Microsoft (R) Windows Debugger  Version 6.0.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [D:\MEMORY.DMP]
Kernel Dump File: Full address space is available

Symbol search path is: c:\windows\symbols
Executable search path is: 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe - 
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.050301-1521
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Tue May 23 18:10:23 2006
System Uptime: 0 days 0:50:39.320
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe - 
Loading Kernel Symbols
.....................................................................................................................
Loading unloaded module list
..........
Loading User Symbols
...............................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {16, 1c, 0, 805021f2}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** ERROR: Module load completed but symbols could not be loaded for npf.sys
Probably caused by : npf.sys ( npf+1997 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pagable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000016, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 805021f2, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

READ_ADDRESS: unable to get nt!MmPoolCodeEnd
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSpecialPoolStart
unable to get nt!MmPagedPoolStart
unable to get nt!MiSessionPoolStart
unable to get nt!MiSessionPoolEnd
unable to get nt!MmNonPagedPoolExpansionStart
unable to get nt!MmPoolCodeStart
 00000016 

CURRENT_IRQL:  1c

FAULTING_IP: 
nt!ZwYieldExecution+1b86
805021f2 6683781601       cmp     word ptr [eax+0x16],0x1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

LAST_CONTROL_TRANSFER:  from 805021f2 to 805436e0

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
a8efeab4 805021f2 badb0d00 00000000 885e3128 nt!Kei386EoiHelper+0x2834
a8efeb44 804f9fa6 88413db8 88103000 88413da8 nt!ZwYieldExecution+0x1b86
a8efeb58 babf9997 88250b80 00000000 00000000 nt!KeSetEvent+0x5a
a8efeb80 804eeec5 882702b0 88413da8 88413da8 npf+0x1997
a8efebc8 805b9e15 0061c810 00000000 8861c7f8 nt!IoBuildPartialMdl+0xed
a8efebe4 805257cc 8861c810 00000000 000005dc nt!NtFreeVirtualMemory+0x84e7
a8efec14 805c1243 e29492a0 8861c810 000005dc nt!ObfDereferenceObject+0x4c
a8efec34 8060c1b3 e40d7bb8 000005dc a8efec74 nt!ObDereferenceSecurityDescriptor+0x2c7
a8efec54 805c133c e29492a0 805c1224 a8efec74 nt!ExInitializePagedLookasideList+0xd4b
a8efec80 805d0e5c 88102020 87cd3020 87cd3268 nt!ObDereferenceSecurityDescriptor+0x3c0
a8efed08 805d10b6 c000013a 87cd3020 00000000 nt!PsGetProcessExitTime+0x6da
a8efed28 805d1291 87cd3020 c000013a a8efed64 nt!PsGetProcessExitTime+0x934
a8efed54 8054061c 00000000 c000013a 036fff04 nt!PsGetProcessExitTime+0xb0f
a8efed64 7c90eb93 badb0d00 036ffe10 a8e1dd98 nt!KeReleaseInStackQueuedSpinLockFromDpcLevel+0xb74
036fff04 7c81cab6 c000013a 77e8f3b0 ffffffff ntdll!KiFastSystemCallRet+0x4
036fff18 7c874f2b c000013a 7c8750cc 00000002 kernel32!ExitProcess+0x14
036fff20 7c8750cc 00000002 05450020 00000002 kernel32!DefaultHandler+0xa
036fffb4 7c80b50b 00000002 05450020 00000002 kernel32!CtrlRoutine+0x18d
036fffec 00000000 7c874f30 00000002 00000000 kernel32!BaseThreadStart+0x37

FOLLOWUP_IP: 
npf+1997
babf9997 895e10           mov     [esi+0x10],ebx

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  npf+1997

MODULE_NAME:  npf

IMAGE_NAME:  npf.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  3e8d8386

STACK_COMMAND:  kb

BUCKET_ID:  WRONG_SYMBOLS