Problem - STOP 0x4E

[Bloke at the pennine puddle]

Before I start fully diagnosing the problem, and I've ruled out bad
RAM or other hardware failure, anyone seen this error before?

---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000002, A list entry was corrupt
Arg2: 0000e040, entry in list being removed
Arg3: 00027fef, highest physical page number
Arg4: 00000001, reference count of entry being removed

Debugging Details:
------------------

DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x4E
LAST_CONTROL_TRANSFER: from 80512b80 to 804f4103

STACK_TEXT:
f8c6ab00 80512b80 0000004e 00000002 0000e040 nt!KeBugCheckEx+0x19
f8c6ab28 8050d751 00000000 d1398000 82edb318 nt!MiUnlinkPageFromList+0x3e
f8c6ab50 80548138 d1398000 00000000 f8c6ad10 nt!MmCheckCachedPageState+0xd1
f8c6abe0 f88add24 82e8db90 00014107 00004000 nt!CcFastCopyRead+0x14c
f8c6ac3c f894418c 82e8db90 f8c6ad10 00004000 Ntfs!NtfsCopyReadA+0x1c0
f8c6ac64 f892cbb9 82e8db90 f8c6ad10 00004000 sr!SrFastIoRead+0x3e
WARNING: Stack unwind information not available. Following frames may be wrong.
f8c6ac8c 8055a11e 82e8db90 f8c6ad10 00004000 PQV2i+0x3bb9
f8c6ad38 8052d571 00000210 00000000 00000000 nt!NtReadFile+0x2b8
f8c6ad38 7ffe0304 00000210 00000000 00000000 nt!KiSystemService+0xc4
009fd4fc 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4

FOLLOWUP_IP:
PQV2i+3bb9
f892cbb9 ?? ???

FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: PQV2i+3bb9
MODULE_NAME: PQV2i
IMAGE_NAME: PQV2i.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3edd1027
STACK_COMMAND: kb
BUCKET_ID: 0x4E_PQV2i+3bb9

Followup: MachineOwner

804f40e3 f6ff idiv bh
804f40e5 ffc2 inc edx
804f40e7 0400 add al,0x0
804f40e9 cc int 3
nt!KeBugCheckEx:
804f40ea 55 push ebp
804f40eb 8bec mov ebp,esp
804f40ed 6a00 push 0x0
804f40ef ff7518 push dword ptr [ebp+0x18]
804f40f2 ff7514 push dword ptr [ebp+0x14]
804f40f5 ff7510 push dword ptr [ebp+0x10]
804f40f8 ff750c push dword ptr [ebp+0xc]
804f40fb ff7508 push dword ptr [ebp+0x8]
804f40fe e817f6ffff call nt!KeBugCheck2 (804f371a)
804f4103 5d pop ebp
804f4104 c21400 ret 0x14
804f4107 cc int 3
nt!KeClearTimer:
804f4108 8b442404 mov eax,[esp+0x4]
804f410c 83600400 and dword ptr [eax+0x4],0x0
804f4110 c20400 ret 0x4
804f4113 cc int 3
nt!KeCheckForTimer:
804f4114 55 push ebp
804f4115 8bec mov ebp,esp
804f4117 8b450c mov eax,[ebp+0xc]
804f411a 53 push ebx
804f411b 56 push es
---------

`PQV2i` refers to `PowerQuest Drive Image 7.0` and before anyone
entertains the idea, I paid cash for the program that I obtained in a
shop!

It caused Windows XP to give me the usual "Windows has recovered from
a critical" error dialogue on the next reboot.

The installed Windows XP Professional is fully patched up.

Anyone got any ideas?

 

[Rick \Nutcase\ Rogers]

Hi,

How have you determined that the ram is not faulty or incompatible? That
error message is an indicator that one condition or the other exists. Did
you run a hardware test? Or just one of the many software tests? Did you
swap in known-good sticks? Did you verify that the sticks are compatible
with your motherboard? Are you overclocking? If using multiple sticks, have
you tried selectively removing them to see if the error continues?

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x

Associate Expert - WinXP - Expert Zone

Before I start fully diagnosing the problem, and I've ruled out bad
RAM or other hardware failure, anyone seen this error before?

---------

kd> !analyze -v
****************************************************************************
***

*

*
* Bugcheck Analysis *

*

*****************************************************************************
***

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000002, A list entry was corrupt
Arg2: 0000e040, entry in list being removed
Arg3: 00027fef, highest physical page number
Arg4: 00000001, reference count of entry being removed

Debugging Details:
------------------

DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x4E
LAST_CONTROL_TRANSFER: from 80512b80 to 804f4103

STACK_TEXT:
f8c6ab00 80512b80 0000004e 00000002 0000e040 nt!KeBugCheckEx+0x19
f8c6ab28 8050d751 00000000 d1398000 82edb318 nt!MiUnlinkPageFromList+0x3e
f8c6ab50 80548138 d1398000 00000000 f8c6ad10 nt!MmCheckCachedPageState+0xd1
f8c6abe0 f88add24 82e8db90 00014107 00004000 nt!CcFastCopyRead+0x14c
f8c6ac3c f894418c 82e8db90 f8c6ad10 00004000 Ntfs!NtfsCopyReadA+0x1c0
f8c6ac64 f892cbb9 82e8db90 f8c6ad10 00004000 sr!SrFastIoRead+0x3e
WARNING: Stack unwind information not available. Following frames may be wrong.
f8c6ac8c 8055a11e 82e8db90 f8c6ad10 00004000 PQV2i+0x3bb9
f8c6ad38 8052d571 00000210 00000000 00000000 nt!NtReadFile+0x2b8
f8c6ad38 7ffe0304 00000210 00000000 00000000 nt!KiSystemService+0xc4
009fd4fc 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4

FOLLOWUP_IP:
PQV2i+3bb9
f892cbb9 ?? ???

FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: PQV2i+3bb9
MODULE_NAME: PQV2i
IMAGE_NAME: PQV2i.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3edd1027
STACK_COMMAND: kb
BUCKET_ID: 0x4E_PQV2i+3bb9

Followup: MachineOwner

804f40e3 f6ff idiv bh
804f40e5 ffc2 inc edx
804f40e7 0400 add al,0x0
804f40e9 cc int 3
nt!KeBugCheckEx:
804f40ea 55 push ebp
804f40eb 8bec mov ebp,esp
804f40ed 6a00 push 0x0
804f40ef ff7518 push dword ptr [ebp+0x18]
804f40f2 ff7514 push dword ptr [ebp+0x14]
804f40f5 ff7510 push dword ptr [ebp+0x10]
804f40f8 ff750c push dword ptr [ebp+0xc]
804f40fb ff7508 push dword ptr [ebp+0x8]
804f40fe e817f6ffff call nt!KeBugCheck2 (804f371a)
804f4103 5d pop ebp
804f4104 c21400 ret 0x14
804f4107 cc int 3
nt!KeClearTimer:
804f4108 8b442404 mov eax,[esp+0x4]
804f410c 83600400 and dword ptr [eax+0x4],0x0
804f4110 c20400 ret 0x4
804f4113 cc int 3
nt!KeCheckForTimer:
804f4114 55 push ebp
804f4115 8bec mov ebp,esp
804f4117 8b450c mov eax,[ebp+0xc]
804f411a 53 push ebx
804f411b 56 push es
---------

`PQV2i` refers to `PowerQuest Drive Image 7.0` and before anyone
entertains the idea, I paid cash for the program that I obtained in a
shop!

It caused Windows XP to give me the usual "Windows has recovered from
a critical" error dialogue on the next reboot.

The installed Windows XP Professional is fully patched up.

Anyone got any ideas?

 

[Rick \Nutcase\ Rogers]

Hi,

Ok, so you've covered the essentials - I had to ask, I'm sure you understand
why. Frankly though, nearly every single reference I have or can find still
points to a ram problem, so I really don't have a better answer. Tell me,
when precisely does this occur?

There are also the suggestions here:
http://support.microsoft.com/?kbid=291806

Have you tried any of them yet (I know it states Win2000, but the same
things can be applied to WinXP)?

Also, test results set aside, I'd still try selective removal of sticks.
I've seen stranger things.....

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x

Associate Expert - WinXP - Expert Zone

A intensive memory test tells me that thre RAM is not faulty. The
test even raised the processor's temparature from the usual 38 degrees
C to 42 degrees C!

The hardware checks out fine. I've got a nice collection of utilities
that does more than just theck to see if it's woking. Line intensive
tests of the DMA and IRQ controllers, etc... They do warm up the
computer as when the tests are running, if I put my hand by the PSU
fan then it's blowing warm air and not cold air.

The majority of the tests are ones that need exclusive access to the
hardware so I've got to boot the machine into MS-DOS.

The memory is correctly matched to the mainboard.

The CPU is not over-clocked. I don't believe in overclocking.

Again, on the last point, not necessary. With the test I've run I
even know the response times of the main system RAM, the second level
cache and also the first level cache on the processor itself.

One thing that some people miss is testing if all the PCI cards can
correctly share resources. I tested that too and that test passed.

the PSU is not a cheap OEM unit. It's supplying clean power and is
over-rated for the hardware I'm using. As in plenty of spare
capacity.

I could carry one going.

Rick, I know your intentions are well and thanks for the suggestions,
but I'm only trying to point out that I've done the works. Right down
from the basics of opening up the case, re-plugging and reseating all
the components in case it's actually mechanical stress as opposed to
an electronic's problem.

BTW, apologies for the odd e-mail address. It remains live until I
begin getting junk mail then assign another mailbox, and so the circle
turns. My profession is a application's programmer, system's
administrator and hardware/software diagnostics.

I'm performing frequent system state backups and if it happens again
then I've got another error to compare againt to see if DeiveImage has
caused the fault, if it's just the sequence all the programs loaded up
in, or if it's possibly a fault with Windows XP Pro itself.

Sheesh... Why do I always have to find the obscure faults.

Hi,

How have you determined that the ram is not faulty or incompatible? That
error message is an indicator that one condition or the other exists. Did
you run a hardware test? Or just one of the many software tests? Did you
swap in known-good sticks? Did you verify that the sticks are compatible
with your motherboard? Are you overclocking? If using multiple sticks, have
you tried selectively removing them to see if the error continues?

message

Before I start fully diagnosing the problem, and I've ruled out bad
RAM or other hardware failure, anyone seen this error before?

****************************************************************************

***
*
* Bugcheck Analysis *
*

****************************************************************************

***

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000002, A list entry was corrupt
Arg2: 0000e040, entry in list being removed
Arg3: 00027fef, highest physical page number
Arg4: 00000001, reference count of entry being removed

Debugging Details:
------------------

DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x4E
LAST_CONTROL_TRANSFER: from 80512b80 to 804f4103

STACK_TEXT:
f8c6ab00 80512b80 0000004e 00000002 0000e040 nt!KeBugCheckEx+0x19
f8c6ab28 8050d751 00000000 d1398000 82edb318 nt!MiUnlinkPageFromList+0x3e
f8c6ab50 80548138 d1398000 00000000 f8c6ad10 nt!MmCheckCachedPageState+0xd1
f8c6abe0 f88add24 82e8db90 00014107 00004000 nt!CcFastCopyRead+0x14c
f8c6ac3c f894418c 82e8db90 f8c6ad10 00004000 Ntfs!NtfsCopyReadA+0x1c0
f8c6ac64 f892cbb9 82e8db90 f8c6ad10 00004000 sr!SrFastIoRead+0x3e
WARNING: Stack unwind information not available. Following frames may

be

wrong.
f8c6ac8c 8055a11e 82e8db90 f8c6ad10 00004000 PQV2i+0x3bb9
f8c6ad38 8052d571 00000210 00000000 00000000 nt!NtReadFile+0x2b8
f8c6ad38 7ffe0304 00000210 00000000 00000000 nt!KiSystemService+0xc4
009fd4fc 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4

FOLLOWUP_IP:
PQV2i+3bb9
f892cbb9 ?? ???

FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: PQV2i+3bb9
MODULE_NAME: PQV2i
IMAGE_NAME: PQV2i.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3edd1027
STACK_COMMAND: kb
BUCKET_ID: 0x4E_PQV2i+3bb9

Followup: MachineOwner

804f40e3 f6ff idiv bh
804f40e5 ffc2 inc edx
804f40e7 0400 add al,0x0
804f40e9 cc int 3
nt!KeBugCheckEx:
804f40ea 55 push ebp
804f40eb 8bec mov ebp,esp
804f40ed 6a00 push 0x0
804f40ef ff7518 push dword ptr [ebp+0x18]
804f40f2 ff7514 push dword ptr [ebp+0x14]
804f40f5 ff7510 push dword ptr [ebp+0x10]
804f40f8 ff750c push dword ptr [ebp+0xc]
804f40fb ff7508 push dword ptr [ebp+0x8]
804f40fe e817f6ffff call nt!KeBugCheck2 (804f371a)
804f4103 5d pop ebp
804f4104 c21400 ret 0x14
804f4107 cc int 3
nt!KeClearTimer:
804f4108 8b442404 mov eax,[esp+0x4]
804f410c 83600400 and dword ptr [eax+0x4],0x0
804f4110 c20400 ret 0x4
804f4113 cc int 3
nt!KeCheckForTimer:
804f4114 55 push ebp
804f4115 8bec mov ebp,esp
804f4117 8b450c mov eax,[ebp+0xc]
804f411a 53 push ebx
804f411b 56 push es
---------

`PQV2i` refers to `PowerQuest Drive Image 7.0` and before anyone
entertains the idea, I paid cash for the program that I obtained in a
shop!

It caused Windows XP to give me the usual "Windows has recovered from
a critical" error dialogue on the next reboot.

The installed Windows XP Professional is fully patched up.

Anyone got any ideas?

 

[Bloke at the pennine puddle]

I understand, but I may have cured the problem by side stepping it.

I've since had another cradh that goven me a BSOD with the same error
and stop code. Also, the same module was indicated at fault by kd.

The BDOD occurred within 5 seconds of the `Press Ctrl-Alt-Del to
login` dialogue. Not always, sporadic, but always very soon after the
C-A-D dialogue appeared. My side-step solution was to uninstall
PowerQuest's Drive Image 7 program.

Now, let's see if the same or similar BSOD error appears again.

It it interesting that a it's presenting an error indocating a RAM
fault. If it was a RAM fault then I don't think there would be a
pattern to the crashes. It would be more random as not every software
component under Windows XP will always start at the same time.

Just for the record, the second crash dump analasis....

Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp2.030422-1633
Kernel base = 0x804d4000 PsLoadedModuleList = 0x80543530
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000002, A list entry was corrupt
Arg2: 0000dfd0, entry in list being removed
Arg3: 00027fef, highest physical page number
Arg4: 00000001, reference count of entry being removed

Debugging Details:
------------------
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x4E
LAST_CONTROL_TRANSFER: from 80512b80 to 804f4103

STACK_TEXT:
f7c53b00 80512b80 0000004e 00000002 0000dfd0 nt!KeBugCheckEx+0x19
f7c53b28 8050d751 00000000 d1818000 82e83bc8 nt!MiUnlinkPageFromList+0x3e
f7c53b50 80548138 d1818000 00000000 f7c53d10 nt!MmCheckCachedPageState+0xd1
f7c53be0 f88add24 82e16498 00014107 00004000 nt!CcFastCopyRead+0x14c
f7c53c3c f894418c 82e16498 f7c53d10 00004000 Ntfs!NtfsCopyReadA+0x1c0
f7c53c64 f892cbb9 82e16498 f7c53d10 00004000 sr!SrFastIoRead+0x3e
WARNING: Stack unwind information not available. Following frames may be wrong.
f7c53c8c 8055a11e 82e16498 f7c53d10 00004000 PQV2i+0x3bb9
f7c53d38 8052d571 00000208 00000000 00000000 nt!NtReadFile+0x2b8
f7c53d38 7ffe0304 00000208 00000000 00000000 nt!KiSystemService+0xc4
009fcfec 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4

FOLLOWUP_IP:
PQV2i+3bb9
f892cbb9 ?? ???

FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: PQV2i+3bb9
MODULE_NAME: PQV2i
IMAGE_NAME: PQV2i.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3edd1027
STACK_COMMAND: kb
BUCKET_ID: 0x4E_PQV2i+3bb9

Followup: MachineOwner
---------

It's the same image name as the first BSOD crash. Maybe, just maybe,
it's an initialisation fault within `PQV2i.sys`?

Think about it. If it was a RAM problem, and we all know NT is very
fussy about RAM, then my computer would be crashing randomly all over
the place. This is happening only during start-up and pretty soon
after I'm presented with the `Press C/A/D` dialogue.

Once Windows XP has booted up and started then it works fine.

 

[Rick \Nutcase\ Rogers]

Hmm, curious indeed. Please keep me posted on the results of disabling Drive
Image. The article I posted previously does indicate that some drive
utilities could be the problem.

Oh, and yes, I agree that if it were truely a ram problem, the crashes
generally would not have any pattern associated with them.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x

Associate Expert - WinXP - Expert Zone

 

[Bloke at the pennine puddle]

Well, totally related, but I'm going off gained experience.

Wher I work there is presently a NetWare 4.11 server and the boss's
laptop is running Windows 98-SE with Netware clien32 3.1.

A problem he had was that he could not create sertain files from only
Word 97 on the Novell server, jet every program worked fine. This
stumped me for a while as everything pointed to either Word 97,
Win98SE or the Netware client being at fault.

I messed with this for ages and finally, by accident, came across an
article that suggested it was ther Novell server that was at fault.

I finally located a patch and instaleld that directly on the Novell
server, which I presumed was working fine. That fixed the "Can't save
word documents that have spaced in the filename" problem!

A second problem on the Netware server was binding the IPX protocol so
a second NIC. There is a patch for the server, but the article
attached suggested only certain serialised Netware OS's of which the
one at work is not. I decided to install this patch even though the
advisory suggested that I should not. That's the second problem
permantly fixed.

Some problems are not that clear cut.

I assume you came to the conclusion because of the following KB
article:
http://support.microsoft.com/default.aspx?scid=kb;en-us;271955

The most helpful article was the following ...
http://support.microsoft.com/default.aspx?scid=kb;en-us;291806
.... of which I didn't follow in the exact order, even though the
article is for Windows 2000 and not Windows XP.

Finally there is an article I read which seems to make sense with this
one driver used by DriveImage shown as bring the culprit inn the
crash-dump file. That article is ....
http://msdn.microsoft.com/library/en-us/kmarch/hh/kmarch/k106_0l6a.asp
..... which the referencing article is ....
http://msdn.microsoft.com/library/en-us/ddtools/hh/ddtools/bccodes_97l3.asp

I have a feeling that whoever wrote that particular driver has missed
something out and introduced a bug, described below:

Bug Check 0x4E: PFN_LIST_CORRUPT
The PFN_LIST_CORRUPT bug check has a value of 0x0000004E.
This indicates that the page frame number (PFN) list is corrupt.

This error is typically caused by drivers passing bad memory
descriptor lists. For example, a driver might have called
MmUnlockPages twice with the same list. If a kernel debugger
is available, examine the stack trace.

I've just learnt never to accept the first diagnosis as abaolute and
to keep on digging.

Summary: It's still possible there is a hardware fault, but I dbout
it, but having DriveImage removed from the equation will show if it
was that, or if it is a hardware fault. The hardware fault is still
in question because once the computer has fully started, there are no
further problems. Only problems were at start-up.

Rick, thanks for the advise though. It did make me recheck a few
things. I will certainly let you know if booting DriveImage 7 has
cured the problem, or not. We shall see..... [=:

Still, spot where I found the hint to the problem! Not in the normal
KB pages but in MSDL!!! It's worth searching `support`, `msdl` and
`technet`. Takes more time, but could give better results.

 

[Bloke at the pennine puddle]

Hmm, curious indeed. Please keep me posted on the results of disabling Drive
Image. The article I posted previously does indicate that some drive
utilities could be the problem.

Oh, and yes, I agree that if it were truely a ram problem, the crashes
generally would not have any pattern associated with them.

You asked me to keep you informed.

Well, so far so good. Everything (touch wood) is runnins as sweet as
can be.