Windbg!cs Critical Zone deadlock

Summarize:
In Win7, when CS is initialized, the nlockcout is -1,recursioncount 0; Recursioncount is own thread increments once per call to enter, but only lockcount minus 1 for the first time.
In XP, when CS is initialized, Nlockcout is -1,recursioncount to 0, and two numbers are added 1 per enter
In general, the difference between XP and Win7 is only reflected in the direction of Nlockcount change and the number of changes!

0:000>!cs

-----------------------------------------
Debuginfo = 0x002357b0
Critical section = 0X07A93F30 (+0X7A93F30)
Not LOCKED
LockSemaphore = 0x0
Spincount = 0x00000000
-----------------------------------------
Debuginfo = 0x002357d8
Critical section = 0X076FDCF4 (+0X76FDCF4)
Not LOCKED
LockSemaphore = 0x0
Spincount = 0x00000000
-----------------------------------------
Debuginfo = 0x00235800
Critical section = 0X076FDD10 (+0X76FDD10)
Not LOCKED
LockSemaphore = 0x0
Spincount = 0x00000000
-----------------------------------------

-----------------------------------------
Debuginfo = 0x0018d708
Critical section = 0x01d0be14 (+0X1D0BE14)
LOCKED
Lockcount = 0x0
OwningThread = 0x00000744
Recursioncount = 0x1
LockSemaphore = 0x0
Spincount = 0x00000400
-----------------------------------------

-----------------------------------------
Debuginfo = 0x0020f030
Critical section = 0x02b29750 (+0x2b29750)
LOCKED
Lockcount = 0x1
OwningThread = 0x0000053c
Recursioncount = 0x1
LockSemaphore = 0x4b0
Spincount = 0x00000000
-----------------------------------------

-----------------------------------------
Debuginfo = 0x0020f058
Critical section = 0x02b29770 (+0x2b29770)
LOCKED
Lockcount = 0xFFFFFFFE
OwningThread = 0x00000000
Recursioncount = 0xFFFFFFFE
LockSemaphore = 0x4ac
Spincount = 0x00000000
-----------------------------------------

0:000> DT 0x01d0be14 Ntdll!_rtl_critical_section
+0x000 debuginfo:0x0018d708 _rtl_critical_section_debug
+0x004 Lockcount:0n0
+0x008 recursioncount:0n1
+0x00c owningthread:0x00000744 Void
+0x010 LockSemaphore: (NULL)
+0x014 spincount:0x400
0:000> DT 0x02b29750 Ntdll!_rtl_critical_section
+0x000 debuginfo:0x0020f030 _rtl_critical_section_debug
+0x004 lockcount:0n1
+0x008 recursioncount:0n1
+0x00c owningthread:0x0000053c Void
+0x010 locksemaphore:0x000004b0 Void
+0x014 spincount:0
0:000> DT 0x02b29770 Ntdll!_rtl_critical_section
+0x000 debuginfo:0x0020f058 _rtl_critical_section_debug
+0x004 lockcount:0n-2
+0x008 recursioncount:0n-2
+0x00c OwningThread: (NULL)
+0x010 LOCKSEMAPHORE:0X000004AC Void
+0x014 spincount:0
0:000> ~~[744]
. 0 id:404.744 suspend:1 teb:7ffdf000 unfrozen
Start:ftnn!wwinmaincrtstartup (0044EA4B)
priority:0 Priority class:32 Affinity:3
0:000> ~~[53c]
8 id:404.53c suspend:1 teb:7ffd6000 unfrozen
start:ombase! Omthread::createthread_inner (10026530)
priority:0 Priority class:32 Affinity:3
0:000> DT 0X076FDD10 Ntdll!_rtl_critical_section
+0x000 debuginfo:0x00235800 _rtl_critical_section_debug
+0x004 lockcount:0n-1
+0x008 Recursioncount:0n0
+0x00c OwningThread: (NULL)
+0x010 LockSemaphore: (NULL)
+0x014 spincount:0
0:000> DT 0X07A93F30 Ntdll!_rtl_critical_section
+0x000 debuginfo:0x002357b0 _rtl_critical_section_debug
+0x004 lockcount:0n-1
+0x008 Recursioncount:0n0
+0x00c OwningThread: (NULL)
+0x010 LockSemaphore: (NULL)
+0x014 spincount:0

//=======================================================================
can be easily output with one command
You can see the following three locked CS, the first two are No. 0 and Line 8 respectively, the 3rd one does not have a thread is permanently locked,
Again, the No. 0 and Line 8 line stacks are 02b29b88 in the critical section, which is the 3rd CS zone
//=======================================================================
0:019>!cs-s-L
-----------------------------------------
Debuginfo = 0x0018d710
Critical section = 0x01d0be14 (+0X1D0BE14)
LOCKED
Lockcount = 0x0
OwningThread = 0x0000093c
Recursioncount = 0x1
LockSemaphore = 0x0
Spincount = 0x00000400
ntdll! RtlpStackTraceDataBase is NULL. Probably the stack traces is not enabled.
-----------------------------------------
Debuginfo = 0x001a3f68
Critical section = 0x02b29b88 (+0x2b29b88)
LOCKED
Lockcount = 0x1
OwningThread = 0x00000864
Recursioncount = 0x1
LockSemaphore = 0x64c
Spincount = 0x00000000
ntdll! RtlpStackTraceDataBase is NULL. Probably the stack traces is not enabled.
-----------------------------------------
Debuginfo = 0x001a3f90
Critical section = 0x02b29ba8 (+0X2B29BA8)
LOCKED
Lockcount = 0xFFFFFFFE
OwningThread = 0x00000000
Recursioncount = 0xFFFFFFFE
LockSemaphore = 0x4B8
Spincount = 0x00000000
ntdll! RtlpStackTraceDataBase is NULL. Probably the stack traces is not enabled.

0:019> ~~[93C]
0 id:598.93c suspend:1 teb:7ffdf000 unfrozen
Start:ftnn!wwinmaincrtstartup (0044EA4B)
priority:0 Priority class:32 Affinity:3
0:019> ~~[864]
8 id:598.864 suspend:1 teb:7ffd6000 unfrozen
start:kernel32! Basethreadstartthunk (7C8106E9)
priority:0 Priority class:32 Affinity:3

0:019> ~0 KBN
# ChildEBP RetAddr Args to Child
XX 0012e45c 7c92df3c 7c93b22b 0000064c 00000000 ntdll! Kifastsystemcallret
0012e460 7c93b22b 0000064c 00000000 00000000 ntdll! Ntwaitforsingleobject+0xc
0012e4e8 7c921046 00b29b88 006e0e32 02b29b88 ntdll! rtlpwaitforcriticalsection+0x132
0012e4f0 006e0e32 02b29b88 19021feb 0012e590 ntdll! rtlentercriticalsection+0x46
0012e558 006a8f69 0012e590 1910faeb 006a8dfb ctrlcenter!gloox::connectiontcpbase::send+0x42 [d:\dailybuild\ftnn_ Git\ftnn\glooxlib\gloox-1.0.11\connectiontcpbase.cpp @ 125]
0012e564 006a8dfb 19021f9b 02b27b10 02b32538 ctrlcenter!gloox::clientbase::send+0x59 [d:\dailybuild\ftnn_git\ftnn\ Glooxlib\gloox-1.0.11\clientbase.cpp @ 1097]
0012e604 006a8bac 02b27b10 02b32538 00000001 ctrlcenter!gloox::clientbase::send+0x5b [d:\dailybuild\ftnn_git\ftnn\ Glooxlib\gloox-1.0.11\clientbase.cpp @ 1060]
0012e61c 006a8b44 19021cc3 02b474e4 02b3a3c8 ctrlcenter!gloox::clientbase::send+0x4c [d:\dailybuild\ftnn_git\ftnn\ Glooxlib\gloox-1.0.11\clientbase.cpp @ 1014]
0012e668 006b9297 0012e758 01d0b978 00000008 ctrlcenter!gloox::clientbase::send+0xe4 [d:\dailybuild\ftnn_git\ftnn\ Glooxlib\gloox-1.0.11\clientbase.cpp @ 1005]
0012e91c 006fe25c 0012e990 190213c7 00000000 ctrlcenter!gloox::rostermanager::getsimple+0x137 [d:\dailybuild\ftnn_ Git\ftnn\glooxlib\gloox-1.0.11\rostermanager.cpp @ 923]
0a 0012ead8 006fa44b 0001adb2 00000000 00000000 ctrlcenter! cc_im_roster::getusersimpleinfo+0x32c [D:\dailybuild\ftnn_git\ftnn\ctrlcenter\ctrlcenter\cc_im_roster.cpp @ 723]
0b 0012eaec 03f86dcd 0001adb2 00000000 00000000 ctrlcenter! icc_im::getusersimpleinfo+0x2b [D:\dailybuild\ftnn_git\ftnn\ctrlcenter\ctrlcenter\icc_im.cpp @ 148]
0c 0012eb14 03f86bcd 0001adb2 00000000 4a6a23fa qtuiassem! Cchatuserheaderdata::D otryrostersimpleinforequest+0x5d [d:\dailybuild\ftnn_git\ftnn\qtuiassem\sns\ Chatuserheaderdata.cpp @ 162]
0d 0012f394 03f946c9 0418DBDC 0001adb2 00000000 qtuiassem! cchatuserheaderdata::getuserheadimg+0x1ed [D:\dailybuild\ftnn_git\ftnn\qtuiassem\sns\chatuserheaderdata.cpp @ 102 ]

0:019> to KBN
# ChildEBP RetAddr Args to Child
XX 02b0f84c 7c92df3c 7c93b22b 000004b8 00000000 ntdll! Kifastsystemcallret
02b0f850 7c93b22b 000004b8 00000000 00000000 ntdll! Ntwaitforsingleobject+0xc
02b0f8d8 7c921046 00b29ba8 006cf60e 02b29ba8 ntdll! rtlpwaitforcriticalsection+0x132
02b0f8e0 006cf60e 02b29ba8 1ba0021b 00000000 ntdll! rtlentercriticalsection+0x46
02b0f960 006e0dd4 000f4240 00000010 006a48fa ctrlcenter!gloox::connectiontcpclient::recv+0x3e [d:\dailybuild\ftnn_ Git\ftnn\glooxlib\gloox-1.0.11\connectiontcpclient.cpp @ 130]
02b0f96c 006a48fa 1ba00393 00000000 02B27B10 ctrlcenter!gloox::connectiontcpbase::receive+0x24 [D:\DAILYBUILD\FTNN _git\ftnn\glooxlib\gloox-1.0.11\connectiontcpbase.cpp @ 116]
02b0fa78 00707090 02b27b10 1ba00063 77d191c6 CTRLCENTER!GLOOX::CLIENTBASE::CONNECT+0X3AA [d:\dailybuild\ftnn_git\ Ftnn\glooxlib\gloox-1.0.11\clientbase.cpp @ 227]
02b0ff70 007071b4 100264b8 000010ef 00000000 ctrlcenter! CC_IM::LOGIN_INNER+0XB10 [D:\dailybuild\ftnn_git\ftnn\ctrlcenter\ctrlcenter\cc_im.cpp @ 141]
02b0ff74 100264b8 000010ef 00000000 00000000 ctrlcenter! Cc_im::P rethreadmsg+0x14 [d:\dailybuild\ftnn_git\ftnn\ctrlcenter\ctrlcenter\cc_im.cpp @ 340]
Warning:stack unwind information not available. Following frames may wrong.
02b0ff90 7c93017b 00000000 000010ef 00000000 ombase! omthread::create_inner+0x68
0a 02b101a8 00380035 00350034 00310030 00350032 ntdll! Rtlallocateheap+0x1c2
0b 02b101a8 00000000 00350034 00310030 00350032 0x380035

//===============================================
A more concise approach
//===============================================

0:019>!cs-o-L
-----------------------------------------
Debuginfo = 0x0018d710
Critical section = 0x01d0be14 (+0X1D0BE14)
LOCKED
Lockcount = 0x0
OwningThread = 0x0000093c
Recursioncount = 0x1
LockSemaphore = 0x0
Spincount = 0x00000400
OwningThread Dbgid = ~0s
OwningThread Stack =
ChildEBP RetAddr Args to Child
0012e45c 7c92df3c 7c93b22b 0000064c 00000000 ntdll! Kifastsystemcallret (FPO: [0,0,0])
0012e460 7c93b22b 0000064c 00000000 00000000 ntdll! NTWAITFORSINGLEOBJECT+0XC (FPO: [3,0,0])
0012e4e8 7c921046 00b29b88 006e0e32 02b29b88 ntdll! rtlpwaitforcriticalsection+0x132 (FPO: [Non-fpo])
0012e4f0 006e0e32 02b29b88 19021feb 0012e590 ntdll! RTLENTERCRITICALSECTION+0X46 (FPO: [1,0,0])
0012e558 006a8f69 0012e590 1910faeb 006a8dfb ctrlcenter!gloox::connectiontcpbase::send+0x42 (FPO: [Uses EBP] [1,19,5]) ( Conv:thiscall)
0012e564 006a8dfb 19021f9b 02b27b10 02b32538 ctrlcenter!gloox::clientbase::send+0x59 (FPO: [0,1,0]) (Conv:thiscall)
0012e604 006a8bac 02b27b10 02b32538 00000001 ctrlcenter!gloox::clientbase::send+0x5b (Conv:thiscall)
0012e61c 006a8b44 19021cc3 02b474e4 02b3a3c8 ctrlcenter!gloox::clientbase::send+0x4c (FPO: [0,0,1]) (Conv:thiscall)
0012e668 006b9297 0012e758 01d0b978 00000008 ctrlcenter!gloox::clientbase::send+0xe4 (FPO: [Uses EBP] [3,13,5]) (conv:th Iscall)
0012e91c 006fe25c 0012e990 190213c7 00000000 ctrlcenter!gloox::rostermanager::getsimple+0x137 (Conv:thiscall)
0012ead8 006fa44b 0001adb2 00000000 00000000 ctrlcenter! CC_IM_ROSTER::GETUSERSIMPLEINFO+0X32C (FPO: [Uses EBP] [2,104,5]) (Conv:thiscall)
0012EAEC 03F86DCD 0001adb2 00000000 00000000 ctrlcenter! ICC_IM::GETUSERSIMPLEINFO+0X2B (Conv:stdcall)
0012eb14 03f86bcd 0001adb2 00000000 4a6a23fa qtuiassem! Cchatuserheaderdata::D otryrostersimpleinforequest+0x5d (FPO: [Uses EBP] [2,3,4]) (Conv:thiscall)
0012f394 03f946c9 0418DBDC 0001adb2 00000000 qtuiassem! Cchatuserheaderdata::getuserheadimg+0x1ed (FPO: [Uses EBP] [4,536,5]) (Conv:thiscall)
0012f3ac 03fb1533 4a6a3b6a 07500c78 0410ae18 qtuiassem! Cftroomdatadelegate::getroommemberheader+0x29 (FPO: [0,1,0]) (Conv:thiscall)
0012f4b0 0405a13a 07500ec0 0012f66c 0410ae18 qtuiassem! Cfgmemberlistgridex::onownerdrawcell+0xd3 (Conv:thiscall)
0012f4c8 0405a318 07500c78 00000000 0000ff58 qtuiassem!_afxdispatchcmdmsg+0x72 (FPO: [Non-fpo]) (Conv:stdcall)
0012f4f8 04057e34 00000000 0000ff58 0012f518 qtuiassem! ccmdtarget::oncmdmsg+0x118 (FPO: [Non-fpo]) (Conv:thiscall)
0012f520 04055f01 0000004e 00000064 07500ec0 qtuiassem! cwnd::reflectchildnotify+0x52 (FPO: [Non-fpo]) (Conv:thiscall)
0012f538 04056571 0012f66c 4a6a3d66 074fffc8 qtuiassem! cwnd::sendchildnotifylastmsg+0x32 (FPO: [1,0,4]) (Conv:thiscall)
-----------------------------------------
Debuginfo = 0x001a3f68
Critical section = 0x02b29b88 (+0x2b29b88)
LOCKED
Lockcount = 0x1
OwningThread = 0x00000864
Recursioncount = 0x1
LockSemaphore = 0x64c
Spincount = 0x00000000
OwningThread Dbgid = ~8s
OwningThread Stack =
ChildEBP RetAddr Args to Child
02b0f84c 7c92df3c 7c93b22b 000004b8 00000000 ntdll! Kifastsystemcallret (FPO: [0,0,0])
02b0f850 7c93b22b 000004b8 00000000 00000000 ntdll! NTWAITFORSINGLEOBJECT+0XC (FPO: [3,0,0])
02b0f8d8 7c921046 00b29ba8 006cf60e 02b29ba8 ntdll! rtlpwaitforcriticalsection+0x132 (FPO: [Non-fpo])
02b0f8e0 006cf60e 02b29ba8 1ba0021b 00000000 ntdll! RTLENTERCRITICALSECTION+0X46 (FPO: [1,0,0])
02b0f960 006e0dd4 000f4240 00000010 006a48fa ctrlcenter!gloox::connectiontcpclient::recv+0x3e (FPO: [Uses EBP] [1,25,5] ) (Conv:thiscall)
02b0f96c 006a48fa 1ba00393 00000000 02b27b10 ctrlcenter!gloox::connectiontcpbase::receive+0x24 (FPO: [0,0,0]) (CONV: ThisCall)
02b0fa78 00707090 02b27b10 1ba00063 77d191c6 ctrlcenter!gloox::clientbase::connect+0x3aa (FPO: [Uses EBP] [1,61,5]) ( Conv:thiscall)
02b0ff70 007071b4 100264b8 000010ef 00000000 ctrlcenter! CC_IM::LOGIN_INNER+0XB10 (Conv:thiscall)
02b0ff74 100264b8 000010ef 00000000 00000000 ctrlcenter! Cc_im::P rethreadmsg+0x14 (FPO: [3,0,0]) (Conv:thiscall)
Warning:stack unwind information not available. Following frames may wrong.
02b0ff90 7c93017b 00000000 000010ef 00000000 ombase! omthread::create_inner+0x68
02b101a8 00380035 00350034 00310030 00350032 ntdll! RTLALLOCATEHEAP+0X1C2 (FPO: [Non-fpo])
02b101a8 00000000 00350034 00310030 00350032 0x380035
-----------------------------------------
Debuginfo = 0x001a3f90
Critical section = 0x02b29ba8 (+0X2B29BA8)
LOCKED
Lockcount = 0xFFFFFFFE
OwningThread = 0x00000000
Recursioncount = 0xFFFFFFFE
LockSemaphore = 0x4B8
Spincount = 0x00000000

Windbg!cs Critical Zone deadlock