BAD_POOL_HEADER in rpcxdr.sys,...

[Kerem Gümrükcü]

Hi,

rebooting my sys, after some time it has run i got
a BS telling me a BAD_POOL_HEADER and some
extra information. I got this BPH always after logging
into my system so my first intention was that it must be
some driver loaded on demand. Over and over i got the
BS, just restarting and rebooting to see whether it will
go away or not (sure i know it does not!). Then i decided
to analyze the crash minidump and i found out that the
driver rpcxdr.sys renders my system useless. So i disabled
it but i need it since the complete Microsoft Services for Unix
(SFU) depend on that service!


The last action i did was to install the complete Windows
Live suite. Thats what the last thing was i made. The
rpcxdr.sys is a very important core component of the SFU,
Microsoft Services for Unix, which are running on my system.
I had to disable this driver in order to make my system
able to run after logon, there was no ther way,...

So what could cause this problem and how to solve this.
I need the SFU,...no other way! I've never encountred
that problem before,..

Here is some extra info from KD and WinDbg:

BugCheck 19, {20, 84e3ec80, 84e3ed60, a1c000a}

MODULE_NAME: rpcxdr

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 3fab69a1

BUGCHECK_STR: 0x19_20

POOL_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
84e3ec80

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

LAST_CONTROL_TRANSFER: from 8054b941 to 8053354e

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
f7b8a9b0 8054b941 00000019 00000020 84e3ec80 nt+0x5c54e
f7b8aa00 8054b2b9 84e3ec88 00000000 f7b8aa48 nt+0x74941
f7b8aa10 f0bc6878 84e3ec88 804e3d38 00000000 nt+0x742b9
f7b8aa48 f1b5aad2 84d65298 84ce6e70 00000002 rpcxdr+0x1878
f7b8aa60 f1b60cc8 84e3eca8 00000000 00000000 tcpip+0x4ad2
f7b8aa74 f1b61ba5 84e3eca8 00000000 00000000 tcpip+0xacc8
f7b8aa94 f1b7247f 84ce6e70 f7b8ac54 00000000 tcpip+0xbba5
f7b8ab18 f1b57ef5 862ff378 0100007f 0100007f tcpip+0x1c47f
f7b8ab78 f1b57b19 00000020 862ff378 f1b5a076 tcpip+0x1ef5
f7b8abf4 f1b57836 f1b973f0 862ff378 f7b8ad10 tcpip+0x1b19
f7b8acac f1b6537e 862ff378 f7b8ad24 00000014 tcpip+0x1836
f7b8ad58 f79cb3e4 f1b97180 862ff378 f1b97190 tcpip+0xf37e
f7b8ad74 804e426b 862ff378 00000000 863c4b30 TDI+0x3e4
f7b8adac 8057d0f1 f1b97180 00000000 00000000 nt+0xd26b
f7b8addc 804f827a 804e4196 00000001 00000000 nt+0xa60f1
00000000 00000000 00000000 00000000 00000000 nt+0x2127a


STACK_COMMAND: kb

FOLLOWUP_IP:
rpcxdr+1878
f0bc6878 ?? ???

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: rpcxdr.sys

SYMBOL_NAME: rpcxdr+1878

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

kd> lmvm rpcxdr
start end module name
f0bc5000 f0bd2280 rpcxdr T (no symbols)
Loaded symbol image file: rpcxdr.sys
Image path: rpcxdr.sys
Image name: rpcxdr.sys
Timestamp: Fri Nov 07 10:45:05 2003 (3FAB69A1)
CheckSum: 000193CC
ImageSize: 0000D280
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
kd> lmvm nt
start end module name
804d7000 806ebe00 nt T (no symbols)
Loaded symbol image file: ntoskrnl.exe
Image path: ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Wed Feb 28 10:10:41 2007 (45E54711)
CheckSum: 002238BC
ImageSize: 00214E00
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0


Any ideas?


Regards

Kerem


---------
New Open Source Tools from me:
Calculate MD5 or SHA1 Hash for Files!
KHash Tools 1.0 Englisch:
http://download.chip.eu/de/KHash-Tools-1.0_1317168.html
http://entwicklung.junetz.de/projects/opensource/khashtools/khashtools%20v.1.0.zip
---------

Beste Grüsse / Best regards / Votre bien devoue

Kerem Gümrükcü
***@arcor.de

Best Quote: "Ain't nobody a badass with a double dose
of rock salt...", Kill Bill Vol.2

Microsoft Live Space: http://kerem-g.spaces.live.com/
Latest Open-Source Projects: http://entwicklung.junetz.de
Sign my guestbook: http://entwicklung.junetz.de/guestbook/

-----------------------
"This reply is provided as is, without warranty express or implied."

[Ashish]

Since the private symbols are not lined up, I cannot really tell if
this is the same problem I know of.
Anyways, please open a ticket with Microsoft PSS. That'll help you get
rid of this problem and if this turns out to be bug in rpcxdr or
nfsrdr, you'll get refund for this ticket.

- Ashish [MSFT

[Hossy]

I'm having the EXACT same BS happen with one of my users. Did PSS give you
any resolution?

Post by Kerem Gümrükcü
Hi,
rebooting my sys, after some time it has run i got
a BS telling me a BAD_POOL_HEADER and some
extra information. I got this BPH always after logging
into my system so my first intention was that it must be
some driver loaded on demand. Over and over i got the
BS, just restarting and rebooting to see whether it will
go away or not (sure i know it does not!). Then i decided
to analyze the crash minidump and i found out that the
driver rpcxdr.sys renders my system useless. So i disabled
it but i need it since the complete Microsoft Services for Unix
(SFU) depend on that service!
The last action i did was to install the complete Windows
Live suite. Thats what the last thing was i made. The
rpcxdr.sys is a very important core component of the SFU,
Microsoft Services for Unix, which are running on my system.
I had to disable this driver in order to make my system
able to run after logon, there was no ther way,...
So what could cause this problem and how to solve this.
I need the SFU,...no other way! I've never encountred
that problem before,..
BugCheck 19, {20, 84e3ec80, 84e3ed60, a1c000a}
MODULE_NAME: rpcxdr
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 3fab69a1
BUGCHECK_STR: 0x19_20
POOL_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
84e3ec80
CUSTOMER_CRASH_COUNT: 3
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
LAST_CONTROL_TRANSFER: from 8054b941 to 8053354e
WARNING: Stack unwind information not available. Following frames may be
wrong.
f7b8a9b0 8054b941 00000019 00000020 84e3ec80 nt+0x5c54e
f7b8aa00 8054b2b9 84e3ec88 00000000 f7b8aa48 nt+0x74941
f7b8aa10 f0bc6878 84e3ec88 804e3d38 00000000 nt+0x742b9
f7b8aa48 f1b5aad2 84d65298 84ce6e70 00000002 rpcxdr+0x1878
f7b8aa60 f1b60cc8 84e3eca8 00000000 00000000 tcpip+0x4ad2
f7b8aa74 f1b61ba5 84e3eca8 00000000 00000000 tcpip+0xacc8
f7b8aa94 f1b7247f 84ce6e70 f7b8ac54 00000000 tcpip+0xbba5
f7b8ab18 f1b57ef5 862ff378 0100007f 0100007f tcpip+0x1c47f
f7b8ab78 f1b57b19 00000020 862ff378 f1b5a076 tcpip+0x1ef5
f7b8abf4 f1b57836 f1b973f0 862ff378 f7b8ad10 tcpip+0x1b19
f7b8acac f1b6537e 862ff378 f7b8ad24 00000014 tcpip+0x1836
f7b8ad58 f79cb3e4 f1b97180 862ff378 f1b97190 tcpip+0xf37e
f7b8ad74 804e426b 862ff378 00000000 863c4b30 TDI+0x3e4
f7b8adac 8057d0f1 f1b97180 00000000 00000000 nt+0xd26b
f7b8addc 804f827a 804e4196 00000001 00000000 nt+0xa60f1
00000000 00000000 00000000 00000000 00000000 nt+0x2127a
STACK_COMMAND: kb
rpcxdr+1878
f0bc6878 ?? ???
SYMBOL_STACK_INDEX: 3
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: rpcxdr.sys
SYMBOL_NAME: rpcxdr+1878
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
kd> lmvm rpcxdr
start end module name
f0bc5000 f0bd2280 rpcxdr T (no symbols)
Loaded symbol image file: rpcxdr.sys
Image path: rpcxdr.sys
Image name: rpcxdr.sys
Timestamp: Fri Nov 07 10:45:05 2003 (3FAB69A1)
CheckSum: 000193CC
ImageSize: 0000D280
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
kd> lmvm nt
start end module name
804d7000 806ebe00 nt T (no symbols)
Loaded symbol image file: ntoskrnl.exe
Image path: ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Wed Feb 28 10:10:41 2007 (45E54711)
CheckSum: 002238BC
ImageSize: 00214E00
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
Any ideas?
Regards
Kerem
---------
Calculate MD5 or SHA1 Hash for Files!
http://download.chip.eu/de/KHash-Tools-1.0_1317168.html
http://entwicklung.junetz.de/projects/opensource/khashtools/khashtools%20v.1.0.zip
---------
Beste Grüsse / Best regards / Votre bien devoue
Kerem Gümrükcü
Best Quote: "Ain't nobody a badass with a double dose
of rock salt...", Kill Bill Vol.2
Microsoft Live Space: http://kerem-g.spaces.live.com/
Latest Open-Source Projects: http://entwicklung.junetz.de
Sign my guestbook: http://entwicklung.junetz.de/guestbook/
-----------------------
"This reply is provided as is, without warranty express or implied."

[Kerem Gümrükcü]

Hi Hossy,

if you read this please contact me: ***@arcor.de

Regards

Kerem

[Ashish]

Hi Hossy,

I am assuming that you and Kerem and running in to the same issue we
have recently fixed. Better part is that the official hot fix will be
created soon. Once that happens, I will update this post so that
everyone knows about it.

If this is really critical for you, let me know.

- Ashish
[MSFT]

[Keith]

I am having the same problem. I am consistantly getting this same BSOD every
time I try and install SFU. I get the BSOD when it states to "Staring
Services." If you could provide a pointer to a fix I would greatly
appreciate it.

Also, I guess since the installation never finishes is why when I still try
and use the applications that are left behind, I get a message that my
license has expired? Is there a way to get a license? Or, do I need to wait
until the installation can finish without BSOD?

Thanks,

Keith

Post by Kerem Gümrükcü
Hi Hossy,
I am assuming that you and Kerem and running in to the same issue we
have recently fixed. Better part is that the official hot fix will be
created soon. Once that happens, I will update this post so that
everyone knows about it.
If this is really critical for you, let me know.
- Ashish
[MSFT]

[Ashish]

Hello All,

To address this BSOD in rpcxdr.sys - you need to install one or both
from KB934326 (http://support.microsoft.com/kb/934326) and KB946226
(http://support.microsoft.com/kb/946226). In most of the case only
nfsrdr.sys is needed but if you are also running User Name Mapping or
Server for NFS on the same system, please also install the second hot
fix.

- Ashish