Forum Discussion
YuanjiXiao
Sep 01, 2022Copper Contributor
Windows Server 2019 BSOD
Hi,
I've got the same BSOD problem from time to time for several months, and i've tried kinds of methods to fix it, but no one works. Here is the bugcheck analysis of the DMP file. Any one can help? Many thanks!
-----------------------------------------------------------------------------------------------------------------
Microsoft (R) Windows Debugger Version 10.0.22621.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Kernel_27_9afb72136999ea6b972ff38b53f60db642db3a0_00000000_cab_02c0b97c\083122-12906-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 17763 MP (8 procs) Free x64
Product: Server, suite: TerminalServer DataCenter SingleUserTS
Edition build lab: 17763.1.amd64fre.rs5_release.180914-1434
Machine Name:
Kernel base = 0xfffff800`0f61e000 PsLoadedModuleList = 0xfffff800`0fa35430
Debug session time: Wed Aug 31 09:49:15.809 2022 (UTC + 8:00)
System Uptime: 6 days 7:51:51.764
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
.............
For analysis of this file, run !analyze -v
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
RDR_FILE_SYSTEM (27)
If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter is the RDBSS BugCheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: 00000000baad0073
Arg2: ffffdc0ebea9e838
Arg3: ffffdc0ebea9e080
Arg4: fffff8044d05c2aa
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullClassPtr
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 7546
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 19059
Key : Analysis.Init.CPU.mSec
Value: 13483
Key : Analysis.Init.Elapsed.mSec
Value: 33919
Key : Analysis.Memory.CommitPeak.Mb
Value: 111
Key : WER.OS.Branch
Value: rs5_release
Key : WER.OS.Timestamp
Value: 2018-09-14T14:34:00Z
Key : WER.OS.Version
Value: 10.0.17763.1
FILE_IN_CAB: 083122-12906-01.dmp
BUGCHECK_CODE: 27
BUGCHECK_P1: baad0073
BUGCHECK_P2: ffffdc0ebea9e838
BUGCHECK_P3: ffffdc0ebea9e080
BUGCHECK_P4: fffff8044d05c2aa
EXCEPTION_RECORD: ffffdc0ebea9e838 -- (.exr 0xffffdc0ebea9e838)
ExceptionAddress: fffff8044d05c2aa (nfsrdr!MdaCancelNotify+0x000000000000007a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000038
Attempt to read from address 0000000000000038
CONTEXT: ffffdc0ebea9e080 -- (.cxr 0xffffdc0ebea9e080)
rax=0000000000000000 rbx=ffff8d886605a920 rcx=fffff8044d070300
rdx=0000000000000000 rsi=ffffa387971d2328 rdi=ffffdc0ebea9eba0
rip=fffff8044d05c2aa rsp=ffffdc0ebea9ea70 rbp=fffff8044b52e980
r8=0000000000000040 r9=0000000000000000 r10=7ffffffffffffffc
r11=fffff8044b52b000 r12=ffff8d886605a920 r13=ffff8d8865fe6920
r14=fffff8044d070000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nfsrdr!MdaCancelNotify+0x7a:
fffff804`4d05c2aa 4c8b7038 mov r14,qword ptr [rax+38h] ds:002b:00000000`00000038=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXPNP: 1 (!blackboxpnp)
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: w3wp.exe
READ_ADDRESS: GetUlongFromAddress: unable to read from fffff8000fae12c0
fffff8000fb5c390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
0000000000000038
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p 0x%p %s
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000038
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
ffffdc0e`bea9ea70 fffff804`4b512bbf : ffff8d88`6605a920 fffff804`4b52e980 ffffa387`971d2328 fffff804`4b52e980 : nfsrdr!MdaCancelNotify+0x7a
ffffdc0e`bea9eb20 fffff804`4b512c42 : fffff804`4b52e9c0 ffff8d88`65fe6920 fffff804`4b52e980 ffffa387`971d2328 : rdbss!RxpCancelRoutineWorker+0x53
ffffdc0e`bea9eb50 fffff804`4b51200d : 00000000`00002f40 00000000`00002f40 00000000`00000001 fffff804`4b52bcc0 : rdbss!RxpCancelRxContextList+0x3e
ffffdc0e`bea9eb80 fffff804`4b54f465 : ffffa387`8b243010 ffff8d88`661bcd01 ffffa387`971d2328 00000000`00000000 : rdbss!RxCancelNotifyChangeDirectoryRequestsForFobxOnCleanup+0x5d89
ffffdc0e`bea9ebd0 fffff804`4b503015 : ffff8d88`65fe6920 ffff8d88`661bcde0 00000041`4e018000 ffff8d88`5a8e3000 : rdbss!RxCommonCleanup+0x185
ffffdc0e`bea9ecf0 fffff804`4b53e686 : ffff8d88`65fc03a0 fffff800`0f66569d ffff8d88`65fc0080 ffff8d88`5abf7380 : rdbss!RxFsdCommonDispatch+0x5c5
ffffdc0e`bea9ee70 fffff804`4d043d2f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : rdbss!RxFsdDispatch+0x86
ffffdc0e`bea9eec0 fffff800`0f66aba9 : ffff8d88`6a1ef180 ffff8d88`661bcde0 ffffa387`867c41e0 00000000`00000000 : nfsrdr!MdaNtDispatch+0x1af
ffffdc0e`bea9ef00 fffff804`4b02d8b0 : 00000000`00000000 fffff804`4b028000 ffff8d88`661bcf88 ffff8d88`6e698948 : nt!IofCallDriver+0x59
ffffdc0e`bea9ef40 fffff804`4b02d3e9 : ffffa387`867c41e0 fffff804`4b028000 fffff804`4b028000 ffff8d88`661bcde0 : mup!MupiCallUncProvider+0xb0
ffffdc0e`bea9efb0 fffff804`4b033c62 : 00000000`00000000 ffff8d88`6e698940 ffff8d88`6e83edc0 ffff8d88`661bcde0 : mup!MupStateMachine+0x59
ffffdc0e`bea9efe0 fffff800`0f66aba9 : ffff8d88`66e772e0 00000000`00000000 ffff8d88`6a1ef180 00000000`00000000 : mup!MupCleanup+0xb2
ffffdc0e`bea9f030 fffff804`497977c9 : ffff8d88`67c20001 ffffdc0e`bea9f0e0 ffff8d88`67c2ccd0 ffff8d88`67c2cd88 : nt!IofCallDriver+0x59
ffffdc0e`bea9f070 fffff804`49796146 : ffffdc0e`bea9f100 ffff8d88`5d177a50 ffff8d88`5d177a50 ffff8d88`5aeddb80 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x289
ffffdc0e`bea9f0e0 fffff800`0f66aba9 : ffff8d88`6e83edc0 fffff800`0f80f15a ffff8d88`65fc07c0 ffff8d88`5a6a9640 : FLTMGR!FltpDispatch+0xb6
ffffdc0e`bea9f140 fffff800`0fc1c09e : ffff8d88`6e83edc0 ffff8d88`6e83edc0 00000000`00000000 ffff8d88`661bcde0 : nt!IofCallDriver+0x59
ffffdc0e`bea9f180 fffff800`0fc26483 : ffff8d88`5a8e3080 00000000`00000000 ffffa387`00000000 ffff8d88`6e83ed90 : nt!IopCloseFile+0x15e
ffffdc0e`bea9f210 fffff800`0fc2c76e : ffff8d88`65fc0080 00000000`00000001 00000041`4f53e0c0 00000041`4f53ea01 : nt!ObCloseHandleTableEntry+0x543
ffffdc0e`bea9f350 fffff800`0f7e7d05 : ffff8d88`65fc0080 000001aa`5104bd10 ffffdc0e`bea9f440 ffff8d88`69963660 : nt!NtClose+0xde
ffffdc0e`bea9f3c0 00007ff8`e3120904 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000041`4f53da98 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`e3120904
SYMBOL_NAME: nfsrdr!MdaCancelNotify+7a
MODULE_NAME: nfsrdr
IMAGE_NAME: nfsrdr.sys
IMAGE_VERSION: 10.0.17763.2746
STACK_COMMAND: .cxr 0xffffdc0ebea9e080 ; kb
BUCKET_ID_FUNC_OFFSET: 7a
FAILURE_BUCKET_ID: 0x27_nfsrdr!MdaCancelNotify
OS_VERSION: 10.0.17763.1
BUILDLAB_STR: rs5_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {d981d000-0757-4a62-5566-08f087aa422c}
Followup: MachineOwner
---------
- Reza_AmeriSilver ContributorDo you have access to a Windows 10 or Windows 11 PC?
If yes, then open start and search for feedback and open the Feedback Hub app and report this issue and attach dump files or any other relevant data there.
In the list, you have to select Windows Server.- YuanjiXiaoCopper ContributorI've tried the app, and now i'm waiting for the reply, thank you!
- Reza_AmeriSilver ContributorGreat, you might not receive direct feedback but the Windows team would investigate and attempt to fix the issue.