ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffffaaef9553898, Virtual address for the attempted write.
Arg2: 810000087943b021, PTE contents.
Arg3: fffff60fc2dff430, (reserved)
Arg4: 000000000000000b, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 3
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-HH6FM2D
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 23
Key : Analysis.Memory.CommitPeak.Mb
Value: 82
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: be
BUGCHECK_P1: fffffaaef9553898
BUGCHECK_P2: 810000087943b021
BUGCHECK_P3: fffff60fc2dff430
BUGCHECK_P4: b
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: csrss.exe
TRAP_FRAME: fffff60fc2dff430 -- (.trap 0xfffff60fc2dff430)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa81c64f4920
rdx=00000000000004e2 rsi=0000000000000000 rdi=0000000000000000
rip=fffffaaef92d3eea rsp=fffff60fc2dff5c0 rbp=00000000000004e2
r8=0000000000000000 r9=0000000000000000 r10=fffff8037c0fa940
r11=fffff60fc2dff620 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
win32kfull!TimersProc+0x10a:
fffffaae`f92d3eea 48ff15a7f92700 call qword ptr [win32kfull!_imp_HMUnlockObjectWorker (fffffaae`f9553898)] ds:fffffaae`f9553898={win32kbase!HMUnlockObjectWorker (fffffaae`f95cc3e0)}
Resetting default scope
STACK_TEXT:
fffff60f`c2dff188 fffff803`7c1e350c : 00000000`000000be fffffaae`f9553898 81000008`7943b021 fffff60f`c2dff430 : nt!KeBugCheckEx
fffff60f`c2dff190 fffff803`7c072edf : 00000000`00000000 00000000`00000003 00000000`00000000 fffffaae`f9553898 : nt!MiSystemFault+0x1d67dc
fffff60f`c2dff290 fffff803`7c1cf320 : ffff9201`00000000 00000000`00000000 00000000`034862fa 00000000`00000000 : nt!MmAccessFault+0x34f
fffff60f`c2dff430 fffffaae`f92d3eea : 00000000`00000000 fffffaae`f9520308 00000000`00000000 ffffa608`d6b39288 : nt!KiPageFault+0x360
fffff60f`c2dff5c0 fffffaae`f92d3c2b : 00000000`00000001 fffff60f`c2dff740 fffffaae`f9520308 00000000`00000004 : win32kfull!TimersProc+0x10a
fffff60f`c2dff640 fffffaae`f965946e : ffffa608`d43cd080 ffffa608`d43cd080 00000000`00000000 00000000`00000005 : win32kfull!RawInputThread+0xd9b
fffff60f`c2dff8c0 fffffaae`f92eb820 : ffffa608`d43cd080 00000000`00000000 00000000`00000005 00000000`00000000 : win32kbase!xxxCreateSystemThreads+0x9e
fffff60f`c2dff9d0 fffff803`7c1d2b15 : ffffa608`d43cd080 00000000`00000005 00000285`44804510 00000000`0000346c : win32kfull!NtUserCallNoParam+0x70
fffff60f`c2dffa00 00007ffd`b5bf1144 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000fb`b8b3f9f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`b5bf1144
SYMBOL_NAME: win32kfull!TimersProc+10a
MODULE_NAME: win32kfull
IMAGE_NAME: win32kfull.sys
IMAGE_VERSION: 10.0.18362.387
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 10a
FAILURE_BUCKET_ID: 0xBE_win32kfull!TimersProc
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e1a79366-4b84-5b8e-5c04-6383e7673532}
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffff800659b34ac, memory referenced.
Arg2: 0000000000000010, value 0 = read operation, 1 = write operation.
Arg3: fffff800659b34ac, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 3
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-HH6FM2D
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 11
Key : Analysis.Memory.CommitPeak.Mb
Value: 70
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: 50
BUGCHECK_P1: fffff800659b34ac
BUGCHECK_P2: 10
BUGCHECK_P3: fffff800659b34ac
BUGCHECK_P4: 2
READ_ADDRESS: fffff80067f733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff80067e2a3c8: Unable to get Flags value from nt!KdVersionBlock
fffff80067e2a3c8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
fffff800659b34ac
MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: avpui.exe
TRAP_FRAME: fffff106f021e570 -- (.trap 0xfffff106f021e570)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffbe0ef542e64d rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800659b34ac rsp=fffff106f021e700 rbp=ffffbe0ef542e64a
r8=0000000000000000 r9=0000000000000031 r10=fffff106f021e8a8
r11=fffff106f021e778 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
fffff800`659b34ac ?? ???
Resetting default scope
FAILED_INSTRUCTION_ADDRESS:
+0
fffff800`659b34ac ?? ???
STACK_TEXT:
fffff106`f021e2c8 fffff800`67be33d6 : 00000000`00000050 fffff800`659b34ac 00000000`00000010 fffff106`f021e570 : nt!KeBugCheckEx
fffff106`f021e2d0 fffff800`67a72edf : 00000000`00000000 00000000`00000010 00000000`00000000 fffff800`659b34ac : nt!MiSystemFault+0x1d66a6
fffff106`f021e3d0 fffff800`67bcf320 : fffff800`6c339060 00000000`00000000 ffffbe0e`f542e600 00000000`00000000 : nt!MmAccessFault+0x34f
fffff106`f021e570 fffff800`659b34ac : ffff9704`14578da0 00000000`0b280001 ffff0578`a2b025b9 fffff800`67a7e7f3 : nt!KiPageFault+0x360
fffff106`f021e700 ffff9704`14578da0 : 00000000`0b280001 ffff0578`a2b025b9 fffff800`67a7e7f3 fffff106`f021e8a8 : 0xfffff800`659b34ac
fffff106`f021e708 00000000`0b280001 : ffff0578`a2b025b9 fffff800`67a7e7f3 fffff106`f021e8a8 00000000`00000018 : 0xffff9704`14578da0
fffff106`f021e710 ffff0578`a2b025b9 : fffff800`67a7e7f3 fffff106`f021e8a8 00000000`00000018 fffff106`f021eaa0 : 0xb280001
fffff106`f021e718 fffff800`67a7e7f3 : fffff106`f021e8a8 00000000`00000018 fffff106`f021eaa0 00000000`00000000 : 0xffff0578`a2b025b9
fffff106`f021e720 fffff800`f542e600 : fffff106`f021e8a8 fffff106`f021e858 fffff106`f021e801 fffff106`00000000 : nt!CcGetVirtualAddress+0x233
fffff106`f021e7c0 fffff106`f021e8a8 : fffff106`f021e858 fffff106`f021e801 fffff106`00000000 ffff9704`00000000 : 0xfffff800`f542e600
fffff106`f021e7c8 fffff106`f021e858 : fffff106`f021e801 fffff106`00000000 ffff9704`00000000 ffff9704`00000000 : 0xfffff106`f021e8a8
fffff106`f021e7d0 fffff106`f021e801 : fffff106`00000000 ffff9704`00000000 ffff9704`00000000 fffff106`f021f8e0 : 0xfffff106`f021e858
fffff106`f021e7d8 fffff106`00000000 : ffff9704`00000000 ffff9704`00000000 fffff106`f021f8e0 00000000`00000001 : 0xfffff106`f021e801
fffff106`f021e7e0 ffff9704`00000000 : ffff9704`00000000 fffff106`f021f8e0 00000000`00000001 fffff800`67a00000 : 0xfffff106`00000000
fffff106`f021e7e8 ffff9704`00000000 : fffff106`f021f8e0 00000000`00000001 fffff800`67a00000 fffff800`67a33926 : 0xffff9704`00000000
fffff106`f021e7f0 fffff106`f021f8e0 : 00000000`00000001 fffff800`67a00000 fffff800`67a33926 ffffab8c`79399018 : 0xffff9704`00000000
fffff106`f021e7f8 00000000`00000001 : fffff800`67a00000 fffff800`67a33926 ffffab8c`79399018 00000000`00000008 : 0xfffff106`f021f8e0
fffff106`f021e800 fffff800`67a00000 : fffff800`67a33926 ffffab8c`79399018 00000000`00000008 fffff106`f021eaa8 : 0x1
fffff106`f021e808 fffff800`67a33926 : ffffab8c`79399018 00000000`00000008 fffff106`f021eaa8 fffff800`6da89952 : nt!SeConvertSecurityDescriptorToStringSecurityDescriptor <PERF> (nt+0x0)
fffff106`f021e810 fffff800`00000008 : fffff106`f021eaa0 fffff106`f021eaa8 00000000`00000000 ffff9704`14c3dfb0 : nt!RtlpHpLfhSlotAllocate+0x126
fffff106`f021e970 fffff106`f021eaa0 : fffff106`f021eaa8 00000000`00000000 ffff9704`14c3dfb0 ffff9704`1460b180 : 0xfffff800`00000008
fffff106`f021e978 fffff106`f021eaa8 : 00000000`00000000 ffff9704`14c3dfb0 ffff9704`1460b180 00000000`00000000 : 0xfffff106`f021eaa0
fffff106`f021e980 00000000`00000000 : ffff9704`14c3dfb0 ffff9704`1460b180 00000000`00000000 00000000`000000ff : 0xfffff106`f021eaa8
SYMBOL_NAME: nt!MiSystemFault+1d66a6
MODULE_NAME: nt
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 1d66a6
FAILURE_BUCKET_ID: AV_INVALID_BAD_IP_nt!MiSystemFault
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {48ad9531-e3f8-1044-fc5f-d917677674c7}
Followup: MachineOwner
---------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffffe00000056, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8067c482062, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 2
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-HH6FM2D
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 8
Key : Analysis.Memory.CommitPeak.Mb
Value: 68
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: a
BUGCHECK_P1: fffffffe00000056
BUGCHECK_P2: 2
BUGCHECK_P3: 1
BUGCHECK_P4: fffff8067c482062
WRITE_ADDRESS: fffff8067c9733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8067c82a3c8: Unable to get Flags value from nt!KdVersionBlock
fffff8067c82a3c8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
fffffffe00000056
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffffc2064b26a280 -- (.trap 0xffffc2064b26a280)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffffe00000056
rdx=0a00000125d06821 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8067c482062 rsp=ffffc2064b26a410 rbp=0000000000040000
r8=0000000020000006 r9=ffffd76c419a07c8 r10=0000000000000000
r11=ffffc2064b26a410 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiReadyStandbyPageForActive+0xc2:
fffff806`7c482062 488917 mov qword ptr [rdi],rdx ds:00000000`00000000=????????????????
Resetting default scope
STACK_TEXT:
ffffc206`4b26a138 fffff806`7c5d30e9 : 00000000`0000000a fffffffe`00000056 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffffc206`4b26a140 fffff806`7c5cf42b : 00000000`00000078 ffffd76b`b620cd00 ffffef00`03716d00 fffff806`7c86c480 : nt!KiBugCheckDispatch+0x69
ffffc206`4b26a280 fffff806`7c482062 : ffffef00`03717120 00000000`00040000 80000000`00000000 00000000`00000005 : nt!KiPageFault+0x46b
ffffc206`4b26a410 fffff806`7c481f26 : ffffef00`03717120 00000000`00000007 00000000`00000007 ffffc601`c3dcdfc8 : nt!MiReadyStandbyPageForActive+0xc2
ffffc206`4b26a440 fffff806`7c47fd15 : 00000000`00000001 ffffef00`037172e0 ffffd76c`419a0780 00000000`00000000 : nt!MiUnlinkStandbyBatch+0x186
ffffc206`4b26a480 fffff806`7c47e0ff : 00000000`000001c0 00000000`001c0000 00000000`00040000 ffff8c0f`396d33b8 : nt!MmCheckCachedPageStates+0x1145
ffffc206`4b26a680 fffff806`7ca1e499 : 00000000`001c0000 00000000`00000000 00000000`00000001 ffffc206`4b26a790 : nt!CcFetchDataForRead+0x8f
ffffc206`4b26a6e0 fffff806`7c4a5106 : ffff8c0f`396e09a0 00000000`001c0000 00000000`00040000 00000000`00000001 : nt!CcMapAndCopyFromCache+0xd9
ffffc206`4b26a780 fffff806`7c48c4a5 : 00000000`00000000 fffff806`7c48c220 00000000`00000000 ffff8c0f`394d39e0 : nt!CcPerformReadAhead+0x3a2
ffffc206`4b26a950 fffff806`7c4bd465 : ffff8c0f`39496a60 ffff8c0f`4458f0c0 ffff8c0f`39496a60 ffff8c0f`4458f0c0 : nt!CcWorkerThread+0x285
ffffc206`4b26aa70 fffff806`7c52a725 : ffff8c0f`4458f0c0 00000000`00000080 ffff8c0f`394a1140 000024ef`bd9bbfff : nt!ExpWorkerThread+0x105
ffffc206`4b26ab10 fffff806`7c5c886a : ffff9f01`69b4b180 ffff8c0f`4458f0c0 fffff806`7c52a6d0 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffc206`4b26ab60 00000000`00000000 : ffffc206`4b26b000 ffffc206`4b264000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a
SYMBOL_NAME: nt!MiReadyStandbyPageForActive+c2
MODULE_NAME: nt
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: c2
FAILURE_BUCKET_ID: AV_nt!MiReadyStandbyPageForActive
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {162abed9-8eea-1274-0bec-dc2682dbf597}
Followup: MachineOwner
---------
