Hi all,

on our Windows XP SP3 and newest Updates, Novell Cient 4.91 SP5 we get
randomly BSOD.


Here our WinDbg6.11 analyze-file:

----------------

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\TEMP\Minidump bis 15.11.2009\Mini111609-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86
compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Nov 16 11:41:30.781 2009 (GMT+1)
System Uptime: 0 days 3:08:58.571
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.................................................. ..............
.................................................. ...............
...........................................
Loading User Symbols
Loading unloaded module list
.................
Unable to load image tcpip.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for tcpip.sys
************************************************** **************************
***
*
*
* Bugcheck Analysis
*
*
*
************************************************** **************************
***

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {9f3eeedc, 0, 8050924a, 0}


Could not read faulting driver name
Unable to load image nwdns.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nwdns.sys
*** ERROR: Module load completed but symbols could not be loaded for
nwdns.sys
Probably caused by : nwdns.sys ( nwdns+4e74 )

Followup: MachineOwner
---------

0: kd> !analyze -v
************************************************** **************************
***
*
*
* Bugcheck Analysis
*
*
*
************************************************** **************************
***

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain bad or
it
is pointing at freed memory.
Arguments:
Arg1: 9f3eeedc, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8050924a, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: 9f3eeedc

FAULTING_IP:
nt!DbgUnLoadImageSymbols+d
8050924a 8b530c mov edx,dword ptr [ebx+0Ch]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from eceac9f8 to 8050924a

STACK_TEXT:
f78daa70 eceac9f8 85af8c38 1f000000 00000001 nt!DbgUnLoadImageSymbols+0xd
f78daa90 ece9f1fb 85af8c38 00000010 86c7002b tcpip!TCPRcv+0x14bb
f78dabbc ecea6308 eceddbb4 86b36870 86c750d8 tcpip!IPTransmit+0x162a
f78dac5c ecea60cf 85c5c008 86b36870 867bcc40 tcpip!UDPSend+0x41e
f78dac80 ecea6135 008daca4 85aafdbe 86c75118 tcpip!TdiSendDatagram+0xd8
f78dacb8 ecea2881 867bcc40 867bccd4 f7600240 tcpip!UDPSendDatagram+0x52
f78dacd4 804ef19f 89824cc8 867bcc40 867bcc40
tcpip!TCPDispatchInternalDeviceControl+0xff
f78dad08 804ef19f 89a46020 867bcc40 85aaf848
nt!MiFlushSectionInternal+0x256
f78dad44 f75fbe74 f7600240 85c3fb80 f7600240
nt!MiFlushSectionInternal+0x256
WARNING: Stack unwind information not available. Following frames may be
wrong.
f78dad6c f75fb999 f7600240 8056485c f78dadac nwdns+0x4e74
f78dad7c 8053877d 85c3fb80 00000000 8a557b30 nwdns+0x4999
f78dadac 805cff72 85c3fb80 00000000 00000000 nt!MiTrimPte+0x1fe
f78daddc 805460ee 8053868e 00000001 00000000
nt!IopQueryReconfiguration+0x25
f78dadf8 00000000 00000000 00000000 00001f80 nt!ExpRemovePoolTracker+0x7b


STACK_COMMAND: kb

FOLLOWUP_IP:
nwdns+4e74
f75fbe74 ?? ???

SYMBOL_STACK_INDEX: 9

SYMBOL_NAME: nwdns+4e74

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nwdns

IMAGE_NAME: nwdns.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4884e5e9

FAILURE_BUCKET_ID: 0x50_nwdns+4e74

BUCKET_ID: 0x50_nwdns+4e74

Followup: MachineOwner
---------

0: kd> lmvm nwdns
start end module name
f75f7000 f7602300 nwdns T (no symbols)
Loaded symbol image file: nwdns.sys
Image path: nwdns.sys
Image name: nwdns.sys
Timestamp: Mon Jul 21 21:39:21 2008 (4884E5E9)
CheckSum: 0001763D
ImageSize: 0000B300
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4







---------------

Looks like an nwdns.sys error?

Thanks,

Mark