1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: e46a4ba8, The pool entry we were looking for within the page.
Arg3: e46a4c10, The next pool entry.
Arg4: 0c0d0201, (reserved)

Debugging Details:
------------------

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************

BUGCHECK_STR:  0x19_20

POOL_ADDRESS:  e46a4ba8 Paged pool

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

PROCESS_NAME:  TheWorld.exe

LAST_CONTROL_TRANSFER:  from 8054c583 to 804faf43

STACK_TEXT:  
a0c12c44 8054c583 00000019 00000020 e46a4ba8 nt!KeBugCheckEx+0x1b
a0c12c94 805c20a3 e46a4bb0 a079654b 8a185128 nt!ExFreePoolWithTag+0x2a3
a0c12cb4 805bc4b2 00000000 e46a4bb0 e46a4bc8 nt!ObpFreeObject+0x18d
a0c12ccc 805276fa e46a4bc8 00000000 00000a64 nt!ObpRemoveObjectRoutine+0xe8
a0c12ce4 805bd37f 86fef020 e3a43598 868aa020 nt!ObfDereferenceObject+0x4c
a0c12cfc 805bd415 e3a43598 e46a4bc8 00000a64 nt!ObpCloseHandleTableEntry+0x155
a0c12d44 805bd54d 00000a64 00000001 00000000 nt!ObpCloseHandle+0x87
a0c12d58 8054267c 00000a64 01487304 7c92e4f4 nt!NtClose+0x1d
a0c12d58 7c92e4f4 00000a64 01487304 7c92e4f4 nt!KiFastCallEntry+0xfc
014872f0 7c92cfdc 77da6bf3 00000a64 079d9408 ntdll!KiFastSystemCallRet
014872f4 77da6bf3 00000a64 079d9408 01487310 ntdll!ZwClose+0xc
01487304 77da6c9b 01487318 01487328 3ebc9edb ADVAPI32!BaseRegCloseKeyInternal+0x51
01487310 3ebc9edb 00000a64 079d9408 3ebc9e58 ADVAPI32!RegCloseKey+0x76
0148731c 3ebc9e58 079d9408 01487348 3ebc9e41 iertutil!SettingStore::CRegistryKey::~CRegistryKey+0x32
01487328 3ebc9e41 00000001 00155c30 3ec09ce1 iertutil!SettingStore::CRegistryKey::`scalar deleting destructor'+0xd
01487334 3ec09ce1 00000000 3ec7e670 3ec801d0 iertutil!SettingStore::CRegistryKey::Release+0x20
01487348 3ebcb11f 00000000 014875dc 3ec7e668 iertutil!SettingStore::CKeyMRU::_FreeNode+0x42
01487374 3ec09e6d 00155c30 014875dc 079ec218 iertutil!SettingStore::CKeyMRU::Add+0x84
014875b4 3ebbea69 00155c30 014875dc 00000102 iertutil!SettingStore::CKeyCache::OpenKey+0xde
014877e8 3ebbe9e3 00000000 01487854 00000102 iertutil!SettingStore::CRegistryStore::OpenKey+0x74
0148780c 3ebcb7ab 01487854 01487a5c 00000003 iertutil!SettingStore::_GetSchemaHiveFlag+0x11f
01487c68 3daa1733 3da9f358 00000005 00000001 iertutil!GetValue+0xed
01487c8c 3da96b8c 3da9f358 01487cb0 00000004 mshtml!GetBinary+0x1b
01488d58 3da93f5d 3da9ee68 01b2e6a0 00000000 mshtml!ReadSettingsFromIESettingsAPI+0x22b
01488dac 3da93ea5 00000000 00000000 079a4520 mshtml!CDoc::ReadOptionSettingsFromRegistry+0xa9
01489038 3da9546d 022005e8 00000000 00000000 mshtml!CDoc::UpdateFromRegistry+0xb2
01489090 3da965c0 022005e8 001f1e4c 00000000 mshtml!CDoc::SetClientSite+0xc6
014891c0 3da96c6f 022005e8 00000000 00000000 mshtml!CDoc::LoadFromInfo+0x71d
0148927c 43d1153b 022005e8 00000001 079e37a0 mshtml!CDoc::Load+0xbb
014892c8 43d1187c 00000000 022005e8 00000000 urlmon!CBinding::ObjectPersistMnkLoad+0x2e2
0148933c 43d11dfb 022a2840 01489384 01489374 urlmon!CBinding::InstantiateObject+0x237
01489398 43d11dc2 022a2840 00000000 000012a8 urlmon!CBinding::OnObjectAvailable+0x36e
014893c4 43ce82ee 022a2840 00000006 000012a8 urlmon!CBinding::OnTransNotification+0x2c1
014893f4 43ce7c84 000012a8 0000000c 000012a8 urlmon!CBinding::ReportData+0x77
01489414 43ce638f 01b316dc 0000000c 000012a8 urlmon!COInetProt::ReportData+0x6e
0148943c 43ce6205 01b31500 00000006 0000000c urlmon!CTransaction::DispatchReport+0x37e
01489468 43ce6424 01b31500 07a4cb48 00000000 urlmon!CTransaction::DispatchPacket+0x31
01489488 43ce7e22 01b31500 00000000 00000000 urlmon!CTransaction::OnINetCallback+0x92
014894b0 43cf3478 01b31500 0000000c 000012a8 urlmon!CTransaction::ReportData+0x139
014894c8 43cf3448 079e3460 0000000c 000012a8 urlmon!CINetEmbdFilter::ReportData+0x1a
014895f0 43d0a995 079e3460 0000000c 000012a8 urlmon!CINet::ReportDataToEmbdFilter+0xac
01489620 43d0a8b1 022ea030 022ea030 003a0046 urlmon!CINet::INetReportAvailableData+0xfb
0148983c 43d0a7fa 022ea030 00000000 43d09c94 urlmon!CINet::INetDataAvailable+0xd8
01489848 43d09c94 3e423312 022ea030 00000000 urlmon!CINet::INetRead+0x2e
01489858 43d0a3f1 00000001 3e423312 022ea030 urlmon!CINet::INetQueryInfo+0x24
01489884 43d0b492 00cc0010 022ea030 00000000 urlmon!CINetHttp::INetAsyncSendRequest+0x3c8
0148a0a4 43d0b62f 00000000 022ea030 00000000 urlmon!CINetHttp::INetAsyncOpenRequest+0x2cf
0148a0b8 43d0ae1b 022ea26c 022ea030 00000000 urlmon!CINet::INetAsyncConnect+0x24b
0148a0d0 43cf42c5 022ea1a0 022ea030 00000000 urlmon!CINet::INetAsyncOpen+0x11b
0148a0e0 43cf4276 022ea26c 01b316d8 00000000 urlmon!CINet::INetAsyncStart+0x1a
0148a0fc 43cf410b 04d714d0 01b31500 01b31508 urlmon!CINet::StartCommon+0x198
0148a118 43cf432a 022ea030 04d714d0 01b31500 urlmon!CINet::StartEx+0x1c
0148a14c 43ce8fea 022ea030 04d714d0 01b31500 urlmon!COInetProt::StartEx+0xc2
0148a19c 43ce9577 01b31500 00000000 022a2848 urlmon!CTransaction::StartEx+0x3f3
0148a224 43ce9188 04d714d0 079d9cf8 3ecaeb94 urlmon!CBinding::StartBinding+0x602
0148a268 43d11b68 079e37a0 00000001 079d9cf8 urlmon!CUrlMon::StartBinding+0x169
0148a2a4 3ed64cef 079e37a0 079d9cf8 00000000 urlmon!CUrlMon::BindToObject+0xd5
0148a2dc 3ed5b460 079e37a0 00000000 00000000 ieframe!CDocObjectHost::_StartAsyncBinding+0x1ba
0148b384 3ed5aafe 079e37a0 00000000 00000000 ieframe!CDocObjectHost::SetTarget+0x600
0148b3bc 3ed5a8e1 00000000 079e37a0 01b9b060 ieframe!CDocObjectView::CreateViewWindow2+0xea
0148b3f4 3ed5a21a 01b9b060 00000000 02110650 ieframe!CDocObjectView::CreateViewWindow+0x49
0148b4b0 3ed5a139 02110060 02110650 01b9b060 ieframe!FileCabinet_CreateViewWindow2+0x29d
0148b4d4 3ed5a057 01b9b060 00000000 0148b4f8 ieframe!CBaseBrowser2::_CreateViewWindow+0x2b
0148b514 3ed59f0b 00000000 022f0ec0 00000000 ieframe!CBaseBrowser2::_CreateNewShellView+0x1a6
0148b544 3ed59e3e 022f0ec0 00000000 00000001 ieframe!CBaseBrowser2::_CreateNewShellViewPidl+0xe1
0148c5c8 3ed5c2cd 022f0ec0 00000000 00000001 ieframe!CBaseBrowser2::v_NavigateToPidl+0x2c3
0148c818 3ed8d8b8 00000700 02110060 00000000 ieframe!CBaseBrowser2::_OnGoto+0x2fb
0148c82c 3ecc4c5b 00360346 00000700 00000000 ieframe!CBaseBrowser2::v_WndProc+0x340
0148c848 3ecc4bf3 00360346 00000700 00000000 ieframe!CWebBrowserSB::v_WndProc+0x19
0148c870 3edc6e79 00360346 00000700 00000000 ieframe!CWebBrowserOC::v_WndProc+0x71
0148c894 77d18734 00360346 00000700 00000000 ieframe!CImpWndProc::s_WndProc+0x65
0148c8c0 77d18816 3edc6e3a 00360346 00000700 USER32!InternalCallWinProc+0x28
0148c928 77d2927b 00000000 3edc6e3a 00360346 USER32!UserCallWinProcCheckWow+0x150
0148c964 77d292e3 009faf38 009f74a8 00000000 USER32!SendMessageWorker+0x4a5
0148c984 3ecc3198 00360346 00000700 00000000 USER32!SendMessageW+0x7f


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    80505668-8050566b  4 bytes - nt!KiServiceTable+1e8
[ 40 c4 5c 80:00 30 ee a0 ]
    805056a4-805056a7  4 bytes - nt!KiServiceTable+224 (+0x3c)
[ 1e 94 5b 80:08 31 ee a0 ]
    80542665-80542669  5 bytes - nt!KiFastCallEntry+e5 (+0x3cfc1)
[ 2b e1 c1 e9 02:e9 56 31 bf 09 ]
13 errors : !nt (80505668-80542669)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  LARGE

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_LARGE

BUCKET_ID:  MEMORY_CORRUPTION_LARGE

Followup: memory_corruption
---------

1: kd> lmvm memory_corruption
start    end        module name