KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffad079cd5e820, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffad079cd5e778, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 17134.1.amd64fre.rs4_release.180410-1804
DUMP_TYPE: 2
BUGCHECK_P1: 3
BUGCHECK_P2: ffffad079cd5e820
BUGCHECK_P3: ffffad079cd5e778
BUGCHECK_P4: 0
TRAP_FRAME: ffffad079cd5e820 -- (.trap 0xffffad079cd5e820)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffdf03f4c9ee01 rsi=0000000000000000 rdi=0000000000000000
rip=fffff803d349b39f rsp=ffffad079cd5e9b0 rbp=ffffdf03f4ce0c48
r8=ffffdf03f4ce0c48 r9=ffffb380d3c79180 r10=0000000000000001
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di ng nz na po cy
nt!ExInterlockedInsertTailList+0xe581f:
fffff803`d349b39f cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffad079cd5e778 -- (.exr 0xffffad079cd5e778)
ExceptionAddress: fffff803d349b39f (nt!ExInterlockedInsertTailList+0x00000000000e581f)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: 6
CPU_MHZ: af8
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: a
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: System
CURRENT_IRQL: 0
DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY
ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: DESKTOP-NG9H4F5
ANALYSIS_SESSION_TIME: 03-11-2019 21:49:28.0982
ANALYSIS_VERSION: 10.0.18317.1001 amd64fre
LAST_CONTROL_TRANSFER: from fffff803d3455c69 to fffff803d34450c0
STACK_TEXT:
ffffad07`9cd5e4f8 fffff803`d3455c69 : 00000000`00000139 00000000`00000003 ffffad07`9cd5e820 ffffad07`9cd5e778 : nt!KeBugCheckEx
ffffad07`9cd5e500 fffff803`d3456010 : ffffdf03`f26de440 00000000`00000000 00000000`00000000 fffff803`d32f361a : nt!KiBugCheckDispatch+0x69
ffffad07`9cd5e640 fffff803`d345461f : ffffdf03`f5fcd040 fffff803`d336085b ffffb380`d3c79180 ffffb380`d3c79180 : nt!KiFastFailDispatch+0xd0
ffffad07`9cd5e820 fffff803`d349b39f : ffffdf03`f4cb81a0 fffff803`00000000 ffffdf03`f4c9eedf ffffdf03`f4ce0c58 : nt!KiRaiseSecurityCheckFailure+0x2df
ffffad07`9cd5e9b0 fffff804`b0485521 : ffffdf03`f4cb81a0 ffffad07`9cd5eea8 00000000`00000003 ffffdf03`f4c4d068 : nt!ExInterlockedInsertTailList+0xe581f
ffffad07`9cd5e9e0 ffffdf03`f4cb81a0 : ffffad07`9cd5eea8 00000000`00000003 ffffdf03`f4c4d068 00000000`00000000 : athurx+0x5521
ffffad07`9cd5e9e8 ffffad07`9cd5eea8 : 00000000`00000003 ffffdf03`f4c4d068 00000000`00000000 fffff804`b04aa190 : 0xffffdf03`f4cb81a0
ffffad07`9cd5e9f0 00000000`00000003 : ffffdf03`f4c4d068 00000000`00000000 fffff804`b04aa190 ffffdf03`f4cce030 : 0xffffad07`9cd5eea8
ffffad07`9cd5e9f8 ffffdf03`f4c4d068 : 00000000`00000000 fffff804`b04aa190 ffffdf03`f4cce030 ffffdf03`f4c9eedf : 0x3
ffffad07`9cd5ea00 00000000`00000000 : fffff804`b04aa190 ffffdf03`f4cce030 ffffdf03`f4c9eedf ffffdf03`f4c4d060 : 0xffffdf03`f4c4d068
THREAD_SHA1_HASH_MOD_FUNC: a82446535e101af22dabac571e6512fcfdfee426
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: f08a0d4cd79b70c84e2d709bf8aa8d83d67cc48b
THREAD_SHA1_HASH_MOD: 9b490a8a6443cee405841f68027d5f9f45a3434c
FOLLOWUP_IP:
athurx+5521
fffff804`b0485521 4883c428 add rsp,28h
FAULT_INSTR_CODE: 28c48348
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: athurx+5521
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: athurx
IMAGE_NAME: athurx.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4daeb071
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 5521
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function
BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function
PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function
TARGET_TIME: 2019-03-11T15:54:37.000Z
OSBUILD: 17134
OSSERVICEPACK: 590
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2019-02-06 05:25:47
BUILDDATESTAMP_STR: 180410-1804
BUILDLAB_STR: rs4_release
BUILDOSVER_STR: 10.0.17134.1.amd64fre.rs4_release.180410-1804
ANALYSIS_SESSION_ELAPSED_TIME: 9cdd
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_athurx!unknown_function
FAILURE_ID_HASH: {cf0b00cb-8b52-be47-e20d-865e290d55f0}
Followup: MachineOwner
---------
5: kd> lmvm athurx
start end module name
fffff804`b0480000 fffff804`b065e000 athurx T (no symbols)
Loaded symbol image file: athurx.sys
Image path: \SystemRoot\System32\drivers\athurx.sys
Image name: athurx.sys
Timestamp: Wed Apr 20 03:07:45 2011 (4DAEB071)
CheckSum: 001E1C78
ImageSize: 001DE000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
drive.google.com
