Windows 2003 SBOD when creating a network share (Win2003)

[Sven Huijbrechts]

Hi,

I'm having a particular issue on a Windows Server 2003 std (SP2, fully
patched)

When trying to create a new networkshare (both GUI and command line), I get
a BSOD with this info:

Error code 1000008e, parameter1 c0000005, parameter2 808b49d1, parameter3
f6ceea84, parameter4 00000000.

BugCheck 1000008E, {c0000005, 808b49d1, f7e9eaa4, 0}
Probably caused by : ntkrnlpa.exe ( nt!HvpGetCellMapped+97 )
Followup: MachineOwner


Already checked:
- updated all drivers
- disabled network
- un/re-installed NIC
- shares created in the past are working normally




Extended Bugcheck:
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 808b49d1, The address that the exception occurred at
Arg3: f7e9eaa4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced
memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!HvpGetCellMapped+97
808b49d1 8b4604 mov eax,dword ptr [esi+4]

TRAP_FRAME: f7e9eaa4 -- (.trap 0xfffffffff7e9eaa4)
ErrCode = 00000000
eax=e101f000 ebx=e101c008 ecx=00000008 edx=81fd24e8 esi=00001f60
edi=00000000
eip=808b49d1 esp=f7e9eb18 ebp=f7e9eb8c iopl=0 nv up ei pl nz na pe
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010206
nt!HvpGetCellMapped+0x97:
808b49d1 8b4604 mov eax,dword ptr [esi+4]
ds:0023:00001f64=????????

Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR: 0x8E

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 808cdee6 to 808b49d1

STACK_TEXT:
f7e9eb8c 808cdee6 e101c008 011f60f0 f7e9ec78 nt!HvpGetCellMapped+0x97
f7e9ebb0 808ce064 e1395a30 e178405c 00000000 nt!CmpGetValueKeyFromCache+0xa4
f7e9ec20 808bb707 e1395a30 f7e9ecb0 f7e9ec74
nt!CmpFindValueByNameFromCache+0xa0

f7e9eca4 808b3ab2 e1395a30 00140012 015800c8 nt!CmQueryValueKey+0x23b
f7e9ed44 80883908 000009c8 0130fca4 00000001 nt!NtQueryValueKey+0x29a
f7e9ed44 7c8285ec 000009c8 0130fca4 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0130fcc0 00000000 00000000 00000000 00000000 0x7c8285ec


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!HvpGetCellMapped+97
808b49d1 8b4604 mov eax,dword ptr [esi+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!HvpGetCellMapped+97

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec0a19

FAILURE_BUCKET_ID: 0x8E_nt!HvpGetCellMapped+97

BUCKET_ID: 0x8E_nt!HvpGetCellMapped+97

Followup: MachineOwner