TCPIP address file receive queue corrupted after running mshtml:htmllocation

htmllocation: 141 tests executed (0 marked as todo, 1 failure), 0 skipped.

TCP operation failed: 0xc0000128 (-12)

TCP operation failed: 0xc0000128 (-12)

*** Fatal System Error: 0x0000000a

                       (0x00000034,0xFFFFFFFF,0x00000000,0x80405508)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.

Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

Connected to Windows Server 2003 3790 x86 compatible target at (Mon Oct 13 14:17:04.136 2014 (UTC + 2:00)), ptr64 FALSE

Loading Kernel Symbols

...................................................

Loading User Symbols

................................................................

.

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {34, ffffffff, 0, 80405508}

Probably caused by : tcpip.sys ( tcpip!AddrFileFree+e9 )

Followup: MachineOwner

---------

nt!RtlpBreakWithStatusInstruction:

80525638 cc              int     3

kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high.  This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: 00000034, memory referenced

Arg2: ffffffff, IRQL

Arg3: 00000000, bitfield :

	bit 0 : value 0 = read operation, 1 = write operation

	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)

Arg4: 80405508, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS:  00000034 

CURRENT_IRQL:  0

FAULTING_IP: 

nt!RtlpCheckListEntry+8 [c:\ros\reactos-clean\reactos\include\ddk\wdm.h @ 9685]

80405508 8b5104          mov     edx,dword ptr [ecx+4]

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  mshtml_winetest

TRAP_FRAME:  00000018 -- (.trap 0x18)

Unable to read trap frame at 00000018

LAST_CONTROL_TRANSFER:  from 804856b6 to 80525638

STACK_TEXT:  

f817c530 804856b6 00000003 f817c850 ffdff408 nt!RtlpBreakWithStatusInstruction

f817c560 80485f32 00000003 01dbdb40 01dbdae8 nt!KiBugCheckDebugBreak+0x36 [c:\ros\reactos-clean\reactos\ntoskrnl\ke\bug.c @ 536]

f817c8fc 8050d0e6 0000000a 00000034 ffffffff nt!KeBugCheckWithTf+0x4f2 [c:\ros\reactos-clean\reactos\ntoskrnl\ke\bug.c @ 1084]

f817c938 804036df f817c9b4 80405508 8040b83a nt!KiTrap0EHandler+0xc6 [c:\ros\reactos-clean\reactos\ntoskrnl\ke\i386\traphdlr.c @ 1234]

f817c938 80405508 f817c9b4 80405508 8040b83a nt!KiTrap0E+0x8f

f817c9b4 8040818f b0fac604 b0fac5b0 01fac604 nt!RtlpCheckListEntry+0x8 [c:\ros\reactos-clean\reactos\include\ddk\wdm.h @ 9685]

f817c9c8 804345d0 b0fac604 b0fac5b0 b0fac604 nt!RemoveHeadList+0xf [c:\ros\reactos-clean\reactos\include\ddk\wdm.h @ 9722]

f817c9e4 f87cf7b9 00000000 00000001 ffdff000 nt!ExfInterlockedRemoveHeadList+0x40 [c:\ros\reactos-clean\reactos\ntoskrnl\ex\interlocked.c @ 391]

f817ca08 f87d005a b0fac5a0 00000001 00000001 tcpip!AddrFileFree+0xe9 [c:\ros\reactos-clean\reactos\drivers\network\tcpip\tcpip\fileobjs.c @ 329]

f817ca2c f87d1ac6 f817ca48 00000001 b0f064a0 tcpip!FileCloseAddress+0x1ba [c:\ros\reactos-clean\reactos\drivers\network\tcpip\tcpip\fileobjs.c @ 588]

f817ca58 f87d1b6d b1233408 b0fa9cf8 8046f302 tcpip!TiCloseFileObject+0x96 [c:\ros\reactos-clean\reactos\drivers\network\tcpip\tcpip\main.c @ 304]

f817ca74 8046fd59 b1233408 b0fa9cf8 00000001 tcpip!TiDispatchOpenClose+0x4d [c:\ros\reactos-clean\reactos\drivers\network\tcpip\tcpip\main.c @ 356]

f817ca98 8046359e 00000001 b1313ac0 b1233408 nt!IofCallDriver+0xa9 [c:\ros\reactos-clean\reactos\ntoskrnl\io\iomgr\irp.c @ 1205]

f817cad0 804dcafd b0f06788 00000000 00000000 nt!IopDeleteFile+0x1ce [c:\ros\reactos-clean\reactos\ntoskrnl\io\iomgr\file.c @ 1035]

f817caf8 804e0c5c b0f06788 00000000 00000001 nt!ObpDeleteObject+0x19d [c:\ros\reactos-clean\reactos\ntoskrnl\ob\oblife.c @ 212]

f817cb18 804d8e6e b1313ac0 b0f06788 c0502400 nt!ObfDereferenceObject+0xbc [c:\ros\reactos-clean\reactos\ntoskrnl\ob\obref.c @ 239]

f817cb34 804da187 e1ad6eb8 e1afa2b8 0000015c nt!ObpCloseHandleTableEntry+0x1ae [c:\ros\reactos-clean\reactos\ntoskrnl\ob\obhandle.c @ 759]

f817cb54 8042f661 e1afa2b8 0000015c f817cba0 nt!ObpCloseHandleCallback+0x27 [c:\ros\reactos-clean\reactos\ntoskrnl\ob\obhandle.c @ 1906]

f817cb70 804da4aa e1ad6eb8 804da160 f817cba0 nt!ExSweepHandleTable+0x81 [c:\ros\reactos-clean\reactos\ntoskrnl\ex\handle.c @ 1217]

f817cbb0 804e8ec9 b0fbcd88 01dbdb40 01dbdae8 nt!ObKillProcess+0x12a [c:\ros\reactos-clean\reactos\ntoskrnl\ob\obhandle.c @ 2103]

f817cc7c 804e91d0 00000000 00000000 f817cce0 nt!PspExitThread+0x999 [c:\ros\reactos-clean\reactos\ntoskrnl\ps\kill.c @ 839]

f817cc8c 804843fd b0fe2c78 f817ccdc f817ccb8 nt!PsExitSpecialApc+0x80 [c:\ros\reactos-clean\reactos\ntoskrnl\ps\kill.c @ 941]

f817cce0 8050ddc5 00000001 00000000 f817cd64 nt!KiDeliverApc+0x34d [c:\ros\reactos-clean\reactos\ntoskrnl\ke\apc.c @ 481]

f817ccfc 8050d9dd f817cd64 f817cd28 8050bd6d nt!KiCheckForApcDelivery+0x65 [c:\ros\reactos-clean\reactos\ntoskrnl\include\internal\i386\ke.h @ 762]

f817cd08 8050bd6d f817cd64 00000000 00000001 nt!KiCommonExit+0xd [c:\ros\reactos-clean\reactos\ntoskrnl\ke\i386\traphdlr.c @ 97]

f817cd28 8050d954 ffdff6b8 01dbdac0 f817cd64 nt!KiServiceExit+0x8d [c:\ros\reactos-clean\reactos\ntoskrnl\ke\i386\traphdlr.c @ 155]

f817cd5c 80403e03 01dbdb40 7c92d01e badb0d00 nt!KiSystemServiceHandler+0x264 [c:\ros\reactos-clean\reactos\ntoskrnl\ke\i386\traphdlr.c @ 1721]

f817cd5c 7c92d01e 01dbdb40 7c92d01e badb0d00 nt!KiFastCallEntry+0x8c

01dbdab4 7c9515a7 72cb3f92 00000138 00000154 ntdll!KiFastSystemCallRet

01dbdab8 72cb3f92 00000138 00000154 00000000 ntdll!NtDeviceIoControlFile+0xc

01dbdb40 778d3409 00000138 0197d3f8 00000010 msafd!WSPConnect+0x382 [c:\ros\reactos-clean\reactos\dll\win32\msafd\misc\dllmain.c @ 1594]

01dbdb88 778d336c 00000138 0197d3f8 00000010 ws2_32!WSAConnect+0x89 [c:\ros\reactos-clean\reactos\dll\win32\ws2_32\misc\dllmain.c @ 732]

01dbdbac 75fa9d09 00000138 0197d3f8 00000010 ws2_32!connect+0x1c [c:\ros\reactos-clean\reactos\dll\win32\ws2_32\misc\dllmain.c @ 692]

01dbdd14 75fa9bfd 0197d3e8 01808f90 0000ea60 wininet!create_netconn_socket+0xb9 [c:\ros\reactos-clean\reactos\dll\win32\wininet\netconnection.c @ 266]

01dbdd30 75f9bd6c 00000000 0197d3e8 00000000 wininet!create_netconn+0x8d [c:\ros\reactos-clean\reactos\dll\win32\wininet\netconnection.c @ 333]

01dbdd6c 75f98d85 0192f7b8 01dbfe28 00000000 wininet!open_http_connection+0x30c [c:\ros\reactos-clean\reactos\dll\win32\wininet\http.c @ 4757]

01dbfed0 75f9c7be 0192f7b8 0197d670 0000001e wininet!HTTP_HttpSendRequestW+0x425 [c:\ros\reactos-clean\reactos\dll\win32\wininet\http.c @ 4882]

01dbfefc 75fa79e3 0197d648 00000000 0197d648 wininet!AsyncHttpSendRequestProc+0x9e [c:\ros\reactos-clean\reactos\dll\win32\wininet\http.c @ 5149]

01dbff10 7c962c45 0197d648 00000000 00000000 wininet!INTERNET_WorkerThreadFunc+0x63 [c:\ros\reactos-clean\reactos\dll\win32\wininet\internet.c @ 3799]

01dbff5c 7c9635ae 00000000 00000000 01997180 ntdll!RtlpExecuteWorkItem+0xb5 [c:\ros\reactos-clean\reactos\lib\rtl\workitem.c @ 227]

01dbffb8 77d99c24 0012e378 00000000 00000000 ntdll!RtlpWorkerThreadProc+0xbe [c:\ros\reactos-clean\reactos\lib\rtl\workitem.c @ 724]

01dbffec 00000000 7c9634f0 0012e378 00000000 kernel32!BaseThreadStartup+0x54 [c:\ros\reactos-clean\reactos\dll\win32\kernel32\client\thread.c @ 69]

STACK_COMMAND:  kb

FOLLOWUP_IP: 

tcpip!AddrFileFree+e9 [c:\ros\reactos-clean\reactos\drivers\network\tcpip\tcpip\fileobjs.c @ 329]

f87cf7b9 8945ec          mov     dword ptr [ebp-14h],eax

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  tcpip!AddrFileFree+e9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tcpip

IMAGE_NAME:  tcpip.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  543b9073

FAILURE_BUCKET_ID:  0xA_tcpip!AddrFileFree+e9

BUCKET_ID:  0xA_tcpip!AddrFileFree+e9

Followup: MachineOwner

---------

kd> .trap 0xf817c940 

ErrCode = 00000000

eax=b0fac604 ebx=0012e378 ecx=00000030 edx=00000000 esi=01dbdae8 edi=01dbdb40

eip=80405508 esp=f817c9b4 ebp=f817c9b4 iopl=0         nv up di ng nz na pe nc

cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010086

nt!RtlpCheckListEntry+0x8:

80405508 8b5104          mov     edx,dword ptr [ecx+4] ds:0023:00000034=????????

kd> kp

  *** Stack trace for last set context - .thread/.cxr resets it

ChildEBP RetAddr  

f817c9b4 8040818f nt!RtlpCheckListEntry(struct _LIST_ENTRY * Entry = 0xb0fac604 [ 0x30 - 0xb0fac604 ])+0x8 [c:\ros\reactos-clean\reactos\include\ddk\wdm.h @ 9685]

f817c9c8 804345d0 nt!RemoveHeadList(struct _LIST_ENTRY * ListHead = 0xb0fac604 [ 0x30 - 0xb0fac604 ])+0xf [c:\ros\reactos-clean\reactos\include\ddk\wdm.h @ 9722]

f817c9e4 f87cf7b9 nt!ExfInterlockedRemoveHeadList(struct _LIST_ENTRY * ListHead = 0xb0fac604 [ 0x30 - 0xb0fac604 ], unsigned long * Lock = 0xb0fac5b0)+0x40 [c:\ros\reactos-clean\reactos\ntoskrnl\ex\interlocked.c @ 391]

f817ca08 f87d005a tcpip!AddrFileFree(void * Object = 0xb0fac5a0)+0xe9 [c:\ros\reactos-clean\reactos\drivers\network\tcpip\tcpip\fileobjs.c @ 329]

f817ca2c f87d1ac6 tcpip!FileCloseAddress(struct _TDI_REQUEST * Request = 0xf817ca48)+0x1ba [c:\ros\reactos-clean\reactos\drivers\network\tcpip\tcpip\fileobjs.c @ 588]

f817ca58 f87d1b6d tcpip!TiCloseFileObject(struct _DEVICE_OBJECT * DeviceObject = 0xb1233408, struct _IRP * Irp = 0xb0fa9cf8)+0x96 [c:\ros\reactos-clean\reactos\drivers\network\tcpip\tcpip\main.c @ 304]

f817ca74 8046fd59 tcpip!TiDispatchOpenClose(struct _DEVICE_OBJECT * DeviceObject = 0xb1233408, struct _IRP * Irp = 0xb0fa9cf8)+0x4d [c:\ros\reactos-clean\reactos\drivers\network\tcpip\tcpip\main.c @ 356]

f817ca98 8046359e nt!IofCallDriver(struct _DEVICE_OBJECT * DeviceObject = 0xb1233408, struct _IRP * Irp = 0xb0fa9cf8)+0xa9 [c:\ros\reactos-clean\reactos\ntoskrnl\io\iomgr\irp.c @ 1205]

f817cad0 804dcafd nt!IopDeleteFile(void * ObjectBody = 0xb0f06788)+0x1ce [c:\ros\reactos-clean\reactos\ntoskrnl\io\iomgr\file.c @ 1035]

f817caf8 804e0c5c nt!ObpDeleteObject(void * Object = 0xb0f06788, unsigned char CalledFromWorkerThread = 0x00 '')+0x19d [c:\ros\reactos-clean\reactos\ntoskrnl\ob\oblife.c @ 212]

f817cb18 804d8e6e nt!ObfDereferenceObject(void * Object = 0xb0f06788)+0xbc [c:\ros\reactos-clean\reactos\ntoskrnl\ob\obref.c @ 239]

f817cb34 804da187 nt!ObpCloseHandleTableEntry(struct _HANDLE_TABLE * HandleTable = 0xe1ad6eb8, struct _HANDLE_TABLE_ENTRY * HandleEntry = 0xe1afa2b8, void * Handle = 0x0000015c, char AccessMode = 0n0 '', unsigned char IgnoreHandleProtection = 0x01 '')+0x1ae [c:\ros\reactos-clean\reactos\ntoskrnl\ob\obhandle.c @ 759]

f817cb54 8042f661 nt!ObpCloseHandleCallback(struct _HANDLE_TABLE_ENTRY * HandleTableEntry = 0xe1afa2b8, void * Handle = 0x0000015c, void * Context = 0xf817cba0)+0x27 [c:\ros\reactos-clean\reactos\ntoskrnl\ob\obhandle.c @ 1906]

f817cb70 804da4aa nt!ExSweepHandleTable(struct _HANDLE_TABLE * HandleTable = 0xe1ad6eb8, <function> * EnumHandleProcedure = 0x804da160, void * Context = 0xf817cba0)+0x81 [c:\ros\reactos-clean\reactos\ntoskrnl\ex\handle.c @ 1217]

f817cbb0 804e8ec9 nt!ObKillProcess(struct _EPROCESS * Process = 0xb0fbcd88)+0x12a [c:\ros\reactos-clean\reactos\ntoskrnl\ob\obhandle.c @ 2103]

f817cc7c 804e91d0 nt!PspExitThread(long ExitStatus = 0)+0x999 [c:\ros\reactos-clean\reactos\ntoskrnl\ps\kill.c @ 839]

f817cc8c 804843fd nt!PsExitSpecialApc(struct _KAPC * Apc = 0xb0fe2c78, <function> ** NormalRoutine = 0xf817ccdc, void ** NormalContext = 0xf817ccb8, void ** SystemArgument1 = 0xf817ccd4, void ** SystemArgument2 = 0xf817ccd8)+0x80 [c:\ros\reactos-clean\reactos\ntoskrnl\ps\kill.c @ 941]

f817cce0 8050ddc5 nt!KiDeliverApc(char DeliveryMode = 0n1 '', struct _KEXCEPTION_FRAME * ExceptionFrame = 0x00000000, struct _KTRAP_FRAME * TrapFrame = 0xf817cd64)+0x34d [c:\ros\reactos-clean\reactos\ntoskrnl\ke\apc.c @ 481]

f817ccfc 8050d9dd nt!KiCheckForApcDelivery(struct _KTRAP_FRAME * TrapFrame = 0xf817cd64)+0x65 [c:\ros\reactos-clean\reactos\ntoskrnl\include\internal\i386\ke.h @ 762]

f817cd08 8050bd6d nt!KiCommonExit(struct _KTRAP_FRAME * TrapFrame = 0xf817cd64, unsigned char SkipPreviousMode = 0x00 '')+0xd [c:\ros\reactos-clean\reactos\ntoskrnl\ke\i386\traphdlr.c @ 97]

f817cd28 8050d954 nt!KiServiceExit(struct _KTRAP_FRAME * TrapFrame = 0xf817cd64, long Status = 0x103)+0x8d [c:\ros\reactos-clean\reactos\ntoskrnl\ke\i386\traphdlr.c @ 155]

f817cd5c 80403e03 nt!KiSystemServiceHandler(struct _KTRAP_FRAME * TrapFrame = 0xf817cd64, void * Arguments = 0x01dbdac0)+0x264 [c:\ros\reactos-clean\reactos\ntoskrnl\ke\i386\traphdlr.c @ 1721]

f817cd5c 7c92d01e nt!KiFastCallEntry+0x8c

01dbdab4 7c9515a7 ntdll!KiFastSystemCallRet

01dbdab8 72cb3f92 ntdll!NtDeviceIoControlFile+0xc

01dbdb40 778d3409 msafd!WSPConnect(unsigned int Handle = 0x138, struct sockaddr * SocketAddress = 0x0197d3f8, int SocketAddressLength = 0x10, struct _WSABUF * lpCallerData = 0x00000000, struct _WSABUF * lpCalleeData = 0x00000000, struct _QualityOfService * lpSQOS = 0x00000000, struct _QualityOfService * lpGQOS = 0x00000000, int * lpErrno = 0x01dbdb70)+0x382 [c:\ros\reactos-clean\reactos\dll\win32\msafd\misc\dllmain.c @ 1594]

01dbdb88 778d336c ws2_32!WSAConnect(unsigned int s = 0x138, struct sockaddr * name = 0x0197d3f8, int namelen = 0x10, struct _WSABUF * lpCallerData = 0x00000000, struct _WSABUF * lpCalleeData = 0x00000000, struct _QualityOfService * lpSQOS = 0x00000000, struct _QualityOfService * lpGQOS = 0x00000000)+0x89 [c:\ros\reactos-clean\reactos\dll\win32\ws2_32\misc\dllmain.c @ 732]

01dbdbac 75fa9d09 ws2_32!connect(unsigned int s = 0x138, struct sockaddr * name = 0x0197d3f8, int namelen = 0x10)+0x1c [c:\ros\reactos-clean\reactos\dll\win32\ws2_32\misc\dllmain.c @ 692]

01dbdd14 75fa9bfd wininet!create_netconn_socket(struct server_t * server = 0x0197d3e8, struct netconn_t * netconn = 0x01808f90, unsigned int timeout = 0xea60)+0xb9 [c:\ros\reactos-clean\reactos\dll\win32\wininet\netconnection.c @ 266]

01dbdd30 75f9bd6c wininet!create_netconn(int useSSL = 0, struct server_t * server = 0x0197d3e8, unsigned int security_flags = 0, int mask_errors = 1, unsigned int timeout = 0xea60, struct netconn_t ** ret = 0x01dbdd60)+0x8d [c:\ros\reactos-clean\reactos\dll\win32\wininet\netconnection.c @ 333]

01dbdd6c 75f98d85 wininet!open_http_connection(struct http_request_t * request = 0x0192f7b8, int * reusing = 0x01dbfe28)+0x30c [c:\ros\reactos-clean\reactos\dll\win32\wininet\http.c @ 4757]

01dbfed0 75f9c7be wininet!HTTP_HttpSendRequestW(struct http_request_t * request = 0x0192f7b8, wchar_t * lpszHeaders = 0x0197d670 "Accept-Encoding: gzip, deflate灰獳???", unsigned int dwHeaderLength = 0x1e, void * lpOptional = 0x00000000, unsigned int dwOptionalLength = 0, unsigned int dwContentLength = 0, int bEndRequest = 1)+0x425 [c:\ros\reactos-clean\reactos\dll\win32\wininet\http.c @ 4882]

01dbfefc 75fa79e3 wininet!AsyncHttpSendRequestProc(struct task_header_t * hdr = 0x0197d648)+0x9e [c:\ros\reactos-clean\reactos\dll\win32\wininet\http.c @ 5149]

01dbff10 7c962c45 wininet!INTERNET_WorkerThreadFunc(void * lpvParam = 0x0197d648)+0x63 [c:\ros\reactos-clean\reactos\dll\win32\wininet\internet.c @ 3799]

01dbff5c 7c9635ae ntdll!RtlpExecuteWorkItem(void * NormalContext = 0x00000000, void * SystemArgument1 = 0x00000000, void * SystemArgument2 = 0x01997180)+0xb5 [c:\ros\reactos-clean\reactos\lib\rtl\workitem.c @ 227]

01dbffb8 77d99c24 ntdll!RtlpWorkerThreadProc(void * Parameter = 0x0012e378)+0xbe [c:\ros\reactos-clean\reactos\lib\rtl\workitem.c @ 724]

01dbffec 00000000 kernel32!BaseThreadStartup(<function> * lpStartAddress = 0x7c9634f0, void * lpParameter = 0x0012e378)+0x54 [c:\ros\reactos-clean\reactos\dll\win32\kernel32\client\thread.c @ 69]

kd> ?? ListHead

struct _LIST_ENTRY * 0xb0fac604

 [ 0x30 - 0xb0fac604 ]

   +0x000 Flink            : 0x00000030 _LIST_ENTRY

   +0x004 Blink            : 0xb0fac604 _LIST_ENTRY [ 0x30 - 0xb0fac604 ]

kd> !pool 0xb0fac604 2

Pool page b0fac604 region is Unknown

*b0fac598 size:  108 previous size:   20  (Free ) *AdrF

		Owning component : Unknown (update pooltag.txt)

kd> !poolval 0xb0fac604

Pool page b0fac604 region is Unknown

Validating Pool headers for pool page: b0fac604

Pool page [ b0fac000 ] is VALID.