KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffffa0b877ad220, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffffa0b877ad178, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for ts_arnusbx.sys
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.
SYSTEM_PRODUCT_NAME: B450M S2H
SYSTEM_SKU: Default string
SYSTEM_VERSION: Default string
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: F42c
BIOS_DATE: 09/12/2019
BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.
BASEBOARD_PRODUCT: B450M S2H
BASEBOARD_VERSION: x.x
DUMP_TYPE: 2
BUGCHECK_P1: 3
BUGCHECK_P2: fffffa0b877ad220
BUGCHECK_P3: fffffa0b877ad178
BUGCHECK_P4: 0
TRAP_FRAME: fffffa0b877ad220 -- (.trap 0xfffffa0b877ad220)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc3883e9ee2fc rbx=0000000000000000 rcx=0000000000000003
rdx=ffffc3883f614c48 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8075dd07b4b rsp=fffffa0b877ad3b0 rbp=0000000000000001
r8=0000000000000010 r9=0000000000000000 r10=0000000000000000
r11=fffffa0b877ad3d0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di ng nz ac po cy
nt!ExInterlockedRemoveHeadList+0x8b:
fffff807`5dd07b4b cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: fffffa0b877ad178 -- (.exr 0xfffffa0b877ad178)
ExceptionAddress: fffff8075dd07b4b (nt!ExInterlockedRemoveHeadList+0x000000000000008b)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: c
CPU_MHZ: e09
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 71
CPU_STEPPING: 0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: System
CURRENT_IRQL: 1
DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY
ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: DESKTOP-BKJR0DQ
ANALYSIS_SESSION_TIME: 03-18-2020 17:10:27.0437
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff8075ddd32e9 to fffff8075ddc14e0
STACK_TEXT:
fffffa0b`877acef8 fffff807`5ddd32e9 : 00000000`00000139 00000000`00000003 fffffa0b`877ad220 fffffa0b`877ad178 : nt!KeBugCheckEx
fffffa0b`877acf00 fffff807`5ddd3710 : 00000000`00000000 00003c77`baea8d38 ffffc388`451572c0 00000000`00000168 : nt!KiBugCheckDispatch+0x69
fffffa0b`877ad040 fffff807`5ddd1aa5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
fffffa0b`877ad220 fffff807`5dd07b4b : 00000000`00000000 00000000`00000000 ffffc388`3f614c58 ffffc388`3f614c48 : nt!KiRaiseSecurityCheckFailure+0x325
fffffa0b`877ad3b0 fffff807`6c2854a0 : ffffc388`3e9580a0 ffffc388`3f71e050 ffffc388`43011040 fffff807`6c2aa740 : nt!ExInterlockedRemoveHeadList+0x8b
fffffa0b`877ad3e0 ffffc388`3e9580a0 : ffffc388`3f71e050 ffffc388`43011040 fffff807`6c2aa740 00000000`00000000 : ts_arnusbx+0x54a0
fffffa0b`877ad3e8 ffffc388`3f71e050 : ffffc388`43011040 fffff807`6c2aa740 00000000`00000000 ffffc388`3e9ee947 : 0xffffc388`3e9580a0
fffffa0b`877ad3f0 ffffc388`43011040 : fffff807`6c2aa740 00000000`00000000 ffffc388`3e9ee947 ffffc388`4623a060 : 0xffffc388`3f71e050
fffffa0b`877ad3f8 fffff807`6c2aa740 : 00000000`00000000 ffffc388`3e9ee947 ffffc388`4623a060 fffff807`6c2ab183 : 0xffffc388`43011040
fffffa0b`877ad400 00000000`00000000 : ffffc388`3e9ee947 ffffc388`4623a060 fffff807`6c2ab183 ffffc388`3f602030 : ts_arnusbx+0x2a740
THREAD_SHA1_HASH_MOD_FUNC: cd5564cbc2438faf246a72b4590ed246d1abc777
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: b51cc2a7d2191a823ced7b3927e82888d6a8e669
THREAD_SHA1_HASH_MOD: e07e846e0fb23bd411f1f9358fee2afe7f81e9e6
FOLLOWUP_IP:
ts_arnusbx+54a0
fffff807`6c2854a0 4889442420 mov qword ptr [rsp+20h],rax
FAULT_INSTR_CODE: 24448948
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: ts_arnusbx+54a0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ts_arnusbx
IMAGE_NAME: ts_arnusbx.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 532c99ec
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 54a0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_ts_arnusbx!unknown_function
BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_ts_arnusbx!unknown_function
PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_ts_arnusbx!unknown_function
TARGET_TIME: 2020-03-17T15:05:20.000Z
OSBUILD: 18362
OSSERVICEPACK: 592
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1972-08-22 03:24:00
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 13f7f
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_ts_arnusbx!unknown_function
FAILURE_ID_HASH: {d62c5129-98fc-fe25-dee5-f04db3063a6c}
Followup: MachineOwner
---------
