BSOD with RDR_File_System 0x27

[Keith-s]

Hi all

 

Hope someone can help point me in the right direction to fix this issue.

 

Windows 7 32bit on a domain with Office 2003 installed (SP3). When the users go to save a file from word, randomly, it will give the old BSOD with RDR_File_System 0x27 error.

I have looked at the dump file but can't decifer what the problem is. I can see a file called mrxsmb10.sys is mentioned and this also shows on the Blue Screen. I have updated all drivers on the PC, removed and reinstalled Office as per some of the suggestion I have found on the internet. It's still doing it!

 

This is the Bug check... can any help please?

 

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

 

RDR_FILE_SYSTEM (27)

If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the

exception record and context record. Do a .cxr on the 3rd parameter and then kb to

obtain a more informative stack trace.

The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined

as follows:

RDBSS_BUG_CHECK_CACHESUP = 0xca550000,

RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,

RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,

RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,

Arguments:

Arg1: baad0073

Arg2: b01f05e4

Arg3: b01f01c0

Arg4: 95d2a755

 

Debugging Details:

------------------

 

 

EXCEPTION_RECORD: b01f05e4 -- (.exr 0xffffffffb01f05e4)

ExceptionAddress: 95d2a755 (mrxsmb10!MRxSmbBuildWriteRequest+0x000001c9)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000000

Parameter[1]: 00000008

Attempt to read from address 00000008

 

CONTEXT: b01f01c0 -- (.cxr 0xffffffffb01f01c0)

eax=00000000 ebx=00000a01 ecx=00000000 edx=b044c080 esi=85e5d160 edi=00000000

eip=95d2a755 esp=b01f06ac ebp=b01f0724 iopl=0 nv up ei pl nz na po nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202

mrxsmb10!MRxSmbBuildWriteRequest+0x1c9:

95d2a755 0fb74008 movzx eax,word ptr [eax+8] ds:0023:00000008=????

Resetting default scope

 

PROCESS_NAME: WINWORD.EXE

 

CURRENT_IRQL: 0

 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

 

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

 

EXCEPTION_PARAMETER1: 00000000

 

EXCEPTION_PARAMETER2: 00000008

 

READ_ADDRESS: 00000008

 

FOLLOWUP_IP:

mrxsmb10!MRxSmbBuildWriteRequest+1c9

95d2a755 0fb74008 movzx eax,word ptr [eax+8]

 

FAULTING_IP:

mrxsmb10!MRxSmbBuildWriteRequest+1c9

95d2a755 0fb74008 movzx eax,word ptr [eax+8]

 

BUGCHECK_STR: 0x27

 

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

 

LAST_CONTROL_TRANSFER: from 95d2aa90 to 95d2a755

 

STACK_TEXT:

b01f0724 95d2aa90 00e5d160 b01f0700 0000002f mrxsmb10!MRxSmbBuildWriteRequest+0x1c9

b01f076c 95d20023 85d27268 85e73008 b01f07a0 mrxsmb10!SmbPseExchangeStart_Write+0x195

b01f077c 95d19781 85e5d160 00000200 95d16000 mrxsmb10!SmbPseExchangeStart_default+0x12

b01f07a0 95d2b4de 01000000 85e73098 85e73008 mrxsmb10!SmbCeInitiateExchange+0x3fd

b01f07e4 95ceb9ed 85e73008 b01f0850 90e1d168 mrxsmb10!MRxSmbWrite+0x348

b01f07f0 90e1d168 85e73008 85e73360 85e73008 mrxsmb!SmbShellWrite+0x1e

b01f0850 8b95b5a4 00e73008 8b94e7d4 8b950000 csc!CscWrite+0x2c8

b01f0870 8b9683dd 01e73008 85c3bd28 c24254a8 rdbss!RxLowIoSubmit+0x24c

b01f0894 8b946aed 85e73008 85c3bd28 c24254a8 rdbss!RxLowIoWriteShell+0x67

b01f0964 8b96833b 85e73008 85c3bd28 c24254a8 rdbss!RxCommonFileWrite+0x1412

b01f0988 8b93fefc 85e73008 cba0c8b0 3b8a0f9e rdbss!RxCommonWrite+0xb6

b01f0a10 8b9562c9 8b950240 85c3bd28 899ad968 rdbss!RxFsdCommonDispatch+0x646

b01f0a40 95cf76a2 894f1780 04c3bd28 85c3bde0 rdbss!RxFsdDispatch+0x1ab

b01f0a5c 82c895be 894f1780 01c3bd28 85c3be04 mrxsmb!MRxSmbFsdDispatch+0x9a

b01f0a74 8b7ebbb0 00000103 857f0998 899ad968 nt!IofCallDriver+0x63

b01f0a90 8b7eab52 857f0998 00000000 85c3bd28 mup!MupiCallUncProvider+0x10f

b01f0aa8 8b7eb13e 857f0998 00000000 85554cf8 mup!MupStateMachine+0x9b

b01f0ac0 82c895be 85554cf8 857f0998 85c3bd28 mup!MupFsdIrpPassThrough+0x93

b01f0ad8 8b2d220c 85554400 85c3bd28 00000000 nt!IofCallDriver+0x63

b01f0afc 8b2d23cb b01f0b1c 85554400 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa

b01f0b34 82c895be 85554400 85c3bd28 85c3bd28 fltmgr!FltpDispatch+0xc5

b01f0b4c 82e7cb09 899ad968 85c3bd28 85c3be04 nt!IofCallDriver+0x63

b01f0b6c 82ec2840 85554400 899ad968 00000001 nt!IopSynchronousServiceTail+0x1f8

b01f0c08 82c9027a 85554400 00000000 00000000 nt!NtWriteFile+0x6e8

b01f0c08 77687094 85554400 00000000 00000000 nt!KiFastCallEntry+0x12a

WARNING: Frame IP not in any known module. Following frames may be wrong.

0e74b38c 00000000 00000000 00000000 00000000 0x77687094

 

 

SYMBOL_STACK_INDEX: 0

 

SYMBOL_NAME: mrxsmb10!MRxSmbBuildWriteRequest+1c9

 

FOLLOWUP_NAME: MachineOwner

 

MODULE_NAME: mrxsmb10

 

IMAGE_NAME: mrxsmb10.sys

 

DEBUG_FLR_IMAGE_TIMESTAMP: 4e17bd25

 

STACK_COMMAND: .cxr 0xffffffffb01f01c0 ; kb

 

FAILURE_BUCKET_ID: 0x27_mrxsmb10!MRxSmbBuildWriteRequest+1c9

 

BUCKET_ID: 0x27_mrxsmb10!MRxSmbBuildWriteRequest+1c9

 

Followup: MachineOwner

---------

 

Cheers

 

Keith

[MattGibson]

Did you find out what was causing this??

 

Same issue with toshiba L300 & c600

 

Matt

[Keith-s]

No Matt, still have same issue after applying various Hot Fixes from MS... Still on the case... if and when I do find a resolution to it I'll post up here.

[Steve21]

By any chance you using Linux samba shares?

 

Steve

[MattGibson]

No Linux shares all windows based. These machines were working fine on XP but now that I've moved them all over to Win 7 everyone's getting BSOD with the same error message. I have also tried various MS patches but still no joy! Oviously a driver issue but I've used all the manufacture drivers from the web!

[Keith-s]

Same here, no Linux...just Server 2003, Office 2003 and Windows 7 and like Matt, I've also updated all drivers from web with latest versions... no luck so far

[DMcCoy]

What antivirus? Any quotas/file type filters on the server?

[Keith-s]

ESET AV, no quotas or file filters used. Though progress this morning has been made... 2 Macromedia Studio pluggins in word were disabled this morning as so far no crashes... time will tell.

[MattGibson]

Hi Guys,

 

We are also using ESET AV which I don't think is at fault as its the same version/package that we used on XP. Today I have turned off Windows Search (indexing) service to see If this resolves the issue.

 

Keith, Interesting about the Macromedia - keep is posted with the outcome over the next few days!!

[plexer]

Just because xp didn't bsod with eset doesn't mean it's not a possibility with win7

 

Ben

[MattGibson]

Hi Keith,

 

Just to let you know by completely disabling the Windows Search Service by GPO seems to have solved this issue for us, It's now coming up to over a week without a BSOD. I hope this post will help someone else out.

 

Regards

Matt

[Keith-s]

Thanks for the update Matt.. We were going to remove Macromedia Studio to see if that stopped the BSOD... I'll give this a go first...

 

Cheers

 

Keith

[Keith-s]

Well, GPO set, lets see if that cures it...

[Keith-s]

I could be tempting fate here, but since GPO was applied this morning, no bluescreens... We would normally have had 2 or 3 in the course of an afternoon.... good find Matt !

[Keith-s]

Can confirm that this seems to have cured the error. Only one BS since Monday, normally at least a couple per lesson.