0xea (FPO: [Non-Fpo])
a31135b8 805769aa e34240d8 40000000 a3113660 nt!IopCreateFile+0x407 (FPO: [Non-Fpo])
a3113614 b64ae4ee e34240d8 40000000 a3113660 nt!IoCreateFile+0x8e (FPO: [Non-Fpo])
a3113690 b64ada77 800010d8 b64ada80 88e036b0 ks!KsiCreateObjectType+0xd6 (FPO: [Non-Fpo])
a31136b0 ad412fdf 800010d8 88e036b0 40000200 ks!KsCreatePin+0x33 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
a31136d4 ad41240d e3585fc0 e33311a0 e1a40c20 sysaudio+0x4fdf
a3113700 ad412b2a 00000000 88e036b0 00000000 sysaudio+0x440d
a3113728 ad411574 e32fbbc8 e21d5d98 88e036b0 sysaudio+0x4b2a
a3113758 ad4121e7 c0000010 88e036b0 00000000 sysaudio+0x3574
a3113774 ad411718 88a997d8 ad4114e6 88e036b0 sysaudio+0x41e7
a31137a8 b64adfdb 897f6bf0 88a997d8 897f6bf0 sysaudio+0x3718
a31137cc 804ef19f 897f6bf0 00000000 806e6428 ks!DispatchCreate+0xc7 (FPO: [Non-Fpo])
a31137dc 80658128 88a997e8 88a997d8 88f77d08 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
a3113800 805831fa 88f7f748 88e07388 a31139d0 nt!IovCallDriver+0xa0 (FPO: [Non-Fpo])
a31138e0 8058361c 897f6bf0 00000000 89254468 nt!IopParseDevice+0xa12 (FPO: [Non-Fpo])
a3113918 805bf02d 88f7f748 00000000 89254468 nt!IopParseFile+0x46 (FPO: [Non-Fpo])
a3113990 805bb9dc 80001ecc a31139d0 00000240 nt!ObpLookupObjectName+0x119 (FPO: [Non-Fpo])
a31139e4 80576033 00000000 00000000 00096300 nt!ObOpenObjectByName+0xea (FPO: [Non-Fpo])
a3113a60 805769aa a3113b88 40000000 a3113b08 nt!IopCreateFile+0x407 (FPO: [Non-Fpo])
a3113abc b64ae4ee a3113b88 40000000 a3113b08 nt!IoCreateFile+0x8e (FPO: [Non-Fpo])
a3113b38 b64ada77 80001ecc b64ada80 89237ba8 ks!KsiCreateObjectType+0xd6 (FPO: [Non-Fpo])
a3113b58 a418c3e2 80001ecc 89237ba8 40000200 ks!KsCreatePin+0x33 (FPO: [Non-Fpo])
a3113b8c a418c813 00000000 00000009 00000001 wdmaud+0x43e2
a3113bc8 a418ba83 00000092 00000009 89273758 wdmaud+0x4813
a3113bf4 a418b382 892637d0 89273758 00000000 wdmaud+0x3a83
a3113c1c 804ef19f 00000010 88e0b000 806e6428 wdmaud+0x3382
a3113c2c 80658128 88e45c80 806e6410 892637d0 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
a3113c50 8057f982 89263864 88e45c80 892637d0 nt!IovCallDriver+0xa0 (FPO: [Non-Fpo])
a3113c64 805807f7 8975ef10 892637d0 88e45c80 nt!IopSynchronousServiceTail+0x70 (FPO: [Non-Fpo])
a3113d00 80579274 00000df8 00000f48 00000000 nt!IopXxxControlFile+0x5c5 (FPO: [Non-Fpo])
a3113d34 8054162c 00000df8 00000f48 00000000 nt!NtDeviceIoControlFile+0x2a (FPO: [Non-Fpo])
a3113d34 7c90e514 00000df8 00000f48 00000000 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ a3113d64)
0b79fbbc 00000000 00000000 00000000 00000000 0x7c90e514
BAD_POOL_CALLER (c2)
This indicates that the current thread is making a bad pool request.
Same as above, audio calls throughout stack.
DRIVER_CORRUPTED_EXPOOL (c5)
This indicates that the system attempted to access invalid memory at a process IRQL that was too high.
The kernel attempted to access pageable memory (or perhaps completely invalid memory) when the IRQL was too high. The ultimate cause of this problem is almost certainly a driver that has corrupted the system pool.
---------------------------------------------
We can see we go from a few
wdmaud.sys (Microsoft Windows WDM sound system driver file) calls, to a few
sysaudio.sys (System Audio WDM Filter) calls, and then finally to
kmixer.sys (Kernel Mode Audio Mixer).
We likely have some sort of device driver or piece of software conflicting with your Windows sound drivers. Interesingly enough, in all of the crashes, we have a consistent process at the time of the crash -
PROCESS_NAME: Citect32.exe
^^ I know what this software is, who it's developed by, etc. But what exactly is its purpose, what is it used for?
Regards,
Patrick
