Question : Blue screen error - Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+436 ) ??? - 2003 ent ed.

Hi we got a  blue screen on a 2003 server.

How can we track down what is causing the error?

As follows:


Microsoft (R) Windows Debugger  Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [H:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: H:\Debugging_2003_server\Symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 1) UP Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp1_rtm.050324-1447
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a8e48
Debug session time: Tue Feb  6 17:00:32.534 2007 (GMT+1)
System Uptime: 0 days 5:43:18.453
Loading Kernel Symbols
................................................................................................................
Loading User Symbols

Loading unloaded module list
..
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 121a, 320033, e205dbf8}

Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+436 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 0000121a, (reserved)
Arg3: 00320033, Memory contents of the pool block
Arg4: e205dbf8, Address of the block of pool being deallocated

Debugging Details:
------------------


POOL_ADDRESS:  e205dbf8 Paged pool

FREED_POOL_TAG:  NtFU

BUGCHECK_STR:  0xc2_7_NtFU

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  1

LAST_CONTROL_TRANSFER:  from 80896586 to 80875d0e

STACK_TEXT:  
f78beb20 80896586 000000c2 00000007 0000121a nt!KeBugCheckEx+0x1b
f78beb84 f71bef58 e205dbf8 00000000 e10ee0d0 nt!ExFreePoolWithTag+0x436
f78beb98 f719b4e5 89232b68 f78bebb4 89232b68 Ntfs!NtfsDeleteLcb+0xae
f78bebe0 f71c80a8 89232b68 8968b7f8 e1e77a10 Ntfs!NtfsTeardownFromLcb+0x11f
f78bec38 f719ef5d 89232b68 e1e77ad8 00000000 Ntfs!NtfsTeardownStructures+0x12c
f78bec64 f71cc5ae 89232b68 e1e77ad8 00000000 Ntfs!NtfsDecrementCloseCounts+0xa9
f78becec f71cef67 89232b68 e1e77ad8 e1e77a10 Ntfs!NtfsCommonClose+0x3a1
f78bed80 808203bd 00000000 00000000 8979a8d0 Ntfs!NtfsFspClose+0xe2
f78bedac 80905d2c 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f78beddc 80828499 80820300 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+436
80896586 cc              int     3

SYMBOL_STACK_INDEX:  1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  42435e33

SYMBOL_NAME:  nt!ExFreePoolWithTag+436

FAILURE_BUCKET_ID:  0xc2_7_NtFU_nt!ExFreePoolWithTag+436

BUCKET_ID:  0xc2_7_NtFU_nt!ExFreePoolWithTag+436

Followup: MachineOwner
---------

Answer : Blue screen error - Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+436 ) ??? - 2003 ent ed.

From the stack trace of your debug, the culprit is ram. Run memtest to stress test the ram.

Stack Trace of first dump
>>>
f78beb20 80896586 000000c2 00000007 0000121a nt!KeBugCheckEx+0x1b
f78beb84 f71bef58 e205dbf8 00000000 e10ee0d0 nt!ExFreePoolWithTag+0x436 <--- Crash at Memory Management is related to hardware problem (probably it is RAM)
f78beb98 f719b4e5 89232b68 f78bebb4 89232b68 Ntfs!NtfsDeleteLcb+0xae

>>>
Stack Trace of second dump
>>>
adf2fbe4 808553d1 0000008e c0000005 808960cd nt!KeBugCheckEx+0x1b
adf2ffa8 80823dca adf2ffc4 00000000 adf30018 nt!KiDispatchException+0x3a2  <-- Crash at Dispatcher is usually related to hardware error (probably it is ram problem)
adf30010 80823d7e adf300c4 808960cd badb0d00 nt!CommonDispatchException+0x4a
adf300c4 80895b90 897c4030 80a6ea90 00000000 nt!Kei386EoiHelper+0x182
>>>