KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffd300a7036220, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd300a7036178, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2562
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-1IBQR0U
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 4656
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffd300a7036220
BUGCHECK_P3: ffffd300a7036178
BUGCHECK_P4: 0
TRAP_FRAME: ffffd300a7036220 -- (.trap 0xffffd300a7036220)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc3026d6e2590 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffc3026326c4d0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8053d5f6727 rsp=ffffd300a70363b0 rbp=ffffd300a7036500
r8=ffffd300a70363b8 r9=0000000000000001 r10=7ffffffffffffffc
r11=ffffd300a7036340 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!DelistKeyBodyFromKCB+0xc7:
fffff805`3d5f6727 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffd300a7036178 -- (.exr 0xffffd300a7036178)
ExceptionAddress: fffff8053d5f6727 (nt!DelistKeyBodyFromKCB+0x00000000000000c7)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: upc.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffd300`a7035ef8 fffff805`3d1d30e9 : 00000000`00000139 00000000`00000003 ffffd300`a7036220 ffffd300`a7036178 : nt!KeBugCheckEx
ffffd300`a7035f00 fffff805`3d1d3510 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffd300`a7036040 fffff805`3d1d18a5 : ffffc302`5eeebe10 fffff805`3d5ee730 ffffd403`f7d0c3a0 fffff805`3d039d9d : nt!KiFastFailDispatch+0xd0
ffffd300`a7036220 fffff805`3d5f6727 : ffffc302`6326c4a0 ffffc302`00000000 ffffd300`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x325
ffffd300`a70363b0 fffff805`3d5f5fd5 : ffffc302`6d6e2570 00000000`00000000 00000000`00000000 01000000`00100000 : nt!DelistKeyBodyFromKCB+0xc7
ffffd300`a70363e0 fffff805`3d5f94c0 : 00000000`00000000 ffffd403`e8b3ba60 ffffd403`e8b3ba60 ffffc302`6d6e2540 : nt!CmpDeleteKeyObject+0x125
ffffd300`a7036470 fffff805`3d03a969 : 00000000`00000000 00000000`00000000 ffffd300`a70365f9 ffffc302`6d6e2570 : nt!ObpRemoveObjectRoutine+0x80
ffffd300`a70364d0 fffff805`3d5ec267 : 00000000`ffff8003 ffffc302`6d6e2540 ffffc302`6d6e2540 ffffd403`f3d7c510 : nt!ObfDereferenceObjectWithTag+0xc9
ffffd300`a7036510 fffff805`3d6379e5 : 00000000`0000ffc0 00000000`0000ffc0 00000000`00000004 00000000`00000000 : nt!ObCloseHandleTableEntry+0x2c7
ffffd300`a7036650 fffff805`3d637681 : 00000000`00000000 ffffd403`f7d0c080 ffffffff`ffffff01 ffffd403`f7f597c0 : nt!ExSweepHandleTable+0xd5
ffffd300`a7036700 fffff805`3d637ba9 : ffffffff`ffffffff ffffd403`f7f594c0 ffffd300`a7036750 ffffd403`00000000 : nt!ObKillProcess+0x35
ffffd300`a7036730 fffff805`3d65e1c3 : ffffd403`f7f594c0 ffffc302`6bd027b0 ffffd300`a7036959 00000000`00000000 : nt!PspRundownSingleProcess+0x131
ffffd300`a70367b0 fffff805`3d6cb973 : 00000000`40010004 00000000`0fa8b601 00000000`00272000 00008000`00000bb8 : nt!PspExitThread+0x60b
ffffd300`a70368c0 fffff805`3d03e511 : 00000000`00008000 fffff805`3d074f31 00000000`00000010 00000000`00040246 : nt!KiSchedulerApcTerminate+0x33
ffffd300`a7036900 fffff805`3d1c57a0 : 00000000`00000001 ffffd300`a70369c0 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x481
ffffd300`a70369c0 fffff805`3d1cf496 : ffffd403`f7d0c080 00000000`00000000 00000000`00272000 00000000`00000000 : nt!KiInitiateUserApc+0x70
ffffd300`a7036b00 00000000`0fa8b660 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x4d6
00000000`0019f8b4 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfa8b660
SYMBOL_NAME: nt!KiFastFailDispatch+d0
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}
Followup: MachineOwner
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000002c5e0d, page frame number
Arg3: 0000000000000002, current page state
Arg4: 020002c0002c5e0e, 0
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2609
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-1IBQR0U
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 7138
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 4e
BUGCHECK_P1: 99
BUGCHECK_P2: 2c5e0d
BUGCHECK_P3: 2
BUGCHECK_P4: 20002c0002c5e0e
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: FarCry5.exe
STACK_TEXT:
ffffab05`04d40ac8 fffff804`3bff77a0 : 00000000`0000004e 00000000`00000099 00000000`002c5e0d 00000000`00000002 : nt!KeBugCheckEx
ffffab05`04d40ad0 fffff804`3be77ac7 : 00000000`00000003 ffffab05`04d41220 ffffab05`04d41220 ffffab05`04d41170 : nt!MiDeletePteRun+0x1b8740
ffffab05`04d40cf0 fffff804`3be735e2 : ffffe10f`c7118580 ffff8281`0de56000 00000000`00004000 00000000`00000000 : nt!MiDeleteVaTail+0x77
ffffab05`04d40d20 fffff804`3be73771 : ffffab05`04d41170 ffff82c1`4086f2a8 00000000`00000000 0a000003`a78a4867 : nt!MiWalkPageTablesRecursively+0x512
ffffab05`04d40de0 fffff804`3be73771 : ffffab05`04d41170 ffff82c1`60a04378 00000000`00000000 0a000000`4876e867 : nt!MiWalkPageTablesRecursively+0x6a1
ffffab05`04d40ea0 fffff804`3be73771 : ffffab05`04d41170 ffff82c1`60b05020 ffff82c1`00000000 0a000003`f8202867 : nt!MiWalkPageTablesRecursively+0x6a1
ffffab05`04d40f60 fffff804`3be72efc : ffffab05`04d41170 ffffcaa4`40000000 ffffcaa4`00000000 ffffe10f`c7118580 : nt!MiWalkPageTablesRecursively+0x6a1
ffffab05`04d41020 fffff804`3be71368 : ffffab05`04d41170 00000000`00000002 00000000`00000001 fffff804`00000000 : nt!MiWalkPageTables+0x36c
ffffab05`04d41120 fffff804`3be7f4c0 : ffffffff`ffffffff ffffe10f`c71183f8 00000002`00000001 00000000`00000000 : nt!MiDeletePagablePteRange+0x268
ffffab05`04d414c0 fffff804`3c3dd4bd : ffffe10f`c85ab0c0 00000000`00000000 ffffe10f`c898ae70 ffffe10f`c85ab0c0 : nt!MiDeleteVad+0x860
ffffab05`04d41680 fffff804`3c3dca0f : ffffe10f`c8a68060 ffffe10f`c8a68060 ffffe10f`c7118080 fffff804`3c26a440 : nt!MiCleanVad+0x4d
ffffab05`04d416b0 fffff804`3c46d6b9 : ffffffff`00000000 ffffffff`ffffffff ffffab05`04d41901 ffffe10f`c7118080 : nt!MmCleanProcessAddressSpace+0x137
ffffab05`04d41730 fffff804`3c426673 : ffffe10f`c7118080 ffff9705`c96f0060 ffffab05`04d41959 00000000`00000000 : nt!PspRundownSingleProcess+0x139
ffffab05`04d417b0 fffff804`3c423f23 : 00000000`00000003 ffffcc01`46524101 000000fc`b7090000 00000000`00000000 : nt!PspExitThread+0x60b
ffffab05`04d418c0 fffff804`3bea6441 : ffffe10f`c85ab0c0 ffffe10f`00000000 00000000`00000000 00000000`00000000 : nt!KiSchedulerApcTerminate+0x33
ffffab05`04d41900 fffff804`3bfc6920 : 00000000`21a10001 ffffab05`04d419c0 00000000`00000000 fffff804`00000000 : nt!KiDeliverApc+0x481
ffffab05`04d419c0 fffff804`3bfd3cbf : ffffe10f`c85ab0c0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInitiateUserApc+0x70
ffffab05`04d41b00 00007ffd`1549c0f4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
000000fc`bb3ff748 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`1549c0f4
SYMBOL_NAME: nt!MiDeletePteRun+1b8740
MODULE_NAME: nt
IMAGE_VERSION: 10.0.18362.959
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 1b8740
FAILURE_BUCKET_ID: 0x4E_99_nt!MiDeletePteRun
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {826a8dfe-b402-47c5-bb75-e9ab5230289f}
Followup: MachineOwner
