The computer has rebooted from a bugcheck. The bugcheck was: 0x000000f4 (0x0000000000000003, 0xfffffa80bd3e09a0, 0xfffffa80bd3e0c80, 0xfffff80001dd3b60).
Two XenApp 6.5 servers blue screened and rebooted one morning last week with the following:
FAULTING_MODULE: 000000004a560000 csrss
Luckily this happened only 4 weeks before, and after raising a job with Citrix they noted they could see that csrss.exe had an exception, however we only had Kernel Memory Dump enabled, so support could not find any information in the user space. I enabled Complete Memory Dumps on the XenApp 6.5 desktop platform then.
Refer to the following article on how to change the dump level:
We reopened the archived case, compressed, and uploaded the complete memory dump.
We received the response:
From the dump we can see that Client/Server Runtime Subsystem process (csrss.exe) was terminated.
We do not see any of the Citrix modules involved in the thread call stack.
There was an exception while running sxs!BufferedStream::getLineBuf+0x1f
Microsoft’s SXS.DLL time stamp was Sat Nov 20 18:44:52 2010
We raised and logged a case with Microsoft.
What they came back with was:
Exception reported when handling sxs!BufferedStream::getLineBuf
_xxxxxpos variable is not allowed to be subtracted. This is how the exception happened.
0x034 _lMarkedlinepos : 0n-2025 <<<<<<<<< This value is negative
The solution from Microsoft was to install the following hotfix:
Surprisingly, the issue is caused by click-once applications, in our case – Yammer.Notifier.exe