BSOD CLASSPNP.SYS SYSTEM_SERVICE_EXCEPTION (3b)

[tzachk]

Hi,

We develop an ERM solution to protect files and documents. As part of our application we have our own encrypting file system filter driver.

We just found out that when our product is used in conjunction with VMPlayer PRO (version 6,7), we get a BSOD from classpnp.sys.

Below you can fine the output of windbg !analyze -v

ADDITIONAL_DEBUG_TEXT: 
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

FAULTING_MODULE: fffff80002a65000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7929b

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
CLASSPNP+1198
fffff880`01801198 448b502c        mov     r10d,dword ptr [rax+2Ch]

CONTEXT:  fffff88006113020 -- (.cxr 0xfffff88006113020)
rax=0000000000000000 rbx=fffffa801932d8e0 rcx=0000000000000001
rdx=fffffa801afaa310 rsi=fffffa801910c4b0 rdi=fffffa801afaa428
rip=fffff88001801198 rsp=fffff88006113a00 rbp=fffffa801afaa310
r8=fffffa801932d790  r9=0000000000000200 r10=fffffa801932d8e0
r11=0000000000000000 r12=fffffa801afaa310 r13=fffffa801932f530
r14=0000000000000200 r15=fffffa801932f530
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
CLASSPNP+0x1198:
fffff880`01801198 448b502c        mov     r10d,dword ptr [rax+2Ch] ds:002b:00000000`0000002c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffffa80194e61a0 to fffff88001801198

STACK_TEXT: 
fffff880`06113a00 fffffa80`194e61a0 : fffff880`06113ab8 fffffa80`00000001 fffffa80`1b1f80c0 00000000`00000000 : CLASSPNP+0x1198
fffff880`06113a08 fffff880`06113ab8 : fffffa80`00000001 fffffa80`1b1f80c0 00000000`00000000 fffff880`01055052 : 0xfffffa80`194e61a0
fffff880`06113a10 fffffa80`00000001 : fffffa80`1b1f80c0 00000000`00000000 fffff880`01055052 fffffa80`194e61a0 : 0xfffff880`06113ab8
fffff880`06113a18 fffffa80`1b1f80c0 : 00000000`00000000 fffff880`01055052 fffffa80`194e61a0 fffffa80`1ad82a30 : 0xfffffa80`00000001
fffff880`06113a20 00000000`00000000 : fffff880`01055052 fffffa80`194e61a0 fffffa80`1ad82a30 fffffa80`1932f530 : 0xfffffa80`1b1f80c0

FOLLOWUP_IP:
CLASSPNP+1198
fffff880`01801198 448b502c        mov     r10d,dword ptr [rax+2Ch]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  CLASSPNP+1198

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: CLASSPNP

IMAGE_NAME:  CLASSPNP.SYS

STACK_COMMAND:  .cxr 0xfffff88006113020 ; kb

BUCKET_ID:  WRONG_SYMBOLS

Any idea on this issue?

Regards,

T.