PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff9600016d08a, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffff9600016d08a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000007, (reserved)
Debugging Details:
------------------
Page 73cf4e not present in the dump file. Type ".hh dbgerr004" for details
READ_ADDRESS: fffff9600016d08a
FAULTING_IP:
win32k!ClientGetMessageMPH+7a
fffff960`0016d08a 4889057f671a00 mov qword ptr [win32k!gptiCurrent (fffff960`00313810)],rax
MM_INTERNAL_CODE: 7
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 54ee9222
MODULE_NAME: win32k
FAULTING_MODULE: fffff96000020000 win32k
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: EXCEL.EXE
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
TRAP_FRAME: fffff8800b48b780 -- (.trap 0xfffff8800b48b780)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c2511c20 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff9600016d08a rsp=fffff8800b48b910 rbp=fffff8800b48bb60
r8=fffff80001857000 r9=0000000000000000 r10=fffffffffffffffb
r11=fffff8800b48b640 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
win32k!ClientGetMessageMPH+0x7a:
fffff960`0016d08a 4889057f671a00 mov qword ptr [win32k!gptiCurrent (fffff960`00313810)],rax ds:fffff960`00313810=0000000000000000
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800019497fb to fffff800018cbec0
FAILED_INSTRUCTION_ADDRESS:
win32k!ClientGetMessageMPH+7a
fffff960`0016d08a 4889057f671a00 mov qword ptr [win32k!gptiCurrent (fffff960`00313810)],rax
STACK_TEXT:
fffff880`0b48b618 fffff800`019497fb : 00000000`00000050 fffff960`0016d08a 00000000`00000008 fffff880`0b48b780 : nt!KeBugCheckEx
fffff880`0b48b620 fffff800`018c9fee : 00000000`00000008 fffff960`0016d08a fffff880`0b48b800 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x43781
fffff880`0b48b780 fffff960`0016d08a : 00000000`0000003f fffff880`0b48b948 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0b48b910 fffff960`000ecbbe : 00000000`00000000 00000000`00000000 00000000`000dfd20 fffffa80`2055c630 : win32k!ClientGetMessageMPH+0x7a
fffff880`0b48b9a0 fffff960`000e56bb : 00000000`72d62450 00000000`000debf0 00000000`000dfd20 00000000`7efdb001 : win32k!xxxInternalGetMessage+0x2e
fffff880`0b48b9e0 fffff800`018cb153 : fffffa80`2055c630 00000000`000de268 fffff880`0b48ba88 00000000`00000000 : win32k!NtUserPeekMessage+0x77
fffff880`0b48ba70 00000000`72c6fdea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000de248 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x72c6fdea
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!ClientGetMessageMPH+7a
fffff960`0016d08a 4889057f671a00 mov qword ptr [win32k!gptiCurrent (fffff960`00313810)],rax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: win32k!ClientGetMessageMPH+7a
FOLLOWUP_NAME: MachineOwner
IMAGE_VERSION: 6.1.7601.18773
FAILURE_BUCKET_ID: X64_0x50_BAD_IP_win32k!ClientGetMessageMPH+7a
BUCKET_ID: X64_0x50_BAD_IP_win32k!ClientGetMessageMPH+7a
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x50_bad_ip_win32k!clientgetmessagemph+7a
FAILURE_ID_HASH: {13bc5ab6-ddc4-07e6-772f-574750c4bf9f}
Followup: MachineOwner
---------
2: kd> lmvm win32k
start end module name
fffff960`00020000 fffff960`00343000 win32k (pdb symbols) c:\debugging tools\symbols\win32k.pdb\20ABC53752B64A2ABDB9DBC09B8A074D2\win32k.pdb
Loaded symbol image file: win32k.sys
Mapped memory image file: c:\debugging tools\symbols\win32k.sys\54EE9222323000\win32k.sys
Image path: \SystemRoot\System32\win32k.sys
Image name: win32k.sys
Timestamp: Thu Feb 26 04:25:22 2015 (54EE9222)
CheckSum: 0031B9BD
ImageSize: 00323000
File version: 6.1.7601.18773
Product version: 6.1.7601.18773
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: win32k.sys
OriginalFilename: win32k.sys
ProductVersion: 6.1.7601.18773
FileVersion: 6.1.7601.18773 (win7sp1_gdr.150225-1507)
FileDescription: Multi-User Win32 Driver
LegalCopyright: © Microsoft Corporation. All rights reserved.