Question
2542 views

BSOD error " DRIVER CORRUPTED EXPOOL, BAD POOL CALLER, SYSTEM THREAD EXCEPTION NOT HANDLED, and IRQL NOT LESS OR EQUAL."

MattMichalewicz asked on

Original Title: BSOD and Audio Issues.

Hello,

I updated to Windows 8.1 a little over a week ago and it has been giving me nothing but issues. Last weekend, I ran into a BSOD every time I restarted my computer. It would give me error messages like, DRIVER CORRUPTED EXPOOL, BAD POOL CALLER, SYSTEM THREAD EXCEPTION NOT HANDLED, and IRQL NOT LESS OR EQUAL. After countless attempts of restarting in Safe Mode and such, I finally got back into my laptop. There was an issue with the Bluetooth driver, so I updated it and the issue seemed to be solved. Then a few days ago, I restarted my laptop and I got two more BSODs. After that, I realized that when I plugged in my laptop into my HDTV with an HDMI cable, it would not recognize the TV as a playback device. I finally found that my Intel audio driver as having issues, so I updated it and it worked for the time being. Then today, I tried connecting it to the TV again and ran into the same issue. The driver from before was already updated, so I restarted my laptop and the BSOD happened again. The errors were the BAD POOL CALLER and DRIVER CORRUPTED EXPOOL. I've attached the DMP files for the crashes today, but unfortunately the others weren't in the folder. Any help would be appreciated. 

DMP Files:

https://onedrive.live.com/redir?resid=5FD56EBBEB275447!597&authkey=!AOHONxrNXrifpQY&ithint=file%2c.zip

3 people had this question

Abuse history


The answered status icon Answer
Patrick Barker replied on

Hi,

Two dumps, but one was corrupt.

The attached DMP file is of the BAD_POOL_CALLER (c2) bug check.


This indicates that the current thread is making a bad pool request.

BugCheck C2, {7, 1200, 0, ffffe0001ebf1290}

6: kd> !pool ffffe0001ebf1290
Pool page ffffe0001ebf1290 region is Unknown
 ffffe0001ebf1000 size:  250 previous size:    0  (Allocated)  @GM2
 ffffe0001ebf1250 size:   10 previous size:  250  (Free)       Free
 ffffe0001ebf1260 size:   20 previous size:   10  (Allocated)  NGLG

6: kd> !poolval ffffe0001ebf1290
Pool page ffffe0001ebf1290 region is Unknown

Validating Pool headers for pool page: ffffe0001ebf1290

Pool page [ ffffe0001ebf1000 ] is __inVALID.

Analyzing linked list...
[ ffffe0001ebf1260 --> ffffe0001ebf1470 (size = 0x210 bytes)]: Corrupt region

^^ Looks like we have a driver causing corruption.

6: kd> k
Child-SP          RetAddr           Call Site
ffffd000`259ad6e8 fffff801`1f8b442a nt!KeBugCheckEx
ffffd000`259ad6f0 fffff801`c2a82129 nt!ExFreePoolWithTag+0x114a
ffffd000`259ad7c0 00000000`00000004 ngvpn+0xc129
ffffd000`259ad7c8 fffff801`c2a83de8 0x4
ffffd000`259ad7d0 ffffe000`1ebf1398 ngvpn+0xdde8
ffffd000`259ad7d8 fffff801`c2a82c17 0xffffe000`1ebf1398
ffffd000`259ad7e0 ffffe000`1ef93cb0 ngvpn+0xcc17
ffffd000`259ad7e8 fffff801`c2a821a8 0xffffe000`1ef93cb0
ffffd000`259ad7f0 00000000`c00000e5 ngvpn+0xc1a8
ffffd000`259ad7f8 00000000`00000000 0xc00000e5

^^ Aventail VPN Adapter driver seems to be the culprit here, so please remove this software ASAP.

Regards,

Patrick

Debugger/Reverse Engineer.
1 person found this helpful

Abuse history


progress