KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000008, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ExceptionRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ContextRecord ***
*** ***
*************************************************************************
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 12937
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 53570
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 1e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: 0
BUGCHECK_P3: 8
BUGCHECK_P4: 0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 2
PROCESS_NAME: csrss.exe
TRAP_FRAME: ffff800000000000 -- (.trap 0xffff800000000000)
Unable to read trap frame at ffff8000`00000000
STACK_TEXT:
fffffe8f`f38b0678 fffff806`29c9128d : 00000000`0000001e ffffffff`c0000005 00000000`00000000 00000000`00000008 : nt!KeBugCheckEx
fffffe8f`f38b0680 fffff806`29c078ac : 00000000`00001000 fffffe8f`f38b0f20 ffff8000`00000000 00000000`00000000 : nt!KiDispatchException+0x16688d
fffffe8f`f38b0d40 fffff806`29c03a43 : ffffee69`998b8ef0 ffff8d86`7d1950c8 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0x12c
fffffe8f`f38b0f20 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x443
SYMBOL_NAME: nt!KiDispatchException+16688d
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.685
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 16688d
FAILURE_BUCKET_ID: 0x1E_nt!KiDispatchException
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {4c003660-11e1-3fb7-2474-3522eb7ee67b}
Followup: MachineOwner
---------
KERNEL_AUTO_BOOST_LOCK_ACQUISITION_WITH_RAISED_IRQL (192)
A lock tracked by AutoBoost was acquired while executing at DISPATCH_LEVEL or
above.
Arguments:
Arg1: ffff96046f170080, The address of the thread.
Arg2: ffff96046f248748, The lock address.
Arg3: 0000000000000000, The IRQL at which the lock was acquired.
Arg4: 0000000000000000, Reserved.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4983
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 8488
Key : Analysis.Memory.CommitPeak.Mb
Value: 75
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 192
BUGCHECK_P1: ffff96046f170080
BUGCHECK_P2: ffff96046f248748
BUGCHECK_P3: 0
BUGCHECK_P4: 0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: MicrosoftEdgeUpdate.exe
STACK_TEXT:
ffffec8c`a494d7d8 fffff804`3c460ce2 : 00000000`00000192 ffff9604`6f170080 ffff9604`6f248748 00000000`00000000 : nt!KeBugCheckEx
ffffec8c`a494d7e0 fffff804`3c4675c5 : ffffec8c`a494d860 ffffec8c`a494da20 00000000`00000000 ffffc38d`b296c400 : nt!ExAcquirePushLockSharedEx+0x142
ffffec8c`a494d830 fffff804`3c82cb75 : ffffec8c`a494d990 00000000`00000004 00000000`74c6bfff ffff9604`6f248280 : nt!MiObtainReferencedVadEx+0x55
ffffec8c`a494d870 fffff804`3c7ed89f : ffff9604`6f248280 ffff9604`6f248280 ffffec8c`a494d9e8 ffffec8c`a494d9f8 : nt!MmProtectVirtualMemory+0x175
ffffec8c`a494d9a0 fffff804`3c6071b8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000004 : nt!NtProtectVirtualMemory+0x1bf
ffffec8c`a494da90 00007ffd`93d0c9b4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`0144e2c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`93d0c9b4
SYMBOL_NAME: nt!ExAcquirePushLockSharedEx+142
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.685
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 142
FAILURE_BUCKET_ID: 0x192_nt!ExAcquirePushLockSharedEx
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {292e4563-5d10-0ceb-86fc-152da5e999ce}
Followup: MachineOwner
---------
KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION (157)
An illegal operation was attempted on the priority floor of a particular
thread.
Arguments:
Arg1: ffff880462b7e080, The address of the thread
Arg2: 0000000000000008, The target priority value
Arg3: 0000000000000002, The priority counter for the target priority underflowed
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32kfull.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6780
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 31494
Key : Analysis.Memory.CommitPeak.Mb
Value: 79
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 157
BUGCHECK_P1: ffff880462b7e080
BUGCHECK_P2: 8
BUGCHECK_P3: 2
BUGCHECK_P4: 0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: winlogon.exe
STACK_TEXT:
ffff8606`348bca08 fffff804`59e6898e : 00000000`00000157 ffff8804`62b7e080 00000000`00000008 00000000`00000002 : nt!KeBugCheckEx
ffff8606`348bca10 fffff804`59c60dad : ffff8606`348bcb00 00000000`00000000 00000000`00000007 ffff8804`00000000 : nt!KiAbThreadUnboostCpuPriority+0x1649fa
ffff8606`348bca80 fffff804`59c60ace : ffff8804`62b7e080 fffffecf`c07cbf70 ffff8804`622c3290 00000000`00000000 : nt!KiAbThreadRemoveBoosts+0x5d
ffff8606`348bcab0 fffffe94`06a1d4c5 : 00000000`000005f7 00000000`00000000 ffff8804`62b7e080 00000000`00000000 : nt!ExAcquirePushLockExclusiveEx+0xee
ffff8606`348bcaf0 fffffe94`06a387ae : fffffecf`c07cbf70 00000000`00000000 00000000`00000005 00000000`00000394 : win32kbase!HmgSetOwner+0x205
ffff8606`348bcb90 fffffe94`06a38aa9 : 00000000`00000000 ffff8606`348bcec0 ffff8606`348bcd60 fffffecf`c0853460 : win32kbase!GreSelectPalette+0x27e
ffff8606`348bcbf0 fffffe94`06d59d54 : 00000000`00000000 fffffecf`c0853460 fffffecf`c06288a0 00000000`00000020 : win32kbase!GreSetBitmapOwner+0x9
ffff8606`348bcc20 00000000`00000000 : fffffecf`c0853460 fffffecf`c06288a0 00000000`00000020 00000000`00000040 : win32kfull+0x79d54
SYMBOL_NAME: win32kbase!HmgSetOwner+205
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
IMAGE_VERSION: 10.0.19041.662
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 205
FAILURE_BUCKET_ID: 0x157_win32kbase!HmgSetOwner
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {88237c7c-9070-710b-4df2-7868b0e0656f}
Followup: MachineOwner
---------
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->CombinedApcDisable field. This consists of two separate 16-bit
fields, the SpecialApcDisable and the KernelApcDisable. A negative value
of either indicates that a driver has disabled special or normal APCs
(respectively) without re-enabling them; a positive value indicates that
a driver has enabled special or normal APCs (respectively) too many times.
Arguments:
Arg1: 00007ff97d54c754, Address of system call function or worker routine
Arg2: 0000000000000000, Thread->ApcStateIndex
Arg3: 00000000ffff0000, (Thread->SpecialApcDisable << 16) | Thread->KernelApcDisable
Arg4: ffffa98b8405ab80, Call type (0 - system call, 1 - worker routine)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4764
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 12968
Key : Analysis.Memory.CommitPeak.Mb
Value: 76
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 1
BUGCHECK_P1: 7ff97d54c754
BUGCHECK_P2: 0
BUGCHECK_P3: ffff0000
BUGCHECK_P4: ffffa98b8405ab80
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 2
PROCESS_NAME: csrss.exe
STACK_TEXT:
ffffa98b`8405a9b8 fffff803`77c07769 : 00000000`00000001 00007ff9`7d54c754 00000000`00000000 00000000`ffff0000 : nt!KeBugCheckEx
ffffa98b`8405a9c0 fffff803`77c07633 : ffff998c`fb662000 00000000`00000000 ffff998c`fb662080 000000c6`3ed3e3d0 : nt!KiBugCheckDispatch+0x69
ffffa98b`8405ab00 00007ff9`7d54c754 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExitPico+0x1fe
000000c6`3ed3e128 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`7d54c754
SYMBOL_NAME: nt!KiSystemServiceExitPico+1fe
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.685
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1fe
FAILURE_BUCKET_ID: 0x1_SysCallNum_3d_nt!KiSystemServiceExitPico
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {4dc00784-d9e4-d667-d0a8-e76801c389ec}
Followup: MachineOwner
---------
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80482386bd6, Address of the instruction which caused the bugcheck
Arg3: ffffbf86e1dfd530, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 8328
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 14861
Key : Analysis.Memory.CommitPeak.Mb
Value: 79
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff80482386bd6
BUGCHECK_P3: ffffbf86e1dfd530
BUGCHECK_P4: 0
CONTEXT: ffffbf86e1dfd530 -- (.cxr 0xffffbf86e1dfd530)
rax=ffffbf86e1dfdfe8 rbx=0000000000000000 rcx=ffffbf86e1dfe4c0
rdx=0000000000000000 rsi=ffffbf86e1dfe490 rdi=ffffdf08734a4548
rip=fffff80482386bd6 rsp=ffffbf86e1dfdf30 rbp=0000000000000000
r8=ffffbf86e1dfe008 r9=ffffbf86e1dfdff0 r10=fffff8047f8082e0
r11=ffffbf86e1dfe418 r12=0000000000000258 r13=0000000000000000
r14=0000000000000000 r15=ffffbf86e1dfe4c0
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050286
Ntfs+0x16bd6:
fffff804`82386bd6 488b4218 mov rax,qword ptr [rdx+18h] ds:002b:00000000`00000018=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 2
PROCESS_NAME: MsMpEng.exe
STACK_TEXT:
ffffbf86`e1dfdf30 fffff804`824b444f : 00000000`00000000 ffffbf86`e1dfe1e9 ffffdf08`6a010100 fffff804`7f84caf2 : Ntfs+0x16bd6
ffffbf86`e1dfdf70 fffff804`824aaedd : 00000000`00000000 00000000`00000000 00000000`00000000 ffffbf86`e1dfe490 : Ntfs+0x14444f
ffffbf86`e1dfe420 fffff804`7f852f55 : ffffdf08`734a4460 fffff804`7c2a4b46 ffffdf08`7287f010 ffffdf08`6b73dd60 : Ntfs+0x13aedd
ffffbf86`e1dfe770 fffff804`7c2a6ccf : ffffbf86`e1dfe880 fffff804`7c2a4b46 ffffbf86`e1dff000 ffffbf86`e1df9000 : nt!IofCallDriver+0x55
ffffbf86`e1dfe7b0 fffff804`7c2a48d3 : ffffbf86`e1dfe840 00000000`00000000 00000000`00000000 ffffdf08`73289340 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffffbf86`e1dfe820 fffff804`7f852f55 : ffffdf08`73d38830 fffff804`7f85346d ffffdf08`734a4460 ffffffff`ffffffff : FLTMGR!FltpDispatch+0xa3
ffffbf86`e1dfe880 fffff804`7fbfd96a : 00000000`00000001 ffffdf08`73d38830 00000000`00000000 00000000`00040042 : nt!IofCallDriver+0x55
ffffbf86`e1dfe8c0 fffff804`7fc2882c : 00000000`00000000 00000000`00007ffa ffffffff`00000000 ffffdf08`696c0d20 : nt!IopCloseFile+0x17a
ffffbf86`e1dfe950 fffff804`7fc2c4fc : 00000000`00000b2c 00000063`ebeff0c0 00000063`ebeff150 ffffdf08`00000018 : nt!ObCloseHandleTableEntry+0x24c
ffffbf86`e1dfea90 fffff804`7fa071b8 : ffffdf08`73495300 00007ff9`00000000 ffffbf86`e1dfeb80 ffffffff`ffb3b4c0 : nt!NtClose+0xec
ffffbf86`e1dfeb00 00007ff9`1c0cc194 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000063`ebeff278 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`1c0cc194
SYMBOL_NAME: Ntfs+16bd6
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
IMAGE_VERSION: 10.0.19041.685
STACK_COMMAND: .cxr 0xffffbf86e1dfd530 ; kb
BUCKET_ID_FUNC_OFFSET: 16bd6
FAILURE_BUCKET_ID: 0x3B_c0000005_Ntfs!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {295ea5f8-4818-74e6-5ff2-8c3321f15313}
Followup: MachineOwner
---------
