BSOD on 2008R2 VM

crash dump analysis

*******************************************************************************
*                                                                             *
*                        bugcheck analysis                                    *
*                                                                             *
*******************************************************************************

page_fault_in_nonpaged_area (50)
invalid system memory referenced.  cannot protected try-except,
must protected probe.  typically address plain bad or it
pointing @ freed memory.
arguments:
arg1: fffff960001551dc, memory referenced.
arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
arg3: fffff960001551dc, if non-zero, instruction address referenced bad memory
    address.
arg4: 0000000000000007, (reserved)

debugging details:
------------------


read_address:  fffff960001551dc

faulting_ip:
win32k!sfninlpwindowpos+138
fffff960`001551dc 4889056d152400  mov     qword ptr [win32k!gpticurrent (fffff960`00396750)],rax

mm_internal_code:  7

image_name:  win32k.sys

debug_flr_image_timestamp:  50e64bda

module_name: win32k

faulting_module: fffff960000b0000 win32k

default_bucket_id:  win7_driver_fault

bugcheck_str:  0x50

process_name:  winword.exe

current_irql:  0

analysis_version: 6.3.9600.17029 (debuggers(dbg).140219-1702) x86fre

trap_frame:  fffff88006bd5590 -- (.trap 0xfffff88006bd5590)
note: trap frame not contain registers.
register values may zeroed or incorrect.
rax=fffff900c019dc20 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960001551dc rsp=fffff88006bd5720 rbp=0000000000000000
 r8=fffff80001618000  r9=0000000000000000 r10=fffffffffffffffe
r11=fffff80001809e00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv ei ng nz na pe nc
win32k!sfninlpwindowpos+0x138:
fffff960`001551dc 4889056d152400  mov     qword ptr [win32k!gpticurrent (fffff960`00396750)],rax ds:fffff960`00396750=0000000000000000
resetting default scope

last_control_transfer:  fffff8000170a5fb fffff8000168dc40

failed_instruction_address:
win32k!sfninlpwindowpos+138
fffff960`001551dc 4889056d152400  mov     qword ptr [win32k!gpticurrent (fffff960`00396750)],rax

stack_text:  
fffff880`06bd5428 fffff800`0170a5fb : 00000000`00000050 fffff960`001551dc 00000000`00000008 fffff880`06bd5590 : nt!kebugcheckex
fffff880`06bd5430 fffff800`0168bd6e : 00000000`00000008 fffff960`001551dc fffff880`06bd5600 00000000`00000000 : nt! ?? ::fnodobfm::`string'+0x43781
fffff880`06bd5590 fffff960`001551dc : fffff900`00000011 fffff880`06bd57b0 fffff900`c069a830 00000000`00b7a830 : nt!kipagefault+0x16e
fffff880`06bd5720 fffff960`0017cd5b : 00000000`00000002 00000000`00000047 fffff900`c1f5cc00 00000000`00000000 : win32k!sfninlpwindowpos+0x138
fffff880`06bd5840 fffff960`0017c613 : 00000000`00000000 fffff900`c069a830 00000000`00000047 00000000`00000000 : win32k!xxxsendmessagetoclient+0x1f7
fffff880`06bd58b0 fffff960`0014a2e1 : fffff900`c1f5cc00 fffff900`c1f5cc00 00000000`00000000 00000000`00000000 : win32k!xxxsendmessagetimeout+0x2b6
fffff880`06bd5960 fffff960`0014b054 : fffff900`c00b8010 fffff960`003975a0 00000000`00000000 00000000`00000000 : win32k!xxxsendchangedmsgs+0x1b5
fffff880`06bd59e0 fffff960`0014ac3a : fffff900`00000001 fffff900`c069a830 00000000`00000000 fffff960`00000000 : win32k!xxxenddeferwindowposex+0x3d8
fffff880`06bd5aa0 fffff960`001893d9 : 00000000`00000000 00000000`00000000 fffff900`00000000 fffff960`00000000 : win32k!xxxsetwindowpos+0x156
fffff880`06bd5b20 fffff800`0168ced3 : fffffa80`365d2620 fffff880`06bd5ca0 00000000`0008e318 fffff880`06bd5bc8 : win32k!ntusersetwindowpos+0x1e5
fffff880`06bd5bb0 00000000`74e2001a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!kisystemservicecopyend+0x13
00000000`0008e2f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74e2001a


stack_command:  kb

followup_ip:
win32k!sfninlpwindowpos+138
fffff960`001551dc 4889056d152400  mov     qword ptr [win32k!gpticurrent (fffff960`00396750)],rax

symbol_stack_index:  3

symbol_name:  win32k!sfninlpwindowpos+138

followup_name:  machineowner

image_version:  6.1.7601.18043

failure_bucket_id:  x64_0x50_bad_ip_win32k!sfninlpwindowpos+138

bucket_id:  x64_0x50_bad_ip_win32k!sfninlpwindowpos+138

analysis_source:  km

failure_id_hash_string:  km:x64_0x50_bad_ip_win32k!sfninlpwindowpos+138

failure_id_hash:  {b8aaae46-9f7a-7cc4-9a2d-8c59a67e24c1}

followup: machineowner
---------
looking direction - thanks

hi,

regarding bug check 0x50, please refer following article.

bug check 0x50: page_fault_in_nonpaged_area

would please let me know whether operation (or change) had been done before bsod issue occurred? examples, install update, install application (from crash dump analysis: process_name:  winword.exe) or other? did issue occurred periodically?

please update possible drivers. please run chkdsk , sfc /scannow command, monitor result. meanwhile, please perform clean boot , check if issue still exists.

by way, not effective debug crash dump file here in forum. if issues state of emergency you. please contact microsoft customer service , support (css) via telephone dedicated support professional can assist request.

to obtain phone numbers specific technology request, please refer web site listed below:

http://support.microsoft.com/default.aspx?scid=fh;en-us;offerprophone#faq607

hope helps.

best regards,

justin gu

Windows Server  >  Management