
Microsoft (R) Windows Debugger  Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.070227-2300
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Nov 16 16:00:36.312 2007 (GMT+1)
System Uptime: 0 days 0:25:48.017
Loading Kernel Symbols
....................................................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffdf00c).  Type ".hh dbgerr001" for details
Loading unloaded module list
...........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D0, {54504354, 2, 1, 80547ed8}

Probably caused by : Ntfs.sys

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_CORRUPTED_MMPOOL (d0)
Arguments:
Arg1: 54504354, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 80547ed8, address which referenced memory
	An attempt was made to access a pageable (or completely invalid) address at an
	interrupt request level (IRQL) that is too high.  This is
	caused by drivers that have corrupted the system pool.  Run the driver
	verifier against any new (or suspect) drivers, and if that doesn't turn up
	the culprit, then use gflags to enable special pool.  You can also set
	HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\ProtectNonPagedPool
	to a DWORD 1 value and reboot.  Then the system will unmap freed nonpaged pool,
	preventing drivers (although not DMA-hardware) from corrupting the pool.

Debugging Details:
------------------


WRITE_ADDRESS:  54504354 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiFreePoolPages+336
80547ed8 8908            mov     dword ptr [eax],ecx

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xD0

PROCESS_NAME:  salamand.exe

IRP_ADDRESS:  888d99c8

DEVICE_OBJECT: 8a051770

DRIVER_OBJECT: 8a3a3e20

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  45cc56a7

MODULE_NAME: Ntfs

FAULTING_MODULE: f7214000 Ntfs

TRAP_FRAME:  ba208b0c -- (.trap ffffffffba208b0c)
ErrCode = 00000002
eax=54504354 ebx=03ffffff ecx=00350000 edx=00000000 esi=8174f3a8 edi=00000000
eip=80547ed8 esp=ba208b80 ebp=ba208ba4 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!MiFreePoolPages+0x336:
80547ed8 8908            mov     dword ptr [eax],ecx  ds:0023:54504354=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 80547ed8 to 80543a70

STACK_TEXT:  
ba208b0c 80547ed8 badb0d00 00000000 0101d648 nt!KiTrap0E+0x238
ba208ba4 8054a49a 88542000 888cd940 806e4410 nt!MiFreePoolPages+0x336
ba208be4 804f4bf4 88542000 00000000 00000103 nt!ExFreePoolWithTag+0x1ba
ba208c3c 8057e7b4 888d9a08 ba208c78 ba208c84 nt!IopCompleteRequest+0xf4
ba208c64 8057f5e1 8a05e9f0 c0000275 888cd940 nt!IopSynchronousServiceTail+0x96
ba208d00 8057816a 00000248 00000000 00000000 nt!IopXxxControlFile+0x5c5
ba208d34 805409ac 00000248 00000000 00000000 nt!NtFsControlFile+0x2a
ba208d34 7c90eb94 00000248 00000000 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013d310 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  0xD0_W_IMAGE_Ntfs.sys_DATE_2007_02_09

BUCKET_ID:  0xD0_W_IMAGE_Ntfs.sys_DATE_2007_02_09

Followup: MachineOwner
---------

