Dump

PROCESS_HAS_LOCKED_PAGES (76)
Caused by a driver not cleaning up correctly after an I/O.
Arguments:
Arg1: 0000000000000000, Locked memory pages found in process being terminated.
Arg2: fffffa800df23060, Process address.
Arg3: 000000000000057f, Number of locked pages.
Arg4: 0000000000000000, Pointer to driver stacks (if enabled) or 0 if not.
	Issue a !search over all of physical memory for the current process pointer.
	This will yield at least one MDL which points to it.  Then do another !search
	for each MDL found, this will yield the IRP(s) that point to it, revealing
	which driver is leaking the pages.
	Otherwise, set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
	Management\TrackLockedPages to a DWORD 1 value and reboot.  Then the system
	will save stack traces so the guilty driver can be easily identified.
	When you enable this flag, if the driver commits the error again you will
	see a different bugcheck - DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (0xCB) -
	which can identify the offending driver(s).

Debugging Details:
------------------


PROCESS_NAME:  MediaExpress.e

DEFAULT_BUCKET_ID:  DRIVER_FAULT_0x76

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0x76

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f3c019 to fffff80002cdbc40

STACK_TEXT:
fffff880`097b58f8 fffff800`02f3c019 : 00000000`00000076 00000000`00000000 fffffa80`0df23060 00000000`0000057f : nt!KeBugCheckEx
fffff880`097b5900 fffff800`02f97a37 : fffffa80`0df23060 fffffa80`066b1b40 fffffa80`00000000 fffffa80`00000006 : nt! ?? ::NNGAKEGL::`string'+0x17e46
fffff880`097b5940 fffff800`02ce5174 : 00000000`00000000 fffffa80`0d630230 fffffa80`0df23030 fffffa80`0d9d0360 : nt!PspProcessDelete+0x177
fffff880`097b59a0 fffff800`02fd6184 : fffffa80`0d630230 00000000`00000000 fffffa80`0d81c8b0 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`097b5a00 fffff800`02fd6734 : 00000000`00000690 fffffa80`0d630230 fffff8a0`025b6550 00000000`00000690 : nt!ObpCloseHandleTableEntry+0xc4
fffff880`097b5a90 fffff800`02cdaed3 : fffffa80`0d81c8b0 fffff880`097b5b60 00000000`7ef77000 00000000`00000000 : nt!ObpCloseHandle+0x94
fffff880`097b5ae0 00000000`771a140a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`079ce808 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771a140a


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt! ?? ::NNGAKEGL::`string'+17e46
fffff800`02f3c019 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::NNGAKEGL::`string'+17e46

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  50e79935

FAILURE_BUCKET_ID:  X64_0x76_MediaExpress.e_nt!_??_::NNGAKEGL::_string_+17e46

BUCKET_ID:  X64_0x76_MediaExpress.e_nt!_??_::NNGAKEGL::_string_+17e46