Edit 1: Super busy couple of days, friend had to go to emergency room and I helped them get there (vehicle issues). I'll get to this very soon!
Edit 2: Updated additional steps taken, new BSOD info, and "!analyze -v" with Windows Debug. I am using Windows Storage spaces, so I think it's interesting that I'm getting errors after starting that recently since the debug mentioned "spaceport.sys" after I did the analysis. I also noticed that "SavService.exe" was mentioned, and I'm wondering if I should uninstall and reinstall Sophos Endpoint Security. Thoughts?
Edit 3: Added list of recent changes.
Starts below
So, I always tend to feel at a loss for BSODs which don't seem to point to a direct driver and something Microsoft related instead. Believe it or not, I'd done a lot of research over the years to try and narrow down possibilities on what could be causing the issue.
So I'm really looking for two things on this post. Possible sources for this problem and other ways I can better diagnose these things myself (even if it's just a really handy guide that you know of, I'm willing to read if I can find something decent and that -works- well!)
Anyway, this is the information
BSOD Information from Blue Screen Viewer
================================================== Dump File : 060616-40703-01.dmp Crash Time : 6/6/2016 9:12:56 PM Bug Check String : BAD_POOL_HEADER Bug Check Code : 0x00000019 Parameter 1 : 00000000`00000020 Parameter 2 : ffffe000`a3020000 Parameter 3 : ffffe000`a30202c0 Parameter 4 : 00000000`0c2c0000 Caused By Driver : ntoskrnl.exe Caused By Address : ntoskrnl.exe+142780 File Description : Product Name : Company : File Version : Processor : x64 Crash Address : ntoskrnl.exe+142780 Stack Address 1 : Stack Address 2 : Stack Address 3 : Computer Name : Full Path : C:\Windows\Minidump\060616-40703-01.dmp Processors Count : 6 Major Version : 15 Minor Version : 10586 Dump File Size : 280,556 Dump File Time : 6/6/2016 9:45:37 PM ================================================== ================================================== Dump File : 060516-21531-01.dmp Crash Time : 6/5/2016 9:15:06 PM Bug Check String : BAD_POOL_HEADER Bug Check Code : 0x00000019 Parameter 1 : 00000000`00000020 Parameter 2 : ffffe001`3cba1000 Parameter 3 : ffffe001`3cba12c0 Parameter 4 : 00000000`0c2c0000 Caused By Driver : ntoskrnl.exe Caused By Address : ntoskrnl.exe+142780 File Description : Product Name : Company : File Version : Processor : x64 Crash Address : ntoskrnl.exe+142780 Stack Address 1 : Stack Address 2 : Stack Address 3 : Computer Name : Full Path : C:\Windows\Minidump\060516-21531-01.dmp Processors Count : 6 Major Version : 15 Minor Version : 10586 Dump File Size : 280,500 Dump File Time : 6/5/2016 9:21:26 PM ================================================== ================================================== Dump File : 060316-22125-01.dmp Crash Time : 6/3/2016 9:17:31 PM Bug Check String : BAD_POOL_HEADER Bug Check Code : 0x00000019 Parameter 1 : 00000000`00000020 Parameter 2 : ffffe000`f96e9170 Parameter 3 : ffffe000`f96e9430 Parameter 4 : 00000000`0c2c0017 Caused By Driver : ntoskrnl.exe Caused By Address : ntoskrnl.exe+142780 File Description : Product Name : Company : File Version : Processor : x64 Crash Address : ntoskrnl.exe+142780 Stack Address 1 : Stack Address 2 : Stack Address 3 : Computer Name : Full Path : C:\Windows\Minidump\060316-22125-01.dmp Processors Count : 6 Major Version : 15 Minor Version : 10586 Dump File Size : 280,516 Dump File Time : 6/3/2016 9:39:07 PM ================================================== ================================================== Dump File : 060216-41609-01.dmp Crash Time : 6/2/2016 9:17:58 PM Bug Check String : BAD_POOL_HEADER Bug Check Code : 0x00000019 Parameter 1 : 00000000`00000020 Parameter 2 : ffffe000`7c726000 Parameter 3 : ffffe000`7c7262c0 Parameter 4 : 00000000`0c2c0000 Caused By Driver : ntoskrnl.exe Caused By Address : ntoskrnl.exe+142780 File Description : Product Name : Company : File Version : Processor : x64 Crash Address : ntoskrnl.exe+142780 Stack Address 1 : Stack Address 2 : Stack Address 3 : Computer Name : Full Path : C:\Windows\Minidump\060216-41609-01.dmp Processors Count : 6 Major Version : 15 Minor Version : 10586 Dump File Size : 280,636 Dump File Time : 6/2/2016 10:34:50 PM ================================================== ================================================== Dump File : 053116-22062-01.dmp Crash Time : 5/31/2016 9:17:09 PM Bug Check String : BAD_POOL_HEADER Bug Check Code : 0x00000019 Parameter 1 : 00000000`00000020 Parameter 2 : ffffe002`0f7e7000 Parameter 3 : ffffe002`0f7e72c0 Parameter 4 : 00000000`0c2c0000 Caused By Driver : ntoskrnl.exe Caused By Address : ntoskrnl.exe+142780 File Description : Product Name : Company : File Version : Processor : x64 Crash Address : ntoskrnl.exe+142780 Stack Address 1 : Stack Address 2 : Stack Address 3 : Computer Name : Full Path : C:\Windows\Minidump\053116-22062-01.dmp Processors Count : 6 Major Version : 15 Minor Version : 10586 Dump File Size : 280,588 Dump File Time : 5/31/2016 9:18:56 PM ================================================== ================================================== Dump File : 052716-40593-01.dmp Crash Time : 5/27/2016 9:12:58 PM Bug Check String : BAD_POOL_HEADER Bug Check Code : 0x00000019 Parameter 1 : 00000000`00000020 Parameter 2 : ffffe000`d630f000 Parameter 3 : ffffe000`d630f2c0 Parameter 4 : 00000000`0c2c0000 Caused By Driver : ntoskrnl.exe Caused By Address : ntoskrnl.exe+142780 File Description : Product Name : Company : File Version : Processor : x64 Crash Address : ntoskrnl.exe+142780 Stack Address 1 : Stack Address 2 : Stack Address 3 : Computer Name : Full Path : C:\Windows\Minidump\052716-40593-01.dmp Processors Count : 6 Major Version : 15 Minor Version : 10586 Dump File Size : 280,468 Dump File Time : 5/27/2016 9:49:21 PM ================================================== ================================================== Dump File : 052616-22187-01.dmp Crash Time : 5/26/2016 9:17:26 PM Bug Check String : BAD_POOL_HEADER Bug Check Code : 0x00000019 Parameter 1 : 00000000`00000020 Parameter 2 : ffffe000`ec94c140 Parameter 3 : ffffe000`ec94c400 Parameter 4 : 00000000`0c2c0005 Caused By Driver : ntoskrnl.exe Caused By Address : ntoskrnl.exe+142780 File Description : Product Name : Company : File Version : Processor : x64 Crash Address : ntoskrnl.exe+142780 Stack Address 1 : Stack Address 2 : Stack Address 3 : Computer Name : Full Path : C:\Windows\Minidump\052616-22187-01.dmp Processors Count : 6 Major Version : 15 Minor Version : 10586 Dump File Size : 280,564 Dump File Time : 5/26/2016 9:20:00 PM ================================================== ================================================== Dump File : 052516-22093-01.dmp Crash Time : 5/25/2016 9:30:58 PM Bug Check String : BAD_POOL_HEADER Bug Check Code : 0x00000019 Parameter 1 : 00000000`00000020 Parameter 2 : ffffe000`94bff000 Parameter 3 : ffffe000`94bff2c0 Parameter 4 : 00000000`0c2c0000 Caused By Driver : ntoskrnl.exe Caused By Address : ntoskrnl.exe+142780 File Description : Product Name : Company : File Version : Processor : x64 Crash Address : ntoskrnl.exe+142780 Stack Address 1 : Stack Address 2 : Stack Address 3 : Computer Name : Full Path : C:\Windows\Minidump\052516-22093-01.dmp Processors Count : 6 Major Version : 15 Minor Version : 10586 Dump File Size : 280,500 Dump File Time : 5/25/2016 9:36:24 PM ================================================== ================================================== Dump File : 051816-54859-01.dmp Crash Time : 5/18/2016 11:41:50 PM Bug Check String : CRITICAL_PROCESS_DIED Bug Check Code : 0x000000ef Parameter 1 : ffffe000`b6fdb840 Parameter 2 : 00000000`00000000 Parameter 3 : 00000000`00000000 Parameter 4 : 00000000`00000000 Caused By Driver : ntoskrnl.exe Caused By Address : ntoskrnl.exe+142780 File Description : Product Name : Company : File Version : Processor : x64 Crash Address : ntoskrnl.exe+142780 Stack Address 1 : Stack Address 2 : Stack Address 3 : Computer Name : Full Path : C:\Windows\Minidump\051816-54859-01.dmp Processors Count : 6 Major Version : 15 Minor Version : 10586 Dump File Size : 280,476 Dump File Time : 5/18/2016 11:44:24 PM ================================================== ================================================== Dump File : 051816-52671-01.dmp Crash Time : 5/18/2016 11:11:33 PM Bug Check String : KERNEL_DATA_INPAGE_ERROR Bug Check Code : 0x0000007a Parameter 1 : ffffc001`93929e90 Parameter 2 : ffffffff`c000000e Parameter 3 : 00000000`1b5d5860 Parameter 4 : fffff801`21cea250 Caused By Driver : portcls.sys Caused By Address : portcls.sys+2a250 File Description : Product Name : Company : File Version : Processor : x64 Crash Address : ntoskrnl.exe+142780 Stack Address 1 : Stack Address 2 : Stack Address 3 : Computer Name : Full Path : C:\Windows\Minidump\051816-52671-01.dmp Processors Count : 6 Major Version : 15 Minor Version : 10586 Dump File Size : 280,436 Dump File Time : 5/18/2016 11:30:29 PM ================================================== ================================================== Dump File : 050916-53156-01.dmp Crash Time : 5/9/2016 9:21:22 AM Bug Check String : CRITICAL_PROCESS_DIED Bug Check Code : 0x000000ef Parameter 1 : ffffe001`ff3e6840 Parameter 2 : 00000000`00000000 Parameter 3 : 00000000`00000000 Parameter 4 : 00000000`00000000 Caused By Driver : ntoskrnl.exe Caused By Address : ntoskrnl.exe+142760 File Description : Product Name : Company : File Version : Processor : x64 Crash Address : ntoskrnl.exe+142760 Stack Address 1 : Stack Address 2 : Stack Address 3 : Computer Name : Full Path : C:\Windows\Minidump\050916-53156-01.dmp Processors Count : 6 Major Version : 15 Minor Version : 10586 Dump File Size : 280,524 Dump File Time : 5/9/2016 9:23:41 AM ================================================== ================================================== Dump File : 042916-71359-01.dmp Crash Time : 4/29/2016 8:37:49 AM Bug Check String : CRITICAL_PROCESS_DIED Bug Check Code : 0x000000ef Parameter 1 : ffffe001`397ef840 Parameter 2 : 00000000`00000000 Parameter 3 : 00000000`00000000 Parameter 4 : 00000000`00000000 Caused By Driver : ntoskrnl.exe Caused By Address : ntoskrnl.exe+142760 File Description : Product Name : Company : File Version : Processor : x64 Crash Address : ntoskrnl.exe+142760 Stack Address 1 : Stack Address 2 : Stack Address 3 : Computer Name : Full Path : C:\Windows\Minidump\042916-71359-01.dmp Processors Count : 6 Major Version : 15 Minor Version : 10586 Dump File Size : 280,604 Dump File Time : 4/29/2016 8:45:25 AM ================================================== Things Tried thus far
- Updated Audio Drivers
- Ran "Windows Memory Diagnostic
- Ran "sfc /scannow"
- Ran "DISM /Online /Cleanup-Image /RestoreHealth"
- Tried to run the Driver Verifier, but was unable to boot into Windows after a restart. Disabled it, did not try to run in Safe Mode long term.
List of recent changes
- Imaged Partition OS from RAID 1 to SSD, deleted RAID OS and resized partitions
- Converted OS from using drive in RAID mode (on motherboard) to AHCI, registry edit. Turned off RAID setting on motherboard. Backed up data beforehand.
- Set up Windows Storage spaces and copied data back over, using Storage spaces to handle the "RAID 1" in order to be able to use the on board SATA controller. My research indicated that on board SATA controllers outperformed 3rd party add on controllers that were on the motherboard or PCIe SATA controllers. Thus RAID can stay off and still maintain data in RAID 1.
I've looked at this microsoft developer network article, but I don't really understand what I need to do (referring to "The internal pool links must be walked using the kernel debugger to figure out a possible cause of the problem."). Or I'd do it. What is that asking me to do? analyze it or something else?
I really appreciate any help you can offer with this. :)
System Hardware
AMD Phenom II X6 1090T Black Edition Processor at 3.2 GHz ASUS Motherboard Sabertooth 990FX R2.0 Asus ProArt 24" LED LCD Monitor - 16:10 - 6 ms PA248Q HP S2031 20-Inch Diagonal LCD Monitor - Black AHCI mode - Samsung 850 EVO 250GB 2.5-Inch SATA III Internal SSD (MZ-75E250B/AM) AHCI mode, 2 drives using Windows Storage Spaces, RAID 1 with ReFS - WD Red 2 TB NAS Hard Drive: 3.5 Inch, SATA III, 64 MB Cache - WD20EFRX 16 GB of RAM total, all sticks are Kingston, same model, and bought in pairs 1333 MHz, 4 sticks, 4 GB each, KVR1333D3N9K2/8G (bought a set of two 4 GB sticks) Sapphire AMD Radeon HD 6770 1G GDDR5 PCI-E HDMI/DVI-I/DP ver 8.890.0.0, Catalyst 12.6, 2D Driver Version 8.01.01.1253, Direct3D Version 9.14.10.0920 OpenGL Version 6.14.10.11733, AMD Vision Control Center Version 2012.0611.1251.21046 0.12.020.000.058 ORICO USB 3.0 SuperSpeed Multi-Card Reader for SD/SDHC/SDXC/MS/CF/TF Cards ATAPI iHAS424 SATA Seasonic M12-11-750bronze SeaSonic M12II 750 SS-750AM2 750W ATX12V / EPS12V SLI Ready 80 PLUS BRONZE Certified Modular Active PFC Full-modular Power Supply New 4th Gen CPU Certified Haswell Ready Microsoft LifeCam VX-2000 Anker 7-Port USB 3.0 Hub H7928-U3 - 68UNHUB-B7U Saicoo USB3.0 4 Slots 11 in 1 Card Reader, with dual SD and Micro SD slots 3 External HDDs - WD MyBook Essential 4 TB - P/N WDBACW0030HBK-01 511D -Iomega 640 GB External HDD - P\N 31810100 - Model MMHDU -Rosewill RX35-AT-SU BLK Aluminum 3.5" Black SATA USB 2.0 External Enclosure -Barcode number 17182155041300542 --------------------------------------------------------------------------- Networked Devices --------------------------------------------------------------------------- Canon PRO-100 networked wired HP Photosmart 6510 Series Networked wireless Additional Information through "!analyze -v"
Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\MEMORY.DMP] Kernel Bitmap Dump File: Only kernel address space is available ************* Symbol Path validation summary ************** Response Time (ms) Location Deferred SRV*C:\Windows\symbol_cache* Symbol search path is: SRV*C:\Windows\symbol_cache* Executable search path is: Windows 8 Kernel Version 10586 MP (6 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 10586.306.amd64fre.th2_release_sec.160422-1850 Machine Name: Kernel base = 0xfffff802`d1c77000 PsLoadedModuleList = 0xfffff802`d1f55cd0 Debug session time: Mon Jun 6 21:12:56.104 2016 (UTC - 7:00) System Uptime: 0 days 23:51:55.902 Loading Kernel Symbols ............................................................... ................................................................ .............................................................. Loading User Symbols PEB is paged out (Peb.Ldr = 00000000`005ac018). Type ".hh dbgerr001" for details Loading unloaded module list ............................................. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 19, {20, ffffe000a3020000, ffffe000a30202c0, c2c0000} *** ERROR: Module load completed but symbols could not be loaded for SamsungRapidDiskFltr.sys *** ERROR: Module load completed but symbols could not be loaded for fltsrv.sys *** ERROR: Module load completed but symbols could not be loaded for snapman.sys Page 4d00 not present in the dump file. Type ".hh dbgerr004" for details Page 4d00 not present in the dump file. Type ".hh dbgerr004" for details Page 4d00 not present in the dump file. Type ".hh dbgerr004" for details Page 4d00 not present in the dump file. Type ".hh dbgerr004" for details Page 4d00 not present in the dump file. Type ".hh dbgerr004" for details Page 4d00 not present in the dump file. Type ".hh dbgerr004" for details Probably caused by : spaceport.sys ( spaceport!SpSpaceDeviceControl+80 ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BAD_POOL_HEADER (19) The pool is already corrupt at the time of the current request. This may or may not be due to the caller. The internal pool links must be walked to figure out a possible cause of the problem, and then special pool applied to the suspect tags or the driver verifier to a suspect driver. Arguments: Arg1: 0000000000000020, a pool block header size is corrupt. Arg2: ffffe000a3020000, The pool entry we were looking for within the page. Arg3: ffffe000a30202c0, The next pool entry. Arg4: 000000000c2c0000, (reserved) Debugging Details: ------------------ Page 4d00 not present in the dump file. Type ".hh dbgerr004" for details Page 4d00 not present in the dump file. Type ".hh dbgerr004" for details Page 4d00 not present in the dump file. Type ".hh dbgerr004" for details Page 4d00 not present in the dump file. Type ".hh dbgerr004" for details Page 4d00 not present in the dump file. Type ".hh dbgerr004" for details Page 4d00 not present in the dump file. Type ".hh dbgerr004" for details BUGCHECK_STR: 0x19_20 POOL_ADDRESS: unable to get nt!MmSpecialPoolStart unable to get nt!MmSpecialPoolEnd unable to get nt!MmPagedPoolEnd unable to get nt!MmNonPagedPoolStart unable to get nt!MmSizeOfNonPagedPoolInBytes ffffe000a3020000 DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT PROCESS_NAME: SavService.exe CURRENT_IRQL: 1 ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre IRP_ADDRESS: ffffe000f2240378 LAST_CONTROL_TRANSFER: from fffff802d1ea8deb to fffff802d1db9780 STACK_TEXT: ffffd000`2294be88 fffff802`d1ea8deb : 00000000`00000019 00000000`00000020 ffffe000`a3020000 ffffe000`a30202c0 : nt!KeBugCheckEx ffffd000`2294be90 fffff802`d1cf9e99 : ffffe000`a0f95080 fffff802`d1cf4b19 ffffe000`9f439520 00000000`20206f49 : nt!ExDeferredFreePool+0x63b ffffd000`2294bf70 fffff802`d1cf914c : ffffe000`f22403f0 00000000`00000050 00000028`00000001 00000001`00000000 : nt!IopCompleteRequest+0x79 ffffd000`2294c060 fffff801`7c104050 : fffff801`7d0e8f40 fffff802`d1cefd01 00000000`00000000 00000000`8000001a : nt!IopfCompleteRequest+0x40c ffffd000`2294c180 fffff801`7caf14a3 : ffffe000`a19d0de0 ffffe000`f22403f0 00000000`00000000 fffff801`7cf142dc : spaceport!SpSpaceDeviceControl+0x80 ffffd000`2294c1c0 fffff801`7cf13a6d : 00000000`00000000 ffffd000`2294c310 ffffe000`f22403f0 00000000`0004d004 : SamsungRapidDiskFltr+0x14a3 ffffd000`2294c210 fffff801`7cef16cf : 00000000`00000000 ffffe000`9ef57750 00000000`0004d004 ffffe000`9ef57828 : CLASSPNP!ClassDeviceControl+0x52d ffffd000`2294c380 fffff801`7cf18a73 : ffffe000`a2b6e060 00000000`00000001 ffffe000`a2a591b0 ffffe000`a2a59c60 : disk!DiskDeviceControl+0x8f ffffd000`2294c410 fffff801`7c0e4925 : ffffe000`f22403f0 ffffe000`a2a59c60 ffffd000`2294c590 00000000`00000000 : CLASSPNP!ClassDeviceControlDispatch+0x53 ffffd000`2294c440 fffff801`7c0d2935 : ffffe000`f2240300 00000000`00000000 00000000`00000000 ffffe000`f22403f0 : partmgr!PmIoctlRedirect+0x4d ffffd000`2294c4b0 fffff801`7ced548f : ffffe000`a2a59b10 ffffe000`f22403f0 ffffe000`f2240748 ffffe000`f2240748 : partmgr!PmFilterDeviceControl+0x2a5 ffffd000`2294c500 fffff801`7ced3eb8 : ffffe000`f22403f0 fffff801`7c0d1960 00000000`00000020 00000000`00000000 : fltsrv+0x548f ffffd000`2294c550 fffff801`7cdde1ac : ffffe000`9ea6ab80 00000000`00000030 ffffe000`a48e3010 ffffe000`f22403f0 : fltsrv+0x3eb8 ffffd000`2294c580 fffff801`7cde7848 : ffffe000`9ea6ab80 00000000`60000001 ffffe000`f6c2cbf0 fffff801`7cdcdaef : snapman+0x1e1ac ffffd000`2294c600 fffff801`7cdde694 : ffffe000`a1836560 fffff801`7cdecfe4 ffffe000`a1836560 fffff801`7cde6d39 : snapman+0x27848 ffffd000`2294c630 fffff801`7cde6f71 : 00000000`00005740 ffffe000`a2a59b10 ffffe000`a1836560 ffffe000`9ea6ab80 : snapman+0x1e694 ffffd000`2294c6b0 fffff801`7cded02a : ffffd000`2294d000 ffffe000`f22403f0 ffffd000`22947000 fffff801`7cdecfe4 : snapman+0x26f71 ffffd000`2294c740 fffff801`7ced4d20 : ffffe000`f2240748 fffff801`7cdecfe4 ffffe000`9ea6ab80 ffffd000`2294c7f0 : snapman+0x2d02a ffffd000`2294c7e0 fffff801`7ced3d24 : ffffe000`9fa07f30 ffffe000`f22403f0 ffffe000`f22403f0 ffffe000`f2240790 : fltsrv+0x4d20 ffffd000`2294c880 fffff802`d21481b2 : 00000000`00000000 ffffc001`3ec173c0 00000000`00000000 fffff802`d2079bf6 : fltsrv+0x3d24 ffffd000`2294c8b0 fffff802`d2147f8c : ffffe000`f22403f0 ffffd000`2294ccc0 ffffe000`a1415e40 fffff802`d1ceacc1 : nt!RawReadWriteDeviceControl+0x9e ffffd000`2294c8e0 fffff801`7bbf5842 : ffffe000`9df2c060 ffffe000`a36e9400 ffffe000`f22403f0 00000000`00000200 : nt!RawDispatch+0x78 ffffd000`2294c930 fffff802`d2079842 : ffffe000`a36e9400 ffffd000`2294ccc0 00000000`00000001 00000000`00000001 : FLTMGR!FltpDispatch+0xe2 ffffd000`2294c990 fffff802`d20786d6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x1162 ffffd000`2294cb60 fffff802`d1dc3fa3 : ffffc001`4fed9540 fffff802`d2035ced 00000000`06d1e848 ffffd000`2294ccc0 : nt!NtDeviceIoControlFile+0x56 ffffd000`2294cbd0 00000000`62f521bc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`06d1f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x62f521bc STACK_COMMAND: kb FOLLOWUP_IP: spaceport!SpSpaceDeviceControl+80 fffff801`7c104050 85db test ebx,ebx SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: spaceport!SpSpaceDeviceControl+80 FOLLOWUP_NAME: MachineOwner MODULE_NAME: spaceport IMAGE_NAME: spaceport.sys DEBUG_FLR_IMAGE_TIMESTAMP: 5632d745 BUCKET_ID_FUNC_OFFSET: 80 FAILURE_BUCKET_ID: 0x19_20_spaceport!SpSpaceDeviceControl BUCKET_ID: 0x19_20_spaceport!SpSpaceDeviceControl ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0x19_20_spaceport!spspacedevicecontrol FAILURE_ID_HASH: {856d5b8f-6bfc-cd5c-1543-fe1594ace9a5} Followup: MachineOwner --------- 2: kd> lmvm spaceport start end module name fffff801`7c100000 fffff801`7c186000 spaceport (pdb symbols) C:\ProgramData\dbg\sym\spaceport.pdb\2E1806EFBFDD44F793C355B32D6E0EFE1\spaceport.pdb Loaded symbol image file: spaceport.sys Image path: \SystemRoot\System32\drivers\spaceport.sys Image name: spaceport.sys Timestamp: Thu Oct 29 19:34:45 2015 (5632D745) CheckSum: 00083816 ImageSize: 00086000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 
