Windows 2008 R2 Memory Dump

Question

Today we have got memory dump error on our windows server 2008 R2. As per Blue Screen Viewer its "UNEXPECTED_KERNEL_MODE_TRAP" with BugCheck Code "0x0000007f".

But i am not sure what does its means. Kindly advise on the same.

Thanks, Sandesh

Answer 1

https://msdn.microsoft.com/en-us/library/windows/hardware/ff559244(v=vs.85).aspx

UNEXPECTED_KERNEL_MODE_TRAP (7f) 

This means a trap occurred in kernel mode, and it's a trap of a kind that the kernel isn't allowed to have/catch (bound trap) or that is always instant death (double fault). The first number in the bugcheck parens is the number of the trap (8 = double fault, etc) Consult an Intel x86 family manual to learn more about what these traps are.

•0x00000008, or Double Fault, indicates that an exception occurs during a call to the handler for a prior exception. Typically, the two exceptions are handled serially. However, there are several exceptions that cannot be handled serially, and in this situation the processor signals a double fault. There are two common causes of a double fault:

◦A kernel stack overflow. This overflow occurs when a guard page is hit, and the kernel tries to push a trap frame. Because there is no stack left, a stack overflow results, causing the double fault. If you think this overview has occurred, use !thread to determine the stack limits, and then use kb (Display Stack Backtrace) with a large parameter (for example, kb 100) to display the full stack.

◦A hardware problem.

3rd party device drivers are the most likely culprit. (Antivirus is a frequent offender, but I repeat myself, it's drivers.) When they do things incorrectly like overflow a kernel stack or mess up a call to ExAllocatePoolWithTag, the system will crash. Everything has to be perfect in kernel mode, or the machine will crash.

I would need to analyze the dump to say any more. The link I added has quite a lot of good info in it.