Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 2600.xpsp_sp2_gdr.061219-0316 Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700 Debug session time: Tue May 8 20:22:54.861 2007 (GMT+4) System Uptime: 7 days 21:03:22.337 Loading Kernel Symbols .......................................................................................................................................... Loading User Symbols Loading unloaded module list ............................ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 100000D1, {c, 2, 0, ac962c02} Probably caused by : tcpip.sys ( tcpip!ReadNextTCB+d2 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: 0000000c, memory referenced Arg2: 00000002, IRQL Arg3: 00000000, value 0 = read operation, 1 = write operation Arg4: ac962c02, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: 0000000c CURRENT_IRQL: 2 FAULTING_IP: tcpip!ReadNextTCB+d2 ac962c02 8b400c mov eax,dword ptr [eax+0Ch] CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0xD1 PROCESS_NAME: procexp.exe LAST_CONTROL_TRANSFER: from ac9536c5 to ac962c02 STACK_TEXT: a91988f0 ac9536c5 020ceec0 a9198a90 87fa8448 tcpip!ReadNextTCB+0xd2 806e4830 05c7fffe fffe0080 00000041 0f04eac1 tcpip!TdiQueryInformationEx+0x7e5 WARNING: Frame IP not in any known module. Following frames may be wrong. 806e4848 720029ba ff8bc303 000101f7 ee740000 0x5c7fffe 806e484c ff8bc303 000101f7 ee740000 f4eb90f3 0x720029ba 806e4850 000101f7 ee740000 f4eb90f3 24a48dc3 0xff8bc303 806e4854 ee740000 f4eb90f3 24a48dc3 00000000 0x101f7 806e4858 f4eb90f3 24a48dc3 00000000 0024a48d 0xee740000 806e485c 24a48dc3 00000000 0024a48d 90000000 0xf4eb90f3 806e4860 00000000 0024a48d 90000000 0080158b 0x24a48dc3 STACK_COMMAND: kb FOLLOWUP_IP: tcpip!ReadNextTCB+d2 ac962c02 8b400c mov eax,dword ptr [eax+0Ch] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: tcpip!ReadNextTCB+d2 FOLLOWUP_NAME: MachineOwner MODULE_NAME: tcpip IMAGE_NAME: tcpip.sys DEBUG_FLR_IMAGE_TIMESTAMP: 444775d3 FAILURE_BUCKET_ID: 0xD1_tcpip!ReadNextTCB+d2 BUCKET_ID: 0xD1_tcpip!ReadNextTCB+d2 Followup: MachineOwner Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 2600.xpsp_sp2_gdr.061219-0316 Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700 Debug session time: Fri Mar 23 18:40:58.156 2007 (GMT+4) System Uptime: 2 days 19:35:05.923 Loading Kernel Symbols .............................................................................................................................................. Loading User Symbols Loading unloaded module list ....................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 100000D1, {c, 2, 0, ab70bc02} Probably caused by : tcpip.sys ( tcpip!ReadNextTCB+d2 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: 0000000c, memory referenced Arg2: 00000002, IRQL Arg3: 00000000, value 0 = read operation, 1 = write operation Arg4: ab70bc02, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: 0000000c CURRENT_IRQL: 2 FAULTING_IP: tcpip!ReadNextTCB+d2 ab70bc02 8b400c mov eax,dword ptr [eax+0Ch] CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0xD1 PROCESS_NAME: procexp.exe LAST_CONTROL_TRANSFER: from ab6fc6c5 to ab70bc02 STACK_TEXT: a5c538f0 ab6fc6c5 02bb0db0 a5c53a90 88d01aa0 tcpip!ReadNextTCB+0xd2 806e4830 05c7fffe fffe0080 00000041 0f04eac1 tcpip!TdiQueryInformationEx+0x7e5 WARNING: Frame IP not in any known module. Following frames may be wrong. 806e4848 720029ba ff8bc303 000101f7 ee740000 0x5c7fffe 806e484c ff8bc303 000101f7 ee740000 f4eb90f3 0x720029ba 806e4850 000101f7 ee740000 f4eb90f3 24a48dc3 0xff8bc303 806e4854 ee740000 f4eb90f3 24a48dc3 00000000 0x101f7 806e4858 f4eb90f3 24a48dc3 00000000 0024a48d 0xee740000 806e485c 24a48dc3 00000000 0024a48d 90000000 0xf4eb90f3 806e4860 00000000 0024a48d 90000000 0080158b 0x24a48dc3 STACK_COMMAND: kb FOLLOWUP_IP: tcpip!ReadNextTCB+d2 ab70bc02 8b400c mov eax,dword ptr [eax+0Ch] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: tcpip!ReadNextTCB+d2 FOLLOWUP_NAME: MachineOwner MODULE_NAME: tcpip IMAGE_NAME: tcpip.sys DEBUG_FLR_IMAGE_TIMESTAMP: 444775d3 FAILURE_BUCKET_ID: 0xD1_tcpip!ReadNextTCB+d2 BUCKET_ID: 0xD1_tcpip!ReadNextTCB+d2 Followup: MachineOwner ---------