SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff802376862a0, Address of the instruction which caused the BugCheck
Arg3: fffff58422098730, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3046
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 38041
Key : Analysis.Init.CPU.mSec
Value: 546
Key : Analysis.Init.Elapsed.mSec
Value: 10042
Key : Analysis.Memory.CommitPeak.Mb
Value: 75
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff802376862a0
BUGCHECK_P3: fffff58422098730
BUGCHECK_P4: 0
CONTEXT: fffff58422098730 -- (.cxr 0xfffff58422098730)
rax=0000000000040293 rbx=ffffdb8a0cfaa330 rcx=ffffdb8a1185fbb0
rdx=0000000000000000 rsi=0000000000000000 rdi=ffffdb8a026396a0
rip=fffff802376862a0 rsp=fffff58422099130 rbp=fffff584220991e9
r8=fffff58422099138 r9=000000000000003e r10=ffffdb8a02a63050
r11=ffffdb8a0d6d3080 r12=ffffdb8a0cfaa3b0 r13=fffff584220992e0
r14=ffffdb8a02a632b0 r15=0000000000000280
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050206
FLTMGR!FltpPerformPreCallbacksWorker+0x580:
fffff802`376862a0 488b4840 mov rcx,qword ptr [rax+40h] ds:002b:00000000`000402d3=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: WmiPrvSE.exe
STACK_TEXT:
fffff584`22099130 fffff802`37685b37 : fffff584`22099200 fffff802`37687800 00000000`00000000 ffffdb8a`00000000 : FLTMGR!FltpPerformPreCallbacksWorker+0x580
fffff584`22099250 fffff802`376bbbc0 : fffff584`2209a000 fffff584`22094000 ffffdb8a`02586d00 00000000`00000000 : FLTMGR!FltpPassThroughInternal+0xc7
fffff584`220992a0 fffff802`39852f55 : ffffdb8a`1185fb00 ffffdb8a`024a4080 00000000`00000000 00000000`00000000 : FLTMGR!FltpCreate+0x310
fffff584`22099350 fffff802`39854544 : 00000000`00000000 ffffdb8a`09090010 ffffdb8a`0261fab0 fffff802`3990ad82 : nt!IofCallDriver+0x55
fffff584`22099390 fffff802`39bfec2d : fffff584`22099650 ffffdb8a`024a4080 ffffdb8a`1185fc48 fffff584`00000001 : nt!IoCallDriverWithTracing+0x34
fffff584`220993e0 fffff802`39c2751e : ffffdb8a`024a4080 00000000`00000000 ffffdb8a`0acee010 ffffdb8a`0acee001 : nt!IopParseDevice+0x117d
fffff584`22099550 fffff802`39beb19a : ffffdb8a`0acee000 fffff584`220997b8 ffffdb8a`00000040 ffffdb8a`014f8820 : nt!ObpLookupObjectName+0x3fe
fffff584`22099720 fffff802`39c6dc95 : 00000000`00000000 000000c8`298fa7e0 000000c8`298fa901 000000c8`298fa7b0 : nt!ObOpenObjectByNameEx+0x1fa
fffff584`22099850 fffff802`39a071b8 : ffffdb8a`0d6d3000 000002ad`efe40000 ffffdb8a`0d6d3080 000002ad`f0180910 : nt!NtQueryAttributesFile+0x1c5
fffff584`22099b00 00007fff`c806c754 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000c8`298fa738 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`c806c754
SYMBOL_NAME: FLTMGR!FltpPerformPreCallbacksWorker+580
MODULE_NAME: FLTMGR
IMAGE_NAME: FLTMGR.SYS
IMAGE_VERSION: 10.0.19041.264
STACK_COMMAND: .cxr 0xfffff58422098730 ; kb
BUCKET_ID_FUNC_OFFSET: 580
FAILURE_BUCKET_ID: 0x3B_c0000005_FLTMGR!FltpPerformPreCallbacksWorker
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {8c1dd5a6-b42f-d6ff-4bb6-2f415b42874f}
Followup: MachineOwner
---------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000000004f0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff803614993ef, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3421
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 17810
Key : Analysis.Init.CPU.mSec
Value: 342
Key : Analysis.Init.Elapsed.mSec
Value: 1057
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: a
BUGCHECK_P1: 4f0
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff803614993ef
READ_ADDRESS: fffff80361efa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
00000000000004f0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: ngen.exe
TRAP_FRAME: ffff8c05a0e761b0 -- (.trap 0xffff8c05a0e761b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffbd8000000000 rbx=0000000000000000 rcx=ffffbd8000000000
rdx=0000003fffffff78 rsi=0000000000000000 rdi=0000000000000000
rip=fffff803614993ef rsp=ffff8c05a0e76340 rbp=ffff8c05a0e76440
r8=000000000033f6ac r9=0000000000000001 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!MiDeletePteRun+0x5ef:
fffff803`614993ef 4939b3f0040000 cmp qword ptr [r11+4F0h],rsi ds:00000000`000004f0=????????????????
Resetting default scope
STACK_TEXT:
ffff8c05`a0e76068 fffff803`61607769 : 00000000`0000000a 00000000`000004f0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffff8c05`a0e76070 fffff803`61603a69 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffff8c05`a0e761b0 fffff803`614993ef : 00000000`00000004 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x469
ffff8c05`a0e76340 fffff803`6149ad6e : ffff8c05`a0e76918 ffffbd80`00030218 00000000`00000000 ffffbd80`00030218 : nt!MiDeletePteRun+0x5ef
ffff8c05`a0e76550 fffff803`6149b94b : ffff8c05`a0e76680 00000000`00000000 ffffbd80`00030218 00000000`00000000 : nt!MiDeleteVaTail+0x6e
ffff8c05`a0e76580 fffff803`6146baf0 : 00000000`00000001 ffff8c05`00000000 ffffc18d`14881550 ffffc18d`121e7080 : nt!MiDeletePagablePteRange+0x4ab
ffff8c05`a0e76890 fffff803`61835c99 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiDeleteVad+0x360
ffff8c05`a0e769a0 fffff803`61835a72 : ffffc18d`15b52bc0 00000000`00000000 ffffc18d`14881080 00000000`00000000 : nt!MiUnmapVad+0x49
ffff8c05`a0e769d0 fffff803`618358e9 : ffff7c4a`c3936b01 00000000`00d5cc00 00000000`00ac4000 00000000`00000000 : nt!MiUnmapViewOfSection+0x152
ffff8c05`a0e76ab0 fffff803`616071b8 : ffffc18d`121e7080 00007ffc`a50e7f01 ffff8c05`a0e76b80 ffffc18d`14881080 : nt!NtUnmapViewOfSectionEx+0x99
ffff8c05`a0e76b00 00007ffc`a68af924 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`00c5e068 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`a68af924
SYMBOL_NAME: nt!MiDeletePteRun+5ef
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.685
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 5ef
FAILURE_BUCKET_ID: AV_nt!MiDeletePteRun
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {b0b903a2-f631-d26c-01b4-99fbbec4b0a6}
Followup: MachineOwner
---------
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffff8e872212a670, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff801616c274e, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3124
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 19550
Key : Analysis.Init.CPU.mSec
Value: 342
Key : Analysis.Init.Elapsed.mSec
Value: 1052
Key : Analysis.Memory.CommitPeak.Mb
Value: 75
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffff8e872212a670
BUGCHECK_P2: 0
BUGCHECK_P3: fffff801616c274e
BUGCHECK_P4: 2
READ_ADDRESS: fffff801620fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffff8e872212a670
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: MsMpEng.exe
TRAP_FRAME: ffff8c87124995d0 -- (.trap 0xffff8c87124995d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffff8e863b6b8930
rdx=00000000edae0040 rsi=0000000000000000 rdi=0000000000000000
rip=fffff801616c274e rsp=ffff8c8712499768 rbp=ffff8c8712499829
r8=ffff8e872212a670 r9=0000000000000002 r10=fffff801616c2730
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!ExAcquireRundownProtectionCacheAwareEx+0x1e:
fffff801`616c274e 498b00 mov rax,qword ptr [r8] ds:ffff8e87`2212a670=????????????????
Resetting default scope
STACK_TEXT:
ffff8c87`12499328 fffff801`6181e8bb : 00000000`00000050 ffff8e87`2212a670 00000000`00000000 ffff8c87`124995d0 : nt!KeBugCheckEx
ffff8c87`12499330 fffff801`6160c960 : ffff8e86`3bc42bb0 00000000`00000000 ffff8c87`12499650 00000000`00000000 : nt!MiSystemFault+0x1f40ab
ffff8c87`12499430 fffff801`6180395e : ffff8e86`3c36f6d0 fffff801`61660c8b ffff8e86`3c36f080 ffffb88e`872d3748 : nt!MmAccessFault+0x400
ffff8c87`124995d0 fffff801`616c274e : fffff801`5dbe5ee4 ffff8e86`3e4f5460 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x35e
ffff8c87`12499768 fffff801`5dbe5ee4 : ffff8e86`3e4f5460 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExAcquireRundownProtectionCacheAwareEx+0x1e
ffff8c87`12499770 fffff801`5dbe4490 : ffff8c87`12499900 ffff8c87`12499911 00000000`00000000 00000000`00000000 : FLTMGR!FltpPerformPreCallbacksWorker+0x1c4
ffff8c87`12499890 fffff801`5dc189e5 : ffff8c87`1249a000 ffff8c87`12494000 00000000`00000000 ffff8e86`3bc42bb0 : FLTMGR!FltpPassThroughFastIo+0xc0
ffff8c87`12499910 fffff801`61a98f18 : ffff8e86`3bc42bb0 fffff801`61abe701 ffffa480`00000000 ffff8e86`3bcf6700 : FLTMGR!FltpFastIoLock+0x185
ffff8c87`124999c0 fffff801`618071b8 : ffff8e86`3c36f080 0000006f`2c07a338 00000000`00000000 0000006f`2c07a3c0 : nt!NtLockFile+0x228
ffff8c87`12499a90 00007ff9`5e22e0e4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000006f`2c07a308 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`5e22e0e4
SYMBOL_NAME: nt!ExAcquireRundownProtectionCacheAwareEx+1e
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.685
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1e
FAILURE_BUCKET_ID: AV_R_INVALID_nt!ExAcquireRundownProtectionCacheAwareEx
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {8c4e56f0-7b8e-3ab5-4d50-017b8f0ea0c2}
Followup: MachineOwner
---------
.
