REFERENCE_BY_POINTER (18)
Arguments:
Arg1: ffffa9815eb3b380, Object type of the object whose reference count is being lowered
Arg2: ffff9980fe64b310, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: 0800000000000000, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: ffffa9815eb3b380
BUGCHECK_P2: ffff9980fe64b310
BUGCHECK_P3: 1
BUGCHECK_P4: 800000000000000
CPU_COUNT: 4
CPU_MHZ: da5
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 1
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: System
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-7KGVC4E
ANALYSIS_SESSION_TIME: 03-24-2020 21:42:52.0057
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff803199f6fc3 to fffff803199c1220
STACK_TEXT:
ffff8200`b48f29f8 fffff803`199f6fc3 : 00000000`00000018 ffffa981`5eb3b380 ffff9980`fe64b310 00000000`00000001 : nt!KeBugCheckEx
ffff8200`b48f2a00 fffff803`1988aa23 : ffff8200`b48f2a00 ffff8200`b48f2ae8 ffffa981`5eb4e050 ffff8200`b48f2ae8 : nt!ObfDereferenceObject+0x1bdfe3
ffff8200`b48f2a40 fffff803`1988b8f0 : 00000000`00000031 ffff8200`b48f2b09 ffffa981`6fe2d6e0 00000000`00000000 : nt!CcDeleteSharedCacheMap+0x157
ffff8200`b48f2a90 fffff803`198bd465 : ffffa981`5ea95900 ffffa981`00000000 00000000`00000031 ffff8200`b63d4a90 : nt!CcWriteBehindInternal+0x3a0
ffff8200`b48f2b70 fffff803`1992a725 : ffffa981`5eae4080 00000000`00000080 ffffa981`5ea7b380 00000000`00000000 : nt!ExpWorkerThread+0x105
ffff8200`b48f2c10 fffff803`199c886a : ffffde00`fe040180 ffffa981`5eae4080 fffff803`1992a6d0 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff8200`b48f2c60 00000000`00000000 : ffff8200`b48f3000 ffff8200`b48ed000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a
THREAD_SHA1_HASH_MOD_FUNC: ff19a56d3b636d3add1fd00b549b177b5c2c9218
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: c95279ffa8236785e54fe8740aae3b7f91553053
THREAD_SHA1_HASH_MOD: 30a3e915496deaace47137d5b90c3ecc03746bf6
FOLLOWUP_IP:
nt!CcDeleteSharedCacheMap+157
fffff803`1988aa23 4883a7a800000000 and qword ptr [rdi+0A8h],0
FAULT_INSTR_CODE: a8a78348
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!CcDeleteSharedCacheMap+157
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 157
FAILURE_BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!CcDeleteSharedCacheMap
BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!CcDeleteSharedCacheMap
PRIMARY_PROBLEM_CLASS: 0x18_CORRUPT_REF_COUNT_nt!CcDeleteSharedCacheMap
TARGET_TIME: 2020-03-23T19:06:38.000Z
OSBUILD: 18362
OSSERVICEPACK: 418
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 99e6
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x18_corrupt_ref_count_nt!ccdeletesharedcachemap
FAILURE_ID_HASH: {744a5520-ffbc-3417-772d-60056197c0ac}
Followup: MachineOwner
---------
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff805426e84f0, Address of the instruction which caused the bugcheck
Arg3: ffffd40d98252b10, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff805426e84f0
BUGCHECK_P3: ffffd40d98252b10
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
FLTMGR!TreeUnlinkMulti+50
fffff805`426e84f0 483b7b20 cmp rdi,qword ptr [rbx+20h]
CONTEXT: ffffd40d98252b10 -- (.cxr 0xffffd40d98252b10)
rax=4000000000000000 rbx=4000000000000000 rcx=ffff8c0d8b5b2e40
rdx=ffff8c0d8b62a210 rsi=0000000000000000 rdi=ffff8c0d8b62a210
rip=fffff805426e84f0 rsp=ffffd40d98253500 rbp=ffffd40d98253679
r8=ffffffffffffffff r9=7fff8c0d8b5b2e28 r10=fffff80540e39af0
r11=ffff8c0d8b7e6080 r12=ffff8c0d875e4c10 r13=0000000000002000
r14=ffff8c0d8b5b2e40 r15=00000000ffffdfff
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050206
FLTMGR!TreeUnlinkMulti+0x50:
fffff805`426e84f0 483b7b20 cmp rdi,qword ptr [rbx+20h] ds:002b:40000000`00000020=????????????????
Resetting default scope
BUGCHECK_STR: 0x3B_c0000005
CPU_COUNT: 4
CPU_MHZ: da5
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 1
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: wermgr.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-7KGVC4E
ANALYSIS_SESSION_TIME: 03-24-2020 21:42:54.0794
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff8054271dcdf to fffff805426e84f0
STACK_TEXT:
ffffd40d`98253500 fffff805`4271dcdf : ffff8c0d`8b5b2dc0 ffff8c0d`00000000 ffffd40d`00000000 ffff8c0d`875e45a0 : FLTMGR!TreeUnlinkMulti+0x50
ffffd40d`98253550 fffff805`426e4fc9 : ffff8c0d`8b5b2dc0 ffff8c0d`00000000 ffff8c0d`ffff7fff 00000000`00008000 : FLTMGR!FltpRemoveAllNamesCachedForFileObject+0xbf
ffffd40d`982535d0 fffff805`426e45a0 : ffffd40d`982537b0 ffff8c0d`8b62a100 ffff8c0d`8af60902 00000000`00000400 : FLTMGR!FltpPerformPreCallbacks+0x869
ffffd40d`982536e0 fffff805`426e4112 : ffff8c0d`8af609a0 ffffd40d`982537b0 ffff8c0d`8af609a0 ffffd40d`982537c0 : FLTMGR!FltpPassThroughInternal+0x90
ffffd40d`98253710 fffff805`426e3efe : ffffffff`fffe7960 ffff8c0d`82756d30 00000000`00000000 ffff8c0d`8b62a100 : FLTMGR!FltpPassThrough+0x162
ffffd40d`98253790 fffff805`40e31f39 : ffff8c0d`8b62a210 fffff805`40f01e80 00000000`0000064e 00000000`00000000 : FLTMGR!FltpDispatch+0x9e
ffffd40d`982537f0 fffff805`413e72dd : ffff8c0d`8b62a210 ffff8c0d`875ec3f0 ffff8c0d`82756d30 ffff8c0d`8af609a0 : nt!IofCallDriver+0x59
ffffd40d`98253830 fffff805`413f94c0 : ffffd40d`98253a39 00000000`00000000 ffff8c0d`8273ae80 ffff8c0d`8af609a0 : nt!IopDeleteFile+0x12d
ffffd40d`982538b0 fffff805`40e3a969 : 00000000`00000000 00000000`00000000 ffffd40d`98253a39 ffff8c0d`8b62a210 : nt!ObpRemoveObjectRoutine+0x80
ffffd40d`98253910 fffff805`413ec267 : 00000000`ffff8003 ffff8c0d`8b62a1e0 ffff8c0d`00000000 00000000`00007ffd : nt!ObfDereferenceObjectWithTag+0xc9
ffffd40d`98253950 fffff805`413f155e : 00000000`00000228 000000d6`aedbc400 00000270`82446f00 000000d6`00000210 : nt!ObCloseHandleTableEntry+0x2c7
ffffd40d`98253a90 fffff805`40fd2b18 : ffff8c0d`8b7e6080 00000000`00000000 ffffd40d`98253b80 ffff8c0d`8b6550e0 : nt!NtClose+0xde
ffffd40d`98253b00 00007ff9`66bbc2a4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000d6`aedbc4c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`66bbc2a4
THREAD_SHA1_HASH_MOD_FUNC: 262bcdcc4c7dc0fd1657a17f3ab3b8a289b5bccf
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: a4e8caf8e5c9a48017392f7504d8c35d354b6e7a
THREAD_SHA1_HASH_MOD: 7485e10fd8dcb694521b00f1f5ffde4296096abf
FOLLOWUP_IP:
FLTMGR!TreeUnlinkMulti+50
fffff805`426e84f0 483b7b20 cmp rdi,qword ptr [rbx+20h]
FAULT_INSTR_CODE: 207b3b48
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: FLTMGR!TreeUnlinkMulti+50
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: FLTMGR
IMAGE_NAME: FLTMGR.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.267
STACK_COMMAND: .cxr 0xffffd40d98252b10 ; kb
BUCKET_ID_FUNC_OFFSET: 50
FAILURE_BUCKET_ID: 0x3B_c0000005_FLTMGR!TreeUnlinkMulti
BUCKET_ID: 0x3B_c0000005_FLTMGR!TreeUnlinkMulti
PRIMARY_PROBLEM_CLASS: 0x3B_c0000005_FLTMGR!TreeUnlinkMulti
TARGET_TIME: 2020-03-23T18:49:52.000Z
OSBUILD: 18362
OSSERVICEPACK: 418
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: b3ba
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x3b_c0000005_fltmgr!treeunlinkmulti
FAILURE_ID_HASH: {3d475075-10a3-e90a-79e1-d5bbd61bab6f}
Followup: MachineOwner
---------
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80014dc8725, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff80014dc8725
BUGCHECK_P3: 0
BUGCHECK_P4: ffffffffffffffff
READ_ADDRESS: fffff800151733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
ffffffffffffffff
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!SwapContext+4a5
fffff800`14dc8725 c3 ret
EXCEPTION_PARAMETER2: ffffffffffffffff
BUGCHECK_STR: 0x1E_c0000005_R
CPU_COUNT: 4
CPU_MHZ: da5
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 1
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: DESKTOP-7KGVC4E
ANALYSIS_SESSION_TIME: 03-24-2020 21:42:57.0004
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
EXCEPTION_RECORD: fffff80678a73e9f -- (.exr 0xfffff80678a73e9f)
Cannot read Exception record @ fffff80678a73e9f
TRAP_FRAME: fffff80678bc20a2 -- (.trap 0xfffff80678bc20a2)
Unable to read trap frame at fffff806`78bc20a2
BAD_STACK_POINTER: ffff8001ea5bd8f8
LAST_CONTROL_TRANSFER: from fffff80014e2fd3f to fffff80014dc1220
STACK_TEXT:
ffff8001`ea5bd8f8 fffff800`14e2fd3f : 00000000`0000001e ffffffff`c0000005 fffff800`14dc8725 00000000`00000000 : nt!KeBugCheckEx
ffff8001`ea5bd900 fffff800`14dc20a2 : fffff806`78a73e9f 00000000`00000000 fffff806`78bc20a2 fffff806`78a00000 : nt!KiDispatchException+0x16859f
ffff8001`ea5bdfb0 fffff800`14dc2070 : 55fff800`14dd3216 7eff918f`24dc0010 7c000000`00000103 ffff918f`252e88a0 : nt!KxExceptionDispatchOnExceptionStack+0x12
ffffc28f`eb339a28 55fff800`14dd3216 : 7eff918f`24dc0010 7c000000`00000103 ffff918f`252e88a0 fffff800`16ae580a : nt!KiExceptionDispatchOnExceptionStackContinue
ffffc28f`eb339a30 7eff918f`24dc0010 : 7c000000`00000103 ffff918f`252e88a0 fffff800`16ae580a 00000000`00000001 : 0x55fff800`14dd3216
ffffc28f`eb339a38 7c000000`00000103 : ffff918f`252e88a0 fffff800`16ae580a 00000000`00000001 fffff800`16afc470 : 0x7eff918f`24dc0010
ffffc28f`eb339a40 ffff918f`252e88a0 : fffff800`16ae580a 00000000`00000001 fffff800`16afc470 00000000`00000000 : 0x7c000000`00000103
ffffc28f`eb339a48 fffff800`16ae580a : 00000000`00000001 fffff800`16afc470 00000000`00000000 00000000`00000000 : 0xffff918f`252e88a0
ffffc28f`eb339a50 c3000000`00000000 : 44000000`00000000 cf000000`00000000 40000000`00000000 7a000000`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x38a
ffffc28f`eb339ad0 44000000`00000000 : cf000000`00000000 40000000`00000000 7a000000`00000000 7a000000`00000000 : 0xc3000000`00000000
ffffc28f`eb339ad8 cf000000`00000000 : 40000000`00000000 7a000000`00000000 7a000000`00000000 03000000`00000000 : 0x44000000`00000000
ffffc28f`eb339ae0 40000000`00000000 : 7a000000`00000000 7a000000`00000000 03000000`00000000 ffff918f`252e8a28 : 0xcf000000`00000000
ffffc28f`eb339ae8 7a000000`00000000 : 7a000000`00000000 03000000`00000000 ffff918f`252e8a28 ffff918f`20c89368 : 0x40000000`00000000
ffffc28f`eb339af0 7a000000`00000000 : 03000000`00000000 ffff918f`252e8a28 ffff918f`20c89368 ffff918f`23d30780 : 0x7a000000`00000000
ffffc28f`eb339af8 03000000`00000000 : ffff918f`252e8a28 ffff918f`20c89368 ffff918f`23d30780 fffff800`14c39d9d : 0x7a000000`00000000
ffffc28f`eb339b00 ffff918f`252e8a28 : ffff918f`20c89368 ffff918f`23d30780 fffff800`14c39d9d ffff918f`23d30400 : 0x03000000`00000000
ffffc28f`eb339b08 ffff918f`20c89368 : ffff918f`23d30780 fffff800`14c39d9d ffff918f`23d30400 ffff918f`20c893a8 : 0xffff918f`252e8a28
ffffc28f`eb339b10 ffff918f`23d30780 : fffff800`14c39d9d ffff918f`23d30400 ffff918f`20c893a8 ffff8001`ea597180 : 0xffff918f`20c89368
ffffc28f`eb339b18 fffff800`14c39d9d : ffff918f`23d30400 ffff918f`20c893a8 ffff8001`ea597180 ffff8001`ea5a8140 : 0xffff918f`23d30780
ffffc28f`eb339b20 deff918f`239ef080 : 5fff8001`ea5ab000 16000000`c0000005 35000000`00000000 56fff800`14dc8725 : nt!ExAcquirePushLockSharedEx+0xed
ffffc28f`eb339b60 5fff8001`ea5ab000 : 16000000`c0000005 35000000`00000000 56fff800`14dc8725 ffff918f`00000002 : 0xdeff918f`239ef080
ffffc28f`eb339b68 16000000`c0000005 : 35000000`00000000 56fff800`14dc8725 ffff918f`00000002 08000000`00000000 : 0x5fff8001`ea5ab000
ffffc28f`eb339b70 35000000`00000000 : 56fff800`14dc8725 ffff918f`00000002 08000000`00000000 89ffffff`ffffffff : 0x16000000`c0000005
ffffc28f`eb339b78 56fff800`14dc8725 : ffff918f`00000002 08000000`00000000 89ffffff`ffffffff f6ff918f`239ef080 : 0x35000000`00000000
ffffc28f`eb339b80 ffff918f`00000002 : 08000000`00000000 89ffffff`ffffffff f6ff918f`239ef080 5dff918f`23d30400 : 0x56fff800`14dc8725
ffffc28f`eb339b88 08000000`00000000 : 89ffffff`ffffffff f6ff918f`239ef080 5dff918f`23d30400 54fff800`1758ebc0 : 0xffff918f`00000002
ffffc28f`eb339b90 89ffffff`ffffffff : f6ff918f`239ef080 5dff918f`23d30400 54fff800`1758ebc0 57ff918f`252e8a28 : 0x08000000`00000000
ffffc28f`eb339b98 f6ff918f`239ef080 : 5dff918f`23d30400 54fff800`1758ebc0 57ff918f`252e8a28 44000000`00000000 : 0x89ffffff`ffffffff
ffffc28f`eb339ba0 5dff918f`23d30400 : 54fff800`1758ebc0 57ff918f`252e8a28 44000000`00000000 ffffc28f`eb339c58 : 0xf6ff918f`239ef080
ffffc28f`eb339ba8 54fff800`1758ebc0 : 57ff918f`252e8a28 44000000`00000000 ffffc28f`eb339c58 fffff800`16ae7bd2 : 0x5dff918f`23d30400
ffffc28f`eb339bb0 57ff918f`252e8a28 : 44000000`00000000 ffffc28f`eb339c58 fffff800`16ae7bd2 ffff918f`00000002 : 0x54fff800`1758ebc0
ffffc28f`eb339bb8 44000000`00000000 : ffffc28f`eb339c58 fffff800`16ae7bd2 ffff918f`00000002 ffff918f`00000002 : 0x57ff918f`252e8a28
ffffc28f`eb339bc0 ffffc28f`eb339c58 : fffff800`16ae7bd2 ffff918f`00000002 ffff918f`00000002 ffffc78a`dbe8eb80 : 0x44000000`00000000
ffffc28f`eb339bc8 fffff800`16ae7bd2 : ffff918f`00000002 ffff918f`00000002 ffffc78a`dbe8eb80 ffffc78a`dbe8eba0 : 0xffffc28f`eb339c58
ffffc28f`eb339bd0 5cfff800`14dcefa2 : ddfff780`00000320 71000000`00000000 cb000000`00000000 dcffc78a`00000002 : FLTMGR!FltGetStreamContext+0x42
ffffc28f`eb339c10 ddfff780`00000320 : 71000000`00000000 cb000000`00000000 dcffc78a`00000002 c7ffc78a`dbe8eb40 : 0x5cfff800`14dcefa2
ffffc28f`eb339c18 71000000`00000000 : cb000000`00000000 dcffc78a`00000002 c7ffc78a`dbe8eb40 c4001f80`01e8eba3 : 0xddfff780`00000320
ffffc28f`eb339c20 cb000000`00000000 : dcffc78a`00000002 c7ffc78a`dbe8eb40 c4001f80`01e8eba3 0000009b`53eb2000 : 0x71000000`00000000
ffffc28f`eb339c28 dcffc78a`00000002 : c7ffc78a`dbe8eb40 c4001f80`01e8eba3 0000009b`53eb2000 00000000`c0000102 : 0xcb000000`00000000
ffffc28f`eb339c30 c7ffc78a`dbe8eb40 : c4001f80`01e8eba3 0000009b`53eb2000 00000000`c0000102 00000000`0000009b : 0xdcffc78a`00000002
ffffc28f`eb339c38 c4001f80`01e8eba3 : 0000009b`53eb2000 00000000`c0000102 00000000`0000009b 00000001`000000df : 0xc7ffc78a`dbe8eb40
ffffc28f`eb339c40 0000009b`53eb2000 : 00000000`c0000102 00000000`0000009b 00000001`000000df 00000000`00000000 : 0xc4001f80`01e8eba3
ffffc28f`eb339c48 00000000`c0000102 : 00000000`0000009b 00000001`000000df 00000000`00000000 ffff8001`ea597180 : 0x0000009b`53eb2000
ffffc28f`eb339c50 00000000`0000009b : 00000001`000000df 00000000`00000000 ffff8001`ea597180 ffff918f`239ef080 : 0xc0000102
ffffc28f`eb339c58 00000001`000000df : 00000000`00000000 ffff8001`ea597180 ffff918f`239ef080 00000000`00000000 : 0x9b
ffffc28f`eb339c60 00000000`00000000 : ffff8001`ea597180 ffff918f`239ef080 00000000`00000000 c0011020`06300054 : 0x00000001`000000df
THREAD_SHA1_HASH_MOD_FUNC: 46bb294314c74e96ee649f81ab10a639148dea69
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 9bf48a0cf0738b166fcbac3ab2a10bed53c5b0e1
THREAD_SHA1_HASH_MOD: 904605e151f82af21123dde86dae57675d7a261c
FOLLOWUP_IP:
nt!SwapContext+4a5
fffff800`14dc8725 c3 ret
FAULT_INSTR_CODE: cb8b48c3
SYMBOL_NAME: nt!SwapContext+4a5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 4a5
FAILURE_BUCKET_ID: 0x1E_c0000005_R_STACKPTR_ERROR_nt!SwapContext
BUCKET_ID: 0x1E_c0000005_R_STACKPTR_ERROR_nt!SwapContext
PRIMARY_PROBLEM_CLASS: 0x1E_c0000005_R_STACKPTR_ERROR_nt!SwapContext
TARGET_TIME: 2020-03-23T18:23:40.000Z
OSBUILD: 18362
OSSERVICEPACK: 418
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 4f11
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x1e_c0000005_r_stackptr_error_nt!swapcontext
FAILURE_ID_HASH: {bd591bce-fa9d-a983-0398-0157fd169b8e}
Followup: MachineOwner
---------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff747208f7fb0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80350ca72c9, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: fffff747208f7fb0
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff80350ca72c9
READ_ADDRESS: fffff803511733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff747208f7fb0
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiReplenishBitMap+f9
fffff803`50ca72c9 498b0cf9 mov rcx,qword ptr [r9+rdi*8]
CPU_COUNT: 4
CPU_MHZ: da5
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 1
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: System
ANALYSIS_SESSION_HOST: DESKTOP-7KGVC4E
ANALYSIS_SESSION_TIME: 03-24-2020 21:42:59.0647
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
TRAP_FRAME: ffffad83a935ae70 -- (.trap 0xffffad83a935ae70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000001
rdx=fffff77bbddee000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80350ca72c9 rsp=ffffad83a935b000 rbp=0000000000000000
r8=0000000000000008 r9=fffff74500000000 r10=fffff77bbddee7f8
r11=fffff745008f7fb8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!MiReplenishBitMap+0xf9:
fffff803`50ca72c9 498b0cf9 mov rcx,qword ptr [r9+rdi*8] ds:fffff745`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80350dd30e9 to fffff80350dc1220
STACK_TEXT:
ffffad83`a935ad28 fffff803`50dd30e9 : 00000000`0000000a fffff747`208f7fb0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffad83`a935ad30 fffff803`50dcf42b : 00000000`00020000 ffff9d8f`5cbe5018 ffff9d8f`00000001 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffad83`a935ae70 fffff803`50ca72c9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x46b
ffffad83`a935b000 fffff803`50c4c326 : ffffc38a`30b8e5a8 fffff770`42232400 00000000`00001000 fffff803`00000000 : nt!MiReplenishBitMap+0xf9
ffffad83`a935b170 fffff803`50c4bdae : fffff745`008ee238 00000000`00000014 00000000`00000000 00000000`00000000 : nt!MiInsertCachedPte+0x2f6
ffffad83`a935b200 fffff803`50c4d93b : fffff803`5106a480 00000000`000000db fffff803`5106a480 ffffd700`00000000 : nt!MiReleasePtes+0x12e
ffffad83`a935b350 fffff803`50c4f841 : 00000000`01000000 ffff9d8f`52e98b90 ffff9d8f`58f8a9a0 00000000`00000000 : nt!MiMakePageAvoidRead+0x55b
ffffad83`a935b520 fffff803`50c4ebfb : ffffe084`46480000 ffff8a01`1ed4d020 ffffad83`00000000 00000000`00001000 : nt!MmCopyToCachedPage+0x281
ffffad83`a935b600 fffff803`50c509d5 : ffff9d8f`58f8a9a0 ffff8a01`1ed4d020 ffffad83`a935b7e0 ffff9d8f`000c0000 : nt!CcMapAndCopyInToCache+0x5fb
ffffad83`a935b780 fffff803`54b0b62a : ffffc38a`30b8e728 ffff9d8f`5ed7ce00 00000000`00000000 00000000`0000070f : nt!CcCopyWriteEx+0x105
ffffad83`a935b800 fffff803`54b0753b : ffff9d8f`5ed7cd78 fffff803`54b071a0 00000000`00000000 ffff9d8f`5ed7cd78 : Ntfs!NtfsCommonWrite+0x113a
ffffad83`a935ba30 fffff803`50cbd465 : ffff9d8f`52e797f0 ffff9d8f`593aa040 ffff9d8f`52e797f0 ffff9d8f`5ed7ce08 : Ntfs!NtfsFspDispatch+0x39b
ffffad83`a935bb70 fffff803`50d2a725 : ffff9d8f`593aa040 00000000`00000080 ffff9d8f`52e99040 00000000`00000001 : nt!ExpWorkerThread+0x105
ffffad83`a935bc10 fffff803`50dc886a : ffff8a01`1d1d9180 ffff9d8f`593aa040 fffff803`50d2a6d0 00000000`00000246 : nt!PspSystemThreadStartup+0x55
ffffad83`a935bc60 00000000`00000000 : ffffad83`a935c000 ffffad83`a9356000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a
THREAD_SHA1_HASH_MOD_FUNC: d332c9de8b240e217cd0dd5525ea59b899fea5a7
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: dc14da0f34549bbc46cd98560d549974aa791b9e
THREAD_SHA1_HASH_MOD: b823d9e2ae29e411106fbc4841eac41ca7a4a340
FOLLOWUP_IP:
nt!MiReplenishBitMap+f9
fffff803`50ca72c9 498b0cf9 mov rcx,qword ptr [r9+rdi*8]
FAULT_INSTR_CODE: f90c8b49
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiReplenishBitMap+f9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: f9
FAILURE_BUCKET_ID: AV_nt!MiReplenishBitMap
BUCKET_ID: AV_nt!MiReplenishBitMap
PRIMARY_PROBLEM_CLASS: AV_nt!MiReplenishBitMap
TARGET_TIME: 2020-03-23T18:15:14.000Z
OSBUILD: 18362
OSSERVICEPACK: 418
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 83ee
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_nt!mireplenishbitmap
FAILURE_ID_HASH: {f6b71f01-5ac8-b73e-36a2-bf4e25b0e94a}
Followup: MachineOwner
---------
