*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff850805be9970, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff850805be98c8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: System manufacturer
SYSTEM_PRODUCT_NAME: System Product Name
SYSTEM_SKU: SKU
SYSTEM_VERSION: System Version
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 1820
BIOS_DATE: 09/12/2019
BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.
BASEBOARD_PRODUCT: TUF B450-PLUS GAMING
BASEBOARD_VERSION: Rev X.0x
DUMP_TYPE: 2
BUGCHECK_P1: 3
BUGCHECK_P2: ffff850805be9970
BUGCHECK_P3: ffff850805be98c8
BUGCHECK_P4: 0
TRAP_FRAME: ffff850805be9970 -- (.trap 0xffff850805be9970)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000003
rdx=ffff8788c83e8090 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8024340ebc5 rsp=ffff850805be9b00 rbp=fffff8024319eab0
r8=ffffffffffffff80 r9=0000000000000002 r10=0000000000000003
r11=000000000000001d r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe nc
nt!PopFreeHiberContext+0xea495:
fffff802`4340ebc5 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff850805be98c8 -- (.exr 0xffff850805be98c8)
ExceptionAddress: fffff8024340ebc5 (nt!PopFreeHiberContext+0x00000000000ea495)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: c
CPU_MHZ: d42
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 8
CPU_STEPPING: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: System
CURRENT_IRQL: 0
DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY
ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 11-16-2019 18:57:05.0232
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff80242dd30e9 to fffff80242dc1220
STACK_TEXT:
ffff8508`05be9648 fffff802`42dd30e9 : 00000000`00000139 00000000`00000003 ffff8508`05be9970 ffff8508`05be98c8 : nt!KeBugCheckEx
ffff8508`05be9650 fffff802`42dd3510 : ffffaf80`00007000 00000000`00000000 fffff802`4306a480 00000000`00000010 : nt!KiBugCheckDispatch+0x69
ffff8508`05be9790 fffff802`42dd18a5 : 00000000`000001d0 00000000`00000001 00000000`000004a0 ffff8788`cbb734e0 : nt!KiFastFailDispatch+0xd0
ffff8508`05be9970 fffff802`4340ebc5 : fffff802`4319eab0 00000000`00000000 00000000`00000000 fffff802`00000000 : nt!KiRaiseSecurityCheckFailure+0x325
ffff8508`05be9b00 fffff802`4319eb1f : ffffffff`80002098 ffff8788`c81c4040 ffff8788`c275b9e0 fffff802`42d33620 : nt!PopFreeHiberContext+0xea495
ffff8508`05be9b40 fffff802`42cbd465 : ffff8788`c275b9e0 ffff8788`c81c4000 ffff8788`c275b900 fffff802`44f8f1b0 : nt!PopUnlockAfterSleepWorker+0x6f
ffff8508`05be9b70 fffff802`42d2a725 : ffff8788`c81c4040 00000000`00000080 ffff8788`c268b2c0 00000067`b4bbbdff : nt!ExpWorkerThread+0x105
ffff8508`05be9c10 fffff802`42dc886a : ffff9a80`03b40180 ffff8788`c81c4040 fffff802`42d2a6d0 ffff8788`c8194de8 : nt!PspSystemThreadStartup+0x55
ffff8508`05be9c60 00000000`00000000 : ffff8508`05bea000 ffff8508`05be4000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a
THREAD_SHA1_HASH_MOD_FUNC: 30e249f83ca26ab27e6f7974b36c20c4e7905a68
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 3ef93ef1e723c61d357c6c728b6df7e24878a9c2
THREAD_SHA1_HASH_MOD: 9f457f347057f10e1df248e166a3e95e6570ecfe
FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff802`42dd3510 c644242000 mov byte ptr [rsp+20h],0
FAULT_INSTR_CODE: 202444c6
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiFastFailDispatch+d0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
TARGET_TIME: 2019-11-16T15:36:34.000Z
OSBUILD: 18362
OSSERVICEPACK: 418
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 4182
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_nt!kifastfaildispatch
FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8004c5caa4a, Address of the instruction which caused the bugcheck
Arg3: ffffbd89b830fe90, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: System manufacturer
SYSTEM_PRODUCT_NAME: System Product Name
SYSTEM_SKU: SKU
SYSTEM_VERSION: System Version
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 1820
BIOS_DATE: 09/12/2019
BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.
BASEBOARD_PRODUCT: TUF B450-PLUS GAMING
BASEBOARD_VERSION: Rev X.0x
DUMP_TYPE: 2
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff8004c5caa4a
BUGCHECK_P3: ffffbd89b830fe90
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!ObDereferenceSecurityDescriptor+aa
fffff800`4c5caa4a 488b01 mov rax,qword ptr [rcx]
CONTEXT: ffffbd89b830fe90 -- (.cxr 0xffffbd89b830fe90)
rax=0000000000000000 rbx=ffffd70315250ec0 rcx=0000000000000000
rdx=fffff8004c58f730 rsi=000000000000000d rdi=00000000fffffff3
rip=fffff8004c5caa4a rsp=ffffbd89b8310880 rbp=fffff8004c58f730
r8=ffffbd89b8310888 r9=7fff8586ecf32d80 r10=7ffffffffffffffc
r11=ffffd7030e3347a0 r12=ffffd703109f44a0 r13=0000000000000000
r14=ffffd70308741b40 r15=ffff8586ece26080
iopl=0 nv up ei pl nz na pe cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050203
nt!ObDereferenceSecurityDescriptor+0xaa:
fffff800`4c5caa4a 488b01 mov rax,qword ptr [rcx] ds:002b:00000000`00000000=????????????????
Resetting default scope
BUGCHECK_STR: 0x3B_c0000005
CPU_COUNT: c
CPU_MHZ: d42
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 8
CPU_STEPPING: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 11-16-2019 18:57:10.0032
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff8004c5ca6d5 to fffff8004c5caa4a
STACK_TEXT:
ffffbd89`b8310880 fffff800`4c5ca6d5 : ffffbd89`b8310900 ffffd703`15250ee0 ffff8586`ecf32da0 00000000`000000e8 : nt!ObDereferenceSecurityDescriptor+0xaa
ffffbd89`b83108c0 fffff800`4c5cb034 : ffffe773`000000c4 ffffd703`109f44a0 00000000`00000000 00000000`00000000 : nt!ObSetSecurityDescriptorInfo+0x115
ffffbd89`b8310930 fffff800`4c5cc299 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SeDefaultObjectMethod+0x104
ffffbd89`b8310990 fffff800`4c6ebb5d : 00000000`00000000 fffff800`00000004 000000d7`00000001 00000250`e3842d40 : nt!ObSetSecurityObjectByPointer+0x89
ffffbd89`b83109f0 fffff800`4c1d2b18 : 00000000`000001a8 ffff8586`ece26080 00000000`00000000 ffff8586`ece19f01 : nt!NtSetSecurityObject+0x17d
ffffbd89`b8310b00 00007ffc`c0cdf4d4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000d7`9c37eba8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`c0cdf4d4
THREAD_SHA1_HASH_MOD_FUNC: dfe48a0f6bedce3893da019a65494d77f0049710
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 949e74fa2a1de6fad89d03cd19ef663b9a2882a3
THREAD_SHA1_HASH_MOD: ee8fcf1fb60cb6e3e2f60ddbed2ec02b5748a693
FOLLOWUP_IP:
nt!ObDereferenceSecurityDescriptor+aa
fffff800`4c5caa4a 488b01 mov rax,qword ptr [rcx]
FAULT_INSTR_CODE: 4c018b48
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ObDereferenceSecurityDescriptor+aa
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .cxr 0xffffbd89b830fe90 ; kb
BUCKET_ID_FUNC_OFFSET: aa
FAILURE_BUCKET_ID: 0x3B_c0000005_nt!ObDereferenceSecurityDescriptor
BUCKET_ID: 0x3B_c0000005_nt!ObDereferenceSecurityDescriptor
PRIMARY_PROBLEM_CLASS: 0x3B_c0000005_nt!ObDereferenceSecurityDescriptor
TARGET_TIME: 2019-11-16T15:38:56.000Z
OSBUILD: 18362
OSSERVICEPACK: 418
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 3805
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x3b_c0000005_nt!obdereferencesecuritydescriptor
FAILURE_ID_HASH: {17944f04-ac36-d743-91bc-bc40359b9425}
Followup: MachineOwner
---------