winxp hit the same issue 

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bab910ce, The address that the exception occurred at
Arg3: bacfbbf8, Exception Record Address
Arg4: bacfb8f4, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. 

The memory could not be %s.

FAULTING_IP: 
BALLOON!BalloonTellHost+9c [c:\cygwin\tmp\build\source\internal-kvm-guest-drivers-windows

\balloon\sys\balloon.c @ 347]
bab910ce 8b4304          mov     eax,dword ptr [ebx+4]

EXCEPTION_RECORD:  bacfbbf8 -- (.exr 0xffffffffbacfbbf8)
ExceptionAddress: bab910ce (BALLOON!BalloonTellHost+0x0000009c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000004
Attempt to read from address 00000004

CONTEXT:  bacfb8f4 -- (.cxr 0xffffffffbacfb8f4)
eax=00001000 ebx=00000000 ecx=bacfbce8 edx=00000000 esi=00000000 edi=00001000
eip=bab910ce esp=bacfbcc0 ebp=bacfbd00 iopl=0         nv up ei pl nz ac pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010216
BALLOON!BalloonTellHost+0x9c:
bab910ce 8b4304          mov     eax,dword ptr [ebx+4] ds:0023:00000004=????????
Resetting default scope

PROCESS_NAME:  System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The 

memory could not be %s.

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00000004

READ_ADDRESS:  00000004 

FOLLOWUP_IP: 
BALLOON!BalloonTellHost+9c [c:\cygwin\tmp\build\source\internal-kvm-guest-drivers-windows

\balloon\sys\balloon.c @ 347]
bab910ce 8b4304          mov     eax,dword ptr [ebx+4]

BUGCHECK_STR:  0x7E

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from bab914b4 to bab910ce

STACK_TEXT:  
bacfbd00 bab914b4 8a3f3ec0 00000000 8a4b6244 BALLOON!BalloonTellHost+0x9c [c:\cygwin\tmp\build

\source\internal-kvm-guest-drivers-windows\balloon\sys\balloon.c @ 347]
bacfbd28 bab90910 75c0c300 00000400 806e6900 BALLOON!BalloonFill+0x244 [c:\cygwin\tmp\build

\source\internal-kvm-guest-drivers-windows\balloon\sys\balloon.c @ 258]
bacfbd40 ba50f042 7831d090 8a3f0330 87ce2f68 BALLOON!FillLeakWorkItem+0x90 [c:\cygwin\tmp\build

\source\internal-kvm-guest-drivers-windows\balloon\sys\device.c @ 382]
bacfbd5c ba50f0aa 8a3dca80 bacfbd7c 80576ad5 wdf01000!FxWorkItem::WorkItemHandler+0xad
bacfbd68 80576ad5 8a3dca80 87ce2f68 8056485c wdf01000!FxWorkItem::WorkItemThunk+0x19
bacfbd7c 8053876d 8a3f0330 00000000 8a4b3b30 nt!IopProcessWorkItem+0x13
bacfbdac 805cff64 8a3f0330 00000000 00000000 nt!ExpWorkerThread+0xef
bacfbddc 805460de 8053867e 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FAULTING_SOURCE_CODE:  
   343: 
   344:     sg.physAddr = MmGetPhysicalAddress(drvCtx->pfns_table);
   345:     sg.ulSize = sizeof(drvCtx->pfns_table[0]) * drvCtx->num_pfns;
   346: 
>  347:     if(0 > vq->vq_ops->add_buf(vq, &sg, 1, 0, devCtx, NULL, 0))
   348:     {
   349:         TraceEvents(TRACE_LEVEL_ERROR, DBG_HW_ACCESS, "<-> %s :: Cannot add buffer\n", 

__FUNCTION__);
   350:         return;
   351:     }
   352:     vq->vq_ops->kick(vq);


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  BALLOON!BalloonTellHost+9c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: BALLOON

IMAGE_NAME:  BALLOON.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4f666145

STACK_COMMAND:  .cxr 0xffffffffbacfb8f4 ; kb

FAILURE_BUCKET_ID:  0x7E_BALLOON!BalloonTellHost+9c

BUCKET_ID:  0x7E_BALLOON!BalloonTellHost+9c

Followup: MachineOwner
---------

Moving to 6.4
Added a tech note

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Shutdown or Suspend to S3/S4 while memory ballooning (inflate/deflate), can result in a BSOD.

*** Bug 803940 has been marked as a duplicate of this bug. ***

please check with build25
http://download.devel.redhat.com/brewroot/packages/virtio-win-prewhql/0.1/25/win/virtio-win-prewhql-0.1.zip

Re-test this on virtio-win-prewhql-25

steps as same as described in comment #0

Actual Results:

Guest still BOSD happened ,I use !analyze -v to view the dmp ,results exactly same as comment #3

Based on above ,this issue still existed .
re-assign this issue .

(In reply to comment #10)
> Re-test this on virtio-win-prewhql-25
> 
> steps as same as described in comment #0
> 
> Actual Results:
> 
> Guest still BOSD happened ,I use !analyze -v to view the dmp ,results exactly
> same as comment #3
> 
> Based on above ,this issue still existed .
> re-assign this issue .

Hi Mike,
Could you please upload the crash dump file?
Thank you,
Vadim.

Hi Mike,
Could you give a try to build 26?
http://download.devel.redhat.com/brewroot/packages/virtio-win-prewhql/0.1/26/win/virtio-win-prewhql-0.1.zip

It not a finale fix for this problem, rather a workaround which should minimize the chances of hitting this BSOD.

Thank you,
Vadim.

(In reply to comment #13)
> Hi Mike,
> Could you give a try to build 26?
> http://download.devel.redhat.com/brewroot/packages/virtio-win-prewhql/0.1/26/win/virtio-win-prewhql-0.1.zip
> 
> It not a finale fix for this problem, rather a workaround which should minimize
> the chances of hitting this BSOD.
> 
> Thank you,
> Vadim.

Hi, Vadim

Tried 7 times w/ virtio-win-prewhql-26 ,I did not hit the issue described in comment #0

Since this is not a final fix.

How to handle the bug's status ?

Best Regards,
Mike

Hi Mike,
Balloon driver will be slightly redesigned in 6.4,
including the piece of code which leads to the above problem.
If you cannot reproduce this problem, let's close it for now
and hope that we will not see it any more.
Best,
Vadim.

(In reply to comment #15)
> Hi Mike,
> Balloon driver will be slightly redesigned in 6.4,
> including the piece of code which leads to the above problem.
> If you cannot reproduce this problem, let's close it for now
> and hope that we will not see it any more.
> Best,
> Vadim.

Let's keep it open now . QE will run full round virtio balloon recently ,if We did not this this issue and the version ack change back to rhel6.3.0+ ,I will close this one 

Mike

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0751.html