As per M961799, this may be recorded when a user accesses shared files on the server by using a server message block (SMB) connection. The problem occurs because the Netbt.sys (NetBIOS) network driver incorrectly handles a buffer when a malformed packet is received from the network. A hotfix is available for Windows Server 2003 SP2.
* * *
M967228 describes a condition when this problem happens on a Windows Server 2008-based or a Windows Server 2003-based that is running Hitachi Dynamic Link Manager Software. It is happening because the hdlmdsm.sys driver is referencing the MdlAddress pointer. A hotfix is available from Hitachi.
* * *
As per M960882, this may be caused by a bug in Mrxsmb.sys. A hotfix is available.
According to Microsoft, this Stop message, also known as Stop 0x50, occurs when requested data is not found in memory. The system generates a fault, which indicates that invalid system memory has been referenced. This fault can occur due to a variety of error conditions, such as bugs in antivirus software, a corrupted NTFS volume, or faulty hardware (typically related to defective RAM, be it main memory, L2 RAM cache, or video RAM).
If this problem appeared after you have installed new hardware, remove it to see if the problem is caused by the hardware component.
As stated before, this problem can also be caused by software. A good place to start to troubleshoot this problem is to perform a clean boot. This way you can find out if the problem is caused by Windows or by a third-party application. See M281770, M310353, and M316434 for information on performing a clean boot.
Additional information on this problem can be found in the following articles: Troubleshooting specific Stop messages, Windows 2000 Stop Messages, Stop Messages for Disks and File Systems, Windows 2000 Resource Kits - STOP 0x00000050, and Windows XP Resource Kits - Stop 0x00000050.
What this error says is that a driver tried to access a portion of the memory that is accessible only to some of the core components of Windows. This indicates a serious breach in the driver functionality so Windows stops the system before further damages is done.
Occurs on many circumstances and it usually indicates faulty device drivers. For this, the solution is sometimes to updated these drivers (i.e M811016) or boot in safe mode and remove them (i.e. M810982). The trick here is to be identify the driver that is creating this problem. The additional parameters associated with this error message may provide clues in regards to this. Drivers for video cards and printers seem to cause this more often than other hardware.
In other conditions, this may a sign of faulty hardware - for example if it occurs when you install Windows (so there are only standard device drivers used at that point). See M171003 for an example when this may occur if there are problems with the memory modules.
If some hardware is not compatible with the operating system one may also get this error (see M817197 as an example).
Corrupted files or corrupted NTFS volumes may also end up generating this error (for an example see M811769). The solution here it be to update those files (i.e. by reinstalling the latest service pack).
Installing a new service pack or hotfix may add new drivers for the existing hardware and if there is a problem with these drivers, this error may occur (see M329293 for an example related to Windows XP SP1).
Antivirus software is also known to cause this error. Obtain the latest version or try disabling it and see if the error persists. See M156211 (and M319123 or M317153).
M180963 describes a situation when this error can occur ofter a denial of service attack (this however, was due to a bug in the SMB logon request algorithm).
Here is what Microsoft says about this error:
"If this is the first time you have booted after installing new hardware, remove the hardware and boot again. Check the Microsoft Hardware Compatibility List to verify that the hardware and its drivers are compatible with Windows 2000. For information about the hardware, contact the supplier. If you are installing Windows 2000 for the first time, check the Windows 2000 system requirements, including the amount of RAM and disk space required to load the operating system. Also, check the Hardware Compatibility List to verify that the system can run Windows 2000. If Windows 2000 is loaded and no new hardware has been installed, reboot with recovery options set to create a dump file. If the message continues to appear, select the Last Known Good option when you reboot. If there is no Last Known Good configuration, try using the Emergency Repair Disk. If you do not have an Emergency Repair Disk, contact your technical support group."
And again from Microsoft:
"This indicates that invalid system memory has been referenced.
The following parameters are displayed on the blue screen.
1 Memory address referenced
2 0: Read operation / 1: Write operation
3 Address that referenced memory (if known)
If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).
Another common cause is the installation of a faulty system service.
Antivirus software can also trigger this error, as can a corrupted NTFS volume.
Resolving the Problem
Resolving a faulty hardware problem: If hardware has been added to the system recently, remove it to see if the error recurs. If existing hardware has failed, remove or replace the faulty component. You should run hardware diagnostics supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer.
Resolving a faulty system service problem: Disable the service and confirm that this resolves the error. If so, contact the manufacturer of the system service about a possible update. If the error occurs during system startup, restart your computer, and press F8 at the character-mode menu that displays the operating system choices. At the resulting Windows Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time.
Resolving an antivirus software problem: Disable the program and confirm that this resolves the error. If it does, contact the manufacturer of the program about a possible update.
Resolving a corrupted NTFS volume problem: Run Chkdsk /f /r to detect and repair disk errors. You must restart the system before the disk scan begins on a system partition. If the hard disk is SCSI, check for problems between the SCSI controller and the disk.
Finally, check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. Disabling memory caching of the BIOS might also resolve it.
Typically, this address is in freed memory or is simply invalid.
This cannot be protected by a try - except handler it can only be protected by a probe."
Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.
Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.