DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffff9381035d6550, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff809c178c485, address which referenced memory
.....
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
ffff9381035d6550
[COLOR="#008000"]Hier wird zwar auf Speicherzugriffsfehler aufmerksam gemacht, aber das rührt
von den falschen Parametern des Netzwerktreibers her.[/COLOR]
......
[COLOR="#FF0000"]FAULTING_IP: NETIO!IndexListClassify+325[/COLOR] fffff809`c178c485 6641837f1807 cmp word ptr [r15+18h],7
PROCESS_NAME: svchost.exe
....
TRAP_FRAME: ffff9381025d61a0 -- (.trap 0xffff9381025d61a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc3839c90e8a0 rbx=0000000000000000 rcx=0000000000000000
rdx=ffff9381025d64e0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff809c178c485 rsp=ffff9381025d6330 rbp=0000000000000001
r8=ffff9381025d6870 r9=fffff809c17e1000 r10=ffffc3839dad5130
r11=ffff9381025d6538 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
[COLOR="#FF0000"]NETIO!IndexListClassify+0x325[/COLOR]: fffff809`c178c485 6641837f1807 cmp word ptr [r15+18h],7 ds:00000000`00000018=????
LAST_CONTROL_TRANSFER: from fffff80307f5e829 to fffff80307f536f0
STACK_TEXT:
ffff9381`025d6058 fffff803`07f5e829 : 00000000`0000000a ffff9381`035d6550 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffff9381`025d6060 fffff803`07f5ce07 : 00000000`00000000 00000000`0000ff02 00000000`00000000 ffffc383`9db441b0 : nt!KiBugCheckDispatch+0x69
ffff9381`025d61a0 fffff809`c178c485 : ffffc383`9c90e900 ffff9381`025d6b50 ffffc383`9b796de0 ffffc383`9bf3a030 : nt!KiPageFault+0x247
[COLOR="#FF0000"]ffff9381`025d6330 fffff809`c178b0fb : ffffc383`9dad5130 ffff9381`025d6870 00000000`00000000 ffff9381`025d6520 : NETIO!IndexListClassify+0x325[/COLOR]
[COLOR="#008000"]NETIO.sys will eine Liste im Speicher bearbeiten und verursacht ein PageFault (Seitenfehler)[/COLOR]
ffff9381`025d63c0 fffff809`c187cb1b : ffffc383`99449db0 ffffc383`99449e18 ffffc383`9949bb58 ffffc383`99449db0 : NETIO!KfdClassify+0x23b
ffff9381`025d6770 fffff809`c187c056 : ffffc383`9e09c040 00000000`00000000 00000000`00000ead 00000008`00000000 : tcpip!WfpAlepAuthorizeSend+0x77f
ffff9381`025d6ba0 fffff809`c183c407 : ffff9381`025d7000 fffff809`c1894464 00000000`00000003 fffff809`c1ab14cd : tcpip!WfpAleAuthorizeSend+0x386
[COLOR="#008000"]Da tcpip.sys die Netio.sys beauftragt hat, kann der Fehler durch diese oder den Treiber
des Netzwerk-Adapters verursacht worden sein.[/COLOR]
ffff9381`025d6f20 fffff809`c183b76e : 00000000`00000900 fffff809`c165494c fffff809`c165da01 ffffc383`9f1d0030 : tcpip!ProcessALEForTransportPacket+0x727
ffff9381`025d71f0 fffff809`c1853a95 : 00000000`025d7500 ffff9381`025d75b0 00000000`00000000 ffff9381`025d7543 : tcpip!WfpProcessOutTransportStackIndication+0x37e
ffff9381`025d7510 fffff809`c1852589 : ffff9381`025d7c30 ffff9381`025d7c30 ffffc383`9949ba78 fffff803`08055301 : tcpip!IppInspectLocalDatagramsOut+0x765
ffff9381`025d7820 fffff809`c1852154 : 00000000`00000006 fffff809`c1896504 fffff809`c19ef000 ffffc383`9ee82a50 : tcpip!IppSendDatagramsCommon+0x419
ffff9381`025d7aa0 fffff809`c1847abf : 00000000`00000000 ffffc383`981fdbed ffffc383`981f3500 ffffc383`981facd0 : tcpip!IpNlpSendDatagrams+0x44
ffff9381`025d7ae0 fffff809`c18466c3 : 00000000`00000000 ffff9381`025d84b0 ffffc383`9eb5dbb4 fffff809`c19ef000 : tcpip!UdpSendMessagesOnPathCreation+0x5ff
ffff9381`025d7f30 fffff809`c18464c5 : ffffc383`99486230 00000000`00000001 00000000`00000006 fffff809`c18464b0 : tcpip!UdpSendMessages+0x1f3
ffff9381`025d82f0 fffff803`07e97505 : ffff9381`025d84b0 ffff9381`025d83a0 00000000`00000006 fffff809`c39dff8f : tcpip!UdpTlProviderSendMessagesCalloutRoutine+0x15
ffff9381`025d8320 fffff809`c1893f9c : 00000000`00000000 00000000`00000000 ffffc383`9eb5d8e0 ffffc383`96e4d1a0 : nt!KeExpandKernelStackAndCalloutInternal+0x85
ffff9381`025d8370 fffff809`c39d9ec3 : ffffc383`9f0b47f0 ffff9381`025d8b80 ffffc383`9eb5d8e0 ffffc383`9eb5d8e0 : tcpip!UdpTlProviderSendMessages+0x6c
ffff9381`025d83f0 fffff809`c39c309d : ffffc383`9f0b47f0 ffff9381`025d86c0 0000004f`0000001e 0000004f`ad0fe600 : afd!AfdFastDatagramSend+0x543
ffff9381`025d8560 fffff803`082968c3 : ffffc383`00000000 ffffc383`964f3320 00000000`000120d3 ffff9381`025d8b80 : afd!AfdFastIoDeviceControl+0x15ed
ffff9381`025d88e0 fffff803`08296536 : c3839dbc`dde0f199 00000000`00000db4 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x383
ffff9381`025d8a20 fffff803`07f5e393 : 00000000`00000000 00000000`00000001 00000000`00000000 ffffdf60`00000000 : nt!NtDeviceIoControlFile+0x56
ffff9381`025d8a90 00007ff8`e9ab61b4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
0000004f`ad0fdec8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`e9ab61b4
....
FAILURE_BUCKET_ID: AV_NETIO!IndexListClassify
BUCKET_ID: AV_NETIO!IndexListClassify
ANALYSIS_SOURCE: KM
[COLOR="#FF0000"]FAILURE_ID_HASH_STRING: km:av_netio!indexlistclassify[/COLOR]
[COLOR="#008000"]Hier noch mal die Bestätigung durch den Debugger, dass die NETIO-Funktion den Fehler ausgelöst hat.[/COLOR]
....
[COLOR="#008000"]Die Abfrage der Datei NETIO.SYS hat gezeigt, dass sie aktuell ist.[/COLOR]
6: kd> lmvm NETIO
start end module name
fffff809`c1780000 fffff809`c17f9000 NETIO (pdb symbols) c:\symbols\netio.pdb\B937C2393EE242CF956DE315A593E0EF1\netio.pdb
Loaded symbol image file: NETIO.SYS
Mapped memory image file: c:\symbols\NETIO.SYS\57899B4079000\NETIO.SYS
Image path: \SystemRoot\system32\drivers\NETIO.SYS
Image name: NETIO.SYS
Timestamp: [COLOR="#FF0000"]Sat Jul 16 04:26:08 2016[/COLOR] (57899B40)
CheckSum: 00080657
ImageSize: 00079000
[COLOR="#FF0000"]File version: 10.0.14393.0
Product version: 10.0.14393.0[/COLOR]
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.6 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: netio.sys
OriginalFilename: netio.sys
ProductVersion: 10.0.14393.0
[COLOR="#FF0000"]FileVersion: 10.0.14393.0 (rs1_release.160715-1616)[/COLOR]
FileDescription: Network I/O Subsystem
LegalCopyright: © Microsoft Corporation. All rights reserved.
