| Subject: BAD_POOL_HEADER (19) |
| Group: microsoft.public.winternals |
| Date: 1/9/2008 5:50:19 PM |
| From: Megan Kielman [Email Address Protection] |
All - I opened a crash dump in WinDbg and the !analyze -v showed the below. -------------------------------------------------------------------------- BAD_POOL_HEADER (19) The pool is already corrupt at the time of the current request. This may or may not be due to the caller. The internal pool links must be walked to figure out a possible cause of the problem, and then special pool applied to the suspect tags or the driver verifier to a suspect driver. Arguments: Arg1: 00000020, a pool block header size is corrupt. Arg2: 883b3760, The pool entry we were looking for within the page. Arg3: 883b37d0, The next pool entry. Arg4: 0a0e0019, (reserved) Debugging Details: ------------------ BUGCHECK_STR: 0x19_20 POOL_ADDRESS: 883b3760 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP PROCESS_NAME: System CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 8089c8ff to 8087c480 STACK_TEXT: f78f2ca4 8089c8ff 00000019 00000020 883b3760 nt!KeBugCheckEx+0x1b f78f2d0c 8089c26e 883b3768 00000000 f78f2d28 nt!ExFreePoolWithTag+0x477 f78f2d1c b88c50b5 883b3768 f78f2d3c b88bb205 nt!ExFreePool+0xf WARNING: Stack unwind information not available. Following frames may be wrong. f78f2d28 b88bb205 883b3768 883b3768 0000001a mfehidk01+0x170b5 f78f2d3c b88be25d 883b3768 0000001a b88d2b30 mfehidk01+0xd205 f78f2d60 b88be70f 89f968d0 808b711c b88d2ad0 mfehidk01+0x1025d f78f2d80 8082db08 00000000 00000000 89f968d0 mfehidk01+0x1070f f78f2dac 80920833 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb f78f2ddc 8083fe9f 8082da4b 00000001 00000000 nt!PspSystemThreadStartup+0x2e 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 STACK_COMMAND: kb FOLLOWUP_IP: mfehidk01+170b5 b88c50b5 ?? ??? SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: mfehidk01+170b5 FOLLOWUP_NAME: MachineOwner MODULE_NAME: mfehidk01 IMAGE_NAME: mfehidk01.sys DEBUG_FLR_IMAGE_TIMESTAMP: 469e3dea FAILURE_BUCKET_ID: 0x19_20_mfehidk01+170b5 BUCKET_ID: 0x19_20_mfehidk01+170b5 Followup: MachineOwner --------- ------------------------------------------------------------------ The analysis says to use Driver Verifier but I am not sure which drivers to apply it to. All of them? Does driver verifier have any risk of causing irreversible damage? It also mentions this: The internal pool links must be walked to figure out a possible cause of the problem, and then special pool applied to the suspect tags or the driver verifier to a suspect driver Do I use Driver Verifier to "walk the pool links" or is there another way to do this? |
| Back |
| Subject: Re: BAD_POOL_HEADER (19) |
| Group: microsoft.public.winternals |
| Date: 1/10/2008 12:47:32 AM |
| From: "Edwin vMierlo [MVP]" [Email Address Protection] |
> > The analysis says to use Driver Verifier but I am not sure which drivers > to apply it to. All of them? Does driver verifier have any risk of > causing irreversible damage? It also mentions this: Start with this one, as it is mentioned in your !analyze -v IMAGE_NAME: mfehidk01.sys |
| Back |
| Subject: Re: BAD_POOL_HEADER (19) |
| Group: microsoft.public.winternals |
| Date: 1/10/2008 9:26:38 AM |
| From: Megan Kielman [Email Address Protection] |
I was planning to start with that one but it doesn't exist. mfehidk.sys does. Do you know why it would list a driver that doesn't exist? If that doesn't turn out to be the problem what is the best method for moving forward? Edwin vMierlo [MVP] wrote: >> The analysis says to use Driver Verifier but I am not sure which drivers >> to apply it to. All of them? Does driver verifier have any risk of >> causing irreversible damage? It also mentions this: > > Start with this one, as it is mentioned in your !analyze -v > > IMAGE_NAME: mfehidk01.sys > > |
| Back |
| Subject: Re: BAD_POOL_HEADER (19) |
| Group: microsoft.public.winternals |
| Date: 1/20/2008 8:26:28 AM |
| From: "Gerry" [Email Address Protection] |
Megan 0x00000019: BAD_POOL_HEADER A pool header issue is a problem with Windows memory allocation. Device driver issues are probably the msot common, but this can have diverse causes including bad sectors or other disk write issues, and problems with some routers. (By theory, RAM problems would be suspect for memory pool issues, but I haven't been able to confirm this as a cause.) Uninstall and reinstall McAfee might be a solution. -- Hope this helps. Gerry ~~~~ FCA Stourport, England Enquire, plan and execute ~~~~~~~~~~~~~~~~~~~ Megan Kielman wrote: > I was planning to start with that one but it doesn't exist. > mfehidk.sys does. Do you know why it would list a driver that doesn't > exist? > If that doesn't turn out to be the problem what is the best method for > moving forward? > > Edwin vMierlo [MVP] wrote: >>> The analysis says to use Driver Verifier but I am not sure which >>> drivers to apply it to. All of them? Does driver verifier have any >>> risk of causing irreversible damage? It also mentions this: >> >> Start with this one, as it is mentioned in your !analyze -v >> >> IMAGE_NAME: mfehidk01.sys |
| Back |