*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_HEAP_CORRUPTION (13a)
The kernel mode heap manager has detected corruption in a heap.
Arguments:
Arg1: 0000000000000011, Type of corruption detected
Arg2: ffff9a85d7402100, Address of the heap that reported the corruption
Arg3: ffff9a85e8bfaf70, Address at which the corruption was detected
Arg4: 0000000000000000
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
fffff8036b0fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
HeapDbgInitExtension Failed
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 9515
Key : Analysis.Elapsed.mSec
Value: 22374
Key : Analysis.IO.Other.Mb
Value: 16
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 18
Key : Analysis.Init.CPU.mSec
Value: 968
Key : Analysis.Init.Elapsed.mSec
Value: 36836
Key : Analysis.Memory.CommitPeak.Mb
Value: 84
Key : Bugcheck.Code.LegacyAPI
Value: 0x13a
Key : Failure.Bucket
Value: 0x13a_11_BE___BEDaisy!unknown_function
Key : Failure.Hash
Value: {6a85b8ad-f8a7-b71c-b9d1-e9d62252af2e}
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 13a
BUGCHECK_P1: 11
BUGCHECK_P2: ffff9a85d7402100
BUGCHECK_P3: ffff9a85e8bfaf70
BUGCHECK_P4: 0
FILE_IN_CAB: 061723-13453-01.dmp
POOL_ADDRESS: Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffff9a85e8bfaf70
FREED_POOL_TAG: BE__
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: RainbowSix.exe
STACK_TEXT:
ffffef01`6a266878 fffff803`6a991e3c : 00000000`0000013a 00000000`00000011 ffff9a85`d7402100 ffff9a85`e8bfaf70 : nt!KeBugCheckEx
ffffef01`6a266880 fffff803`6a991e9c : 00000000`00000011 00000000`00000000 ffff9a85`d7402100 00000000`00040286 : nt!RtlpHeapHandleError+0x40
ffffef01`6a2668c0 fffff803`6a991ac9 : 00000000`00000030 ffff9a85`e8bf5000 00000000`00000000 ffff9a85`f350e0c0 : nt!RtlpHpHeapHandleError+0x58
ffffef01`6a2668f0 fffff803`6a857e6a : 00000000`00000404 ffffef01`6a266b70 ffffd46a`351a8000 ffff9a85`f350e518 : nt!RtlpLogHeapFailure+0x45
ffffef01`6a266920 fffff803`6a617a42 : ffff9a85`d7402340 fffff803`6a6d49ff ffff9a85`d7a83420 ffff9a85`00000000 : nt!RtlpHpLfhSubsegmentFreeBlock+0x1867fa
ffffef01`6a2669d0 fffff803`6adb70b9 : 00000000`00000000 ffff9a85`f350e0c0 ffffef01`6a266b70 01000000`00100000 : nt!ExFreeHeapPool+0x362
ffffef01`6a266ab0 fffff807`c9c439f3 : fffff807`c99351d8 ffffef01`00000000 ffff4457`30c8c400 fffff803`93419500 : nt!ExFreePool+0x9
ffffef01`6a266ae0 fffff807`c99351d8 : ffffef01`00000000 ffff4457`30c8c400 fffff803`93419500 00000000`00000000 : BEDaisy+0x3239f3
ffffef01`6a266ae8 ffffef01`00000000 : ffff4457`30c8c400 fffff803`93419500 00000000`00000000 00000000`00000009 : BEDaisy+0x151d8
ffffef01`6a266af0 ffff4457`30c8c400 : fffff803`93419500 00000000`00000000 00000000`00000009 fffff803`6b0ec138 : 0xffffef01`00000000
ffffef01`6a266af8 fffff803`93419500 : 00000000`00000000 00000000`00000009 fffff803`6b0ec138 00000000`0000000b : 0xffff4457`30c8c400
ffffef01`6a266b00 00000000`00000000 : 00000000`00000009 fffff803`6b0ec138 00000000`0000000b 00000000`00000001 : nvlddmkm+0xbe9500
SYMBOL_NAME: BEDaisy+3239f3
MODULE_NAME: BEDaisy
IMAGE_NAME: BEDaisy.sys
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 3239f3
FAILURE_BUCKET_ID: 0x13a_11_BE___BEDaisy!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {6a85b8ad-f8a7-b71c-b9d1-e9d62252af2e}
Followup: MachineOwner
---------
0: kd> lmvm BEDaisy
Browse full module list
start end module name
fffff807`c9920000 fffff807`c9c51000 BEDaisy T (no symbols)
Loaded symbol image file: BEDaisy.sys
Image path: \??\C:\Program Files (x86)\Common Files\BattlEye\BEDaisy.sys
Image name: BEDaisy.sys
Browse all global symbols functions data
Timestamp: Tue Apr 19 20:09:51 2022 (625EECDF)
CheckSum: 0033D7DC
ImageSize: 00331000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables: