I was able to use the W2K debugging tools to examine the crash dump. It
appears the problem is with the services for Macintosh driver?? Here is
partial output from the debugger:
0: kd> !analyze -v
****************************************************************************
***
*
*
* Bugcheck Analysis
*
*
*
****************************************************************************
***
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bebce80e, The address that the exception occurred at
Arg3: 00000001, Parameter 0 of the exception
Arg4: 0000000c, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
sfmsrv!AfpHostPathFromDFEntry+14
bebce80e 668916 mov [esi],dx
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 0000000c
WRITE_ADDRESS: 0000000c
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x1E
EXCEPTION_RECORD: bed9fae8 -- (.exr ffffffffbed9fae8)
ExceptionAddress: bebce80e (sfmsrv!AfpHostPathFromDFEntry+0x00000014)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 0000000c
Attempt to write to address 0000000c
CONTEXT: bed9f740 -- (.cxr ffffffffbed9f740)
eax=00df31c0 ebx=00000000 ecx=0000001a edx=00000000 esi=0000000c
edi=0000001a
eip=bebce80e esp=bed9fbb0 ebp=bed9fc04 iopl=0 nv up ei pl zr na po
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
sfmsrv!AfpHostPathFromDFEntry+14:
bebce80e 668916 mov [esi],dx
ds:0023:0000000c=????
Resetting default context
LAST_CONTROL_TRANSFER: from bebcd8d0 to bebce80e
STACK_TEXT:
bed9fc04 bebcd8d0 00df31c0 0000001a 0000000c
sfmsrv!AfpHostPathFromDFEntry+0x14
bed9fc7c bebcd9f6 87a9a630 00002415 87a3232c
sfmsrv!AfpMapAfpPathForLookup+0xb0
bed9fd7c bebce7e7 bebcc078 bebc22d0 00000000
sfmsrv!AfpFspDispGetFileDirParms+0xb0
bed9fd84 bebc22d0 00000000 00000000 bed9fddc
sfmsrv!AfpStartApiProcessing+0x9
bed9fda8 80455a82 00000001 00000000 00000000 sfmsrv!AfpWorkerThread+0xc8
bed9fddc 8046b012 bebc2208 00000001 00000000 nt!PspSystemThreadStartup+0x54
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
FOLLOWUP_IP:
sfmsrv!AfpHostPathFromDFEntry+14
bebce80e 668916 mov [esi],dx
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: sfmsrv!AfpHostPathFromDFEntry+14
MODULE_NAME: sfmsrv
IMAGE_NAME: sfmsrv.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3d7d3a25
STACK_COMMAND: .cxr ffffffffbed9f740 ; kb
BUCKET_ID: 0x1E_W_sfmsrv!AfpHostPathFromDFEntry+14
Followup: MachineOwner
---------
Ken Simmons said:
Hi Jeff,
This is an exception error that we normally see with 3rd party drivers.
Have you added any new hardware or software? The best method to
troubleshoot blue screen errors is to save a memory.dmp and look at it in a
debugger.
Regards,
Ken Simmons
Microsoft Technical Support for Platforms and Business Applications
Jeff said:
I have a server running W2K Server with SP 4. Twice today it has rebooted
automatically after returning a STOP error. Below is the event log entry:
Event Type: Information
Event Source: Save Dump
Event Category: None
Event ID: 1001
Date: 1/20/2004
Time: 9:40:16 AM
User: N/A
Computer:
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e
(0xc0000005, 0xbeb8580e, 0x00000001, 0x0000000c). Microsoft Windows 2000
[v15.2195]. A dump was saved in: C:\WINNT\MEMORY.DMP.
Here is a section of the dumpchk.exe analysis of the dump as well:
BugCheckCode . . . . .0x0000001e
BugCheckParameter1 . .0xc0000005
BugCheckParameter2 . .0xbeb8580e
BugCheckParameter3 . .0x00000001
BugCheckParameter4 . .0x0000000c
ExceptionCode. . . . .0x80000003
ExceptionFlags . . . .0x00000001
ExceptionAddress . . .0x80455a28
Does anyone know the best way to troubleshoot this? I've combed the
knowledgebase but there are many, many causes of the 0x0000001e error.
Thanks,
Jeff
