kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: 82edeb30, The address that the exception occurred at Arg3: 8b963978, Trap Frame Arg4: 00000000 Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: CLFS!CClfsBaseFilePersisted::PrivGetContainer+0 82edeb30 8b4158 mov eax,dword ptr [ecx+58h] TRAP_FRAME: 8b963978 -- (.trap 0xffffffff8b963978) ErrCode = 00000000 eax=006f0072 ebx=00000000 ecx=006f0072 edx=746c6644 esi=00000000 edi=c0000000 eip=82edeb30 esp=8b9639ec ebp=8b9639f0 iopl=0 nv up ei pl zr na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 CLFS!CClfsBaseFilePersisted::PrivGetContainer: 82edeb30 8b4158 mov eax,dword ptr [ecx+58h] ds:0023:006f00ca=???????? Resetting default scope DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT BUGCHECK_STR: 0x8E PROCESS_NAME: TransactionMan CURRENT_IRQL: 2 ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) x86fre LAST_CONTROL_TRANSFER: from 828f6f6f to 828928d8 STACK_TEXT: 8b962f2c 828f6f6f 00000003 abded18e 00000065 nt!RtlpBreakWithStatusInstruction 8b962f7c 828f7a6d 00000003 8b963380 00000000 nt!KiBugCheckDebugBreak+0x1c 8b963340 828f6e0c 0000008e c0000005 82edeb30 nt!KeBugCheck2+0x68b 8b963364 828cc56e 0000008e c0000005 82edeb30 nt!KeBugCheckEx+0x1e 8b963908 828564a6 8b963924 00000000 8b963978 nt!KiDispatchException+0x1ac 8b963970 8285645a 8b9639f0 82edeb30 badb0d00 nt!CommonDispatchException+0x4a 8b9639e8 82ed5cb1 8b963a28 829bf908 867209c0 nt!Kei386EoiHelper+0x192 8b9639f0 829bf908 867209c0 8b963a30 c0000000 CLFS!ClfsPrivGetBaseLogFileFromFileObjectPointer+0x21 8b963a28 829c1413 868853d8 8b963a99 abdec5ce nt!TmpIsClusteredTransactionManager+0x1f 8b963b3c 829b76b5 868853d8 abdec586 868853d8 nt!TmpCreateLogFile+0x199 8b963b74 829bf194 868853d8 00000000 868853d8 nt!TmpCreateOrOpenLogTransactionManager+0x24 8b963bb4 829c01d5 8b963bd4 00000000 abdec2e6 nt!TmInitializeTransactionManager+0x1d2 8b963c14 828558c6 0025f5c0 000f003f 0025f5c4 nt!NtCreateTransactionManager+0x155 8b963c14 77a570f4 0025f5c0 000f003f 0025f5c4 nt!KiSystemServicePostCall 0025f578 77a557b4 00b519ef 0025f5c0 000f003f ntdll!KiFastSystemCallRet 0025f57c 00b519ef 0025f5c0 000f003f 0025f5c4 ntdll!NtCreateTransactionManager+0xc WARNING: Stack unwind information not available. Following frames may be wrong. 0025f808 00b52170 00000001 00462038 004620b0 TransactionManagerTest+0x19ef 0025f850 76dbee1c 7ffdb000 0025f89c 77a737eb TransactionManagerTest+0x2170 0025f85c 77a737eb 7ffdb000 778f12e7 00000000 kernel32!BaseThreadInitThunk+0xe 0025f89c 77a737be 00b521ed 7ffdb000 00000000 ntdll!__RtlUserThreadStart+0x70 0025f8b4 00000000 00b521ed 7ffdb000 00000000 ntdll!_RtlUserThreadStart+0x1b STACK_COMMAND: kb FOLLOWUP_IP: CLFS!CClfsBaseFilePersisted::PrivGetContainer+0 82edeb30 8b4158 mov eax,dword ptr [ecx+58h] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: CLFS!CClfsBaseFilePersisted::PrivGetContainer+0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: CLFS IMAGE_NAME: CLFS.SYS DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bbf0e FAILURE_BUCKET_ID: 0x8E_CLFS!CClfsBaseFilePersisted::PrivGetContainer+0 BUCKET_ID: 0x8E_CLFS!CClfsBaseFilePersisted::PrivGetContainer+0 ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0x8e_clfs!cclfsbasefilepersisted::privgetcontainer+0 FAILURE_ID_HASH: {cf47799f-5107-43f4-1e7f-57a5b542ead0} Followup: MachineOwner ---------