(sdk\lib\rtl\heap.c:2995) Realloc in place failed, but it was the only option (sdk\lib\rtl\heap.c:2995) Realloc in place failed, but it was the only option (sdk\lib\rtl\heap.c:2995) Realloc in place failed, but it was the only option (sdk\lib\rtl\heap.c:2995) Realloc in place failed, but it was the only option (sdk\lib\rtl\heap.c:2995) Realloc in place failed, but it was the only option (sdk\lib\rtl\heap.c:2995) Realloc in place failed, but it was the only option (sdk\lib\rtl\heap.c:2995) Realloc in place failed, but it was the only option (ntoskrnl\mm\ARM3\expool.c:2692) Freeing pool - invalid tag specified: vmKM != vmGB *** Fatal System Error: 0x000000c2 (0x0000000A,0xB2079F00,0x42476D76,0x4D4B6D76) Break instruction exception - code 80000003 (first chance) A fatal system error has occurred. Debugger entered on first try; Bugcheck callbacks have not been invoked. A fatal system error has occurred. Connected to Windows Server 2003 3790 x86 compatible target at (Wed Dec 17 04:21:51.083 2025 (UTC - 9:00)), ptr64 FALSE Loading Kernel Symbols ........................................................... Loading User Symbols ................................ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck C2, {a, b2079f00, 42476d76, 4d4b6d76} *** ERROR: Module load completed but symbols could not be loaded for vmx_svga.sys *** ERROR: Module load completed but symbols could not be loaded for vmx_fb.dll *** ERROR: Module load completed but symbols could not be loaded for vmwogl32.DLL *** WARNING: Unable to verify checksum for wglgears.exe *** ERROR: Module load completed but symbols could not be loaded for wglgears.exe Probably caused by : vmx_svga.sys ( vmx_svga+ce0f ) Followup: MachineOwner --------- nt!RtlpBreakWithStatusInstruction: 8058fd56 cc int 3 kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BAD_POOL_CALLER (c2) The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc. Arguments: Arg1: 0000000a, Attempt to free some other component's protected pool. Arg2: b2079f00, Address of pool Arg3: 42476d76, Pool allocation's tag Arg4: 4d4b6d76, Quota process pointer (bad). Debugging Details: ------------------ BUGCHECK_STR: 0xc2_a DEFAULT_BUCKET_ID: DRIVER_FAULT PROCESS_NAME: wglgears.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 804b3a68 to 8058fd56 STACK_TEXT: eeb544b0 804b3a68 00000003 eeb548a4 ffdff408 nt!RtlpBreakWithStatusInstruction eeb544e0 804b2b16 00000003 eeb54988 eeb549f8 nt!KiBugCheckDebugBreak+0x38 [C:\vmware_test\ntoskrnl\ke\bug.c @ 504] eeb548ac 804b23c0 000000c2 0000000a b2079f00 nt!KeBugCheckWithTf+0x6b6 [C:\vmware_test\ntoskrnl\ke\bug.c @ 1084] eeb548cc 804ceb2f 000000c2 0000000a b2079f00 nt!KeBugCheckEx+0x20 [C:\vmware_test\ntoskrnl\ke\bug.c @ 1426] eeb54988 f7611e0f b2079f00 4d4b6d76 eeb549dc nt!ExFreePoolWithTag+0x5ef [C:\vmware_test\ntoskrnl\mm\ARM3\expool.c @ 2701] WARNING: Stack unwind information not available. Following frames may be wrong. eeb549cc f75eb4b7 b2721224 eeb549f8 eeb54a84 vmx_svga+0xce0f eeb54a20 f75e99a1 b2721040 b20a04b8 eeb54b00 VIDEOPRT!VideoPortForwardDeviceControl+0x127 [C:\vmware_test\win32ss\drivers\videoprt\dispatch.c @ 727] eeb54a84 8048a717 b2721040 b20a04b8 eeb54ab8 VIDEOPRT!IntVideoPortDispatchDeviceControl+0x5b1 [C:\vmware_test\win32ss\drivers\videoprt\dispatch.c @ 882] eeb54ab0 ef17c434 eeb54b38 b2079f00 cccccccc nt!IofCallDriver+0xc7 [C:\vmware_test\ntoskrnl\io\iomgr\irp.c @ 1286] eeb54b00 eed2bc23 b2721040 002320c0 eeb54b28 win32k!EngDeviceIoControl+0x114 [C:\vmware_test\win32ss\gdi\eng\device.c @ 1016] eeb54b3c eed27cd1 e12e3000 b2079f00 4d4b6d76 vmx_fb+0x23c23 eeb54b64 eed27db7 e12e3000 eed41f84 e12e3000 vmx_fb+0x1fcd1 eeb54b8c eed0f023 e12e3000 eed41d98 00000000 vmx_fb+0x1fdb7 eeb54bbc eed10713 e12e3000 eed407cc 00000001 vmx_fb+0x7023 eeb54bd4 eed11662 00000001 e16d59c8 eed114d8 vmx_fb+0x8713 eeb54bec eed1191b e12e2838 00030001 00000010 vmx_fb+0x9662 eeb54c44 eed26fbe e12e2838 00030001 00000010 vmx_fb+0x991b eeb54c6c ef299a18 00000000 00030001 00000010 vmx_fb+0x1efbe eeb54ce0 8040405e 8c010149 00000000 00000000 win32k!NtGdiExtEscape+0x378 [C:\vmware_test\win32ss\gdi\ntgdi\print.c @ 239] eeb54d10 8056fed8 ef2996a0 0022fcd8 00000020 nt!KiSystemCallTrampoline+0x19 eeb54d5c 80403ea5 0022fcf8 7c93605e badb0d00 nt!KiSystemServiceHandler+0x278 [C:\vmware_test\ntoskrnl\ke\i386\traphdlr.c @ 1840] eeb54d5c 7c93605e 0022fcf8 7c93605e badb0d00 nt!KiFastCallEntry+0x96 0022fccc 7c4e76dc 7c4b4916 8c010149 00000000 ntdll!KiFastSystemCallRet 0022fcd0 7c4b4916 8c010149 00000000 00000000 GDI32!ZwGdiExtEscape+0xc 0022fcf8 100010c7 8c010149 00030001 00000010 GDI32!ExtEscape+0x26 [C:\vmware_test\win32ss\gdi\gdi32\misc\misc.c @ 225] 0022fd4c 100036af 00374038 10adb48c 10ad7450 vmwogl32+0x10c7 0022fdb8 106ed1be 10000000 0022fddc 7c92fc27 vmwogl32+0x36af 0022fdc4 7c92fc27 10000000 00000000 00000001 vmwogl32+0x6ed1be 0022fddc 7c9280f6 106ed1a0 10000000 00000000 ntdll!LdrpCallInitRoutine+0x17 [C:\vmware_test\dll\ntdll\ldr\ldrutils.c @ 106] 0022fe78 7c65e126 00000000 0022ffc8 00000000 ntdll!LdrShutdownProcess+0x2a6 [C:\vmware_test\dll\ntdll\ldr\ldrinit.c @ 1034] 0022ff70 004011d4 00000000 7c5be485 0022ffa0 kernel32!ExitProcess+0xd6 [C:\vmware_test\dll\win32\kernel32\client\proc.c @ 1508] 0022ffa0 004011eb 00000001 00000000 7c96ff9a wglgears+0x11d4 0022ffc0 7c656eb4 00000000 00000000 7ffd6000 wglgears+0x11eb 0022fff0 00000000 004011d4 00000000 75010175 kernel32!BaseProcessStartup+0x54 [C:\vmware_test\dll\win32\kernel32\client\proc.c @ 463] STACK_COMMAND: kb FOLLOWUP_IP: vmx_svga+ce0f f7611e0f 8b4604 mov eax,dword ptr [esi+4] SYMBOL_STACK_INDEX: 5 SYMBOL_NAME: vmx_svga+ce0f FOLLOWUP_NAME: MachineOwner MODULE_NAME: vmx_svga IMAGE_NAME: vmx_svga.sys DEBUG_FLR_IMAGE_TIMESTAMP: 546ab93b FAILURE_BUCKET_ID: 0xc2_a_vmx_svga+ce0f BUCKET_ID: 0xc2_a_vmx_svga+ce0f Followup: MachineOwner --------- kd> kp ChildEBP RetAddr eeb544b0 804b3a68 nt!RtlpBreakWithStatusInstruction eeb544e0 804b2b16 nt!KiBugCheckDebugBreak(unsigned long StatusCode = 3)+0x38 [C:\vmware_test\ntoskrnl\ke\bug.c @ 504] eeb548ac 804b23c0 nt!KeBugCheckWithTf(unsigned long BugCheckCode = 0xc2, unsigned long BugCheckParameter1 = 0xa, unsigned long BugCheckParameter2 = 0xb2079f00, unsigned long BugCheckParameter3 = 0x42476d76, unsigned long BugCheckParameter4 = 0x4d4b6d76, struct _KTRAP_FRAME * TrapFrame = 0x00000000)+0x6b6 [C:\vmware_test\ntoskrnl\ke\bug.c @ 1084] eeb548cc 804ceb2f nt!KeBugCheckEx(unsigned long BugCheckCode = 0xc2, unsigned long BugCheckParameter1 = 0xa, unsigned long BugCheckParameter2 = 0xb2079f00, unsigned long BugCheckParameter3 = 0x42476d76, unsigned long BugCheckParameter4 = 0x4d4b6d76)+0x20 [C:\vmware_test\ntoskrnl\ke\bug.c @ 1426] eeb54988 f7611e0f nt!ExFreePoolWithTag(void * P = 0xb2079f00, unsigned long TagToFree = 0x4d4b6d76)+0x5ef [C:\vmware_test\ntoskrnl\mm\ARM3\expool.c @ 2701] WARNING: Stack unwind information not available. Following frames may be wrong. eeb549cc f75eb4b7 vmx_svga+0xce0f eeb54a20 f75e99a1 VIDEOPRT!VideoPortForwardDeviceControl(struct _DEVICE_OBJECT * DeviceObject = 0xb2721040, struct _IRP * Irp = 0xb20a04b8)+0x127 [C:\vmware_test\win32ss\drivers\videoprt\dispatch.c @ 727] eeb54a84 8048a717 VIDEOPRT!IntVideoPortDispatchDeviceControl(struct _DEVICE_OBJECT * DeviceObject = 0xb2721040, struct _IRP * Irp = 0xb20a04b8)+0x5b1 [C:\vmware_test\win32ss\drivers\videoprt\dispatch.c @ 882] eeb54ab0 ef17c434 nt!IofCallDriver(struct _DEVICE_OBJECT * DeviceObject = 0xb2721040, struct _IRP * Irp = 0xb20a04b8)+0xc7 [C:\vmware_test\ntoskrnl\io\iomgr\irp.c @ 1286] eeb54b00 eed2bc23 win32k!EngDeviceIoControl(void * hDevice = 0xb2721040, unsigned long dwIoControlCode = 0x2320c0, void * lpInBuffer = 0xeeb54b28, unsigned long cjInBufferSize = 0x10, void * lpOutBuffer = 0x00000000, unsigned long cjOutBufferSize = 0, unsigned long * lpBytesReturned = 0xeeb54b38)+0x114 [C:\vmware_test\win32ss\gdi\eng\device.c @ 1016] eeb54b3c eed27cd1 vmx_fb+0x23c23 eeb54b64 eed27db7 vmx_fb+0x1fcd1 eeb54b8c eed0f023 vmx_fb+0x1fdb7 eeb54bbc eed10713 vmx_fb+0x7023 eeb54bd4 eed11662 vmx_fb+0x8713 eeb54bec eed1191b vmx_fb+0x9662 eeb54c44 eed26fbe vmx_fb+0x991b eeb54c6c ef299a18 vmx_fb+0x1efbe eeb54ce0 8040405e win32k!NtGdiExtEscape(struct HDC__ * hDC = 0x8c010149, wchar_t * pDriver = 0x00000000 "", int nDriver = 0n0, int Escape = 0n196609, int InSize = 0n16, char * UnsafeInData = 0x0022fd20 "csmv???", int OutSize = 0n4, char * UnsafeOutData = 0x0022fd1c "")+0x378 [C:\vmware_test\win32ss\gdi\ntgdi\print.c @ 239] eeb54d10 8056fed8 nt!KiSystemCallTrampoline+0x19 eeb54d5c 80403ea5 nt!KiSystemServiceHandler(struct _KTRAP_FRAME * TrapFrame = 0xeeb54d64, void * Arguments = 0x0022fcd8)+0x278 [C:\vmware_test\ntoskrnl\ke\i386\traphdlr.c @ 1840] eeb54d5c 7c93605e nt!KiFastCallEntry+0x96 0022fccc 7c4e76dc ntdll!KiFastSystemCallRet 0022fcd0 7c4b4916 GDI32!ZwGdiExtEscape+0xc 0022fcf8 100010c7 GDI32!ExtEscape(struct HDC__ * hDC = 0x8c010149, int nEscape = 0n196609, int cbInput = 0n16, char * lpszInData = 0x0022fd20 "csmv???", int cbOutput = 0n4, char * lpszOutData = 0x0022fd1c "")+0x26 [C:\vmware_test\win32ss\gdi\gdi32\misc\misc.c @ 225] 0022fd4c 100036af vmwogl32+0x10c7 0022fdb8 106ed1be vmwogl32+0x36af 0022fdc4 7c92fc27 vmwogl32+0x6ed1be 0022fddc 7c9280f6 ntdll!LdrpCallInitRoutine( * EntryPoint = 0x106ed1a0, void * BaseAddress = 0x10000000, unsigned long Reason = 0, void * Context = 0x00000001)+0x17 [C:\vmware_test\dll\ntdll\ldr\ldrutils.c @ 106] 0022fe78 7c65e126 ntdll!LdrShutdownProcess(void)+0x2a6 [C:\vmware_test\dll\ntdll\ldr\ldrinit.c @ 1034] 0022ff70 004011d4 kernel32!ExitProcess(unsigned int uExitCode = 0)+0xd6 [C:\vmware_test\dll\win32\kernel32\client\proc.c @ 1508] 0022ffa0 004011eb wglgears+0x11d4 0022ffc0 7c656eb4 wglgears+0x11eb 0022fff0 00000000 kernel32!BaseProcessStartup( * lpStartAddress = 0x004011d4)+0x54 [C:\vmware_test\dll\win32\kernel32\client\proc.c @ 463]