*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffbb89164e5230, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffffbb89164e5188, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2030
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 2028
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 359
Key : Analysis.Init.Elapsed.mSec
Value: 7673
Key : Analysis.Memory.CommitPeak.Mb
Value: 91
Key : Bugcheck.Code.DumpHeader
Value: 0x139
Key : Bugcheck.Code.Register
Value: 0x139
Key : Dump.Attributes.AsUlong
Value: 8
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
FILE_IN_CAB: 041823-7953-01.dmp
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffbb89164e5230
BUGCHECK_P3: ffffbb89164e5188
BUGCHECK_P4: 0
TRAP_FRAME: ffffbb89164e5230 -- (.trap 0xffffbb89164e5230)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffa90904604e18 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffa9090cd23008 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8056fe68c2e rsp=ffffbb89164e53c0 rbp=ffffbb89164e54c0
r8=ffffa90904604e08 r9=ffffa90904604e18 r10=ffffa9090aeec000
r11=00000000000000c8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!RtlpHpLfhSlotAllocate+0x1d5b6e:
fffff805`6fe68c2e cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffbb89164e5188 -- (.exr 0xffffbb89164e5188)
ExceptionAddress: fffff8056fe68c2e (nt!RtlpHpLfhSlotAllocate+0x00000000001d5b6e)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffbb89`164e4f08 fffff805`6fe0e129 : 00000000`00000139 00000000`00000003 ffffbb89`164e5230 ffffbb89`164e5188 : nt!KeBugCheckEx
ffffbb89`164e4f10 fffff805`6fe0e690 : 00000000`00000002 ffffbb89`164e6650 ffffbb89`164e4b50 ffffbb89`164e1000 : nt!KiBugCheckDispatch+0x69
ffffbb89`164e5050 fffff805`6fe0c65d : 00000000`00000000 00000000`ffffffff 7ffff805`7072e748 00000000`ffffffff : nt!KiFastFailDispatch+0xd0
ffffbb89`164e5230 fffff805`6fe68c2e : ffffffff`ffffffff ffffbb89`00000014 ffffbb89`164e54c0 00000000`00000210 : nt!KiRaiseSecurityCheckFailure+0x31d
ffffbb89`164e53c0 fffff805`6fc92741 : ffffa909`04602340 ffffa909`04604cc0 ffffa909`04604e00 021000c0`000000c0 : nt!RtlpHpLfhSlotAllocate+0x1d5b6e
ffffbb89`164e5510 fffff805`703b5094 : ffffa909`00000000 00000000`00021600 00000000`6e497350 fffff805`703b5019 : nt!ExAllocateHeapPool+0x2b1
ffffbb89`164e5650 fffff805`70091b71 : 00000000`00021490 ffffbb89`164e6100 ffffa909`0c1c5d30 00000000`00000000 : nt!ExAllocatePoolWithTag+0x64
ffffbb89`164e56a0 fffff805`700b5a47 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExpGetProcessInformation+0x531
ffffbb89`164e5d00 fffff805`700b4bf7 : ffffbb89`164e6598 ffffbb89`164e6bd8 00000000`00000005 00000000`00000000 : nt!ExpQuerySystemInformation+0xd07
ffffbb89`164e6040 fffff805`6fe0e09d : 00000000`00000000 00000000`00000000 00000000`00000000 ffffbb89`164e6240 : nt!NtQuerySystemInformation+0x37
ffffbb89`164e6080 fffff805`6fdfecf0 : fffff806`496d39ad 00000000`00000110 00000000`00000088 00000000`000001a0 : nt!KiSystemServiceExitPico+0x3f2
ffffbb89`164e6218 fffff806`496d39ad : 00000000`00000110 00000000`00000088 00000000`000001a0 00000000`00000040 : nt!KiServiceLinkage
ffffbb89`164e6220 00000000`00000110 : 00000000`00000088 00000000`000001a0 00000000`00000040 00000000`00000000 : vgk+0x1739ad
ffffbb89`164e6228 00000000`00000088 : 00000000`000001a0 00000000`00000040 00000000`00000000 00000000`00000001 : 0x110
ffffbb89`164e6230 00000000`000001a0 : 00000000`00000040 00000000`00000000 00000000`00000001 00000000`00000001 : 0x88
ffffbb89`164e6238 00000000`00000040 : 00000000`00000000 00000000`00000001 00000000`00000001 00000000`00000401 : 0x1a0
ffffbb89`164e6240 00000000`00000000 : 00000000`00000001 00000000`00000001 00000000`00000401 ffffbb89`164e6bd8 : 0x40
SYMBOL_NAME: vgk+1739ad
MODULE_NAME: vgk
IMAGE_NAME: vgk.sys
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 1739ad
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_vgk!unknown_function
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {7c341901-5d2d-4d7a-3f87-d2bb78adb92c}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffad8626842cb0, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffffad8626842c08, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2624
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 7604
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 327
Key : Analysis.Init.Elapsed.mSec
Value: 6155
Key : Analysis.Memory.CommitPeak.Mb
Value: 82
Key : Bugcheck.Code.DumpHeader
Value: 0x139
Key : Bugcheck.Code.Register
Value: 0x139
Key : Dump.Attributes.AsUlong
Value: 8
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
FILE_IN_CAB: 041823-9781-01.dmp
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffad8626842cb0
BUGCHECK_P3: ffffad8626842c08
BUGCHECK_P4: 0
TRAP_FRAME: ffffad8626842cb0 -- (.trap 0xffffad8626842cb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff9d8dcfc03758 rbx=0000000000000000 rcx=0000000000000003
rdx=ffff9d8dd70f4008 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80264e68c2e rsp=ffffad8626842e40 rbp=ffffad8626842f40
r8=ffff9d8dcfc03748 r9=ffff9d8dcfc03758 r10=ffff9d8dd6130000
r11=00000000000000c8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
nt!RtlpHpLfhSlotAllocate+0x1d5b6e:
fffff802`64e68c2e cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffad8626842c08 -- (.exr 0xffffad8626842c08)
ExceptionAddress: fffff80264e68c2e (nt!RtlpHpLfhSlotAllocate+0x00000000001d5b6e)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: AndroidEmulato
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffad86`26842988 fffff802`64e0e129 : 00000000`00000139 00000000`00000003 ffffad86`26842cb0 ffffad86`26842c08 : nt!KeBugCheckEx
ffffad86`26842990 fffff802`64e0e690 : 00000000`00000000 00000000`0000000f 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffad86`26842ad0 fffff802`64e0c65d : 7fff9d8d`d8385920 00000000`ffffffff 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffad86`26842cb0 fffff802`64e68c2e : ffffffff`ffffffff ffffad86`00000028 ffffad86`26842f40 00000000`000000d0 : nt!KiRaiseSecurityCheckFailure+0x31d
ffffad86`26842e40 fffff802`64c92741 : ffff9d8d`cfc02340 ffff9d8d`cfc03600 ffff9d8d`cfc03740 00d00090`00000090 : nt!RtlpHpLfhSlotAllocate+0x1d5b6e
ffffad86`26842f90 fffff802`653b5094 : ffffad86`00000000 00000000`02d66510 ffff9d8d`6e497350 ffff9d8d`d9093a01 : nt!ExAllocateHeapPool+0x2b1
ffffad86`268430d0 fffff802`65091b71 : 00000000`02d663a0 ffffad86`26843b80 ffff9d8d`d85ac2f0 00000000`00000000 : nt!ExAllocatePoolWithTag+0x64
ffffad86`26843120 fffff802`650b5a47 : ffff9d8d`00000000 ffff9d8d`00049288 00000000`00000000 00000000`00000000 : nt!ExpGetProcessInformation+0x531
ffffad86`26843780 fffff802`650b4bf7 : ffff9d8d`d84e0080 fffff802`650bcfbf 00000000`003cc000 00000000`003cc000 : nt!ExpQuerySystemInformation+0xd07
ffffad86`26843ac0 fffff802`64e0d8f8 : ffff9d8d`d84e0000 ffff9d8d`00000000 ffffffff`ffe17b80 ffff9d8d`d8c4ddd0 : nt!NtQuerySystemInformation+0x37
ffffad86`26843b00 00007fff`7a4ad784 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`03b0e608 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`7a4ad784
SYMBOL_NAME: nt!KiFastFailDispatch+d0
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.2728
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}
Followup: MachineOwner