Page 1 of 1

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION

PostPosted: Thu Apr 23, 2015 4:42 pm
by admin
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: fffff98008406ff0, address trying to free
Arg2: fffff98008406ff4, address where bits are corrupted
Arg3: 00000000008d0004, (reserved)
Arg4: 0000000000000024, caller is freeing an address where bytes after the end
of the allocation have been overwritten


Enable the driver verifier
!verifier 0x80 fffff98008406ff0
Log of recent kernel pool Allocate and Free operations:

!thread
THREAD fffffa8009336a50 Cid 056c.0608 Teb: 000000007ef92000 Win32Thread:
0000000000000000 RUNNING on processor 0
IRP List:
fffff98004bdcee0: (0006,0118) Flags: 40060070 Mdl: 00000000
Not impersonating

!IRP fffff98004bdcee0 1
Irp is active with 1 stacks 3 is current (= 0xfffff98004bdd040)
No Mdl: System buffer=fffff98008406ff0: Thread fffffa8009336a50: Irp is
completed.
Flags = 40060070
ThreadListEntry.Flink = fffffa8009336e40
ThreadListEntry.Blink = fffffa8009336e40
IoStatus.Status = 00000000
IoStatus.Information = 00000008
RequestorMode = 00000001
Tail.Overlay.CurrentStackLocation = fffff98004bdd040
Tail.Overlay.OriginalFileObject = fffffa800933f950

dt _IO_STACK_LOCATION fffff98004bdd040
nt!_IO_STACK_LOCATION
+0x000 MajorFunction : ??
+0x001 MinorFunction : ??
+0x002 Flags : ??
+0x003 Control : ??
+0x008 Parameters : <unnamed-tag>
+0x028 DeviceObject : ????
+0x030 FileObject : ????
+0x038 CompletionRoutine : ????
+0x040 Context : ????
Memory read error fffff98004bdd080