Dump of WudfSvc.dll error

[consumeraficionado]

I would appreciate assistance in interpreting this debug session and isolating fault. Svchost.exe is crashing on bootup.

Code: Select all

Loading Dump File [C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp]

Comment: 'Dr. Watson generated MiniDump'
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible

...........................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(55c.564): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=00000000 ecx=00000118 edx=0067d7a0 esi=0067d790 edi=00000000
eip=7c91b1fa esp=0066febc ebp=0066ff30 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!RtlpWaitForCriticalSection+0x8c:
7c91b1fa ff4010          inc     dword ptr [eax+10h]  ds:0023:00000010=????????
0:001> .reload
...........................
0:001>  !sym noisy
noisy mode - symbol prompts on
0:001> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

SYMSRV:  c:\symbols\WudfSvc.dll\451C7D3610000\WudfSvc.dll not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/WudfSvc.dll/451C7D3610000/WudfSvc.dll not found
DBGENG:  c:\WINDOWS\system32\WudfSvc.dll - Mapped image memory
DBGHELP: WudfSvc - public symbols 
         c:\symbols\WUDFSvc.pdb\7A257B1950044F66B3492F0B2F4D1BD41\WUDFSvc.pdb
DBGHELP: c:\symbols\svchost.exe\48025BC06000\svchost.exe - OK
DBGENG:  c:\symbols\svchost.exe\48025BC06000\svchost.exe - Mapped image memory
DBGHELP: svchost - public symbols 
         c:\symbols\svchost.pdb\A22ACFC8D5644DFBB8C4A0529E9146762\svchost.pdb
DBGHELP: c:\symbols\advapi32.dll\4802A0B29b000\advapi32.dll - OK
DBGENG:  c:\symbols\advapi32.dll\4802A0B29b000\advapi32.dll - Mapped image memory
DBGHELP: advapi32 - public symbols 
         c:\symbols\advapi32.pdb\5EFB9BF42CC64024AB64802E467394642\advapi32.pdb
DBGHELP: c:\symbols\kernel32.dll\4802A12Cf6000\kernel32.dll - OK
DBGENG:  c:\symbols\kernel32.dll\4802A12Cf6000\kernel32.dll - Mapped image memory
DBGHELP: kernel32 - public symbols 
         c:\symbols\kernel32.pdb\34560E80F5C54175B208848EF863C5BD2\kernel32.pdb
DBGHELP: c:\symbols\ole32.dll\4802A11113d000\ole32.dll - OK
DBGENG:  c:\symbols\ole32.dll\4802A11113d000\ole32.dll - Mapped image memory
DBGHELP: ole32 - public symbols 
         c:\symbols\ole32.pdb\ED517599D2C14CF19200861833059C142\ole32.pdb
DBGHELP: c:\symbols\user32.dll\4802A11B91000\user32.dll - OK
DBGENG:  c:\symbols\user32.dll\4802A11B91000\user32.dll - Mapped image memory
DBGHELP: user32 - public symbols 
         c:\symbols\user32.pdb\D18A41B74E7F458CAAAC1847E2D8BF022\user32.pdb
SYMSRV:  c:\symbols\WUDFPlatform.dll\451C7D382c000\WUDFPlatform.dll not found
SYMSRV:  http://msdl.microsoft.com/download/symbols/WUDFPlatform.dll/451C7D382c000/WUDFPlatform.dll not found
DBGENG:  c:\WINDOWS\system32\WUDFPlatform.dll - Mapped image memory
DBGHELP: WUDFPlatform - public symbols 
         c:\symbols\WUDFPlatform.pdb\70CF40185944435FBAF2831CEC633A8E1\WUDFPlatform.pdb
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************

FAULTING_IP:
ntdll!RtlpWaitForCriticalSection+8c
7c91b1fa ff4010          inc     dword ptr [eax+10h]

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7c91b1fa (ntdll!RtlpWaitForCriticalSection+0x0000008c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 00000010
Attempt to write to address 00000010

DEFAULT_BUCKET_ID:  STATUS_ACCESS_VIOLATION

PROCESS_NAME:  svchost.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

WRITE_ADDRESS:  00000010

CRITICAL_SECTION:  0067d790 -- (!cs -s 0067d790)

FAULTING_THREAD:  00000564

PRIMARY_PROBLEM_CLASS:  STATUS_ACCESS_VIOLATION

BUGCHECK_STR:  APPLICATION_FAULT_STATUS_ACCESS_VIOLATION

LAST_CONTROL_TRANSFER:  from 7c901046 to 7c91b1fa

STACK_TEXT: 
0066ff30 7c901046 0067d790 00675026 0067d790 ntdll!RtlpWaitForCriticalSection+0x8c
0066ff38 00675026 0067d790 0000001f 00000000 ntdll!RtlEnterCriticalSection+0x46
0066ff4c 006754c1 00000001 00000000 00000000 WudfSvc!ReportStatusToSCMgr+0x13
0066ff6c 010011cc 00000001 00000000 00000000 WudfSvc!WudfServiceMain+0x2a0
0066ffa0 77df352b 00000001 00096920 0007e898 svchost!ServiceStarter+0x9e
0066ffb4 7c80b713 00096918 00000000 0007e898 advapi32!ScSvcctrlThreadA+0x12
0066ffec 00000000 77df3519 00096918 00000000 kernel32!BaseThreadStart+0x37


STACK_COMMAND:  ~1s; .ecxr ; kb

FOLLOWUP_IP:
WudfSvc!ReportStatusToSCMgr+13
00675026 ff7510          push    dword ptr [ebp+10h]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  WudfSvc!ReportStatusToSCMgr+13

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: WudfSvc

IMAGE_NAME:  WudfSvc.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  451c7d36

FAILURE_BUCKET_ID:  STATUS_ACCESS_VIOLATION_c0000005_WudfSvc.dll!ReportStatusToSCMgr

BUCKET_ID:  APPLICATION_FAULT_STATUS_ACCESS_VIOLATION_WudfSvc!ReportStatusToSCMgr+13

Followup: MachineOwner
---------

[VDO]

Looks like critical section corruption. What does !locks command show? Although your dump seems to be mini-dump from Dr. Watson and you might want to configure it to save full dumps (drwtsn32.exe)