hcmon.sys blue screen of death bugcheck

Computer_Guru · ‎03-25-2015

Hello,

The following as the BugCheck for a hcmon.sys blue screen of death, caught under the driver verifier.

Microsoft (R) Windows Debugger Version 6.2.9200.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*d:\websymbols\*http://msdl.microsoft.com/download/symbols;srv*D:\websymbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.22948.amd64fre.win7sp1_ldr.150202-1521
Machine Name:
Kernel base = 0xfffff800`0540f000 PsLoadedModuleList = 0xfffff800`05652890
Debug session time: Wed Mar 25 10:55:22.058 2015 (UTC - 5:00)
System Uptime: 0 days 0:00:52.901
Loading Kernel Symbols
...............................................................
................................................................
................................................................

Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffdf018).  Type ".hh dbgerr001" for details
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff98032aeafc0, 2, 1, fffff8000554f348}

*** ERROR: Module load completed but symbols could not be loaded for hcmon.sys
Probably caused by : hcmon.sys ( hcmon+6855 )

Followup: MachineOwner
---------

10: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff98032aeafc0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
     bit 0 : value 0 = read operation, 1 = write operation
     bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000554f348, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  fffff98032aeafc0 Special pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IoEnumerateDeviceObjectList+68
fffff800`0554f348 48895d00        mov     qword ptr [rbp],rbx

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  vmware-usbarbi

TRAP_FRAME:  fffff88009827550 -- (.trap 0xfffff88009827550)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000006 rbx=0000000000000000 rcx=fffffa80243950a0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000554f348 rsp=fffff880098276e0 rbp=fffff98032aeafc0
 r8=0000000000000000  r9=0000000000000000 r10=00000000019ff358
r11=fffff880098276b0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!IoEnumerateDeviceObjectList+0x68:
fffff800`0554f348 48895d00        mov     qword ptr [rbp],rbx ss:0018:fffff980`32aeafc0=3f3f3f3f3f3f3f3f
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80005482429 to fffff80005482e80

STACK_TEXT:  
fffff880`09827408 fffff800`05482429 : 00000000`0000000a fffff980`32aeafc0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`09827410 fffff800`054810a0 : 00000000`00000001 fffff880`098275d0 00000000`00000008 fffffa80`243950a0 : nt!KiBugCheckDispatch+0x69
fffff880`09827550 fffff800`0554f348 : fffffa80`243950a0 00000000`00000000 fffff980`32aeafc0 fffff880`09827780 : nt!KiPageFault+0x260
fffff880`098276e0 fffff880`07657855 : 00000000`00000000 fffff980`330eefa0 fffff980`32aeafc0 fffff800`057a15e7 : nt!IoEnumerateDeviceObjectList+0x68
fffff880`09827720 fffff880`07654f00 : fffffa80`00000008 fffff980`330eefa0 fffff980`330eefa0 fffff880`098277a8 : hcmon+0x6855
fffff880`09827780 fffff880`076554ec : 00000000`00000000 fffffa80`247c0670 00000000`0000002c 00000000`81012368 : hcmon+0x3f00
fffff880`098277f0 fffff800`0592ed46 : fffff980`33018ee0 00000000`00000054 fffffa80`25263a10 fffff980`33018ee0 : hcmon+0x44ec
fffff880`09827870 fffff800`057a15e7 : fffffa80`25263a10 fffff880`09827b60 fffffa80`25263a10 fffffa80`25399e70 : nt!IovCallDriver+0x566
fffff880`098278d0 fffff800`057a1e46 : 00000000`00000001 00000000`00000168 00000000`00000000 00000001`3f505c80 : nt!IopXxxControlFile+0x607
fffff880`09827a00 fffff800`05482113 : fffffa80`2551c110 fffff880`09827b60 fffff880`746c6644 fffff880`09827af8 : nt!NtDeviceIoControlFile+0x56
fffff880`09827a70 00000000`7793062a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`019ff358 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7793062a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
hcmon+6855
fffff880`07657855 3bc3            cmp     eax,ebx

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  hcmon+6855

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: hcmon

IMAGE_NAME:  hcmon.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  54ad58a5

FAILURE_BUCKET_ID:  X64_0xA_VRF_hcmon+6855

BUCKET_ID:  X64_0xA_VRF_hcmon+6855

Followup: MachineOwner
---------