@Stefan Costa

I have seen a few of these over the past four months where wsnmp32.dll is taking out tbe print system.

I'll debug the dumps to pinpoint which driver might be causing an issue.

In general, this is caused when Language Monitor software reaches out to the device. Some LMs can be switched off by checking the Bidirectional support box in printer Properties/Ports.

Thanks

@Alan Morris

Thank you for the insight and being willing to take a look.

OneDrive link to the most recent crashdump: https://pepsiva-my.sharepoint.com/:u:/g/personal/scosta_pepsicva_com/ERGc3Ya-wFRLnom5p_SavdABHsONe25xAJB-EAxU_gXQDA?e=mT6soO

Let me know if there's anything else you need me to provide.

Thank you!

@Stefan Costa

I'm sure you are thinking.

WTF.

To capture the culprit in the act of being rude, you need a debugger and need to have plenty of memory on the system so you can enable pageheap on spoolsv.exe .

You are not going to do that.

First things first is to disable those Language Monitors. You can do this by running a script.

https://www.papercut.com/kb/Main/BidirectionalSupport#managing-bidirectional-support-for-an-entire-print-server

basically run this command in an elevated PowerShell windows . Change en-US to your locale if not US. You might have to set cscript as the default

$printers = Get-Printer -Name *
foreach ($p in $printers) {
cscript c:\Windows\System32\Printing_Admin_Scripts\en-US\prncnfg.vbs -t -p $p.name -enablebidi
}

Thanks

Hi Alan,

After your response this morning I did some google delving, found that exact papercut article and disabled bidirectional support. Haven't seen a print spooler crash since 6:30ish AM this morning! When prior to disabling bidirectional support, the spooler was crashing every couple of hours.

I will continue to monitor the server and a big thank you for taking the time to look into this for me!

@Stefan Costa

the spooler looks to be in a loop making SNMP calls.

You can tell this system is a print server. So many vendor dlls.

There are many language monitors. The spooler does not have a way to remove these, it takes a registry edit or just rename the file in system32.

Image path: C:\Windows\System32\hpmlm225.dll  
Image name: hpmlm225.dll  
Timestamp:        Wed Nov 14 05:39:16 2018 (5BEC2584)  
  
Image path: C:\Windows\System32\hpmlm190.dll  
Image name: hpmlm190.dll  
Timestamp:        Thu Aug 25 23:04:40 2016 (57BFDBF8)  
 
Image path: C:\Windows\System32\hpmlm180.dll  
Image name: hpmlm180.dll  
Timestamp:        Tue Mar 17 02:16:46 2015 (5507F0FE)  

Image path: C:\Windows\System32\hpmpm082.dll  
Image name: hpmpm082.dll  
Timestamp:        Thu Aug 20 11:21:06 2020 (5F3EBF12)  

I do not like this one the most because I am guessing it's for some at home network InkJet from HP.
Image path: C:\Windows\System32\hpinkstsc52aLM.dll
Image name: hpinkstsc52aLM.dll
Timestamp: Mon May 6 08:59:04 2019 (5CD059C8)

Image path: C:\Windows\System32\zdnNLM64.dll
Image name: zdnNLM64.dll
Timestamp: Fri Jul 28 04:02:51 2017 (597B19DB)

Image path: C:\Windows\System32\rica8Llm.dll
Image name: rica8Llm.dll
Timestamp: Wed Dec 25 22:44:28 2013 (52BBD04C)

This is a file from Windows Vista. Code name LongHorn. HP named all the Vista specific binaries with LH or LHN in the file name
Image path: C:\Windows\System32\HPZ3LLHN.DLL
Image name: HPZ3LLHN.DLL
Timestamp: Wed Aug 9 20:27:14 2006 (44DAA792)

Image path: C:\Windows\System32\HP1100LM.DLL  
Image name: HP1100LM.DLL  
Timestamp:        Fri Aug 31 00:03:11 2012 (504061AF)  

Thread 19 is the failure but there is not a trace of the culprit

19 Id: 13a4.18a4 Suspend: 0 Teb: 00000084`a4595000 Unfrozen

Child-SP RetAddr Call Site
00000084a49c4000 00007ffad56035aa wsnmp32!FreeVarBindList+0x11
00000084a49c4030 00007ffad56035aa wsnmp32!FreeVarBindList+0x16
00000084a49c4060 00007ffad56035aa wsnmp32!FreeVarBindList+0x16
00000084a49c4090 00007ffad56035aa wsnmp32!FreeVarBindList+0x16
00000084a49c40c0 00007ffad56035aa wsnmp32!FreeVarBindList+0x16
00000084a49c40f0 00007ffad56035aa wsnmp32!FreeVarBindList+0x16
00000084a49c4120 00007ffad56035aa wsnmp32!FreeVarBindList+0x16

The failure is a stack overflow most like caused by one of the components above.

wsnmp32!FreeVarBindList+0x11:
00007ffad56035a5 e8eaffffff call wsnmp32!FreeVarBindList (00007ffad5603594)
Resetting default scope

FAULTING_IP:
wsnmp32!SnmpFreeVbl+de
00007ffa`d560c04e 8bd3 mov edx,ebx

EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffad56035a5 (wsnmp32!FreeVarBindList+0x0000000000000011)
ExceptionCode: c00000fd (Stack overflow)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 00000084a49c3ff8

BUGCHECK_STR: STACK_OVERFLOW

DEFAULT_BUCKET_ID: STACK_OVERFLOW

PROCESS_NAME: spoolsv.exe

RECURRING_STACK: From frames 0x1 to 0x0

ERROR_CODE: (NTSTATUS) 0xc00000fd - A new guard page for the stack cannot be created.

EXCEPTION_CODE: (NTSTATUS) 0xc00000fd - A new guard page for the stack cannot be created.