Access violation, when turning off after removing usb drive

err:(base\system\winlogon\sas.c:1100) Shutting down NT...

(win32ss\user\ntuser\msgqueue.c:2292) err: Thread Cleanup Sent Messages E1788C30

WARNING:  HvHiveWillShrink at sdk\lib\cmlib\hivewrt.c:280 is UNIMPLEMENTED!

WARNING:  HvHiveWillShrink at sdk\lib\cmlib\hivewrt.c:280 is UNIMPLEMENTED!

WARNING:  HvHiveWillShrink at sdk\lib\cmlib\hivewrt.c:280 is UNIMPLEMENTED!

WARNING:  HvHiveWillShrink at sdk\lib\cmlib\hivewrt.c:280 is UNIMPLEMENTED!

WARNING:  HvHiveWillShrink at sdk\lib\cmlib\hivewrt.c:280 is UNIMPLEMENTED!

WARNING:  HvHiveWillShrink at sdk\lib\cmlib\hivewrt.c:280 is UNIMPLEMENTED!

WARNING:  HvHiveWillShrink at sdk\lib\cmlib\hivewrt.c:280 is UNIMPLEMENTED!

WARNING:  HvHiveWillShrink at sdk\lib\cmlib\hivewrt.c:280 is UNIMPLEMENTED!

WARNING:  HvHiveWillShrink at sdk\lib\cmlib\hivewrt.c:280 is UNIMPLEMENTED!

Access violation - code c0000005 (!!! second chance !!!)

nt!IofCallDriver+0xa7:

8046d3b7 8b548138        mov     edx,dword ptr [ecx+eax*4+38h]

kd> kp

ChildEBP RetAddr  

f842f534 f89632f3 nt!IofCallDriver(struct _DEVICE_OBJECT * DeviceObject = 0xb0fd8110, struct _IRP * Irp = 0xb112ace0)+0xa7 [C:\rosgit\ntoskrnl\io\iomgr\irp.c @ 1286]

f842f554 f8958c8d disk!ScsiDiskShutdownFlush(struct _DEVICE_OBJECT * DeviceObject = 0xb0fd8450, struct _IRP * Irp = 0xb112ace0)+0x213 [C:\rosgit\drivers\storage\class\disk\disk.c @ 3140]

f842f570 8046d3bd class2!ScsiClassShutdownFlush(struct _DEVICE_OBJECT * DeviceObject = 0xb0fd8450, struct _IRP * Irp = 0xb112ace0)+0x5d [C:\rosgit\drivers\storage\class\class2\class2.c @ 4552]

f842f598 f7e8c5bc nt!IofCallDriver(struct _DEVICE_OBJECT * DeviceObject = 0xb0fd8450, struct _IRP * Irp = 0xb112ace0)+0xad [C:\rosgit\ntoskrnl\io\iomgr\irp.c @ 1288]

f842f5f4 f7e8c1d8 fastfat!VfatFlushVolume(struct DEVICE_EXTENSION * DeviceExt = 0xb0f220d0, struct _VFATFCB * VolumeFcb = 0xb101be00)+0x2ec [C:\rosgit\drivers\filesystems\fastfat\flush.c @ 119]

f842f618 f7e9015e fastfat!VfatFlush(struct VFAT_IRP_CONTEXT * IrpContext = 0xb0f97e80)+0xa8 [C:\rosgit\drivers\filesystems\fastfat\flush.c @ 168]

f842f648 f7e8f9d3 fastfat!VfatDispatchRequest(struct VFAT_IRP_CONTEXT * IrpContext = 0xb0f97e80)+0x16e [C:\rosgit\drivers\filesystems\fastfat\misc.c @ 173]

f842f66c 8046d3bd fastfat!VfatBuildRequest(struct _DEVICE_OBJECT * DeviceObject = 0xb0f22018, struct _IRP * Irp = 0xb107e8c8)+0xa3 [C:\rosgit\drivers\filesystems\fastfat\misc.c @ 248]

f842f694 80466812 nt!IofCallDriver(struct _DEVICE_OBJECT * DeviceObject = 0xb0f22018, struct _IRP * Irp = 0xb107e8c8)+0xad [C:\rosgit\ntoskrnl\io\iomgr\irp.c @ 1288]

f842f6b8 80466f96 nt!IopPerformSynchronousRequest(struct _DEVICE_OBJECT * DeviceObject = 0xb0f22018, struct _IRP * Irp = 0xb107e8c8, struct _FILE_OBJECT * FileObject = 0xb1073548, unsigned char Deferred = 0x00 '', char PreviousMode = 0n0 '', unsigned char SynchIo = 0x00 '', _IOP_TRANSFER_TYPE TransferType = IopOtherTransfer (2))+0x32 [C:\rosgit\ntoskrnl\io\iomgr\iofunc.c @ 142]

f842f74c 80518e5b nt!NtFlushBuffersFile(void * FileHandle = 0x80000710, struct _IO_STATUS_BLOCK * IoStatusBlock = 0xf842fa38)+0x2c6 [C:\rosgit\ntoskrnl\io\iomgr\iofunc.c @ 1591]

f842f764 80516dbc nt!KiSystemCallTrampoline(void * Handler = 0x80466cd0, void * Arguments = 0xf842f828, unsigned long StackBytes = 8)+0x1b [C:\rosgit\ntoskrnl\include\internal\i386\ke.h @ 766]

f842f7a8 80403d96 nt!KiSystemServiceHandler(struct _KTRAP_FRAME * TrapFrame = 0xf842f7b0, void * Arguments = 0xf842f828)+0x25c [C:\rosgit\ntoskrnl\ke\i386\traphdlr.c @ 1813]

f842f7a8 80401675 nt!KiSystemService+0x60

f842f820 804e868a nt!ZwFlushBuffersFile+0x11

f842fa78 804e899c nt!PopFlushVolumeWorker(void * Context = 0xf842fa84)+0x10a [C:\rosgit\ntoskrnl\po\povolume.c @ 212]

f842faec 804e9432 nt!PopFlushVolumes(unsigned char ShuttingDown = 0x01 '')+0x2ac [C:\rosgit\ntoskrnl\po\povolume.c @ 357]

f842fb7c 80518e5b nt!NtSetSystemPowerState(POWER_ACTION SystemAction = PowerActionShutdownReset (5), _SYSTEM_POWER_STATE MinSystemState = PowerSystemSleeping3 (4), unsigned long Flags = 0xc0000004)+0x422 [C:\rosgit\ntoskrnl\po\power.c @ 974]

f842fb98 80516dbc nt!KiSystemCallTrampoline(void * Handler = 0x804e9010, void * Arguments = 0xf842fc5c, unsigned long StackBytes = 0xc)+0x1b [C:\rosgit\ntoskrnl\include\internal\i386\ke.h @ 766]

f842fbdc 80403d96 nt!KiSystemServiceHandler(struct _KTRAP_FRAME * TrapFrame = 0xf842fbe4, void * Arguments = 0xf842fc5c)+0x25c [C:\rosgit\ntoskrnl\ke\i386\traphdlr.c @ 1813]

f842fbdc 804023a5 nt!KiSystemService+0x60

f842fc54 804e9372 nt!ZwSetSystemPowerState+0x11

f842fcec 8043564a nt!NtSetSystemPowerState(POWER_ACTION SystemAction = PowerActionShutdownReset (5), _SYSTEM_POWER_STATE MinSystemState = PowerSystemSleeping3 (4), unsigned long Flags = 0xc0000004)+0x362 [C:\rosgit\ntoskrnl\po\power.c @ 910]

f842fd04 80518e5b nt!NtShutdownSystem(_SHUTDOWN_ACTION Action = ShutdownReboot (1))+0x4a [C:\rosgit\ntoskrnl\ex\shutdown.c @ 72]

f842fd18 80516dbc nt!KiSystemCallTrampoline(void * Handler = 0x80435600, void * Arguments = 0x0012fcc8, unsigned long StackBytes = 4)+0x1b [C:\rosgit\ntoskrnl\include\internal\i386\ke.h @ 766]

f842fd5c 80403e23 nt!KiSystemServiceHandler(struct _KTRAP_FRAME * TrapFrame = 0xf842fd64, void * Arguments = 0x0012fcc8)+0x25c [C:\rosgit\ntoskrnl\ke\i386\traphdlr.c @ 1813]

f842fd5c 7c932c9e nt!KiFastCallEntry+0x8c

0012fcbc 7c95f756 ntdll!KiFastSystemCallRet

0012fcc0 00404fa5 ntdll!ZwShutdownSystem+0xc

0012fcf0 00404031 winlogon!HandleShutdown(struct _WLSESSION * Session = 0x00135408, unsigned long wlxAction = 0xb)+0x375 [C:\rosgit\base\system\winlogon\sas.c @ 1105]

0012fd08 00406933 winlogon!DoGenericAction(struct _WLSESSION * Session = 0x00135408, unsigned long wlxAction = 0xb)+0x1b1 [C:\rosgit\base\system\winlogon\sas.c @ 1183]

0012fd68 77a8c96a winlogon!SASWindowProc(struct HWND__ * hwndDlg = 0x0002006e, unsigned int uMsg = 0x4c, unsigned int wParam = 0, long lParam = 3)+0x5c3 [C:\rosgit\base\system\winlogon\sas.c @ 1540]

0012fd98 77a7dc61 user32!CALL_EXTERN_WNDPROC+0x1a

0012fe54 77a81194 user32!IntCallWindowProcW(int IsAnsiProc = 0, <function> * WndProc = 0x00406370, struct _WND * pWnd = 0x00541308, struct HWND__ * hWnd = 0x0002006e, unsigned int Msg = 0x4c, unsigned int wParam = 0, long lParam = 3)+0x5c1 [C:\rosgit\win32ss\user\user32\windows\message.c @ 1546]

0012fe88 77a80b6b user32!IntCallMessageProc(struct _WND * Wnd = 0x00541308, struct HWND__ * hWnd = 0x0002006e, unsigned int Msg = 0x4c, unsigned int wParam = 0, long lParam = 3, int Ansi = 0)+0x1d4 [C:\rosgit\win32ss\user\user32\windows\message.c @ 1797]

0012fee4 00409ecb user32!DispatchMessageW(struct tagMSG * lpmsg = 0x0012fef0)+0x1fb [C:\rosgit\win32ss\user\user32\windows\message.c @ 2045]

0012ff38 0040e820 winlogon!WinMain(struct HINSTANCE__ * hInstance = 0x00400000, struct HINSTANCE__ * hPrevInstance = 0x00000000, char * lpCmdLine = 0x001331f4 "", int nShowCmd = 0xa)+0x72b [C:\rosgit\base\system\winlogon\winlogon.c @ 476]

0012ff50 0040e5ec winlogon!main(int flags = 1, char ** cmdline = 0x00133c58, char ** inst = 0x00133f68)+0x20 [C:\rosgit\sdk\lib\crt\startup\crt0_c.c @ 22]

0012ffe8 0040e301 winlogon!__tmainCRTStartup(void)+0x25c [C:\rosgit\sdk\lib\crt\startup\crtexe.c @ 315]

0012fff4 00000000 winlogon!WinMainCRTStartup(void)+0x21 [C:\rosgit\sdk\lib\crt\startup\crtexe.c @ 172]