KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff806356676a0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff806356675f8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 3
BUGCHECK_P2: fffff806356676a0
BUGCHECK_P3: fffff806356675f8
BUGCHECK_P4: 0
TRAP_FRAME: fffff806356676a0 -- (.trap 0xfffff806356676a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff9b03d802b598 rbx=0000000000000000 rcx=0000000000000003
rdx=ffff9b03d75b3118 rsi=0000000000000000 rdi=0000000000000000
rip=fffff806327dd2e5 rsp=fffff80635667830 rbp=fffff8062e19f180
r8=0000000000000102 r9=0000000000000000 r10=0000fffff8063273
r11=fffff80635667920 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KiTryUnwaitThread+0x192465:
fffff806`327dd2e5 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: fffff806356675f8 -- (.exr 0xfffff806356675f8)
ExceptionAddress: fffff806327dd2e5 (nt!KiTryUnwaitThread+0x0000000000192465)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 71
CPU_STEPPING: 0
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: System
CURRENT_IRQL: 2
DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY
ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 02-08-2020 19:20:52.0908
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff806327d32e9 to fffff806327c14e0
STACK_TEXT:
fffff806`35667378 fffff806`327d32e9 : 00000000`00000139 00000000`00000003 fffff806`356676a0 fffff806`356675f8 : nt!KeBugCheckEx
fffff806`35667380 fffff806`327d3710 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff806`356674c0 fffff806`327d1aa5 : 00000000`00000000 ffff9b03`d80071f0 00000000`00000001 00000000`00000002 : nt!KiFastFailDispatch+0xd0
fffff806`356676a0 fffff806`327dd2e5 : 00000001`00400a02 00000000`00000000 00400a02`00000010 000000d3`a06bd718 : nt!KiRaiseSecurityCheckFailure+0x325
fffff806`35667830 fffff806`3266be16 : ffff9b03`d802b5c8 00000000`00000000 ffff9b03`d802b690 ffff9b03`d802b5c0 : nt!KiTryUnwaitThread+0x192465
fffff806`35667890 fffff806`3266b9f2 : ffff9b03`d802b5c0 00000000`00000002 00000000`00000080 ffff9b03`00000002 : nt!KiTimerWaitTest+0x1b6
fffff806`35667940 fffff806`3266a7e9 : 00000000`00000008 00000000`00989680 00000000`00002353 00000000`0000006b : nt!KiProcessExpiredTimerList+0xd2
fffff806`35667a30 fffff806`327c5024 : 00000000`00000000 fffff806`2e19f180 fffff806`32b91400 ffff9b03`d64ce080 : nt!KiRetireDpcList+0x4e9
fffff806`35667c60 00000000`00000000 : fffff806`35668000 fffff806`35662000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x84
THREAD_SHA1_HASH_MOD_FUNC: f01c4d5c2f1ac69d78d7c0f6672a74ba1fa32dfa
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 87e202a05b30571d7c63039f52b4da523e099291
THREAD_SHA1_HASH_MOD: 9f457f347057f10e1df248e166a3e95e6570ecfe
FOLLOWUP_IP:
nt!KiTimerWaitTest+1b6
fffff806`3266be16 4c3bf3 cmp r14,rbx
FAULT_INSTR_CODE: ff33b4c
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: nt!KiTimerWaitTest+1b6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4f6eba0
IMAGE_VERSION: 10.0.18362.592
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1b6
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiTimerWaitTest
BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiTimerWaitTest
PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiTimerWaitTest
TARGET_TIME: 2020-02-08T15:10:10.000Z
OSBUILD: 18362
OSSERVICEPACK: 592
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1972-08-22 03:24:00
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 68c9
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_ktimer_list_corruption_nt!kitimerwaittest
FAILURE_ID_HASH: {efb56395-a173-53f8-073d-d3c8cfd50e2b}
Followup: MachineOwner
---------
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8025c0eaa0a, The address that the exception occurred at
Arg3: fffff8828615d138, Exception Record Address
Arg4: fffff8828615c980, Context Record Address
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullPtr
Key : AV.Fault
Value: Write
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8025c0eaa0a
BUGCHECK_P3: fffff8828615d138
BUGCHECK_P4: fffff8828615c980
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
FLTMGR!FltGetInstanceContext+6a
fffff802`5c0eaa0a 488906 mov qword ptr [rsi],rax
EXCEPTION_RECORD: fffff8828615d138 -- (.exr 0xfffff8828615d138)
ExceptionAddress: fffff8025c0eaa0a (FLTMGR!FltGetInstanceContext+0x000000000000006a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000000000000
Attempt to write to address 0000000000000000
CONTEXT: fffff8828615c980 -- (.cxr 0xfffff8828615c980)
rax=ffffcf01f8005240 rbx=ffffcf01f2e0f8a0 rcx=ffffcf01f80051e0
rdx=ffffcf01f2e0f920 rsi=0000000000000000 rdi=ffffcf01f2e0f920
rip=fffff8025c0eaa0a rsp=fffff8828615d370 rbp=fffff8828615d4b9
r8=fffff8828615d378 r9=000000000000003e r10=fffff80259639cf0
r11=ffffd0fd09800000 r12=0000000010000004 r13=ffffcf01f2e0f8a0
r14=fffff8828615d478 r15=ffffcf01fd79e930
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050282
FLTMGR!FltGetInstanceContext+0x6a:
fffff802`5c0eaa0a 488906 mov qword ptr [rsi],rax ds:002b:00000000`00000000=????????????????
Resetting default scope
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 71
CPU_STEPPING: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: NULL_DEREFERENCE
PROCESS_NAME: RtkAudUService64.exe
CURRENT_IRQL: 0
FOLLOWUP_IP:
Wof!WofPreFileSystemControlCallback+43
fffff802`5ca8fd03 488b6c2458 mov rbp,qword ptr [rsp+58h]
BUGCHECK_STR: AV
WRITE_ADDRESS: fffff80259b733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
0000000000000000
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000000000
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 02-08-2020 19:20:57.0188
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff8025ca8fd03 to fffff8025c0eaa0a
STACK_TEXT:
fffff882`8615d370 fffff802`5ca8fd03 : ffffcf01`f2e0f8a0 ffffcf01`f23346a0 ffffcf01`00000000 ffffcf01`f80051e0 : FLTMGR!FltGetInstanceContext+0x6a
fffff882`8615d3c0 fffff802`5c0e4a5c : ffffcf01`fd79e8b0 ffffcf01`00000000 ffffcf01`fd79ea38 00000000`00000000 : Wof!WofPreFileSystemControlCallback+0x43
fffff882`8615d410 fffff802`5c0e45a0 : fffff882`8615d5f0 00000000`00000000 00000000`0000000d 00000000`00060800 : FLTMGR!FltpPerformPreCallbacks+0x2fc
fffff882`8615d520 fffff802`5c0e4112 : 00000000`00000000 fffff882`8615d5f0 ffffcf01`fec4e8b0 fffff882`8615d600 : FLTMGR!FltpPassThroughInternal+0x90
fffff882`8615d550 fffff802`5c11c14b : 00000000`00000000 ffffcf01`ff0665a8 00000000`00000000 fffff802`59bf1225 : FLTMGR!FltpPassThrough+0x162
fffff882`8615d5d0 fffff802`59631f79 : ffffcf01`fec4e8b0 00000000`00000002 00000000`00000000 ffffcf01`fec4ec98 : FLTMGR!FltpFsControl+0xcb
fffff882`8615d630 fffff802`59be95e5 : ffffcf01`fec4e8b0 00000000`00000000 00000000`00000000 ffffcf01`fea9b230 : nt!IofCallDriver+0x59
fffff882`8615d670 fffff802`59be93f0 : 00000000`00000000 fffff882`8615d990 ffffcf01`fec4e8b0 fffff882`8615d990 : nt!IopSynchronousServiceTail+0x1a5
fffff882`8615d710 fffff802`59c426f7 : 00000000`00000001 ffffffff`80003b14 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xc10
fffff882`8615d830 fffff802`59dc2919 : ffffa98c`7ba4e4d0 ffffffff`80004148 fffff882`8615d9b1 ffffa98c`7ba733e8 : nt!PfSnPrefetchFileMetadata+0xeb
fffff882`8615d8d0 fffff802`59c4513d : 00000000`0000006c fffff882`8615db00 ffffa98c`7ba794f2 ffffa98c`00000000 : nt!PfSnGetSectionObject+0x17d561
fffff882`8615da00 fffff802`596bd095 : ffffcf01`f0494300 ffffcf01`f2fa7040 ffffcf01`f0494300 00000000`00000000 : nt!PfSnPopulateReadList+0x2bd
fffff882`8615db70 fffff802`5972a7a5 : ffffcf01`f2fa7040 00000000`00000080 ffffcf01`f04b0080 00000067`b4bbbdff : nt!ExpWorkerThread+0x105
fffff882`8615dc10 fffff802`597c8b2a : fffff802`561a5180 ffffcf01`f2fa7040 fffff802`5972a750 ae3fae3e`ae3dae3c : nt!PspSystemThreadStartup+0x55
fffff882`8615dc60 00000000`00000000 : fffff882`8615e000 fffff882`86158000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a
THREAD_SHA1_HASH_MOD_FUNC: 7f5eaa515b28ae64749af1f4327df5b9527c0c38
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 9e4e535e064d8f7891c66e59c8413a470aa96166
THREAD_SHA1_HASH_MOD: b8d07c81e52486127ebe9c8b1faa06aab311a8dd
FAULT_INSTR_CODE: 246c8b48
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: Wof!WofPreFileSystemControlCallback+43
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Wof
IMAGE_NAME: Wof.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .cxr 0xfffff8828615c980 ; kb
BUCKET_ID_FUNC_OFFSET: 43
FAILURE_BUCKET_ID: AV_Wof!WofPreFileSystemControlCallback
BUCKET_ID: AV_Wof!WofPreFileSystemControlCallback
PRIMARY_PROBLEM_CLASS: AV_Wof!WofPreFileSystemControlCallback
TARGET_TIME: 2020-02-08T15:11:07.000Z
OSBUILD: 18362
OSSERVICEPACK: 592
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1972-08-22 03:24:00
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 6892
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_wof!wofprefilesystemcontrolcallback
FAILURE_ID_HASH: {4a394750-50b7-9fd3-fdea-eef27eb1bc90}
Followup: MachineOwner
---------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 000000000000000e, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80366e389ca, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: e
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff80366e389ca
READ_ADDRESS: fffff803673733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
000000000000000e
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExpReleaseResourceExclusiveForThreadLite+22a
fffff803`66e389ca 488b00 mov rax,qword ptr [rax]
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 71
CPU_STEPPING: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: NVIDIA Share.exe
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 02-08-2020 19:21:01.0231
ANALYSIS_VERSION: 10.0.18362.1 x86fre
TRAP_FRAME: fffffe804bd71e30 -- (.trap 0xfffffe804bd71e30)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000000e rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80366e389ca rsp=fffffe804bd71fc0 rbp=0000000000000001
r8=0000000000000002 r9=0000000000000002 r10=fffff80366e38650
r11=fffffe804bd720d0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!ExpReleaseResourceExclusiveForThreadLite+0x22a:
fffff803`66e389ca 488b00 mov rax,qword ptr [rax] ds:00000000`0000000e=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80366fd32e9 to fffff80366fc14e0
STACK_TEXT:
fffffe80`4bd71ce8 fffff803`66fd32e9 : 00000000`0000000a 00000000`0000000e 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffe80`4bd71cf0 fffff803`66fcf62b : 00000000`00000000 ffffffff`ffffffff fffffe80`4bd71f50 fffff803`66e33294 : nt!KiBugCheckDispatch+0x69
fffffe80`4bd71e30 fffff803`66e389ca : ffffd907`9f238110 fffff803`00000000 fffff803`66d61e70 fffff803`66d5e848 : nt!KiPageFault+0x46b
fffffe80`4bd71fc0 fffff803`66e386da : ffffd907`00000000 fffffe80`4bd72b80 00000000`000009c4 00000000`000e9e89 : nt!ExpReleaseResourceExclusiveForThreadLite+0x22a
fffffe80`4bd72080 fffffccd`01024fa2 : 00000000`00000000 fffffca1`c62118a0 00000000`00000000 fffffccd`01ad06d2 : nt!ExReleaseResourceAndLeaveCriticalRegion+0x8a
fffffe80`4bd720e0 fffffccd`01a0ac03 : 00000000`00000000 fffffca1`c62118a0 00000000`ffffffff 00000000`00000004 : win32kbase!UserSessionSwitchLeaveCrit+0x62
fffffe80`4bd72160 fffff803`66fd2d18 : ffffd907`a3c3b080 00000045`3ed9f578 00000045`00000004 fffffe80`00001cff : win32kfull!NtUserMsgWaitForMultipleObjectsEx+0x523
fffffe80`4bd72a90 00007ffe`6a0e9a84 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000045`3ed9f558 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`6a0e9a84
THREAD_SHA1_HASH_MOD_FUNC: 818f839df4ef8e3f408756da31b5e13dceadb8ea
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 39c25022b19c3683e0f3d8bde3d9e27e0ddd7b51
THREAD_SHA1_HASH_MOD: a1065c0f1e29b9ea5565121504105574f7d99b4b
FOLLOWUP_IP:
win32kbase!UserSessionSwitchLeaveCrit+62
fffffccd`01024fa2 488b4c2460 mov rcx,qword ptr [rsp+60h]
FAULT_INSTR_CODE: 244c8b48
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: win32kbase!UserSessionSwitchLeaveCrit+62
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.592
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 62
FAILURE_BUCKET_ID: AV_win32kbase!UserSessionSwitchLeaveCrit
BUCKET_ID: AV_win32kbase!UserSessionSwitchLeaveCrit
PRIMARY_PROBLEM_CLASS: AV_win32kbase!UserSessionSwitchLeaveCrit
TARGET_TIME: 2020-02-08T15:33:32.000Z
OSBUILD: 18362
OSSERVICEPACK: 592
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1972-08-22 03:24:00
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 3ecd
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_win32kbase!usersessionswitchleavecrit
FAILURE_ID_HASH: {208d5850-4c0e-4f6a-8d91-5f50f886e78a}
Followup: MachineOwner
---------
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff803262394ea, Address of the instruction which caused the bugcheck
Arg3: ffffc681e27e9980, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff803262394ea
BUGCHECK_P3: ffffc681e27e9980
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!KeAbPreAcquire+11a
fffff803`262394ea 0fb64220 movzx eax,byte ptr [rdx+20h]
CONTEXT: ffffc681e27e9980 -- (.cxr 0xffffc681e27e9980)
rax=0000000000000000 rbx=ffffb68d5dd3e080 rcx=ffffc681e27ea598
rdx=0000000000000001 rsi=ffffc681e27ea598 rdi=0000000000000001
rip=fffff803262394ea rsp=ffffc681e27ea370 rbp=0000000000000000
r8=0000000000000001 r9=fffff80326200000 r10=ffffc781515b9180
r11=ffffc681e27ea278 r12=ffffb68d5dd3e1c0 r13=0000000000000000
r14=0000000000000001 r15=fffff803240bf180
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050202
nt!KeAbPreAcquire+0x11a:
fffff803`262394ea 0fb64220 movzx eax,byte ptr [rdx+20h] ds:002b:00000000`00000021=??
Resetting default scope
BUGCHECK_STR: 0x3B_c0000005
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 71
CPU_STEPPING: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 02-08-2020 19:21:05.0136
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff803263f76a9 to fffff803262394ea
STACK_TEXT:
ffffc681`e27ea370 fffff803`263f76a9 : ffffb68d`5dd3e080 ffffc681`e27ea441 00000000`00000000 00000000`00000000 : nt!KeAbPreAcquire+0x11a
ffffc681`e27ea3c0 fffff803`2623e05d : ffffc681`e27ea598 00000000`0000001b 00000000`00000000 00000002`00543a00 : nt!KeWaitForSingleObject+0x1bcb19
ffffc681`e27ea4a0 fffff803`2623829e : ffffb68d`5d3cc290 ffffc681`e27ea580 ffffc781`00010224 fffff803`263599a0 : nt!ExpWaitForResource+0x6d
ffffc681`e27ea520 fffff803`2623746f : fffff803`26cbae70 00000000`00000000 ffffb68d`5dcd4490 00000000`00000000 : nt!ExpAcquireResourceExclusiveLite+0x33e
ffffc681`e27ea5e0 ffffee14`9abd8bdc : ffffb68d`5dcd4490 00000000`00989680 00000000`00000000 00000000`00000001 : nt!ExEnterCriticalRegionAndAcquireResourceExclusive+0x3f
ffffc681`e27ea620 ffffee14`9a80cbb6 : 00000000`00000001 00000000`00000001 ffffee14`9ab21308 00000000`00000004 : win32kbase!EnterCrit+0x8c
ffffc681`e27ea740 ffffee14`9ac4efe3 : ffffb68d`5dd3e080 ffffb68d`5dd3e080 00000000`00000000 00000000`00000005 : win32kfull!RawInputThread+0xd96
ffffc681`e27ea9c0 ffffee14`9a82afef : ffffb68d`5dd3e080 00000000`00000000 00000000`00000005 00000000`00000000 : win32kbase!xxxCreateSystemThreads+0xa3
ffffc681`e27eaad0 fffff803`263d2d18 : ffffb68d`5dd3e080 00000000`00000005 00000294`cc8042f0 00000000`00000484 : win32kfull!NtUserCallNoParam+0x6f
ffffc681`e27eab00 00007fff`27201144 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000e1`0d1ff768 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`27201144
THREAD_SHA1_HASH_MOD_FUNC: 704193183c98ceba1f60d0c29a15f127b181e086
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 612f771af4d31fad4b7bf9a278d754895ff0d116
THREAD_SHA1_HASH_MOD: d95ee6ebe5f7ee4bf1c75755de65839d4ffd87c7
FOLLOWUP_IP:
win32kbase!EnterCrit+8c
ffffee14`9abd8bdc 4885c0 test rax,rax
FAULT_INSTR_CODE: 74c08548
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: win32kbase!EnterCrit+8c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.592
STACK_COMMAND: .cxr 0xffffc681e27e9980 ; kb
BUCKET_ID_FUNC_OFFSET: 8c
FAILURE_BUCKET_ID: 0x3B_c0000005_win32kbase!EnterCrit
BUCKET_ID: 0x3B_c0000005_win32kbase!EnterCrit
PRIMARY_PROBLEM_CLASS: 0x3B_c0000005_win32kbase!EnterCrit
TARGET_TIME: 2020-02-08T15:39:36.000Z
OSBUILD: 18362
OSSERVICEPACK: 592
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1972-08-22 03:24:00
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 5e59
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x3b_c0000005_win32kbase!entercrit
FAILURE_ID_HASH: {a4ae1fed-f8cf-effb-734e-4b667f8fbde8}
Followup: MachineOwner
---------
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: fffff8062d173358, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding this single DPC timeout
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: TickPeriods ***
*** ***
*************************************************************************
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: Micro-Star International Co., Ltd.
SYSTEM_PRODUCT_NAME: MS-7B93
SYSTEM_SKU: To be filled by O.E.M.
SYSTEM_VERSION: 1.0
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 1.50
BIOS_DATE: 11/06/2019
BASEBOARD_MANUFACTURER: Micro-Star International Co., Ltd.
BASEBOARD_PRODUCT: MPG X570 GAMING PRO CARBON WIFI (MS-7B93)
BASEBOARD_VERSION: 1.0
DUMP_TYPE: 2
BUGCHECK_P1: 0
BUGCHECK_P2: 501
BUGCHECK_P3: 500
BUGCHECK_P4: fffff8062d173358
DPC_TIMEOUT_TYPE: SINGLE_DPC_TIMEOUT_EXCEEDED
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 71
CPU_STEPPING: 0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x133
PROCESS_NAME: System
CURRENT_IRQL: d
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 02-08-2020 19:21:09.0198
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff8062cdeea3d to fffff8062cdc14e0
STACK_TEXT:
ffffb701`1a2eab08 fffff806`2cdeea3d : 00000000`00000133 00000000`00000000 00000000`00000501 00000000`00000500 : nt!KeBugCheckEx
ffffb701`1a2eab10 fffff806`2cc1f897 : 00000145`c1348f3a ffffb701`1a292180 00000000`00000286 ffffe001`036376c0 : nt!KeAccumulateTicks+0x1cbfdd
ffffb701`1a2eab70 fffff806`2d6b91e1 : 00000000`00000000 ffff8186`ee6b1f00 ffffe001`03637740 ffff8186`ee6b1fb0 : nt!KeClockInterruptNotify+0xc07
ffffb701`1a2eaf30 fffff806`2cc02a25 : ffff8186`ee6b1f00 00000000`00000000 00000000`00000000 ffffff8b`23469ba3 : hal!HalpTimerClockIpiRoutine+0x21
ffffb701`1a2eaf60 fffff806`2cdc2f7a : ffffe001`03637740 ffff8186`ee6b1f00 00000000`00000000 00000000`00000000 : nt!KiCallInterruptServiceRoutine+0xa5
ffffb701`1a2eafb0 fffff806`2cdc34e7 : ffff8186`ff649900 00000000`00989680 ffff8186`ff929890 fffff806`2cdc34f4 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
ffffe001`036376c0 fffff806`2cc1ba2b : ffffffff`ffffffd2 fffff806`2d1ab3e6 00000000`00000010 00000000`00000282 : nt!KiInterruptDispatchNoLockNoEtw+0x37
ffffe001`03637850 fffff806`2d1ab3f5 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`d2a71e89 : nt!KeYieldProcessorEx+0x1b
ffffe001`03637880 fffff806`2d1aa555 : 00000000`3905339d ffffb701`1a292180 ffff8186`ff929890 00000000`00000000 : nt!IopLiveDumpProcessCorralStateChange+0x2d
ffffe001`036378b0 fffff806`2cc6ae95 : ffffb701`1a294f80 00000000`00000001 ffffe001`036378a8 00000000`00000000 : nt!IopLiveDumpCorralDpc+0x55
ffffe001`036378f0 fffff806`2cc6a4ef : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExecuteAllDpcs+0x305
ffffe001`03637a30 fffff806`2cdc5024 : ffffffff`00000000 ffffb701`1a292180 ffffb701`1a2a3440 ffff8186`f9060040 : nt!KiRetireDpcList+0x1ef
ffffe001`03637c60 00000000`00000000 : ffffe001`03638000 ffffe001`03632000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x84
THREAD_SHA1_HASH_MOD_FUNC: ef8fc3e4491a4a29d5c2ee424880f97b2e45514c
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 0b9914501dfbff519fcb3a7ce8eb37bf92de6e64
THREAD_SHA1_HASH_MOD: d5e908d356bf8d04aac79332806776dc287dfa54
FOLLOWUP_IP:
nt!KeAccumulateTicks+1cbfdd
fffff806`2cdeea3d cc int 3
FAULT_INSTR_CODE: f68445cc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KeAccumulateTicks+1cbfdd
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4f6eba0
IMAGE_VERSION: 10.0.18362.592
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1cbfdd
FAILURE_BUCKET_ID: 0x133_DPC_nt!KeAccumulateTicks
BUCKET_ID: 0x133_DPC_nt!KeAccumulateTicks
PRIMARY_PROBLEM_CLASS: 0x133_DPC_nt!KeAccumulateTicks
TARGET_TIME: 2020-02-08T15:46:26.000Z
OSBUILD: 18362
OSSERVICEPACK: 592
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1972-08-22 03:24:00
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 8cf5
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x133_dpc_nt!keaccumulateticks
FAILURE_ID_HASH: {88dc98ce-f842-4daa-98d0-858621db6b0f}
Followup: MachineOwner
---------