KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffec877b37eea0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffec877b37edf8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4687
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 13121
Key : Analysis.Memory.CommitPeak.Mb
Value: 92
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffec877b37eea0
BUGCHECK_P3: ffffec877b37edf8
BUGCHECK_P4: 0
TRAP_FRAME: ffffec877b37eea0 -- (.trap 0xffffec877b37eea0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc5b404d762f0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffc5b404d56b80 rsi=0000000000000000 rdi=0000000000000000
rip=ffffc5ea2b85fc47 rsp=ffffec877b37f030 rbp=ffffec877b37f2c0
r8=0000000000000002 r9=7fffc5b400605f00 r10=7ffffffffffffffc
r11=ffffec877b37f010 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy
win32kbase!xxxDestroyThreadInfo+0x13c3:
ffffc5ea`2b85fc47 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffec877b37edf8 -- (.exr 0xffffec877b37edf8)
ExceptionAddress: ffffc5ea2b85fc47 (win32kbase!xxxDestroyThreadInfo+0x00000000000013c3)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffec87`7b37eb78 fffff807`34406569 : 00000000`00000139 00000000`00000003 ffffec87`7b37eea0 ffffec87`7b37edf8 : nt!KeBugCheckEx
ffffec87`7b37eb80 fffff807`34406990 : 00000000`00000000 00000000`00000000 00000000`000000de 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffec87`7b37ecc0 fffff807`34404d23 : 00000000`0000008f ffffec87`7b37eef0 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffec87`7b37eea0 ffffc5ea`2b85fc47 : 00000000`00000000 ffffec87`7b37f2c0 ffffc5b4`04d76010 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x323
ffffec87`7b37f030 ffffc5ea`2b8585c3 : ffffc5b4`04d76010 00000000`00000000 ffffb406`903a2080 ffffc5ea`2ba582b0 : win32kbase!xxxDestroyThreadInfo+0x13c3
ffffec87`7b37f1c0 ffffc5ea`2bb09826 : 00000000`00000001 00000000`00000001 ffffb406`903a2080 00000000`00000000 : win32kbase!UserThreadCallout+0x553
ffffec87`7b37f3b0 ffffc5ea`2b87c10d : 00000000`00000001 ffffec87`7b37f4e0 00000000`c000001c fffff807`342db4db : win32kfull!W32pThreadCallout+0x76
ffffec87`7b37f3e0 ffffc5ea`2c6810d1 : 00000000`c000001c ffffec87`7b37f6a0 00000000`00000000 ffffec87`7b37f6f8 : win32kbase!W32CalloutDispatch+0x44d
ffffec87`7b37f5f0 fffff807`347056e5 : 00000000`00000001 fffff807`34c1df08 ffffb406`894208b0 00000000`00000000 : win32k!W32CalloutDispatchThunk+0x31
ffffec87`7b37f630 fffff807`345e6e55 : ffffb406`908dbdf0 ffffec87`7b37f820 ffffec87`00000000 00000000`00000000 : nt!PsInvokeWin32Callout+0x55
ffffec87`7b37f660 fffff807`3467a978 : 00000000`000005bb 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PspExitThread+0x4b5
ffffec87`7b37f760 fffff807`342e2707 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSchedulerApcTerminate+0x38
ffffec87`7b37f7a0 fffff807`343f8b40 : 00000000`00000000 ffffec87`7b37f850 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x487
ffffec87`7b37f850 fffff807`3440605f : 00000000`00000000 00000000`00000000 00000000`00000778 fffff807`34662c10 : nt!KiInitiateUserApc+0x70
ffffec87`7b37f990 00007ff9`c745a104 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
00000000`04e4f7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`c745a104
SYMBOL_NAME: win32kbase!xxxDestroyThreadInfo+13c3
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
IMAGE_VERSION: 10.0.19041.572
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 13c3
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_win32kbase!xxxDestroyThreadInfo
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {185f5999-2bb1-26df-6dfb-a8efeeb63947}
Followup: MachineOwner
---------
INTERNAL_POWER_ERROR (a0)
The power policy manager experienced a fatal error.
Arguments:
Arg1: 000000000000010e, The disk subsystem returned corrupt data while reading from the
hibernation file.
Arg2: 000000000000000a
Arg3: 000000000000c19b, Incorrect checksum
Arg4: 000000000000a930, Previous disk read's checksum
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 5687
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 9835
Key : Analysis.Memory.CommitPeak.Mb
Value: 79
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
DUMP_FILE_ATTRIBUTES: 0x9
Hiber Crash Dump
Kernel Generated Triage Dump
BUGCHECK_CODE: a0
BUGCHECK_P1: 10e
BUGCHECK_P2: a
BUGCHECK_P3: c19b
BUGCHECK_P4: a930
CUSTOMER_CRASH_COUNT: 1
STACK_TEXT:
ffffc284`1480f548 fffff804`3fda078e : 00000000`000000a0 00000000`0000010e 00000000`0000000a 00000000`0000c19b : nt!KeBugCheckEx
ffffc284`1480f550 fffff804`3fdadc41 : 00000000`00000001 ffffd90f`85cdd130 00000001`6f5fa000 ffffd90f`b8336000 : nt!PopHiberChecksumHiberFileData+0x1035e
ffffc284`1480f5b0 fffff804`3fd9fd67 : 00000000`00000000 ffffb28c`cd14de58 00000000`00000001 00000000`00000001 : nt!PopRequestRead+0x7d
ffffc284`1480f620 fffff804`3fd8f5c0 : 00010d3b`02a200d0 ffffb28c`cd14de58 00000000`00000000 00000000`00000000 : nt!PopRestoreHiberContext+0x1064f
ffffc284`1480f6b0 fffff804`3fd8f302 : fffff804`400504e0 ffffc284`1480f830 fffff804`400504e0 00000000`00000100 : nt!PopHandleNextState+0x210
ffffc284`1480f700 fffff804`3fd8f07f : 00000000`00000100 fffff804`400504e0 00000119`025dbde5 00000000`00989680 : nt!PopIssueNextState+0x1a
ffffc284`1480f730 fffff804`3fd91c89 : 00000000`0000000b ffffc284`1480fa40 00000000`00000000 fffff804`3fd91a0f : nt!PopInvokeSystemStateHandler+0x33b
ffffc284`1480f930 fffff804`3fd8ca6a : ffffffff`00000000 ffffffff`ffffffff 00000000`00000000 00000000`00000000 : nt!PopEndMirroring+0x1e9
ffffc284`1480f9f0 fffff804`3fd8c755 : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000000 : nt!MmDuplicateMemory+0x2be
ffffc284`1480fa80 fffff804`3f6a2ae5 : ffffd90f`89cd2000 ffffd90f`89cd2040 fffff804`3fd8c620 00000000`00000001 : nt!PopTransitionToSleep+0x135
ffffc284`1480fb10 fffff804`3f7fbbf8 : ffff8f81`3b6ea180 ffffd90f`89cd2040 fffff804`3f6a2a90 00000000`00000246 : nt!PspSystemThreadStartup+0x55
ffffc284`1480fb60 00000000`00000000 : ffffc284`14810000 ffffc284`14809000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!PopHiberChecksumHiberFileData+1035e
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.572
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1035e
FAILURE_BUCKET_ID: 0xa0_10e_nt!PopHiberChecksumHiberFileData
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {28ba2091-a476-6f77-2dec-6241bccd4685}
Followup: MachineOwner
---------
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8020e2c93fc, Address of the instruction which caused the bugcheck
Arg3: ffffc18fb4c26390, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 12859
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 15792
Key : Analysis.Memory.CommitPeak.Mb
Value: 76
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff8020e2c93fc
BUGCHECK_P3: ffffc18fb4c26390
BUGCHECK_P4: 0
CONTEXT: ffffc18fb4c26390 -- (.cxr 0xffffc18fb4c26390)
rax=0000000000000000 rbx=ffffe58a68400290 rcx=0000000000000000
rdx=ffffe58a76e11888 rsi=ffffe58a76e0e800 rdi=ffffe58a76e11888
rip=fffff8020e2c93fc rsp=ffffc18fb4c26d98 rbp=0000000000000308
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=efffe58a7658a888 r12=ffffe58a76e02030 r13=ffffe58a76e02000
r14=0000000000000000 r15=ffffe58a76e11880
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050286
nt!RtlRbRemoveNode+0x7c:
fffff802`0e2c93fc 498b4308 mov rax,qword ptr [r11+8] ds:002b:efffe58a`7658a890=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: audiodg.exe
LOCK_ADDRESS: fffff8020ec44ae0 -- (!locks fffff8020ec44ae0)
Cannot get _ERESOURCE type
Resource @ nt!PiEngineLock (0xfffff8020ec44ae0) Available
1 total locks
PNP_TRIAGE_DATA:
Lock address : 0xfffff8020ec44ae0
Thread Count : 0
Thread address: 0x0000000000000000
Thread wait : 0x0
STACK_TEXT:
ffffc18f`b4c26d98 fffff802`0e2c9213 : 00000000`00000308 ffffe58a`76e0e800 00000000`00000000 ffffe58a`76e11880 : nt!RtlRbRemoveNode+0x7c
ffffc18f`b4c26db0 fffff802`0e2c8b88 : ffffe58a`68400280 ffffe58a`76e02000 00000000`00000000 ffffc18f`b4c26eb8 : nt!RtlpHpVsChunkCoalesce+0x183
ffffc18f`b4c26e10 fffff802`0e2c7514 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!RtlpHpVsContextFree+0x188
ffffc18f`b4c26eb0 fffff802`0e9b1019 : 00000000`00002890 00000000`00000900 00000000`00000000 01000000`00100000 : nt!ExFreeHeapPool+0x4d4
ffffc18f`b4c26f90 fffff802`0e622697 : ffffe58a`00000000 00000000`00000000 ffffe58a`76e0f000 ffffe58a`76e11878 : nt!ExFreePool+0x9
ffffc18f`b4c26fc0 fffff802`0e62e243 : ffffc18f`b4c27300 00000000`00000000 ffffc18f`b4c27050 ffffe58a`74d4b000 : nt!PiDmListEnumObjectsWithCallback+0x127
ffffc18f`b4c27010 fffff802`0e62e186 : ffffc18f`b4c27360 00000000`c0000002 ffffe58a`6a0fe590 00000000`00000400 : nt!PiDmGetObjectConstraintList+0x9f
ffffc18f`b4c27080 fffff802`0e62e093 : ffffc18f`b4c27428 ffffc18f`b4c27490 00000000`00000004 ffffe58a`68d9c520 : nt!PiDmGetCmObjectConstraintListFromCache+0x76
ffffc18f`b4c270f0 fffff802`0e62286c : 00000000`00000000 ffffc18f`b4c27360 ffffe58a`74d4b000 00000000`00000002 : nt!PiPnpRtlGetFilteredDeviceInterfaceList+0xa3
ffffc18f`b4c27190 fffff802`0e62f9d1 : 00000000`00000103 00000000`00000000 4647c038`73c93b54 ffffc18f`b4c274f8 : nt!PiPnpRtlCmActionCallback+0x1ac
ffffc18f`b4c27300 fffff802`0e62f306 : 00000000`c0000023 ffffc18f`b4c27520 00000000`00000000 ffffc18f`00000000 : nt!_CmGetMatchingFilteredDeviceInterfaceList+0xdd
ffffc18f`b4c27420 fffff802`0e62efa5 : ffff8e8c`7eaaf001 ffffc18f`b4c27868 00000000`00000000 ffffc18f`b4c27668 : nt!IopGetDeviceInterfaces+0x28a
ffffc18f`b4c275f0 fffff802`0e621785 : 8e8c7e44`9100febd 00000000`00120089 00000000`00000000 00000000`00000000 : nt!PiCMGetDeviceInterfaceList+0x10d
ffffc18f`b4c276f0 fffff802`0e6215d3 : ffffc18f`b4c27840 00000000`00008014 00000000`00470807 fffff802`0e6efbce : nt!PiCMHandleIoctl+0x195
ffffc18f`b4c27730 fffff802`0e675dda : 00000000`00470807 fffff802`0e675d70 ffffc18f`b4c27a00 fffff802`0e2de63a : nt!PiCMFastIoDeviceDispatch+0x53
ffffc18f`b4c27780 fffff802`0e6c1b92 : 00000000`00470807 00000000`00000000 00000000`00000000 ffff8e8c`7e449130 : nt!PiDaFastIoDispatch+0x6a
ffffc18f`b4c277e0 fffff802`0e6c17f6 : 000001ec`92868dba 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x382
ffffc18f`b4c27920 fffff802`0e405fb5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000079`f0b7c618 : nt!NtDeviceIoControlFile+0x56
ffffc18f`b4c27990 00007ffd`d05cbe74 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000079`f0b7c7d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`d05cbe74
SYMBOL_NAME: nt!ExFreePool+9
IMAGE_NAME: Pool_Corruption
IMAGE_VERSION: 10.0.19041.572
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .cxr 0xffffc18fb4c26390 ; kb
BUCKET_ID_FUNC_OFFSET: 9
FAILURE_BUCKET_ID: 0x3B_c0000005_nt!ExFreePool
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {c9913766-80de-cdf5-a1a8-15c856d3f064}
Followup: Pool_corruption
---------