BSoD details in nwsipx32.sys / tdi.sys


NWSIPX32.SYS dated 2002.06.10
BSoD data: STOP 0x50 (PAGE_FAULT_IN_NONPAGED_AREA) - [F7903A36-F78FF000=4A36]

Code [00014A36]:




NWSIPX32.SYS dated 2004.03.11
BSoD data: STOP 0x50 (PAGE_FAULT_IN_NONPAGED_AREA) - [F85DAD60-F85D6000=4D60]

Code [00014D60] (different .sys, but same part of code as above):




Another common BSoD place of NWSIPX32.SYS (2004.03.11)
BSoD data: STOP 0xD1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL) - [F874B4F5-F8746000=54F5]

BSoD data: STOP 0xD1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL) - [F864B4F5-F8646000=54F5]

Code [000154F5]:




BSoD in TDI.SYS (possibly caused by NWSIPX32.SYS passing invalid value)
BSoD data: STOP 0xD1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL) - [F8A22CBF-F8A22000=CBF]

BSoD data: STOP 0xD1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL) - [F8A2ECBF-F8A2E000=CBF]

Code [00010CBF]:




Same hexdumps in ASCII format:

nprintenwsipxrabend.txt
nprinterabend.txt

Zip file containing two full dumps (one in tdi.sys and one in nwsipx32.sys) and the corresponding screenshots.


Different analysis files on the dumps:

Microsoft's analysis on the dump of the TDI BSoD
My analysis on the BSoD in NWSIPX32
Comparsion on the BSoDs - colorized disassebly


Technical description on relation of TDI.SYS and NWSIPX32.SYS

http://support.novell.com/techcenter/articles/ana19970501.html#h12zvgp

Quote: "When a 32-bit Windows application makes a NetWare IPX/SPX API call, the Novell 32-bit library (NWSIPX32.DLL) communicates with NWSIPX32.SYS. NWSIPX32.SYS makes a call directly to NWLink through the TDI interface to deliver the IPX/SPX packet onto the network medium."



Comments, suggestions about this web page, to:


v1.00 - 2006.02.07 First version
v1.01 - 2006.08.18 Changed Novell AppNote link
v1.02 - 2006.08.22 Dumps
v1.03 - 2007.05.11 Reference to blog, and links to the incident materials

BACK