BSOD with RDR_File_System 0x27

[Keith-s]

Hi all

Hope someone can help point me in the right direction to fix this issue.

Windows 7 32bit on a domain with Office 2003 installed (SP3). When the users go to save a file from word, randomly, it will give the old BSOD with RDR_File_System 0x27 error.
I have looked at the dump file but can't decifer what the problem is. I can see a file called mrxsmb10.sys is mentioned and this also shows on the Blue Screen. I have updated all drivers on the PC, removed and reinstalled Office as per some of the suggestion I have found on the internet. It's still doing it!

This is the Bug check... can any help please?

************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

RDR_FILE_SYSTEM (27)
If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: baad0073
Arg2: b01f05e4
Arg3: b01f01c0
Arg4: 95d2a755

Debugging Details:
------------------


EXCEPTION_RECORD: b01f05e4 -- (.exr 0xffffffffb01f05e4)
ExceptionAddress: 95d2a755 (mrxsmb10!MRxSmbBuildWriteRequest+0x000001c9)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000008
Attempt to read from address 00000008

CONTEXT: b01f01c0 -- (.cxr 0xffffffffb01f01c0)
eax=00000000 ebx=00000a01 ecx=00000000 edx=b044c080 esi=85e5d160 edi=00000000
eip=95d2a755 esp=b01f06ac ebp=b01f0724 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
mrxsmb10!MRxSmbBuildWriteRequest+0x1c9:
95d2a755 0fb74008 movzx eax,word ptr [eax+8] ds:0023:00000008=????
Resetting default scope

PROCESS_NAME: WINWORD.EXE

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 00000008

READ_ADDRESS: 00000008

FOLLOWUP_IP:
mrxsmb10!MRxSmbBuildWriteRequest+1c9
95d2a755 0fb74008 movzx eax,word ptr [eax+8]

FAULTING_IP:
mrxsmb10!MRxSmbBuildWriteRequest+1c9
95d2a755 0fb74008 movzx eax,word ptr [eax+8]

BUGCHECK_STR: 0x27

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER: from 95d2aa90 to 95d2a755

STACK_TEXT:
b01f0724 95d2aa90 00e5d160 b01f0700 0000002f mrxsmb10!MRxSmbBuildWriteRequest+0x1c9
b01f076c 95d20023 85d27268 85e73008 b01f07a0 mrxsmb10!SmbPseExchangeStart_Write+0x195
b01f077c 95d19781 85e5d160 00000200 95d16000 mrxsmb10!SmbPseExchangeStart_default+0x12
b01f07a0 95d2b4de 01000000 85e73098 85e73008 mrxsmb10!SmbCeInitiateExchange+0x3fd
b01f07e4 95ceb9ed 85e73008 b01f0850 90e1d168 mrxsmb10!MRxSmbWrite+0x348
b01f07f0 90e1d168 85e73008 85e73360 85e73008 mrxsmb!SmbShellWrite+0x1e
b01f0850 8b95b5a4 00e73008 8b94e7d4 8b950000 csc!CscWrite+0x2c8
b01f0870 8b9683dd 01e73008 85c3bd28 c24254a8 rdbss!RxLowIoSubmit+0x24c
b01f0894 8b946aed 85e73008 85c3bd28 c24254a8 rdbss!RxLowIoWriteShell+0x67
b01f0964 8b96833b 85e73008 85c3bd28 c24254a8 rdbss!RxCommonFileWrite+0x1412
b01f0988 8b93fefc 85e73008 cba0c8b0 3b8a0f9e rdbss!RxCommonWrite+0xb6
b01f0a10 8b9562c9 8b950240 85c3bd28 899ad968 rdbss!RxFsdCommonDispatch+0x646
b01f0a40 95cf76a2 894f1780 04c3bd28 85c3bde0 rdbss!RxFsdDispatch+0x1ab
b01f0a5c 82c895be 894f1780 01c3bd28 85c3be04 mrxsmb!MRxSmbFsdDispatch+0x9a
b01f0a74 8b7ebbb0 00000103 857f0998 899ad968 nt!IofCallDriver+0x63
b01f0a90 8b7eab52 857f0998 00000000 85c3bd28 mup!MupiCallUncProvider+0x10f
b01f0aa8 8b7eb13e 857f0998 00000000 85554cf8 mup!MupStateMachine+0x9b
b01f0ac0 82c895be 85554cf8 857f0998 85c3bd28 mup!MupFsdIrpPassThrough+0x93
b01f0ad8 8b2d220c 85554400 85c3bd28 00000000 nt!IofCallDriver+0x63
b01f0afc 8b2d23cb b01f0b1c 85554400 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksComple ted+0x2aa
b01f0b34 82c895be 85554400 85c3bd28 85c3bd28 fltmgr!FltpDispatch+0xc5
b01f0b4c 82e7cb09 899ad968 85c3bd28 85c3be04 nt!IofCallDriver+0x63
b01f0b6c 82ec2840 85554400 899ad968 00000001 nt!IopSynchronousServiceTail+0x1f8
b01f0c08 82c9027a 85554400 00000000 00000000 nt!NtWriteFile+0x6e8
b01f0c08 77687094 85554400 00000000 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0e74b38c 00000000 00000000 00000000 00000000 0x77687094


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: mrxsmb10!MRxSmbBuildWriteRequest+1c9

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mrxsmb10

IMAGE_NAME: mrxsmb10.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4e17bd25

STACK_COMMAND: .cxr 0xffffffffb01f01c0 ; kb

FAILURE_BUCKET_ID: 0x27_mrxsmb10!MRxSmbBuildWriteRequest+1c9

BUCKET_ID: 0x27_mrxsmb10!MRxSmbBuildWriteRequest+1c9

Followup: MachineOwner
---------

Cheers

Keith

[MattGibson]

Did you find out what was causing this??

Same issue with toshiba L300 & c600

Matt

[Keith-s]

No Matt, still have same issue after applying various Hot Fixes from MS... Still on the case... if and when I do find a resolution to it I'll post up here.

[Steve21]

By any chance you using Linux samba shares?

Steve

[MattGibson]

No Linux shares all windows based. These machines were working fine on XP but now that I've moved them all over to Win 7 everyone's getting BSOD with the same error message. I have also tried various MS patches but still no joy! Oviously a driver issue but I've used all the manufacture drivers from the web!

[Keith-s]

Same here, no Linux...just Server 2003, Office 2003 and Windows 7 and like Matt, I've also updated all drivers from web with latest versions... no luck so far

[DMcCoy]

What antivirus? Any quotas/file type filters on the server?

[Keith-s]

ESET AV, no quotas or file filters used. Though progress this morning has been made... 2 Macromedia Studio pluggins in word were disabled this morning as so far no crashes... time will tell.

[MattGibson]

Hi Guys,

We are also using ESET AV which I don't think is at fault as its the same version/package that we used on XP. Today I have turned off Windows Search (indexing) service to see If this resolves the issue.

Keith, Interesting about the Macromedia - keep is posted with the outcome over the next few days!!

[plexer]

Just because xp didn't bsod with eset doesn't mean it's not a possibility with win7

Ben

[MattGibson]

Hi Keith,

Just to let you know by completely disabling the Windows Search Service by GPO seems to have solved this issue for us, It's now coming up to over a week without a BSOD. I hope this post will help someone else out.

Regards
Matt

[Keith-s]

Thanks for the update Matt.. We were going to remove Macromedia Studio to see if that stopped the BSOD... I'll give this a go first...

Cheers

Keith

[Keith-s]

Well, GPO set, lets see if that cures it...

[Keith-s]

I could be tempting fate here, but since GPO was applied this morning, no bluescreens... We would normally have had 2 or 3 in the course of an afternoon.... good find Matt !

[Keith-s]

Can confirm that this seems to have cured the error. Only one BS since Monday, normally at least a couple per lesson.