W
Wolf
For about 2 months I've had random reboots. It's started shortly after I
upgraded to SP3 as well as to Norton Anti-virus 2008. I never get to see the
blue screen before it reboots, And had to download the debugger just to read
the dump files. I've upgraded the drivers, checked that everything was
seated. It doesn't matter what program it happens on, a game, just working
with files, etc. The one constant here, and I'm having trouble finding the
function in support is: FAILURE_BUCKET_ID:
0xA_W_nt!MiRestoreTransitionPte+6b. What does this call refer to? Physical
memory, hard drive, that sort of thing...
Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini061808-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Wed Jun 18 20:26:07.750 2008 (GMT-7)
System Uptime: 0 days 0:37:18.315
Loading Kernel Symbol
......................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {4f000010, 2, 1, 80514135}
Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )
Followup: MachineOwner
---------
kd> !analyze -
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 4f000010, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 4f000010
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135
STACK_TEXT:
bace3aac 8051ec6d e7aea080 ffffffff 8a612408 nt!MiRestoreTransitionPte+0x6b
bace3ac4 8051f21e 87c265c0 805126d5 8a612438 nt!MiRemovePageFromList+0xd1
bace3acc 805126d5 8a612438 000004c0 00000400 nt!MiRemoveAnyPage+0x56
bace3af8 80513210 00010000 87c26634 87c26650 nt!MiResolveMappedFileFault+0x3dd
bace3b3c 805133ca 00000000 ced10000 c0676880 nt!MiResolveProtoPteFault+0x18c
bace3bc0 8051cb1c e7aea080 ced10000 c0676880 nt!MiDispatchFault+0xe8
bace3c24 80517c78 00000000 ced10000 00000000 nt!MmAccessFault+0x7b4
bace3c80 804e0fe7 ced10000 00000000 80550118 nt!MmCheckCachedPageState+0x56c
bace3d2c 804e620f 8a7b9298 8055b0c0 8a7bb830 nt!CcPerformReadAhead+0x1f1
bace3d74 80534c02 8a7b9298 00000000 8a7bb830 nt!CcWorkerThread+0x147
bace3dac 805c6160 8a7b9298 00000000 00000000 nt!ExpWorkerThread+0x100
bace3ddc 80541dd2 80534b02 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiRestoreTransitionPte+6b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
Followup: MachineOwner
---------
kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
CheckSum: 00204E7E
ImageSize: 001F8580
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
Please note that I picked an older dump file, The parameters are almost the
same in each dump file. The executables in each dump are different, however.
The most current one:
Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini081608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Sat Aug 16 23:39:31.765 2008 (GMT-7)
System Uptime: 0 days 2:23:35.349
Loading Kernel Symbols
......................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {a080014, 2, 1, 80514135}
Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0a080014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 0a080014
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: WinRAR.exe
LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135
STACK_TEXT:
a9405810 8051ec6d 00000000 ffffffff 9da00000 nt!MiRestoreTransitionPte+0x6b
a9405828 8051f21e e7dc0c30 80518793 00000000 nt!MiRemovePageFromList+0xd1
a9405830 80518793 00000000 c2146000 00001000 nt!MiRemoveAnyPage+0x56
a9405924 804e2d61 c2146000 01d29450 00000000 nt!MmCopyToCachedPage+0x1f3
a94059b4 804e0d21 87c25c60 01d29450 a94059e8 nt!CcMapAndCopy+0x1a9
a9405a34 ba646846 87d2bdb8 2ec80ebc 00007ff0 nt!CcFastCopyWrite+0x211
a9405a9c ba6d5018 87d2bdb8 a9405b0c 00007ff0 Ntfs!NtfsCopyWriteA+0x23d
a9405ad0 ba6e0b99 00000004 00000000 a9405b04
fltmgr!FltpPerformFastIoCall+0x230
a9405b24 ba6c7a27 87d2bdb8 8783b9e0 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405b58 ba6d5018 87d2bdb8 8783b9e0 00007ff0 sr!SrFastIoWrite+0x77
a9405b8c ba6d51e4 00000004 00000000 8783b9d8
fltmgr!FltpPerformFastIoCall+0x230
a9405bb8 ba6e0c38 00405bd8 01d2430c 8a5eccc0 fltmgr!FltpPassThroughFastIo+0x78
a9405bf8 ba6d5018 87d2bdb8 a9405c68 00007ff0 fltmgr!FltpFastIoWrite+0x148
a9405c2c ba6e0b99 00000004 00000000 a9405c60
fltmgr!FltpPerformFastIoCall+0x230
a9405c80 8057256c 87d2bdb8 a9405cc4 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405d38 8053d638 000001f4 00000000 00000000 nt!NtWriteFile+0x324
a9405d38 7c90e4f4 000001f4 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
000eff78 00000000 00000000 00000000 00000000 0x7c90e4f4
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiRestoreTransitionPte+6b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
Followup: MachineOwner
---------
kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
CheckSum: 00204E7E
ImageSize: 001F8580
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
upgraded to SP3 as well as to Norton Anti-virus 2008. I never get to see the
blue screen before it reboots, And had to download the debugger just to read
the dump files. I've upgraded the drivers, checked that everything was
seated. It doesn't matter what program it happens on, a game, just working
with files, etc. The one constant here, and I'm having trouble finding the
function in support is: FAILURE_BUCKET_ID:
0xA_W_nt!MiRestoreTransitionPte+6b. What does this call refer to? Physical
memory, hard drive, that sort of thing...
Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini061808-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Wed Jun 18 20:26:07.750 2008 (GMT-7)
System Uptime: 0 days 0:37:18.315
Loading Kernel Symbol
......................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {4f000010, 2, 1, 80514135}
Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )
Followup: MachineOwner
---------
kd> !analyze -
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 4f000010, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 4f000010
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135
STACK_TEXT:
bace3aac 8051ec6d e7aea080 ffffffff 8a612408 nt!MiRestoreTransitionPte+0x6b
bace3ac4 8051f21e 87c265c0 805126d5 8a612438 nt!MiRemovePageFromList+0xd1
bace3acc 805126d5 8a612438 000004c0 00000400 nt!MiRemoveAnyPage+0x56
bace3af8 80513210 00010000 87c26634 87c26650 nt!MiResolveMappedFileFault+0x3dd
bace3b3c 805133ca 00000000 ced10000 c0676880 nt!MiResolveProtoPteFault+0x18c
bace3bc0 8051cb1c e7aea080 ced10000 c0676880 nt!MiDispatchFault+0xe8
bace3c24 80517c78 00000000 ced10000 00000000 nt!MmAccessFault+0x7b4
bace3c80 804e0fe7 ced10000 00000000 80550118 nt!MmCheckCachedPageState+0x56c
bace3d2c 804e620f 8a7b9298 8055b0c0 8a7bb830 nt!CcPerformReadAhead+0x1f1
bace3d74 80534c02 8a7b9298 00000000 8a7bb830 nt!CcWorkerThread+0x147
bace3dac 805c6160 8a7b9298 00000000 00000000 nt!ExpWorkerThread+0x100
bace3ddc 80541dd2 80534b02 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiRestoreTransitionPte+6b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
Followup: MachineOwner
---------
kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
CheckSum: 00204E7E
ImageSize: 001F8580
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
Please note that I picked an older dump file, The parameters are almost the
same in each dump file. The executables in each dump are different, however.
The most current one:
Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini081608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Sat Aug 16 23:39:31.765 2008 (GMT-7)
System Uptime: 0 days 2:23:35.349
Loading Kernel Symbols
......................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {a080014, 2, 1, 80514135}
Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0a080014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 0a080014
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: WinRAR.exe
LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135
STACK_TEXT:
a9405810 8051ec6d 00000000 ffffffff 9da00000 nt!MiRestoreTransitionPte+0x6b
a9405828 8051f21e e7dc0c30 80518793 00000000 nt!MiRemovePageFromList+0xd1
a9405830 80518793 00000000 c2146000 00001000 nt!MiRemoveAnyPage+0x56
a9405924 804e2d61 c2146000 01d29450 00000000 nt!MmCopyToCachedPage+0x1f3
a94059b4 804e0d21 87c25c60 01d29450 a94059e8 nt!CcMapAndCopy+0x1a9
a9405a34 ba646846 87d2bdb8 2ec80ebc 00007ff0 nt!CcFastCopyWrite+0x211
a9405a9c ba6d5018 87d2bdb8 a9405b0c 00007ff0 Ntfs!NtfsCopyWriteA+0x23d
a9405ad0 ba6e0b99 00000004 00000000 a9405b04
fltmgr!FltpPerformFastIoCall+0x230
a9405b24 ba6c7a27 87d2bdb8 8783b9e0 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405b58 ba6d5018 87d2bdb8 8783b9e0 00007ff0 sr!SrFastIoWrite+0x77
a9405b8c ba6d51e4 00000004 00000000 8783b9d8
fltmgr!FltpPerformFastIoCall+0x230
a9405bb8 ba6e0c38 00405bd8 01d2430c 8a5eccc0 fltmgr!FltpPassThroughFastIo+0x78
a9405bf8 ba6d5018 87d2bdb8 a9405c68 00007ff0 fltmgr!FltpFastIoWrite+0x148
a9405c2c ba6e0b99 00000004 00000000 a9405c60
fltmgr!FltpPerformFastIoCall+0x230
a9405c80 8057256c 87d2bdb8 a9405cc4 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405d38 8053d638 000001f4 00000000 00000000 nt!NtWriteFile+0x324
a9405d38 7c90e4f4 000001f4 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
000eff78 00000000 00000000 00000000 00000000 0x7c90e4f4
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiRestoreTransitionPte+6b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
Followup: MachineOwner
---------
kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
CheckSum: 00204E7E
ImageSize: 001F8580
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.