SBOD when creating a network share (Win2003)

[Guest Sven Huijbrechts]

Hi,

 

I'm having a particular issue on a Windows Server 2003 std (SP2, fully

patched)

 

When trying to create a new networkshare (both GUI and command line), I get

a BSOD with this info:

 

Error code 1000008e, parameter1 c0000005, parameter2 808b49d1, parameter3

f6ceea84, parameter4 00000000.

 

BugCheck 1000008E, {c0000005, 808b49d1, f7e9eaa4, 0}

Probably caused by : ntkrnlpa.exe ( nt!HvpGetCellMapped+97 )

Followup: MachineOwner

 

 

Already checked:

- updated all drivers

- disabled network

- un/re-installed NIC

- shares created in the past are working normally

 

 

 

 

Extended Bugcheck:

*******************************************************************************

*

*

* Bugcheck Analysis

*

*

*

*******************************************************************************

 

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c0000005, The exception code that was not handled

Arg2: 808b49d1, The address that the exception occurred at

Arg3: f7e9eaa4, Trap Frame

Arg4: 00000000

 

Debugging Details:

------------------

 

 

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"

referenced

memory at "0x%08lx". The memory could not be "%s".

 

FAULTING_IP:

nt!HvpGetCellMapped+97

808b49d1 8b4604 mov eax,dword ptr [esi+4]

 

TRAP_FRAME: f7e9eaa4 -- (.trap 0xfffffffff7e9eaa4)

ErrCode = 00000000

eax=e101f000 ebx=e101c008 ecx=00000008 edx=81fd24e8 esi=00001f60

edi=00000000

eip=808b49d1 esp=f7e9eb18 ebp=f7e9eb8c iopl=0 nv up ei pl nz na pe

nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000

efl=00010206

nt!HvpGetCellMapped+0x97:

808b49d1 8b4604 mov eax,dword ptr [esi+4]

ds:0023:00001f64=????????

 

Resetting default scope

 

CUSTOMER_CRASH_COUNT: 3

 

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

 

BUGCHECK_STR: 0x8E

 

CURRENT_IRQL: 0

 

LAST_CONTROL_TRANSFER: from 808cdee6 to 808b49d1

 

STACK_TEXT:

f7e9eb8c 808cdee6 e101c008 011f60f0 f7e9ec78 nt!HvpGetCellMapped+0x97

f7e9ebb0 808ce064 e1395a30 e178405c 00000000 nt!CmpGetValueKeyFromCache+0xa4

f7e9ec20 808bb707 e1395a30 f7e9ecb0 f7e9ec74

nt!CmpFindValueByNameFromCache+0xa0

 

f7e9eca4 808b3ab2 e1395a30 00140012 015800c8 nt!CmQueryValueKey+0x23b

f7e9ed44 80883908 000009c8 0130fca4 00000001 nt!NtQueryValueKey+0x29a

f7e9ed44 7c8285ec 000009c8 0130fca4 00000001 nt!KiFastCallEntry+0xf8

WARNING: Frame IP not in any known module. Following frames may be wrong.

0130fcc0 00000000 00000000 00000000 00000000 0x7c8285ec

 

 

STACK_COMMAND: kb

 

FOLLOWUP_IP:

nt!HvpGetCellMapped+97

808b49d1 8b4604 mov eax,dword ptr [esi+4]

 

SYMBOL_STACK_INDEX: 0

 

SYMBOL_NAME: nt!HvpGetCellMapped+97

 

FOLLOWUP_NAME: MachineOwner

 

MODULE_NAME: nt

 

IMAGE_NAME: ntkrnlpa.exe

 

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

 

FAILURE_BUCKET_ID: 0x8E_nt!HvpGetCellMapped+97

 

BUCKET_ID: 0x8E_nt!HvpGetCellMapped+97

 

Followup: MachineOwner