Windows Server 2008R2 crash, 0x50 (0x461f20c, 0x0, 0x77446b59, 0x8)

as title states, had crash following stop code message:

"the computer has rebooted bugcheck.  bugcheck was: 0x00000050 (0x000000000461f20c, 0x0000000000000000, 0x0000000077446b59, 0x0000000000000008). dump saved in: c:\windows\memory.dmp. report id: 081610-34257-01."

the server has hyper-v installed , hosting 1 server 03 vm @ time.  third party known software installed symantec endpoint protection, though has scom/dpm/sccm agent installed.  no sccm deployment running or @ deadline, nor time dpm backup.  found couple of different hotfixes may or may not relevant , have bugcheck report below.  on figuring out needed appreciated.  of there has been 1 failure, server hosts production, , part of set of identical servers, pretty nervous.

 

hotfixes:

http://support.microsoft.com/kb/951418
http://support.microsoft.com/kb/976527

 

bugcheck:

microsoft (r) windows debugger version 6.11.0001.404 amd64
copyright (c) microsoft corporation. rights reserved.


loading dump file [c:\users\pbarcelino\desktop\memory.dmp]
kernel summary dump file: kernel address space available

symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
executable search path is:
windows 7 kernel version 7600 mp (16 procs) free x64
product: server, suite: terminalserver datacenter singleuserts
built by: 7600.16539.amd64fre.win7_gdr.100226-1909
machine name:
kernel base = 0xfffff800`0161b000 psloadedmodulelist = 0xfffff800`01858e50
debug session time: mon aug 16 19:31:39.371 2010 (gmt-6)
system uptime: 13 days 3:28:16.443
loading kernel symbols
...............................................................
..........................................................page 2a601f not present in dump file. type ".hh dbgerr004" details
..page 2d2ee3 not present in dump file. type ".hh dbgerr004" details
.page 80461d not present in dump file. type ".hh dbgerr004" details
...
..............................
loading user symbols
peb paged out (peb.ldr = 000007ff`fffd6018).  type ".hh dbgerr001" details
loading unloaded module list
................................................
*******************************************************************************
*                                                                             *
*                        bugcheck analysis                                    *
*                                                                             *
*******************************************************************************

use !analyze -v detailed debugging information.

bugcheck 50, {461f20c, 0, 77446b59, 8}

page 2d2ee3 not present in dump file. type ".hh dbgerr004" details
page 2a601f not present in dump file. type ".hh dbgerr004" details
page 2a601f not present in dump file. type ".hh dbgerr004" details
page 2d2ee3 not present in dump file. type ".hh dbgerr004" details
page 80461d not present in dump file. type ".hh dbgerr004" details
peb paged out (peb.ldr = 000007ff`fffd6018).  type ".hh dbgerr001" details
page 2a601f not present in dump file. type ".hh dbgerr004" details
page 2d2ee3 not present in dump file. type ".hh dbgerr004" details
page 80461d not present in dump file. type ".hh dbgerr004" details
peb paged out (peb.ldr = 000007ff`fffd6018).  type ".hh dbgerr001" details
caused : ntkrnlmp.exe ( nt! ?? ::fnodobfm::`string'+43057 )

followup: machineowner
---------

15: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        bugcheck analysis                                    *
*                                                                             *
*******************************************************************************

page_fault_in_nonpaged_area (50)
invalid system memory referenced.  cannot protected try-except,
must protected probe.  typically address plain bad or it
pointing @ freed memory.
arguments:
arg1: 000000000461f20c, memory referenced.
arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
arg3: 0000000077446b59, if non-zero, instruction address referenced bad memory
    address.
arg4: 0000000000000008, (reserved)

debugging details:
------------------

page 2d2ee3 not present in dump file. type ".hh dbgerr004" details
page 2a601f not present in dump file. type ".hh dbgerr004" details
page 2a601f not present in dump file. type ".hh dbgerr004" details
page 2d2ee3 not present in dump file. type ".hh dbgerr004" details
page 80461d not present in dump file. type ".hh dbgerr004" details
peb paged out (peb.ldr = 000007ff`fffd6018).  type ".hh dbgerr001" details
page 2a601f not present in dump file. type ".hh dbgerr004" details
page 2d2ee3 not present in dump file. type ".hh dbgerr004" details
page 80461d not present in dump file. type ".hh dbgerr004" details
peb paged out (peb.ldr = 000007ff`fffd6018).  type ".hh dbgerr001" details

read_address:  000000000461f20c

faulting_ip:
+0
00000000`77446b59 ??              ???

mm_internal_code:  8

default_bucket_id:  vista_driver_fault

bugcheck_str:  0x50

process_name:  cscript.exe

current_irql:  0

last_control_transfer:  fffff80001637f7d fffff8000168b600

stack_text: 
fffff880`07a98ab8 fffff800`01637f7d : 00000000`00000050 00000000`0461f20c 00000000`00000000 fffff880`07a98c20 : nt!kebugcheckex
fffff880`07a98ac0 fffff800`016896ee : 00000000`00000000 00000000`00000002 00000000`002abf01 fffffa80`3c1c8c60 : nt! ?? ::fnodobfm::`string'+0x43057
fffff880`07a98c20 00000000`77446b59 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!kipagefault+0x16e
00000000`002abc70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77446b59


stack_command:  kb

followup_ip:
nt! ?? ::fnodobfm::`string'+43057
fffff800`01637f7d cc              int     3

symbol_stack_index:  1

symbol_name:  nt! ?? ::fnodobfm::`string'+43057

followup_name:  machineowner

module_name: nt

image_name:  ntkrnlmp.exe

debug_flr_image_timestamp:  4b88cfeb

failure_bucket_id:  x64_0x50_nt!_??_::fnodobfm::_string_+43057

bucket_id:  x64_0x50_nt!_??_::fnodobfm::_string_+43057

followup: machineowner
---------

15: kd> !thread
thread fffffa803d805b60  cid 17d4.1100  teb: 000007fffffde000 win32thread: fffff900c1d85850 running on processor f
not impersonating
devicemap                 fffff8a000008b30
owning process            fffffa803f6c6b30       image:         cscript.exe
attached process          n/a            image:         n/a
wait start tickcount      72800587       ticks: 0
context switch count      777                 largestack
usertime                  00:00:00.046
kerneltime                00:00:00.171
win32 start address 0x00000000ff3728c4
stack init fffff88007a98db0 current fffff88007a983b0
base fffff88007a99000 limit fffff88007a91000 call 0
priority 15 basepriority 8 unusualboost 0 foregroundboost 0 iopriority 2 pagepriority 5
child-sp          retaddr           : args child                                                           : call site
fffff880`07a98ab8 fffff800`01637f7d : 00000000`00000050 00000000`0461f20c 00000000`00000000 fffff880`07a98c20 : nt!kebugcheckex
fffff880`07a98ac0 fffff800`016896ee : 00000000`00000000 00000000`00000002 00000000`002abf01 fffffa80`3c1c8c60 : nt! ?? ::fnodobfm::`string'+0x43057
fffff880`07a98c20 00000000`77446b59 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!kipagefault+0x16e (trapframe @ fffff880`07a98c20)
00000000`002abc70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77446b59

15: kd> !process fffffa803f6c6b30 0
process fffffa803f6c6b30
    sessionid: 0  cid: 17d4    peb: 7fffffd6000  parentcid: 0fc8
    dirbase: 3e05bf000  objecttable: fffff8a0017cba80  handlecount: 267.
    image: cscript.exe

actually, crash occured again different stop code, , upon migrating vm, same thing happened on different host.  ended nailing problem down using new processor type in several new servers: http://support.microsoft.com/kb/981791/en-us.  once hotfix installed errors stopped.  apparently other stop codes possible documented.  btw, had been using last generation(e5500), has similar hotfix.  old fashioned ms fun, guess.

Windows Server  >  Windows Server General Forum