KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000004, The thread's stack pointer was outside the legal stack
extents for the thread.
Arg2: ffff9801e525eff0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff9801e525ef48, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 2
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-NG9H4F5
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 2
Key : Analysis.Memory.CommitPeak.Mb
Value: 66
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: 139
BUGCHECK_P1: 4
BUGCHECK_P2: ffff9801e525eff0
BUGCHECK_P3: ffff9801e525ef48
BUGCHECK_P4: 0
TRAP_FRAME: ffff9801e525eff0 -- (.trap 0xffff9801e525eff0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffa80ad2551000 rbx=0000000000000000 rcx=0000000000000004
rdx=ffffa80ad2557000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8043144eec7 rsp=ffff9801e525f180 rbp=ffff9801e525f6f0
r8=ffffa80ad2557000 r9=ffff9801e525f710 r10=ffffd185a7be90c0
r11=0000009f857fdde0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!RtlpGetStackLimitsEx+0x12e8cb:
fffff804`3144eec7 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff9801e525ef48 -- (.exr 0xffff9801e525ef48)
ExceptionAddress: fffff8043144eec7 (nt!RtlpGetStackLimitsEx+0x000000000012e8cb)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000004
Subcode: 0x4 FAST_FAIL_INCORRECT_STACK
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
WATSON_BKT_EVENT: BEX
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000004
EXCEPTION_STR: 0xc0000409
BAD_STACK_POINTER: ffff9801e525ecc8
STACK_TEXT:
ffff9801`e525ecc8 fffff804`313d30e9 : 00000000`00000139 00000000`00000004 ffff9801`e525eff0 ffff9801`e525ef48 : nt!KeBugCheckEx
ffff9801`e525ecd0 fffff804`313d3510 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffff9801`e525ee10 fffff804`313d18a5 : fffff804`313271d8 fffff804`3160edbc ffff9801`e525f7d0 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffff9801`e525eff0 fffff804`3144eec7 : 00000000`00000000 00000000`00000360 0005e530`00ab6000 00000000`0010001f : nt!KiRaiseSecurityCheckFailure+0x325
ffff9801`e525f180 fffff804`3142e800 : 00000000`00000000 00000000`00000000 ffff9801`e525f6f0 00007fff`00000003 : nt!RtlpGetStackLimitsEx+0x12e8cb
ffff9801`e525f1b0 fffff804`312c7aee : ffffa80a`d25560e8 ffff9801`e525fe30 ffffa80a`d25560e8 00000000`00000000 : nt!RtlDispatchException+0x16b750
ffff9801`e525f900 fffff804`313c20a2 : 00000000`00000000 ffffffff`03000000 00000000`0000f8ff 00000000`00000000 : nt!KiDispatchException+0x16e
ffff9801`e525ffb0 fffff804`313c2070 : fffff804`313d3216 ffffd185`99715a50 ffffa80a`d25561c8 00000000`00000006 : nt!KxExceptionDispatchOnExceptionStack+0x12
ffffa80a`d2555fa8 fffff804`313d3216 : ffffd185`99715a50 ffffa80a`d25561c8 00000000`00000006 00000000`000000c0 : nt!KiExceptionDispatchOnExceptionStackContinue
ffffa80a`d2555fb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0x116
SYMBOL_NAME: nt!KiFastFailDispatch+d0
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.18362.388
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_MISSING_GSFRAME_STACKPTR_ERROR_nt!KiFastFailDispatch
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {7b0febb5-6007-4f2b-3d38-57fef278d8d5}
Followup: MachineOwner
---------
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffff8c8ecf6dd2cc, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80711462840, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 3
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-NG9H4F5
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 6
Key : Analysis.Memory.CommitPeak.Mb
Value: 67
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: 50
BUGCHECK_P1: ffff8c8ecf6dd2cc
BUGCHECK_P2: 0
BUGCHECK_P3: fffff80711462840
BUGCHECK_P4: 2
READ_ADDRESS: fffff807113733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8071122a3b8: Unable to get Flags value from nt!KdVersionBlock
fffff8071122a3b8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffff8c8ecf6dd2cc
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Monitor.exe
TRAP_FRAME: ffffdb0289b0ffa0 -- (.trap 0xffffdb0289b0ffa0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000011e rbx=0000000000000000 rcx=ffffa180c80a4180
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80711462840 rsp=ffffdb0289b10130 rbp=000000000000000d
r8=0000000000000000 r9=00000000000002ba r10=0000000000000257
r11=ffffb6822eaeb2c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!PsQueryStatisticsProcess+0xd0:
fffff807`11462840 03aed4fbffff add ebp,dword ptr [rsi-42Ch] ds:ffffffff`fffffbd4=????????
Resetting default scope
STACK_TEXT:
ffffdb02`89b0fcf8 fffff807`10fe33d6 : 00000000`00000050 ffff8c8e`cf6dd2cc 00000000`00000000 ffffdb02`89b0ffa0 : nt!KeBugCheckEx
ffffdb02`89b0fd00 fffff807`10e730bf : 00010101`011fffff 00000000`00000000 00000000`00000000 ffff8c8e`cf6dd2cc : nt!MiSystemFault+0x1d66a6
ffffdb02`89b0fe00 fffff807`10fcf320 : 00000000`000000ff 00000000`00000002 ffff8c8e`cf65a688 00000000`00000090 : nt!MmAccessFault+0x34f
ffffdb02`89b0ffa0 fffff807`11462840 : ffffdb02`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x360
ffffdb02`89b10130 fffff807`11462684 : ffff8c8e`d0cd6080 00000000`00000000 ffffb682`2eaeb180 bd2e1e7e`61c4ec88 : nt!PsQueryStatisticsProcess+0xd0
ffffdb02`89b101a0 fffff807`113efe1a : 00000000`00000000 00000000`027bd9d8 ffff8c8e`cf65a200 fffff807`11238b20 : nt!ExpCopyProcessInfo+0x274
ffffdb02`89b10240 fffff807`113e1be8 : 00000000`00000000 ffffb682`00039400 ffffdb02`89b10a00 00000000`00000000 : nt!ExpGetProcessInformation+0x9ca
ffffdb02`89b108b0 fffff807`113e12ab : 00000000`00000000 ffff8c8e`d142f810 ffffffff`fb3b4c00 00000000`00989680 : nt!ExpQuerySystemInformation+0x818
ffffdb02`89b10ac0 fffff807`10fd2b18 : ffff8c8e`d0cd6080 00000000`00aa0da8 ffffdb02`89b10b18 ffffffff`fb3b4c00 : nt!NtQuerySystemInformation+0x2b
ffffdb02`89b10b00 00007ffd`d5c9c784 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`0672e608 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`d5c9c784
SYMBOL_NAME: nt!PsQueryStatisticsProcess+d0
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.18362.388
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: AV_R_INVALID_nt!PsQueryStatisticsProcess
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3f41bc41-95dc-0efd-2b3e-aa8c85eb6516}
Followup: MachineOwner
---------
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc000001d, The exception code that was not handled
Arg2: fffff80457192929, The address that the exception occurred at
Arg3: ffffcb82a6984080, Parameter 0 of the exception
Arg4: ffff81019ca00180, Parameter 1 of the exception
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 4
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-NG9H4F5
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 4
Key : Analysis.Memory.CommitPeak.Mb
Value: 68
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: 1e
BUGCHECK_P1: ffffffffc000001d
BUGCHECK_P2: fffff80457192929
BUGCHECK_P3: ffffcb82a6984080
BUGCHECK_P4: ffff81019ca00180
EXCEPTION_PARAMETER1: ffffcb82a6984080
EXCEPTION_PARAMETER2: ffff81019ca00180
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
FAILED_INSTRUCTION_ADDRESS:
hal!HalpSetWakeAlarm+55
fffff804`57192929 418bc3 mov eax,r11d
STACK_TEXT:
fffffb05`9231e068 fffff804`5742fb47 : 00000000`0000001e ffffffff`c000001d fffff804`57192929 ffffcb82`a6984080 : nt!KeBugCheckEx
fffffb05`9231e070 fffff804`573d301d : 000000ce`00000000 ffffcb82`9fc65cb0 00000000`00000001 00000000`00000000 : nt!KiDispatchException+0x1681c7
fffffb05`9231e720 fffff804`573cd5ab : 00000000`00000000 ffffcb82`00000000 fffffb05`9231e928 00000000`00000001 : nt!KiExceptionDispatch+0x11d
fffffb05`9231e900 fffff804`57192929 : 00000000`002c0000 00000000`003a041c ffffcb82`a6904080 000000ce`387ff968 : nt!KiInvalidOpcodeFault+0x32b
fffffb05`9231ea90 000000ce`3877f664 : 000000ce`00000004 000000ce`385ff3d0 00000000`00000000 00000000`00000000 : hal!HalpSetWakeAlarm+0x55
fffffb05`9231eac0 000000ce`00000004 : 000000ce`385ff3d0 00000000`00000000 00000000`00000000 000001d1`2f52a5c4 : 0x000000ce`3877f664
fffffb05`9231eac8 000000ce`385ff3d0 : 00000000`00000000 00000000`00000000 000001d1`2f52a5c4 fffff804`573c7785 : 0x000000ce`00000004
fffffb05`9231ead0 00000000`00000000 : 00000000`00000000 000001d1`2f52a5c4 fffff804`573c7785 00000000`00000000 : 0x000000ce`385ff3d0
SYMBOL_NAME: nt!KiDispatchException+1681c7
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.18362.356
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1681c7
FAILURE_BUCKET_ID: 0x1E_c000001d_BAD_IP_nt!KiDispatchException
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {32d53838-e3d6-fa50-5106-1dd1cbc4aba1}
Followup: MachineOwner
---------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000100000098, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8067b2280c0, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 3
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-NG9H4F5
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 14
Key : Analysis.Memory.CommitPeak.Mb
Value: 65
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: a
BUGCHECK_P1: 100000098
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8067b2280c0
READ_ADDRESS: fffff8067b7723b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8067b6293b8: Unable to get Flags value from nt!KdVersionBlock
fffff8067b6293b8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
0000000100000098
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: fffff8067e46b0d0 -- (.trap 0xfffff8067e46b0d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ffffffd8 rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000006 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8067b2280c0 rsp=fffff8067e46b260 rbp=fffff8067e46b2f0
r8=0000000000000002 r9=fffff8067b647df0 r10=0000000000000001
r11=fffff8067e46b2e0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po cy
nt!KiIntSteerCalculateDistribution+0x120:
fffff806`7b2280c0 4839b8c0000000 cmp qword ptr [rax+0C0h],rdi ds:00000001`00000098=????????????????
Resetting default scope
STACK_TEXT:
fffff806`7e46af88 fffff806`7b3d2ee9 : 00000000`0000000a 00000001`00000098 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff806`7e46af90 fffff806`7b3cf22b : ffff9e08`0000012c ffff9e08`00000000 00010000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff806`7e46b0d0 fffff806`7b2280c0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x46b
fffff806`7e46b260 fffff806`7b22737e : 00000000`00000001 0f0f0f0f`0f0f0f0f 00000000`00000002 00000000`00000002 : nt!KiIntSteerCalculateDistribution+0x120
fffff806`7e46b330 fffff806`7b227ba0 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000001 : nt!PpmParkSteerInterrupts+0x45e
fffff806`7e46b7f0 fffff806`7b22672e : fffff806`7b6447e8 00000000`00000000 fffff806`7e46b9f0 fffff806`7b63a5c0 : nt!PpmCheckStart+0x120
fffff806`7e46b8a0 fffff806`7b26b065 : ffff9e08`d0254080 ffff9e08`d0254080 ffff9e08`d02541f0 fffff806`7b248c93 : nt!PpmCheckPeriodicStart+0x3e
fffff806`7e46b8f0 fffff806`7b26a6bf : 00000000`0000001e 00000000`00989680 00000000`002d94fb 00000000`00000013 : nt!KiExecuteAllDpcs+0x305
fffff806`7e46ba30 fffff806`7b3c4be4 : 00000000`00000000 fffff806`76322180 fffff806`7b790400 ffff9e08`ce711080 : nt!KiRetireDpcList+0x1ef
fffff806`7e46bc60 00000000`00000000 : fffff806`7e46c000 fffff806`7e466000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x84
SYMBOL_NAME: nt!KiIntSteerCalculateDistribution+120
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.18362.329
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 120
FAILURE_BUCKET_ID: AV_nt!KiIntSteerCalculateDistribution
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3035e70d-e1a6-b78e-ff73-da6251b6f39c}
Followup: MachineOwner
---------
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8032b8449c2, The address that the exception occurred at
Arg3: ffffae801c075a08, Parameter 0 of the exception
Arg4: ffffae801c075250, Parameter 1 of the exception
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 5
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-NG9H4F5
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 6
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: 1e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8032b8449c2
BUGCHECK_P3: ffffae801c075a08
BUGCHECK_P4: ffffae801c075250
WRITE_ADDRESS: fffff8032bd723b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8032bc293b8: Unable to get Flags value from nt!KdVersionBlock
fffff8032bc293b8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffae801c075250
EXCEPTION_PARAMETER1: ffffae801c075a08
EXCEPTION_PARAMETER2: ffffae801c075250
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: VSSVC.exe
TRAP_FRAME: ffff800000000000 -- (.trap 0xffff800000000000)
Unable to read trap frame at ffff8000`00000000
STACK_TEXT:
ffffae80`1c0749a8 fffff803`2baa6637 : 00000000`0000001e ffffffff`c0000005 fffff803`2b8449c2 ffffae80`1c075a08 : nt!KeBugCheckEx
ffffae80`1c0749b0 fffff803`2b9d8d36 : fffff803`2b8449c2 fffff803`2b9166bb ffffae80`1c075c48 ffffae80`1c075250 : nt!KiFatalFilter+0x1f
ffffae80`1c0749f0 fffff803`2b99c27c : ffffae80`00000002 ffffae80`1c0766a0 ffffae80`1c071000 ffffae80`1c077000 : nt!KeExpandKernelStackAndCalloutInternal$filt$0+0x16
ffffae80`1c074a30 fffff803`2b9c9ed2 : ffffae80`1c0766a0 ffffae80`1c075010 00000000`00000000 00000000`00000000 : nt!_C_specific_handler+0xac
ffffae80`1c074aa0 fffff803`2b8c3555 : 00000000`00000000 00000000`00000000 ffffae80`1c075010 00007fff`ffff0000 : nt!RtlpExecuteHandlerForException+0x12
ffffae80`1c074ad0 fffff803`2b8c7aee : ffffae80`1c075a08 ffffae80`1c075750 ffffae80`1c075a08 ffffce0d`8f58cbd8 : nt!RtlDispatchException+0x4a5
ffffae80`1c075220 fffff803`2b9d301d : ffff8341`a0d06000 ffffae80`1c075ab0 ffff8000`00000000 00000000`00020010 : nt!KiDispatchException+0x16e
ffffae80`1c0758d0 fffff803`2b9cf205 : 00000000`00000001 ffffffff`ffffffff ffffce0d`8c48a590 ffffce0d`902b5840 : nt!KiExceptionDispatch+0x11d
ffffae80`1c075ab0 fffff803`2b8449c2 : 00000028`00080000 00010008`00230000 fffff803`2b844380 00000000`00000023 : nt!KiPageFault+0x445
ffffae80`1c075c48 fffff803`2b844380 : 00000000`00000023 ffffce0d`8b25eb00 00000000`00000000 ffffce0d`8b25ea80 : nt!RtlRbRemoveNode+0x3c2
ffffae80`1c075c60 fffff803`2b843e3a : ffffce0d`82600280 ffffce0d`82600280 ffffce0d`8c489fb0 ffffae80`1c075d70 : nt!RtlpHpVsChunkCoalesce+0xb0
ffffae80`1c075cd0 fffff803`2b8460ad : 00000000`0000005d 00000000`00000000 00000000`00000103 00000000`00000000 : nt!RtlpHpVsContextFree+0x18a
ffffae80`1c075d70 fffff803`2bb6e0a9 : ffffe206`0d718080 ffffe206`00000220 ffffffff`ffffffff 01000000`00100000 : nt!ExFreeHeapPool+0x56d
ffffae80`1c075e90 fffff803`2d8fedad : ffffe206`0d718080 ffffe206`18189a48 ffffce0d`8b6e3dc8 ffffe206`15f79050 : nt!ExFreePool+0x9
ffffae80`1c075ec0 fffff803`2d8fd906 : fffff803`2d8e9060 ffffe206`15f79050 ffffe206`00000000 ffffe206`15f79050 : FLTMGR!FltReleaseFileNameInformation+0x12d
ffffae80`1c075f00 fffff803`2d8fefaa : ffffe206`181899e0 ffffe206`00008000 00000000`00000000 ffffe206`181899e0 : FLTMGR!CleanupStreamListCtrl+0x2a6
ffffae80`1c075f80 fffff803`2be6ecdb : ffffce0d`8c474170 ffffe206`181899e8 ffffce0d`00000000 ffffe206`1de694e8 : FLTMGR!DeleteStreamListCtrlCallback+0xba
ffffae80`1c075fc0 fffff803`2e4d2b06 : ffffce0d`8c474170 ffffae80`1c0760f8 ffffe206`1de694e8 00000000`00000705 : nt!FsRtlTeardownPerStreamContexts+0xcb
ffffae80`1c076000 fffff803`2e4d3452 : ffffce0d`8c474170 fffff803`2e417e9a ffffce0d`00000483 00000000`120f7000 : Ntfs!NtfsDeleteScb+0x166
ffffae80`1c076090 fffff803`2e412035 : ffffce0d`8c474050 ffffce0d`8c474170 ffffce0d`8c474010 ffffce0d`8c474170 : Ntfs!NtfsRemoveScb+0xba
ffffae80`1c0760f0 fffff803`2e4d3190 : ffffe206`1de694e8 00000000`00000002 ffffce0d`8c474010 ffffce0d`8c474400 : Ntfs!NtfsPrepareFcbForRemoval+0x75
ffffae80`1c076130 fffff803`2e41669a : ffffe206`1de694e8 ffffae80`1c076231 ffffce0d`8c474458 ffffe206`1de694e8 : Ntfs!NtfsTeardownStructures+0xa0
ffffae80`1c0761b0 fffff803`2e4f49cc : ffffae80`1c076300 ffffce0d`00000000 ffffe206`00000000 ffffe206`1de694e8 : Ntfs!NtfsDecrementCloseCounts+0xaa
ffffae80`1c0761f0 fffff803`2e4f3911 : ffffe206`1de694e8 ffffce0d`8c474170 ffffce0d`8c474010 ffffe206`16080180 : Ntfs!NtfsCommonClose+0x45c
ffffae80`1c0762d0 fffff803`2e54d1d0 : ffffce0d`00000001 ffffffff`00000000 00000000`00000000 ffffe206`16080a48 : Ntfs!NtfsFspCloseInternal+0x241
ffffae80`1c076430 fffff803`2e4c3e36 : ffffe206`1b054058 ffffce0d`842058b0 ffffe206`1b054058 ffffce0d`842058b0 : Ntfs!NtfsFlushVolume+0x130
ffffae80`1c076550 fffff803`2e4c3549 : ffffe206`1b054058 ffffe206`1bed29a0 fffff803`2e4c3501 ffffae80`1c076780 : Ntfs!NtfsCommonFlushBuffers+0x8a6
ffffae80`1c076670 fffff803`2b869ff8 : ffffae80`1c076780 ffffe206`1b054058 ffffe206`1bd25080 00000000`00000000 : Ntfs!NtfsCommonFlushBuffersCallout+0x19
ffffae80`1c0766a0 fffff803`2b869f6d : fffff803`2e4c3530 ffffae80`1c076780 00000000`00000000 fffff803`2d8c4bea : nt!KeExpandKernelStackAndCalloutInternal+0x78
ffffae80`1c076710 fffff803`2e53bb6e : ffffae80`1c077000 00000000`00000000 ffffae80`1c076770 00000000`00000008 : nt!KeExpandKernelStackAndCalloutEx+0x1d
ffffae80`1c076750 fffff803`2e53ba9d : 00000000`00000000 ffffe206`1bed29a0 ffffe206`1b054058 ffffae80`1c0767e8 : Ntfs!NtfsCommonFlushBuffersOnNewStack+0x66
ffffae80`1c0767c0 fffff803`2b831f39 : ffffe206`0d782010 ffffe206`1bed29a0 ffffe206`1b054058 ffffae80`1c0767e8 : Ntfs!NtfsFsdFlushBuffers+0xdd
ffffae80`1c076830 fffff803`2d8c55de : 00000000`00000000 ffffae80`1c076910 ffffe206`1bed29a0 ffffae80`1c076920 : nt!IofCallDriver+0x59
ffffae80`1c076870 fffff803`2d8c3f16 : ffffae80`1c076910 00000000`00000000 ffffe206`0d6cf001 ffffe206`1114cbc0 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
ffffae80`1c0768f0 fffff803`2b831f39 : ffffe206`1bed29a0 00000000`00000000 00000000`00000000 00000000`00000000 : FLTMGR!FltpDispatch+0xb6
ffffae80`1c076950 fffff803`2bde8345 : ffffe206`1bed29a0 00000000`00000000 00000000`00000000 ffffe206`1e7ba9c0 : nt!IofCallDriver+0x59
ffffae80`1c076990 fffff803`2bec37fc : ffffe206`00000000 ffffe206`1c058130 ffffe206`1e7ba9c0 ffffae80`1c076b80 : nt!IopSynchronousServiceTail+0x1a5
ffffae80`1c076a30 fffff803`2bec35e6 : ffffe206`0d718080 00007ff6`e10961d0 ffffe206`15e30d20 00000000`00000000 : nt!NtFlushBuffersFileEx+0x1fc
ffffae80`1c076ac0 fffff803`2b9d2918 : ffffe206`0d718080 0000001e`cd4c6000 ffffae80`1c076b80 ffffe206`1b5863e0 : nt!NtFlushBuffersFile+0x16
ffffae80`1c076b00 00007ffa`fa8bca34 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000001e`cdb7f708 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`fa8bca34
SYMBOL_NAME: nt!ExFreePool+9
IMAGE_NAME: Pool_Corruption
IMAGE_VERSION: 10.0.18362.356
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 9
FAILURE_BUCKET_ID: 0x1E_c0000005_nt!ExFreePool
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {6ec444be-81e5-f9cb-e158-9efa921a7a06}
Followup: Pool_corruption
---------
drive.google.com
