Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Program Files (x86)\Windows Kits\8.1\Debuggers\MEMORY.DMP] Kernel Summary Dump File: Only kernel address space is available ************* Symbol Path validation summary ************** Response Time (ms) Location Deferred SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.23572.amd64fre.win7sp1_ldr.161011-0600 Machine Name: Kernel base = 0xfffff800`02c0c000 PsLoadedModuleList = 0xfffff800`02e4e730 Debug session time: Thu Dec 29 08:03:16.004 2016 (UTC - 5:00) System Uptime: 1 days 0:05:17.885 Loading Kernel Symbols ............................................................... ................................................................ .................................. Loading User Symbols Loading unloaded module list .................................................. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 27, {baad0073, fffff8800c410568, fffff8800c40fdc0, fffff8800104367b} Probably caused by : mup.sys ( mup!MupCallSurrogatePrePost+eb ) Followup: MachineOwner --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* RDR_FILE_SYSTEM (27) If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined as follows: RDBSS_BUG_CHECK_CACHESUP = 0xca550000, RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000, RDBSS_BUG_CHECK_CLOSE = 0xc10e0000, RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000, Arguments: Arg1: 00000000baad0073 Arg2: fffff8800c410568 Arg3: fffff8800c40fdc0 Arg4: fffff8800104367b Debugging Details: ------------------ EXCEPTION_RECORD: fffff8800c410568 -- (.exr 0xfffff8800c410568) ExceptionAddress: fffff8800104367b (mup!MupCallSurrogatePrePost+0x00000000000000eb) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000018 Attempt to read from address 0000000000000018 CONTEXT: fffff8800c40fdc0 -- (.cxr 0xfffff8800c40fdc0;r) rax=0000000000000000 rbx=fffffa800cfa9570 rcx=00000000c0000016 rdx=00000000c0000016 rsi=fffffa800cfa9600 rdi=00000000c0000016 rip=fffff8800104367b rsp=fffff8800c4107a0 rbp=0000000000000100 r8=00000000c00000bb r9=0000000000000000 r10=fffff8800417eac0 r11=fffff8800c4107f8 r12=fffffa800cfa9620 r13=fffff8a005f9a230 r14=fffffa800cfa95b8 r15=00000000c0000016 iopl=0 nv up ei pl zr na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246 mup!MupCallSurrogatePrePost+0xeb: fffff880`0104367b 83781801 cmp dword ptr [rax+18h],1 ds:002b:00000000`00000018=???????? Last set context: rax=0000000000000000 rbx=fffffa800cfa9570 rcx=00000000c0000016 rdx=00000000c0000016 rsi=fffffa800cfa9600 rdi=00000000c0000016 rip=fffff8800104367b rsp=fffff8800c4107a0 rbp=0000000000000100 r8=00000000c00000bb r9=0000000000000000 r10=fffff8800417eac0 r11=fffff8800c4107f8 r12=fffffa800cfa9620 r13=fffff8a005f9a230 r14=fffffa800cfa95b8 r15=00000000c0000016 iopl=0 nv up ei pl zr na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246 mup!MupCallSurrogatePrePost+0xeb: fffff880`0104367b 83781801 cmp dword ptr [rax+18h],1 ds:002b:00000000`00000018=???????? Resetting default scope PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000018 READ_ADDRESS: 0000000000000018 FOLLOWUP_IP: mup!MupCallSurrogatePrePost+eb fffff880`0104367b 83781801 cmp dword ptr [rax+18h],1 FAULTING_IP: mup!MupCallSurrogatePrePost+eb fffff880`0104367b 83781801 cmp dword ptr [rax+18h],1 BUGCHECK_STR: 0x27 DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre LAST_CONTROL_TRANSFER: from fffff88001042113 to fffff8800104367b STACK_TEXT: fffff880`0c4107a0 fffff880`01042113 : fffffa80`0cfa9570 00000000`00000103 fffffa80`07642e40 00000000`00000000 : mup!MupCallSurrogatePrePost+0xeb fffff880`0c410800 fffff880`0103ba60 : fffffa80`0d37c010 00000000`00000004 fffffa80`07642e40 fffffa80`0cfa9570 : mup!MupStateMachine+0x103 fffff880`0c410850 fffff800`02c7fdc1 : fffffa80`0d37c12b fffff880`00000000 00000000`00000000 00000000`00000000 : mup!MupiUncProviderCompletion+0x94 fffff880`0c410890 fffff880`04164b91 : 00000000`c00000bb 00000000`00000001 fffffa80`0d37c010 00000000`00000000 : nt!IopfCompleteRequest+0x341 fffff880`0c410980 fffff880`04165905 : fffff880`0417e4a8 fffffa80`0d2fc010 00000000`c00000bb fffffa80`0d2fc010 : rdbss!RxCompleteRequestEx+0x301 fffff880`0c410a60 fffff880`04169682 : fffff880`0417e4a8 00000000`c00000bb fffffa80`0d2fc010 00000000`00000000 : rdbss!RxLowIoCompletionTail+0x125 fffff880`0c410aa0 fffff880`07406e95 : fffff880`0417e4a8 00000000`c00000bb 00000000`00000080 fffff800`02c3dbf1 : rdbss!RxLowIoCompletion+0x82 fffff880`0c410ae0 fffff880`0756a084 : fffff880`0417e4a8 00000000`00000080 fffff880`0417d110 fffffa80`00000001 : mrxsmb20!Smb2Fsctl_Finalize+0xc9 fffff880`0c410b10 fffff880`041631b1 : fffff880`0417e4a8 fffff880`0417e4a8 00000000`00000001 fffffa80`0d213b98 : mrxsmb!SmbCepFinalizeExchange+0x44 fffff880`0c410b40 fffff800`02f17236 : fffff880`0417e4a8 fffff880`0417e8f8 00000000`00000000 00000000`00000000 : rdbss!RxpWorkerThreadDispatcher+0x1a1 fffff880`0c410c00 fffff800`02c6d706 : fffff880`009f1180 fffffa80`0c698b50 fffff880`009fbfc0 fffff880`08ddab10 : nt!PspSystemThreadStartup+0x5a fffff880`0c410c40 00000000`00000000 : fffff880`0c411000 fffff880`0c40b000 fffff880`0c410830 00000000`00000000 : nt!KxStartSystemThread+0x16 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: mup!MupCallSurrogatePrePost+eb FOLLOWUP_NAME: MachineOwner MODULE_NAME: mup IMAGE_NAME: mup.sys DEBUG_FLR_IMAGE_TIMESTAMP: 54ac906b STACK_COMMAND: .cxr 0xfffff8800c40fdc0 ; kb FAILURE_BUCKET_ID: X64_0x27_mup!MupCallSurrogatePrePost+eb BUCKET_ID: X64_0x27_mup!MupCallSurrogatePrePost+eb ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:x64_0x27_mup!mupcallsurrogateprepost+eb FAILURE_ID_HASH: {7615ba45-1826-5d9c-782f-873529e53101} Followup: MachineOwner ---------