Windows 10: DRIVER_CORRUPTED_EXPOOL (c5) An attempt was made to access a pageable (or completely invalid) addres

Discus and support DRIVER_CORRUPTED_EXPOOL (c5) An attempt was made to access a pageable (or completely invalid) addres in AntiVirus, Firewalls and System Security to solve the problem; Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File... Discussion in 'AntiVirus, Firewalls and System Security' started by liuyang0225, Dec 23, 2018.

  1. LIUYANG0225
    liuyang0225 Win User

    DRIVER_CORRUPTED_EXPOOL (c5) An attempt was made to access a pageable (or completely invalid) addres


    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Users\46371\Desktop\elfinderTest\12.23\122318-12417-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (24 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.23807.amd64fre.win7sp1_ldr.170512-0600
    Machine Name:
    Kernel base = 0xfffff800`03a4e000 PsLoadedModuleList = 0xfffff800`03c90750
    Debug session time: Sun Dec 23 10:47:28.011 2018 (UTC + 8:00)
    System Uptime: 0 days 12:57:30.932
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................
    Loading User Symbols
    Loading unloaded module list
    ........
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C5, {fffff88000810930, 2, 0, fffff80003bf6ab9}

    Unable to load image \SystemRoot\system32\DRIVERS\pgrcam.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for pgrcam.sys
    *** ERROR: Module load completed but symbols could not be loaded for pgrcam.sys
    Probably caused by : Unknown_Image
    *** Followup info cannot be found !!! Please contact "Debugger Team"
    ---------

    8: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    DRIVER_CORRUPTED_EXPOOL (c5)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is
    caused by drivers that have corrupted the system pool. Run the driver
    verifier against any new (or suspect) drivers, and if that doesn't turn up
    the culprit, then use gflags to enable special pool.
    Arguments:
    Arg1: fffff88000810930, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
    Arg4: fffff80003bf6ab9, address which referenced memory

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0xC5_2

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!ExDeferredFreePool+1ed
    fffff800`03bf6ab9 4c3918 cmp qword ptr [rax],r11

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    PROCESS_NAME: ReviewSystem.e

    TRAP_FRAME: fffff8800bc8e7a0 -- (.trap 0xfffff8800bc8e7a0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffff88000810930 rbx=0000000000000000 rcx=fffff880008007a0
    rdx=fffffa801dff3d50 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80003bf6ab9 rsp=fffff8800bc8e930 rbp=0000000000000000
    r8=fffffa801c17a5e0 r9=fffffa801dff3550 r10=0000000000000001
    r11=fffffa801dff3560 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei pl zr na po nc
    nt!ExDeferredFreePool+0x1ed:
    fffff800`03bf6ab9 4c3918 cmp qword ptr [rax],r11 ds:2030:fffff880`00810930=????????????????
    Resetting default scope

    LAST_CONTROL_TRANSFER: from fffff80003abe3e9 to fffff80003abee40

    STACK_TEXT:
    fffff880`0bc8e930 fffff800`03bf61b1 : fffffa80`1bc908e0 fffffa80`19e28c40 00000000`00000000 fffff800`03add817 : nt!ExDeferredFreePool+0x1ed
    fffff880`0bc8e9c0 fffff880`06bedda5 : fffffa80`1bc90900 fffffa80`00000000 00000000`38524750 00000000`00000467 : nt!ExFreePoolWithTag+0x411
    fffff880`0bc8ea70 fffffa80`1bc90900 : fffffa80`00000000 00000000`38524750 00000000`00000467 fffffa80`1dfdc350 : pgrcam+0x7da5
    fffff880`0bc8ea78 fffffa80`00000000 : 00000000`38524750 00000000`00000467 fffffa80`1dfdc350 fffff800`03ac21f1 : 0xfffffa80`1bc90900
    fffff880`0bc8ea80 00000000`38524750 : 00000000`00000467 fffffa80`1dfdc350 fffff800`03ac21f1 fffffa80`1dfdc4fb : 0xfffffa80`00000000
    fffff880`0bc8ea88 00000000`00000467 : fffffa80`1dfdc350 fffff800`03ac21f1 fffffa80`1dfdc4fb 00000000`00000000 : 0x38524750
    fffff880`0bc8ea90 fffffa80`1dfdc350 : fffff800`03ac21f1 fffffa80`1dfdc4fb 00000000`00000000 00000000`00000000 : 0x467
    fffff880`0bc8ea98 fffff800`03ac21f1 : fffffa80`1dfdc4fb 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffffa80`1dfdc350
    fffff880`0bc8eaa0 fffff880`00e98789 : 00000000`00000001 fffffa80`38940900 00000000`00000000 00000000`00000000 : nt!IopfCompleteRequest+0x341
    fffff880`0bc8eb90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Wdf01000!FxRequest::CompleteInternal+0x65d


    STACK_COMMAND: .trap 0xfffff8800bc8e7a0 ; kb

    MODULE_NAME: Unknown_Module

    IMAGE_NAME: Unknown_Image

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    FAILURE_BUCKET_ID: X64_0xC5_2

    BUCKET_ID: X64_0xC5_2
    *** Followup info cannot be found !!! Please contact "Debugger Team"
    ---------

    :)
     
    liuyang0225, Dec 23, 2018
    #1
  2. YASHWANTH KOTAKURI
    Yashwanth Kotakuri Win User

    I just started getting driver_corrupted_expool -- coincidence day after windows 10 update was released?

    Hello Brain,

    Thank you for contacting Microsoft Community.

    We're sorry to hear the inconvenience you have experienced,

    The DRIVER_CORRUPTED_EXPOOL bug check indicates that the system attempted to access invalid memory at a process IRQL that was too high. The kernel attempted to access pageable memory (or perhaps completely invalid memory) when the IRQL was too high.

    The ultimate cause of this problem is almost certainly a driver that has corrupted the system pool. In most cases, this bug check results if a driver corrupts a small allocation (less than PAGE_SIZE).

    Suggest you to check and install compatible windows 10 drivers from Manufacturer's website. Most probably this will fix the issue. Please do keep your PC up to date with Windows Update.

    Keep us posted if you require further assistance.
     
    Yashwanth Kotakuri, Jan 18, 2020
    #2
  3. ASWINSREEDHAR
    AswinSreedhar Win User
    BSOD-DRIVER_CORRUPTED_EXPOOL (c5)

    I'm getting the below information on analyzing the minidump. Could you help me determine the exact root cause? I'm not able to interpret this.

    BugCheck 100000C5, {ffff, 2, 0, 8054b0ba}

    Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+b4 )

    Followup: Pool_corruption

    ---------

    1: kd> ! analyze -v

    *******************************************************************************

    * *

    * Bugcheck Analysis *

    * *

    *******************************************************************************

    DRIVER_CORRUPTED_EXPOOL (c5)

    An attempt was made to access a pageable (or completely invalid) address at an

    interrupt request level (IRQL) that is too high. This is

    caused by drivers that have corrupted the system pool. Run the driver

    verifier against any new (or suspect) drivers, and if that doesn't turn up

    the culprit, then use gflags to enable special pool.

    Arguments:

    Arg1: 0000ffff, memory referenced

    Arg2: 00000002, IRQL

    Arg3: 00000000, value 0 = read operation, 1 = write operation

    Arg4: 8054b0ba, address which referenced memory

    Debugging Details:

    ------------------

    BUGCHECK_STR: 0xC5_2

    CURRENT_IRQL: 2

    FAULTING_IP:

    nt!ExDeferredFreePool+b4

    8054b0ba 8b10 mov edx,dword ptr [eax]

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: System

    LAST_CONTROL_TRANSFER: from 8054b75f to 8054b0ba

    STACK_TEXT:

    b8527c20 8054b75f 00000000 89607088 896018f8 nt!ExDeferredFreePool+0xb4

    b8527c60 8054b95f 896018f8 00000000 b8527c80 nt!ExFreePoolWithTag+0x47f

    b8527c70 804ef5f7 896018f8 00000000 b8527c9c nt!ExFreePool+0xf

    b8527c80 b2dc5ec4 896018f8 89492880 00000000 nt!IoFreeMdl+0x5b

    b8527c9c b2dc54e5 89607088 89607020 00000000 tcpip!TCPSendComplete+0x9b

    b8527cd4 b2dd057a 8a01ac90 00492880 00000000 tcpip!IPSendComplete+0x126

    b8527d60 b6c183e4 b2e03600 8a01ac90 b2e03610 tcpip!LoopXmitRtn+0x19f

    b8527d7c 8053876d 8a01ac90 00000000 8b296640 TDI!CTEpEventHandler+0x32

    b8527dac 805cff64 b2e03600 00000000 00000000 nt!ExpWorkerThread+0xef

    b8527ddc 805460de 8053867e 00000001 00000000 nt!PspSystemThreadStartup+0x34

    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

    STACK_COMMAND: kb

    FOLLOWUP_IP:

    nt!ExDeferredFreePool+b4

    8054b0ba 8b10 mov edx,dword ptr [eax]

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!ExDeferredFreePool+b4

    FOLLOWUP_NAME: Pool_corruption

    IMAGE_NAME: Pool_Corruption

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    MODULE_NAME: Pool_Corruption

    FAILURE_BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+b4

    BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+b4

    Followup: Pool_corruption

    ---------

    Another one says:

    BugCheck 100000C5, {ffff, 2, 0, 8054bfcb}

    Probably caused by : ntkrpamp.exe ( nt!ExAllocatePoolWithTag+663 )

    Followup: MachineOwner

    ---------

    2: kd> ! analyze -v

    *******************************************************************************

    * *

    * Bugcheck Analysis *

    * *

    *******************************************************************************

    DRIVER_CORRUPTED_EXPOOL (c5)

    An attempt was made to access a pageable (or completely invalid) address at an

    interrupt request level (IRQL) that is too high. This is

    caused by drivers that have corrupted the system pool. Run the driver

    verifier against any new (or suspect) drivers, and if that doesn't turn up

    the culprit, then use gflags to enable special pool.

    Arguments:

    Arg1: 0000ffff, memory referenced

    Arg2: 00000002, IRQL

    Arg3: 00000000, value 0 = read operation, 1 = write operation

    Arg4: 8054bfcb, address which referenced memory

    Debugging Details:

    ------------------

    BUGCHECK_STR: 0xC5_2

    CURRENT_IRQL: 2

    FAULTING_IP:

    nt!ExAllocatePoolWithTag+663

    8054bfcb 8b06 mov eax,dword ptr [esi]

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: explorer.exe

    LAST_CONTROL_TRANSFER: from 80537176 to 8054bfcb

    STACK_TEXT:

    b8277c50 80537176 0000000c 00000001 20206f49 nt!ExAllocatePoolWithTag+0x663

    b8277c74 8058079d 00000004 00000e38 20206f49 nt!ExAllocatePoolWithQuotaTag+0x46

    b8277d00 80579292 00000484 000002e0 00000000 nt!IopXxxControlFile+0x533

    b8277d34 805416cc 00000484 000002e0 00000000 nt!NtDeviceIoControlFile+0x2a

    b8277d34 7c90e514 00000484 000002e0 00000000 nt!KiFastCallEntry+0xfc

    WARNING: Frame IP not in any known module. Following frames may be wrong.

    01eff790 00000000 00000000 00000000 00000000 0x7c90e514

    STACK_COMMAND: kb

    FOLLOWUP_IP:

    nt!ExAllocatePoolWithTag+663

    8054bfcb 8b06 mov eax,dword ptr [esi]

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!ExAllocatePoolWithTag+663

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrpamp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 503385d0

    FAILURE_BUCKET_ID: 0xC5_2_nt!ExAllocatePoolWithTag+663

    BUCKET_ID: 0xC5_2_nt!ExAllocatePoolWithTag+663

    Followup: MachineOwner

    ---------
     
    AswinSreedhar, Jan 18, 2020
    #3
  4. JUNAID_A
    Junaid_A Win User

    DRIVER_CORRUPTED_EXPOOL (c5) An attempt was made to access a pageable (or completely invalid) addres

    Bluescreen during browsing webpage

    Hi,



    Thank you for writing to Microsoft Community forum.



    • Were there any changes made on the computer prior to this issue?


    The DRIVER_IRQL_NOT_LESS_OR_EQUAL error indicates that a kernel-mode driver attempted to access pageable memory at a process interrupt request level that was too
    high.



    Cause:

    • A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high.
    • This error is usually caused by drivers that have used improper addresses.


    You may try the troubleshooting steps listed in Troubleshoot blue screen errors
    and check if it works.



    Respond with the status of the issue after troubleshooting.



    Regards,
     
    Junaid_A, Jan 18, 2020
    #4
Thema:

DRIVER_CORRUPTED_EXPOOL (c5) An attempt was made to access a pageable (or completely invalid) addres

Loading...

  1. DRIVER_CORRUPTED_EXPOOL (c5) An attempt was made to access a pageable (or completely invalid) addres - Similar Threads - DRIVER_CORRUPTED_EXPOOL attempt was

  2. IRQL_NOT_LESS_OR_EQUAL a An attempt was made to access a pageable or completely invalid...

    in Windows 10 Gaming
    IRQL_NOT_LESS_OR_EQUAL a An attempt was made to access a pageable or completely invalid...: Can you please help me figure out how to solve this BSOD?The dump file can be download from the link below:https://drive.google.com/file/d/1x_E0q5N-y2SeYhmwgp-P4x_l_IsgXhS7/view?usp=sharingThank...

  3. IRQL_NOT_LESS_OR_EQUAL a An attempt was made to access a pageable or completely invalid...

    in Windows 10 Software and Apps
    IRQL_NOT_LESS_OR_EQUAL a An attempt was made to access a pageable or completely invalid...: Can you please help me figure out how to solve this BSOD?The dump file can be download from the link below:https://drive.google.com/file/d/1x_E0q5N-y2SeYhmwgp-P4x_l_IsgXhS7/view?usp=sharingThank...

  4. IRQL_NOT_LESS_OR_EQUAL a An attempt was made to access a pageable or completely invalid...

    in Windows 10 BSOD Crashes and Debugging
    IRQL_NOT_LESS_OR_EQUAL a An attempt was made to access a pageable or completely invalid...: Can you please help me figure out how to solve this BSOD?The dump file can be download from the link below:https://drive.google.com/file/d/1x_E0q5N-y2SeYhmwgp-P4x_l_IsgXhS7/view?usp=sharingThank...

  5. An attempt was made to access a pageable or completely invalid address at an interrupt...

    in Windows 10 Gaming
    An attempt was made to access a pageable or completely invalid address at an interrupt...: My Computer suddenly would show the irql not less or equal Error on ever single startup. Only after completely whiping the system was i able to start the computer again. The Dump file looks as follows. Does anyone know what it means or where the error was/is?Microsoft R...

  6. An attempt was made to access a pageable or completely invalid address at an interrupt...

    in Windows 10 Software and Apps
    An attempt was made to access a pageable or completely invalid address at an interrupt...: My laptop, a Dell Precision 7540, occasionally freezes when screen turn off after 30 min of windows inactivity.DRIVER_IRQL_NOT_LESS_OR_EQUAL d1An attempt was made to access a pageable or completely invalid address at aninterrupt request level IRQL that is too high. This is...

  7. An attempt was made to access a pageable or completely invalid address at an interrupt...

    in Windows 10 BSOD Crashes and Debugging
    An attempt was made to access a pageable or completely invalid address at an interrupt...: My laptop, a Dell Precision 7540, occasionally freezes when screen turn off after 30 min of windows inactivity.DRIVER_IRQL_NOT_LESS_OR_EQUAL d1An attempt was made to access a pageable or completely invalid address at aninterrupt request level IRQL that is too high. This is...

  8. An attempt was made to access a pageable or completely invalid address at an interrupt...

    in Windows 10 Gaming
    An attempt was made to access a pageable or completely invalid address at an interrupt...: my pc occasionally freezes then reboots when playing games mainly minecraftDRIVER_IRQL_NOT_LESS_OR_EQUAL d1 An attempt was made to access a pageable or completely invalid address at an interrupt request level IRQL that is too high. This is usually caused by drivers using...

  9. An attempt was made to access a pageable or completely invalid address at an interrupt...

    in Windows 10 Software and Apps
    An attempt was made to access a pageable or completely invalid address at an interrupt...: my pc occasionally freezes then reboots when playing games mainly minecraftDRIVER_IRQL_NOT_LESS_OR_EQUAL d1 An attempt was made to access a pageable or completely invalid address at an interrupt request level IRQL that is too high. This is usually caused by drivers using...

  10. An attempt was made to access a pageable or completely invalid address at an interrupt...

    in Windows 10 BSOD Crashes and Debugging
    An attempt was made to access a pageable or completely invalid address at an interrupt...: my pc occasionally freezes then reboots when playing games mainly minecraftDRIVER_IRQL_NOT_LESS_OR_EQUAL d1 An attempt was made to access a pageable or completely invalid address at an interrupt request level IRQL that is too high. This is usually caused by drivers using...

Users found this page by searching for:

  1. DRIVER_CORRUPTED_EXPOOL (c5) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high.