*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 000000000000001d, Type of memory safety violation
Arg2: ffff9f8c143dacf0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff9f8c143dac48, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 5484
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 26935
Key : Analysis.Init.CPU.mSec
Value: 578
Key : Analysis.Init.Elapsed.mSec
Value: 11871
Key : Analysis.Memory.CommitPeak.Mb
Value: 80
Key : FailFast.Name
Value: INVALID_BALANCED_TREE
Key : FailFast.Type
Value: 29
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 1d
BUGCHECK_P2: ffff9f8c143dacf0
BUGCHECK_P3: ffff9f8c143dac48
BUGCHECK_P4: 0
TRAP_FRAME: ffff9f8c143dacf0 -- (.trap 0xffff9f8c143dacf0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffa208e06279e8 rbx=0000000000000000 rcx=000000000000001d
rdx=ffffa208e06279e8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80776a2d71f rsp=ffff9f8c143dae80 rbp=0000000000000001
r8=ffffa208e24d5528 r9=0000000000000000 r10=ffffa208d6010290
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
nt!RtlRbInsertNodeEx+0x1ddf2f:
fffff807`76a2d71f cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff9f8c143dac48 -- (.exr 0xffff9f8c143dac48)
ExceptionAddress: fffff80776a2d71f (nt!RtlRbInsertNodeEx+0x00000000001ddf2f)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000000000000001d
Subcode: 0x1d FAST_FAIL_INVALID_BALANCED_TREE
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 000000000000001d
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffff9f8c`143da9c8 fffff807`76a07b69 : 00000000`00000139 00000000`0000001d ffff9f8c`143dacf0 ffff9f8c`143dac48 : nt!KeBugCheckEx
ffff9f8c`143da9d0 fffff807`76a07f90 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffff9f8c`143dab10 fffff807`76a06323 : 00000000`00000000 ffff9f8c`143dada1 00000000`e10a0000 fffff807`76864623 : nt!KiFastFailDispatch+0xd0
ffff9f8c`143dacf0 fffff807`76a2d71f : ffffa208`d6010280 fffff807`7684d9c9 ffffa208`da83ca58 ffff9f8c`143daf08 : nt!KiRaiseSecurityCheckFailure+0x323
ffff9f8c`143dae80 fffff807`7684d9c9 : ffffa208`da83ca58 ffff9f8c`143daf08 00000000`00000055 ffffa208`e06279e0 : nt!RtlRbInsertNodeEx+0x1ddf2f
ffff9f8c`143dae90 fffff807`7684d21a : 00000002`00000002 ffffa208`e0627490 ffffa208`00000002 00000000`00000000 : nt!RtlpHpVsChunkSplit+0x5d9
ffff9f8c`143daf50 fffff807`7695e6fd : ffffa208`e06f76d0 00000000`00000540 ffffa208`d6010280 ffffa208`da83c510 : nt!RtlpHpVsContextAllocateInternal+0x1fa
ffff9f8c`143dafb0 fffff807`76850980 : fffff807`77259a40 ffff9f8c`143db111 00000000`00000001 00000000`00000000 : nt!RtlpHpVsContextMultiAlloc+0x69
ffff9f8c`143db030 fffff807`76fb1094 : 00000000`00000000 ffffa208`d7def180 00000000`4c46744e 00000000`65315580 : nt!ExAllocateHeapPool+0xa70
ffff9f8c`143db170 fffff807`7907ad13 : 00000000`00000518 00000000`00000028 00000000`00000020 ffff9f8c`00000000 : nt!ExAllocatePoolWithTag+0x64
ffff9f8c`143db1c0 fffff807`7916e8ba : ffff9f8c`143db4e0 ffff9f8c`143db940 00000000`00000000 00000002`de437000 : Ntfs!InitializeNewTable+0x6b
ffff9f8c`143db200 fffff807`7917a68d : ffffa208`d7def5a8 ffff9f8c`143db800 00000002`de437044 00000000`65315580 : Ntfs!NtfsInitializeRestartTable+0x7a
ffff9f8c`143db230 fffff807`7916d992 : 00000000`00000000 ffff9f8c`143dc000 01d72ff4`d9310700 ffffa208`d7def100 : Ntfs!NtfsCheckpointVolume+0x51d
ffff9f8c`143db730 fffff807`7916eebc : ffff9f8c`143db8d0 ffffa208`d7def180 ffff9f8c`143db880 01d72ff4`d9310701 : Ntfs!NtfsCheckpointAllVolumesWorker+0xe2
ffff9f8c`143db790 fffff807`7916c8ae : ffff9f8c`143db8d0 00000000`00000000 00000000`00000000 fffff807`7916d8b0 : Ntfs!NtfsForEachVcb+0x200
ffff9f8c`143db840 fffff807`76825975 : ffffa208`e10a1040 ffffa208`e10a1040 ffffa208`d5ca4cf0 fffff807`791062b0 : Ntfs!NtfsCheckpointAllVolumes+0x1ee
ffff9f8c`143dbb70 fffff807`76917e85 : ffffa208`e10a1040 00000000`00000080 ffffa208`d5c8b040 00000000`00000001 : nt!ExpWorkerThread+0x105
ffff9f8c`143dbc10 fffff807`769fd2a8 : ffffcc00`60d2c180 ffffa208`e10a1040 fffff807`76917e30 ffffb213`0d68a04b : nt!PspSystemThreadStartup+0x55
ffff9f8c`143dbc60 00000000`00000000 : ffff9f8c`143dc000 ffff9f8c`143d6000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!KiFastFailDispatch+d0
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.867
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_1d_INVALID_BALANCED_TREE_nt!KiFastFailDispatch
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {67ec97ad-ad0b-071e-ab87-6dc661e22d1b}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000002, A list entry was corrupt
Arg2: 0000000000330621, entry in list being removed
Arg3: 000000000043f37f, highest physical page number
Arg4: 00000000000044f0, reference count of entry being removed
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3140
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 18440
Key : Analysis.Init.CPU.mSec
Value: 468
Key : Analysis.Init.Elapsed.mSec
Value: 12266
Key : Analysis.Memory.CommitPeak.Mb
Value: 76
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 4e
BUGCHECK_P1: 2
BUGCHECK_P2: 330621
BUGCHECK_P3: 43f37f
BUGCHECK_P4: 44f0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
fffff909`82987628 fffff805`2fa17ec9 : 00000000`0000004e 00000000`00000002 00000000`00330621 00000000`0043f37f : nt!KeBugCheckEx
fffff909`82987630 fffff805`2fb5374b : fffff805`30450d40 00000000`00000000 0000000f`ffffffff ffff8c8c`b460c040 : nt!MiUnlinkPageFromList+0xc89
fffff909`829876c0 fffff805`2fb5148f : ffff8c8c`bf4b4b90 ffff8c8c`bf4b4b10 00000000`00000000 00000000`00000002 : nt!MiReferencePageForModifiedWrite+0x4f
fffff909`829876f0 fffff805`2fbb2aab : fffff805`30450d40 00000000`00000011 ffff8c8c`b4fe83d0 00000000`00000000 : nt!MiGatherMappedPages+0x173
fffff909`829877b0 fffff805`2fb17e85 : ffff8c8c`b460c040 ffff8c8c`b460c040 00000000`00000080 000f8067`b4bbbdff : nt!MiMappedPageWriter+0x18b
fffff909`82987c10 fffff805`2fbfd2a8 : fffff805`2dcdd180 ffff8c8c`b460c040 fffff805`2fb17e30 00000000`00000000 : nt!PspSystemThreadStartup+0x55
fffff909`82987c60 00000000`00000000 : fffff909`82988000 fffff909`82982000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!MiUnlinkPageFromList+c89
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.867
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: c89
FAILURE_BUCKET_ID: 0x4E_2_nt!MiUnlinkPageFromList
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {b084f841-86a9-e353-1d26-a04cfe7406b4}
Followup: MachineOwner
---------
