1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffffff8, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: aad7d5d6, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS:  fffffff8 

CURRENT_IRQL:  2

FAULTING_IP: 
nwsipx32+55d6
aad7d5d6 89501c          mov     dword ptr [eax+1Ch],edx

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  f88a5cb8 -- (.trap fffffffff88a5cb8)
ErrCode = 00000002
eax=ffffffdc ebx=00000000 ecx=8192d938 edx=aad7cd3e esi=f8acc298 edi=81c0ba38
eip=aad7d5d6 esp=f88a5d2c ebp=f88a5d40 iopl=0         nv up ei ng nz ac po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010293
nwsipx32+0x55d6:
aad7d5d6 89501c          mov     dword ptr [eax+1Ch],edx ds:0023:fffffff8=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from aad7d5d6 to 805436d0

STACK_TEXT:  
f88a5cb8 aad7d5d6 badb0d00 aad7cd3e 81ddf08c nt!KiTrap0E+0x238
WARNING: Stack unwind information not available. Following frames may be wrong.
f88a5d40 aad7d4cd 0000002a 00000200 00000000 nwsipx32+0x55d6
f88a5d58 aada25f4 00000000 81c0ba38 00000620 nwsipx32+0x54cd
f88a5dc0 aada2ad8 81e22460 81d86000 f88a5e5e nwlnkspx!SpxRecvDataPacket+0x448
f88a5de8 aabb7c2c 81e22460 81d86000 00000000 nwlnkspx!SpxReceive+0x4a
f88a5e6c aabac455 81cd8300 81d86000 81bd7238 nwlnkipx!IpxReceiveIndicationCommon+0x724
f88a5e98 f8208c72 81cd8300 81d86000 81bd7238 nwlnkipx!IpxReceiveIndication+0x23
f88a5ecc f7d2d5d7 81d1c120 81d86000 00000000 NDIS!EthFilterDprIndicateReceive+0x17c
f88a5f0c f8208bd6 81d1e008 81d86000 81bd7238 psched!ClReceiveIndication+0x21b
f88a5f40 f802614a 81d56120 81d86000 81bd7238 NDIS!EthFilterDprIndicateReceive+0xe0
f88a5f74 f802641a 0000023c 8052a2f4 81d86000 Rtnicxp+0xc14a
f88a5f88 f80265ac 81d86000 8052a2f4 81d86000 Rtnicxp+0xc41a
f88a5fa0 f80201dc 00d86000 81e8fa68 f88a5fcc Rtnicxp+0xc5ac
f88a5fb0 f8201712 81d86000 81e42e18 f87029c0 Rtnicxp+0x61dc
f88a5fcc 80544e5f 81d8616c 81d86158 00000000 NDIS!ndisMDpc+0xff
f88a5ff4 805449cb aa305c3c 00000000 00000000 nt!KiRetireDpcList+0x61
f88a5ff8 aa305c3c 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2b
805449cb 00000000 00000009 0081850f bb830000 0xaa305c3c

STACK_COMMAND:  kb

FOLLOWUP_IP: 
nwsipx32+55d6
aad7d5d6 89501c          mov     dword ptr [eax+1Ch],edx

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nwsipx32+55d6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nwsipx32

IMAGE_NAME:  nwsipx32.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  43615172

FAILURE_BUCKET_ID:  0xD1_W_nwsipx32+55d6

BUCKET_ID:  0xD1_W_nwsipx32+55d6

Followup: MachineOwner

---------

nwsipx32+55d6 (=aad7d5d6) 89501c       mov     dword ptr [eax+1Ch],edx

eax=ffffffdc ebx=00000000 ecx=8192d938 edx=aad7cd3e esi=f8acc298 edi=81c0ba38
eip=aad7d5d6 esp=f88a5d2c ebp=f88a5d40 iopl=0         nv up ei ng nz ac po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010293

1: kd> u aad7d5d6-17  (EIP-0x17h)
nwsipx32+0x55bf:
aad7d5bf ba3ecdd7aa      mov     edx,offset nwsipx32+0x4d3e (aad7cd3e)
aad7d5c4 8bc2            mov     eax,edx
aad7d5c6 85c0            test    eax,eax					; test if EAX=0 - jump later
aad7d5c8 8b864c010000    mov     eax,dword ptr [esi+14Ch]		; eax=[f8acc3e4]=81080057
aad7d5ce 8b4060          mov     eax,dword ptr [eax+60h]		; eax=[81080057]+60 = ????????
aad7d5d1 740f            je      nwsipx32+0x55e2 (aad7d5e2)		; jump if EAX was 0 above
aad7d5d3 83e824          sub     eax,24h					; EAX is 0 here, as sub 24 results in eax=ffffffdc
aad7d5d6 89501c          mov     dword ptr [eax+1Ch],edx		; [eax+1Ch]=FFFFFFF8

1: kd> d ds:f8acc298+14c (ESI+0x14Ch) = f8acc3e4
0023:f8acc3e4  57 00 08 81 38 81 38 d1-38 81 30 da 30 00 3c 1b W...8.8.8.0.0.<.
0023:f8acc3f4  2a 62 31 37 57 00 08 81-38 81 38 d1 38 01 00 00 *b17W...8.8.8...
0023:f8acc404  81 20 dc 20 00 3c 1b 2a-62 31 34 57 00 00 81 10 . . .<.*b14W....
0023:f8acc414  81 10 d1 10 81 00 da 00-00 1e 1b 2a 62 31 36 57 ...........*b16W
0023:f8acc424  00 01 81 81 81 81 d2 81-00 80 81 00 da 00 00 07 ................
0023:f8acc434  00 00 00 00 00 00 00 33-81 83 81 83 d1 83 81 03 .......3........
0023:f8acc444  da 03 00 83 1b 2a 62 31-35 57 81 03 81 03 d1 03 .....*b15W......
0023:f8acc454  00 02 81 00 db 00 01 03-83 1b 2a 62 30 4d 1b 2a ..........*b0M.*

1: kd> d 81080057
Page 1480 not present in the dump file. Type ".hh dbgerr004" for details
81080057  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
81080067  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
81080077  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
81080087  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
81080097  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
810800a7  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
810800b7  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
810800c7  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????

--

nwsipx32+0x55d6 (routine crashing) is called from:
nwsipx32+0x54cd
[f88a5d58 aada25f4 00000000 81c0ba38 00000620 nwsipx32+0x54cd]
previous calls:
f88a5dc0 aada2ad8 81e22460 81d86000 f88a5e5e nwlnkspx!SpxRecvDataPacket+0x448
f88a5de8 aabb7c2c 81e22460 81d86000 00000000 nwlnkspx!SpxReceive+0x4a
f88a5e6c aabac455 81cd8300 81d86000 81bd7238 nwlnkipx!IpxReceiveIndicationCommon+0x724
f88a5e98 f8208c72 81cd8300 81d86000 81bd7238 nwlnkipx!IpxReceiveIndication+0x23
... [see stack above for the full lot]