IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffd60e149e4089, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8012fb3272c, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3359
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 10193
Key : Analysis.Init.CPU.mSec
Value: 999
Key : Analysis.Init.Elapsed.mSec
Value: 14284
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : WER.OS.Branch
Value: co_release
Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z
Key : WER.OS.Version
Value: 10.0.22000.1
FILE_IN_CAB: 112421-7156-01.dmp
BUGCHECK_CODE: a
BUGCHECK_P1: ffffd60e149e4089
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8012fb3272c
READ_ADDRESS: fffff80130505450: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffd60e149e4089
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: League of Legends.exe
TRAP_FRAME: ffffd60e149db640 -- (.trap 0xffffd60e149db640)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000005
rdx=fffff8012f800000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8012fb3272c rsp=ffffd60e149db7d0 rbp=ffffd60e149db849
r8=ffffd60e149db849 r9=0000000000000f00 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!KiSwapThread+0x67c:
fffff801`2fb3272c 498b9040880000 mov rdx,qword ptr [r8+8840h] ds:ffffd60e`149e4089=????????????????
Resetting default scope
STACK_TEXT:
ffffd60e`149db4f8 fffff801`2fc281a9 : 00000000`0000000a ffffd60e`149e4089 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd60e`149db500 fffff801`2fc24300 : ffffad01`4aa40180 fffff801`2fc1d507 000f8067`b4bbbdff fffffff6`00400000 : nt!KiBugCheckDispatch+0x69
ffffd60e`149db640 fffff801`2fb3272c : ffffad01`4aa40180 00000000`ffffffff 00000000`00000009 00000002`00000000 : nt!KiPageFault+0x440
ffffd60e`149db7d0 fffff801`2fb34309 : 00000000`00000005 00000000`00000008 ffffd60e`149db9b0 00000000`00000000 : nt!KiSwapThread+0x67c
ffffd60e`149db8b0 fffff801`2fb2e224 : ffffd60e`00000000 fffff801`00000000 ffffad01`00000000 00000000`00000000 : nt!KiCommitThreadWait+0x159
ffffd60e`149db950 fffff801`2ff6a5eb : ffffd70f`86a84560 00000000`00000006 00000000`00000001 00000000`00000000 : nt!KeWaitForSingleObject+0x234
ffffd60e`149dba40 fffff801`2ff6a51a : ffffd70f`835d6080 00000000`00000000 00000000`00000000 ffffd70f`86a86be0 : nt!ObWaitForSingleObject+0xbb
ffffd60e`149dbaa0 fffff801`2fc27b78 : ffffd70f`835d6080 00000000`15a55f64 00000000`00000000 00000000`00000000 : nt!NtWaitForSingleObject+0x6a
ffffd60e`149dbae0 00000000`77101cf3 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`0f77ede8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77101cf3
SYMBOL_NAME: nt!KiSwapThread+67c
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.22000.318
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 67c
FAILURE_BUCKET_ID: AV_nt!KiSwapThread
OS_VERSION: 10.0.22000.1
BUILDLAB_STR: co_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3a5eca23-a992-0c0e-a0ce-d48add0d8eda}
Followup: MachineOwner
---------
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
BugCheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->CombinedApcDisable field. This consists of two separate 16-bit
fields, the SpecialApcDisable and the KernelApcDisable. A negative value
of either indicates that a driver has disabled special or normal APCs
(respectively) without re-enabling them; a positive value indicates that
a driver has enabled special or normal APCs (respectively) too many times.
Arguments:
Arg1: 00007ffdef3f10e4, Address of system call function or worker routine
Arg2: 0000000000000000, Thread->ApcStateIndex
Arg3: 000000000000ffff, (Thread->SpecialApcDisable << 16) | Thread->KernelApcDisable
Arg4: ffff8385d8b54b80, Call type (0 - system call, 1 - worker routine)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2843
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 8681
Key : Analysis.Init.CPU.mSec
Value: 827
Key : Analysis.Init.Elapsed.mSec
Value: 15547
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 110821-6437-01.dmp
BUGCHECK_CODE: 1
BUGCHECK_P1: 7ffdef3f10e4
BUGCHECK_P2: 0
BUGCHECK_P3: ffff
BUGCHECK_P4: ffff8385d8b54b80
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: SystemSettings.exe
STACK_TEXT:
ffff8385`d8b549b8 fffff800`57009269 : 00000000`00000001 00007ffd`ef3f10e4 00000000`00000000 00000000`0000ffff : nt!KeBugCheckEx
ffff8385`d8b549c0 fffff800`57009133 : ffffb68e`e4429080 ffffb68e`e41216e0 00000000`00000000 ffff8385`d8b54b80 : nt!KiBugCheckDispatch+0x69
ffff8385`d8b54b00 00007ffd`ef3f10e4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExitPico+0x1fe
00000059`51dfef58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`ef3f10e4
SYMBOL_NAME: nt!KiSystemServiceExitPico+1fe
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1320
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 1fe
FAILURE_BUCKET_ID: 0x1_SysCallNum_1005_nt!KiSystemServiceExitPico
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {81b04e06-366b-1c90-6ba2-1eda92239af7}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffab0bc36b57d0, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffffab0bc36b5728, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2983
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 12443
Key : Analysis.Init.CPU.mSec
Value: 639
Key : Analysis.Init.Elapsed.mSec
Value: 10100
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 110621-6765-01.dmp
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffab0bc36b57d0
BUGCHECK_P3: ffffab0bc36b5728
BUGCHECK_P4: 0
TRAP_FRAME: ffffab0bc36b57d0 -- (.trap 0xffffab0bc36b57d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80071df85a8 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffe4017d95c1a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80076671885 rsp=ffffab0bc36b5960 rbp=0000000000000047
r8=0000000000000001 r9=ffffab0bc36b5a58 r10=fffff80071df5ac0
r11=0000000069205064 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!KiRemoveEntryTimer+0x14a3d5:
fffff800`76671885 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffab0bc36b5728 -- (.exr 0xffffab0bc36b5728)
ExceptionAddress: fffff80076671885 (nt!KiRemoveEntryTimer+0x000000000014a3d5)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffab0b`c36b54a8 fffff800`76609269 : 00000000`00000139 00000000`00000003 ffffab0b`c36b57d0 ffffab0b`c36b5728 : nt!KeBugCheckEx
ffffab0b`c36b54b0 fffff800`76609690 : 00000000`00040046 fffff800`7641963e 00000000`00000000 fffff800`76540fed : nt!KiBugCheckDispatch+0x69
ffffab0b`c36b55f0 fffff800`76607a23 : 00000000`00000000 00000000`00989680 00000000`00000002 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffab0b`c36b57d0 fffff800`76671885 : ffffe401`770c0010 00000000`69204afd ffffffff`00000001 ffffe401`770c01f8 : nt!KiRaiseSecurityCheckFailure+0x323
ffffab0b`c36b5960 fffff800`76499a7a : 00000000`00000000 00000000`00000000 00000000`00140001 ffffab0b`c36b5a58 : nt!KiRemoveEntryTimer+0x14a3d5
ffffab0b`c36b59d0 fffff800`765fae0e : ffffffff`00000000 ffffc401`201c4180 ffffc401`201cf340 ffffe401`7c260040 : nt!KiRetireDpcList+0x73a
ffffab0b`c36b5c60 00000000`00000000 : ffffab0b`c36b6000 ffffab0b`c36b0000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e
SYMBOL_NAME: nt!KiRemoveEntryTimer+14a3d5
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1320
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 14a3d5
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiRemoveEntryTimer
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {5cf1a79f-75db-1c81-82ec-116a11522249}
Followup: MachineOwner
---------
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: fffff80383d05330, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding this single DPC timeout
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for rt640x64.sys
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: TickPeriods ***
*** ***
*************************************************************************
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 7077
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 28352
Key : Analysis.Init.CPU.mSec
Value: 937
Key : Analysis.Init.Elapsed.mSec
Value: 15144
Key : Analysis.Memory.CommitPeak.Mb
Value: 102
Key : WER.OS.Branch
Value: co_release
Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z
Key : WER.OS.Version
Value: 10.0.22000.1
FILE_IN_CAB: 112421-6578-01.dmp
BUGCHECK_CODE: 133
BUGCHECK_P1: 0
BUGCHECK_P2: 501
BUGCHECK_P3: 500
BUGCHECK_P4: fffff80383d05330
DPC_TIMEOUT_TYPE: SINGLE_DPC_TIMEOUT_EXCEEDED
TRAP_FRAME: fffff904ace51170 -- (.trap 0xfffff904ace51170)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000003bdd14ff rbx=0000000000000000 rcx=fffff904ace513f0
rdx=ffffba01489dc180 rsi=0000000000000000 rdi=0000000000000000
rip=fffff803833574dc rsp=fffff904ace51300 rbp=fffff904ace513b0
r8=0000000000000000 r9=fffff80383cf8940 r10=0000000000000000
r11=0000000000000006 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KeYieldProcessorEx+0x1c:
fffff803`833574dc 4883c420 add rsp,20h
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
ffffba01`48b7add8 fffff803`832db5de : 00000000`00000133 00000000`00000000 00000000`00000501 00000000`00000500 : nt!KeBugCheckEx
ffffba01`48b7ade0 fffff803`832db061 : 00005b36`6f6bd6f3 ffffba01`00000500 00000000`00000002 fffff803`832d67ee : nt!KeAccumulateTicks+0x39e
ffffba01`48b7ae50 fffff803`832d924a : ffffba01`48b69200 fffff904`ace51170 ffffba01`48b693b0 fffff803`83213ccb : nt!KiUpdateRunTime+0x61
ffffba01`48b7aeb0 fffff803`832d9036 : ffff888f`283069a0 ffff888f`28306a50 fffff904`00000002 ffff888f`2f3766c0 : nt!KeClockInterruptNotify+0x11a
ffffba01`48b7af40 fffff803`8328d6a0 : ffff888f`283069a0 fffff803`8333817c ffffba01`00000000 00000000`00000000 : nt!HalpTimerClockIpiRoutine+0x16
ffffba01`48b7af70 fffff803`8341719a : fffff904`ace511f0 ffff888f`283069a0 00000000`00000000 00000000`00000000 : nt!KiCallInterruptServiceRoutine+0xa0
ffffba01`48b7afb0 fffff803`83417767 : 00000000`00000050 fffff904`ace51261 ffffba01`48b60180 fffff803`83417774 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
fffff904`ace51170 fffff803`833574dc : 00000000`00000010 00000000`00000282 fffff904`ace51328 00000000`00000018 : nt!KiInterruptDispatchNoLockNoEtw+0x37
fffff904`ace51300 fffff803`8344ee89 : 00000000`000006a0 fffff904`ace513b0 fffff803`83cf8940 ffff888f`3308c290 : nt!KeYieldProcessorEx+0x1c
fffff904`ace51330 fffff803`8343e6e9 : 00000000`3bdd14ff ffff888f`322d5040 ffff888f`00000036 00000000`00000000 : nt!KiHeteroChooseTargetProcessor+0x1d3
fffff904`ace513f0 fffff803`8332f8f7 : ffffba01`48b60180 00000000`00000000 fffff904`ace51590 00000000`00000000 : nt!KiDeferredReadySingleThread+0x1712e9
fffff904`ace514e0 fffff803`8332ed7f : 00000000`00000000 ffff888f`00000000 00000000`00000001 00000000`00000000 : nt!KiExitDispatcher+0x167
fffff904`ace51590 fffff803`943e50cd : 00000000`00000000 ffff888f`31d38700 fffff803`832180a0 ffff888f`322d5180 : nt!KeSetEvent+0xdf
fffff904`ace51620 fffff803`943e4afe : 00000000`00000084 00000000`00000004 ffff888f`321f2430 ffff888f`35a6a040 : Ndu!NduQueueWorkItemForProcessEnergyData+0xcd
fffff904`ace51670 fffff803`943e41d5 : ffff888f`31d38700 00000002`00000004 ffff888f`321a7b78 ffff888f`00000001 : Ndu!NduUpdateInterfacePowerContext+0x39e
fffff904`ace51730 fffff803`943e3ec0 : 00000000`00000002 00000000`00000000 ffff888f`00000000 fffff803`00000036 : Ndu!NduHandleNblContextRemoved+0x235
fffff904`ace51800 fffff803`88721210 : fffff904`ace518d9 ffff888f`3308c290 00000000`00000000 00000002`00000000 : Ndu!NduNblNotifyCallback+0x140
fffff904`ace51860 fffff803`8840bede : ffff888f`33193c30 00000000`00000000 fffff904`ace519c9 ffff888f`00000000 : fwpkclnt!FwppNetBufferListEventNotify+0xd0
fffff904`ace51940 fffff803`88322722 : ffff888f`31750f80 00000000`00000001 00000000`00000000 00000000`00000000 : tcpip!WfppTaggedContextFree+0x1e
fffff904`ace51970 fffff803`88185380 : ffff888f`33193c30 00000000`00000000 ffff888f`33193c30 00000000`00000000 : NETIO!WfpNblInfoCleanup+0x52
fffff904`ace519b0 fffff803`88321730 : 00000000`00000000 00000000`00000000 ffff888f`33193db0 00000000`00000000 : ndis!NdisFreeNetBufferList+0x130
fffff904`ace519f0 fffff803`8840733d : 00000000`00000000 fffff803`8840bede ffff888f`33193c30 00000000`00000000 : NETIO!NetioFreeNetBufferAndNetBufferList+0x10
fffff904`ace51a20 fffff803`8831f016 : 00000000`00000000 00000000`00000001 00000000`00000001 00000000`00000000 : tcpip!TcpSendDatagramsComplete+0xbd
fffff904`ace51a60 fffff803`88403db7 : 00000000`00000000 00000000`00000001 ffff888f`33193c30 fffff803`939fda10 : NETIO!NetioDereferenceNetBufferListChain+0x106
fffff904`ace51ae0 fffff803`8818229b : 00000000`00000000 fffff904`ace51b89 00000000`00000001 fffff803`939f705b : tcpip!FlSendNetBufferListChainComplete+0x67
fffff904`ace51b10 fffff803`881838c1 : 00000000`00000000 ffff888f`33193c01 00000000`00000001 ffff888f`2d0ec102 : ndis!ndisMSendCompleteNetBufferListsInternal+0x12b
fffff904`ace51bf0 fffff803`9400848b : fffff803`00000004 00000000`00000001 ffff888f`33193c30 ffff888f`2d418000 : ndis!NdisMSendNetBufferListsComplete+0x281
fffff904`ace51c90 fffff803`00000004 : 00000000`00000001 ffff888f`33193c30 ffff888f`2d418000 00000000`00000001 : rt640x64+0x848b
fffff904`ace51c98 00000000`00000001 : ffff888f`33193c30 ffff888f`2d418000 00000000`00000001 00000000`00000004 : 0xfffff803`00000004
fffff904`ace51ca0 ffff888f`33193c30 : ffff888f`2d418000 00000000`00000001 00000000`00000004 ffff888f`33193c30 : 0x1
fffff904`ace51ca8 ffff888f`2d418000 : 00000000`00000001 00000000`00000004 ffff888f`33193c30 00000000`00000001 : 0xffff888f`33193c30
fffff904`ace51cb0 00000000`00000001 : 00000000`00000004 ffff888f`33193c30 00000000`00000001 ffff888f`2d0ea570 : 0xffff888f`2d418000
fffff904`ace51cb8 00000000`00000004 : ffff888f`33193c30 00000000`00000001 ffff888f`2d0ea570 fffff803`94007b10 : 0x1
fffff904`ace51cc0 ffff888f`33193c30 : 00000000`00000001 ffff888f`2d0ea570 fffff803`94007b10 ffff888f`33193c30 : 0x4
fffff904`ace51cc8 00000000`00000001 : ffff888f`2d0ea570 fffff803`94007b10 ffff888f`33193c30 fffff803`94007bec : 0xffff888f`33193c30
fffff904`ace51cd0 ffff888f`2d0ea570 : fffff803`94007b10 ffff888f`33193c30 fffff803`94007bec ffff888f`2d418000 : 0x1
fffff904`ace51cd8 fffff803`94007b10 : ffff888f`33193c30 fffff803`94007bec ffff888f`2d418000 00000000`00000000 : 0xffff888f`2d0ea570
fffff904`ace51ce0 ffff888f`33193c30 : fffff803`94007bec ffff888f`2d418000 00000000`00000000 00000000`00000001 : rt640x64+0x7b10
fffff904`ace51ce8 fffff803`94007bec : ffff888f`2d418000 00000000`00000000 00000000`00000001 ffff888f`33193c01 : 0xffff888f`33193c30
fffff904`ace51cf0 ffff888f`2d418000 : 00000000`00000000 00000000`00000001 ffff888f`33193c01 00000000`00000000 : rt640x64+0x7bec
fffff904`ace51cf8 00000000`00000000 : 00000000`00000001 ffff888f`33193c01 00000000`00000000 00000000`00000000 : 0xffff888f`2d418000
SYMBOL_NAME: Ndu!NduQueueWorkItemForProcessEnergyData+cd
MODULE_NAME: Ndu
IMAGE_NAME: Ndu.sys
IMAGE_VERSION: 10.0.22000.5
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: cd
FAILURE_BUCKET_ID: 0x133_DPC_Ndu!NduQueueWorkItemForProcessEnergyData
OS_VERSION: 10.0.22000.1
BUILDLAB_STR: co_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {a728f53c-95fa-01ac-4584-5d2c9eebc2e4}
Followup: MachineOwner
---------
4: kd> lmvm Ndu
Browse full module list
start end module name
fffff803`943e0000 fffff803`94408000 Ndu # (pdb symbols) C:\ProgramData\Dbg\sym\ndu.pdb\A0C55082A719AD8E73B66807451B15C91\ndu.pdb
Loaded symbol image file: Ndu.sys
Mapped memory image file: C:\ProgramData\Dbg\sym\Ndu.sys\24EB76BF28000\Ndu.sys
Image path: \SystemRoot\system32\drivers\Ndu.sys
Image name: Ndu.sys
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 24EB76BF (This is a reproducible build file hash, not a timestamp)
CheckSum: 00032E65
ImageSize: 00028000
File version: 10.0.22000.5
Product version: 10.0.22000.5
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.6 Driver
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ndu.sys
OriginalFilename: ndu.sys
ProductVersion: 10.0.22000.5
FileVersion: 10.0.22000.5 (WinBuild.160101.0800)
FileDescription: Windows Network Data Usage Monitoring Driver
LegalCopyright: © Microsoft Corporation. All rights reserved.
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 5233
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 17082
Key : Analysis.Init.CPU.mSec
Value: 906
Key : Analysis.Init.Elapsed.mSec
Value: 19944
Key : Analysis.Memory.CommitPeak.Mb
Value: 78
Key : WER.OS.Branch
Value: co_release
Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z
Key : WER.OS.Version
Value: 10.0.22000.1
FILE_IN_CAB: 112221-8703-01.dmp
BUGCHECK_CODE: d1
BUGCHECK_P1: 0
BUGCHECK_P2: 2
BUGCHECK_P3: 8
BUGCHECK_P4: 0
READ_ADDRESS: fffff80472105450: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000000
PROCESS_NAME: System
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
TRAP_FRAME: ffff8602642c9220 -- (.trap 0xffff8602642c9220)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe083f595c200 rbx=0000000000000000 rcx=ffffe083f595c740
rdx=ffffac7cde16022a rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000000 rsp=ffff8602642c93b0 rbp=000000000000002a
r8=0000000000000006 r9=0000000000000000 r10=fffff804751d22e0
r11=ffffe083f595c736 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
00000000`00000000 ?? ???
Resetting default scope
IP_IN_FREE_BLOCK: 0
FAILED_INSTRUCTION_ADDRESS:
+0
STACK_TEXT:
ffff8602`642c90d8 fffff804`718281a9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
ffff8602`642c90e0 fffff804`71824300 : 00000000`00000000 0000bb01`5de90002 00000000`00000011 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffff8602`642c9220 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x440
SYMBOL_NAME: nt!KiPageFault+440
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.22000.318
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 440
FAILURE_BUCKET_ID: AV_CODE_AV_NULL_IP_nt!KiPageFault
OS_VERSION: 10.0.22000.1
BUILDLAB_STR: co_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {4ce35ff9-c5cf-d66d-0323-0f05e33f6692}
Followup: MachineOwner
---------
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000001, The system cumulatively spent an extended period of time at
DISPATCH_LEVEL or above. The offending component can usually be
identified with a stack trace.
Arg2: 0000000000001e00, The watchdog period.
Arg3: fffff8003a105330, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding the cumulative timeout
Arg4: 0000000000000000
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: TickPeriods ***
*** ***
*************************************************************************
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 5734
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 23957
Key : Analysis.Init.CPU.mSec
Value: 999
Key : Analysis.Init.Elapsed.mSec
Value: 11418
Key : Analysis.Memory.CommitPeak.Mb
Value: 99
Key : WER.OS.Branch
Value: co_release
Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z
Key : WER.OS.Version
Value: 10.0.22000.1
FILE_IN_CAB: 112421-6609-01.dmp
BUGCHECK_CODE: 133
BUGCHECK_P1: 1
BUGCHECK_P2: 1e00
BUGCHECK_P3: fffff8003a105330
BUGCHECK_P4: 0
DPC_TIMEOUT_TYPE: DPC_QUEUE_EXECUTION_TIMEOUT_EXCEEDED
TRAP_FRAME: ffffb085c5ca6b10 -- (.trap 0xffffb085c5ca6b10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000006ea7fbb0 rbx=0000000000000000 rcx=ffffb085c5ca6d90
rdx=ffff8200174c0180 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800397574dc rsp=ffffb085c5ca6ca0 rbp=ffffb085c5ca6d50
r8=0000000000000000 r9=fffff8003a0f8940 r10=0000000000000001
r11=0000000000000005 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!KeYieldProcessorEx+0x1c:
fffff800`397574dc 4883c420 add rsp,20h
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: msedge.exe
STACK_TEXT:
fffff800`362ba9e8 fffff800`396db44f : 00000000`00000133 00000000`00000001 00000000`00001e00 fffff800`3a105330 : nt!KeBugCheckEx
fffff800`362ba9f0 fffff800`396db061 : 00006737`2b13c020 fffff800`4b3c870a ffff55ec`9f3eff52 fffff800`3963d1f0 : nt!KeAccumulateTicks+0x20f
fffff800`362baa60 fffff800`396d8096 : 00000000`001ed33e 00000000`00125f8c 00000049`7e3004f1 00000000`00000000 : nt!KiUpdateRunTime+0x61
fffff800`362baac0 fffff800`396d93a2 : ffffb085`c5ca6b10 00000000`00000000 fffff800`3a02b440 00000000`00000000 : nt!KiUpdateTime+0x686
fffff800`362baeb0 fffff800`396d6cd2 : ffffb085`c5ca6b10 fffff800`3a0f7d60 fffff800`00000000 00000000`00000002 : nt!KeClockInterruptNotify+0x272
fffff800`362baf40 fffff800`3968d6a0 : 00000049`7e514fb0 fffff800`3a0f7cb0 ffff8200`171fa1f0 00000000`00000000 : nt!HalpTimerClockInterrupt+0xe2
fffff800`362baf70 fffff800`3981719a : ffffb085`c5ca6b90 fffff800`3a0f7cb0 000066f4`e66ce9f4 ffffc303`f6a62500 : nt!KiCallInterruptServiceRoutine+0xa0
fffff800`362bafb0 fffff800`39817767 : ffffb085`c5ca6d90 ffff71fe`a5600000 fffff800`396bd1e0 fffff800`398177f4 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
ffffb085`c5ca6b10 fffff800`397574dc : 00000000`00000010 00000000`00040286 ffffb085`c5ca6cc8 00000000`00000018 : nt!KiInterruptDispatchNoLockNoEtw+0x37
ffffb085`c5ca6ca0 fffff800`3984ee89 : 00000000`000005f2 ffffb085`c5ca6d50 fffff800`3a0f8940 fffff800`39b6d6be : nt!KeYieldProcessorEx+0x1c
ffffb085`c5ca6cd0 fffff800`3983e6e9 : 00000000`6ea7fbb0 ffffc303`f6a62540 00000000`00000000 00000000`00000000 : nt!KiHeteroChooseTargetProcessor+0x1d3
ffffb085`c5ca6d90 fffff800`3972f8f7 : fffff800`3602c180 ffffc303`f0fd5c00 ffffb085`c5ca6f30 ffffb085`c5ca6e98 : nt!KiDeferredReadySingleThread+0x1712e9
ffffb085`c5ca6e80 fffff800`3972f659 : 00000000`00000000 ffffefcb`00000000 00000000`00000002 00000000`0000000e : nt!KiExitDispatcher+0x167
ffffb085`c5ca6f30 fffff800`3972df2c : ffffc303`00000000 ffffb085`c5ca7b60 ffffef8e`4221a620 ffff71fe`0000000d : nt!ExpReleaseResourceExclusiveForThreadLite+0x439
ffffb085`c5ca7000 ffffefcb`40243fab : 00000000`00000000 ffffef8e`4221a620 ffffef8e`40602080 ffffef8e`4221a620 : nt!ExReleaseResourceAndLeaveCriticalRegion+0x7c
ffffb085`c5ca7060 ffffefcb`40572451 : 00000000`00000000 ffffef8e`424854d0 ffffef8e`4221a620 ffffef8e`4221a620 : win32kbase!UserSessionSwitchLeaveCrit+0xeb
ffffb085`c5ca70f0 ffffefcb`40a5741f : ffffb085`c5ca7a88 00000000`00000000 00000000`ffffffff ffffefcb`00001cff : win32kfull!NtUserMsgWaitForMultipleObjectsEx+0x511
ffffb085`c5ca7a30 fffff800`39827b78 : 00000000`00000000 00000000`00000001 ffffd067`eef752d2 000045aa`0012a8d8 : win32k!NtUserMsgWaitForMultipleObjectsEx+0x1f
ffffb085`c5ca7a70 00007ffc`e334abf4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000067`40bff508 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`e334abf4
SYMBOL_NAME: win32kbase!UserSessionSwitchLeaveCrit+eb
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
IMAGE_VERSION: 10.0.22000.318
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: eb
FAILURE_BUCKET_ID: 0x133_ISR_win32kbase!UserSessionSwitchLeaveCrit
OS_VERSION: 10.0.22000.1
BUILDLAB_STR: co_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {45dff02b-c8c1-2655-6948-3e31cf8b8d1c}
Followup: MachineOwner
---------
KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE (162)
A lock tracked by AutoBoost was released by a thread that did not own the lock.
This is typically caused when some thread releases a lock on behalf of another
thread (which is not legal with AutoBoost tracking enabled) or when some thread
tries to release a lock it no longer owns.
Arguments:
Arg1: ffffb208d5994080, The address of the thread
Arg2: ffffb208ca69f590, The lock address
Arg3: 00000000ffffffff, The session ID of the thread
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3952
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 14626
Key : Analysis.Init.CPU.mSec
Value: 655
Key : Analysis.Init.Elapsed.mSec
Value: 10422
Key : Analysis.Memory.CommitPeak.Mb
Value: 75
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 110921-9062-01.dmp
BUGCHECK_CODE: 162
BUGCHECK_P1: ffffb208d5994080
BUGCHECK_P2: ffffb208ca69f590
BUGCHECK_P3: ffffffff
BUGCHECK_P4: 0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: MsMpEng.exe
STACK_TEXT:
ffffee81`cccca5d8 fffff802`1d4175bd : 00000000`00000162 ffffb208`d5994080 ffffb208`ca69f590 00000000`ffffffff : nt!KeBugCheckEx
ffffee81`cccca5e0 fffff802`1a335e8d : 00000000`00000000 00000000`00000000 ffffb208`00000000 ffffb208`ce131390 : nt!ExReleaseCacheAwarePushLockSharedEx+0x20fedd
ffffee81`cccca630 fffff802`0001006b : 00000000`00000000 ffffb208`0000000c ffffb208`e1312800 00000000`00000000 : FLTMGR!FltpPerformPreCallbacksWorker+0x1dd
ffffee81`cccca750 00000000`00000000 : ffffb208`0000000c ffffb208`e1312800 00000000`00000000 00000000`00000000 : 0xfffff802`0001006b
SYMBOL_NAME: nt!ExReleaseCacheAwarePushLockSharedEx+20fedd
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1320
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 20fedd
FAILURE_BUCKET_ID: 0x162_nt!ExReleaseCacheAwarePushLockSharedEx
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {0408c3fa-e7d6-0235-af08-41350148000b}
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the BugCheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff807602191b0, Virtual address for the attempted write.
Arg2: 0a00000002a001a1, PTE contents.
Arg3: ffff8f015aefddd0, (reserved)
Arg4: 000000000000000f, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3375
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 14046
Key : Analysis.Init.CPU.mSec
Value: 999
Key : Analysis.Init.Elapsed.mSec
Value: 9866
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 110821-6406-01.dmp
BUGCHECK_CODE: be
BUGCHECK_P1: fffff807602191b0
BUGCHECK_P2: a00000002a001a1
BUGCHECK_P3: ffff8f015aefddd0
BUGCHECK_P4: f
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
TRAP_FRAME: ffff8f015aefddd0 -- (.trap 0xffff8f015aefddd0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000039b6c9fe285a rbx=0000000000000000 rcx=0000000000000c84
rdx=00000000000002f0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff807602de0d2 rsp=ffff8f015aefdf60 rbp=0000000000000001
r8=0000000000000400 r9=0000000000000000 r10=0000000000000fff
r11=ffff8f015aefdef0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KiCallInterruptServiceRoutine+0x122:
fffff807`602de0d2 4c89b7902d0000 mov qword ptr [rdi+2D90h],r14 ds:00000000`00002d90=????????????????
Resetting default scope
STACK_TEXT:
ffff8f01`5aefdbd8 fffff807`60475828 : 00000000`000000be fffff807`602191b0 0a000000`02a001a1 ffff8f01`5aefddd0 : nt!KeBugCheckEx
ffff8f01`5aefdbe0 fffff807`6029f47f : 00000000`00000001 00000000`00000003 ffff8f01`5aefde50 00000000`00000000 : nt!MiRaisedIrqlFault+0x14264c
ffff8f01`5aefdc30 fffff807`6040545e : 00000000`00000000 00000000`00000ff0 ffffd68e`49cf3100 ffff6bb7`ec1170e9 : nt!MmAccessFault+0x4ef
ffff8f01`5aefddd0 fffff807`602de0d2 : ffffd68e`49b049a0 00000000`00000000 00000000`00000000 ffff6bb7`ec1173a9 : nt!KiPageFault+0x35e
ffff8f01`5aefdf60 fffff807`603f8d4a : fffffb8d`e9395b80 ffffd68e`49b049a0 00000000`0007bc00 00000000`00000000 : nt!KiCallInterruptServiceRoutine+0x122
ffff8f01`5aefdfb0 fffff807`603f92b7 : ffffd68e`56b88080 00000000`00000000 00000000`00000000 ffffd68e`00000000 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
fffffb8d`e9395b00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatchNoLockNoEtw+0x37
SYMBOL_NAME: nt!MiRaisedIrqlFault+14264c
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.1320
STACK_COMMAND: .cxr; .ecxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 14264c
FAILURE_BUCKET_ID: 0xBE_nt!MiRaisedIrqlFault
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {1c5b4d11-09e0-def3-d2d0-70a11d69b92d}
Followup: MachineOwner
---------
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff8014492c0ff, Address of the instruction which caused the BugCheck
Arg3: ffffec0d7180c9b0, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3906
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 18794
Key : Analysis.Init.CPU.mSec
Value: 718
Key : Analysis.Init.Elapsed.mSec
Value: 11230
Key : Analysis.Memory.CommitPeak.Mb
Value: 75
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 111021-8796-01.dmp
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff8014492c0ff
BUGCHECK_P3: ffffec0d7180c9b0
BUGCHECK_P4: 0
CONTEXT: ffffec0d7180c9b0 -- (.cxr 0xffffec0d7180c9b0)
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=ffffec0d7180d3e0 rsi=ffffd78681c96900 rdi=ffffd786729edd60
rip=fffff8014492c0ff rsp=ffffec0d7180d3b0 rbp=ffffec0d7180d3f9
r8=0000000000000000 r9=00000000000000c4 r10=fffff80147677f30
r11=ffff917843600000 r12=ffffd7868277a440 r13=ffffd78681c96988
r14=ffffd7868277a010 r15=ffffd78681c96930
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050246
FLTMGR!FltpCreate+0x19f:
fffff801`4492c0ff 418b5030 mov edx,dword ptr [r8+30h] ds:002b:00000000`00000030=????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: ShellExperienceHost.exe
STACK_TEXT:
ffffec0d`7180d3b0 fffff801`4728f6f5 : 00000000`00000000 ffffd786`72a3d8f0 00000000`00000000 00000000`00000000 : FLTMGR!FltpCreate+0x19f
ffffec0d`7180d460 fffff801`47290ce4 : 00000000`00000003 ffffd786`8277a010 ffffd786`6d4e6f49 fffff801`47290913 : nt!IofCallDriver+0x55
ffffec0d`7180d4a0 fffff801`4767717d : ffffec0d`7180d760 ffffd786`72a3d8f0 ffffd786`81c969c8 00000000`00000000 : nt!IoCallDriverWithTracing+0x34
ffffec0d`7180d4f0 fffff801`475f23ee : ffffd786`72a3d8f0 00000000`000000d8 ffffd786`817a8010 ffffd786`817a8001 : nt!IopParseDevice+0x117d
ffffec0d`7180d660 fffff801`476948aa : ffffd786`817a8001 ffffec0d`7180d8c8 ffffec0d`00000040 ffffd786`6c8f4380 : nt!ObpLookupObjectName+0x3fe
ffffec0d`7180d830 fffff801`4761608f : 00000000`00000000 0000008e`e77fccc8 00000000`00000000 00000000`00000001 : nt!ObOpenObjectByNameEx+0x1fa
ffffec0d`7180d960 fffff801`47615c69 : 0000008e`e77fcc88 00000000`00000000 0000008e`e77fccc8 0000008e`e77fcc90 : nt!IopCreateFile+0x40f
ffffec0d`7180da00 fffff801`47408cb8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateFile+0x79
ffffec0d`7180da90 00007ffc`b3bcd814 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000008e`e77fcc08 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`b3bcd814
SYMBOL_NAME: FLTMGR!FltpCreate+19f
MODULE_NAME: FLTMGR
IMAGE_NAME: FLTMGR.SYS
IMAGE_VERSION: 10.0.19041.1165
STACK_COMMAND: .cxr 0xffffec0d7180c9b0 ; kb
BUCKET_ID_FUNC_OFFSET: 19f
FAILURE_BUCKET_ID: 0x3B_c0000005_FLTMGR!FltpCreate
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {8330fc8a-bcb4-9702-e2b5-42a3a2817933}
Followup: MachineOwner
---------
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000001, The system cumulatively spent an extended period of time at
DISPATCH_LEVEL or above. The offending component can usually be
identified with a stack trace.
Arg2: 0000000000001e00, The watchdog period.
Arg3: fffff80482d05330, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding the cumulative timeout
Arg4: 0000000000000000
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: TickPeriods ***
*** ***
*************************************************************************
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4562
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 19680
Key : Analysis.Init.CPU.mSec
Value: 1030
Key : Analysis.Init.Elapsed.mSec
Value: 17292
Key : Analysis.Memory.CommitPeak.Mb
Value: 78
Key : WER.OS.Branch
Value: co_release
Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z
Key : WER.OS.Version
Value: 10.0.22000.1
FILE_IN_CAB: 112221-7562-01.dmp
BUGCHECK_CODE: 133
BUGCHECK_P1: 1
BUGCHECK_P2: 1e00
BUGCHECK_P3: fffff80482d05330
BUGCHECK_P4: 0
DPC_TIMEOUT_TYPE: DPC_QUEUE_EXECUTION_TIMEOUT_EXCEEDED
TRAP_FRAME: ffffd6014bf805b0 -- (.trap 0xffffd6014bf805b0)
Unable to read trap frame at ffffd601`4bf805b0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
ffffc601`133ebdd8 fffff804`822db44f : 00000000`00000133 00000000`00000001 00000000`00001e00 fffff804`82d05330 : nt!KeBugCheckEx
ffffc601`133ebde0 fffff804`822db061 : 0000905b`e99164a2 ffffc601`13380180 fffff804`8236e050 fffff804`822d67ee : nt!KeAccumulateTicks+0x20f
ffffc601`133ebe50 fffff804`822d924a : ffffc601`13389200 ffffd601`4bf805b0 ffffc601`13389450 fffff804`82213ccb : nt!KiUpdateRunTime+0x61
ffffc601`133ebeb0 fffff804`822d9036 : ffffa488`cdf29780 ffffa488`cdf29830 0000028a`00000000 00000000`00000000 : nt!KeClockInterruptNotify+0x11a
ffffc601`133ebf40 fffff804`8228d6a0 : ffffa488`cdf29780 fffff804`8233817c 000001b4`00000000 000001b4`814269d0 : nt!HalpTimerClockIpiRoutine+0x16
ffffc601`133ebf70 fffff804`8241719a : ffffd601`4bf80630 ffffa488`cdf29780 00000000`00000000 00000000`00000000 : nt!KiCallInterruptServiceRoutine+0xa0
ffffc601`133ebfb0 fffff804`82417767 : 00000000`00000000 00000000`00000000 ffffc601`13380180 fffff804`82417774 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
ffffd601`4bf805b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatchNoLockNoEtw+0x37
SYMBOL_NAME: nt!KeAccumulateTicks+20f
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.22000.318
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 20f
FAILURE_BUCKET_ID: 0x133_ISR_nt!KeAccumulateTicks
OS_VERSION: 10.0.22000.1
BUILDLAB_STR: co_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {65350307-c3b9-f4b5-8829-4d27e9ff9b06}
Followup: MachineOwner
---------
drive.google.com
