Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\maksu\Downloads\120720-6609-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff806`6e400000 PsLoadedModuleList = 0xfffff806`6f02a3b0
Debug session time: Mon Dec 7 20:04:28.148 2020 (UTC + 3:00)
System Uptime: 0 days 12:15:00.789
Loading Kernel Symbols
...............................................................
................................................................
........................................................
Loading User Symbols
Loading unloaded module list
...........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`6e7f5210 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff9c8d`7f5386b0=0000000000000018
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffffb5865afd4560, Object whose reference count is being lowered
Arg3: 0000000000000002, Reserved
Arg4: ffffffffffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4452
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G2EFLS9
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 15418
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 18
BUGCHECK_P1: 0
BUGCHECK_P2: ffffb5865afd4560
BUGCHECK_P3: 2
BUGCHECK_P4: ffffffffffffffff
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: f1_2019_wingaming_m.exe
STACK_TEXT:
ffff9c8d`7f5386a8 fffff806`6e86d35b : 00000000`00000018 00000000`00000000 ffffb586`5afd4560 00000000`00000002 : nt!KeBugCheckEx
ffff9c8d`7f5386b0 fffff806`6eaed70e : ffffb586`4fad7400 00000000`00000001 00000000`00000000 ffffb586`5b7b0140 : nt!ObfDereferenceObjectWithTag+0x191abb
ffff9c8d`7f5386f0 fffff806`6eaa4dc5 : ffffb586`581ae0b8 fffff806`6e6dbc59 00000000`00000000 00000000`00000000 : nt!ObCloseHandleTableEntry+0x29e
ffff9c8d`7f538830 fffff806`6eaa70ad : ffffb586`581ae080 ffffb586`5cdef080 ffffffff`ffffff01 ffffb586`5e0c84d8 : nt!ExSweepHandleTable+0xd5
ffff9c8d`7f5388e0 fffff806`6e9f1647 : ffffffff`ffffffff ffffb586`5e0c8080 ffff9c8d`7f538930 ffffb586`00000000 : nt!ObKillProcess+0x35
ffff9c8d`7f538910 fffff806`6e9e6f96 : ffffb586`5e0c8080 ffffc989`3cde3770 00000000`00000000 00000000`00000000 : nt!PspRundownSingleProcess+0x133
ffff9c8d`7f538990 fffff806`6ea4a7ee : ffffb586`00000000 00000000`00000001 000001bf`b3c403a0 00000065`326ca000 : nt!PspExitThread+0x5f6
ffff9c8d`7f538a90 fffff806`6e806bb8 : ffffb586`5e0c8080 ffffb586`5cdef080 ffff9c8d`7f538b80 ffffb586`5e0c8080 : nt!NtTerminateProcess+0xde
ffff9c8d`7f538b00 00007fff`169ac324 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000065`33fff4d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`169ac324
SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+191abb
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.630
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 191abb
FAILURE_BUCKET_ID: 0x18_OVER_DEREFERENCE_nt!ObfDereferenceObjectWithTag
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {4139309c-4e9f-52f0-ac5e-4041e7a86a20}
Followup: MachineOwner
---------
drive.google.com
