BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000046, Attempt to free an invalid pool address
Arg2: 0800000000000000, Starting address
Arg3: 0000000000000000, 0
Arg4: 0000000000000000, 0
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 8328
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 25071
Key : Analysis.Init.CPU.mSec
Value: 983
Key : Analysis.Init.Elapsed.mSec
Value: 2052
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: c2
BUGCHECK_P1: 46
BUGCHECK_P2: 800000000000000
BUGCHECK_P3: 0
BUGCHECK_P4: 0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: avp.exe
STACK_TEXT:
fffffd06`eaa52b48 fffff800`6d38e1a3 : 00000000`000000c2 00000000`00000046 08000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffffd06`eaa52b50 fffff800`6d38e218 : 00000000`00000016 fffffd06`eaa53350 08000000`00000000 fffff800`6da54518 : nt!RtlpHeapHandleError+0x2b
fffffd06`eaa52b90 fffff800`6d38de45 : fffffd06`eaa52c60 fffff800`6da54518 00000000`00000000 00008008`00000100 : nt!RtlpHpHeapHandleError+0x58
fffffd06`eaa52bc0 fffff800`6d22cf54 : fffffd06`eaa52c60 ffffc08c`b9010280 00000000`0000016d fffffd06`eaa52c98 : nt!RtlpLogHeapFailure+0x45
fffffd06`eaa52bf0 fffff800`6d0dae4a : fffffd06`eaa52d78 08000000`00000000 00000000`00000000 00000000`000015c0 : nt!RtlpHpVaMgrCtxQuery+0x1d2984
fffffd06`eaa52c30 fffff800`6d089824 : fffffd06`eaa534f0 00000100`10000000 00000000`00000000 00000000`00000000 : nt!RtlpHpQueryVA+0x42
fffffd06`eaa52c90 fffff800`6d7b3149 : fffffd06`000015d0 00000000`00000000 00000000`00000000 01000000`00100000 : nt!ExFreeHeapPool+0x764
fffffd06`eaa52d70 fffff800`6d60e2d1 : fffffd06`eaa534f0 00000000`00000000 ffffc08c`cb6e1080 00000000`00000000 : nt!ExFreePool+0x9
fffffd06`eaa52da0 fffff800`6d41552e : 00000000`ca854000 00000000`00000000 00000000`ca854000 00000000`0804e720 : nt!PspDeleteCreateProcessContext+0x15ce0d
fffffd06`eaa52dd0 fffff800`6d2088b8 : 00000000`0804fda0 00000000`1730a000 00000000`00000000 00000000`0804e7c8 : nt!NtCreateUserProcess+0xf8e
fffffd06`eaa53a90 00007ffb`55dee714 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`0804e428 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`55dee714
SYMBOL_NAME: nt!PspDeleteCreateProcessContext+15ce0d
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1110
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 15ce0d
FAILURE_BUCKET_ID: 0xc2_46_nt!PspDeleteCreateProcessContext
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {6554b88e-0527-51e2-b5e7-b55b9d958f9a}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff838e782267e0, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffff838e78226738, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 8140
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 21504
Key : Analysis.Init.CPU.mSec
Value: 1203
Key : Analysis.Init.Elapsed.mSec
Value: 2379
Key : Analysis.Memory.CommitPeak.Mb
Value: 76
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffff838e782267e0
BUGCHECK_P3: ffff838e78226738
BUGCHECK_P4: 0
TRAP_FRAME: ffff838e782267e0 -- (.trap 0xffff838e782267e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffdc88ff14d420 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000080000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80483e4c75b rsp=ffff838e78226970 rbp=fffff80484850a11
r8=ffffdc890a921f20 r9=0000000000000003 r10=fffff1800b55d350
r11=ffff838e78226980 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!MiRemoveUnusedSubsection+0x83:
fffff804`83e4c75b cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff838e78226738 -- (.exr 0xffff838e78226738)
ExceptionAddress: fffff80483e4c75b (nt!MiRemoveUnusedSubsection+0x0000000000000083)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffff838e`782264b8 fffff804`84008e69 : 00000000`00000139 00000000`00000003 ffff838e`782267e0 ffff838e`78226738 : nt!KeBugCheckEx
ffff838e`782264c0 fffff804`84009290 : fffff804`83f26de0 fffff804`83f23b90 00000000`00000030 ffffb301`5e6f6180 : nt!KiBugCheckDispatch+0x69
ffff838e`78226600 fffff804`84007623 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffff838e`782267e0 fffff804`83e4c75b : fffff804`84850a80 fffff180`00000000 00000000`00000001 ffffb301`5e4c7180 : nt!KiRaiseSecurityCheckFailure+0x323
ffff838e`78226970 fffff804`83f2d130 : ffffdc88`ff14d350 fffff804`84850a11 00000000`00000000 8a000002`05362963 : nt!MiRemoveUnusedSubsection+0x83
ffff838e`782269a0 fffff804`83ef6e2b : dc88ff14`d3d004c0 fffff804`84850a80 00000000`00000000 fffff180`060fa260 : nt!MiDereferenceControlAreaPfnList+0x140
ffff838e`782269f0 fffff804`83f82bd8 : dc88ff14`d3d004c0 fffff180`082a82f0 00000000`00000001 00000000`00000002 : nt!MiRestoreTransitionPte+0x2cb
ffff838e`78226a60 fffff804`83f824c0 : fffff804`84850a80 00000000`00000000 00000000`00002000 fffff804`84851518 : nt!MiRemoveLowestPriorityStandbyPage+0x648
ffff838e`78226b00 fffff804`83f81d58 : ffffdc88`ed8c2880 00000000`00000007 ffffdc88`00000000 ffffdc88`ed8ba1c0 : nt!MiPurgePartitionStandby+0x4c
ffff838e`78226b40 fffff804`83eb8515 : ffffdc89`00086080 fffff804`83f81d10 ffffdc88`ed86abb0 ffffdc89`00000000 : nt!MiFinishResume+0x48
ffff838e`78226b70 fffff804`83f55875 : ffffdc89`00086080 00000000`00000080 ffffdc88`ed892040 00000000`00000000 : nt!ExpWorkerThread+0x105
ffff838e`78226c10 fffff804`83ffe578 : ffffb301`5e7c0180 ffffdc89`00086080 fffff804`83f55820 00000000`00000246 : nt!PspSystemThreadStartup+0x55
ffff838e`78226c60 00000000`00000000 : ffff838e`78227000 ffff838e`78221000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!KiFastFailDispatch+d0
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1110
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}
Followup: MachineOwner
---------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000034, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80435747671, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 10890
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 49308
Key : Analysis.Init.CPU.mSec
Value: 1046
Key : Analysis.Init.Elapsed.mSec
Value: 2303
Key : Analysis.Memory.CommitPeak.Mb
Value: 75
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: a
BUGCHECK_P1: 34
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff80435747671
READ_ADDRESS: fffff804360fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000034
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1081_none_7e3d47227c69
TRAP_FRAME: ffff860b22333380 -- (.trap 0xffff860b22333380)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=ffffab07aac57fb8
rdx=ffffab07aac57fb0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80435747671 rsp=ffff860b22333510 rbp=ffffab07aad35d70
r8=ffff860b22333618 r9=ffff860b22333614 r10=ffffbd5eaf57a7f8
r11=ffffbd5eaf57a000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiGetImageProtoProtection+0x51:
fffff804`35747671 8b4b34 mov ecx,dword ptr [rbx+34h] ds:00000000`00000034=????????
Resetting default scope
STACK_TEXT:
ffff860b`22333238 fffff804`35808e69 : 00000000`0000000a 00000000`00000034 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffff860b`22333240 fffff804`35805169 : 00004000`0000001c 00000000`00000000 fffff804`00000001 00000000`00000001 : nt!KiBugCheckDispatch+0x69
ffff860b`22333380 fffff804`35747671 : 00000000`00000000 ffff988a`835f8700 ffffbd5e`9ffef110 ffff860b`223336c0 : nt!KiPageFault+0x469
ffff860b`22333510 fffff804`356b2b68 : 00000000`00000380 ffffab07`aad35d70 ffffbd3f`fde22e38 ab07aad3`5d700400 : nt!MiGetImageProtoProtection+0x51
ffff860b`22333540 fffff804`356b1565 : 00000000`00000000 00000000`00000000 ffff860b`22333618 ffff860b`22333614 : nt!MiGetPageProtection+0x6a8
ffff860b`223335c0 fffff804`3564b92f : 00000000`00000000 00007ffb`c4591000 988a835f`8050f31d 00000000`001fffff : nt!MiQueryAddressState+0x4b5
ffff860b`223337d0 fffff804`359ffc0c : ffff860b`22330000 00000000`00000000 ffff988a`00000000 ffff988a`00000000 : nt!MiQueryAddressSpan+0xcf
ffff860b`22333890 fffff804`359ff3b5 : ffff860b`22333aa8 fffff804`359ea64b ffff988a`831b0080 00000061`e3c77fd8 : nt!MmQueryVirtualMemory+0x83c
ffff860b`22333a40 fffff804`358088b8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtQueryVirtualMemory+0x25
ffff860b`22333a90 00007ffb`c462d284 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000061`e3c78408 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`c462d284
SYMBOL_NAME: nt!MiGetImageProtoProtection+51
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.1110
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 51
FAILURE_BUCKET_ID: AV_nt!MiGetImageProtoProtection
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {7b3c290c-72a7-7f7b-53ac-dca820030305}
Followup: MachineOwner
---------
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8070e1e7d46, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 13140
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 33113
Key : Analysis.Init.CPU.mSec
Value: 999
Key : Analysis.Init.Elapsed.mSec
Value: 2111
Key : Analysis.Memory.CommitPeak.Mb
Value: 76
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 1e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8070e1e7d46
BUGCHECK_P3: 0
BUGCHECK_P4: ffffffffffffffff
READ_ADDRESS: fffff8070e8fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff
EXCEPTION_PARAMETER2: ffffffffffffffff
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Registry
STACK_TEXT:
fffff206`8ef00418 fffff807`0e059c05 : 00000000`0000001e ffffffff`c0000005 fffff807`0e1e7d46 00000000`00000000 : nt!KeBugCheckEx
fffff206`8ef00420 fffff807`0e008fac : 00000000`00000100 00000000`00000000 ffffbd89`a34fa44c fffff206`8ef00ce0 : nt!KiDispatchException+0x174395
fffff206`8ef00ae0 fffff807`0e004ce0 : 00000000`0000090d 00000000`00000000 00000000`00001001 00000000`00000fff : nt!KiExceptionDispatch+0x12c
fffff206`8ef00cc0 fffff807`0e1e7d46 : ffffcd8b`9728d000 00000000`000016a8 ffffcd8b`ab5ad760 fffff807`0e1f0c24 : nt!KiGeneralProtectionFault+0x320
fffff206`8ef00e50 fffff807`0e1e785b : 00000000`13c1cbb0 fffff206`8ef011f0 ffffcd8b`ab5ad760 fffff807`0e1e6a5c : nt!CmpFindKcbInHashEntryByName+0x62
fffff206`8ef00ea0 fffff807`0e1ec739 : 00000000`ffffffff 00000000`13c1cbb0 00000000`00000000 00000000`00000000 : nt!CmpCreateKeyControlBlock+0x6b
fffff206`8ef00f10 fffff807`0e1efa19 : ffffcd8b`ab5ad760 00000000`00000002 fffff206`8ef01110 fffff206`8ef01170 : nt!CmpWalkOneLevel+0x639
fffff206`8ef01010 fffff807`0e1ee303 : fffff206`0000001c fffff206`8ef01360 fffff206`8ef01318 ffffbd89`b29462a0 : nt!CmpDoParseKey+0x849
fffff206`8ef012b0 fffff807`0e1f23ce : fffff807`0e1ee001 00000000`00000000 ffffbd89`b29462a0 fffff807`0e00ef00 : nt!CmpParseKey+0x2c3
fffff206`8ef01450 fffff807`0e29433a : ffffbd89`b2946200 fffff206`8ef016b8 fffff206`00000240 ffffbd89`a34fa400 : nt!ObpLookupObjectName+0x3fe
fffff206`8ef01620 fffff807`0e29411c : 00000000`00000000 00000000`00000000 00000000`00000000 ffffbd89`a34fa400 : nt!ObOpenObjectByNameEx+0x1fa
fffff206`8ef01750 fffff807`0e293c41 : fffff206`8ef01c20 fffff206`8ef01ac0 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByName+0x5c
fffff206`8ef017a0 fffff807`0e29396f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CmOpenKey+0x2c1
fffff206`8ef01a00 fffff807`0e0088b8 : 00000000`00000000 00000000`00000000 ffff397b`afac0c9f 00000000`00000000 : nt!NtOpenKeyEx+0xf
fffff206`8ef01a40 fffff807`0dffad80 : fffff807`0e1e1dca 00000000`00000004 ffffcd8b`972becb0 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
fffff206`8ef01bd8 fffff807`0e1e1dca : 00000000`00000004 ffffcd8b`972becb0 00000000`00000000 00000000`00000010 : nt!KiServiceLinkage
fffff206`8ef01be0 fffff807`0e1e1cfa : 00000000`00000000 ffffffff`800000e0 ffffcd8b`af578a4c ffffcd8b`af578a4c : nt!_RegRtlOpenKeyTransacted+0xba
fffff206`8ef01c80 fffff807`0e1e2f01 : 00000000`00000086 fffff206`8ef01d40 00000000`000000f0 00000000`00000000 : nt!SysCtxRegOpenKey+0x3a
fffff206`8ef01cc0 fffff807`0e1e18db : 00000000`00000000 ffffcd8b`972becb0 fffff807`0000005d 00000000`00000000 : nt!_CmOpenDeviceRegKeyWorker+0x1b9
fffff206`8ef01d80 fffff807`0e1e06ce : 00000000`00000000 fffff206`8ef01ee0 fffff206`8ef020a4 fffff206`8ef020b0 : nt!_CmOpenDeviceRegKey+0xef
fffff206`8ef01de0 fffff807`0e1e054b : 00000000`00000000 00000000`000000ff fffff206`8ef020d0 fffff206`8ef020a8 : nt!_CmGetDeviceRegPropWorker+0x102
fffff206`8ef01f30 fffff807`0e34d20d : fffff206`8ef02450 00000000`00000000 ffffcd8b`a38bd4ec fffff206`00000000 : nt!_CmGetDeviceRegProp+0xff
fffff206`8ef02040 fffff807`0e2f5eb9 : ffffbd89`ba13d6d0 fffff807`0de07d6b ffffbd89`ba13d080 ffffcd8b`985c58c0 : nt!PiPnpRtlServiceFilterCallback+0xcd
fffff206`8ef02180 fffff807`0e2c379b : fffff807`0e2c3760 fffff206`8ef022c9 00000000`00000001 fffff807`0e1db09e : nt!PiDmCmObjectMatchCallback+0x29
fffff206`8ef021c0 fffff807`0e1d8b25 : ffffcd8b`985c58c0 00000000`00000000 fffff206`8ef022c9 fffff807`0e843be0 : nt!PiDmGetObjectListCallback+0x3b
fffff206`8ef02210 fffff807`0e2c5cef : fffff206`8ef02420 00000000`00000140 00000000`00000001 01000000`00100000 : nt!PiDmEnumObjectsWithCallback+0x10d
fffff206`8ef02330 fffff807`0e2c5c92 : 00000000`00000000 fffff206`8ef02449 00000000`00000000 00000000`00000000 : nt!PiDmGetObjectList+0x4f
fffff206`8ef02380 fffff807`0e2c57f6 : ffffbd89`ba13d080 ffffcd8b`badba300 00000000`00000000 00000000`000007ec : nt!PiDmGetCmObjectListFromCache+0x46
fffff206`8ef023e0 fffff807`0e1d944f : 00000000`00000000 00000000`00000000 fffff206`8ef02680 00000000`c0000002 : nt!PiPnpRtlGetFilteredDeviceList+0x17a
fffff206`8ef024b0 fffff807`0e2f6b73 : 00000000`00000000 00000000`00000000 ffffffff`ffffffff fffff206`8ef027b0 : nt!PiPnpRtlCmActionCallback+0x1ff
fffff206`8ef02620 fffff807`0e2f69a9 : 00000000`00000000 fffff206`8ef02700 00000000`00000000 fffff206`8ef02799 : nt!_CmGetMatchingFilteredDeviceList+0xc3
fffff206`8ef02740 fffff807`0e1d82ac : fffff206`8ef02968 00000080`041feab8 00000000`00000018 00000000`00000000 : nt!PiCMGetDeviceIdList+0x145
fffff206`8ef027f0 fffff807`0e1d8163 : fffff206`8ef02940 00000000`00000016 00000000`00470803 fffff807`0e1f5bee : nt!PiCMHandleIoctl+0x12c
fffff206`8ef02830 fffff807`0e2ee2aa : 00000000`00470803 fffff807`0e2ee240 00000000`00000008 fffff807`0de0afca : nt!PiCMFastIoDeviceDispatch+0x53
fffff206`8ef02880 fffff807`0e274bf2 : 00000000`00470803 ffffffff`fffffffe 00000000`00000000 ffffbd89`ad803b70 : nt!PiDaFastIoDispatch+0x6a
fffff206`8ef028e0 fffff807`0e274856 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x382
fffff206`8ef02a20 fffff807`0e0088b8 : 00000000`00000c18 00000080`041fe901 00000080`041fea58 ffffffff`00000000 : nt!NtDeviceIoControlFile+0x56
fffff206`8ef02a90 00007ff8`55d6cf04 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000080`041fe9a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`55d6cf04
SYMBOL_NAME: nt!CmpFindKcbInHashEntryByName+62
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1110
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 62
FAILURE_BUCKET_ID: 0x1E_c0000005_R_nt!CmpFindKcbInHashEntryByName
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {ed301492-4858-6f72-c2ea-10b394f00a63}
Followup: MachineOwner
---------