Forum Discussion

YuanjiXiao's avatar
YuanjiXiao
Copper Contributor
Sep 01, 2022

Windows Server 2019 BSOD

Hi, 
I've got the same BSOD problem from time to time for several months, and i've tried kinds of methods to fix it, but no one works. Here is the bugcheck analysis of the DMP file. Any one can help? Many thanks!

-----------------------------------------------------------------------------------------------------------------
Microsoft (R) Windows Debugger Version 10.0.22621.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Kernel_27_9afb72136999ea6b972ff38b53f60db642db3a0_00000000_cab_02c0b97c\083122-12906-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 17763 MP (8 procs) Free x64
Product: Server, suite: TerminalServer DataCenter SingleUserTS
Edition build lab: 17763.1.amd64fre.rs5_release.180914-1434
Machine Name:
Kernel base = 0xfffff800`0f61e000 PsLoadedModuleList = 0xfffff800`0fa35430
Debug session time: Wed Aug 31 09:49:15.809 2022 (UTC + 8:00)
System Uptime: 6 days 7:51:51.764
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
.............
For analysis of this file, run !analyze -v
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

RDR_FILE_SYSTEM (27)
If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter is the RDBSS BugCheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: 00000000baad0073
Arg2: ffffdc0ebea9e838
Arg3: ffffdc0ebea9e080
Arg4: fffff8044d05c2aa

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : AV.Dereference
Value: NullClassPtr

Key : AV.Fault
Value: Read

Key : Analysis.CPU.mSec
Value: 7546

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 19059

Key : Analysis.Init.CPU.mSec
Value: 13483

Key : Analysis.Init.Elapsed.mSec
Value: 33919

Key : Analysis.Memory.CommitPeak.Mb
Value: 111

Key : WER.OS.Branch
Value: rs5_release

Key : WER.OS.Timestamp
Value: 2018-09-14T14:34:00Z

Key : WER.OS.Version
Value: 10.0.17763.1


FILE_IN_CAB: 083122-12906-01.dmp

BUGCHECK_CODE: 27

BUGCHECK_P1: baad0073

BUGCHECK_P2: ffffdc0ebea9e838

BUGCHECK_P3: ffffdc0ebea9e080

BUGCHECK_P4: fffff8044d05c2aa

EXCEPTION_RECORD: ffffdc0ebea9e838 -- (.exr 0xffffdc0ebea9e838)
ExceptionAddress: fffff8044d05c2aa (nfsrdr!MdaCancelNotify+0x000000000000007a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000038
Attempt to read from address 0000000000000038

CONTEXT: ffffdc0ebea9e080 -- (.cxr 0xffffdc0ebea9e080)
rax=0000000000000000 rbx=ffff8d886605a920 rcx=fffff8044d070300
rdx=0000000000000000 rsi=ffffa387971d2328 rdi=ffffdc0ebea9eba0
rip=fffff8044d05c2aa rsp=ffffdc0ebea9ea70 rbp=fffff8044b52e980
r8=0000000000000040 r9=0000000000000000 r10=7ffffffffffffffc
r11=fffff8044b52b000 r12=ffff8d886605a920 r13=ffff8d8865fe6920
r14=fffff8044d070000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nfsrdr!MdaCancelNotify+0x7a:
fffff804`4d05c2aa 4c8b7038 mov r14,qword ptr [rax+38h] ds:002b:00000000`00000038=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXPNP: 1 (!blackboxpnp)


CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: w3wp.exe

READ_ADDRESS: GetUlongFromAddress: unable to read from fffff8000fae12c0
fffff8000fb5c390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
0000000000000038

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p 0x%p %s

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000000038

EXCEPTION_STR: 0xc0000005

STACK_TEXT:
ffffdc0e`bea9ea70 fffff804`4b512bbf : ffff8d88`6605a920 fffff804`4b52e980 ffffa387`971d2328 fffff804`4b52e980 : nfsrdr!MdaCancelNotify+0x7a
ffffdc0e`bea9eb20 fffff804`4b512c42 : fffff804`4b52e9c0 ffff8d88`65fe6920 fffff804`4b52e980 ffffa387`971d2328 : rdbss!RxpCancelRoutineWorker+0x53
ffffdc0e`bea9eb50 fffff804`4b51200d : 00000000`00002f40 00000000`00002f40 00000000`00000001 fffff804`4b52bcc0 : rdbss!RxpCancelRxContextList+0x3e
ffffdc0e`bea9eb80 fffff804`4b54f465 : ffffa387`8b243010 ffff8d88`661bcd01 ffffa387`971d2328 00000000`00000000 : rdbss!RxCancelNotifyChangeDirectoryRequestsForFobxOnCleanup+0x5d89
ffffdc0e`bea9ebd0 fffff804`4b503015 : ffff8d88`65fe6920 ffff8d88`661bcde0 00000041`4e018000 ffff8d88`5a8e3000 : rdbss!RxCommonCleanup+0x185
ffffdc0e`bea9ecf0 fffff804`4b53e686 : ffff8d88`65fc03a0 fffff800`0f66569d ffff8d88`65fc0080 ffff8d88`5abf7380 : rdbss!RxFsdCommonDispatch+0x5c5
ffffdc0e`bea9ee70 fffff804`4d043d2f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : rdbss!RxFsdDispatch+0x86
ffffdc0e`bea9eec0 fffff800`0f66aba9 : ffff8d88`6a1ef180 ffff8d88`661bcde0 ffffa387`867c41e0 00000000`00000000 : nfsrdr!MdaNtDispatch+0x1af
ffffdc0e`bea9ef00 fffff804`4b02d8b0 : 00000000`00000000 fffff804`4b028000 ffff8d88`661bcf88 ffff8d88`6e698948 : nt!IofCallDriver+0x59
ffffdc0e`bea9ef40 fffff804`4b02d3e9 : ffffa387`867c41e0 fffff804`4b028000 fffff804`4b028000 ffff8d88`661bcde0 : mup!MupiCallUncProvider+0xb0
ffffdc0e`bea9efb0 fffff804`4b033c62 : 00000000`00000000 ffff8d88`6e698940 ffff8d88`6e83edc0 ffff8d88`661bcde0 : mup!MupStateMachine+0x59
ffffdc0e`bea9efe0 fffff800`0f66aba9 : ffff8d88`66e772e0 00000000`00000000 ffff8d88`6a1ef180 00000000`00000000 : mup!MupCleanup+0xb2
ffffdc0e`bea9f030 fffff804`497977c9 : ffff8d88`67c20001 ffffdc0e`bea9f0e0 ffff8d88`67c2ccd0 ffff8d88`67c2cd88 : nt!IofCallDriver+0x59
ffffdc0e`bea9f070 fffff804`49796146 : ffffdc0e`bea9f100 ffff8d88`5d177a50 ffff8d88`5d177a50 ffff8d88`5aeddb80 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x289
ffffdc0e`bea9f0e0 fffff800`0f66aba9 : ffff8d88`6e83edc0 fffff800`0f80f15a ffff8d88`65fc07c0 ffff8d88`5a6a9640 : FLTMGR!FltpDispatch+0xb6
ffffdc0e`bea9f140 fffff800`0fc1c09e : ffff8d88`6e83edc0 ffff8d88`6e83edc0 00000000`00000000 ffff8d88`661bcde0 : nt!IofCallDriver+0x59
ffffdc0e`bea9f180 fffff800`0fc26483 : ffff8d88`5a8e3080 00000000`00000000 ffffa387`00000000 ffff8d88`6e83ed90 : nt!IopCloseFile+0x15e
ffffdc0e`bea9f210 fffff800`0fc2c76e : ffff8d88`65fc0080 00000000`00000001 00000041`4f53e0c0 00000041`4f53ea01 : nt!ObCloseHandleTableEntry+0x543
ffffdc0e`bea9f350 fffff800`0f7e7d05 : ffff8d88`65fc0080 000001aa`5104bd10 ffffdc0e`bea9f440 ffff8d88`69963660 : nt!NtClose+0xde
ffffdc0e`bea9f3c0 00007ff8`e3120904 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000041`4f53da98 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`e3120904


SYMBOL_NAME: nfsrdr!MdaCancelNotify+7a

MODULE_NAME: nfsrdr

IMAGE_NAME: nfsrdr.sys

IMAGE_VERSION: 10.0.17763.2746

STACK_COMMAND: .cxr 0xffffdc0ebea9e080 ; kb

BUCKET_ID_FUNC_OFFSET: 7a

FAILURE_BUCKET_ID: 0x27_nfsrdr!MdaCancelNotify

OS_VERSION: 10.0.17763.1

BUILDLAB_STR: rs5_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {d981d000-0757-4a62-5566-08f087aa422c}

Followup: MachineOwner
---------

 

  • Reza_Ameri's avatar
    Reza_Ameri
    Silver Contributor
    Do you have access to a Windows 10 or Windows 11 PC?
    If yes, then open start and search for feedback and open the Feedback Hub app and report this issue and attach dump files or any other relevant data there.
    In the list, you have to select Windows Server.
    • YuanjiXiao's avatar
      YuanjiXiao
      Copper Contributor
      I've tried the app, and now i'm waiting for the reply, thank you!
      • Reza_Ameri's avatar
        Reza_Ameri
        Silver Contributor
        Great, you might not receive direct feedback but the Windows team would investigate and attempt to fix the issue.

Resources