Crash Dump Analysis Patterns (Part 185)

Similar to Network Packet Buildup pattern we also have Disk Packet Buildup. This can be detectable either through SCSI WinDbg extension or using IRP Distribution Anomaly pattern:

0: kd> .load scsikd

0: kd> !scsikd.classext
Storage class devices:

* !classext fffffa80026395b0 [1,2] SAMSUNG HS082HB Paging Disk

Usage: !classext <class device> <level [0-2]>

0: kd> !scsikd.classext fffffa80026395b0
Storage class device fffffa80026395b0 with extension at fffffa8002639700

Classpnp Internal Information at fffffa8002648010

-- dt classpnp!_CLASS_PRIVATE_FDO_DATA fffffa8002648010 --

Classpnp External Information at fffffa8002639700

SAMSUNG HS082HB NL100-01 S140JR0SA00025

Minidriver information at fffffa8002639bc0
Attached device object at fffffa80017ecda0
Physical device object at fffffa80024ab060

Media Geometry:

Bytes in a Sector = 512
Sectors per Track = 63
Tracks / Cylinder = 255
Media Length      = 80026361856 bytes = ~74 GB

-- dt classpnp!_FUNCTIONAL_DEVICE_EXTENSION fffffa8002639700 --

This is a normal case:

0: kd> !scsikd.classext fffffa80026395b0 2
Storage class device fffffa80026395b0 with extension at fffffa8002639700

Classpnp Internal Information at fffffa8002648010

Transfer Packet Engine:

Packet          Status  DL Irp          Opcode  Sector/ListId   UL Irp
--------         ------ --------         ------ --------------- --------
fffffa8002648e80  Free  fffffa800249eac0
fffffa8002644220  Free  fffffa80024aa4f0
fffffa80026898a0  Free  fffffa80019d2b30
fffffa800267ad40  Free  fffffa8001801b90
fffffa800267aa60  Free  fffffa8001835e10
fffffa8002679010  Free  fffffa80019fac40
fffffa8002679770  Free  fffffa8002679500
fffffa80027659a0  Free  fffffa8002764e10
fffffa8002790e80  Free  fffffa800267a6a0
fffffa800278f5e0  Free  fffffa80019d53c0
fffffa8002599410  Free  fffffa8002785600
fffffa80027f7490  Free  fffffa800278ea00
fffffa80027f6e80  Free  fffffa80027f6c80
fffffa80027f69a0  Free  fffffa80027f67a0
fffffa80027f64c0  Free  fffffa80027f62c0
fffffa8002dd4440  Free  fffffa80027fc600
fffffa8002dced30  Free  fffffa8002dceb30
fffffa8002dce850  Free  fffffa8002ddc010
fffffa8002ddc530  Free  fffffa8002ddc330
fffffa8002de2d30  Free  fffffa8002de2b30
fffffa8002de2850  Free  fffffa8002de2650
fffffa8002de2370  Free  fffffa8002de2170
fffffa8002ddbe80  Free  fffffa8002ddbc80
fffffa8002ddb9a0  Free  fffffa8002ddb7a0
fffffa8002dda010  Free  fffffa8002ddae10
[...]

This is not:

0: kd> !scsikd.classext fffffa80026395b0 2

Storage class device fffffa80026395b0 with extension at fffffa8002639700

Classpnp Internal Information at fffffa8002648010

Transfer Packet Engine:

Packet           Status DL Irp           Opcode Sector   UL Irp
--------         ------ --------         ------ -------- --------
fffffa80c71d9560 Queued fffffa80c71d9360   2a   03cbb948 fffffa80c4f269d0 \FileName
fffffa80c77a3360 Queued fffffa80c77a3160   2a   0400f0a8 fffffa80c59c1010 \FileName
fffffa80c6cefe60 Queued fffffa80c6cefc60   2a   0400f128 fffffa80c59c1010 \FileName
fffffa80c6e92260 Queued fffffa80c4f80010   2a   0400f1e8 fffffa80c59c1010 \FileName
fffffa80c79dbca0 Queued fffffa80c79dbaa0   2a   0400c4e8 fffffa80c59c1010 \FileName
fffffa80c83f2d90 Queued fffffa80c3b23bc0   2a   0400f168 fffffa80c59c1010 \FileName
fffffa80c4a94640 Queued fffffa80c4a94440   2a   0400d5e8 fffffa80c59c1010 \FileName
fffffa80c7984010 Queued fffffa80c7984210   2a   0400d328 fffffa80c59c1010 \FileName
fffffa80c6e52be0 Queued fffffa80c6e529e0   2a   0400f1a8 fffffa80c59c1010 \FileName
fffffa80c7afada0 Queued fffffa80c7afaba0   2a   04010268 fffffa80c59c1010 \FileName
fffffa80c7c19d90 Queued fffffa80ca2c5e10   2a   0400c628 fffffa80c59c1010 \FileName
fffffa80c6182d60 Queued fffffa80c6182b60   2a   0400f9a8 fffffa80c59c1010 \FileName
fffffa80c8695ba0 Queued fffffa80c86959a0   2a   0400d128 fffffa80c59c1010 \FileName
fffffa80c6b42b40 Queued fffffa80c6b42940   2a   0400ed28 fffffa80c59c1010 \FileName
fffffa80c5e1ab00 Queued fffffa80c5e1a900   2a   0400eee8 fffffa80c59c1010 \FileName
fffffa80c5d80a30 Queued fffffa80c4841e10   2a   0400fba8 fffffa80c59c1010 \FileName
fffffa80c48255d0 Queued fffffa80c48253d0   2a   040119e8 fffffa80c59c1010 \FileName
fffffa80c718a270 Queued fffffa80c47d0010   2a   0400d1e8 fffffa80c59c1010 \FileName
fffffa80c51a94b0 Queued fffffa80c51a92b0   2a   0400bd28 fffffa80c59c1010 \FileName
fffffa80ca280990 Queued fffffa80c52b2930   2a   0400d268 fffffa80c59c1010 \FileName
fffffa80c586f280 Queued fffffa80c551fe10   2a   0400f068 fffffa80c59c1010 \FileName
fffffa80c8413540 Queued fffffa80c544ae10   2a   04011a68 fffffa80c59c1010 \FileName
fffffa80c544ac60 Queued fffffa80c535ba90   2a   0400e7e8 fffffa80c59c1010 \FileName
fffffa80c4678010 Queued fffffa80c4678230   2a   04011168 fffffa80c59c1010 \FileName
fffffa80c9d94be0 Queued fffffa80c59205e0   2a   0400d4a8 fffffa80c59c1010 \FileName
fffffa80c5920430 Queued fffffa80c59248f0   2a   0400ea68 fffffa80c59c1010 \FileName
fffffa80c737e8f0 Queued fffffa80c737e6f0   2a   0400fee8 fffffa80c59c1010 \FileName
fffffa80c4797c60 Queued fffffa80c5d31800   2a   0400f328 fffffa80c59c1010 \FileName
fffffa80c711d270 Queued fffffa80c76ee390   2a   0400eaa8 fffffa80c59c1010 \FileName
fffffa80c872dba0 Queued fffffa80c872d9a0   2a   0400eb28 fffffa80c59c1010 \FileName
fffffa80c9e67d10 Queued fffffa80c9e67b10   2a   04012168 fffffa80c59c1010 \FileName
fffffa80ca3bb350 Queued fffffa80c66e4370   2a   0400c928 fffffa80c59c1010 \FileName
fffffa80c5894ab0 Queued fffffa80c58948b0   2a   0400c368 fffffa80c59c1010 \FileName
fffffa80c305fe60 Queued fffffa80c305fc60   2a   04013168 fffffa80c59c1010 \FileName
fffffa80c496cce0 Queued fffffa80c496cae0   2a   0400d168 fffffa80c59c1010 \FileName
fffffa80c5e78c60 Queued fffffa80c905c7f0   2a   0400f8a8 fffffa80c59c1010 \FileName
fffffa80c905c640 Queued fffffa80c5c1c410   2a   0400f428 fffffa80c59c1010 \FileName
fffffa80c68ffc40 Queued fffffa80c68ffa40   2a   0400f468 fffffa80c59c1010 \FileName
fffffa80c3aa3e60 Queued fffffa80c3aa3c60   2a   0400c7a8 fffffa80c59c1010 \FileName
fffffa80c5e8dc60 Queued fffffa80c8852cf0   2a   0400f4a8 fffffa80c59c1010 \FileName
fffffa80c90082b0 Queued fffffa80c7907440   2a   04013428 fffffa80c59c1010 \FileName
fffffa80c7907290 Queued fffffa80c67aea80   2a   0400fe68 fffffa80c59c1010 \FileName
fffffa80c67ae8d0 Queued fffffa80c9383cf0   2a   0400f3a8 fffffa80c59c1010 \FileName
fffffa80c8497010 Queued fffffa80c8497270   2a   0400c5e8 fffffa80c59c1010 \FileName
fffffa80c78c7480 Queued fffffa80c78c7280   2a   0400c3e8 fffffa80c59c1010 \FileName
fffffa80c7f37d90 Queued fffffa80c618b480   2a   0400cce8 fffffa80c59c1010 \FileName
fffffa80c618b2d0 Queued fffffa80ca2e9e10   2a   0400ee28 fffffa80c59c1010 \FileName
fffffa80ca2e9c60 Queued fffffa80c5e783f0   2a   0400d8e8 fffffa80c59c1010 \FileName
fffffa80c64e1650 Queued fffffa80c64e1450   2a   0400d0e8 fffffa80c59c1010 \FileName
fffffa80c684dd60 Queued fffffa80c684db60   2a   0400c6a8 fffffa80c59c1010 \FileName
fffffa80c3b2bac0 Queued fffffa80c3b2b8c0   2a   040127a8 fffffa80c59c1010 \FileName
fffffa80c5ff64d0 Queued fffffa80c5ff62d0   2a   0400de68 fffffa80c59c1010 \FileName
fffffa80c99a84b0 Queued fffffa80c99a82b0   2a   0400cfe8 fffffa80c59c1010 \FileName
fffffa80ca300510 Queued fffffa80ca300310   2a   0400c168 fffffa80c59c1010 \FileName
[...]

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

One Response to “Crash Dump Analysis Patterns (Part 185)”

  1. Dmitry Vostokov Says:

    For Windows 8 and higher there is !storagekd.storclass 2 extension command

Leave a Reply