DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000220000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8043c3bb2d0, address which referenced memory
Debugging Details:
------------------
***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 30
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 44
Key : Analysis.Memory.CommitPeak.Mb
Value: 44
Key : Analysis.System
Value: CreateObject
Key : WER.CorruptModuleList
Value: 1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: d1
BUGCHECK_P1: 220000000000
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8043c3bb2d0
READ_ADDRESS: Unable to get size of nt!_MMPTE - probably bad symbols
0000220000000000
CUSTOMER_CRASH_COUNT: 1
STACK_TEXT:
ffffdb02`f7e373d8 fffff804`38fce469 : 00000000`0000000a 00002200`00000000 00000000`00000002 00000000`00000000 : 0xfffff804`38fbc810
ffffdb02`f7e373e0 00000000`0000000a : 00002200`00000000 00000000`00000002 00000000`00000000 fffff804`3c3bb2d0 : 0xfffff804`38fce469
ffffdb02`f7e373e8 00002200`00000000 : 00000000`00000002 00000000`00000000 fffff804`3c3bb2d0 00000000`00000000 : 0xa
ffffdb02`f7e373f0 00000000`00000002 : 00000000`00000000 fffff804`3c3bb2d0 00000000`00000000 00000000`00000000 : 0x00002200`00000000
ffffdb02`f7e373f8 00000000`00000000 : fffff804`3c3bb2d0 00000000`00000000 00000000`00000000 00000000`00000000 : 0x2
SYMBOL_NAME: ANALYSIS_INCONCLUSIVE
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: CORRUPT_MODULELIST_AV
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {fc259191-ef0c-6215-476f-d32e5dcaf1b7}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffec0ee3509730, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffec0ee3509688, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4530
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 33829
Key : Analysis.Memory.CommitPeak.Mb
Value: 78
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffec0ee3509730
BUGCHECK_P3: ffffec0ee3509688
BUGCHECK_P4: 0
TRAP_FRAME: ffffec0ee3509730 -- (.trap 0xffffec0ee3509730)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000003403 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffc9885903df90 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80676085ca1 rsp=ffffec0ee35098c0 rbp=0000000000000000
r8=0000000000003403 r9=0000000000000001 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
rt640x64!MpHandleRecvIntPriVLanJumbo+0xc29:
fffff806`76085ca1 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffec0ee3509688 -- (.exr 0xffffec0ee3509688)
ExceptionAddress: fffff80676085ca1 (rt640x64!MpHandleRecvIntPriVLanJumbo+0x0000000000000c29)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffec0e`e3509408 fffff806`673ce469 : 00000000`00000139 00000000`00000003 ffffec0e`e3509730 ffffec0e`e3509688 : nt!KeBugCheckEx
ffffec0e`e3509410 fffff806`673ce890 : 00000000`0000feff fffff806`6a38f230 00000000`00000001 ffffc988`5d791c30 : nt!KiBugCheckDispatch+0x69
ffffec0e`e3509550 fffff806`673ccc1f : ffffc988`00000000 00000000`00000001 fffff806`6310a180 fffff806`6310a180 : nt!KiFastFailDispatch+0xd0
ffffec0e`e3509730 fffff806`76085ca1 : 00000000`000000ff fffff806`ffffffff 00000000`00000000 33333333`33333333 : nt!KiRaiseSecurityCheckFailure+0x31f
ffffec0e`e35098c0 fffff806`76072351 : 00000000`00000001 fffff806`67230f01 00000000`0000000a ffffec0e`e3509a38 : rt640x64!MpHandleRecvIntPriVLanJumbo+0xc29
ffffec0e`e35099b0 fffff806`69f4ec91 : ffffc988`590c7538 00000000`00000000 ffffc988`56704180 ffffc988`00000000 : rt640x64!MPHandleMessageInterrupt+0x341
ffffec0e`e3509a20 fffff806`69f63aec : ffffc988`54ad1010 ffffc988`54ad1010 fffff806`69f63900 ffffc988`590c7538 : ndis!NdisAllocateNetBufferListContext+0x341
ffffec0e`e3509b40 fffff806`67330925 : ffffc988`56704040 ffffc988`56704040 fffff806`69f63910 00000000`00000000 : ndis!NdisAcquireReadWriteLock+0x34c
ffffec0e`e3509c10 fffff806`673c3d5a : fffff806`6310a180 ffffc988`56704040 fffff806`673308d0 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffec0e`e3509c60 00000000`00000000 : ffffec0e`e350a000 ffffec0e`e3504000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a
SYMBOL_NAME: rt640x64!MpHandleRecvIntPriVLanJumbo+c29
MODULE_NAME: rt640x64
IMAGE_NAME: rt640x64.sys
IMAGE_VERSION: 9.1.409.2015
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: c29
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_rt640x64!MpHandleRecvIntPriVLanJumbo
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {cdf88df1-f791-6c3f-0e87-27dc7eb30b26}
Followup: MachineOwner
---------
0: kd> lmvm rt640x64
Browse full module list
start end module name
fffff806`76070000 fffff806`76116000 rt640x64 (pdb symbols) C:\ProgramData\Dbg\sym\rt640x64.pdb\A333EFD411894F41BA2C83E5A727534D1\rt640x64.pdb
Loaded symbol image file: rt640x64.sys
Mapped memory image file: C:\ProgramData\Dbg\sym\rt640x64.sys\5BCDE005a6000\rt640x64.sys
Image path: \SystemRoot\System32\drivers\rt640x64.sys
Image name: rt640x64.sys
Browse all global symbols functions data
Timestamp: Mon Oct 22 17:34:45 2018 (5BCDE005)
CheckSum: 000ACC60
ImageSize: 000A6000
File version: 9.1.409.2015
Product version: 9.1.409.2015
File flags: 8 (Mask 3F) Private
File OS: 40004 NT Win32
File type: 3.6 Driver
File date: 00000000.00000000
Translations: 0000.04b0
Information from resource tables:
CompanyName: Realtek
ProductName: Realtek 8125/8136/8168/8169 PCI/PCIe Adapters
InternalName: rt640x64.sys
OriginalFilename: rt640x64.sys
ProductVersion: 9.001.0409.2015
FileVersion: 9.001.0409.2015
FileDescription: Realtek 8125/8136/8168/8169 NDIS 6.40 64-bit Driver
LegalCopyright: Copyright (C) 2018 Realtek Semiconductor Corporation. All Right Reserved.
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffdbc3d2ea10c0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80237aef4aa, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3546
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 19339
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffdbc3d2ea10c0
BUGCHECK_P2: 0
BUGCHECK_P3: fffff80237aef4aa
BUGCHECK_P4: 2
READ_ADDRESS: fffff80237f6e3b0: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff80237e253b8: Unable to get Flags value from nt!KdVersionBlock
fffff80237e253b8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffdbc3d2ea10c0
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: dwm.exe
TRAP_FRAME: ffff8689098453d0 -- (.trap 0xffff8689098453d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffdc03d2ea10c3 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000100 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80237aef4aa rsp=ffff868909845568 rbp=ffff8689098456f0
r8=0000000002d14f9a r9=000000000003ffc0 r10=0000000000000003
r11=0000004000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
nt!RtlDecompressBufferXpressHuff+0x3aa:
fffff802`37aef4aa f3a4 rep movs byte ptr [rdi],byte ptr [rsi]
Resetting default scope
STACK_TEXT:
ffff8689`09845128 fffff802`37c00b1a : 00000000`00000050 ffffdbc3`d2ea10c0 00000000`00000000 ffff8689`098453d0 : nt!KeBugCheckEx
ffff8689`09845130 fffff802`37ac91df : 00000002`d41b2a00 00000000`00000000 00000000`00000000 ffffdbc3`d2ea10c0 : nt!MiSystemFault+0x18fb0a
ffff8689`09845230 fffff802`37bca69a : ffffdc03`d2ff0cc0 00000000`00000200 00000000`00000000 ffffdc03`cbc02000 : nt!MmAccessFault+0x34f
ffff8689`098453d0 fffff802`37aef4aa : fffff802`3805135e 00000000`00000001 fffff802`37a8fb21 ffffdc03`d6246ec0 : nt!KiPageFault+0x35a
ffff8689`09845568 ffff8b8d`6f6f6508 : 00000000`00000000 ffffdc03`d65f5b50 00000000`1bc1e8e0 00000000`1bc1e8e0 : nt!RtlDecompressBufferXpressHuff+0x3aa
ffff8689`098455b8 00000000`00000000 : ffffdc03`d65f5b50 00000000`1bc1e8e0 00000000`1bc1e8e0 ffff8689`098458f0 : 0xffff8b8d`6f6f6508
SYMBOL_NAME: nt!RtlDecompressBufferXpressHuff+3aa
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.18362.53
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 3aa
FAILURE_BUCKET_ID: AV_R_INVALID_nt!RtlDecompressBufferXpressHuff
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {1028827f-4a7a-b8d6-c7cf-200e7c1fab21}
Followup: MachineOwner
---------
