CTX107896 - Presentation Server Crashes with Bug Check AB (SESSION_HAS_VALID_POOL_ON_EXIT) This document was published at: http://support.citrix.com/article/CTX107896 Document ID: CTX107896, Created on: Nov 28, 2005, Updated: Nov 28, 2005 Products: Citrix MetaFrame XP 1.0 for Microsoft Windows 2003, Citrix MetaFrame Presentation Server 3.0 for Microsoft Windows 2003, Citrix Presentation Server 4.0 for Microsoft Windows 2003 Symptoms The Presentation Server on Windows 2003 Service Pack 1 crashes with the following stack trace and a ?!poolused c? command shows the tags: Gtmp Gump GpXX (XX = varies) GfXX GhXX G@XX 0: kd> !analyze -v SESSION_HAS_VALID_POOL_ON_EXIT (ab) Caused by a session driver not freeing its pool allocations prior to a session unload. This indicates a bug in win32k.sys, atmfd.dll, rdpdd.dll or a video driver. Arguments: Arg1: 0000001b, session ID Arg2: 000000a0, number of paged pool bytes that are leaking Arg3: 00000000, number of nonpaged pool bytes that are leaking Arg4: 00000002, total number of paged and nonpaged allocations that are leaking. nonpaged allocations are in the upper half of this word, paged allocations are in the lower half of this word. STACK_TEXT: b79b5c30 8095df98 000000ab 0000001b 000000a0 nt!KeBugCheckEx+0x1b b79b5c68 809c4c28 89113020 89113020 00000000 nt!MiCheckSessionPoolAllocations+0xe3 b79b5ce8 8082117f 89113020 00000000 889a9020 nt!MiDereferenceSessionFinal+0x183 b79b5d04 80912d6f 89113020 889a9020 889a9260 nt!MmCleanProcessAddressSpace+0x6b b79b5d8c 8092d96b 00000000 00000000 889a9020 nt!PspExitThread+0x5f1 b79b5da4 8092cd0d 889a9020 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b b79b5ddc 80841a96 bf92b850 88ef2598 00000000 nt!PspSystemThreadStartup+0x3c 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 0: kd> !poolused c Sorting by Session Paged Pool Consumed Pool Used: NonPaged Paged Tag Allocs Used Allocs Used Gtmp 0 0 2 160 Gdi temporary allocations TOTAL 0 0 2 160 Another dump: 1: kd> !analyze -v SESSION_HAS_VALID_POOL_ON_EXIT (ab) Caused by a session driver not freeing its pool allocations prior to a session unload. This indicates a bug in win32k.sys, atmfd.dll, rdpdd.dll or a video driver. STACK_TEXT: ec6a6c30 e095df98 000000ab 00000001 00001100 nt!KeBugCheckEx+0x1b ec6a6c68 e09c4c28 f90fa2f8 f90fa2f8 00000000 nt!MiCheckSessionPoolAllocations+0xe3 ec6a6ce8 e082117f f90fa2f8 00000000 f931a020 nt!MiDereferenceSessionFinal+0x183 ec6a6d04 e0912d6f f90fa2f8 f931a020 f931a260 nt!MmCleanProcessAddressSpace+0x6b ec6a6d8c e092d96b 00000000 00000000 f931a020 nt!PspExitThread+0x5f1 ec6a6da4 e092cd0d f931a020 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b ec6a6ddc e0841a96 de12b562 f8ec2c40 00000000 nt!PspSystemThreadStartup+0x3c 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 !poolused c 1: kd> !poolused c Sorting by Session Paged Pool Consumed Pool Used: NonPaged Paged Tag Allocs Used Allocs Used Gtmp 0 0 7 680 Gdi temporary allocations TOTAL 0 0 7 680 3: kd> !analyze -v SESSION_HAS_VALID_POOL_ON_EXIT (ab) Caused by a session driver not freeing its pool allocations prior to a session unload. This indicates a bug in win32k.sys, atmfd.dll, rdpdd.dll or a video driver. Arguments: Arg1: 00000019, session ID Arg2: 00000030, number of paged pool bytes that are leaking Arg3: 00000000, number of nonpaged pool bytes that are leaking Arg4: 00000002, total number of paged and nonpaged allocations that are leaking. nonpaged allocations are in the upper half of this word, paged allocations are in the lower half of this word. STACK_TEXT: b9f29c30 8095df98 000000ab 00000019 00000030 nt!KeBugCheckEx+0x1b b9f29c68 809c4c28 88cec238 88cec238 00000000 nt!MiCheckSessionPoolAllocations+0xe3 b9f29ce8 8082117f 88cec238 00000000 8861f470 nt!MiDereferenceSessionFinal+0x183 b9f29d04 80912d6f 88cec238 8861f470 8861f6b0 nt!MmCleanProcessAddressSpace+0x6b b9f29d8c 8092d96b 00000000 00000000 8861f470 nt!PspExitThread+0x5f1 b9f29da4 8092cd0d 8861f470 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b b9f29ddc 80841a96 bf92b562 8a26bff0 00000000 nt!PspSystemThreadStartup+0x3c 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 3: kd> !poolused c Sorting by Session Paged Pool Consumed Pool Used: NonPaged Paged Tag Allocs Used Allocs Used Gump 0 0 2 48 UNKNOWN pooltag 'Gump', please update pooltag.txt TOTAL 0 0 2 48 3: kd> !analyze -v SESSION_HAS_VALID_POOL_ON_EXIT (ab) Caused by a session driver not freeing its pool allocations prior to a session unload. This indicates a bug in win32k.sys, atmfd.dll, rdpdd.dll or a video driver. Arguments: Arg1: 00000015, session ID Arg2: 00008000, number of paged pool bytes that are leaking Arg3: 00000000, number of nonpaged pool bytes that are leaking Arg4: 00000001, total number of paged and nonpaged allocations that are leaking. nonpaged allocations are in the upper half of this word, paged allocations are in the lower half of this word. STACK_TEXT: af976c24 8092ea6f 000000ab 00000015 00008000 nt!KeBugCheckEx+0x1b af976c68 809ab017 89993d88 89993d88 00000000 nt!MiCheckSessionPoolAllocations+0x107 af976ce8 8084c1a7 89993d88 00000000 89827468 nt!MiDereferenceSessionFinal+0x183 af976d04 8094b539 89993d88 89827468 898276a8 nt!MmCleanProcessAddressSpace+0x6b af976d8c 8094b68d 00000000 00000000 89827468 nt!PspExitThread+0x5f1 af976da4 80948bc0 89827468 00000000 00000001 nt!PspTerminateThreadByPointer+0x4b af976ddc 8088d4d2 bf92b850 89dc1730 00000000 nt!PspSystemThreadStartup+0x3c 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 3: kd> !poolused c Sorting by Session Paged Pool Consumed Pool Used: NonPaged Paged Tag Allocs Used Allocs Used GhEE 0 0 1 32768 UNKNOWN pooltag 'GhEE', please update pooltag.txt TOTAL 0 0 1 32768 Cause This is a Microsoft bug (pool leaking in their drivers). Resolution The dump should be forwarded to Microsoft for the private. More Information ?You may receive a ?Stop 0x000000ab" error message when you log off a Terminal Services session on a Windows Server 2003 SP1-based Terminal Server? (901150) http://support.microsoft.com/default.aspx?scid=kb;en-us;901150