Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini061410-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Symbole
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.100216-1514
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Jun 14 09:44:35.671 2010 (GMT+2)
System Uptime: 0 days 0:10:29.402
Loading Kernel Symbols
...............................................................
.........................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {7, 8da11, 1, 0}

Unable to load image kwpcafog.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for kwpcafog.sys
*** ERROR: Module load completed but symbols could not be loaded for kwpcafog.sys
Probably caused by : memory_corruption ( nt!MiDeferredUnlockPages+17c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000007, A driver has unlocked a page more times than it locked it
Arg2: 0008da11, page frame number
Arg3: 00000001, current share count
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_7

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from 80522d1f to 804f9f43

STACK_TEXT:  
b4be4b0c 80522d1f 0000004e 00000007 0008da11 nt!KeBugCheckEx+0x1b
b4be4b2c 805067aa 00000000 80564d20 8950a000 nt!MiDecrementReferenceCount+0x33
b4be4b70 80548c46 8055c588 8950b000 80564d20 nt!MiDeferredUnlockPages+0x17c
b4be4ba0 8054b49a 8950a000 8950b000 00000000 nt!MiFreePoolPages+0xa4
b4be4be0 b41eb227 8950a000 00000000 b4be4d4c nt!ExFreePoolWithTag+0x1ba
WARNING: Stack unwind information not available. Following frames may be wrong.
b4be4cf0 b41e11bf 8950a000 b56b2b30 00000000 kwpcafog+0xc227
b4be4d8c b41e14ce b41f3040 00000000 898b1da8 kwpcafog+0x21bf
b4be4dac 805cff62 b41f3040 00000000 00000000 kwpcafog+0x24ce
b4be4ddc 8054611e b41e1478 b41f3040 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiDeferredUnlockPages+17c
805067aa 8b55e0          mov     edx,dword ptr [ebp-20h]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!MiDeferredUnlockPages+17c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b7a9cac

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_7_nt!MiDeferredUnlockPages+17c

BUCKET_ID:  0x4E_7_nt!MiDeferredUnlockPages+17c

Followup: MachineOwner
---------