1

I need some help with my Windbg output on our Win Server 2008 R2 Standard installation. It is our mission critical production server and it crashes every 2 months or so. It's done it a couple of times already. Logs say it might be a driver, but which? who crashed says:

On Tue 6/2/2015 2:36:19 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\060215-12854-01.dmp
This was probably caused by the following module: win32k.sys (win32k+0xC3B43) 
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF96000123B43, 0xFFFFF8800AF02EA0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\win32k.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Multi-User Win32 Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code. 
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time. 

windbg output:

*******************************************************************************
*                                                                                  *
*                        Bugcheck Analysis                                        *
*                                                                                 * 
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000123b43, Address of the instruction which caused the bugcheck
Arg3: fffff8800af02ea0, Address of the context record for the exception that      caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!HMAllocObject+43
fffff960`00123b43 488bbd58010000  mov     rdi,qword ptr [rbp+158h]

CONTEXT:  fffff8800af02ea0 -- (.cxr 0xfffff8800af02ea0;r)
rax=0000000000000000 rbx=0000000000000020 rcx=fffff96000319200
rdx=0000000000000000 rsi=0000000000008802 rdi=0000000000000000
rip=fffff96000123b43 rsp=fffff8800af03880 rbp=0000000000000000
 r8=0000000000000010  r9=0000000000000080 r10=0000000000000000
r11=fffffa801a87a420 r12=0000000000000000 r13=0000000000000000
r14=0000000000000080 r15=0000000000000010
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b                 efl=00010202
win32k!HMAllocObject+0x43:
fffff960`00123b43 488bbd58010000  mov     rdi,qword ptr [rbp+158h]     ss:0018:00000000`00000158=????????????????
Last set context:
rax=0000000000000000 rbx=0000000000000020 rcx=fffff96000319200
rdx=0000000000000000 rsi=0000000000008802 rdi=0000000000000000
rip=fffff96000123b43 rsp=fffff8800af03880 rbp=0000000000000000
 r8=0000000000000010  r9=0000000000000080 r10=0000000000000000
r11=fffffa801a87a420 r12=0000000000000000 r13=0000000000000000
r14=0000000000000080 r15=0000000000000010
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
win32k!HMAllocObject+0x43:
fffff960`00123b43 488bbd58010000  mov     rdi,qword ptr [rbp+158h] ss:0018:00000000`00000158=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT_SERVER

BUGCHECK_STR:  0x3B

PROCESS_NAME:  conhost.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) x86fre

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff96000123b43

STACK_TEXT:  
fffff880`0af03880 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!HMAllocObject+0x43


FOLLOWUP_IP: 
win32k!HMAllocObject+43
fffff960`00123b43 488bbd58010000  mov     rdi,qword ptr [rbp+158h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!HMAllocObject+43

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  54372ef1

IMAGE_VERSION:  6.1.7601.18635

STACK_COMMAND:  .cxr 0xfffff8800af02ea0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k!HMAllocObject+43

BUCKET_ID:  X64_0x3B_win32k!HMAllocObject+43

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x3b_win32k!hmallocobject+43

FAILURE_ID_HASH:  {9363ac24-db12-dd42-fe3b-b3a794764f0d}

Followup: MachineOwner
---------

I've uploaded the minidump file here in case someone wants to view it: https://onedrive.live.com/redir?resid=C5803CB16D4F7842!113&authkey=!ADrMX0cv07mIJpg&ithint=file%2cdmp

I also have the MEMORY.DMP file in case someone would require further information. Whenever I open it in windbg it looks the same as the minidump, is there a way to see more indepth information on it?

1

Stop error 0x3B when an application changes the z-order of a window in Windows 7 SP1 and Windows Server 2008 R2 SP1
https://support.microsoft.com/kb/2965768

  • The download link Microsoft sent me gave me a 500 internal server error and I couldn't find it in WSUS by searching by KB article number... any ideas? – j1ckj1ck Jun 9 '15 at 13:45
  • QFE hotfixes are not in Windows Update. You need to use the download link or call Microsoft. support.microsoft.com/en-us/hotfix/… – Greg Askew Jun 9 '15 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.