BSOD: X64_0xD1_CODE_AV_BAD_IP_VBoxNetFlt+81fd

[Ryan Capp]

Loading Dump File [C:\Windows\Minidump\021010-32245-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols\*​http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (3 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16385.amd64fre.win7_rtm.090713-1255 Machine Name: Kernel base = 0xfffff80002e54000 PsLoadedModuleList = 0xfffff80003091e50 Debug session time: Wed Feb 10 03:25:26.678 2010 (GMT-5) System Uptime: 0 days 0:14:30.474 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ . Loading User Symbols Loading unloaded module list ...... *

• *
• Bugcheck Analysis *
• *

*

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff880640acfcf, 2, 8, fffff880640acfcf}

Unable to load image \SystemRoot\system32\DRIVERS\VBoxNetFlt.sys, Win32 error 0n2 * WARNING: Unable to verify timestamp for VBoxNetFlt.sys * ERROR: Module load completed but symbols could not be loaded for VBoxNetFlt.sys Probably caused by : VBoxNetFlt.sys ( VBoxNetFlt+81fd )

Followup: MachineOwner

---

2: kd> !analyze -v *

• *
• Bugcheck Analysis *
• *

*

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: fffff880640acfcf, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000008, value 0 = read operation, 1 = write operation Arg4: fffff880640acfcf, address which referenced memory

Debugging Details:

---

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030fc0e0

fffff880640acfcf

CURRENT_IRQL: 2

FAULTING_IP: +0 fffff880`640acfcf ?? ???

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

TRAP_FRAME: fffff8800318b770 -- (.trap 0xfffff8800318b770) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000028 rdx=0000000000000045 rsi=0000000000000000 rdi=0000000000000000 rip=fffff880640acfcf rsp=fffff8800318b908 rbp=fffffa8008ae7018

r8=0000000000000000 r9=0000000000000028 r10=0000000000000001

r11=fffffa800a8efc00 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc fffff880`640acfcf ?? ??? Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002ec5469 to fffff80002ec5f00

FAILED_INSTRUCTION_ADDRESS: +0 fffff880`640acfcf ?? ???

STACK_TEXT: fffff8800318b628 fffff80002ec5469 : 000000000000000a fffff880640acfcf 0000000000000002 0000000000000008 : ntKeBugCheckEx fffff8800318b630 fffff80002ec40e0 : fffffa8007c35000 fffffa800a8efd30 fffffa8008cdf7a0 fffffa80084141a0 : ntKiBugCheckDispatch+0x69 fffff8800318b770 fffff880640acfcf : fffff8800185c0cb 0000000000000000 0000000000000001 fffffa8007c51c58 : ntKiPageFault+0x260 fffff8800318b908 fffff8800185c0cb : 0000000000000000 0000000000000001 fffffa8007c51c58 ffff0000028ec970 : 0xfffff880`640acfcf fffff8800318b910 fffff8800185c426 : 0000000000000006 fffffa8007c60000 0000000000000000 0000000008cdf701 : tcpip!Ipv4pValidateNetBuffer+0x19b fffff8800318b970 fffff8800185b272 : fffffa8008cf0210 0000000000000000 fffffa8008cdf701 0000000000000001 : tcpipIpFlcReceivePackets+0x256 fffff8800318bb70 fffff880018746ba : fffffa8008cdf7a0 fffff8800318bca0 fffffa8008cdf7a0 0000000000000000 : tcpipFlpReceiveNonPreValidatedNetBufferListChain+0x2b2 fffff8800318bc50 fffff80002ed564a : fffffa800a8efc00 fffff88003187000 0000000000004800 0000000000000000 : tcpipFlReceiveNetBufferListChainCalloutRoutine+0xda fffff8800318bca0 fffff880018740e2 : fffff880018745e0 fffff8800318bdb0 fffff8800318c102 0000000000000001 : ntKeExpandKernelStackAndCalloutEx+0xda fffff8800318bd80 fffff880017060eb : fffffa8008cf0820 0000000000000000 fffffa80084141a0 fffff88001651afe : tcpipFlReceiveNetBufferListChain+0xb2 fffff8800318bdf0 fffff880016cffc6 : fffffa8000000000 0000000000000000 0000000000000000 0000000000000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb fffff8800318be60 fffff88001652a24 : fffffa80084141a0 0000000000000002 0000000000000001 0000000000000000 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6 fffff8800318c2e0 fffff880017068d5 : 0000000000000001 0000000000000000 fffffa80084141a0 0000000000000000 : ndis!ndisMTopReceiveNetBufferLists+0x24 fffff8800318c320 fffff880041681fd : 0000000000000000 0000000000000001 fffff88000000001 fffffa800a953a30 : ndis!ndisMIndicatePacketsToNetBufferLists+0x105 fffff8800318c3c0 0000000000000000 : 0000000000000001 fffff88000000001 fffffa800a953a30 0000000000000000 : VBoxNetFlt+0x81fd

STACK_COMMAND: kb

FOLLOWUP_IP: VBoxNetFlt+81fd fffff880`041681fd ?? ???

SYMBOL_STACK_INDEX: e

SYMBOL_NAME: VBoxNetFlt+81fd

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: VBoxNetFlt

IMAGE_NAME: VBoxNetFlt.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4b2a38e9

FAILURE_BUCKET_ID: X64_0xD1_CODE_AV_BAD_IP_VBoxNetFlt+81fd

BUCKET_ID: X64_0xD1_CODE_AV_BAD_IP_VBoxNetFlt+81fd

Followup: MachineOwner

---