OS: Windows Embedded CE 6.0
Updates: All Until May 2008
Platform: ARMV4I
Display Format: 640x480 @ 16-bit
Background Image: Bitmap, 640x480 @ 24-bit Bottom Up DIB
FS: RAM and ROM Filesystem with Persistent Registry in NAND.

Exception 'Data Abort' (4):
Thread-Id=0412000a(pth=85cf31bc)
Proc-Id=00400002(pprc=83689aa0) 'NK.EXE'
VM-active=040a000a(pprc=85cf309c) 'CTLPNL.EXE'
PC=c022b74c(filesys.dll+0x0002b74c)
RA=c022b5ac(filesys.dll+0x0002b5ac)
SP=d18fea40
BVA=04000404

The quick description of my problem is that loading in a background
image other than the one that is supplied (default) with Windows
Embedded CE 6.0 results in a Data Abort whenever the
GetSystemMemoryDivision function is called.  This function is called
via the System Control Panel Applet when it is loaded and is an easy
way to reproduce the problem.

Thank you,
Brad.
In case this problem has to do with the whole Control Panel Applet
code I wrote a simple C App (see source below) with a shortcut in the
start menu.  Running the app as the first thing done in the system
results in the Data Abort as well.

I'm hoping that either someone has come across this before, has a good
hint where to look, or has access to more PRIVATE code than I do and
might mind giving me some pointers on where to look or check out.

Crash Details:
WINCE600\PRIVATE\WINCEOS\COREOS\FILESYS\HEAP\heap.c at ~ line561.

From the dissassembly it looks like a local variable pTrac either
starts with an invalid value or gets an invalid value because
eventually pTrac + (4 bytes) is accessed (read) which results in the
Data Abort at the BVA address (pTrac is 0x04000404.)

Stack Dump:
Filesys|CountStorePages(ulong* 0xD18FEA64, ulong* 0xD18FEA60)
FileSys|FS_GetSystemMemoryDivision(ulong* NULL, ulong* NULL, ulong*
NULL)
CoreDll|xxx_GetSystemMemoryDivision(ulong* 0x1207E3B8, ulong*
0x1207E36C, ulong* 0x1207E3C0)
CplMain|GetMemoryInfo(ulong& 0x1000, ulong& 0x0, ulong& 0x0, ulong&
0x0, ulong& 0x0)

Config.bib (Related Items):
AUTOSIZE=ON
;FSRAMPERCENT=202020202

I've created a very simple C App that simply calls GetMemoryDivision
alone and the same problem is observed.  In this case the call stack
is the same except CplMain|GetMemoryInfo is replaced by wmain().

Small Test App Source:
int _tmain(
    int                                        argc,
    _TCHAR*                                argv[])
{
    DWORD    store        = 0;
    DWORD    ram            = 0;
    DWORD    pageSize    = 0;

    _tprintf(TEXT("Memory Division\r\n"));

    if (!::GetSystemMemoryDivision(
            &store,
            &ram,
            &pageSize))
    {
        _tprintf(TEXT("    GetSystemMemoryDivision Failed(%d)\r
\n"),::GetLastError());

        return -1;
    }

    _tprintf(TEXT("    Object Store Size: %d MB\r\n"), (store *
pageSize) / (1024 * 1024));
    _tprintf(TEXT("    Ram Size         : %d MB\r\n"), (ram * pageSize) /
(1024 * 1024));
    _tprintf(TEXT("    Page Size        : %d Bytes\r\n"), pageSize);

    return 0;
} // _tmain

Windows CE Debug Output:
<snip>

Initializing Database
 18259 PID:400002 TID:1c40002 EventLog: System supports UTF8.
EventLog will write log files in this format.
 18265 PID:400002 TID:680002 DB:Validation: Name already exists
DB_notify_events
 18266 PID:400002 TID:1c40002 EventLog: Begin loading up format and
outputter extensions
 18267 PID:400002 TID:680002 DB:CeCreateDatabase failed
 18272 PID:400002 TID:1c40002 EventLog: Done loading up format and
outputter extensions.
 18275 PID:400002 TID:680002 DB:Validation: Name already exists
DB_notify_events
 18275 PID:400002 TID:1c40002 EventLog: About to initialize
eventLogger for <Application>
 18276 PID:400002 TID:680002 DB:CeCreateDatabase failed
 18284 PID:400002 TID:1c40002 EventLog: Initialized file log windows
\ApplicationLog.xml, maxLog size = 32768
 18291 PID:400002 TID:680002 FileSys: DEBUGCHK failed in file C:\ymzki
\private\winceos\COREOS\filesys\dbase\.\btrees.c at line 567
 18292 PID:400002 TID:1c40002 EventLog: EventLog <<Application>>
successfully initialized.
 21247 PID:400002 TID:1c40002 EventLog: About to initialize
eventLogger for <System>
 21254 PID:400002 TID:1c40002 EventLog: Initialized file log windows
\SystemLog.xml, maxLog size = 32768
 21255 PID:400002 TID:1c40002 EventLog: EventLog <<System>>
successfully initialized.
 21260 PID:400002 TID:1c40002 OSAXST1: >>> Loading Module
'eventlogmsgs.dll' (0x878CD42C) at address 0xC0D60000-0xC0D66000 in
Process 'NK.EXE' (0x83699AA0)
 21428 PID:400002 TID:680002 FS: AbandonLogBlock called
 21428 PID:400002 TID:680002 ERROR: C:\ymzki\private\winceos\COREOS
\filesys\dbase\.\dbase.c line 2351:
 21429 PID:400002 TID:680002 DB:Recreating sort indexes for dbase
0x30000001
 21432 PID:400002 TID:680002 ERROR: C:\ymzki\private\winceos\COREOS
\filesys\dbase\.\record.c line 225:
 21433 PID:400002 TID:680002 DB:CeWriteRecordProps failed
 21433 PID:400002 TID:680002 ERROR: C:\ymzki\private\winceos\COREOS
\filesys\dbase\.\initdb.c line 648:
 21434 PID:400002 TID:680002 Error writing record ending line 349
 21434 PID:400002 TID:680002 Filesystem initialized!

<snip>

 75375 PID:e50006 TID:5580006 [NOTIFY] RemoveAppRunAtTime::Starting
Database Sweep...
 75376 PID:e50006 TID:5580006 [NOTIFY] SetUserNotification (or
replacing 00000000)
 75380 PID:400002 TID:5580006 FileSys: DEBUGCHK failed in file C:
\ymzki\private\winceos\COREOS\filesys\dbase\.\btrees.c at line 567
 75699 PID:400002 TID:47d0002 DeviceFolder::LoadDevice(Services
\TIMESVC) last 479 Ticks
 75700 PID:47c0002 TID:47d0002 Completed initializating services for
Services.exe
 75702 PID:400002 TID:5580006 FS: AbandonLogBlock called
 75702 PID:400002 TID:5580006 ERROR: C:\ymzki\private\winceos\COREOS
\filesys\dbase\.\dbase.c line 2351:
 75703 PID:400002 TID:5580006 DB:Recreating sort indexes for dbase
0x30000004
 75704 PID:400002 TID:5580006 ERROR: C:\ymzki\private\winceos\COREOS
\filesys\dbase\.\record.c line 225:
 75704 PID:400002 TID:5580006 DB:CeWriteRecordProps failed
 75705 PID:e50006 TID:5580006 [NOTIFY] SetUserNotification::Could not
write database

<snip>

 86324 PID:400002 TID:48e0006 Bailing on save bits because someone
has an open DC!
 87487 PID:400002 TID:48e0006 Bailing on save bits because someone
has an open DC!
 87489 PID:400002 TID:48e0006 Grow Gdi handle table from 320 to 384
 89537 PID:407000a TID:40c000a OSAXST1: >>> Loading Module
'coredll.dll' (0x87AF76CC) at address 0x40010000-0x40124000 in Process
'memory_division.exe' (0x85BFA4F8)
 89601 PID:407000a TID:40c000a OSAXST1: >>> Loading Module
'memory_division.exe' (0x85BFA4F8) at address 0x00010000-0x00015000 in
Process 'memory_division.exe' (0x85BFA4F8)
PB Debugger Loaded symbols for 'C:\WINCE600\OSDESIGNS\XXXX\XXXX\RELDIR
\XXXX_ARMV4I_DEBUG\MEMORY_DIVISION.EXE'
 90141 PID:407000a TID:40c000a Console NOT redirected for process
0x407000A
 90144 PID:400002 TID:40c000a DEVICE!RegReadActivationValues
RegQueryValueEx(Drivers\Console\BusPrefix) returned 2
PB Debugger Loaded symbols for 'C:\WINCE600\OSDESIGNS\XXXX\XXXX\RELDIR
\XXXXX_ARMV4I_DEBUG\CONSOLE.DLL'
 90155 PID:400002 TID:40c000a OSAXST1: >>> Loading Module
'console.dll' (0x85CC0BE8) at address 0x401E0000-0x401F8000 in Process
'NK.EXE' (0x83699AA0)
 90327 PID:e50006 TID:40c000a OSAXST1: >>> Loading Module
'console.dll' (0x85CC0BE8) at address 0x401E0000-0x401F8000 in Process
'udevice.exe' (0x858ECE7C)
 91012 PID:e50006 TID:cc0002 [NOTIFY] HandleSystemEvent 7 /ADD CON1:
 92665 PID:400002 TID:40c000a AddToProcessInputLocaleTable: Added
process to ProcessInputLocale table, hProcess = 0x0407000A
 92724 PID:400002 TID:40c000a Exception 'Data Abort' (4): Thread-
Id=040c000a(pth=85c71a74), Proc-Id=00400002(pprc=83699aa0) 'NK.EXE',
VM-active=0407000a(pprc=85bfa4f8) 'memory_division.exe'
 92725 PID:400002 TID:40c000a PC=c022b74c(filesys.dll+0x0002b74c)
RA=c022b5ac(filesys.dll+0x0002b5ac) SP=d07cfdc0, BVA=10001004