MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: ffff9780a0d23038
Arg3: 0000000002000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 5
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 8
Key : Analysis.Memory.CommitPeak.Mb
Value: 67
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: ffff9780a0d23038
BUGCHECK_P3: 2000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: MsMpEng.exe
STACK_TEXT:
ffff8880`8d486e28 fffff806`1c6502b8 : 00000000`0000001a 00000000`00041792 ffff9780`a0d23038 00000000`02000000 : nt!KeBugCheckEx
ffff8880`8d486e30 fffff806`1c4e3d07 : 00000000`00000000 ffff9780`a0d23038 00000000`00000000 00000000`00000000 : nt!MiDeleteVa+0x16a7b8
ffff8880`8d486f40 fffff806`1c4e41c1 : ffff8880`8d487390 ffff97cb`c0506918 00000000`00000000 0a000000`658ee867 : nt!MiWalkPageTablesRecursively+0x1e7
ffff8880`8d487000 fffff806`1c4e41c1 : ffff8880`8d487390 ffff97cb`e5e02830 00000000`00000000 0a000002`3352b867 : nt!MiWalkPageTablesRecursively+0x6a1
ffff8880`8d4870c0 fffff806`1c4e41c1 : ffff8880`8d487390 ffff97cb`e5f2f010 ffff97cb`00000000 0a000002`3352a867 : nt!MiWalkPageTablesRecursively+0x6a1
ffff8880`8d487180 fffff806`1c4e394c : ffff8880`8d487390 00000000`00000000 ffffd282`00000000 ffffd282`61533080 : nt!MiWalkPageTablesRecursively+0x6a1
ffff8880`8d487240 fffff806`1c4e1db8 : ffff8880`8d487390 ffffffff`00000002 ffff8880`00000001 fffff806`00000000 : nt!MiWalkPageTables+0x36c
ffff8880`8d487340 fffff806`1c4eff10 : ffffffff`ffffffff ffffd282`615333f8 00000000`00000001 00000000`00000000 : nt!MiDeletePagablePteRange+0x268
ffff8880`8d4876e0 fffff806`1ca79a0d : 00000000`00000000 00000000`141a3cb0 ffffd282`6d950780 00000000`00000000 : nt!MiDeleteVad+0x860
ffff8880`8d4878a0 fffff806`1ca79803 : ffffd282`6d950780 00000000`00000000 00000141`a3cb0000 00000000`00000000 : nt!MiUnmapVad+0x49
ffff8880`8d4878d0 fffff806`1ca79699 : ffffd282`61533080 ffffc283`00000008 ffffd282`6149d7a0 00000000`00000000 : nt!MiUnmapViewOfSection+0x133
ffff8880`8d4879b0 fffff806`1c5d3c15 : ffffd282`6b46a080 00000141`a3cb0000 ffff8880`8d487a80 ffffd282`61533080 : nt!NtUnmapViewOfSectionEx+0x99
ffff8880`8d487a00 00007ffa`0bd7f924 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0000003b`3e4ff538 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`0bd7f924
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000343b2, page frame number
Arg3: 0000000000000002, current page state
Arg4: 04000030000343b1, 0
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 7
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 7
Key : Analysis.Memory.CommitPeak.Mb
Value: 66
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 4e
BUGCHECK_P1: 99
BUGCHECK_P2: 343b2
BUGCHECK_P3: 2
BUGCHECK_P4: 4000030000343b1
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: WerFault.exe
STACK_TEXT:
ffffdf86`2aa8e9b8 fffff802`7d84a091 : 00000000`0000004e 00000000`00000099 00000000`000343b2 00000000`00000002 : nt!KeBugCheckEx
ffffdf86`2aa8e9c0 fffff802`7d6af33f : 1a000000`66a00867 ffffdf86`2aa8f6c0 ffffdf86`2aa8ea81 00002000`00000200 : nt!MiDecrementShareCount+0x16fed1
ffffdf86`2aa8ea00 fffff802`7d6f32fb : ffffdf86`2aa8ee10 ffffcf87`81f61080 00000000`00000001 ffffdf86`2aa8f6c0 : nt!MiDeletePteList+0x55f
ffffdf86`2aa8eae0 fffff802`7dc945cd : 00000000`00000040 ffffdf86`2aa8f780 00000226`4f7ba168 00000000`00000000 : nt!MiDecommitPages+0x153b
ffffdf86`2aa8f680 fffff802`7dc94b1b : 00000000`000c8000 00000000`00000000 ffffdf86`2aa8f960 ffffffff`ffffffff : nt!MiDecommitRegion+0xbd
ffffdf86`2aa8f860 fffff802`7dc9480b : 00000000`00000000 000000db`bf7a9298 ffff9369`61bcc8b8 00000000`00000004 : nt!MmFreeVirtualMemory+0x2db
ffffdf86`2aa8f9a0 fffff802`7d7d3c15 : ffffcf87`815a6080 ffffdf86`2aa8fa80 00007ff9`1404b280 00000000`00000008 : nt!NtFreeVirtualMemory+0x8b
ffffdf86`2aa8fa00 00007ff9`2931c434 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000db`bf7a9218 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`2931c434
SYMBOL_NAME: nt!MiDecrementShareCount+16fed1
MODULE_NAME: nt
IMAGE_VERSION: 10.0.18362.836
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 16fed1
FAILURE_BUCKET_ID: 0x4E_99_nt!MiDecrementShareCount
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {add373c4-2fe4-723e-d1db-12fcb6adef02}
Followup: MachineOwner
---------
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffe78fad2878d8, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8043fe013c9, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 10
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 13
Key : Analysis.Memory.CommitPeak.Mb
Value: 67
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffe78fad2878d8
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8043fe013c9
BUGCHECK_P4: 2
READ_ADDRESS: fffff8043fb733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8043fa2a3d8: Unable to get Flags value from nt!KdVersionBlock
fffff8043fa2a3d8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffe78fad2878d8
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Discord.exe
TRAP_FRAME: ffff818f46056fc0 -- (.trap 0xffff818f46056fc0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe78fad2878b8 rbx=0000000000000000 rcx=0000000000000011
rdx=01d638f7ab4ac835 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8043fe013c9 rsp=ffff818f46057150 rbp=ffff818f46057400
r8=ffff818f46057158 r9=7ffff8043fa65bf0 r10=fffff8043faf5010
r11=ffff818f46057288 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!CmpCallbackFillObjectContext+0x148c59:
fffff804`3fe013c9 48395020 cmp qword ptr [rax+20h],rdx ds:ffffe78f`ad2878d8=????????????????
Resetting default scope
STACK_TEXT:
ffff818f`46056d18 fffff804`3f82dd34 : 00000000`00000050 ffffe78f`ad2878d8 00000000`00000000 ffff818f`46056fc0 : nt!KeBugCheckEx
ffff818f`46056d20 fffff804`3f6c91af : 00000000`00000000 00000000`00000000 00000000`00000000 ffffe78f`ad2878d8 : nt!MiSystemFault+0x195c94
ffff818f`46056e20 fffff804`3f7d041e : 00000000`00000000 00000000`00000000 ffffe78f`d3494680 00000000`00000000 : nt!MmAccessFault+0x34f
ffff818f`46056fc0 fffff804`3fe013c9 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffe78f`d3494698 : nt!KiPageFault+0x35e
ffff818f`46057150 fffff804`3fcb8546 : ffff818f`46057340 ffffe78f`dfeca850 00000000`00000000 fffff804`3fa65c00 : nt!CmpCallbackFillObjectContext+0x148c59
ffff818f`46057180 fffff804`3fcbf470 : 00000000`0000000e ffff818f`46057340 00000000`00000000 00000000`00000001 : nt!CmpCallCallBacksEx+0x376
ffff818f`46057290 fffff804`3fcc06b1 : 00000000`00000000 ffffe78f`e9a52d10 00000000`00000000 01000000`00100000 : nt!CmpCallCallBacks+0x28
ffff818f`460572e0 fffff804`3fcc3c10 : 00000000`00000000 ffff830a`d44cb2a0 00000000`00000000 ffffe78f`ed287840 : nt!CmpDeleteKeyObject+0xb1
ffff818f`46057370 fffff804`3f713269 : 00000000`00000000 00000000`00000000 ffff818f`460574f9 ffffe78f`ed287870 : nt!ObpRemoveObjectRoutine+0x80
ffff818f`460573d0 fffff804`3fcb5f87 : 00000000`ffff8044 ffffe78f`ed287840 ffffe78f`ed287840 ffff830a`e5aa50a0 : nt!ObfDereferenceObjectWithTag+0xc9
ffff818f`46057410 fffff804`3fbf8bc5 : ffff830a`e55d5098 fffff804`3f70f43f ffff830a`e55d5060 ffff830a`da564080 : nt!ObCloseHandleTableEntry+0x2c7
ffff818f`46057550 fffff804`3fc6aecd : ffff830a`e55d5060 ffff830a`da564080 ffffffff`ffffff01 ffff830a`e5e5d380 : nt!ExSweepHandleTable+0xd5
ffff818f`46057600 fffff804`3fbde6d1 : ffffffff`ffffffff ffff830a`e5e5d080 ffff818f`46057650 ffff830a`00000000 : nt!ObKillProcess+0x35
ffff818f`46057630 fffff804`3fcd1943 : ffff830a`e5e5d080 ffffe78f`eb8ee7f0 ffff818f`46057859 00000000`00000000 : nt!PspRundownSingleProcess+0x131
ffff818f`460576b0 fffff804`3fccf223 : 00000000`c0000005 ffff830a`da564001 00000000`002db000 00000000`0000000f : nt!PspExitThread+0x60b
ffff818f`460577c0 fffff804`3f716e11 : ffff830a`da564180 00000000`00000001 00000000`00000000 00000000`00000100 : nt!KiSchedulerApcTerminate+0x33
ffff818f`46057800 fffff804`3f7c68f0 : ffff830a`da564001 ffff818f`460578c0 ffff830a`da564080 00000000`00000000 : nt!KiDeliverApc+0x481
ffff818f`460578c0 fffff804`3f7d3cbf : ffff830a`da564080 00000000`00000000 00000000`00000000 ffff830a`e28e3660 : nt!KiInitiateUserApc+0x70
ffff818f`46057a00 00000000`77471cbc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
00000000`0e0cebe8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77471cbc
SYMBOL_NAME: nt!CmpCallbackFillObjectContext+148c59
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.18362.836
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 148c59
FAILURE_BUCKET_ID: AV_R_INVALID_nt!CmpCallbackFillObjectContext
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {630defa1-411e-3bce-a58c-3aaefdbe9f0c}
Followup: MachineOwner
---------
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: ffffac80000034f8
Arg3: 0000000020000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 5
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 6
Key : Analysis.Memory.CommitPeak.Mb
Value: 66
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: ffffac80000034f8
BUGCHECK_P3: 20000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: WPSHWPBC.exe
STACK_TEXT:
ffff818e`de5f6d88 fffff803`3fe502b8 : 00000000`0000001a 00000000`00041792 ffffac80`000034f8 00000000`20000000 : nt!KeBugCheckEx
ffff818e`de5f6d90 fffff803`3fce3d07 : 00000000`00000000 ffffac80`000034f8 00000000`00000000 00000000`00000000 : nt!MiDeleteVa+0x16a7b8
ffff818e`de5f6ea0 fffff803`3fce41c1 : ffff818e`de5f72f0 ffffacd6`40000018 00000000`00000000 0a000000`657ff867 : nt!MiWalkPageTablesRecursively+0x1e7
ffff818e`de5f6f60 fffff803`3fce41c1 : ffff818e`de5f72f0 ffffacd6`6b200000 00000000`00000000 0a000002`2e36b867 : nt!MiWalkPageTablesRecursively+0x6a1
ffff818e`de5f7020 fffff803`3fce41c1 : ffff818e`de5f72f0 ffffacd6`6b359000 ffffacd6`00000000 0a000002`2e36a867 : nt!MiWalkPageTablesRecursively+0x6a1
ffff818e`de5f70e0 fffff803`3fce394c : ffff818e`de5f72f0 00000000`00000000 00000000`00000000 ffffbc09`6b403310 : nt!MiWalkPageTablesRecursively+0x6a1
ffff818e`de5f71a0 fffff803`3fce1db8 : ffff818e`de5f72f0 00000000`00000002 ffffbc09`00000001 00000000`00000000 : nt!MiWalkPageTables+0x36c
ffff818e`de5f72a0 fffff803`3fceff10 : ffffffff`ffffffff ffffbc09`68244438 ffff818e`00000001 00000000`00000000 : nt!MiDeletePagablePteRange+0x268
ffff818e`de5f7640 fffff803`3fd35b7a : 00000000`00000790 ffffbc09`682a6080 00000000`00000000 fffff803`3fceaeea : nt!MiDeleteVad+0x860
ffff818e`de5f7800 fffff803`40294bd0 : 00000000`00000000 00000000`00000000 ffff818e`de5f7960 ffffffff`ffffffff : nt!MiFreeVadRange+0x9e
ffff818e`de5f7860 fffff803`4029480b : 00000000`00000000 00000000`00000000 00000000`0102f300 00000000`00690000 : nt!MmFreeVirtualMemory+0x390
ffff818e`de5f79a0 fffff803`3fdd3c15 : ffffbc09`682a6080 00000000`0102f8c8 ffff818e`de5f7a18 ffffffff`ff676980 : nt!NtFreeVirtualMemory+0x8b
ffff818e`de5f7a00 00007ffc`b067c434 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`0102f318 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`b067c434
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: fffffa80002a8378
Arg3: 0000000002000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 4
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 6
Key : Analysis.Memory.CommitPeak.Mb
Value: 67
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: fffffa80002a8378
BUGCHECK_P3: 2000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: csgo.exe
STACK_TEXT:
fffffe0e`002e6df8 fffff801`666502b8 : 00000000`0000001a 00000000`00041792 fffffa80`002a8378 00000000`02000000 : nt!KeBugCheckEx
fffffe0e`002e6e00 fffff801`664e3d07 : 00000000`00000000 fffffa80`002a8378 00000000`00000000 00000000`00000000 : nt!MiDeleteVa+0x16a7b8
fffffe0e`002e6f10 fffff801`664e41c1 : fffffe0e`002e7360 fffffafd`40001540 00000000`00000000 0a000000`631dc867 : nt!MiWalkPageTablesRecursively+0x1e7
fffffe0e`002e6fd0 fffff801`664e41c1 : fffffe0e`002e7360 fffffafd`7ea00008 00000000`00000000 0a000002`181cb867 : nt!MiWalkPageTablesRecursively+0x6a1
fffffe0e`002e7090 fffff801`664e41c1 : fffffe0e`002e7360 fffffafd`7ebf5000 fffffafd`00000000 8a000001`bedb9867 : nt!MiWalkPageTablesRecursively+0x6a1
fffffe0e`002e7150 fffff801`664e394c : fffffe0e`002e7360 00000000`55001000 ffffc180`00000000 00000000`564cc7a0 : nt!MiWalkPageTablesRecursively+0x6a1
fffffe0e`002e7210 fffff801`664e1db8 : fffffe0e`002e7360 fffffafd`00000002 00000000`00000001 90000001`00000000 : nt!MiWalkPageTables+0x36c
fffffe0e`002e7310 fffff801`664eff10 : ffffffff`ffffffff ffffdc8c`628843f8 ffffdc8c`00000001 00000000`00000000 : nt!MiDeletePagablePteRange+0x268
fffffe0e`002e76b0 fffff801`66a79a0d : 00000000`00000000 ffffdc8c`621c0810 ffffdc8c`621c0810 00000000`00000000 : nt!MiDeleteVad+0x860
fffffe0e`002e7870 fffff801`66a79803 : ffffdc8c`613ebb00 00000000`00000000 00000000`55000000 00000000`00000000 : nt!MiUnmapVad+0x49
fffffe0e`002e78a0 fffff801`66a79699 : ffffdc8c`62884080 00000000`00000008 ffffdc8c`5649ec40 00000000`00000000 : nt!MiUnmapViewOfSection+0x133
fffffe0e`002e7980 fffff801`66a7938c : ffffdc8c`5fb60080 00007ffd`f94c4e01 00000000`000be000 ffffdc8c`62884080 : nt!NtUnmapViewOfSectionEx+0x99
fffffe0e`002e79d0 fffff801`665d3c15 : ffffdc8c`5fb60080 00000000`00000000 00000000`0101e000 00000000`54bee928 : nt!NtUnmapViewOfSection+0xc
fffffe0e`002e7a00 00007ffd`f9c3c5b4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`4d01e658 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`f9c3c5b4
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: ffffa001397aa2f0
Arg3: 0000000004000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 4
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 6
Key : Analysis.Memory.CommitPeak.Mb
Value: 66
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: ffffa001397aa2f0
BUGCHECK_P3: 4000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera_crashreporter.exe
STACK_TEXT:
fffff08b`743bee28 fffff806`162502b8 : 00000000`0000001a 00000000`00041792 ffffa001`397aa2f0 00000000`04000000 : nt!KeBugCheckEx
fffff08b`743bee30 fffff806`160e3d07 : 00000000`00000000 ffffa001`397aa2f0 00000000`00000000 00000000`00000000 : nt!MiDeleteVa+0x16a7b8
fffff08b`743bef40 fffff806`160e41c1 : fffff08b`743bf390 ffffa050`009cbd50 00000000`00000000 0a000000`655bb867 : nt!MiWalkPageTablesRecursively+0x1e7
fffff08b`743bf000 fffff806`160e41c1 : fffff08b`743bf390 ffffa050`28004e58 00000000`00000000 0a000001`6cb1f867 : nt!MiWalkPageTablesRecursively+0x6a1
fffff08b`743bf0c0 fffff806`160e41c1 : fffff08b`743bf390 ffffa050`28140020 ffffa050`00000000 8a000001`0711e867 : nt!MiWalkPageTablesRecursively+0x6a1
fffff08b`743bf180 fffff806`160e394c : fffff08b`743bf390 ffffbd84`429b4c48 00000000`00000000 00000000`00000008 : nt!MiWalkPageTablesRecursively+0x6a1
fffff08b`743bf240 fffff806`160e1db8 : fffff08b`743bf390 ffffdf86`00000002 ffffbd84`00000001 ffffbd84`00000000 : nt!MiWalkPageTables+0x36c
fffff08b`743bf340 fffff806`160eff10 : ffffffff`ffffffff ffffbd84`4199a3f8 bd846340`00000001 00000000`00000000 : nt!MiDeletePagablePteRange+0x268
fffff08b`743bf6e0 fffff806`16679a0d : 00000272`00000000 00000000`272f4e50 ffffbd84`43280d00 00000000`00000000 : nt!MiDeleteVad+0x860
fffff08b`743bf8a0 fffff806`16679803 : ffffbd84`43280d00 00000000`00000000 00000272`f4e50000 00000000`00000000 : nt!MiUnmapVad+0x49
fffff08b`743bf8d0 fffff806`16679699 : ffffbd84`4199a080 000000c3`00000008 ffffbd84`3649c220 00000000`00000000 : nt!MiUnmapViewOfSection+0x133
fffff08b`743bf9b0 fffff806`161d3c15 : ffffbd84`42cbf080 00000272`f4e50000 000000c3`682feea0 ffffbd84`4199a080 : nt!NtUnmapViewOfSectionEx+0x99
fffff08b`743bfa00 00007ff9`41fdf924 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000c3`682fe0a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`41fdf924
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 000000000000001d, Type of memory safety violation
Arg2: ffff8082fb8fef80, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff8082fb8feed8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 5
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 31
Key : Analysis.Memory.CommitPeak.Mb
Value: 68
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 139
BUGCHECK_P1: 1d
BUGCHECK_P2: ffff8082fb8fef80
BUGCHECK_P3: ffff8082fb8feed8
BUGCHECK_P4: 0
TRAP_FRAME: ffff8082fb8fef80 -- (.trap 0xffff8082fb8fef80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=000000000000001d
rdx=ffffa789f771af58 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8023f465c3b rsp=ffff8082fb8ff118 rbp=0000000000000059
r8=ffffa78a095eff58 r9=0000000000000000 r10=ffffa78a0cbaef58
r11=ffffa78a095eff58 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe cy
nt!RtlRbRemoveNode+0x148d3b:
fffff802`3f465c3b cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff8082fb8feed8 -- (.exr 0xffff8082fb8feed8)
ExceptionAddress: fffff8023f465c3b (nt!RtlRbRemoveNode+0x0000000000148d3b)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000000000000001d
Subcode: 0x1d FAST_FAIL_INVALID_BALANCED_TREE
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 000000000000001d
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffff8082`fb8fec58 fffff802`3f3d41e9 : 00000000`00000139 00000000`0000001d ffff8082`fb8fef80 ffff8082`fb8feed8 : nt!KeBugCheckEx
ffff8082`fb8fec60 fffff802`3f3d4610 : fffff802`3f668d80 fffff802`3f2cb1b6 ffff9048`24120000 ffffa789`faf81f68 : nt!KiBugCheckDispatch+0x69
ffff8082`fb8feda0 fffff802`3f3d29a3 : fffff280`0198f3f0 00000000`00000002 ffffa78a`07ca19d0 fffff802`3f2b334a : nt!KiFastFailDispatch+0xd0
ffff8082`fb8fef80 fffff802`3f465c3b : 00000059`00090000 0001019e`00590000 fffff802`3f31cd53 00000000`00000059 : nt!KiRaiseSecurityCheckFailure+0x323
ffff8082`fb8ff118 fffff802`3f31cd53 : 00000000`00000059 ffffa789`f771a9c0 00000000`00000000 ffffa789`f771af50 : nt!RtlRbRemoveNode+0x148d3b
ffff8082`fb8ff130 fffff802`3f31c73a : ffffa789`ed600280 ffffa789`ed600280 ffffa789`f8d0b9c0 ffff8082`fb8ff240 : nt!RtlpHpVsChunkCoalesce+0x183
ffff8082`fb8ff1a0 fffff802`3f31e9ad : ffffbc0f`00000062 fffff802`00000000 ffffbc0f`d544e600 ffffa789`00000000 : nt!RtlpHpVsContextFree+0x18a
ffff8082`fb8ff240 fffff802`3f56f019 : ffffbc0f`e142d360 fffff802`00000220 ffffbc0f`e14b7c50 01000000`00100000 : nt!ExFreeHeapPool+0x56d
ffff8082`fb8ff360 fffff802`410fedae : ffffbc0f`d544e600 ffffbc0f`e142d3c8 00000000`ffffbfff ffffa789`f9d8ed78 : nt!ExFreePool+0x9
ffff8082`fb8ff390 fffff802`410fddff : ffffa789`f9d8ed78 ffffbc0f`d54495a0 fffff802`00000000 00000000`00004000 : FLTMGR!FltReleaseFileNameInformation+0x12e
ffff8082`fb8ff3d0 fffff802`410c4fc9 : ffffbc0f`e142d360 ffffbc0f`00000000 ffffbc0f`ffff7fff 00000000`00008000 : FLTMGR!FltpRemoveAllNamesCachedForFileObject+0x1df
ffff8082`fb8ff450 fffff802`410c45a0 : ffff8082`fb8ff630 00000000`00000000 ffffbc0f`dd0b3902 00000000`00000400 : FLTMGR!FltpPerformPreCallbacks+0x869
ffff8082`fb8ff560 fffff802`410c4112 : ffffbc0f`dd0b39a0 ffff8082`fb8ff630 ffffbc0f`dd0b39a0 ffff8082`fb8ff640 : FLTMGR!FltpPassThroughInternal+0x90
ffff8082`fb8ff590 fffff802`410c3efe : ffffffff`fffe7960 ffffbc0f`d5261d60 00000000`00000000 00000000`00000080 : FLTMGR!FltpPassThrough+0x162
ffff8082`fb8ff610 fffff802`3f30a929 : ffffbc0f`e14b7c50 fffff802`3f241640 00000000`000018a3 00000000`000000ff : FLTMGR!FltpDispatch+0x9e
ffff8082`fb8ff670 fffff802`3f8b0ffd : ffffbc0f`e14b7c50 ffffbc0f`d54414d0 ffffbc0f`d5261d60 ffffbc0f`dd0b39a0 : nt!IofCallDriver+0x59
ffff8082`fb8ff6b0 fffff802`3f8c3c10 : ffffa789`fb287510 00000000`00000000 ffffbc0f`cf4ccae0 fffff802`3f30383f : nt!IopDeleteFile+0x12d
ffff8082`fb8ff730 fffff802`3f3119f4 : 00000000`00000000 00000000`00000000 ffffa789`fb287510 ffffbc0f`e14b7c50 : nt!ObpRemoveObjectRoutine+0x80
ffff8082`fb8ff790 fffff802`3f89e014 : 00000000`00000000 ffffbc0f`d8f28c30 ffffa789`fb287510 00000000`00000000 : nt!ObfDereferenceObject+0xa4
ffff8082`fb8ff7d0 fffff802`3f3626a7 : fffff802`00000001 fffff802`3f66a440 ffff8082`fb8ff8a0 ffffbc0f`d8f28c38 : nt!MiSegmentDelete+0x154
ffff8082`fb8ff820 fffff802`3f3900b9 : 00000000`00000000 fffff802`00000001 00000000`00000000 fffff802`3f66a440 : nt!MiProcessDereferenceList+0xc3
ffff8082`fb8ff8e0 fffff802`3f26bcd5 : ffffbc0f`d544e600 ffffbc0f`d544e600 00000000`00000080 fffff802`3f38ff90 : nt!MiDereferenceSegmentThread+0x129
ffff8082`fb8ffb10 fffff802`3f3c9998 : fffff802`3a67d180 ffffbc0f`d544e600 fffff802`3f26bc80 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff8082`fb8ffb60 00000000`00000000 : ffff8082`fb900000 ffff8082`fb8f9000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!ExFreePool+9
IMAGE_NAME: Pool_Corruption
IMAGE_VERSION: 10.0.18362.836
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 9
FAILURE_BUCKET_ID: 0x139_1d_INVALID_BALANCED_TREE_nt!ExFreePool
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {ab43366d-59cb-5971-8e17-b53398bf3f90}
Followup: Pool_corruption
---------
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000028660, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000002000028661, 0
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 6
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 9
Key : Analysis.Memory.CommitPeak.Mb
Value: 72
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 4e
BUGCHECK_P1: 99
BUGCHECK_P2: 28660
BUGCHECK_P3: 2
BUGCHECK_P4: 2000028661
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.18362.772_none_5f13f94c58ff4
STACK_TEXT:
ffff8887`7feff058 fffff807`3944a091 : 00000000`0000004e 00000000`00000099 00000000`00028660 00000000`00000002 : nt!KeBugCheckEx
ffff8887`7feff060 fffff807`39293c75 : ffffb684`205b8038 ffffb684`0000001f ffffb684`205b9011 00002000`686618c0 : nt!MiDecrementShareCount+0x16fed1
ffff8887`7feff0a0 fffff807`3988552f : ffffa283`4dc80000 ffffc78c`068ecd30 00000000`00000000 fffff807`39299800 : nt!MmUnmapViewInSystemCache+0x9f5
ffff8887`7feff1b0 fffff807`39292232 : 00000000`00780000 ffffb684`2f9d3700 ffffb684`2e9e4258 00000000`00000001 : nt!CcUnmapVacb+0x63
ffff8887`7feff1f0 fffff807`392d4c9b : 00000000`00800001 ffffb684`205139e0 00000000`00000000 00000000`00000001 : nt!CcUnmapVacbArray+0x202
ffff8887`7feff260 fffff807`3988f9a9 : 00000000`00000000 00000000`00000000 ffff8887`7feff3a0 ffff8887`7feff3b0 : nt!CcGetVirtualAddress+0x40b
ffff8887`7feff300 fffff807`392d4175 : 00000000`00000000 00000000`00800000 00000000`00400000 ffffb684`2b60d001 : nt!CcMapAndCopyFromCache+0x79
ffff8887`7feff3a0 fffff807`3f3ea54d : ffff8887`7feff4f0 00000000`00000000 ffffc78c`00400000 00000000`00400000 : nt!CcCopyReadEx+0x135
ffff8887`7feff440 fffff807`3d935f78 : 00000000`00000000 00000000`000002b0 ffffb684`303406c0 00000000`00000000 : Ntfs!NtfsCopyReadA+0x2ed
ffff8887`7feff730 fffff807`3d932fa3 : ffff8887`7feff820 00000000`00000000 00000000`00000000 ffffb684`2d7d1950 : FLTMGR!FltpPerformFastIoCall+0x198
ffff8887`7feff790 fffff807`3d96c7c5 : ffff8887`7feff8f8 ffff8887`7feffa80 ffffb684`2b60d080 ffffb684`303406c0 : FLTMGR!FltpPassThroughFastIo+0xd3
ffff8887`7feff7f0 fffff807`398af10f : ffffb684`303406c0 00000000`00000000 00000000`00000000 ffffb684`00000000 : FLTMGR!FltpFastIoRead+0x165
ffff8887`7feff8a0 fffff807`393d3c15 : 00000000`05d5ba79 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x39f
ffff8887`7feff990 00007ffa`480fc134 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0000008b`8557afd8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`480fc134
SYMBOL_NAME: nt!MiDecrementShareCount+16fed1
MODULE_NAME: nt
IMAGE_VERSION: 10.0.18362.836
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 16fed1
FAILURE_BUCKET_ID: 0x4E_99_nt!MiDecrementShareCount
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {add373c4-2fe4-723e-d1db-12fcb6adef02}
Followup: MachineOwner
---------
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8033320d4cc, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000040000090, Parameter 1 of the exception
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 5
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 7
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 1e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8033320d4cc
BUGCHECK_P3: 0
BUGCHECK_P4: 40000090
READ_ADDRESS: fffff803337733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8033362a3d8: Unable to get Flags value from nt!KdVersionBlock
fffff8033362a3d8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
0000000040000090
EXCEPTION_PARAMETER2: 0000000040000090
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffff800000000000 -- (.trap 0xffff800000000000)
Unable to read trap frame at ffff8000`00000000
STACK_TEXT:
ffff820b`cc745618 fffff803`3345ad71 : 00000000`0000001e ffffffff`c0000005 fffff803`3320d4cc 00000000`00000000 : nt!KeBugCheckEx
ffff820b`cc745620 fffff803`333d431d : fffff77b`bddee000 ffff820b`cc745eb0 ffff8000`00000000 00000000`40000090 : nt!KiDispatchException+0x15c681
ffff820b`cc745cd0 fffff803`333d0503 : ffff830a`d7fd3170 00000000`00000000 ffffad07`43f54ec0 fffff803`3331ff67 : nt!KiExceptionDispatch+0x11d
ffff820b`cc745eb0 fffff803`3320d4cc : 00000000`00000000 00000000`00000000 ffff830a`00000000 fffff803`34738a39 : nt!KiPageFault+0x443
ffff820b`cc746040 fffff803`3320d396 : ffffad07`43f54a90 00000000`00000000 ffff830a`00000000 00000000`00000000 : nt!FsRtlCheckOplockEx+0xfc
ffff820b`cc746160 fffff803`361eb32f : ffff830a`d7fe9aa0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!FsRtlCheckOplock+0x76
ffff820b`cc7461a0 fffff803`361eaa5d : 00000000`00000000 00000000`00000258 00000000`00000000 ffff820b`cc746660 : Ntfs!NtfsCommonCleanup+0x45f
ffff820b`cc7465f0 fffff803`3330a929 : ffffad07`43ca6010 fffff803`347345a0 ffffad07`43f54f08 ffffad07`3666a000 : Ntfs!NtfsFsdCleanup+0x1ad
ffff820b`cc746940 fffff803`347355de : ffffad07`43f54a90 ffffad07`44e29790 ffffad07`43f54a90 ffff820b`cc746a30 : nt!IofCallDriver+0x59
ffff820b`cc746980 fffff803`34733f16 : ffff820b`cc746a20 ffffad07`44e889a8 ffffad07`3a0db101 ffffad07`44e889ae : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
ffff820b`cc746a00 fffff803`3330a929 : ffffad07`44e29790 fffff803`3330a81d ffffad07`36002340 fffff803`3330e24c : FLTMGR!FltpDispatch+0xb6
ffff820b`cc746a60 fffff803`338ade08 : 00000000`00000000 ffffad07`44e29790 00000000`00000000 ffffad07`43f54a90 : nt!IofCallDriver+0x59
ffff820b`cc746aa0 fffff803`338b5f38 : 00000000`00000000 00000000`00000001 ffff820b`cc746be8 00000000`00007fff : nt!IopCloseFile+0x188
ffff820b`cc746b30 fffff803`338bb27e : 00000000`0000101c fffff803`333119f4 00000000`00000000 00000000`00000000 : nt!ObCloseHandleTableEntry+0x278
ffff820b`cc746c70 fffff803`333d3c15 : 00000000`00100081 ffff820b`cc746d88 ffff820b`cc746d60 00000000`00000000 : nt!NtClose+0xde
ffff820b`cc746ce0 fffff803`333c61b0 : fffff803`347737f0 ffff820b`cc746ed0 ffff820b`cc746ef8 ffff820b`cc746f00 : nt!KiSystemServiceCopyEnd+0x25
ffff820b`cc746e78 fffff803`347737f0 : ffff820b`cc746ed0 ffff820b`cc746ef8 ffff820b`cc746f00 00000000`00000002 : nt!KiServiceLinkage
ffff820b`cc746e80 fffff803`350afc2b : ffff820b`cc746ec8 ffff820b`cc746f50 ffff830a`d7a57780 00000000`00000000 : FLTMGR!FltClose+0x10
ffff820b`cc746eb0 fffff803`3509db43 : 00000000`00000000 ffffad07`44e29790 ffffffff`8000101c 00000000`00000000 : Wof!FileProvCbLocateGenerateContext+0x13b
ffff820b`cc746ef0 fffff803`3509d6fc : ffffad07`43f0c7e8 ffffad07`43f0c7e8 ffffad07`43f0c700 ffff820b`cc747010 : Wof!WofCreateOpenContext+0x327
ffff820b`cc746fc0 fffff803`34733c03 : ffffad07`43f0c700 ffffad07`3cc88010 00000000`00000000 00000000`00000000 : Wof!WofPostCreateCallback+0x5bc
ffff820b`cc7470e0 fffff803`34733408 : 00000000`00000000 00000000`00000000 ffffad07`44e27b70 00000000`00000000 : FLTMGR!FltpPerformPostCallbacks+0x3e3
ffff820b`cc7471b0 fffff803`34735680 : 00000000`00000000 fffff803`3474c470 00000000`00000008 ffffad07`43f0c700 : FLTMGR!FltpPassThroughCompletionWorker+0x128
ffff820b`cc747230 fffff803`3476cd27 : ffff820b`cc7472f0 00000000`00000120 00000000`00000000 00000000`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x200
ffff820b`cc7472b0 fffff803`3330a929 : 00000000`00000000 fffff803`338af705 00000000`00000000 00000000`00000000 : FLTMGR!FltpCreate+0x307
ffff820b`cc747360 fffff803`333099e4 : 00000000`00000003 00000000`00000000 00000000`00000000 fffff803`3330a1a3 : nt!IofCallDriver+0x59
ffff820b`cc7473a0 fffff803`338afd3b : ffff820b`cc747660 fffff803`338af705 ffff820b`cc7475d0 ffffad07`431c19a0 : nt!IoCallDriverWithTracing+0x34
ffff820b`cc7473f0 fffff803`338b6cef : ffffad07`3c64a8f0 ffffad07`3c64a805 ffffad07`3a08a050 00000000`00000001 : nt!IopParseDevice+0x62b
ffff820b`cc747560 fffff803`338b5151 : ffffad07`3a08a000 ffff820b`cc7477a8 ffffad07`00000040 ffffad07`366cc220 : nt!ObpLookupObjectName+0x78f
ffff820b`cc747720 fffff803`338651c0 : 00000000`00000001 000000bf`20a7bce8 00000000`00000001 00000000`00000000 : nt!ObOpenObjectByNameEx+0x201
ffff820b`cc747860 fffff803`33864989 : 000000bf`20a7b8d0 00690073`00100081 000000bf`20a7bce8 000000bf`20a7bef0 : nt!IopCreateFile+0x820
ffff820b`cc747900 fffff803`333d3c15 : ffffad07`40a46080 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateFile+0x79
ffff820b`cc747990 00007ffb`8cd1cb14 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000bf`20a7afa8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`8cd1cb14
SYMBOL_NAME: Wof!FileProvCbLocateGenerateContext+13b
MODULE_NAME: Wof
IMAGE_NAME: Wof.sys
IMAGE_VERSION: 10.0.18362.1059
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 13b
FAILURE_BUCKET_ID: 0x1E_c0000005_R_Wof!FileProvCbLocateGenerateContext
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {df6f5a10-d157-34fa-b11b-b6519699464a}
Followup: MachineOwner
---------
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: ffff9780a0d23038
Arg3: 0000000002000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 5
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 8
Key : Analysis.Memory.CommitPeak.Mb
Value: 67
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: ffff9780a0d23038
BUGCHECK_P3: 2000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: MsMpEng.exe
STACK_TEXT:
ffff8880`8d486e28 fffff806`1c6502b8 : 00000000`0000001a 00000000`00041792 ffff9780`a0d23038 00000000`02000000 : nt!KeBugCheckEx
ffff8880`8d486e30 fffff806`1c4e3d07 : 00000000`00000000 ffff9780`a0d23038 00000000`00000000 00000000`00000000 : nt!MiDeleteVa+0x16a7b8
ffff8880`8d486f40 fffff806`1c4e41c1 : ffff8880`8d487390 ffff97cb`c0506918 00000000`00000000 0a000000`658ee867 : nt!MiWalkPageTablesRecursively+0x1e7
ffff8880`8d487000 fffff806`1c4e41c1 : ffff8880`8d487390 ffff97cb`e5e02830 00000000`00000000 0a000002`3352b867 : nt!MiWalkPageTablesRecursively+0x6a1
ffff8880`8d4870c0 fffff806`1c4e41c1 : ffff8880`8d487390 ffff97cb`e5f2f010 ffff97cb`00000000 0a000002`3352a867 : nt!MiWalkPageTablesRecursively+0x6a1
ffff8880`8d487180 fffff806`1c4e394c : ffff8880`8d487390 00000000`00000000 ffffd282`00000000 ffffd282`61533080 : nt!MiWalkPageTablesRecursively+0x6a1
ffff8880`8d487240 fffff806`1c4e1db8 : ffff8880`8d487390 ffffffff`00000002 ffff8880`00000001 fffff806`00000000 : nt!MiWalkPageTables+0x36c
ffff8880`8d487340 fffff806`1c4eff10 : ffffffff`ffffffff ffffd282`615333f8 00000000`00000001 00000000`00000000 : nt!MiDeletePagablePteRange+0x268
ffff8880`8d4876e0 fffff806`1ca79a0d : 00000000`00000000 00000000`141a3cb0 ffffd282`6d950780 00000000`00000000 : nt!MiDeleteVad+0x860
ffff8880`8d4878a0 fffff806`1ca79803 : ffffd282`6d950780 00000000`00000000 00000141`a3cb0000 00000000`00000000 : nt!MiUnmapVad+0x49
ffff8880`8d4878d0 fffff806`1ca79699 : ffffd282`61533080 ffffc283`00000008 ffffd282`6149d7a0 00000000`00000000 : nt!MiUnmapViewOfSection+0x133
ffff8880`8d4879b0 fffff806`1c5d3c15 : ffffd282`6b46a080 00000141`a3cb0000 ffff8880`8d487a80 ffffd282`61533080 : nt!NtUnmapViewOfSectionEx+0x99
ffff8880`8d487a00 00007ffa`0bd7f924 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0000003b`3e4ff538 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`0bd7f924
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000343b2, page frame number
Arg3: 0000000000000002, current page state
Arg4: 04000030000343b1, 0
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 7
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 7
Key : Analysis.Memory.CommitPeak.Mb
Value: 66
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 4e
BUGCHECK_P1: 99
BUGCHECK_P2: 343b2
BUGCHECK_P3: 2
BUGCHECK_P4: 4000030000343b1
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: WerFault.exe
STACK_TEXT:
ffffdf86`2aa8e9b8 fffff802`7d84a091 : 00000000`0000004e 00000000`00000099 00000000`000343b2 00000000`00000002 : nt!KeBugCheckEx
ffffdf86`2aa8e9c0 fffff802`7d6af33f : 1a000000`66a00867 ffffdf86`2aa8f6c0 ffffdf86`2aa8ea81 00002000`00000200 : nt!MiDecrementShareCount+0x16fed1
ffffdf86`2aa8ea00 fffff802`7d6f32fb : ffffdf86`2aa8ee10 ffffcf87`81f61080 00000000`00000001 ffffdf86`2aa8f6c0 : nt!MiDeletePteList+0x55f
ffffdf86`2aa8eae0 fffff802`7dc945cd : 00000000`00000040 ffffdf86`2aa8f780 00000226`4f7ba168 00000000`00000000 : nt!MiDecommitPages+0x153b
ffffdf86`2aa8f680 fffff802`7dc94b1b : 00000000`000c8000 00000000`00000000 ffffdf86`2aa8f960 ffffffff`ffffffff : nt!MiDecommitRegion+0xbd
ffffdf86`2aa8f860 fffff802`7dc9480b : 00000000`00000000 000000db`bf7a9298 ffff9369`61bcc8b8 00000000`00000004 : nt!MmFreeVirtualMemory+0x2db
ffffdf86`2aa8f9a0 fffff802`7d7d3c15 : ffffcf87`815a6080 ffffdf86`2aa8fa80 00007ff9`1404b280 00000000`00000008 : nt!NtFreeVirtualMemory+0x8b
ffffdf86`2aa8fa00 00007ff9`2931c434 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000db`bf7a9218 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`2931c434
SYMBOL_NAME: nt!MiDecrementShareCount+16fed1
MODULE_NAME: nt
IMAGE_VERSION: 10.0.18362.836
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 16fed1
FAILURE_BUCKET_ID: 0x4E_99_nt!MiDecrementShareCount
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {add373c4-2fe4-723e-d1db-12fcb6adef02}
Followup: MachineOwner
---------
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffe78fad2878d8, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8043fe013c9, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 10
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 13
Key : Analysis.Memory.CommitPeak.Mb
Value: 67
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffe78fad2878d8
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8043fe013c9
BUGCHECK_P4: 2
READ_ADDRESS: fffff8043fb733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8043fa2a3d8: Unable to get Flags value from nt!KdVersionBlock
fffff8043fa2a3d8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffe78fad2878d8
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Discord.exe
TRAP_FRAME: ffff818f46056fc0 -- (.trap 0xffff818f46056fc0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe78fad2878b8 rbx=0000000000000000 rcx=0000000000000011
rdx=01d638f7ab4ac835 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8043fe013c9 rsp=ffff818f46057150 rbp=ffff818f46057400
r8=ffff818f46057158 r9=7ffff8043fa65bf0 r10=fffff8043faf5010
r11=ffff818f46057288 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!CmpCallbackFillObjectContext+0x148c59:
fffff804`3fe013c9 48395020 cmp qword ptr [rax+20h],rdx ds:ffffe78f`ad2878d8=????????????????
Resetting default scope
STACK_TEXT:
ffff818f`46056d18 fffff804`3f82dd34 : 00000000`00000050 ffffe78f`ad2878d8 00000000`00000000 ffff818f`46056fc0 : nt!KeBugCheckEx
ffff818f`46056d20 fffff804`3f6c91af : 00000000`00000000 00000000`00000000 00000000`00000000 ffffe78f`ad2878d8 : nt!MiSystemFault+0x195c94
ffff818f`46056e20 fffff804`3f7d041e : 00000000`00000000 00000000`00000000 ffffe78f`d3494680 00000000`00000000 : nt!MmAccessFault+0x34f
ffff818f`46056fc0 fffff804`3fe013c9 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffe78f`d3494698 : nt!KiPageFault+0x35e
ffff818f`46057150 fffff804`3fcb8546 : ffff818f`46057340 ffffe78f`dfeca850 00000000`00000000 fffff804`3fa65c00 : nt!CmpCallbackFillObjectContext+0x148c59
ffff818f`46057180 fffff804`3fcbf470 : 00000000`0000000e ffff818f`46057340 00000000`00000000 00000000`00000001 : nt!CmpCallCallBacksEx+0x376
ffff818f`46057290 fffff804`3fcc06b1 : 00000000`00000000 ffffe78f`e9a52d10 00000000`00000000 01000000`00100000 : nt!CmpCallCallBacks+0x28
ffff818f`460572e0 fffff804`3fcc3c10 : 00000000`00000000 ffff830a`d44cb2a0 00000000`00000000 ffffe78f`ed287840 : nt!CmpDeleteKeyObject+0xb1
ffff818f`46057370 fffff804`3f713269 : 00000000`00000000 00000000`00000000 ffff818f`460574f9 ffffe78f`ed287870 : nt!ObpRemoveObjectRoutine+0x80
ffff818f`460573d0 fffff804`3fcb5f87 : 00000000`ffff8044 ffffe78f`ed287840 ffffe78f`ed287840 ffff830a`e5aa50a0 : nt!ObfDereferenceObjectWithTag+0xc9
ffff818f`46057410 fffff804`3fbf8bc5 : ffff830a`e55d5098 fffff804`3f70f43f ffff830a`e55d5060 ffff830a`da564080 : nt!ObCloseHandleTableEntry+0x2c7
ffff818f`46057550 fffff804`3fc6aecd : ffff830a`e55d5060 ffff830a`da564080 ffffffff`ffffff01 ffff830a`e5e5d380 : nt!ExSweepHandleTable+0xd5
ffff818f`46057600 fffff804`3fbde6d1 : ffffffff`ffffffff ffff830a`e5e5d080 ffff818f`46057650 ffff830a`00000000 : nt!ObKillProcess+0x35
ffff818f`46057630 fffff804`3fcd1943 : ffff830a`e5e5d080 ffffe78f`eb8ee7f0 ffff818f`46057859 00000000`00000000 : nt!PspRundownSingleProcess+0x131
ffff818f`460576b0 fffff804`3fccf223 : 00000000`c0000005 ffff830a`da564001 00000000`002db000 00000000`0000000f : nt!PspExitThread+0x60b
ffff818f`460577c0 fffff804`3f716e11 : ffff830a`da564180 00000000`00000001 00000000`00000000 00000000`00000100 : nt!KiSchedulerApcTerminate+0x33
ffff818f`46057800 fffff804`3f7c68f0 : ffff830a`da564001 ffff818f`460578c0 ffff830a`da564080 00000000`00000000 : nt!KiDeliverApc+0x481
ffff818f`460578c0 fffff804`3f7d3cbf : ffff830a`da564080 00000000`00000000 00000000`00000000 ffff830a`e28e3660 : nt!KiInitiateUserApc+0x70
ffff818f`46057a00 00000000`77471cbc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
00000000`0e0cebe8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77471cbc
SYMBOL_NAME: nt!CmpCallbackFillObjectContext+148c59
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.18362.836
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 148c59
FAILURE_BUCKET_ID: AV_R_INVALID_nt!CmpCallbackFillObjectContext
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {630defa1-411e-3bce-a58c-3aaefdbe9f0c}
Followup: MachineOwner
---------
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: ffffac80000034f8
Arg3: 0000000020000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 5
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 6
Key : Analysis.Memory.CommitPeak.Mb
Value: 66
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: ffffac80000034f8
BUGCHECK_P3: 20000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: WPSHWPBC.exe
STACK_TEXT:
ffff818e`de5f6d88 fffff803`3fe502b8 : 00000000`0000001a 00000000`00041792 ffffac80`000034f8 00000000`20000000 : nt!KeBugCheckEx
ffff818e`de5f6d90 fffff803`3fce3d07 : 00000000`00000000 ffffac80`000034f8 00000000`00000000 00000000`00000000 : nt!MiDeleteVa+0x16a7b8
ffff818e`de5f6ea0 fffff803`3fce41c1 : ffff818e`de5f72f0 ffffacd6`40000018 00000000`00000000 0a000000`657ff867 : nt!MiWalkPageTablesRecursively+0x1e7
ffff818e`de5f6f60 fffff803`3fce41c1 : ffff818e`de5f72f0 ffffacd6`6b200000 00000000`00000000 0a000002`2e36b867 : nt!MiWalkPageTablesRecursively+0x6a1
ffff818e`de5f7020 fffff803`3fce41c1 : ffff818e`de5f72f0 ffffacd6`6b359000 ffffacd6`00000000 0a000002`2e36a867 : nt!MiWalkPageTablesRecursively+0x6a1
ffff818e`de5f70e0 fffff803`3fce394c : ffff818e`de5f72f0 00000000`00000000 00000000`00000000 ffffbc09`6b403310 : nt!MiWalkPageTablesRecursively+0x6a1
ffff818e`de5f71a0 fffff803`3fce1db8 : ffff818e`de5f72f0 00000000`00000002 ffffbc09`00000001 00000000`00000000 : nt!MiWalkPageTables+0x36c
ffff818e`de5f72a0 fffff803`3fceff10 : ffffffff`ffffffff ffffbc09`68244438 ffff818e`00000001 00000000`00000000 : nt!MiDeletePagablePteRange+0x268
ffff818e`de5f7640 fffff803`3fd35b7a : 00000000`00000790 ffffbc09`682a6080 00000000`00000000 fffff803`3fceaeea : nt!MiDeleteVad+0x860
ffff818e`de5f7800 fffff803`40294bd0 : 00000000`00000000 00000000`00000000 ffff818e`de5f7960 ffffffff`ffffffff : nt!MiFreeVadRange+0x9e
ffff818e`de5f7860 fffff803`4029480b : 00000000`00000000 00000000`00000000 00000000`0102f300 00000000`00690000 : nt!MmFreeVirtualMemory+0x390
ffff818e`de5f79a0 fffff803`3fdd3c15 : ffffbc09`682a6080 00000000`0102f8c8 ffff818e`de5f7a18 ffffffff`ff676980 : nt!NtFreeVirtualMemory+0x8b
ffff818e`de5f7a00 00007ffc`b067c434 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`0102f318 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`b067c434
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: fffffa80002a8378
Arg3: 0000000002000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 4
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 6
Key : Analysis.Memory.CommitPeak.Mb
Value: 67
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: fffffa80002a8378
BUGCHECK_P3: 2000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: csgo.exe
STACK_TEXT:
fffffe0e`002e6df8 fffff801`666502b8 : 00000000`0000001a 00000000`00041792 fffffa80`002a8378 00000000`02000000 : nt!KeBugCheckEx
fffffe0e`002e6e00 fffff801`664e3d07 : 00000000`00000000 fffffa80`002a8378 00000000`00000000 00000000`00000000 : nt!MiDeleteVa+0x16a7b8
fffffe0e`002e6f10 fffff801`664e41c1 : fffffe0e`002e7360 fffffafd`40001540 00000000`00000000 0a000000`631dc867 : nt!MiWalkPageTablesRecursively+0x1e7
fffffe0e`002e6fd0 fffff801`664e41c1 : fffffe0e`002e7360 fffffafd`7ea00008 00000000`00000000 0a000002`181cb867 : nt!MiWalkPageTablesRecursively+0x6a1
fffffe0e`002e7090 fffff801`664e41c1 : fffffe0e`002e7360 fffffafd`7ebf5000 fffffafd`00000000 8a000001`bedb9867 : nt!MiWalkPageTablesRecursively+0x6a1
fffffe0e`002e7150 fffff801`664e394c : fffffe0e`002e7360 00000000`55001000 ffffc180`00000000 00000000`564cc7a0 : nt!MiWalkPageTablesRecursively+0x6a1
fffffe0e`002e7210 fffff801`664e1db8 : fffffe0e`002e7360 fffffafd`00000002 00000000`00000001 90000001`00000000 : nt!MiWalkPageTables+0x36c
fffffe0e`002e7310 fffff801`664eff10 : ffffffff`ffffffff ffffdc8c`628843f8 ffffdc8c`00000001 00000000`00000000 : nt!MiDeletePagablePteRange+0x268
fffffe0e`002e76b0 fffff801`66a79a0d : 00000000`00000000 ffffdc8c`621c0810 ffffdc8c`621c0810 00000000`00000000 : nt!MiDeleteVad+0x860
fffffe0e`002e7870 fffff801`66a79803 : ffffdc8c`613ebb00 00000000`00000000 00000000`55000000 00000000`00000000 : nt!MiUnmapVad+0x49
fffffe0e`002e78a0 fffff801`66a79699 : ffffdc8c`62884080 00000000`00000008 ffffdc8c`5649ec40 00000000`00000000 : nt!MiUnmapViewOfSection+0x133
fffffe0e`002e7980 fffff801`66a7938c : ffffdc8c`5fb60080 00007ffd`f94c4e01 00000000`000be000 ffffdc8c`62884080 : nt!NtUnmapViewOfSectionEx+0x99
fffffe0e`002e79d0 fffff801`665d3c15 : ffffdc8c`5fb60080 00000000`00000000 00000000`0101e000 00000000`54bee928 : nt!NtUnmapViewOfSection+0xc
fffffe0e`002e7a00 00007ffd`f9c3c5b4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`4d01e658 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`f9c3c5b4
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: ffffa001397aa2f0
Arg3: 0000000004000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 4
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 6
Key : Analysis.Memory.CommitPeak.Mb
Value: 66
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: ffffa001397aa2f0
BUGCHECK_P3: 4000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera_crashreporter.exe
STACK_TEXT:
fffff08b`743bee28 fffff806`162502b8 : 00000000`0000001a 00000000`00041792 ffffa001`397aa2f0 00000000`04000000 : nt!KeBugCheckEx
fffff08b`743bee30 fffff806`160e3d07 : 00000000`00000000 ffffa001`397aa2f0 00000000`00000000 00000000`00000000 : nt!MiDeleteVa+0x16a7b8
fffff08b`743bef40 fffff806`160e41c1 : fffff08b`743bf390 ffffa050`009cbd50 00000000`00000000 0a000000`655bb867 : nt!MiWalkPageTablesRecursively+0x1e7
fffff08b`743bf000 fffff806`160e41c1 : fffff08b`743bf390 ffffa050`28004e58 00000000`00000000 0a000001`6cb1f867 : nt!MiWalkPageTablesRecursively+0x6a1
fffff08b`743bf0c0 fffff806`160e41c1 : fffff08b`743bf390 ffffa050`28140020 ffffa050`00000000 8a000001`0711e867 : nt!MiWalkPageTablesRecursively+0x6a1
fffff08b`743bf180 fffff806`160e394c : fffff08b`743bf390 ffffbd84`429b4c48 00000000`00000000 00000000`00000008 : nt!MiWalkPageTablesRecursively+0x6a1
fffff08b`743bf240 fffff806`160e1db8 : fffff08b`743bf390 ffffdf86`00000002 ffffbd84`00000001 ffffbd84`00000000 : nt!MiWalkPageTables+0x36c
fffff08b`743bf340 fffff806`160eff10 : ffffffff`ffffffff ffffbd84`4199a3f8 bd846340`00000001 00000000`00000000 : nt!MiDeletePagablePteRange+0x268
fffff08b`743bf6e0 fffff806`16679a0d : 00000272`00000000 00000000`272f4e50 ffffbd84`43280d00 00000000`00000000 : nt!MiDeleteVad+0x860
fffff08b`743bf8a0 fffff806`16679803 : ffffbd84`43280d00 00000000`00000000 00000272`f4e50000 00000000`00000000 : nt!MiUnmapVad+0x49
fffff08b`743bf8d0 fffff806`16679699 : ffffbd84`4199a080 000000c3`00000008 ffffbd84`3649c220 00000000`00000000 : nt!MiUnmapViewOfSection+0x133
fffff08b`743bf9b0 fffff806`161d3c15 : ffffbd84`42cbf080 00000272`f4e50000 000000c3`682feea0 ffffbd84`4199a080 : nt!NtUnmapViewOfSectionEx+0x99
fffff08b`743bfa00 00007ff9`41fdf924 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000c3`682fe0a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`41fdf924
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 000000000000001d, Type of memory safety violation
Arg2: ffff8082fb8fef80, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff8082fb8feed8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 5
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 31
Key : Analysis.Memory.CommitPeak.Mb
Value: 68
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 139
BUGCHECK_P1: 1d
BUGCHECK_P2: ffff8082fb8fef80
BUGCHECK_P3: ffff8082fb8feed8
BUGCHECK_P4: 0
TRAP_FRAME: ffff8082fb8fef80 -- (.trap 0xffff8082fb8fef80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=000000000000001d
rdx=ffffa789f771af58 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8023f465c3b rsp=ffff8082fb8ff118 rbp=0000000000000059
r8=ffffa78a095eff58 r9=0000000000000000 r10=ffffa78a0cbaef58
r11=ffffa78a095eff58 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe cy
nt!RtlRbRemoveNode+0x148d3b:
fffff802`3f465c3b cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff8082fb8feed8 -- (.exr 0xffff8082fb8feed8)
ExceptionAddress: fffff8023f465c3b (nt!RtlRbRemoveNode+0x0000000000148d3b)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000000000000001d
Subcode: 0x1d FAST_FAIL_INVALID_BALANCED_TREE
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 000000000000001d
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffff8082`fb8fec58 fffff802`3f3d41e9 : 00000000`00000139 00000000`0000001d ffff8082`fb8fef80 ffff8082`fb8feed8 : nt!KeBugCheckEx
ffff8082`fb8fec60 fffff802`3f3d4610 : fffff802`3f668d80 fffff802`3f2cb1b6 ffff9048`24120000 ffffa789`faf81f68 : nt!KiBugCheckDispatch+0x69
ffff8082`fb8feda0 fffff802`3f3d29a3 : fffff280`0198f3f0 00000000`00000002 ffffa78a`07ca19d0 fffff802`3f2b334a : nt!KiFastFailDispatch+0xd0
ffff8082`fb8fef80 fffff802`3f465c3b : 00000059`00090000 0001019e`00590000 fffff802`3f31cd53 00000000`00000059 : nt!KiRaiseSecurityCheckFailure+0x323
ffff8082`fb8ff118 fffff802`3f31cd53 : 00000000`00000059 ffffa789`f771a9c0 00000000`00000000 ffffa789`f771af50 : nt!RtlRbRemoveNode+0x148d3b
ffff8082`fb8ff130 fffff802`3f31c73a : ffffa789`ed600280 ffffa789`ed600280 ffffa789`f8d0b9c0 ffff8082`fb8ff240 : nt!RtlpHpVsChunkCoalesce+0x183
ffff8082`fb8ff1a0 fffff802`3f31e9ad : ffffbc0f`00000062 fffff802`00000000 ffffbc0f`d544e600 ffffa789`00000000 : nt!RtlpHpVsContextFree+0x18a
ffff8082`fb8ff240 fffff802`3f56f019 : ffffbc0f`e142d360 fffff802`00000220 ffffbc0f`e14b7c50 01000000`00100000 : nt!ExFreeHeapPool+0x56d
ffff8082`fb8ff360 fffff802`410fedae : ffffbc0f`d544e600 ffffbc0f`e142d3c8 00000000`ffffbfff ffffa789`f9d8ed78 : nt!ExFreePool+0x9
ffff8082`fb8ff390 fffff802`410fddff : ffffa789`f9d8ed78 ffffbc0f`d54495a0 fffff802`00000000 00000000`00004000 : FLTMGR!FltReleaseFileNameInformation+0x12e
ffff8082`fb8ff3d0 fffff802`410c4fc9 : ffffbc0f`e142d360 ffffbc0f`00000000 ffffbc0f`ffff7fff 00000000`00008000 : FLTMGR!FltpRemoveAllNamesCachedForFileObject+0x1df
ffff8082`fb8ff450 fffff802`410c45a0 : ffff8082`fb8ff630 00000000`00000000 ffffbc0f`dd0b3902 00000000`00000400 : FLTMGR!FltpPerformPreCallbacks+0x869
ffff8082`fb8ff560 fffff802`410c4112 : ffffbc0f`dd0b39a0 ffff8082`fb8ff630 ffffbc0f`dd0b39a0 ffff8082`fb8ff640 : FLTMGR!FltpPassThroughInternal+0x90
ffff8082`fb8ff590 fffff802`410c3efe : ffffffff`fffe7960 ffffbc0f`d5261d60 00000000`00000000 00000000`00000080 : FLTMGR!FltpPassThrough+0x162
ffff8082`fb8ff610 fffff802`3f30a929 : ffffbc0f`e14b7c50 fffff802`3f241640 00000000`000018a3 00000000`000000ff : FLTMGR!FltpDispatch+0x9e
ffff8082`fb8ff670 fffff802`3f8b0ffd : ffffbc0f`e14b7c50 ffffbc0f`d54414d0 ffffbc0f`d5261d60 ffffbc0f`dd0b39a0 : nt!IofCallDriver+0x59
ffff8082`fb8ff6b0 fffff802`3f8c3c10 : ffffa789`fb287510 00000000`00000000 ffffbc0f`cf4ccae0 fffff802`3f30383f : nt!IopDeleteFile+0x12d
ffff8082`fb8ff730 fffff802`3f3119f4 : 00000000`00000000 00000000`00000000 ffffa789`fb287510 ffffbc0f`e14b7c50 : nt!ObpRemoveObjectRoutine+0x80
ffff8082`fb8ff790 fffff802`3f89e014 : 00000000`00000000 ffffbc0f`d8f28c30 ffffa789`fb287510 00000000`00000000 : nt!ObfDereferenceObject+0xa4
ffff8082`fb8ff7d0 fffff802`3f3626a7 : fffff802`00000001 fffff802`3f66a440 ffff8082`fb8ff8a0 ffffbc0f`d8f28c38 : nt!MiSegmentDelete+0x154
ffff8082`fb8ff820 fffff802`3f3900b9 : 00000000`00000000 fffff802`00000001 00000000`00000000 fffff802`3f66a440 : nt!MiProcessDereferenceList+0xc3
ffff8082`fb8ff8e0 fffff802`3f26bcd5 : ffffbc0f`d544e600 ffffbc0f`d544e600 00000000`00000080 fffff802`3f38ff90 : nt!MiDereferenceSegmentThread+0x129
ffff8082`fb8ffb10 fffff802`3f3c9998 : fffff802`3a67d180 ffffbc0f`d544e600 fffff802`3f26bc80 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff8082`fb8ffb60 00000000`00000000 : ffff8082`fb900000 ffff8082`fb8f9000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!ExFreePool+9
IMAGE_NAME: Pool_Corruption
IMAGE_VERSION: 10.0.18362.836
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 9
FAILURE_BUCKET_ID: 0x139_1d_INVALID_BALANCED_TREE_nt!ExFreePool
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {ab43366d-59cb-5971-8e17-b53398bf3f90}
Followup: Pool_corruption
---------
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000028660, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000002000028661, 0
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 6
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 9
Key : Analysis.Memory.CommitPeak.Mb
Value: 72
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 4e
BUGCHECK_P1: 99
BUGCHECK_P2: 28660
BUGCHECK_P3: 2
BUGCHECK_P4: 2000028661
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.18362.772_none_5f13f94c58ff4
STACK_TEXT:
ffff8887`7feff058 fffff807`3944a091 : 00000000`0000004e 00000000`00000099 00000000`00028660 00000000`00000002 : nt!KeBugCheckEx
ffff8887`7feff060 fffff807`39293c75 : ffffb684`205b8038 ffffb684`0000001f ffffb684`205b9011 00002000`686618c0 : nt!MiDecrementShareCount+0x16fed1
ffff8887`7feff0a0 fffff807`3988552f : ffffa283`4dc80000 ffffc78c`068ecd30 00000000`00000000 fffff807`39299800 : nt!MmUnmapViewInSystemCache+0x9f5
ffff8887`7feff1b0 fffff807`39292232 : 00000000`00780000 ffffb684`2f9d3700 ffffb684`2e9e4258 00000000`00000001 : nt!CcUnmapVacb+0x63
ffff8887`7feff1f0 fffff807`392d4c9b : 00000000`00800001 ffffb684`205139e0 00000000`00000000 00000000`00000001 : nt!CcUnmapVacbArray+0x202
ffff8887`7feff260 fffff807`3988f9a9 : 00000000`00000000 00000000`00000000 ffff8887`7feff3a0 ffff8887`7feff3b0 : nt!CcGetVirtualAddress+0x40b
ffff8887`7feff300 fffff807`392d4175 : 00000000`00000000 00000000`00800000 00000000`00400000 ffffb684`2b60d001 : nt!CcMapAndCopyFromCache+0x79
ffff8887`7feff3a0 fffff807`3f3ea54d : ffff8887`7feff4f0 00000000`00000000 ffffc78c`00400000 00000000`00400000 : nt!CcCopyReadEx+0x135
ffff8887`7feff440 fffff807`3d935f78 : 00000000`00000000 00000000`000002b0 ffffb684`303406c0 00000000`00000000 : Ntfs!NtfsCopyReadA+0x2ed
ffff8887`7feff730 fffff807`3d932fa3 : ffff8887`7feff820 00000000`00000000 00000000`00000000 ffffb684`2d7d1950 : FLTMGR!FltpPerformFastIoCall+0x198
ffff8887`7feff790 fffff807`3d96c7c5 : ffff8887`7feff8f8 ffff8887`7feffa80 ffffb684`2b60d080 ffffb684`303406c0 : FLTMGR!FltpPassThroughFastIo+0xd3
ffff8887`7feff7f0 fffff807`398af10f : ffffb684`303406c0 00000000`00000000 00000000`00000000 ffffb684`00000000 : FLTMGR!FltpFastIoRead+0x165
ffff8887`7feff8a0 fffff807`393d3c15 : 00000000`05d5ba79 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x39f
ffff8887`7feff990 00007ffa`480fc134 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0000008b`8557afd8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`480fc134
SYMBOL_NAME: nt!MiDecrementShareCount+16fed1
MODULE_NAME: nt
IMAGE_VERSION: 10.0.18362.836
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 16fed1
FAILURE_BUCKET_ID: 0x4E_99_nt!MiDecrementShareCount
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {add373c4-2fe4-723e-d1db-12fcb6adef02}
Followup: MachineOwner
---------
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8033320d4cc, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000040000090, Parameter 1 of the exception
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 5
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 7
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 1e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8033320d4cc
BUGCHECK_P3: 0
BUGCHECK_P4: 40000090
READ_ADDRESS: fffff803337733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8033362a3d8: Unable to get Flags value from nt!KdVersionBlock
fffff8033362a3d8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
0000000040000090
EXCEPTION_PARAMETER2: 0000000040000090
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffff800000000000 -- (.trap 0xffff800000000000)
Unable to read trap frame at ffff8000`00000000
STACK_TEXT:
ffff820b`cc745618 fffff803`3345ad71 : 00000000`0000001e ffffffff`c0000005 fffff803`3320d4cc 00000000`00000000 : nt!KeBugCheckEx
ffff820b`cc745620 fffff803`333d431d : fffff77b`bddee000 ffff820b`cc745eb0 ffff8000`00000000 00000000`40000090 : nt!KiDispatchException+0x15c681
ffff820b`cc745cd0 fffff803`333d0503 : ffff830a`d7fd3170 00000000`00000000 ffffad07`43f54ec0 fffff803`3331ff67 : nt!KiExceptionDispatch+0x11d
ffff820b`cc745eb0 fffff803`3320d4cc : 00000000`00000000 00000000`00000000 ffff830a`00000000 fffff803`34738a39 : nt!KiPageFault+0x443
ffff820b`cc746040 fffff803`3320d396 : ffffad07`43f54a90 00000000`00000000 ffff830a`00000000 00000000`00000000 : nt!FsRtlCheckOplockEx+0xfc
ffff820b`cc746160 fffff803`361eb32f : ffff830a`d7fe9aa0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!FsRtlCheckOplock+0x76
ffff820b`cc7461a0 fffff803`361eaa5d : 00000000`00000000 00000000`00000258 00000000`00000000 ffff820b`cc746660 : Ntfs!NtfsCommonCleanup+0x45f
ffff820b`cc7465f0 fffff803`3330a929 : ffffad07`43ca6010 fffff803`347345a0 ffffad07`43f54f08 ffffad07`3666a000 : Ntfs!NtfsFsdCleanup+0x1ad
ffff820b`cc746940 fffff803`347355de : ffffad07`43f54a90 ffffad07`44e29790 ffffad07`43f54a90 ffff820b`cc746a30 : nt!IofCallDriver+0x59
ffff820b`cc746980 fffff803`34733f16 : ffff820b`cc746a20 ffffad07`44e889a8 ffffad07`3a0db101 ffffad07`44e889ae : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
ffff820b`cc746a00 fffff803`3330a929 : ffffad07`44e29790 fffff803`3330a81d ffffad07`36002340 fffff803`3330e24c : FLTMGR!FltpDispatch+0xb6
ffff820b`cc746a60 fffff803`338ade08 : 00000000`00000000 ffffad07`44e29790 00000000`00000000 ffffad07`43f54a90 : nt!IofCallDriver+0x59
ffff820b`cc746aa0 fffff803`338b5f38 : 00000000`00000000 00000000`00000001 ffff820b`cc746be8 00000000`00007fff : nt!IopCloseFile+0x188
ffff820b`cc746b30 fffff803`338bb27e : 00000000`0000101c fffff803`333119f4 00000000`00000000 00000000`00000000 : nt!ObCloseHandleTableEntry+0x278
ffff820b`cc746c70 fffff803`333d3c15 : 00000000`00100081 ffff820b`cc746d88 ffff820b`cc746d60 00000000`00000000 : nt!NtClose+0xde
ffff820b`cc746ce0 fffff803`333c61b0 : fffff803`347737f0 ffff820b`cc746ed0 ffff820b`cc746ef8 ffff820b`cc746f00 : nt!KiSystemServiceCopyEnd+0x25
ffff820b`cc746e78 fffff803`347737f0 : ffff820b`cc746ed0 ffff820b`cc746ef8 ffff820b`cc746f00 00000000`00000002 : nt!KiServiceLinkage
ffff820b`cc746e80 fffff803`350afc2b : ffff820b`cc746ec8 ffff820b`cc746f50 ffff830a`d7a57780 00000000`00000000 : FLTMGR!FltClose+0x10
ffff820b`cc746eb0 fffff803`3509db43 : 00000000`00000000 ffffad07`44e29790 ffffffff`8000101c 00000000`00000000 : Wof!FileProvCbLocateGenerateContext+0x13b
ffff820b`cc746ef0 fffff803`3509d6fc : ffffad07`43f0c7e8 ffffad07`43f0c7e8 ffffad07`43f0c700 ffff820b`cc747010 : Wof!WofCreateOpenContext+0x327
ffff820b`cc746fc0 fffff803`34733c03 : ffffad07`43f0c700 ffffad07`3cc88010 00000000`00000000 00000000`00000000 : Wof!WofPostCreateCallback+0x5bc
ffff820b`cc7470e0 fffff803`34733408 : 00000000`00000000 00000000`00000000 ffffad07`44e27b70 00000000`00000000 : FLTMGR!FltpPerformPostCallbacks+0x3e3
ffff820b`cc7471b0 fffff803`34735680 : 00000000`00000000 fffff803`3474c470 00000000`00000008 ffffad07`43f0c700 : FLTMGR!FltpPassThroughCompletionWorker+0x128
ffff820b`cc747230 fffff803`3476cd27 : ffff820b`cc7472f0 00000000`00000120 00000000`00000000 00000000`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x200
ffff820b`cc7472b0 fffff803`3330a929 : 00000000`00000000 fffff803`338af705 00000000`00000000 00000000`00000000 : FLTMGR!FltpCreate+0x307
ffff820b`cc747360 fffff803`333099e4 : 00000000`00000003 00000000`00000000 00000000`00000000 fffff803`3330a1a3 : nt!IofCallDriver+0x59
ffff820b`cc7473a0 fffff803`338afd3b : ffff820b`cc747660 fffff803`338af705 ffff820b`cc7475d0 ffffad07`431c19a0 : nt!IoCallDriverWithTracing+0x34
ffff820b`cc7473f0 fffff803`338b6cef : ffffad07`3c64a8f0 ffffad07`3c64a805 ffffad07`3a08a050 00000000`00000001 : nt!IopParseDevice+0x62b
ffff820b`cc747560 fffff803`338b5151 : ffffad07`3a08a000 ffff820b`cc7477a8 ffffad07`00000040 ffffad07`366cc220 : nt!ObpLookupObjectName+0x78f
ffff820b`cc747720 fffff803`338651c0 : 00000000`00000001 000000bf`20a7bce8 00000000`00000001 00000000`00000000 : nt!ObOpenObjectByNameEx+0x201
ffff820b`cc747860 fffff803`33864989 : 000000bf`20a7b8d0 00690073`00100081 000000bf`20a7bce8 000000bf`20a7bef0 : nt!IopCreateFile+0x820
ffff820b`cc747900 fffff803`333d3c15 : ffffad07`40a46080 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateFile+0x79
ffff820b`cc747990 00007ffb`8cd1cb14 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000bf`20a7afa8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`8cd1cb14
SYMBOL_NAME: Wof!FileProvCbLocateGenerateContext+13b
MODULE_NAME: Wof
IMAGE_NAME: Wof.sys
IMAGE_VERSION: 10.0.18362.1059
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 13b
FAILURE_BUCKET_ID: 0x1E_c0000005_R_Wof!FileProvCbLocateGenerateContext
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {df6f5a10-d157-34fa-b11b-b6519699464a}
Followup: MachineOwner
---------
