*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 000000000000001d, An RTL_BALANCED_NODE RBTree entry has been corrupted.
Arg2: fffffc8ce2b2ef70, Address of the trap frame for the exception that caused the BugCheck
Arg3: fffffc8ce2b2eec8, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 12811
Key : Analysis.Elapsed.mSec
Value: 24023
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 1
Key : Analysis.Init.CPU.mSec
Value: 2093
Key : Analysis.Init.Elapsed.mSec
Value: 14336
Key : Analysis.Memory.CommitPeak.Mb
Value: 79
Key : Bugcheck.Code.LegacyAPI
Value: 0x139
Key : Dump.Attributes.AsUlong
Value: 1008
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
Key : FailFast.Name
Value: INVALID_BALANCED_TREE
Key : FailFast.Type
Value: 29
Key : Failure.Bucket
Value: 0x139_1d_INVALID_BALANCED_TREE_Npfs!NpWriteDataQueue
Key : Failure.Hash
Value: {28cbf4dd-9f0f-d5b8-99e5-1e3eb498266e}
BUGCHECK_CODE: 139
BUGCHECK_P1: 1d
BUGCHECK_P2: fffffc8ce2b2ef70
BUGCHECK_P3: fffffc8ce2b2eec8
BUGCHECK_P4: 0
FILE_IN_CAB: 062923-16796-01.dmp
DUMP_FILE_ATTRIBUTES: 0x1008
Kernel Generated Triage Dump
TRAP_FRAME: fffffc8ce2b2ef70 -- (.trap 0xfffffc8ce2b2ef70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffcc8400000014 rbx=0000000000000000 rcx=000000000000001d
rdx=ffffcc84338e98c8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80753e916b5 rsp=fffffc8ce2b2f100 rbp=0000000000000000
r8=ffffcc84338e98c8 r9=ffffcc84338e98d8 r10=ffffcc842be022d0
r11=ffffcc843bb0efe8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe cy
nt!RtlRbRemoveNode+0x24d015:
fffff807`53e916b5 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: fffffc8ce2b2eec8 -- (.exr 0xfffffc8ce2b2eec8)
ExceptionAddress: fffff80753e916b5 (nt!RtlRbRemoveNode+0x000000000024d015)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000000000000001d
Subcode: 0x1d FAST_FAIL_INVALID_BALANCED_TREE
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Discord.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 000000000000001d
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
fffffc8c`e2b2ec48 fffff807`53e418a9 : 00000000`00000139 00000000`0000001d fffffc8c`e2b2ef70 fffffc8c`e2b2eec8 : nt!KeBugCheckEx
fffffc8c`e2b2ec50 fffff807`53e41e32 : fffffc8c`e2b2edb0 00000000`00000000 00000000`00000000 fffffff6`00000002 : nt!KiBugCheckDispatch+0x69
fffffc8c`e2b2ed90 fffff807`53e3fc06 : fffff807`4f1b2180 fffffc8c`e2b2f060 00000000`00000001 fffffc8c`e2b2f060 : nt!KiFastFailDispatch+0xb2
fffffc8c`e2b2ef70 fffff807`53e916b5 : ffffcc84`3e4cb000 ffffcc84`2be022c0 00000000`00000700 ffffcc84`3e4d7fe0 : nt!KiRaiseSecurityCheckFailure+0x346
fffffc8c`e2b2f100 fffff807`53c43371 : ffffffff`ffffffff fffffc8c`e2b2f301 00000000`00000072 00000000`00000073 : nt!RtlRbRemoveNode+0x24d015
fffffc8c`e2b2f130 fffff807`53c43187 : fffffc8c`e2b2f298 00000000`00000000 00000000`00000002 00000000`00000001 : nt!RtlpHpVsChunkSplit+0x41
fffffc8c`e2b2f1d0 fffff807`53c8671e : 00000000`00000071 fffffc8c`00000700 00000000`00000072 00000000`00000080 : nt!RtlpHpVsContextAllocateInternal+0x227
fffffc8c`e2b2f240 fffff807`53c85fdf : 00000000`00000002 00000000`00000000 00000000`5246704e 00000000`00000000 : nt!ExAllocateHeapPool+0x70e
fffffc8c`e2b2f360 fffff807`544ad48d : 00000000`00000040 00000000`00000001 00000000`00000600 ffffcc84`00000000 : nt!ExpAllocatePoolWithTagFromNode+0x5f
fffffc8c`e2b2f3b0 fffff807`64b6be09 : ffffe207`bc216478 ffffcc84`00000000 fffff807`53a00002 ffffcc84`3eb440d0 : nt!ExAllocatePool2+0xdd
fffffc8c`e2b2f460 fffff807`64b6bb70 : 00000000`00000000 00000000`00000000 00000000`35a95b00 ffffe207`000006d8 : Npfs!NpWriteDataQueue+0x119
fffffc8c`e2b2f4d0 fffff807`64b6b9ad : 00000000`000006d8 00000000`35a95b00 ffffcc84`3a474b40 ffffcc84`49e55080 : Npfs!NpCommonWrite+0x140
fffffc8c`e2b2f560 fffff807`53c924e5 : ffffcc84`333dd6b0 ffffcc84`6cfefbb0 00000000`00000600 ffffcc84`3a474b40 : Npfs!NpFsdWrite+0x6d
fffffc8c`e2b2f5d0 fffff807`55f27bd6 : ffffcc84`4fbac9b0 00000000`00000000 00000000`00000001 00000000`35eb38e4 : nt!IofCallDriver+0x55
fffffc8c`e2b2f610 fffff807`53c924e5 : ffffcc84`3a474b40 00000000`00000000 00000000`00000a2c ffffcc84`6cfefbb0 : FLTMGR!FltpDispatch+0xd6
fffffc8c`e2b2f670 fffff807`540b5f10 : ffffcc84`3a474b40 00000000`00000001 fffffc8c`e2b2f711 00000000`1005ed08 : nt!IofCallDriver+0x55
fffffc8c`e2b2f6b0 fffff807`540f3d27 : ffffcc84`3a474b40 fffffc8c`e2b2f890 fffffc8c`e2b2f7d0 00000000`1005ed08 : nt!IopSynchronousServiceTail+0x1d0
fffffc8c`e2b2f760 fffff807`540f3973 : ffffcc84`6cfefbb0 00000000`001a019f ffffcc84`3a474b40 00000000`00000000 : nt!IopWriteFile+0x267
fffffc8c`e2b2f880 fffff807`53e40fe5 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`3569177c : nt!NtWriteFile+0x263
fffffc8c`e2b2f970 00000000`779e1cf3 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`1005ecb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x779e1cf3
SYMBOL_NAME: Npfs!NpWriteDataQueue+119
MODULE_NAME: Npfs
IMAGE_NAME: Npfs.SYS
IMAGE_VERSION: 10.0.22621.1690
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 119
FAILURE_BUCKET_ID: 0x139_1d_INVALID_BALANCED_TREE_Npfs!NpWriteDataQueue
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {28cbf4dd-9f0f-d5b8-99e5-1e3eb498266e}
Followup: MachineOwner
---------
