BAD POOL HEADER 19

Problem: Der Server startet teilweise 3-4 mal am Tag von selber neu, auf die Auswirkungen im Unternehmen brauche ich wohl nicht näher eingehen ;-(
Der ursprüngliche Server hatte das gleiche Problem, die Installation als VM auf einem anderen Server hat das Problem leider nicht gelöst.


Im Ereignisprotokoll ist kein Eintrag zum Zeitpunkt des Neustarts ersichtlich, daher habe ich den Minidump mittels windbg ausgelesen:

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini072310-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: LanManNt, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.090319-1204
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Fri Jul 23 07:09:51.455 2010 (GMT+2)
System Uptime: 0 days 16:12:38.296
Loading Kernel Symbols
Loading unloaded module list
Loading User Symbols
*

• *
• Bugcheck Analysis *
• *

*

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, e4f5ca50, e4f5cad0, c100203}

Probably caused by : win32k.sys ( win32k!FreeThreadBufferWithTag+1b )

Followup: MachineOwner

1: kd> !analyze -v
*

• *
• Bugcheck Analysis *
• *

*

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: e4f5ca50, The pool entry we were looking for within the page.
Arg3: e4f5cad0, The next pool entry.
Arg4: 0c100203, (reserved)

Debugging Details:


OVERLAPPED_MODULE: rdbss

BUGCHECK_STR: 0x19_20

POOL_ADDRESS: e4f5ca50

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 808927bb to 80827c83

STACK_TEXT:
b820c6ac 808927bb 00000019 00000020 e4f5ca50 nt!KeBugCheckEx+0x1b
b820c714 bf8c0c5d e4f5ca58 00000000 b820c770 nt!ExFreePoolWithTag+0x477
b820c728 bf962d0a e4f5ca68 b820c804 00000000 win32k!FreeThreadBufferWithTag+0x1b
b820c744 bf9632e8 b820c750 e5184018 00000000 win32k!PFFOBJ::vPFFC_Delete+0x93
b820c75c bf963a5a 00000000 b820c804 b820caa8 win32k!PFFOBJ::vPFFC_DeleteAndCleanup+0x11
b820c790 bf82ba38 e1bc0d98 b820cd2c e1bc0d78 win32k!DEVICE_PFTOBJ::bLoadFonts+0x10f
b820c7a4 bf8a7290 b820cd2c b820caa8 00000000 win32k!PDEVOBJ::bGetDeviceFonts+0x30
b820c80c bf8a72d9 b820cd2c 00000000 00000002 win32k!RFONTOBJ::bInit+0xd3
b820c824 bf8a96cc b820cd2c 00000000 00000002 win32k!RFONTOBJ::vInit+0x16
b820ca90 bf8abbd2 b820cd2c 00000654 00000352 win32k!GreExtTextOutWLocked+0x443
b820cbf8 bf89d0b8 b820cd2c 7ffd71dc 000001d4 win32k!GreBatchTextOut+0x344
b820cd54 8088978d 00000096 0623ea7c 0623ea88 win32k!NtGdiFlushUserBatch+0x11a
b820cd64 7c94860c badb0d00 0623ea7c 00000000 nt!KiFastCallEntry+0xcd
WARNING: Frame IP not in any known module. Following frames may be wrong.
0623ea88 00000000 00000000 00000000 00000000 0x7c94860c


FOLLOWUP_IP:
win32k!FreeThreadBufferWithTag+1b
bf8c0c5d 5e pop esi

SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: win32k!FreeThreadBufferWithTag+1b

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 49e867f5

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0x19_20_win32k!FreeThreadBufferWithTag+1b

BUCKET_ID: 0x19_20_win32k!FreeThreadBufferWithTag+1b

Followup: MachineOwner


Vielleicht kann mir jemand von euch einen Tipp geben, bei Microsoft oder diversen Internet-Foren bin ich leider nicht fündig geworden.

lg. Chris