*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: ffffce80631472a0
Arg3: 0020000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.
SYSTEM_PRODUCT_NAME: B450M S2H
SYSTEM_SKU: Default string
SYSTEM_VERSION: Default string
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: F50
BIOS_DATE: 11/27/2019
BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.
BASEBOARD_PRODUCT: B450M S2H
BASEBOARD_VERSION: x.x
DUMP_TYPE: 2
BUGCHECK_P1: 41792
BUGCHECK_P2: ffffce80631472a0
BUGCHECK_P3: 20000000000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BUGCHECK_STR: 0x1a_41792
CPU_COUNT: c
CPU_MHZ: e09
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 8
CPU_STEPPING: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-03-2019 17:21:13.0758
ANALYSIS_VERSION: 10.0.18362.1 x86fre
STACK_TEXT:
fffffc89`6087cb98 fffff803`28e2548a : 00000000`0000001a 00000000`00041792 ffffce80`631472a0 00200000`00000000 : nt!KeBugCheckEx
fffffc89`6087cba0 fffff803`28cace07 : 00000000`00000000 ffffce80`631472a0 00000000`00000000 00000000`00000000 : nt!MiDeleteVa+0x17688a
fffffc89`6087ccb0 fffff803`28cad2c1 : fffffc89`6087d100 ffffcee7`40318a38 00000000`00000000 0a000001`90809867 : nt!MiWalkPageTablesRecursively+0x1e7
fffffc89`6087cd70 fffff803`28cad2c1 : fffffc89`6087d100 ffffcee7`73a018c0 00000000`00000000 0a000001`31bbc867 : nt!MiWalkPageTablesRecursively+0x6a1
fffffc89`6087ce30 fffff803`28cad2c1 : fffffc89`6087d100 ffffcee7`73b9d008 ffffcee7`00000000 0a000001`985bb867 : nt!MiWalkPageTablesRecursively+0x6a1
fffffc89`6087cef0 fffff803`28caca4c : fffffc89`6087d100 ffff839e`80000000 ffff839e`00000000 ffffab8c`ecbba580 : nt!MiWalkPageTablesRecursively+0x6a1
fffffc89`6087cfb0 fffff803`28caaeb8 : fffffc89`6087d100 00000000`00000002 00000000`00000001 fffff803`00000000 : nt!MiWalkPageTables+0x36c
fffffc89`6087d0b0 fffff803`28cb9010 : ffffffff`ffffffff ffffab8c`ecbba3f8 ffffab8c`00000001 00000000`00000000 : nt!MiDeletePagablePteRange+0x268
fffffc89`6087d450 fffff803`291d9e31 : ffffab8c`ed8d8080 00000000`00000000 ffffab8c`edbb27f0 ffffab8c`ed8d8080 : nt!MiDeleteVad+0x860
fffffc89`6087d610 fffff803`291d98cf : ffffab8c`edbb2930 ffffab8c`edbb2930 ffffab8c`ecbba080 fffff803`2906a400 : nt!MiCleanVad+0x4d
fffffc89`6087d640 fffff803`292386a1 : ffffffff`00000000 ffffffff`ffffffff fffffc89`6087d801 ffffab8c`ecbba080 : nt!MmCleanProcessAddressSpace+0x137
fffffc89`6087d6c0 fffff803`2925ecb3 : ffffab8c`ecbba080 ffffd285`a7b1a770 fffffc89`6087d8e9 00000000`00000000 : nt!PspRundownSingleProcess+0x139
fffffc89`6087d740 fffff803`292ccdb3 : ffffab8c`c0000005 0000029f`a4637501 000000c6`1dbb5000 fffffc89`6087d934 : nt!PspExitThread+0x60b
fffffc89`6087d850 fffff803`28c3e551 : 00000000`00000000 fffff803`291f0fde ffffa2f8`5b8ccb51 00000000`00000002 : nt!KiSchedulerApcTerminate+0x33
fffffc89`6087d890 fffff803`28dc5a60 : ffffab8c`ed89e601 fffffc89`6087d950 ffffab8c`ed47e210 00000000`00000000 : nt!KiDeliverApc+0x481
fffffc89`6087d950 fffff803`28dd2dbf : ffffe933`30c65768 00000000`00000001 ffffab8c`ed8d8080 000000c6`1fbff5d8 : nt!KiInitiateUserApc+0x70
fffffc89`6087da90 00007ffe`eb0ffa54 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
000000c6`1fbff668 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`eb0ffa54
THREAD_SHA1_HASH_MOD_FUNC: b87de3a7dc4c3b4e5f8b396a1852162b9bab7e4f
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 04055d0b39735f7e5fa0210d6f5423de96067011
THREAD_SHA1_HASH_MOD: aaa5a324bf1bd3082ad2b464ee2ed2f6d50e564c
SYMBOL_NAME: ONE_BIT
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
PRIMARY_PROBLEM_CLASS: MEMORY_CORRUPTION_ONE_BIT
TARGET_TIME: 2019-12-03T13:20:28.000Z
OSBUILD: 18362
OSSERVICEPACK: 476
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2011-12-30 02:28:41
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 558a
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_one_bit
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000004, The thread's stack pointer was outside the legal stack
extents for the thread.
Arg2: ffffd280bad05ff0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd280bad05f48, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.
SYSTEM_PRODUCT_NAME: B450M S2H
SYSTEM_SKU: Default string
SYSTEM_VERSION: Default string
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: F50
BIOS_DATE: 11/27/2019
BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.
BASEBOARD_PRODUCT: B450M S2H
BASEBOARD_VERSION: x.x
DUMP_TYPE: 2
BUGCHECK_P1: 4
BUGCHECK_P2: ffffd280bad05ff0
BUGCHECK_P3: ffffd280bad05f48
BUGCHECK_P4: 0
TRAP_FRAME: ffffd280bad05ff0 -- (.trap 0xffffd280bad05ff0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff8681dfb19000 rbx=0000000000000000 rcx=0000000000000004
rdx=ffff8681dfb1f000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8071ee4f1df rsp=ffffd280bad06180 rbp=ffffd280bad066f0
r8=ffff8681dfb1f000 r9=ffffd280bad06710 r10=ffffe50c62e07080
r11=0000009b9803d830 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!RtlpGetStackLimitsEx+0x12ea53:
fffff807`1ee4f1df cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffd280bad05f48 -- (.exr 0xffffd280bad05f48)
ExceptionAddress: fffff8071ee4f1df (nt!RtlpGetStackLimitsEx+0x000000000012ea53)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000004
Subcode: 0x4 FAST_FAIL_INCORRECT_STACK
CPU_COUNT: c
CPU_MHZ: e09
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 8
CPU_STEPPING: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 2
DEFAULT_BUCKET_ID: FAIL_FAST_INCORRECT_STACK
WATSON_BKT_EVENT: BEX
ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000004
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-03-2019 17:21:17.0804
ANALYSIS_VERSION: 10.0.18362.1 x86fre
BAD_STACK_POINTER: ffffd280bad05cc8
LAST_CONTROL_TRANSFER: from fffff8071edd32e9 to fffff8071edc14e0
STACK_TEXT:
ffffd280`bad05cc8 fffff807`1edd32e9 : 00000000`00000139 00000000`00000004 ffffd280`bad05ff0 ffffd280`bad05f48 : nt!KeBugCheckEx
ffffd280`bad05cd0 fffff807`1edd3710 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffd280`bad05e10 fffff807`1edd1aa5 : fffff807`1ed27368 fffff807`1f00ec84 ffffd280`bad067d0 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffd280`bad05ff0 fffff807`1ee4f1df : 00000000`00000000 00000000`00000360 0005e560`00ab6000 00000000`0010001f : nt!KiRaiseSecurityCheckFailure+0x325
ffffd280`bad06180 fffff807`1ee2e9fc : 00000000`00000000 00000000`00000000 ffffd280`bad066f0 00007fff`00000003 : nt!RtlpGetStackLimitsEx+0x12ea53
ffffd280`bad061b0 fffff807`1ecc795e : ffff8681`dfb1e558 ffffd280`bad06e30 ffff8681`dfb1e558 00000000`00006919 : nt!RtlDispatchException+0x16badc
ffffd280`bad06900 fffff807`1edc2362 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x16e
ffffd280`bad06fb0 fffff807`1edc2330 : fffff807`1edd3416 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxExceptionDispatchOnExceptionStack+0x12
ffff8681`dfb1e418 fffff807`1edd3416 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatchOnExceptionStackContinue
ffff8681`dfb1e420 fffff807`1edcf1a2 : 00000000`00000000 0000009b`9803d830 00000000`79517350 ffff8681`dfb1e630 : nt!KiExceptionDispatch+0x116
ffff8681`dfb1e600 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x322
THREAD_SHA1_HASH_MOD_FUNC: e737fbae702fb97094ad39b47d3b15c19fae2b06
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 9553227367d1d8395677e59c961f2e6757d288d4
THREAD_SHA1_HASH_MOD: b28610981796779b4ac02f58898fde25728a775c
FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff807`1edd3710 c644242000 mov byte ptr [rsp+20h],0
FAULT_INSTR_CODE: 202444c6
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiFastFailDispatch+d0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4efcf7a9
IMAGE_VERSION: 10.0.18362.476
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch
BUCKET_ID: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch
PRIMARY_PROBLEM_CLASS: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch
TARGET_TIME: 2019-12-03T13:40:13.000Z
OSBUILD: 18362
OSSERVICEPACK: 476
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2011-12-30 02:28:41
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 3d03
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_missing_gsframe_stackptr_error_nt!kifastfaildispatch
FAILURE_ID_HASH: {7b0febb5-6007-4f2b-3d38-57fef278d8d5}
Followup: MachineOwner
---------