Como posso resolver o BSOD BAD_POOL_CALLER 0x000000C2?

Question

Problema

Um notebook cliente está recebendo uma tela azul da morte com o código 0000002c. Isso acontece quando o Windows XP é inicializado e tenta carregar a interface de boas-vindas.

O que eu fiz até agora

• Não é um problema de hardware, pois já testei HD (Ferramenta de Diagnóstico HD do Scan de Victoria, Fabricação (Samsung)), RAM (Memtest86 + 24hr) e CPU (stresstest) sem erros.
• Modo de segurança: BSOD 2c
• Reparo do Windows: BSOD 2c (durante a instalação de drivers)
• Utilizou o HD em um Notebook completamente diferente (chipset diferente), mesmo em ambiente virtual: BSOD 2c.
• Substitui todos os logonui.exe e ntkrpamp.exe pelo original.

Diagnóstico

• Se eu inicializar o Notebook com um Windows PE (CD de inicialização do Hirens 15.1) e quiser ver quais programas e drivers estão carregando na inicialização (autorun.exe da Sysinternals), estou obtendo o mesmo BSOD 2c no ambiente PE.

Eu posso fazer o upload do arquivo * .dmp do minidump mais recente, se solicitado.

Minidump

z:\TOOLS\windbg_6.12.0002.633_x86\debugger_x86>kd -y srv*c:\symbols*http://msdl.
microsoft.com/download/symbols -i c:\windows\i386 -z z:\TMP\User\Mini052512-07.
dmp

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [z:\TMP\User\Mini052512-07.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is: c:\windows\i386
Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp.080413-2111
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Fri May 25 18:48:44.218 2012 (UTC + 2:00)
System Uptime: 0 days 0:19:39.765
Loading Kernel Symbols
...............................................................
.................................................
Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {43, c68a4000, 0, 0}

Probably caused by : ntkrpamp.exe ( nt!CmpFree+17 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQ
L level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000043, Attempt to free a virtual address which was never in any pool
Arg2: c68a4000, Address being freed.
Arg3: 00000000, 0
Arg4: 00000000, 0

Debugging Details:
------------------


FAULTING_IP:
nt!CmpFree+17
8063beef 5d              pop     ebp

BUGCHECK_STR:  0xc2_43

CUSTOMER_CRASH_COUNT:  7

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

PROCESS_NAME:  setup.exe

LAST_CONTROL_TRANSFER:  from 80548c2d to 804f9f33

STACK_TEXT:
ba2979e4 80548c2d 000000c2 00000043 c68a4000 nt!KeBugCheckEx+0x1b
ba297a24 8054b49a c68a4000 e1cc3640 e1c97000 nt!MiFreePoolPages+0x8b
ba297a64 8063beef c68a4000 00000000 ba297ad0 nt!ExFreePoolWithTag+0x1ba
ba297a74 8063eaf6 c68a4000 00001000 00000000 nt!CmpFree+0x17
ba297ad0 8063eedb 9d308b60 00000000 00000000 nt!HvpRecoverData+0x3ec
ba297b1c 80630854 9d308b60 00000000 00000001 nt!HvMapHive+0x133
ba297b34 8063837f 9d308c01 00000005 00000000 nt!HvInitializeHive+0x416
ba297ba0 80625bcf ba297bdc 00000005 00000000 nt!CmpInitializeHive+0x26d
ba297bf8 8062ad61 ba297d04 00000000 ba297c64 nt!CmpInitHiveFromFile+0xa3
ba297c20 80631efa ba297ccc ba297c6c ba297c5c nt!CmpCmdHiveOpen+0x21
ba297cac 8062578a ba297ce4 ba297ccc 00000000 nt!CmLoadKey+0x90
ba297d40 80625994 0641a62c 0641a614 00000000 nt!NtLoadKey2+0x1fc
ba297d54 8054161c 0641a62c 0641a614 0641a658 nt!NtLoadKey+0x12
ba297d54 7c91e4f4 0641a62c 0641a614 0641a658 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0641a658 00000000 00000000 00000000 00000000 0x7c91e4f4


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!CmpFree+17
8063beef 5d              pop     ebp

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!CmpFree+17

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4802516a

FAILURE_BUCKET_ID:  0xc2_43_nt!CmpFree+17

BUCKET_ID:  0xc2_43_nt!CmpFree+17

Followup: MachineOwner
---------

0: kd>

Então, o que exatamente está causando o BSOD?

    

Answer 1

A chamada para HvpRecoverData sugere registro corrompido. Falha durante o processo de recuperação aponta para o arquivo log da seção danificado (de acordo com as origens do Kernel do Windows Research). Quando tive esse problema, a exclusão de todos os arquivos C:\Documents and Settings\<USERNAME>\NTUSER.DAT.LOG ajudou. Nenhum dado ou configuração do usuário foi perdido no processo no meu caso.