How Can I Find The Root Cause Running Out Of Freesysptes

See more:

WinDbg

Need some debug help
I manage to get the !sysptes 4 working on the affected machines.
It shows hunderds of the following items, guess it is eating the syspte's

kd> !sysptes 4

0x722 System PTEs allocated to mapping locked pages

VA       MDL     PageCount  Caller/CallersCaller
f7857000 86681c58        8 nt!MmMapLockedPages+0x18/LiveKdD+0x1182
f4e30818 85007c38        1 TDI!TdiCopyBufferToMdl+0x48/tcpip!CopyFlatToNdis+0x24
f4d15090 84b2b410        1 netbt!DispatchIoctls+0x650/netbt!NbtDispatchDevCtrl+0xce
f79ebdc8 8658ecf0        2 mrxsmb!BowserMapUsersBuffer+0x93/mrxsmb!BowserCommonDeviceIoControlFile+0x19d
f4ce6418 865ddee0        1 TDI!TdiCopyBufferToMdl+0x48/tcpip!CopyFlatToNdis+0x24
f4e3b448 85d00320        1 TDI!TdiCopyBufferToMdl+0x48/tcpip!CopyFlatToNdis+0x24
f5067b78 849e09a0        1 TDI!TdiCopyBufferToMdl+0x48/tcpip!CopyFlatToNdis+0x24

and this goes on and on.

I managed to get a live dump from 1 of the systems, now i need some help to get the root cause.
What todo in windbg that points to the hungry syspte byte


What I have discoverd is that the csrss.exe process is running more than once, (2 of them running fine) and in time more csrss.exe processes are started. The stange thing is that it doesn't has any threat's/hhandle's

kd> !PROCESS 85cf3778 2
PROCESS 85cf3778  SessionId: 3  Cid: 15f0    Peb: 7ffda000  ParentCid: 0128
    DirBase: 2c12c000  ObjectTable: 00000000  HandleCount:   0.
    Image: csrss.exe

kd> !vm
....
         15f0 csrss.exe            0 (         0 Kb)
         14c8 csrss.exe            0 (         0 Kb)
         08f0 csrss.exe            0 (         0 Kb)

No active threads