5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffdb0e3621f084, memory referenced.
Arg2: 0000000000000002, X64: bit 0 set if the fault was due to a not-present PTE.
bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the processor decided the fault was due to a corrupted PTE.
bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
- ARM64: bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: fffff804749fbe43, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Type
Value: Write
Key : Analysis.CPU.mSec
Value: 3937
Key : Analysis.Elapsed.mSec
Value: 16880
Key : Analysis.IO.Other.Mb
Value: 3
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 4
Key : Analysis.Init.CPU.mSec
Value: 405
Key : Analysis.Init.Elapsed.mSec
Value: 6584
Key : Analysis.Memory.CommitPeak.Mb
Value: 99
Key : Bugcheck.Code.LegacyAPI
Value: 0x50
Key : Failure.Bucket
Value: AV_W_(null)_fileinfo!FIStreamQueryInfo
Key : Failure.Hash
Value: {05c917e6-f5ab-02b5-3120-35f7a8676250}
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffdb0e3621f084
BUGCHECK_P2: 2
BUGCHECK_P3: fffff804749fbe43
BUGCHECK_P4: 2
FILE_IN_CAB: 070423-13140-01.dmp
READ_ADDRESS: fffff80471cfb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffdb0e3621f084
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffffc6847eeeeb40 -- (.trap 0xffffc6847eeeeb40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000004 rbx=0000000000000000 rcx=ffffdb0e3621f000
rdx=ffffdb8e3dd3e010 rsi=0000000000000000 rdi=0000000000000000
rip=fffff804749fbe43 rsp=ffffc6847eeeecd0 rbp=ffffc6847eeef0c8
r8=ffffdb8e3dd3e170 r9=ffff89019c84b4b0 r10=fffff804712f67d0
r11=ffffc6847eeeed90 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
Ntfs!NtfsBuildRelativeName+0xc3:
fffff804`749fbe43 f0440fb1a984000000 lock cmpxchg dword ptr [rcx+84h],r13d ds:ffffdb0e`3621f084=????????
Resetting default scope
STACK_TEXT:
ffffc684`7eeee898 fffff804`7144af53 : 00000000`00000050 ffffdb0e`3621f084 00000000`00000002 ffffc684`7eeeeb40 : nt!KeBugCheckEx
ffffc684`7eeee8a0 fffff804`7126e7b0 : ffff9e08`4ef318a0 00000000`00000002 ffffc684`7eeeebc0 00000000`00000000 : nt!MiSystemFault+0x1b2563
ffffc684`7eeee9a0 fffff804`7140bad8 : 00000000`00000000 ffffdb8e`3dd3e018 ffffdb8e`00000000 00000000`0018b400 : nt!MmAccessFault+0x400
ffffc684`7eeeeb40 fffff804`749fbe43 : ffff8901`9c84b498 ffffdb8e`3dd3e018 ffffdb8e`3dd3e170 ffffc684`7eeef3c0 : nt!KiPageFault+0x358
ffffc684`7eeeecd0 fffff804`74989dff : ffffc684`7eeef3c0 ffffdb8e`3dd3e010 ffffdb8e`3dd3e010 ffffdb8e`3ed40000 : Ntfs!NtfsBuildRelativeName+0xc3
ffffc684`7eeeedc0 fffff804`7498937b : ffffc684`7eeef3c0 ffffdb8e`368928f0 fffff804`749fbd80 ffff9e08`5f26b010 : Ntfs!NtfsWalkUpTree+0x20f
ffffc684`7eeeef60 fffff804`74989183 : 00000000`00000000 00000000`00000000 ffffdb8e`368928f0 ffff9e08`64dad110 : Ntfs!NtfsBuildNormalizedNameWithTxfIsolation+0x97
ffffc684`7eeeeff0 fffff804`74988ecd : ffffdb8e`368928f0 ffff9e08`64dad110 ffffc684`7eeef3c0 ffffdb8e`36892a50 : Ntfs!NtfsBuildNormalizedNameWithSystemSpecialCases+0xf7
ffffc684`7eeef050 fffff804`7499e55d : ffffc684`7eeef3c0 ffffc684`7eeef3c0 ffffdb8e`36892a50 ffffdb8e`36892a50 : Ntfs!NtfsQueryNameInfo+0x49d
ffffc684`7eeef170 fffff804`7499cf16 : ffffc684`7eeef3c0 ffff9e08`5f26b010 00000000`00000001 ffff9e08`5f26b000 : Ntfs!NtfsCommonQueryInformation+0xa4d
ffffc684`7eeef270 fffff804`7499cda0 : ffffc684`7eeef3c0 ffff9e08`5f26b010 ffff9e08`5f26b010 ffff9e08`5f26b010 : Ntfs!NtfsFsdDispatchSwitch+0x156
ffffc684`7eeef3a0 fffff804`71211385 : ffff9e08`64dad110 fffff804`713067fc 00000000`0000000e fffff804`71218f04 : Ntfs!NtfsFsdDispatchWait+0x40
ffffc684`7eeef640 fffff804`6e727945 : ffff9e08`615ade40 ffff9e08`64dad110 ffff9e08`66ff9d0c 00000000`00000000 : nt!IofCallDriver+0x55
ffffc684`7eeef680 fffff804`6e7285ee : ffff9e08`6880a860 00000000`00000000 00000000`00000000 ffff9e08`6880a8a0 : FLTMGR!FltpGetFileName+0x195
ffffc684`7eeef720 fffff804`6e728e5b : ffff9e08`615ade00 ffff9e08`615ade40 ffff9e08`615ade40 00000000`00000000 : FLTMGR!FltpGetNormalizedFileNameWorker+0x5e
ffffc684`7eeef7a0 fffff804`6e6f366f : ffff9e08`6880a8a0 ffffc684`7eef0000 ffffc684`7eee9000 fffff804`6e718060 : FLTMGR!FltpCreateFileNameInformation+0x2eb
ffffc684`7eeef820 fffff804`6e72828a : 00000000`00008000 ffff9e08`ffff7fff ffff9e08`6880a860 00000000`00000000 : FLTMGR!FltpGetFileNameInformation+0x6ef
ffffc684`7eeef8d0 fffff804`747cd46c : ffff9e08`4ef528a0 00000000`00000000 ffff9e08`6880a8a8 ffffdb8e`3ea9e600 : FLTMGR!FltGetFileNameInformationUnsafe+0x8a
ffffc684`7eeef950 fffff804`747cc18a : ffff9e08`68169090 ffff9e08`4ef528a0 ffff9e08`64dad110 fffff804`71d25400 : fileinfo!FIStreamQueryInfo+0x13c
ffffc684`7eeef9e0 fffff804`6e72e3e7 : ffffdb8e`3ea9e600 00000000`00000000 ffff9e08`4ef528a0 ffff9e08`68169090 : fileinfo!FIStreamQueryWorker+0x7a
ffffc684`7eeefa20 fffff804`7128e5c5 : ffff9e08`5f979040 ffff9e08`5f979040 fffff804`6e72e340 ffff9e08`4bd08c80 : FLTMGR!FltpProcessGenericWorkItem+0xa7
ffffc684`7eeefab0 fffff804`713268f5 : ffff9e08`5f979040 00000000`00000080 ffff9e08`4bcba1c0 47253f52`4725c54f : nt!ExpWorkerThread+0x105
ffffc684`7eeefb50 fffff804`71404c68 : fffff804`6d48e180 ffff9e08`5f979040 fffff804`713268a0 4725b08b`47254f82 : nt!PspSystemThreadStartup+0x55
ffffc684`7eeefba0 00000000`00000000 : ffffc684`7eef0000 ffffc684`7eee9000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: fileinfo!FIStreamQueryInfo+13c
MODULE_NAME: fileinfo
IMAGE_NAME: fileinfo.sys
IMAGE_VERSION: 10.0.19041.1030
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 13c
FAILURE_BUCKET_ID: AV_W_(null)_fileinfo!FIStreamQueryInfo
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {05c917e6-f5ab-02b5-3120-35f7a8676250}
Followup: MachineOwner
---------
9: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffa30a6a163f00, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8020d41630c, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3561
Key : Analysis.Elapsed.mSec
Value: 10954
Key : Analysis.IO.Other.Mb
Value: 16
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 18
Key : Analysis.Init.CPU.mSec
Value: 374
Key : Analysis.Init.Elapsed.mSec
Value: 33255
Key : Analysis.Memory.CommitPeak.Mb
Value: 100
Key : Bugcheck.Code.LegacyAPI
Value: 0xa
Key : Failure.Bucket
Value: AV_nt!RtlRbRemoveNode
Key : Failure.Hash
Value: {9b43c07a-2da2-b63c-46ab-1c788c8a28c1}
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: a
BUGCHECK_P1: ffffa30a6a163f00
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8020d41630c
FILE_IN_CAB: 070323-14843-01.dmp
READ_ADDRESS: fffff8020defb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffa30a6a163f00
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: fffffa8aa9c0f3f0 -- (.trap 0xfffffa8aa9c0f3f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=ffffa30866f46ef8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8020d41630c rsp=fffffa8aa9c0f588 rbp=0000000000000025
r8=ffffa3086bbf7ef8 r9=ffffa3086bbf7ef8 r10=0000000000000000
r11=ffffa30a6a163ef8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!RtlRbRemoveNode+0x7c:
fffff802`0d41630c 498b4308 mov rax,qword ptr [r11+8] ds:ffffa30a`6a163f00=????????????????
Resetting default scope
STACK_TEXT:
fffffa8a`a9c0f2a8 fffff802`0d610029 : 00000000`0000000a ffffa30a`6a163f00 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffa8a`a9c0f2b0 fffff802`0d60bbe3 : ffffa308`7d338380 00000000`00000001 ffffa308`5d2d4030 ffffa308`5d154d00 : nt!KiBugCheckDispatch+0x69
fffffa8a`a9c0f3f0 fffff802`0d41630c : 00000025`000f0000 00010025`00250000 fffff802`0d416123 00000000`00000025 : nt!KiPageFault+0x463
fffffa8a`a9c0f588 fffff802`0d416123 : 00000000`00000025 ffffa308`66f46ca0 00000000`00000000 ffffa308`66f46ef0 : nt!RtlRbRemoveNode+0x7c
fffffa8a`a9c0f5a0 fffff802`0d415a98 : ffffa308`57010280 ffffa308`66f46000 ffffa308`57010280 fffffa8a`a9c0f6a8 : nt!RtlpHpVsChunkCoalesce+0x183
fffffa8a`a9c0f600 fffff802`0d417bb4 : 00000000`00000000 ffffa308`00000000 00000000`00000000 ffffa308`00000000 : nt!RtlpHpVsContextFree+0x188
fffffa8a`a9c0f6a0 fffff802`0dbb70b9 : fffffa8a`00000240 ffffffff`ffffffff fffffa8a`a9c0f860 01000000`00100000 : nt!ExFreeHeapPool+0x4d4
fffffa8a`a9c0f780 fffff802`0d447eba : 00000000`00000000 fffffa8a`a9c0f860 ffffffff`ffffffff fffffa8a`a9c0f860 : nt!ExFreePool+0x9
fffffa8a`a9c0f7b0 fffff802`0d495cb9 : 00000000`00000000 fffffa8a`a9c0f879 ffffa308`7d338380 ffffa308`6f318560 : nt!CcDeleteSharedCacheMap+0x222
fffffa8a`a9c0f800 fffff802`0d44a9a1 : ffffa308`834814c0 00000000`00000000 ffffa308`56f1db00 ffffa308`00000000 : nt!CcWriteBehindInternal+0x389
fffffa8a`a9c0f8e0 fffff802`0d449e31 : ffffa308`6dac0040 ffffa308`56ef6fb0 ffffa308`834814c0 00000000`00000000 : nt!CcWriteBehind+0x91
fffffa8a`a9c0f9d0 fffff802`0d48e5c5 : ffffa308`6dac0040 ffffa308`56e9da20 ffffa308`56ef6fb0 00000000`00000200 : nt!CcCachemapUninitWorkerThread+0xf1
fffffa8a`a9c0fab0 fffff802`0d5268f5 : ffffa308`6dac0040 00000000`00000080 ffffa308`56f02080 00000000`00000000 : nt!ExpWorkerThread+0x105
fffffa8a`a9c0fb50 fffff802`0d604c68 : ffffbc81`db700180 ffffa308`6dac0040 fffff802`0d5268a0 00000000`00000000 : nt!PspSystemThreadStartup+0x55
fffffa8a`a9c0fba0 00000000`00000000 : fffffa8a`a9c10000 fffffa8a`a9c09000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!RtlRbRemoveNode+7c
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.3155
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 7c
FAILURE_BUCKET_ID: AV_nt!RtlRbRemoveNode
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {9b43c07a-2da2-b63c-46ab-1c788c8a28c1}
Followup: MachineOwner
---------
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffdb0e3621f084, memory referenced.
Arg2: 0000000000000002, X64: bit 0 set if the fault was due to a not-present PTE.
bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the processor decided the fault was due to a corrupted PTE.
bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
- ARM64: bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: fffff804749fbe43, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Type
Value: Write
Key : Analysis.CPU.mSec
Value: 3937
Key : Analysis.Elapsed.mSec
Value: 16880
Key : Analysis.IO.Other.Mb
Value: 3
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 4
Key : Analysis.Init.CPU.mSec
Value: 405
Key : Analysis.Init.Elapsed.mSec
Value: 6584
Key : Analysis.Memory.CommitPeak.Mb
Value: 99
Key : Bugcheck.Code.LegacyAPI
Value: 0x50
Key : Failure.Bucket
Value: AV_W_(null)_fileinfo!FIStreamQueryInfo
Key : Failure.Hash
Value: {05c917e6-f5ab-02b5-3120-35f7a8676250}
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffdb0e3621f084
BUGCHECK_P2: 2
BUGCHECK_P3: fffff804749fbe43
BUGCHECK_P4: 2
FILE_IN_CAB: 070423-13140-01.dmp
READ_ADDRESS: fffff80471cfb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffdb0e3621f084
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffffc6847eeeeb40 -- (.trap 0xffffc6847eeeeb40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000004 rbx=0000000000000000 rcx=ffffdb0e3621f000
rdx=ffffdb8e3dd3e010 rsi=0000000000000000 rdi=0000000000000000
rip=fffff804749fbe43 rsp=ffffc6847eeeecd0 rbp=ffffc6847eeef0c8
r8=ffffdb8e3dd3e170 r9=ffff89019c84b4b0 r10=fffff804712f67d0
r11=ffffc6847eeeed90 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
Ntfs!NtfsBuildRelativeName+0xc3:
fffff804`749fbe43 f0440fb1a984000000 lock cmpxchg dword ptr [rcx+84h],r13d ds:ffffdb0e`3621f084=????????
Resetting default scope
STACK_TEXT:
ffffc684`7eeee898 fffff804`7144af53 : 00000000`00000050 ffffdb0e`3621f084 00000000`00000002 ffffc684`7eeeeb40 : nt!KeBugCheckEx
ffffc684`7eeee8a0 fffff804`7126e7b0 : ffff9e08`4ef318a0 00000000`00000002 ffffc684`7eeeebc0 00000000`00000000 : nt!MiSystemFault+0x1b2563
ffffc684`7eeee9a0 fffff804`7140bad8 : 00000000`00000000 ffffdb8e`3dd3e018 ffffdb8e`00000000 00000000`0018b400 : nt!MmAccessFault+0x400
ffffc684`7eeeeb40 fffff804`749fbe43 : ffff8901`9c84b498 ffffdb8e`3dd3e018 ffffdb8e`3dd3e170 ffffc684`7eeef3c0 : nt!KiPageFault+0x358
ffffc684`7eeeecd0 fffff804`74989dff : ffffc684`7eeef3c0 ffffdb8e`3dd3e010 ffffdb8e`3dd3e010 ffffdb8e`3ed40000 : Ntfs!NtfsBuildRelativeName+0xc3
ffffc684`7eeeedc0 fffff804`7498937b : ffffc684`7eeef3c0 ffffdb8e`368928f0 fffff804`749fbd80 ffff9e08`5f26b010 : Ntfs!NtfsWalkUpTree+0x20f
ffffc684`7eeeef60 fffff804`74989183 : 00000000`00000000 00000000`00000000 ffffdb8e`368928f0 ffff9e08`64dad110 : Ntfs!NtfsBuildNormalizedNameWithTxfIsolation+0x97
ffffc684`7eeeeff0 fffff804`74988ecd : ffffdb8e`368928f0 ffff9e08`64dad110 ffffc684`7eeef3c0 ffffdb8e`36892a50 : Ntfs!NtfsBuildNormalizedNameWithSystemSpecialCases+0xf7
ffffc684`7eeef050 fffff804`7499e55d : ffffc684`7eeef3c0 ffffc684`7eeef3c0 ffffdb8e`36892a50 ffffdb8e`36892a50 : Ntfs!NtfsQueryNameInfo+0x49d
ffffc684`7eeef170 fffff804`7499cf16 : ffffc684`7eeef3c0 ffff9e08`5f26b010 00000000`00000001 ffff9e08`5f26b000 : Ntfs!NtfsCommonQueryInformation+0xa4d
ffffc684`7eeef270 fffff804`7499cda0 : ffffc684`7eeef3c0 ffff9e08`5f26b010 ffff9e08`5f26b010 ffff9e08`5f26b010 : Ntfs!NtfsFsdDispatchSwitch+0x156
ffffc684`7eeef3a0 fffff804`71211385 : ffff9e08`64dad110 fffff804`713067fc 00000000`0000000e fffff804`71218f04 : Ntfs!NtfsFsdDispatchWait+0x40
ffffc684`7eeef640 fffff804`6e727945 : ffff9e08`615ade40 ffff9e08`64dad110 ffff9e08`66ff9d0c 00000000`00000000 : nt!IofCallDriver+0x55
ffffc684`7eeef680 fffff804`6e7285ee : ffff9e08`6880a860 00000000`00000000 00000000`00000000 ffff9e08`6880a8a0 : FLTMGR!FltpGetFileName+0x195
ffffc684`7eeef720 fffff804`6e728e5b : ffff9e08`615ade00 ffff9e08`615ade40 ffff9e08`615ade40 00000000`00000000 : FLTMGR!FltpGetNormalizedFileNameWorker+0x5e
ffffc684`7eeef7a0 fffff804`6e6f366f : ffff9e08`6880a8a0 ffffc684`7eef0000 ffffc684`7eee9000 fffff804`6e718060 : FLTMGR!FltpCreateFileNameInformation+0x2eb
ffffc684`7eeef820 fffff804`6e72828a : 00000000`00008000 ffff9e08`ffff7fff ffff9e08`6880a860 00000000`00000000 : FLTMGR!FltpGetFileNameInformation+0x6ef
ffffc684`7eeef8d0 fffff804`747cd46c : ffff9e08`4ef528a0 00000000`00000000 ffff9e08`6880a8a8 ffffdb8e`3ea9e600 : FLTMGR!FltGetFileNameInformationUnsafe+0x8a
ffffc684`7eeef950 fffff804`747cc18a : ffff9e08`68169090 ffff9e08`4ef528a0 ffff9e08`64dad110 fffff804`71d25400 : fileinfo!FIStreamQueryInfo+0x13c
ffffc684`7eeef9e0 fffff804`6e72e3e7 : ffffdb8e`3ea9e600 00000000`00000000 ffff9e08`4ef528a0 ffff9e08`68169090 : fileinfo!FIStreamQueryWorker+0x7a
ffffc684`7eeefa20 fffff804`7128e5c5 : ffff9e08`5f979040 ffff9e08`5f979040 fffff804`6e72e340 ffff9e08`4bd08c80 : FLTMGR!FltpProcessGenericWorkItem+0xa7
ffffc684`7eeefab0 fffff804`713268f5 : ffff9e08`5f979040 00000000`00000080 ffff9e08`4bcba1c0 47253f52`4725c54f : nt!ExpWorkerThread+0x105
ffffc684`7eeefb50 fffff804`71404c68 : fffff804`6d48e180 ffff9e08`5f979040 fffff804`713268a0 4725b08b`47254f82 : nt!PspSystemThreadStartup+0x55
ffffc684`7eeefba0 00000000`00000000 : ffffc684`7eef0000 ffffc684`7eee9000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: fileinfo!FIStreamQueryInfo+13c
MODULE_NAME: fileinfo
IMAGE_NAME: fileinfo.sys
IMAGE_VERSION: 10.0.19041.1030
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 13c
FAILURE_BUCKET_ID: AV_W_(null)_fileinfo!FIStreamQueryInfo
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {05c917e6-f5ab-02b5-3120-35f7a8676250}
Followup: MachineOwner
---------