CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a025e87eaf05d8, Reserved
Arg2: b3b7326ed13168ec, Reserved
Arg3: fffffe1ba160eefc, Failure type dependent information
Arg4: 000000000000000c, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification
8 : Object type
9 : A processor IVT
a : Modification of a system service function
b : A generic session data region
c : Modification of a session function or .pdata
d : Modification of an import table
e : Modification of a session import table
f : Ps Win32 callout modification
10 : Debug switch routine modification
11 : IRP allocator modification
12 : Driver call dispatcher modification
13 : IRP completion dispatcher modification
14 : IRP deallocator modification
15 : A processor control register
16 : Critical floating point control register modification
17 : Local APIC modification
18 : Kernel notification callout modification
19 : Loaded module list modification
1a : Type 3 process list corruption
1b : Type 4 process list corruption
1c : Driver object corruption
1d : Executive callback object modification
1e : Modification of module padding
1f : Modification of a protected process
20 : A generic data region
21 : A page hash mismatch
22 : A session page hash mismatch
23 : Load config directory modification
24 : Inverted function table modification
25 : Session configuration modification
26 : An extended processor control register
27 : Type 1 pool corruption
28 : Type 2 pool corruption
29 : Type 3 pool corruption
2a : Type 4 pool corruption
2b : Modification of a function or .pdata
2c : Image integrity corruption
2d : Processor misconfiguration
2e : Type 5 process list corruption
2f : Process shadow corruption
30 : Retpoline code page corruption
101 : General pool corruption
102 : Modification of win32k.sys
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6530
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 10301
Key : Analysis.Memory.CommitPeak.Mb
Value: 78
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 109
BUGCHECK_P1: a3a025e87eaf05d8
BUGCHECK_P2: b3b7326ed13168ec
BUGCHECK_P3: fffffe1ba160eefc
BUGCHECK_P4: c
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: csrss.exe
STACK_TEXT:
ffff978a`0ecade28 00000000`00000000 : 00000000`00000109 a3a025e8`7eaf05d8 b3b7326e`d13168ec fffffe1b`a160eefc : nt!KeBugCheckEx
CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32k
fffffe1ba160ef0b - win32k!NtDCompositionRemoveCrossDeviceVisualChild+f
[ 08:0a ]
1 error : !win32k (fffffe1ba160ef0b)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: memory_corruption
---------
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffa18dee1ae250, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80611b11cfb, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 5624
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 13654
Key : Analysis.Memory.CommitPeak.Mb
Value: 83
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffa18dee1ae250
BUGCHECK_P2: 0
BUGCHECK_P3: fffff80611b11cfb
BUGCHECK_P4: 0
READ_ADDRESS: fffff8060fefa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8060fe0f2e0: Unable to get Flags value from nt!KdVersionBlock
fffff8060fe0f2e0: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffa18dee1ae250
MM_INTERNAL_CODE: 0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffffd901997b80c0 -- (.trap 0xffffd901997b80c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffa18dec1b0f00 rbx=0000000000000000 rcx=ffffc9075a117e58
rdx=ffffa18dee1ae250 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80611b11cfb rsp=ffffd901997b8250 rbp=0000000000000000
r8=ffffa18debe43760 r9=ffffa18debe437a8 r10=000000006574504d
r11=0000000000001001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
WdFilter+0x51cfb:
fffff806`11b11cfb 483902 cmp qword ptr [rdx],rax ds:ffffa18d`ee1ae250=????????????????
Resetting default scope
STACK_TEXT:
ffffd901`997b7e18 fffff806`0f6869d9 : 00000000`00000050 ffffa18d`ee1ae250 00000000`00000000 ffffd901`997b80c0 : nt!KeBugCheckEx
ffffd901`997b7e20 fffff806`0f4eeb80 : 00000050`00000050 00000000`00000000 ffffd901`997b8140 00000000`00000000 : nt!MiSystemFault+0x13fda9
ffffd901`997b7f20 fffff806`0f60205e : 00000000`00000000 ffffd901`997b8189 ffffd901`997b8238 ffffd901`997b8260 : nt!MmAccessFault+0x400
ffffd901`997b80c0 fffff806`11b11cfb : fffff806`11ad4000 00000000`00000000 00000000`00000002 ffffc907`5a117dc0 : nt!KiPageFault+0x35e
ffffd901`997b8250 fffff806`11ae3235 : 00000000`0000019e ffffa18d`9dcbf3a0 00000000`00000000 00000000`00000000 : WdFilter+0x51cfb
ffffd901`997b8300 fffff806`0bbe8862 : ffffa18d`9d315b90 ffffc907`5ed25500 ffffc907`57bf79e0 ffffffff`ffffffff : WdFilter+0x23235
ffffd901`997b8340 fffff806`0bc1c331 : ffffc907`5ed255a8 00000000`00000000 ffffa18d`9d315ba8 ffffffff`ffffffff : FLTMGR!DoReleaseContext+0x82
ffffd901`997b8380 fffff806`0bc1c822 : ffffc907`5ed255a8 00000000`00000705 ffffffff`ffffffff ffffc907`5a0bbb18 : FLTMGR!FltpDeleteContextList+0xc1
ffffd901`997b83b0 fffff806`0bc1cd8a : ffffc907`5ed25560 ffffc907`5ed25568 ffffc907`5ed25560 ffffc907`5ed25560 : FLTMGR!CleanupStreamListCtrl+0x4a
ffffd901`997b83f0 fffff806`0f844bc9 : ffffa18d`ea6747c8 ffffc907`5ed25568 00000000`00000000 ffffd901`997b88f0 : FLTMGR!DeleteStreamListCtrlCallback+0xba
ffffd901`997b8430 fffff806`12a8c17b : ffffa18d`ea674790 ffffd901`997b8578 ffffd901`997b88f0 00000000`00000705 : nt!FsRtlTeardownPerStreamContexts+0xc9
ffffd901`997b8470 fffff806`12a8bf06 : ffffa18d`ea674790 00000000`6366744e 00000000`000000a0 00000000`0000018c : Ntfs!NtfsDeleteScb+0x17b
ffffd901`997b8510 fffff806`12997b95 : ffffc907`5a0bca58 ffffa18d`ea674790 ffffd901`997b85c9 00000000`00000000 : Ntfs!NtfsRemoveScb+0x66
ffffd901`997b8570 fffff806`12a8bc9c : ffffd901`997b88f0 fffff806`12ad79a0 ffffa18d`ea674630 ffffa18d`ea674a00 : Ntfs!NtfsPrepareFcbForRemoval+0x75
ffffd901`997b85b0 fffff806`1299bd40 : ffffd901`997b88f0 ffffd901`997b86b2 ffffa18d`ea674a88 ffffa18d`ea674630 : Ntfs!NtfsTeardownStructures+0x9c
ffffd901`997b8630 fffff806`12abb547 : ffffd901`997b8700 ffffa18d`00000000 00000000`00000000 ffffa18d`ea674600 : Ntfs!NtfsDecrementCloseCounts+0xb0
ffffd901`997b8670 fffff806`12ab8061 : ffffd901`997b88f0 ffffa18d`ea674790 ffffa18d`ea674630 ffffc907`5a0bc180 : Ntfs!NtfsCommonClose+0x467
ffffd901`997b8750 fffff806`12ad7a28 : 00000000`0000001c fffff806`0ff24440 00000000`00000000 00000000`00000000 : Ntfs!NtfsFspCloseInternal+0x241
ffffd901`997b88b0 fffff806`0f4c1f15 : ffffc907`636d9040 fffff806`12ad79a0 ffffc907`54a9ecc0 ffffc907`00000000 : Ntfs!NtfsFspClose+0x88
ffffd901`997b8b70 fffff806`0f466dd5 : ffffc907`636d9040 00000000`00000080 ffffc907`54a93040 00000000`00000001 : nt!ExpWorkerThread+0x105
ffffd901`997b8c10 fffff806`0f5fb4f8 : fffff806`0ab4c180 ffffc907`636d9040 fffff806`0f466d80 00000000`00000246 : nt!PspSystemThreadStartup+0x55
ffffd901`997b8c60 00000000`00000000 : ffffd901`997b9000 ffffd901`997b3000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: WdFilter+51cfb
MODULE_NAME: WdFilter
IMAGE_NAME: WdFilter.sys
IMAGE_VERSION: 4.18.2009.7
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 51cfb
FAILURE_BUCKET_ID: AV_R_INVALID_WdFilter!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {90a95f8f-f779-a86f-19f1-7c77e04a9e0a}
Followup: MachineOwner
---------
