A client's Windows 2000 Server has done a BSOD every evening this week
(never before), and we've finally tracked it down to one of the 15 or
so terminal server sessions logging off at the end of his day. The
moment this clicks 'logoff' the server blue screens and reboots. It
does not occur with other users, and we also don't think it occurs if
he logs off earlier in the day: may try to confirm that on Monday.
Having done some searching it looks like I need the memory.dmp file
for use with the debugger, and I'm arranging that now.
The stop error is a 0000000BA, and it seems similar to KB907242 for
Windows 2003 server referring to a SESSION_HAS_VALID_POOL_ON_EXIT
error message, but I've not been able to get a hit with the 'valid
view on exit'.
Has any else already experienced this?
Jerome
Additional Information:
Below is result of using Windows Debugger to analyse the last crash on
Friday afternoon (I appreciate it is complaining about not using
correct symbols):
Jerome Monday Nov 3rd
2: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck
Analysis *
*
*
*******************************************************************************
SESSION_HAS_VALID_VIEWS_ON_EXIT (ba)
Caused by a session driver not unmapping its mapped views prior to a
session unload. This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 00000004, session ID
Arg2: 00000002, number of mapped views that are leaking
Arg3: e88855a8, address of this session's mapped views table
Arg4: 0000001f, size of this session's mapped views table.
Debugging Details:
------------------
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: kernel32!pNlsUserInfo
***
***
***
*************************************************************************
*************************************************************************
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your symbol path
***
*** must point to .pdb files that have full type information.
***
***
***
*** Certain .pdb files (such as the public OS symbols) do not
***
*** contain the required information. Contact the group that
***
*** provided you with these symbols if you need this command to
***
*** work.
***
***
***
*** Type referenced: kernel32!pNlsUserInfo
***
***
***
*************************************************************************
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
BUGCHECK_STR: 0xBA
PROCESS_NAME: CSRSS.EXE
LAST_CONTROL_TRANSFER: from 8044b8fe to 805375e3
STACK_TEXT:
bcd63950 8044b8fe 80486124 eb6ac018 00000000 nt!MiFreeSessionSpaceMap
+0x3d
bcd63b94 80537bf5 80486124 878f7d60 80441f05 nt!MiDereferenceSession
+0x29a
bcd63ba0 80441f05 00000000 87a47080 878f7d60 nt!MiSessionRemoveProcess
+0x41
bcd63c50 804e8582 8790f8c8 00000000 800655c0 nt!
MmCleanProcessAddressSpace+0x14f
bcd63d00 804e801c 00000000 87a47080 8043110a nt!PspExitThread+0x4e4
bcd63d0c 8043110a 8790f8c8 bcd63d48 bcd63d3c nt!PsExitSpecialApc+0x1a
bcd63d4c 804683f4 00000001 00000000 bcd63d64 nt!KiDeliverApc+0x19a
bcd63d4c 77f52565 00000001 00000000 bcd63d64 nt!KiServiceExit+0x59
00e9ffb4 7c57b3bc 00000000 00000000 00000000 GDI32!NtGdiGetSpoolMessage
+0xb
77f87fc0 4affc033 89257508 fff00c42 037d044a KERNEL32!BaseThreadStart
+0x52
WARNING: Frame IP not in any known module. Following frames may be
wrong.
77f87fcc 037d044a 520004c2 0073a3e8 c2c03300 0x4affc033
77f87fd0 520004c2 0073a3e8 c2c03300 a48d0004 0x37d044a
77f87fd4 0073a3e8 c2c03300 a48d0004 00000024 0x520004c2
77f87fd8 c2c03300 a48d0004 00000024 24a48d00 0x73a3e8
77f87fdc a48d0004 00000024 24a48d00 00000000 0xc2c03300
77f87fe0 00000000 24a48d00 00000000 044afff0 0xa48d0004
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiFreeSessionSpaceMap+3d
805375e3 8b4e20 mov ecx,dword ptr [esi+20h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiFreeSessionSpaceMap+3d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 45ec3c8f
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0xBA_nt!MiFreeSessionSpaceMap+3d
BUCKET_ID: 0xBA_nt!MiFreeSessionSpaceMap+3d
Followup: MachineOwner
