aswtdi.sys causing Bugcheck 0xC9 in XP

[Mun]

Hi there. Recently my computer crashed due to a driver failure, so I decided to hunt down any problematic drivers on my system. I am using Windows XP with SP2. Avast build version is 4.6.623 but all ALWIL Software provided drivers in windows\system32\drivers (4 of them) are version 4.6.622.0. I used XP's verifier.exe (in the windows\system32 directory) with flags 0xFF (ie, all tests) on all unsigned drivers. After rebooting and using my computer for a few minutes, I got a BSOD with the following message:

"IO system verification error in aswTdi.sys (WDM driver error 226)
[aswTdi.sys + 2C0 at F57DB2C0]"

The event log had this:

"The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000c9 (0x00000226, 0xf57db2c0, 0x00000000, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini040705-02.dmp."

The Minidump that was generated can be downloaded here: http://www.aqum35.dsl.pipex.com/Mini040705-02.dmp.

The problem should be reproducable by following these steps:

1. Start -> Run -> verifier.exe
2. Select the second radio button named "Create custom settings (for code developers)", and click Next.
3. Select the first radio button named "Enable predefined settings" and tick all the checkboxes, and click Next (btw, this is how all the tests are enabled. In the console version of verifier.exe, this means flags 0xFF).
4. Select the fourth radio button named "Select driver names from a list" and click Next.
5. Tick the checkbox whose Drivers column has in it "aswtdi.sys", and click Finish.
6. Click Ok, and reboot the computer.
7. Play around with the computer for a while (I don't know exactly what I was doing or what the computer was doing at this time). The bugcheck should come up here.

Microsoft has some good documents about this:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ddtools/hh/ddtools/DV_680e1a4f-774e-48c3-ab51-913ea291da0d.xml.asp
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ddtools/hh/ddtools/BCCodes_2090fb00-f954-40b5-b360-e32fae6bfa23.xml.asp

The second link says this:

I/O Error Code	Severity	Cause of Error
0x229	Fatal error	A cancel routine has been set for an IRP that is currently being processed by drivers lower in the stack, possibly stomping their cancel routine. (Routine and IRP specified.)

It is possible this driver was the cause of the original crash. The original crash was a failure in the driver tcpip.sys. Microsoft doesn't mention too much about this file, but generally other people on the internet have said BSOD's caused by tcpip.sys is due to another driver failing.

My computer is:

AMD Athlon 2500+ XP
512 MB DDR SDRAM
MSI K7N2 Delta-L (I am using the onboard network adaptor)
2x Hard drives (WD1600JB and WD800JB)

I did a memory test with Memtest86+ v1.50. In 3 passes there were no errors. Please ask me if you need any more information.

[lukor]

"IO system verification error in aswTdi.sys (WDM driver error 226)
[aswTdi.sys + 2C0 at F57DB2C0]"

The event log had this:

"The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000c9 (0x00000226, 0xf57db2c0, 0x00000000, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini040705-02.dmp."
....

I/O Error Code	Severity	Cause of Error
0x229	Fatal error	A cancel routine has been set for an IRP that is currently being processed by drivers lower in the stack, possibly stomping their cancel routine. (Routine and IRP specified.)

The error code 0x229 is not relevant here, but 0x226 does makes sense. Thanks for the heads up. We have just had a look on it with Pk, and it's seems we got really a problem when there is _NO_ memory for the driver - which is exactly what the verifier does with the Low-resource simulation turned on. But this situation could hardly occur during normal runtime without a bugcheck - the system would have been in a catastrophic shape! Anyway thanks, we'll try to return proper status codes when memory could not be allocated (which seems to be the case in the minidump).

Lukas

[Mun]

ah, oops copied the wrong section out the microsoft site :p. Thanks for looking into it. Now I have to write to Creative about one of their drivers that are causing a similar bug, although I very much doubt they will turn their heads.

I'm impressed by the high level of support here, thank you very much .

[pk]

Thanks again for your detailed report . Driver Verifier prepares ugly deep traps for all drivers and it's quite big probability to see BSOD . Anyway, I'd strongly recommend you to turn Driver Verifier off if you dont need it, because it slows down your system.