*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000061941, The subtype of the bugcheck.
Arg2: 000000001c3d8580
Arg3: 000000000000000d
Arg4: ffffaf8b0f84cb00
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_61941
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: Discord.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
LAST_CONTROL_TRANSFER: from fffff80370473920 to fffff803703f4540
STACK_TEXT:
ffffaf8b`0f84c958 fffff803`70473920 : 00000000`0000001a 00000000`00061941 00000000`1c3d8580 00000000`0000000d : nt!KeBugCheckEx
ffffaf8b`0f84c960 fffff803`7040265e : ffffcc8a`13bf3080 00000000`00000001 ffffaf8b`0f84cb18 ffffffff`ffffd8f0 : nt!MmAccessFault+0x1897a0
ffffaf8b`0f84cb00 00000000`77aa558c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x35e
00000000`0dddf994 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77aa558c
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff803703966be-fffff803703966c1 4 bytes - nt!MiFreeUltraMapping+32
[ a0 7d fb f6:80 20 41 82 ]
4 errors : !nt (fffff803703966be-fffff803703966c1)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_large
FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c}
Followup: memory_corruption
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
VIDEO_TDR_FAILURE (116)
Attempt to reset the display driver and recover from timeout failed.
Arguments:
Arg1: ffff8586952e7460, Optional pointer to internal TDR recovery context (TDR_RECOVERY_CONTEXT).
Arg2: fffff80731cf1940, The pointer into responsible device driver module (e.g. owner tag).
Arg3: ffffffffc0000001, Optional error code (NTSTATUS) of the last failed operation.
Arg4: 0000000000000003, Optional internal context dependent data.
Debugging Details:
------------------
FAULTING_IP:
amdkmdag+b1940
fffff807`31cf1940 4889742420 mov qword ptr [rsp+20h],rsi
DEFAULT_BUCKET_ID: CODE_CORRUPTION
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x116
PROCESS_NAME: System
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
STACK_TEXT:
fffffb81`84efb9f8 fffff807`2d00128e : 00000000`00000116 ffff8586`952e7460 fffff807`31cf1940 ffffffff`c0000001 : nt!KeBugCheckEx
fffffb81`84efba00 fffff807`2cfa960b : fffff807`31cf1940 ffff8586`8cb6c000 ffff8586`8cb6c0f0 00000000`00000000 : dxgkrnl!TdrBugcheckOnTimeout+0xfe
fffffb81`84efba40 fffff807`2cfaa3de : ffff8586`00000101 00000000`00002000 ffff8586`8cb6c000 00000000`01000000 : dxgkrnl!DXGADAPTER::PrepareToReset+0x1a3
fffffb81`84efba90 fffff807`2d0009b5 : 00000000`00000100 ffff8586`8cb6ca50 00000000`9271a090 fffff807`31804d85 : dxgkrnl!DXGADAPTER::Reset+0x28e
fffffb81`84efbb10 fffff807`2d000b27 : fffff807`21b24440 ffff8586`9271a090 00000000`00000000 00000000`00000400 : dxgkrnl!TdrResetFromTimeout+0x15
fffffb81`84efbb40 fffff807`210c1f15 : ffff8586`96c6f040 fffff807`2d000b00 ffff8586`7fe8d300 00000000`00000000 : dxgkrnl!TdrResetFromTimeoutWorkItem+0x27
fffffb81`84efbb70 fffff807`21066dd5 : ffff8586`96c6f040 00000000`00000080 ffff8586`7fea8040 fffff807`210e1eb8 : nt!ExpWorkerThread+0x105
fffffb81`84efbc10 fffff807`211fb4f8 : ffffdd81`4f2a5180 ffff8586`96c6f040 fffff807`21066d80 fffffb81`84efbc80 : nt!PspSystemThreadStartup+0x55
fffffb81`84efbc60 00000000`00000000 : fffffb81`84efc000 fffffb81`84ef6000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
STACK_COMMAND: .bugcheck ; kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !FLTMGR
fffff8071cce5789-fffff8071cce578a 2 bytes - FLTMGR!FltpMeasureInitInstance+39
[ 48 ff:4c 8b ]
fffff8071cce5790-fffff8071cce5794 5 bytes - FLTMGR!FltpMeasureInitInstance+40 (+0x07)
[ 0f 1f 44 00 00:e8 5b b2 32 04 ]
fffff8071cce6ea9-fffff8071cce6eaa 2 bytes - FLTMGR!FltpMeasureFreeInstance+39 (+0x1719)
[ 48 ff:4c 8b ]
fffff8071cce6eb0-fffff8071cce6eb4 5 bytes - FLTMGR!FltpMeasureFreeInstance+40 (+0x07)
[ 0f 1f 44 00 00:e8 3b 9b 32 04 ]
14 errors : !FLTMGR (fffff8071cce5789-fffff8071cce6eb4)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_large
FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c}
Followup: memory_corruption
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffda3de06092ac, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: ffffda194f8c84f0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
ffffda3de06092ac
FAULTING_IP:
win32kbase!DirectComposition::CApplicationChannel::ConfirmFrame+0
ffffda19`4f8c84f0 8b817c010000 mov eax,dword ptr [rcx+17Ch]
MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: AV
PROCESS_NAME: dwm.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
TRAP_FRAME: fffff0039bf9c8d0 -- (.trap 0xfffff0039bf9c8d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffda194f8c84f0 rbx=0000000000000000 rcx=ffffda3d80609130
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=ffffda194f8c84f0 rsp=fffff0039bf9ca68 rbp=fffff0039bf9cb80
r8=0000000000000008 r9=0000000000000001 r10=0000ffffda194f8c
r11=ffff75fbc5a00000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe cy
win32kbase!DirectComposition::CApplicationChannel::ConfirmFrame:
ffffda19`4f8c84f0 8b817c010000 mov eax,dword ptr [rcx+17Ch] ds:ffffda3d`806092ac=0000062a
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80445479a57 to fffff804453f4540
STACK_TEXT:
fffff003`9bf9c628 fffff804`45479a57 : 00000000`00000050 ffffda3d`e06092ac 00000000`00000000 fffff003`9bf9c8d0 : nt!KeBugCheckEx
fffff003`9bf9c630 fffff804`452ea580 : fffff003`00000000 00000000`00000000 fffff003`9bf9c950 00000000`00000000 : nt!MiSystemFault+0x171627
fffff003`9bf9c730 fffff804`4540265e : ffffc88b`7c058a40 fffff804`459b1019 00000000`00000000 ffffc88b`7c058a10 : nt!MmAccessFault+0x400
fffff003`9bf9c8d0 ffffda19`4f8c84f0 : ffffda19`4f888e83 fffff003`9bf9cb80 00000000`00000000 ffffda3d`80609010 : nt!KiPageFault+0x35e
fffff003`9bf9ca68 ffffda19`4f888e83 : fffff003`9bf9cb80 00000000`00000000 ffffda3d`80609010 ffff9709`87202310 : win32kbase!DirectComposition::CApplicationChannel::ConfirmFrame
fffff003`9bf9ca70 ffffda19`507dea8d : 00000000`00000004 00000000`00000001 ffffda3d`80609010 ffffc88b`78e4af20 : win32kbase!NtDCompositionConfirmFrame+0x233
fffff003`9bf9cad0 fffff804`45405eb8 : ffff9709`84c5c080 ffff9709`84c5c080 0000024c`361d1568 00000000`00000020 : win32k!NtDCompositionConfirmFrame+0x15
fffff003`9bf9cb00 00007ff9`f84e3464 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000ab`2de1f148 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`f84e3464
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32kbase
ffffda194f831b17-ffffda194f831b1c 6 bytes - win32kbase!DirectComposition::CResourceMarshaler::EmitCreationCommand+57
[ ff 15 b3 c4 24 00:e8 84 c7 2a 00 90 ]
ffffda194f867ff0-ffffda194f867ff1 2 bytes - win32kbase!DirectComposition::CChannel::Initialize+40 (+0x364d9)
[ 48 ff:4c 8b ]
ffffda194f867ff7-ffffda194f867ffa 4 bytes - win32kbase!DirectComposition::CChannel::Initialize+47 (+0x07)
[ 0f 1f 44 00:e8 24 64 27 ]
ffffda194f86805a-ffffda194f86805b 2 bytes - win32kbase!DirectComposition::CBatchSharedMemoryPoolSet::SetRetrievingProcess+2a (+0x63)
[ 48 ff:4c 8b ]
ffffda194f868061-ffffda194f868064 4 bytes - win32kbase!DirectComposition::CBatchSharedMemoryPoolSet::SetRetrievingProcess+31 (+0x07)
[ 0f 1f 44 00:e8 ba 63 27 ]
ffffda194f86807f-ffffda194f868080 2 bytes - win32kbase!DirectComposition::CBatchSharedMemoryPoolSet::SetRetrievingProcess+4f (+0x1e)
[ 48 ff:4c 8b ]
ffffda194f868086-ffffda194f868089 4 bytes - win32kbase!DirectComposition::CBatchSharedMemoryPoolSet::SetRetrievingProcess+56 (+0x07)
[ 0f 1f 44 00:e8 95 63 27 ]
ffffda194f86b710-ffffda194f86b715 6 bytes - win32kbase!CitpGetForegroundWindowInfo+28 (+0x368a)
[ ff 15 ba 28 21 00:e8 8b 2b 27 00 90 ]
ffffda194f86b75b-ffffda194f86b760 6 bytes - win32kbase!CitpGetForegroundWindowInfo+73 (+0x4b)
[ ff 15 6f 28 21 00:e8 40 2b 27 00 90 ]
ffffda194f8883cc-ffffda194f8883d1 6 bytes - win32kbase!DirectComposition::CApplicationChannel::CompleteDisconnection+7c (+0x1cc71)
[ ff 15 fe 5b 1f 00:e8 cf 5e 25 00 90 ]
ffffda194f88867a-ffffda194f88867b 2 bytes - win32kbase!DirectComposition::CApplicationChannel::Shutdown+1a (+0x2ae)
[ 48 ff:4c 8b ]
ffffda194f888681-ffffda194f888684 4 bytes - win32kbase!DirectComposition::CApplicationChannel::Shutdown+21 (+0x07)
[ 0f 1f 44 00:e8 9a 5d 25 ]
ffffda194f88868b-ffffda194f88868c 2 bytes - win32kbase!DirectComposition::CApplicationChannel::Shutdown+2b (+0x0a)
[ 48 ff:4c 8b ]
ffffda194f888692-ffffda194f888695 4 bytes - win32kbase!DirectComposition::CApplicationChannel::Shutdown+32 (+0x07)
[ 0f 1f 44 00:e8 89 5d 25 ]
ffffda194f8886b2-ffffda194f8886b3 2 bytes - win32kbase!DirectComposition::CApplicationChannel::Shutdown+52 (+0x20)
[ 48 ff:4c 8b ]
ffffda194f8886b9-ffffda194f8886bc 4 bytes - win32kbase!DirectComposition::CApplicationChannel::Shutdown+59 (+0x07)
[ 0f 1f 44 00:e8 62 5d 25 ]
ffffda194f8886be-ffffda194f8886bf 2 bytes - win32kbase!DirectComposition::CApplicationChannel::Shutdown+5e (+0x05)
[ 48 ff:4c 8b ]
ffffda194f8886c5-ffffda194f8886c8 4 bytes - win32kbase!DirectComposition::CApplicationChannel::Shutdown+65 (+0x07)
[ 0f 1f 44 00:e8 56 5d 25 ]
ffffda194f8886dd-ffffda194f8886e2 6 bytes - win32kbase!DirectComposition::CApplicationChannel::Shutdown+7d (+0x18)
[ ff 15 ed 58 1f 00:e8 be 5b 25 00 90 ]
ffffda194f888757-ffffda194f888758 2 bytes - win32kbase!DirectComposition::CApplicationChannel::Shutdown+f7 (+0x7a)
[ 48 ff:4c 8b ]
ffffda194f88875e-ffffda194f88875f 2 bytes - win32kbase!DirectComposition::CApplicationChannel::Shutdown+fe (+0x07)
[ 0f 1f:e8 bd ]
ffffda194f888e83 - win32kbase!NtDCompositionConfirmFrame+233 (+0x725)
[ 00:90 ]
ffffda194f888e97-ffffda194f888e98 2 bytes - win32kbase!NtDCompositionConfirmFrame+247 (+0x14)
[ 48 ff:4c 8b ]
ffffda194f888e9e-ffffda194f888ea1 4 bytes - win32kbase!NtDCompositionConfirmFrame+24e (+0x07)
[ 0f 1f 44 00:e8 7d 55 25 ]
ffffda194f888ea3-ffffda194f888ea4 2 bytes - win32kbase!NtDCompositionConfirmFrame+253 (+0x05)
[ 48 ff:4c 8b ]
ffffda194f888eaa-ffffda194f888ead 4 bytes - win32kbase!NtDCompositionConfirmFrame+25a (+0x07)
[ 0f 1f 44 00:e8 71 55 25 ]
ffffda194f888eec-ffffda194f888eed 2 bytes - win32kbase!NtDCompositionConfirmFrame+29c (+0x42)
[ 48 ff:4c 8b ]
ffffda194f888ef3-ffffda194f888ef6 4 bytes - win32kbase!NtDCompositionConfirmFrame+2a3 (+0x07)
[ 0f 1f 44 00:e8 28 55 25 ]
ffffda194f888ef8-ffffda194f888ef9 2 bytes - win32kbase!NtDCompositionConfirmFrame+2a8 (+0x05)
[ 48 ff:4c 8b ]
ffffda194f888eff-ffffda194f888f02 4 bytes - win32kbase!NtDCompositionConfirmFrame+2af (+0x07)
[ 0f 1f 44 00:e8 1c 55 25 ]
ffffda194f888f1a-ffffda194f888f1b 2 bytes - win32kbase!NtDCompositionConfirmFrame+2ca (+0x1b)
[ 48 ff:4c 8b ]
ffffda194f888f21-ffffda194f888f24 4 bytes - win32kbase!NtDCompositionConfirmFrame+2d1 (+0x07)
[ 0f 1f 44 00:e8 fa 54 25 ]
ffffda194f88eaea-ffffda194f88eaeb 2 bytes - win32kbase!DirectComposition::CApplicationChannel::UnlockAndUnreference+3a (+0x5bc9)
[ 48 ff:4c 8b ]
ffffda194f88eaf1-ffffda194f88eaf4 4 bytes - win32kbase!DirectComposition::CApplicationChannel::UnlockAndUnreference+41 (+0x07)
[ 0f 1f 44 00:e8 2a f9 24 ]
ffffda194f88eaf6-ffffda194f88eaf7 2 bytes - win32kbase!DirectComposition::CApplicationChannel::UnlockAndUnreference+46 (+0x05)
[ 48 ff:4c 8b ]
ffffda194f88eafd-ffffda194f88eb00 4 bytes - win32kbase!DirectComposition::CApplicationChannel::UnlockAndUnreference+4d (+0x07)
[ 0f 1f 44 00:e8 1e f9 24 ]
ffffda194f88eb73-ffffda194f88eb74 2 bytes - win32kbase!GreDecLockCount+13 (+0x76)
[ 48 ff:4c 8b ]
ffffda194f88eb7a-ffffda194f88eb7d 4 bytes - win32kbase!GreDecLockCount+1a (+0x07)
[ 0f 1f 44 00:e8 a1 f8 24 ]
ffffda194f88eb8a-ffffda194f88eb8b 2 bytes - win32kbase!GreDecLockCount+2a (+0x10)
[ 48 ff:4c 8b ]
ffffda194f88eb91-ffffda194f88eb94 4 bytes - win32kbase!GreDecLockCount+31 (+0x07)
[ 0f 1f 44 00:e8 8a f8 24 ]
ffffda194f8a8d2a-ffffda194f8a8d2b 2 bytes - win32kbase!MarkImmersiveProcess+5a (+0x1a199)
[ 48 ff:4c 8b ]
ffffda194f8a8d31-ffffda194f8a8d34 4 bytes - win32kbase!MarkImmersiveProcess+61 (+0x07)
[ 0f 1f 44 00:e8 ea 56 23 ]
ffffda194f8a8d3e-ffffda194f8a8d3f 2 bytes - win32kbase!MarkImmersiveProcess+6e (+0x0d)
[ 48 ff:4c 8b ]
ffffda194f8a8d45-ffffda194f8a8d48 4 bytes - win32kbase!MarkImmersiveProcess+75 (+0x07)
[ 0f 1f 44 00:e8 d6 56 23 ]
ffffda194f8a8d96-ffffda194f8a8d97 2 bytes - win32kbase!MarkImmersiveProcess+c6 (+0x51)
[ 48 ff:4c 8b ]
ffffda194f8a8d9d-ffffda194f8a8da0 4 bytes - win32kbase!MarkImmersiveProcess+cd (+0x07)
[ 0f 1f 44 00:e8 7e 56 23 ]
ffffda194f8a8da6-ffffda194f8a8da7 2 bytes - win32kbase!MarkImmersiveProcess+d6 (+0x09)
[ 48 ff:4c 8b ]
ffffda194f8a8dad-ffffda194f8a8db0 4 bytes - win32kbase!MarkImmersiveProcess+dd (+0x07)
[ 0f 1f 44 00:e8 6e 56 23 ]
ffffda194f8c4ff8-ffffda194f8c4ff9 2 bytes - win32kbase!DirectComposition::CApplicationChannel::CompleteReconnection+78 (+0x1c24b)
[ 48 ff:4c 8b ]
ffffda194f8c4fff-ffffda194f8c5002 4 bytes - win32kbase!DirectComposition::CApplicationChannel::CompleteReconnection+7f (+0x07)
[ 0f 1f 44 00:e8 1c 94 21 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output.
313 errors : !win32kbase (ffffda194f831b17-ffffda194f9dd5bc)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_large
FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c}
Followup: memory_corruption
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffc03adc721f1, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8064bae6430, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
fffffc03adc721f1
FAULTING_IP:
nt!MiObtainReferencedVadEx+1d0
fffff806`4bae6430 0fb64b21 movzx ecx,byte ptr [rbx+21h]
MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: AV
PROCESS_NAME: Discord.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
TRAP_FRAME: ffffe2803ff05590 -- (.trap 0xffffe2803ff05590)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000004221f rbx=0000000000000000 rcx=000000000004221f
rdx=ffff8c03ae437080 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8064bae6430 rsp=ffffe2803ff05720 rbp=ffffe2803ff05860
r8=ffffe2803ff05730 r9=0000000055640000 r10=0000000000001000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!MiObtainReferencedVadEx+0x1d0:
fffff806`4bae6430 0fb64b21 movzx ecx,byte ptr [rbx+21h] ds:00000000`00000021=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8064bc86729 to fffff8064bbf3ea0
STACK_TEXT:
ffffe280`3ff052e8 fffff806`4bc86729 : 00000000`00000050 fffffc03`adc721f1 00000000`00000000 ffffe280`3ff05590 : nt!KeBugCheckEx
ffffe280`3ff052f0 fffff806`4baeeb80 : ffffe280`3ff05480 00000000`00000000 ffffe280`3ff05610 00000000`00000000 : nt!MiSystemFault+0x13faf9
ffffe280`3ff053f0 fffff806`4bc0205e : 0000007f`fffffff8 00000000`00000000 ffffabc9`9df6cdc3 00000000`00000000 : nt!MmAccessFault+0x400
ffffe280`3ff05590 fffff806`4bae6430 : ffffe280`3ff057b9 fffff806`00000000 ffffe280`00000000 ffffe280`3ff059e0 : nt!KiPageFault+0x35e
ffffe280`3ff05720 fffff806`4bedc27a : 00000000`2b700004 00000000`00000002 00000000`00040001 ffffe280`3ff059e0 : nt!MiObtainReferencedVadEx+0x1d0
ffffe280`3ff05760 fffff806`4beeb7eb : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`0050e3d0 : nt!MiAllocateVirtualMemory+0x17a
ffffe280`3ff058e0 fffff806`4bc058b8 : ffffffff`ffffffff ffff8c03`ab8a2080 00000000`00000000 00000000`0050e378 : nt!NtAllocateVirtualMemory+0x1ab
ffffe280`3ff05a90 00007ffe`ecdec0c4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`0050e358 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`ecdec0c4
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff8064baf1f92-fffff8064baf1f93 2 bytes - nt!MiCompletePrivateZeroFault+52
[ 80 f6:00 80 ]
fffff8064bb963ae-fffff8064bb963b1 4 bytes - nt!MiFreeUltraMapping+32 (+0xa441c)
[ a0 7d fb f6:00 20 40 80 ]
fffff8064bc867dd-fffff8064bc867de 2 bytes - nt!MiSystemFault+13fbad (+0xf042f)
[ 80 f6:00 80 ]
fffff8064bc867f3-fffff8064bc867f4 2 bytes - nt!MiSystemFault+13fbc3 (+0x16)
[ ff f6:7f 80 ]
10 errors : !nt (fffff8064baf1f92-fffff8064bc867f4)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_large
FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c}
Followup: memory_corruption
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffff800885e517b0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80270cca753, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
ffff800885e517b0
FAULTING_IP:
Ntfs!NtfsFcbTableCompare+3
fffff802`70cca753 498b10 mov rdx,qword ptr [r8]
MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: AV
PROCESS_NAME: TiWorker.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
TRAP_FRAME: ffff8788429df7e0 -- (.trap 0xffff8788429df7e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80270cca750 rbx=0000000000000000 rcx=ffffbd86192c36c0
rdx=ffff8788429dfa80 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80270cca753 rsp=ffff8788429df978 rbp=0000000000000008
r8=ffff800885e517b0 r9=000100000005168e r10=0000fffff80270cc
r11=ffff887c1be00000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po cy
Ntfs!NtfsFcbTableCompare+0x3:
fffff802`70cca753 498b10 mov rdx,qword ptr [r8] ds:ffff8008`85e517b0=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8026b879a57 to fffff8026b7f4540
STACK_TEXT:
ffff8788`429df538 fffff802`6b879a57 : 00000000`00000050 ffff8008`85e517b0 00000000`00000000 ffff8788`429df7e0 : nt!KeBugCheckEx
ffff8788`429df540 fffff802`6b6ea580 : ffffbd86`1286ab00 00000000`00000000 ffff8788`429df860 00000000`00000000 : nt!MiSystemFault+0x171627
ffff8788`429df640 fffff802`6b80265e : ffffe008`99334800 ffffe008`8cd7d3f0 00000000`00000000 ffffcf09`b2340018 : nt!MmAccessFault+0x400
ffff8788`429df7e0 fffff802`70cca753 : fffff802`6b634b23 00000000`00000000 00000000`00000000 00010000`0005168e : nt!KiPageFault+0x35e
ffff8788`429df978 fffff802`6b634b23 : 00000000`00000000 00000000`00000000 00010000`0005168e ffff8788`429dfb74 : Ntfs!NtfsFcbTableCompare+0x3
ffff8788`429df980 fffff802`70c8d9b4 : 00010000`0005168e ffffcf09`b2340101 ffff8788`429dfb74 00000000`00000000 : nt!RtlLookupElementGenericTableFullAvl+0x53
ffff8788`429df9b0 fffff802`70cac88d : ffffbd86`24fa1018 ffffbd86`192c3180 00000000`00000000 00010000`0005168e : Ntfs!NtfsCreateFcb+0xd4
ffff8788`429dfaf0 fffff802`70cc0612 : ffffbd86`24fa1018 ffffe008`9c0d97c0 ffffe008`99334800 ffff8788`429e0190 : Ntfs!NtfsOpenFile+0x27d
ffff8788`429dfda0 fffff802`70cbc17b : ffffbd86`241db360 ffff8788`429e0190 ffffbd86`241db360 00000000`00000000 : Ntfs!NtfsCommonCreate+0xf52
ffff8788`429e0080 fffff802`6b6cd7f5 : ffffbd86`192c3030 ffffbd86`241db360 ffff8788`429e0300 ffffbd86`28b3e5f0 : Ntfs!NtfsFsdCreate+0x1db
ffff8788`429e0300 fffff802`6aa96ccf : ffffbd86`28b3e500 ffff8788`429e03f0 ffff8788`429e03f9 fffff802`6aa95b37 : nt!IofCallDriver+0x55
ffff8788`429e0340 fffff802`6aacbbd4 : ffff8788`429e03f0 ffffbd86`28b3e648 ffffbd86`191edd10 00000000`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffff8788`429e03b0 fffff802`6b6cd7f5 : 00000000`00000000 ffffbd86`28b3e688 00000000`00000000 00000000`00000000 : FLTMGR!FltpCreate+0x324
ffff8788`429e0460 fffff802`6b6cede4 : 00000000`00000003 ffffbd86`191edd10 00000000`6d4e6f49 fffff802`6b6cea13 : nt!IofCallDriver+0x55
ffff8788`429e04a0 fffff802`6bac29bc : ffff8788`429e0760 ffffbd86`28b3e688 ffffbd86`28b3e5f0 ffffbd86`00000000 : nt!IoCallDriverWithTracing+0x34
ffff8788`429e04f0 fffff802`6baebcbe : ffffbd86`191338f0 00000000`00000000 ffffbd86`24fa19c0 ffffbd86`24fa1901 : nt!IopParseDevice+0x6ac
ffff8788`429e0660 fffff802`6baf4f7a : ffffbd86`24fa1900 ffff8788`429e08c8 ffffbd86`00000040 ffffbd86`128af0c0 : nt!ObpLookupObjectName+0x3fe
ffff8788`429e0830 fffff802`6b9ff52f : ffffffff`00000000 0000002a`67f7b6e0 00000000`00000000 00000000`00000001 : nt!ObOpenObjectByNameEx+0x1fa
ffff8788`429e0960 fffff802`6b9ff109 : 0000002a`67f7b488 00000000`00000000 0000002a`67f7b6e0 0000002a`67f7b740 : nt!IopCreateFile+0x40f
ffff8788`429e0a00 fffff802`6b805eb8 : 00000000`0000a300 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateFile+0x79
ffff8788`429e0a90 00007ffa`0236c834 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000002a`67f7ad88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`0236c834
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !FLTMGR
fffff8026aa948fa-fffff8026aa948fb 2 bytes - FLTMGR!FltpDispatch+ca
[ 48 ff:4c 8b ]
fffff8026aa94901-fffff8026aa94904 4 bytes - FLTMGR!FltpDispatch+d1 (+0x07)
[ 0f 1f 44 00:e8 9a 8e c3 ]
fffff8026aa95baf-fffff8026aa95bb0 2 bytes - FLTMGR!FltpPassThroughInternal+13f (+0x12ae)
[ 48 ff:4c 8b ]
fffff8026aa95bb6-fffff8026aa95bb9 4 bytes - FLTMGR!FltpPassThroughInternal+146 (+0x07)
[ 0f 1f 44 00:e8 c5 4b be ]
fffff8026aa96d06-fffff8026aa96d07 2 bytes - FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+2c6 (+0x1150)
[ 48 ff:4c 8b ]
fffff8026aa96d0d-fffff8026aa96d10 4 bytes - FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+2cd (+0x07)
[ 0f 1f 44 00:e8 6e 64 c2 ]
fffff8026aa97889-fffff8026aa9788e 6 bytes - FLTMGR!FltpPerformFastIoCall+5f9 (+0xb7c)
[ ff 15 91 b1 02 00:e8 12 7a 06 00 90 ]
fffff8026aa9aad4-fffff8026aa9aad5 2 bytes - FLTMGR!FltSendMessage+74 (+0x324b)
[ 48 ff:4c 8b ]
fffff8026aa9aadb-fffff8026aa9aade 4 bytes - FLTMGR!FltSendMessage+7b (+0x07)
[ 0f 1f 44 00:e8 30 4e c9 ]
fffff8026aa9aaf9-fffff8026aa9aafa 2 bytes - FLTMGR!FltSendMessage+99 (+0x1e)
[ 48 ff:4c 8b ]
fffff8026aa9ab00-fffff8026aa9ab03 4 bytes - FLTMGR!FltSendMessage+a0 (+0x07)
[ 0f 1f 44 00:e8 4b ea c3 ]
fffff8026aa9ab0e-fffff8026aa9ab0f 2 bytes - FLTMGR!FltSendMessage+ae (+0x0e)
[ 48 ff:4c 8b ]
fffff8026aa9ab15-fffff8026aa9ab18 4 bytes - FLTMGR!FltSendMessage+b5 (+0x07)
[ 0f 1f 44 00:e8 76 08 c4 ]
fffff8026aa9b9fd-fffff8026aa9b9fe 2 bytes - FLTMGR!FltpSynchronizedOperationCompletion+d (+0xee8)
[ 48 ff:4c 8b ]
fffff8026aa9ba04-fffff8026aa9ba07 4 bytes - FLTMGR!FltpSynchronizedOperationCompletion+14 (+0x07)
[ 0f 1f 44 00:e8 c7 90 c2 ]
fffff8026aa9ba2b-fffff8026aa9ba2c 2 bytes - FLTMGR!FltReleasePushLockEx+b (+0x27)
[ 48 ff:4c 8b ]
fffff8026aa9ba32-fffff8026aa9ba35 4 bytes - FLTMGR!FltReleasePushLockEx+12 (+0x07)
[ 0f 1f 44 00:e8 99 fc c3 ]
fffff8026aa9ba37-fffff8026aa9ba38 2 bytes - FLTMGR!FltReleasePushLockEx+17 (+0x05)
[ 48 ff:4c 8b ]
fffff8026aa9ba3e-fffff8026aa9ba41 4 bytes - FLTMGR!FltReleasePushLockEx+1e (+0x07)
[ 0f 1f 44 00:e8 ad 01 c4 ]
fffff8026aa9bccd-fffff8026aa9bcce 2 bytes - FLTMGR!FltpAddMessageWaiter+8d (+0x28f)
[ 48 ff:4c 8b ]
fffff8026aa9bcd4-fffff8026aa9bcd7 4 bytes - FLTMGR!FltpAddMessageWaiter+94 (+0x07)
[ 0f 1f 44 00:e8 27 c1 bd ]
fffff8026aacb9a4-fffff8026aacb9a5 2 bytes - FLTMGR!FltpCreate+f4
[ 48 ff:4c 8b ]
fffff8026aacb9ab-fffff8026aacb9ae 4 bytes - FLTMGR!FltpCreate+fb (+0x07)
[ 0f 1f 44 00:e8 c0 86 c1 ]
fffff8026aacbc34-fffff8026aacbc35 2 bytes - FLTMGR!FltpCreate+384 (+0x289)
[ 48 ff:4c 8b ]
fffff8026aacbc3b-fffff8026aacbc3e 4 bytes - FLTMGR!FltpCreate+38b (+0x07)
[ 0f 1f 44 00:e8 70 99 ff ]
fffff8026aacbc4c-fffff8026aacbc4d 2 bytes - FLTMGR!FltpCreate+39c (+0x11)
[ 48 ff:4c 8b ]
fffff8026aacbc53-fffff8026aacbc56 4 bytes - FLTMGR!FltpCreate+3a3 (+0x07)
[ 0f 1f 44 00:e8 a8 7c fa ]
fffff8026aaccd05-fffff8026aaccd06 2 bytes - FLTMGR!DeleteStreamListCtrlCallback+35 (+0x10b2)
[ 48 ff:4c 8b ]
fffff8026aaccd0c-fffff8026aaccd0f 4 bytes - FLTMGR!DeleteStreamListCtrlCallback+3c (+0x07)
[ 0f 1f 44 00:e8 df df b9 ]
fffff8026aaccd1a-fffff8026aaccd1b 2 bytes - FLTMGR!DeleteStreamListCtrlCallback+4a (+0x0e)
[ 48 ff:4c 8b ]
fffff8026aaccd21-fffff8026aaccd24 4 bytes - FLTMGR!DeleteStreamListCtrlCallback+51 (+0x07)
[ 0f 1f 44 00:e8 ba f6 c0 ]
fffff8026aaccd6a-fffff8026aaccd6b 2 bytes - FLTMGR!DeleteStreamListCtrlCallback+9a (+0x49)
[ 48 ff:4c 8b ]
fffff8026aaccd71-fffff8026aaccd74 4 bytes - FLTMGR!DeleteStreamListCtrlCallback+a1 (+0x07)
[ 0f 1f 44 00:e8 ba ee c0 ]
fffff8026aaccd76-fffff8026aaccd77 2 bytes - FLTMGR!DeleteStreamListCtrlCallback+a6 (+0x05)
[ 48 ff:4c 8b ]
fffff8026aaccd7d-fffff8026aaccd80 4 bytes - FLTMGR!DeleteStreamListCtrlCallback+ad (+0x07)
[ 0f 1f 44 00:e8 ce d1 b4 ]
fffff8026aad5cdb-fffff8026aad5cdc 2 bytes - FLTMGR!FltpTxVolWaitForCommitFinalize+1b (+0x8f5e)
[ 48 ff:4c 8b ]
fffff8026aad5ce2-fffff8026aad5ce5 4 bytes - FLTMGR!FltpTxVolWaitForCommitFinalize+22 (+0x07)
[ 0f 1f 44 00:e8 f9 8d c0 ]
114 errors : !FLTMGR (fffff8026aa948fa-fffff8026aad5ce5)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_large
FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c}
Followup: memory_corruption
---------