Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a problem, VM server 2008 R2 SP1 , running citrix is randomly crhasing, in event log I found following:

The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff9600008744d, 0xfffff88007ba3de0, 0x0000000000000000)..

Any Idea what's causing it?
Here is results from debug:

here is info from Bugcehck: Bugcheck Analysis * * *

SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff9600008744d, Address of the instruction which caused the bugcheck Arg3: fffff88007ba3de0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero.

Debugging Details:

Page 125923 not present in the dump file. Type ".hh dbgerr004" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: win32k!xxxInternalInvalidate+7d fffff960`0008744d f6473208 test byte ptr [rdi+32h],8

CONTEXT: fffff88007ba3de0 -- (.cxr 0xfffff88007ba3de0) rax=0000000000000000 rbx=0000000000010485 rcx=0000000000000000 rdx=0000000000000b02 rsi=0000000000000000 rdi=0000000000000000 rip=fffff9600008744d rsp=fffff88007ba47c0 rbp=0000000000000000 r8=0000000000010485 r9=0000000000000000 r10=fffff900000004c0 r11=fffff900c26eac30 r12=0000000000000000 r13=0000000000000001 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246 win32k!xxxInternalInvalidate+0x7d: fffff9600008744d f6473208 test byte ptr [rdi+32h],8 ds:002b:0000000000000032=?? Resetting default scope



PROCESS_NAME: csrss.exe


LAST_CONTROL_TRANSFER: from fffff960001351a2 to fffff9600008744d

fffff88007ba47c0 fffff960001351a2 : 0000000000000000 0000000000000040 fffffa800678d330 0000000000000000 : win32k!xxxInternalInvalidate+0x7d fffff88007ba4840 fffff960001352a2 : fffffa800678d330 0000000000000000 fffff88007ba4ca0 fffffa8006109ab0 : win32k!xxxInternalUserChangeDisplaySettings+0x486 fffff88007ba4900 fffff960001330e3 : 0000000000000000 0000000000000000 fffff900c0f9ead0 fffff90000000040 : win32k!xxxUserChangeDisplaySettings+0x92 fffff88007ba49f0 fffff96000115cba : 0000000000000001 0000000000aff960 0000000000000000 ffffffffffffffff : win32k!xxxRemoteReconnect+0x6d7 fffff88007ba4bf0 fffff800016d9ed3 : fffffa8006f66b00 fffff88007ba4ca0 0000000000000000 0000000000000000 : win32k!NtUserCallOneParam+0x4e fffff88007ba4c20 000007fefd1b2aea : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13 0000000000aff918 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x000007fe`fd1b2aea

FOLLOWUP_IP: win32k!xxxInternalInvalidate+7d fffff960`0008744d f6473208 test byte ptr [rdi+32h],8


SYMBOL_NAME: win32k!xxxInternalInvalidate+7d



IMAGE_NAME: win32k.sys


STACK_COMMAND: .cxr 0xfffff88007ba3de0 ; kb

FAILURE_BUCKET_ID: X64_0x3B_win32k!xxxInternalInvalidate+7d

BUCKET_ID: X64_0x3B_win32k!xxxInternalInvalidate+7d

Followup: MachineOwner

share|improve this question

closed as not constructive by mdpc, Ward, Hauke Laging, Jacob, Jenny D Jun 4 '13 at 7:05

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

What diagnostic steps have you tried? (A memory test would be a good start on physical hardware - probably less so for a VM though.) There's really no possible way for us to tell you what's wrong from just that error code. Even Microsoft can't do that – voretaq7 Jun 3 '13 at 16:48
here is info from Bugcehck: – user176320 Jun 3 '13 at 18:47
you can't get root cause from the code but it gives you a direction. Off the top of my head ...0007b is a boot disk issue, this one (3b) is a system service error. – Jim B Jun 3 '13 at 18:53
Just a tip to the OP: Be careful about sending full dump files to someone else for debugging. They can contain passwords and other sensitive information that was resident in memory when the server crashed. – Ryan Ries Jun 3 '13 at 19:09

You'll have to debug the dump file to determine what happened. My wild guess is on a driver causing bad pages. This post HOW TO: Debug Memory Dumps (Figure out what is causing a BSOD) is a pretty good step by step guid to using dumpchk to see what caused the BSOD

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.