KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffcd0f924ca7d0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffcd0f924ca728, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.
SYSTEM_PRODUCT_NAME: B450 GAMING X
SYSTEM_SKU: Default string
SYSTEM_VERSION: Default string
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: F41
BIOS_DATE: 07/22/2019
BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.
BASEBOARD_PRODUCT: B450 GAMING X
BASEBOARD_VERSION: x.x
DUMP_TYPE: 2
BUGCHECK_P1: 3
BUGCHECK_P2: ffffcd0f924ca7d0
BUGCHECK_P3: ffffcd0f924ca728
BUGCHECK_P4: 0
TRAP_FRAME: ffffcd0f924ca7d0 -- (.trap 0xffffcd0f924ca7d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffb90c44428440 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff802782729dc rsp=ffffcd0f924ca960 rbp=ffffb90c3ca0a900
r8=0000000000000000 r9=0000000000000000 r10=fffff8027340fab0
r11=ffffb90c3a1f3140 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po cy
fileinfo!FIPfInterfaceClose+0x451c:
fffff802`782729dc cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffcd0f924ca728 -- (.exr 0xffffcd0f924ca728)
ExceptionAddress: fffff802782729dc (fileinfo!FIPfInterfaceClose+0x000000000000451c)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: c
CPU_MHZ: c7a
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 8
CPU_STEPPING: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: powershell.exe
CURRENT_IRQL: 0
DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY
ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: DESKTOP-ME9UFOB
ANALYSIS_SESSION_TIME: 04-09-2020 19:11:51.0936
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff802735d41e9 to fffff802735c2360
STACK_TEXT:
ffffcd0f`924ca4a8 fffff802`735d41e9 : 00000000`00000139 00000000`00000003 ffffcd0f`924ca7d0 ffffcd0f`924ca728 : nt!KeBugCheckEx
ffffcd0f`924ca4b0 fffff802`735d4610 : ffffcd0f`924ca698 00000000`00007ffb fffff802`71a6f180 ffffb90c`00000000 : nt!KiBugCheckDispatch+0x69
ffffcd0f`924ca5f0 fffff802`735d29a3 : fffff802`7386a440 00000000`00000000 00000000`00000103 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffcd0f`924ca7d0 fffff802`782729dc : ffffcd0f`924ca9c0 ffff980b`c10679c0 00000000`00040282 fffff802`734c0029 : nt!KiRaiseSecurityCheckFailure+0x323
ffffcd0f`924ca960 fffff802`73a35e3d : ffffcd0f`924cab09 ffff980b`c11d6000 00000000`00000000 00000000`00000000 : fileinfo!FIPfInterfaceClose+0x451c
ffffcd0f`924ca9a0 fffff802`73a35c5e : ffff980b`c0eb1690 00000000`00000001 ffffcd0f`924cab09 fffff802`73a57170 : nt!PfpOpenHandleClose+0x55
ffffcd0f`924ca9f0 fffff802`73a35ad7 : ffffcd0f`924caa80 00000000`00000001 ffff16d4`041919a5 00000000`00000005 : nt!PfSnCleanupPrefetchSectionInfo+0xba
ffffcd0f`924caa20 fffff802`739d10db : 00000000`00000002 00000000`00000001 00000000`00000001 ffffb90c`46e2f080 : nt!PfSnCleanupPrefetchHeader+0x3f
ffffcd0f`924caa50 fffff802`734f43b5 : ffffb90c`3a088bf0 ffffb90c`3a1f3140 ffffb90c`3a088bf0 ffffb90c`46e2f080 : nt!PfSnAsyncPrefetchWorker+0x23b
ffffcd0f`924cab70 fffff802`7346bcd5 : ffffb90c`3a1f3140 00000000`00000080 ffffb90c`3a0962c0 00000000`00000000 : nt!ExpWorkerThread+0x105
ffffcd0f`924cac10 fffff802`735c9968 : fffff802`71a6f180 ffffb90c`3a1f3140 fffff802`7346bc80 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffcd0f`924cac60 00000000`00000000 : ffffcd0f`924cb000 ffffcd0f`924c5000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
THREAD_SHA1_HASH_MOD_FUNC: f9c08524d94816aa9c10bf7a96cb24010f9a655d
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 0cc8c7b56c87c56670d1c67ff3c39fab6ec0c496
THREAD_SHA1_HASH_MOD: f9e8dde17232951c8d8a9e44c1a04aaf1a3c411e
FOLLOWUP_IP:
fileinfo!FIPfInterfaceClose+451c
fffff802`782729dc cd29 int 29h
FAULT_INSTR_CODE: be4129cd
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: fileinfo!FIPfInterfaceClose+451c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fileinfo
IMAGE_NAME: fileinfo.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 24bbed20
IMAGE_VERSION: 10.0.18362.1049
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 451c
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_fileinfo!FIPfInterfaceClose
BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_fileinfo!FIPfInterfaceClose
PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_fileinfo!FIPfInterfaceClose
TARGET_TIME: 2020-04-09T15:26:41.000Z
OSBUILD: 18362
OSSERVICEPACK: 752
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 124f
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_fileinfo!fipfinterfaceclose
FAILURE_ID_HASH: {af30cdce-76ff-0c6b-9d69-ccde25693040}
Followup: MachineOwner
---------
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8014c3b1eea, Address of the instruction which caused the bugcheck
Arg3: fffffd8fae39bae0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.
SYSTEM_PRODUCT_NAME: B450 GAMING X
SYSTEM_SKU: Default string
SYSTEM_VERSION: Default string
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: F41
BIOS_DATE: 07/22/2019
BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.
BASEBOARD_PRODUCT: B450 GAMING X
BASEBOARD_VERSION: x.x
DUMP_TYPE: 2
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff8014c3b1eea
BUGCHECK_P3: fffffd8fae39bae0
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
WppRecorder!WppAutoLogTrace+1a
fffff801`4c3b1eea 40386919 cmp byte ptr [rcx+19h],bpl
CONTEXT: fffffd8fae39bae0 -- (.cxr 0xfffffd8fae39bae0)
rax=0000000000000000 rbx=000000000000000d rcx=f7ffc90bad307000
rdx=0000000000000004 rsi=ffffc90bb006f204 rdi=ffff848fabd88e48
rip=fffff8014c3b1eea rsp=fffffd8fae39c4d0 rbp=0000000000000000
r8=000000000000000e r9=ffff848fabd88e48 r10=f7ffc90bad307000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000004
r14=000000000000000e r15=f7ffc90bad307000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050286
WppRecorder!WppAutoLogTrace+0x1a:
fffff801`4c3b1eea 40386919 cmp byte ptr [rcx+19h],bpl ds:002b:f7ffc90b`ad307019=??
Resetting default scope
BUGCHECK_STR: 0x3B_c0000005
CPU_COUNT: c
CPU_MHZ: c7a
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 8
CPU_STEPPING: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-ME9UFOB
ANALYSIS_SESSION_TIME: 04-09-2020 19:11:44.0986
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from ffff848fabbea468 to fffff8014c3b1eea
STACK_TEXT:
fffffd8f`ae39c4d0 ffff848f`abbea468 : 00000000`00000003 fffff801`4cd0fc81 00000000`00000000 00000000`00000000 : WppRecorder!WppAutoLogTrace+0x1a
fffffd8f`ae39c530 ffff848f`abbe99c8 : fffffd8f`ae39ca90 fffffd8f`ae39c680 ffffc90b`b006f280 0a000004`0980a025 : win32kbase!WPP_RECORDER_SF_+0x84
fffffd8f`ae39c580 ffff848f`ab8bd9f5 : 00000000`00000000 ffff848f`ab86cf51 ffff84c5`c07d2620 ffffae80`0c02e3f8 : win32kbase!xxxUserProcessCallout+0x78
fffffd8f`ae39c7b0 ffff848f`abbd2c85 : 00000000`00000000 fffff801`47e389b8 ffffc90b`acffeda0 fffff801`47aca937 : win32kfull!W32pProcessCallout+0x95
fffffd8f`ae39c7f0 ffff848f`abf71040 : fffff801`47e389b8 00000000`00000000 00007ff9`c1df6bf0 ffffc90b`acffeda0 : win32kbase!W32CalloutDispatch+0x385
fffffd8f`ae39ca10 fffff801`4807c511 : ffffc7e3`dffe7070 fffffd8f`ae39ca90 ffffc7e3`f1f8f7f8 ffffc90b`b006f780 : win32k!W32CalloutDispatchThunk+0x10
fffffd8f`ae39ca40 fffff801`4800bf11 : ffffc90b`afee2080 fffffd8f`ae39cab0 00000000`00000021 00000000`00000000 : nt!ExCallCallBack+0x3d
fffffd8f`ae39ca70 fffff801`47bc5fc9 : 00000000`0000000c ffffc90b`afee2080 00000000`00000001 00000000`00000000 : nt!PsConvertToGuiThread+0xc1
fffffd8f`ae39cad0 fffff801`47bd4012 : ffffc90b`000002de 12aa8ce2`ebb50000 00000000`00000000 00000085`f5f5d2a8 : nt!KiConvertToGuiThread+0x9
fffffd8f`ae39cb00 00007ff9`c1df6c04 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExitPico+0x17d
00000085`f5f5d408 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`c1df6c04
THREAD_SHA1_HASH_MOD_FUNC: 2799553d997a4cad4dacb58f2302ad8d588216e6
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: afd0c4d3d1d125e621e8b146443ecde6629be7cf
THREAD_SHA1_HASH_MOD: e5d011da304b42cf95295377caf88b0d34b00133
FOLLOWUP_IP:
WppRecorder!WppAutoLogTrace+1a
fffff801`4c3b1eea 40386919 cmp byte ptr [rcx+19h],bpl
FAULT_INSTR_CODE: 19693840
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: WppRecorder!WppAutoLogTrace+1a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: WppRecorder
IMAGE_NAME: WppRecorder.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 34a54231
IMAGE_VERSION: 10.0.18362.1049
STACK_COMMAND: .cxr 0xfffffd8fae39bae0 ; kb
BUCKET_ID_FUNC_OFFSET: 1a
FAILURE_BUCKET_ID: 0x3B_c0000005_WppRecorder!WppAutoLogTrace
BUCKET_ID: 0x3B_c0000005_WppRecorder!WppAutoLogTrace
PRIMARY_PROBLEM_CLASS: 0x3B_c0000005_WppRecorder!WppAutoLogTrace
TARGET_TIME: 2020-04-09T15:22:30.000Z
OSBUILD: 18362
OSSERVICEPACK: 752
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 4fbf
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x3b_c0000005_wpprecorder!wppautologtrace
FAILURE_ID_HASH: {2b59b96b-1241-0953-b953-498b842b74f4}
Followup: MachineOwner
---------