Bugcheck Code C2 - BAD_POOL_CALLER

Hi Team,

I'm having this issue on Windows 2008 R2 Ent, server was unexpected reboot with Bugcheck C2. Below are the kernel dump logs from Winbdg. 

Can anyone confirm whether below logs related to Ntfs.sys or HP Smart Array driver? 


Based on the dump bugcheck code and call stack, found that BAD_POOL_CALLER. That indicate the current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation.
 

Arguments:

Arg1: 000000000000000b, type of pool violation the caller is guilty of.
Arg2: fffff88008442840
Arg3: 00000000084429a8
Arg4: fffff88008443450


Checking the call stack during crash, found that server crashed when it was allocates pool memory of the specified type and returns a pointer to the allocated block.

STACK_TEXT:  
fffff880`02bc1818 fffff800`023fbca3 : 00000000`000000c2 00000000`0000000b fffff880`08442840 00000000`084429a8 : nt!KeBugCheckEx
fffff880`02bc1820 fffff880`016f9e8b : fffff880`08443380 fffff8a0`05c091a0 fffff800`4146744e fffff8a0`00000493 : nt!ExAllocatePoolWithTag+0x1a0f
fffff880`02bc18d0 fffff880`01656218 : fffffa80`7a79c0a0 fffffa80`89609240 fffff880`08443380 00000000`00000000 : Ntfs!NtfsCommonCreate+0x2534
fffff880`02bc1aa0 fffff800`022ce165 : fffff800`0246e200 fffff800`025c0200 00000000`00000000 00000000`00000000 : Ntfs!NtfsFspDispatch+0x248
fffff880`02bc1b70 fffff800`0255eee6 : 00000000`00000000 fffffa80`79550660 00000000`00000080 fffffa80`79536040 : nt!ExpWorkerThread+0x111
fffff880`02bc1c00 fffff800`022b6706 : fffff880`02472180 fffffa80`79550660 fffff880`0247d4c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02bc1c40 00000000`00000000 : fffff880`02bc2000 fffff880`02bbc000 fffff880`02bc18a0 00000000`00000000 : nt!KiStartSystemThread+0x16

kd> lmDvmNtfs
Browse full module list
start             end                 module name
fffff880`01653000 fffff880`017fb000   Ntfs       (pdb symbols)          C:\ProgramData\dbg\sym\ntfs.pdb\A7E1C0666D2A4377B1235D0C10225CD22\ntfs.pdb
    Loaded symbol image file: Ntfs.sys
    Image path: \SystemRoot\System32\Drivers\Ntfs.sys
    Image name: Ntfs.sys
    Browse all global symbols  functions  data
    Timestamp:        Sat Jan 09 01:50:47 2016 (568FF6F7)
    CheckSum:         0019C464
    ImageSize:        001A8000
    File version:     6.1.7601.23318
    Product version:  6.1.7601.23318

Upon checking Ntfs.sys driver updated with latest  version.



================================================================================================================================================


kd> !analyze -v
*******************************************************************************
*                                                                            *
*                        Bugcheck Analysis                                    *
*                                                                            *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 000000000000000b, type of pool violation the caller is guilty of.
Arg2: fffff88008442840
Arg3: 00000000084429a8
Arg4: fffff88008443450

FAULTING_IP: 
Ntfs!NtfsCommonCreate+2534
fffff880`016f9e8b e9aefbffff      jmp     Ntfs!NtfsCommonCreate+0x20e7 (fffff880`016f9a3e)

BUGCHECK_STR:  0xc2_b



STACK_TEXT:  
fffff880`02bc1818 fffff800`023fbca3 : 00000000`000000c2 00000000`0000000b fffff880`08442840 00000000`084429a8 : nt!KeBugCheckEx
fffff880`02bc1820 fffff880`016f9e8b : fffff880`08443380 fffff8a0`05c091a0 fffff800`4146744e fffff8a0`00000493 : nt!ExAllocatePoolWithTag+0x1a0f
fffff880`02bc18d0 fffff880`01656218 : fffffa80`7a79c0a0 fffffa80`89609240 fffff880`08443380 00000000`00000000 : Ntfs!NtfsCommonCreate+0x2534
fffff880`02bc1aa0 fffff800`022ce165 : fffff800`0246e200 fffff800`025c0200 00000000`00000000 00000000`00000000 : Ntfs!NtfsFspDispatch+0x248
fffff880`02bc1b70 fffff800`0255eee6 : 00000000`00000000 fffffa80`79550660 00000000`00000080 fffffa80`79536040 : nt!ExpWorkerThread+0x111
fffff880`02bc1c00 fffff800`022b6706 : fffff880`02472180 fffffa80`79550660 fffff880`0247d4c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02bc1c40 00000000`00000000 : fffff880`02bc2000 fffff880`02bbc000 fffff880`02bc18a0 00000000`00000000 : nt!KiStartSystemThread+0x16


FOLLOWUP_IP: 
Ntfs!NtfsCommonCreate+2534
fffff880`016f9e8b e9aefbffff      jmp     Ntfs!NtfsCommonCreate+0x20e7 (fffff880`016f9a3e)

FAULT_INSTR_CODE:  fffbaee9

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  Ntfs!NtfsCommonCreate+2534

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  568ff6f7

IMAGE_VERSION:  6.1.7601.23318

FAILURE_BUCKET_ID:  X64_0xc2_b_Ntfs!NtfsCommonCreate+2534

BUCKET_ID:  X64_0xc2_b_Ntfs!NtfsCommonCreate+2534

PRIMARY_PROBLEM_CLASS:  X64_0xc2_b_Ntfs!NtfsCommonCreate+2534

=========================================================================

Regards,

Raja