2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload. This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000000000002, session ID
Arg2: 0000000000000180, number of paged pool bytes that are leaking
Arg3: 0000000000000000, number of nonpaged pool bytes that are leaking
Arg4: 0000000000000003, total number of paged and nonpaged allocations that are leaking.
nonpaged allocations are in the upper half of this word,
paged allocations are in the lower half of this word.
Debugging Details:
------------------
DUMP_FILE_ATTRIBUTES: 0xc
Insufficient Dumpfile Size
Kernel Generated Triage Dump
TAG_NOT_DEFINED_405: Gffv
BUGCHECK_STR: 0xAB_Gffv
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
LAST_CONTROL_TRANSFER: from fffff80262bb7060 to fffff80262768ca0
STACK_TEXT:
ffffd000`2ddb2a98 fffff802`62bb7060 : 00000000`000000ab 00000000`00000002 00000000`00000180 00000000`00000000 : nt!KeBugCheckEx
ffffd000`2ddb2aa0 fffff802`62af7022 : ffffd000`2dab0000 00000000`00000000 ffffd000`2dab0b40 ffffd000`2dab0b40 : nt! ?? ::NNGAKEGL::`string'+0x72720
ffffd000`2ddb2af0 fffff802`62ac5c1c : 00000000`00000002 ffffe000`07586500 00000000`00000000 ffffe000`08268080 : nt!MiDereferenceSessionFinal+0x12e
ffffd000`2ddb2b40 fffff802`629d26b6 : 00000000`000ad3e6 ffffe000`08268080 ffffe000`08268080 ffffe000`07586500 : nt!MiDereferenceSession+0x38
ffffd000`2ddb2b70 fffff802`62a0d440 : 00000000`00040000 ffffd000`2ddb2cc0 00000000`00000000 fffff802`62a2a8f2 : nt!MmCleanProcessAddressSpace+0x1b2
ffffd000`2ddb2bd0 fffff802`62a40820 : ffffe000`07586500 ffffc000`197b9060 ffffd000`2ddb2cc0 00000000`00000000 : nt!PspRundownSingleProcess+0xac
ffffd000`2ddb2c60 fffff802`62a0e84f : ffffd000`00000000 ffffe000`08268080 ffffe000`08268001 00000000`00000000 : nt!PspExitThread+0x4c8
ffffd000`2ddb2d70 fffff802`6276f2c6 : fffff802`62909180 ffffe000`08268080 ffffe000`03b7a340 00000000`00000000 : nt!PspTerminateThreadByPointer+0x47
ffffd000`2ddb2da0 00000000`00000000 : ffffd000`2ddb3000 ffffd000`2ddad000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::NNGAKEGL::`string'+72720
fffff802`62bb7060 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+72720
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 52520fe4
IMAGE_VERSION: 6.3.9600.16422
FAILURE_BUCKET_ID: LEAKED_SESSION_POOLTAG_Gffv
BUCKET_ID: LEAKED_SESSION_POOLTAG_Gffv
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:leaked_session_pooltag_gffv
FAILURE_ID_HASH: {ae7bd06a-77ca-deb8-75dd-63f9bbd25435}
Followup: MachineOwner
---------
It encountered when logging in to remote windows 8.1 machine.
I found several Hotfixs but they're for old version windows.
the remote machine installed nvidia display driver version 327.23
could anyone help me?