Windows Server

ezapien · Guest

Has anybody else seen this crash? It seems that sfmatalk.sys is jumping to a
zero address. I wonder how can I get the SFM group to take a look at it.

Thanks,

--Erik Zapien

6: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 00000000, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: 00000000

CURRENT_IRQL: 2

FAULTING_IP:
+0
00000000 ?? ???

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from ba0ad749 to 00000000

TRAP_FRAME: f78e297c -- (.trap fffffffff78e297c)
ErrCode = 00000000
eax=f78e2a2c ebx=89ba5d54 ecx=89ba5d80 edx=f78e2ad8 esi=00000000 edi=8a0db054
eip=00000000 esp=f78e29f0 ebp=f78e2a40 iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
00000000 ?? ???
DBGHELP: IP not set!
Resetting default scope

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
f78e29ec ba0ad749 00000000 0000000c f78e2a2c 0x0
f78e2a40 ba0b43ff 00000000 89ba5d80 f78e2ad8
sfmatalk!AtalkDdpInvokeHandler+0x179
f78e2a80 ba0b47b6 8a21449c f78e2adc f78e2ad8
sfmatalk!AtalkDdpInPktToNodesOnPort+0x1a9
f78e2ae4 ba0abcdb 8a21449c 892b1f00 8a0d2e8d sfmatalk!AtalkDdpPacketIn+0x37a
f78e2b1c f718b343 0021449c 8a1f2008 f78e2bc8
sfmatalk!AtalkReceiveComplete+0x197
f78e2b6c ba94758d 8a211ad0 f78e2bb0 00000006
NDIS!ethFilterDprIndicateReceivePacket+0x5b1
f78e2b8c ba9482bd 8a1f2008 f78e2bb0 00000006
e1000325!ReceivePacketArrayIndicate+0x1d
f78e2cc0 ba948393 8a1f2008 f78e2cef 8a211ad0
e1000325!RxProcessReceiveArray+0x8d
f78e2ce4 f718012f 001f2008 f7757a40 8a1f235c
e1000325!E1000HandleInterrupt+0xa7
f78e2cf8 8083eb0f 8a1f235c 8a1f2348 00000000 NDIS!ndisMDpcX+0x1f
f78e2d50 8083ac1f 00000000 0000000e 00000000 nt!KiRetireDpcList+0xca
f78e2d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x37

FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ?? ???

FOLLOWUP_IP:
sfmatalk!AtalkDdpInvokeHandler+179
ba0ad749 3d160000c0 cmp eax,0xc0000016

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: sfmatalk!AtalkDdpInvokeHandler+179

MODULE_NAME: sfmatalk

IMAGE_NAME: sfmatalk.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 42435c9c

STACK_COMMAND: .trap fffffffff78e297c ; kb

FAILURE_BUCKET_ID: 0xD1_CODE_AV_NULL_IP_sfmatalk!AtalkDdpInvokeHandler+179

BUCKET_ID: 0xD1_CODE_AV_NULL_IP_sfmatalk!AtalkDdpInvokeHandler+179

Followup: MachineOwner
---------

ezapien · Guest

I forgot to say. This happens in Windows 2003 SP1 with two intel gigabit
ethernet NICs.

--Erik Zapien

"ezapien" wrote:

[tranceformer] · Guest

Hi,

Did you ever find out what was causing your crash?
I seem to have exactly the same problem...

Cheers,
Chris

"ezapien" wrote:

ezapien · Guest

Sorry to say no. My customer switched to HP servers, DELL servers and also a
miryad of Network adapters. Same problem. Only thing I could determine after
this is that the problem is caused from some external entity generating
appletalk packets that kill sfmatalk.sys. If the server was disconneted from
the network, it wouldn't crash. Couldn't determine who is generating those
packets, though. Never got an answer from MS on the crash :(

We had to save the account by switching them to Mac OSX running our product.
(Fortunately we run in many platforms ;)

Maybe you could debug this by running a packet tracer to see what is the
last packet that the server gets before it crash. It's a lot of work and will
result in a lot of data, though. But if you get the log I could help you
analyze it.

--Erik

"[tranceformer]" wrote:

[tranceformer] · Guest

Wow you seem to have done exactly the same as us. We have tried HP and Dell
hardware. Intel and broadcom Nics. When we disconnect the machine from the
network it doesn't crash too!
We have the exact same app unning in a different location and it has never
had any problems. The big difference is that the network structure is much
simpler.

We currently have a specialised company sniffing the connection from the
machine to the network, but after 4 crashes they still are unable to tell us
what is happening... the suspicion lies with spanning tree at the moment but
we cannot turn it off due to our network structure.

I'm reluctant to move to OSX server especially since lots of $$$ were spent
on the Wintel hardware but if there's no choice....

Out of curiosity, what was the application that you were running?

Cheers,
Chris.

"ezapien" wrote:

	Windows Server Forum Index -> Networking	All times are GMT
Page 1 of 1