C:\Program Files\Debugging Tools for Windows>kd -y c:\windows\symbols -z c:\wind ows\MEMORY.DMP Microsoft (R) Windows Debugger Version 6.6.0007.5 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [c:\windows\MEMORY.DMP] Kernel Complete Dump File: Full address space is available Symbol search path is: c:\windows\symbols Executable search path is: Windows Server 2003 Kernel Version 3790 (Service Pack 2) UP Free x86 compatible Product: Server, suite: Enterprise TerminalServer Built by: 3790.srv03_sp2_rtm.070216-1710 Kernel base = 0x80800000 PsLoadedModuleList = 0x808a8e48 Debug session time: Fri Mar 23 07:20:43.796 2007 (GMT+1) System Uptime: 1 days 4:19:24.147 Loading Kernel Symbols ................................................................................ ............... Loading User Symbols Loading unloaded module list ... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck D1, {81, 2, 0, 8176e498} Probably caused by : ntoskrnl.exe ( nt!KiTrap0E+2a1 ) Followup: MachineOwner --------- kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: 00000081, memory referenced Arg2: 00000002, IRQL Arg3: 00000000, value 0 = read operation, 1 = write operation Arg4: 8176e498, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: 00000081 CURRENT_IRQL: 2 FAULTING_IP: +ffffffff8176e498 8176e498 0000 add byte ptr [eax],al DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0xD1 PROCESS_NAME: Idle TRAP_FRAME: 8089d53c -- (.trap ffffffff8089d53c) ErrCode = 00000000 eax=00000081 ebx=8176e48c ecx=8176f000 edx=ffdffa40 esi=817821a0 edi=ffdffa40 eip=8176e498 esp=8089d5b0 ebp=8089d5b0 iopl=0 nv up ei pl nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206 0008:8176e498 0000 add byte ptr [eax],al ds:0023:00000081=?? Resetting default scope LAST_CONTROL_TRANSFER: from 8176e498 to 80826653 STACK_TEXT: 8089d53c 8176e498 badb0d00 ffdffa40 8089fd80 nt!KiTrap0E+0x2a1 WARNING: Frame IP not in any known module. Following frames may be wrong. 8089d5ac 8089d600 80828a68 817821a0 8176f000 0x8176e498 8089d5b0 80828a68 817821a0 8176f000 00000000 nt!KiDoubleFaultStack+0x2d50 8089d600 80820bba 00000000 0000000e 00000000 nt!KiRetireDpcList+0xca 8089d604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x2f STACK_COMMAND: kb FOLLOWUP_IP: nt!KiTrap0E+2a1 80826653 833dc0828a8000 cmp dword ptr [nt!KiFreezeFlag (808a82c0)],0 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!KiTrap0E+2a1 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntoskrnl.exe DEBUG_FLR_IMAGE_TIMESTAMP: 45d6a072 FAILURE_BUCKET_ID: 0xD1_nt!KiTrap0E+2a1 BUCKET_ID: 0xD1_nt!KiTrap0E+2a1 Followup: MachineOwner --------- kd>