[XP]How to trace which driver for BSOD memory corruption issue?

[surewinc]

1. BSOD 0x8E: I check the memory address(Parameter 2) on problem system, but
it's not related to any device.
"BugCheck 1000008E, {c0000005, 80625f5b, edb0b918, 0}
Probably caused by : memory_corruption"
"BugCheck 1000008E, {c0000005, bf80fae5, edd0d730, 0}
Probably caused by : win32k.sys"
"BugCheck 1000008E, {c0000005, 806338f2, edc348c0, 0}
Probably caused by : ntoskrnl.exe ( nt!RtlAllocateHeapSlowly+18e )"
"BugCheck 1000008E, {c0000005, ed170adc, ed450218, 0}
Unable to load image ks.sys, sysaudio.sys, wdmaud.sys, Win32 error 0n2
Probably caused by : kmixer.sys ( kmixer!MapSpeakerLocations+18c )"

2. BSOD 0x0A: I check the memory address(Parameter 4) on problem system,
but it's not related to any device.
"BugCheck 1000000A, {cdeab300, 2, 0, 80520842}
Probably caused by : memory_corruption ( nt!MiCleanSection+586 )"
"BugCheck 1000000A, {28, 2, 0, 80520747}
Probably caused by : memory_corruption"
"BugCheck 1000000A, {bb0e814c, 2, 0, 8050fb7e}
Probably caused by : ntoskrnl.exe"
"BugCheck 1000000A, {cdeab300, 2, 0, 80520842}
Probably caused by : memory_corruption"
"BugCheck 1000000A, {864da418, 2, 0, 8050fb7e}
Probably caused by : ntoskrnl.exe ( nt!`string'+2a )"
"BugCheck 1000000A, {ce0ab30c, 2, 0, 8050d343}
Probably caused by : ntoskrnl.exe ( nt!PnpCompletionRoutine+4 )"
"BugCheck 1000000A, {28, 2, 0, 80520747}
Probably caused by : memory_corruption ( nt!MiCleanSection+48b )"
"BugCheck 1000000A, {ce0ab300, 2, 0, 80520842}
Probably caused by : memory_corruption ( nt!MiCleanSection+586 )"
"BugCheck 1000000A, {ce0ab300, 2, 0, 80520842}
Probably caused by : memory_corruption ( nt!MiCleanSection+586 )"

Memory stress test: PASS

[Trey Nash]

Hi,

When you say the memory is not related to any device, how are you
determining this? Have to passed the value to !address to see which region
it belongs to? Have you passed it to !pool to see if it is in one of the
kernel pools and if so what its tag is? The pool tag can reveal quite a bit
of info in that regard.

Have you checked the pte for that address using !pte? Maybe the page table
has been corrupted. Have you enabled driver verifier on the affected
machines?

Hope this helps,

-Trey

"surewinc" <sure...@discussions.microsoft.com> wrote in message
news:DFD16662-5146-4217...@microsoft.com...