SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8031c2c0a30, The address that the exception occurred at
Arg3: fffff50f0e6f8bd8, Exception Record Address
Arg4: fffff50f0e6f8420, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.Sec
Value: 4
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 5
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8031c2c0a30
BUGCHECK_P3: fffff50f0e6f8bd8
BUGCHECK_P4: fffff50f0e6f8420
EXCEPTION_RECORD: fffff50f0e6f8bd8 -- (.exr 0xfffff50f0e6f8bd8)
ExceptionAddress: fffff8031c2c0a30 (Ntfs!NtfsNonCachedIo+0x0000000000000c00)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff50f0e6f8420 -- (.cxr 0xfffff50f0e6f8420)
rax=0000000000000000 rbx=00000000c0000005 rcx=fffff50f0e6f7ce0
rdx=fffff50f0e6f7401 rsi=ffffbe0dbe1bc9b8 rdi=0000000000000000
rip=fffff8031c2c0a30 rsp=fffff50f0e6f8e10 rbp=fffff50f0e6f8f10
r8=0000000000000001 r9=fffff50f0e6f7470 r10=000000000010000b
r11=fffff50f0e6f74e0 r12=0000000000000000 r13=caffbe0dbc705a30
r14=ffff98080b5a2170 r15=0000000000030001
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
Ntfs!NtfsNonCachedIo+0xc00:
fffff803`1c2c0a30 41895d30 mov dword ptr [r13+30h],ebx ds:002b:caffbe0d`bc705a60=????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff80317d733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff80317c2a3c8: Unable to get Flags value from nt!KdVersionBlock
fffff80317c2a3c8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
fffff50f`0e6f8e10 fffff803`1c2c6e58 : fffff50f`0e6f92b0 00000000`00008000 00000000`00000001 ffffbe0d`bc705a30 : Ntfs!NtfsNonCachedIo+0xc00
fffff50f`0e6f90c0 fffff803`1c2c641c : fffff50f`0e6f92c0 ffffbe0d`bc705a30 fffff50f`0e6f92c0 ffffbe0d`be1bc9b8 : Ntfs!NtfsCommonRead+0x828
fffff50f`0e6f9280 fffff803`1790a929 : ffffbe0d`c1e64010 ffffbe0d`bc705a30 ffffbe0d`bc705e60 ffffbe0d`b961c800 : Ntfs!NtfsFsdRead+0x20c
fffff50f`0e6f9340 fffff803`1b8e55de : 00000000`00000000 fffff50f`0e6f9420 ffffbe0d`bc705a30 fffff50f`0e6f9430 : nt!IofCallDriver+0x59
fffff50f`0e6f9380 fffff803`1b8e3f16 : fffff50f`0e6f9420 fffff803`1792baf6 0000000f`ffffff01 00000000`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
fffff50f`0e6f9400 fffff803`1790a929 : ffffbe0d`bc705a30 fffff803`17821951 ffffbe0d`c1c276c0 00000000`00000000 : FLTMGR!FltpDispatch+0xb6
fffff50f`0e6f9460 fffff803`17821853 : 00000000`00000000 ffffbe0d`bc705a30 ffffbe0d`bce201d0 ffffbe0d`bce20290 : nt!IofCallDriver+0x59
fffff50f`0e6f94a0 fffff803`17821670 : ffffbe0d`bce20180 fffff803`179055d6 ffffbe0d`bce201e0 ffffbe0d`bce201a0 : nt!IoPageReadEx+0x1d3
fffff50f`0e6f9510 fffff803`17de20dc : ffffbe0d`bce20180 ffffbe0d`b7882080 ffffbe0d`bce20290 ffffbe0d`c1cb8c78 : nt!MiPageRead+0x28
fffff50f`0e6f9560 fffff803`17de1f61 : ffffbe0d`c1cb8bb0 00000000`00000000 00000000`ffffffff 00000000`00000000 : nt!MiPfExecuteReadList+0xe8
fffff50f`0e6f95e0 fffff803`178212bf : ffffbe0d`c0c358e0 fffff50f`0e6f97f0 ffffbe0d`c1cb8bb0 ffffbe0d`c1c495e0 : nt!MmPrefetchForCacheManager+0xd9
fffff50f`0e6f9640 fffff803`1798b6f0 : ffffbe0d`00008000 00000000`00000000 00000000`00028000 00000000`00028000 : nt!CcAsyncReadPrefetch+0x14f
fffff50f`0e6f96f0 fffff803`1786bcd5 : ffffbe0d`b7882080 ffffbe0d`b7882080 fffff803`1798b560 ffffbe0d`b78fc560 : nt!CcAsyncReadWorker+0x190
fffff50f`0e6f9c10 fffff803`179c9998 : ffffab81`1de20180 ffffbe0d`b7882080 fffff803`1786bc80 00000000`00000000 : nt!PspSystemThreadStartup+0x55
fffff50f`0e6f9c60 00000000`00000000 : fffff50f`0e6fa000 fffff50f`0e6f4000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: Ntfs!NtfsNonCachedIo+c00
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
IMAGE_VERSION: 10.0.18362.719
STACK_COMMAND: .cxr 0xfffff50f0e6f8420 ; kb
BUCKET_ID_FUNC_OFFSET: c00
FAILURE_BUCKET_ID: AV_Ntfs!NtfsNonCachedIo
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {b1720fe2-9c3e-1feb-2974-cd78a0cdd373}
Followup: MachineOwner
---------
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffb10b97f64f20, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8062cdd535a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 4
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 6
Key : Analysis.Memory.CommitPeak.Mb
Value: 69
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffb10b97f64f20
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8062cdd535a
BUGCHECK_P4: 2
READ_ADDRESS: fffff8062d1733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8062d02a3c8: Unable to get Flags value from nt!KdVersionBlock
fffff8062d02a3c8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffb10b97f64f20
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Registry
TRAP_FRAME: ffffea84d3bdaf50 -- (.trap 0xffffea84d3bdaf50)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffb10b9aace408 rbx=0000000000000000 rcx=fffffffffffffff8
rdx=fffffffffd496b28 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8062cdd535a rsp=ffffea84d3bdb0e8 rbp=ffffea84d3bdb140
r8=00000000fffffff4 r9=7fffb10a9720d050 r10=7ffffffffffffffc
r11=ffffb10a9aace40c r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe cy
nt!memcpy+0x21a:
fffff806`2cdd535a f30f6f4410f0 movdqu xmm0,xmmword ptr [rax+rdx-10h] ds:ffffb10b`97f64f20=????????????????????????????????
Resetting default scope
STACK_TEXT:
ffffea84`d3bdaca8 fffff806`2ce2dd34 : 00000000`00000050 ffffb10b`97f64f20 00000000`00000000 ffffea84`d3bdaf50 : nt!KeBugCheckEx
ffffea84`d3bdacb0 fffff806`2ccc91af : ffffdfb2`5642f71b 00000000`00000000 00000000`00000000 ffffb10b`97f64f20 : nt!MiSystemFault+0x195c94
ffffea84`d3bdadb0 fffff806`2cdd041e : ffffb10a`9720d000 fffff806`2d2894d2 ffffea84`d3bdb401 00000000`0093f408 : nt!MmAccessFault+0x34f
ffffea84`d3bdaf50 fffff806`2cdd535a : fffff806`2d20612b ffffb10a`9720d000 00000000`0093f460 ffffb10a`9720d000 : nt!KiPageFault+0x35e
ffffea84`d3bdb0e8 fffff806`2d20612b : ffffb10a`9720d000 00000000`0093f460 ffffb10a`9720d000 ffffea84`d3bdb130 : nt!memcpy+0x21a
ffffea84`d3bdb0f0 fffff806`2d205fb2 : 00000000`00000014 ffffb10a`977f3048 00000000`00000015 00000000`00000048 : nt!HvReallocateCell+0xd7
ffffea84`d3bdb170 fffff806`2d28d5d2 : ffffb10a`9720d000 00000000`00000001 ffffb10a`977f3048 ffffea84`d3bdb400 : nt!CmpAddValueToListEx+0x7a
ffffea84`d3bdb1d0 fffff806`2d23ab19 : 01d62170`68e3491b ffffea84`d3bdb310 00000000`00000001 ffffb10a`a3f0b730 : nt!CmpSetValueKeyNew+0x8a
ffffea84`d3bdb210 fffff806`2d23a646 : ffffea84`00000001 ffffea84`d3bdb4b0 00000000`00000000 00000000`00000001 : nt!CmSetValueKey+0x379
ffffea84`d3bdb3b0 fffff806`2cdd3c18 : ffffea84`d3bdb6e0 fffff806`2d2e1800 00000000`00000010 00000000`00000082 : nt!NtSetValueKey+0x646
ffffea84`d3bdb5a0 fffff806`2cdc61b0 : fffff806`324533e1 ffffffff`800014c4 ffffd88a`720c8190 ffffd88a`720c8190 : nt!KiSystemServiceCopyEnd+0x28
ffffea84`d3bdb7a8 fffff806`324533e1 : ffffffff`800014c4 ffffd88a`720c8190 ffffd88a`720c8190 fffff806`2cca61ee : nt!KiServiceLinkage
ffffea84`d3bdb7b0 fffff806`32495810 : 00000000`00000000 00000000`00000001 fffff806`2b080180 fffff806`2cc43f8e : volsnap!VspDiagTrace+0x205
ffffea84`d3bdb9f0 fffff806`3247dac1 : ffffd88a`720c8190 ffffd88a`7202b4c8 ffffd88a`00000000 ffffd88a`00000000 : volsnap!VspSetDeletesInMotion+0x13c
ffffea84`d3bdbb10 fffff806`32451759 : ffffd88a`7202b020 ffffd88a`7202b358 ffffd88a`6e135c50 fffff806`3247d520 : volsnap!VspCheckMaxSizeWorker+0x31
ffffea84`d3bdbb40 fffff806`2ccf43b5 : ffffd88a`723f1240 fffff806`32451720 ffffd88a`6e135c50 ffffd88a`75e63be0 : volsnap!VspLowPriorityWorkItem+0x39
ffffea84`d3bdbb70 fffff806`2cc6bcd5 : ffffd88a`723f1240 00000000`00000080 ffffd88a`6e063080 00000224`acbb3dfe : nt!ExpWorkerThread+0x105
ffffea84`d3bdbc10 fffff806`2cdc9998 : ffffc300`6e480180 ffffd88a`723f1240 fffff806`2cc6bc80 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffea84`d3bdbc60 00000000`00000000 : ffffea84`d3bdc000 ffffea84`d3bd6000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: volsnap!VspDiagTrace+205
MODULE_NAME: volsnap
IMAGE_NAME: volsnap.sys
IMAGE_VERSION: 10.0.18362.1059
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 205
FAILURE_BUCKET_ID: AV_R_INVALID_volsnap!VspDiagTrace
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {a237016a-766e-fce0-174d-32ae089d4635}
Followup: MachineOwner
---------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffff83e07fffff80, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8041f8cfd34, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 3
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 5
Key : Analysis.Memory.CommitPeak.Mb
Value: 69
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: a
BUGCHECK_P1: ffff83e07fffff80
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8041f8cfd34
READ_ADDRESS: fffff8041fd733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8041fc2a3c8: Unable to get Flags value from nt!KdVersionBlock
fffff8041fc2a3c8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffff83e07fffff80
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffff92086691e860 -- (.trap 0xffff92086691e860)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000004000 rbx=0000000000000000 rcx=ffffcc0bbd176ae0
rdx=ffff92086691eb68 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80424a7efd6 rsp=ffff92086691e9f8 rbp=ffff92086691eba0
r8=000001e321ccbe38 r9=0000000bc29e0000 r10=0000fffff80424a7
r11=ffffaaf97b400000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe cy
volsnap!VspCompressedTableCompareRoutine+0x6:
fffff804`24a7efd6 4d8b10 mov r10,qword ptr [r8] ds:000001e3`21ccbe38=????????????????
Resetting default scope
STACK_TEXT:
ffff9208`6691e198 fffff804`1f9d41e9 : 00000000`0000000a ffff83e0`7fffff80 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffff9208`6691e1a0 fffff804`1f9d0529 : ffff83c1`c0000000 000001e3`21daf650 ffff9208`6691e3a9 fffff804`1f92d2a2 : nt!KiBugCheckDispatch+0x69
ffff9208`6691e2e0 fffff804`1f8cfd34 : 00000000`00000004 ffff8380`f190ed78 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x469
ffff9208`6691e470 fffff804`1f8cae8c : ffff9208`6691e5e0 00000000`00000000 ffff9208`6691e5b8 fffff804`1f8c9f84 : nt!MiResolveProtoPteFault+0xc4
ffff9208`6691e570 fffff804`1f8c8fc9 : 00000000`00000114 00000000`00000100 00000000`c0000016 fffff804`1f9c9314 : nt!MiDispatchFault+0x80c
ffff9208`6691e6c0 fffff804`1f9d041e : 00000000`00000000 fffff804`1f9c90d6 ffffcc0b`bd176b60 fffff804`1fb6f019 : nt!MmAccessFault+0x169
ffff9208`6691e860 fffff804`24a7efd6 : fffff804`1f93be23 ffffcc0b`bd4cd190 ffffcc0b`bd53c140 00000000`00000000 : nt!KiPageFault+0x35e
ffff9208`6691e9f8 fffff804`1f93be23 : ffffcc0b`bd4cd190 ffffcc0b`bd53c140 00000000`00000000 fffff804`1d760180 : volsnap!VspCompressedTableCompareRoutine+0x6
ffff9208`6691ea00 fffff804`24a5b425 : ffffcc0b`bd176ae0 ffffcc0b`bd176ae0 00000000`00000000 ffffcc0b`bb462000 : nt!RtlLookupElementGenericTableFullAvl+0x53
ffff9208`6691ea30 fffff804`24a885d6 : 00000000`00000000 00000000`00000000 00000000`00000000 0000000a`c623c000 : volsnap!AvlLookupElementGenericTableFull+0x19
ffff9208`6691ea60 fffff804`24a9cfd1 : ffffcc0b`bd4cd600 fffff804`00000000 ffffcc0b`bd1769c0 ffffcc0b`c40c18c0 : volsnap!VspInsertTableEntryWorker+0x4a
ffff9208`6691eaf0 fffff804`24aa2d4a : ffffcc0b`bd1769c0 ffffcc0b`c40c18c0 ffffcc0b`bd1769c0 ffff9208`6691eba0 : volsnap!VspInsertTableEntry+0x9
ffff9208`6691eb30 fffff804`24a99c8b : ffffcc0b`bd4292e8 ffffcc0b`c40c1918 ffffcc0b`bd4292e8 ffffbb01`3f1b1100 : volsnap!VspWriteVolumePhase4+0x9a
ffff9208`6691ebd0 fffff804`1f86bcd5 : ffffcc0b`bd53c040 00000000`00000080 fffff804`24a99bb0 00000224`acbb3dfe : volsnap!VspWorkerThread+0xdb
ffff9208`6691ec10 fffff804`1f9c9998 : ffffbb01`3f1a0180 ffffcc0b`bd53c040 fffff804`1f86bc80 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff9208`6691ec60 00000000`00000000 : ffff9208`6691f000 ffff9208`66919000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: volsnap!VspCompressedTableCompareRoutine+6
MODULE_NAME: volsnap
IMAGE_NAME: volsnap.sys
IMAGE_VERSION: 10.0.18362.1059
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 6
FAILURE_BUCKET_ID: AV_volsnap!VspCompressedTableCompareRoutine
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {bbcee904-4343-c671-ce80-421663026de9}
Followup: MachineOwner
---------
5: kd> lmvm volsnap
Browse full module list
start end module name
fffff804`24a50000 fffff804`24abd000 volsnap # (pdb symbols) C:\ProgramData\Dbg\sym\volsnap.pdb\E010395583EB364F1A36498AC47808E51\volsnap.pdb
Loaded symbol image file: volsnap.sys
Mapped memory image file: C:\ProgramData\Dbg\sym\volsnap.sys\955452396d000\volsnap.sys
Image path: \SystemRoot\System32\drivers\volsnap.sys
Image name: volsnap.sys
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 95545239 (This is a reproducible build file hash, not a timestamp)
CheckSum: 0006B026
ImageSize: 0006D000
File version: 10.0.18362.1059
Product version: 10.0.18362.1059
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: volsnap.sys
OriginalFilename: volsnap.sys
ProductVersion: 10.0.18362.1059
FileVersion: 10.0.18362.1059 (WinBuild.160101.0800)
FileDescription: Volume Shadow Copy driver
LegalCopyright: © Microsoft Corporation. All rights reserved.
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: fffff8bffc42b220
Arg3: 1000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 3
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G25IS1E
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 17
Key : Analysis.Memory.CommitPeak.Mb
Value: 67
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: fffff8bffc42b220
BUGCHECK_P3: 1000000000000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera.exe
STACK_TEXT:
ffffb505`c7730bd8 fffff805`626502b8 : 00000000`0000001a 00000000`00041792 fffff8bf`fc42b220 10000000`00000000 : nt!KeBugCheckEx
ffffb505`c7730be0 fffff805`624e3d07 : ffff858c`0f8ef580 fffff8bf`fc42b220 00000000`00000000 00000000`00000000 : nt!MiDeleteVa+0x16a7b8
ffffb505`c7730cf0 fffff805`624e41c1 : ffffb505`c7731140 fffff8fc`5ffe2158 00000000`00000000 0a000000`aa2c4867 : nt!MiWalkPageTablesRecursively+0x1e7
ffffb505`c7730db0 fffff805`624e41c1 : ffffb505`c7731140 fffff8fc`7e2fff10 00000000`00000000 0a000000`c02e4867 : nt!MiWalkPageTablesRecursively+0x6a1
ffffb505`c7730e70 fffff805`624e41c1 : ffffb505`c7731140 fffff8fc`7e3f17f8 fffff8fc`00000000 0a000000`c0fca867 : nt!MiWalkPageTablesRecursively+0x6a1
ffffb505`c7730f30 fffff805`624e394c : ffffb505`c7731140 fffff8fc`7e3f1f88 ffffb505`00000000 ffffb505`c77310b9 : nt!MiWalkPageTablesRecursively+0x6a1
ffffb505`c7730ff0 fffff805`624e1db8 : ffffb505`c7731140 00000000`00000002 00000000`00000001 ffffb505`00000000 : nt!MiWalkPageTables+0x36c
ffffb505`c77310f0 fffff805`624eff10 : ffffffff`ffffffff ffff858c`0f8ef3f8 ffffb505`00000001 00000000`00000000 : nt!MiDeletePagablePteRange+0x268
ffffb505`c7731490 fffff805`62a7979d : ffff858c`0a84b080 ffff858c`0a84b080 ffff858c`1158dae0 ffff858c`0f8ef3f0 : nt!MiDeleteVad+0x860
ffffb505`c7731650 fffff805`62a884d0 : ffff858c`1158dae0 ffff858c`0d69ad20 ffff858c`0a84b080 00000000`00000000 : nt!MiUnmapVad+0x49
ffffb505`c7731680 fffff805`62a87a3f : ffff858c`1018dba0 ffff858c`1018dba0 ffff858c`0f8ef080 fffff805`6286a400 : nt!MiCleanVad+0x30
ffffb505`c77316b0 fffff805`629de469 : ffffffff`00000000 ffffffff`ffffffff ffffb505`c7731901 ffff858c`0f8ef080 : nt!MmCleanProcessAddressSpace+0x137
ffffb505`c7731730 fffff805`62ad1473 : ffff858c`0f8ef080 ffffd38f`09a3b6b0 ffffb505`c7731959 00000000`00000000 : nt!PspRundownSingleProcess+0x139
ffffb505`c77317b0 fffff805`62aced53 : ffffb505`c0000005 fffff805`66861f01 00000087`51177000 ffffb505`00000006 : nt!PspExitThread+0x60b
ffffb505`c77318c0 fffff805`62516e11 : ffffb505`c778c900 00000000`00000000 00000000`00000000 00000087`00000000 : nt!KiSchedulerApcTerminate+0x33
ffffb505`c7731900 fffff805`625c68f0 : ffffffff`ffffff01 ffffb505`c77319c0 ffffffff`00000000 00000000`00000000 : nt!KiDeliverApc+0x481
ffffb505`c77319c0 fffff805`625d3cbf : ffff858c`0a84b080 00000000`00000000 ffff858c`0a84b080 ffff858c`0a84b080 : nt!KiInitiateUserApc+0x70
ffffb505`c7731b00 00007ff8`a9b75c44 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
00000087`52fff078 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`a9b75c44
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
