1 Reply Latest reply on Feb 29, 2016 2:03 AM by Sandy_Intel

    Windows Blue Screen caused by e1000325.sys

    Lance0716

      I had a tool suffered BSoD issue recently. I used Windbg to analyze crash dump file. Windbg pointed out issue probaly caused by e1000325.sys (intel NIC driver), but I don't understand the detail message from Windbg. Could someone teach me how to read analysis result of windbg ?

      Thanks.

       

       

      *******************************************************************************

      *                                                                             *

      *                        Bugcheck Analysis                                    *

      *                                                                             *

      *******************************************************************************

       

      DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

      An attempt was made to access a pageable (or completely invalid) address at an

      interrupt request level (IRQL) that is too high.  This is usually

      caused by drivers using improper addresses.

      If kernel debugger is available get stack backtrace.

      Arguments:

      Arg1: 00ffdff9, memory referenced

      Arg2: 000000ff, IRQL

      Arg3: 00000001, value 0 = read operation, 1 = write operation

      Arg4: ffdff983, address which referenced memory

       

      Debugging Details:

      ------------------

       

      WRITE_ADDRESS:  00ffdff9

       

      CURRENT_IRQL:  ff

       

      FAULTING_IP:

      +2702faf00e2dfc4

      ffdff983 ff80f9dfff00    inc     dword ptr [eax+0FFDFF9h]

       

      DEFAULT_BUCKET_ID:  DRIVER_FAULT

       

      BUGCHECK_STR:  0xD1

       

      PROCESS_NAME:  Idle

       

      TRAP_FRAME:  805500f0 -- (.trap 0xffffffff805500f0)

      ErrCode = 00000002

      eax=00000000 ebx=80010031 ecx=ffdff980 edx=80010031 esi=badb0d00 edi=806f372a

      eip=ffdff983 esp=80550164 ebp=ffdff980 iopl=0         nv up di ng nz ac po cy

      cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010093

      ffdff983 ff80f9dfff00    inc     dword ptr [eax+0FFDFF9h] ds:0023:00ffdff9=????????

      Resetting default scope

       

      LAST_CONTROL_TRANSFER:  from ffdff983 to 804e187f

       

      STACK_TEXT:

      805500f0 ffdff983 badb0d00 80010031 86329394 nt!KiTrap0E+0x233

      WARNING: Frame IP not in any known module. Following frames may be wrong.

      80550160 806f372a badb0d00 80010031 86329380 0xffdff983

      80550174 f73a26a0 86329008 804da6ed 00000202 hal!HalProcessorIdle+0x2

      8055017c 804da6ed 00000202 804da6f6 00000000 e1000325+0x6a0

      80550184 804da6f6 00000000 f746ef2e 860f4930 nt!KeSynchronizeExecution+0x17

      8055018c f746ef2e 860f4930 f73a2694 80010031 nt!KeSynchronizeExecution+0x20

      805501ac 804dbbd4 80558e80 80558c20 ffdff000 NDIS!ndisMDpcX+0x62

      805501d0 804dbb37 00000000 0000000e 00000000 nt!KiRetireDpcList+0x46

      805501d4 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x10

       

       

      STACK_COMMAND:  kb

       

      FOLLOWUP_IP:

      e1000325+6a0

      f73a26a0 c20400          ret     4

       

      SYMBOL_STACK_INDEX:  3

       

      SYMBOL_NAME:  e1000325+6a0

       

      FOLLOWUP_NAME:  MachineOwner

       

      MODULE_NAME: e1000325

       

      IMAGE_NAME:  e1000325.sys

       

      DEBUG_FLR_IMAGE_TIMESTAMP:  4450f0b4

       

      FAILURE_BUCKET_ID:  0xD1_e1000325+6a0

       

      BUCKET_ID:  0xD1_e1000325+6a0

       

      Followup: MachineOwner

      ---------