KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffffc8d3626f7c0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffffc8d3626f718, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4390
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 6897
Key : Analysis.Memory.CommitPeak.Mb
Value: 75
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: fffffc8d3626f7c0
BUGCHECK_P3: fffffc8d3626f718
BUGCHECK_P4: 0
TRAP_FRAME: fffffc8d3626f7c0 -- (.trap 0xfffffc8d3626f7c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffa5077e5f71a0 rbx=0000000000000000 rcx=0000000000000003
rdx=fffff8017414a6e8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8017707048d rsp=fffffc8d3626f950 rbp=000000010545c050
r8=0000000000000000 r9=fffff80176c00000 r10=fffff80174147ac0
r11=fffffc8d3626fa00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po cy
nt!KiInsertTimerTable+0x18f1fd:
fffff801`7707048d cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: fffffc8d3626f718 -- (.exr 0xfffffc8d3626f718)
ExceptionAddress: fffff8017707048d (nt!KiInsertTimerTable+0x000000000018f1fd)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: svchost.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
fffffc8d`3626f498 fffff801`77007169 : 00000000`00000139 00000000`00000003 fffffc8d`3626f7c0 fffffc8d`3626f718 : nt!KeBugCheckEx
fffffc8d`3626f4a0 fffff801`77007590 : 00000000`00000000 ffffa507`7e5f7118 ffff8206`085ce700 fffffc8d`3626f6a0 : nt!KiBugCheckDispatch+0x69
fffffc8d`3626f5e0 fffff801`77005923 : ffffa507`7f2a8080 fffffc8d`3626f800 00000000`00000000 fffff801`76ffbf96 : nt!KiFastFailDispatch+0xd0
fffffc8d`3626f7c0 fffff801`7707048d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x323
fffffc8d`3626f950 fffff801`76edf5fd : ffffa507`7e5f7080 ffffa507`00000005 00000000`00000000 ffffd300`00000000 : nt!KiInsertTimerTable+0x18f1fd
fffffc8d`3626f9d0 fffff801`76e877fc : ffffa507`00000051 ffffa507`00000000 fffffc8d`00000001 00000299`736780a8 : nt!KiCommitThreadWait+0x3bd
fffffc8d`3626fa70 fffff801`772692d0 : ffffa507`7e5f7080 fffffc8d`3626fb80 fffffc8d`3626fb80 00000000`00000002 : nt!KeWaitForAlertByThreadId+0xc4
fffffc8d`3626fad0 fffff801`77006bb8 : ffffa507`7e5f7080 fffffc8d`3626fb10 ffffffff`ffcbd0a0 00000000`00000000 : nt!NtWaitForAlertByThreadId+0x30
fffffc8d`3626fb00 00007ffe`e5e6f794 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000f6`2d47f6a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`e5e6f794
SYMBOL_NAME: nt!KiInsertTimerTable+18f1fd
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.630
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 18f1fd
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiInsertTimerTable
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {f89e8bcc-9d62-a3aa-7602-6fa1ac774850}
Followup: MachineOwner
---------
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->CombinedApcDisable field. This consists of two separate 16-bit
fields, the SpecialApcDisable and the KernelApcDisable. A negative value
of either indicates that a driver has disabled special or normal APCs
(respectively) without re-enabling them; a positive value indicates that
a driver has enabled special or normal APCs (respectively) too many times.
Arguments:
Arg1: 00007ff99ab0be24, Address of system call function or worker routine
Arg2: 0000000000000000, Thread->ApcStateIndex
Arg3: 000000000000ffff, (Thread->SpecialApcDisable << 16) | Thread->KernelApcDisable
Arg4: ffff8c8c7d2d8b80, Call type (0 - system call, 1 - worker routine)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4624
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 7381
Key : Analysis.Memory.CommitPeak.Mb
Value: 79
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 1
BUGCHECK_P1: 7ff99ab0be24
BUGCHECK_P2: 0
BUGCHECK_P3: ffff
BUGCHECK_P4: ffff8c8c7d2d8b80
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: EpicGamesLauncher.exe
STACK_TEXT:
ffff8c8c`7d2d89b8 fffff806`12807169 : 00000000`00000001 00007ff9`9ab0be24 00000000`00000000 00000000`0000ffff : nt!KeBugCheckEx
ffff8c8c`7d2d89c0 fffff806`12807033 : 000001ca`b8a49880 00000000`00000000 ffff8c8c`7d2d8b18 ffffffff`fffe7960 : nt!KiBugCheckDispatch+0x69
ffff8c8c`7d2d8b00 00007ff9`9ab0be24 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExitPico+0x1fe
00000047`f8bef618 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`9ab0be24
SYMBOL_NAME: nt!KiSystemServiceExitPico+1fe
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.630
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1fe
FAILURE_BUCKET_ID: 0x1_SysCallNum_4_nt!KiSystemServiceExitPico
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {52cd694c-15ec-48c3-924a-3539560711db}
Followup: MachineOwner
---------
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8002ac58fff, The address that the exception occurred at
Arg3: ffff86898afee638, Exception Record Address
Arg4: ffff8801d013d920, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 5453
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 11828
Key : Analysis.Memory.CommitPeak.Mb
Value: 76
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8002ac58fff
BUGCHECK_P3: ffff86898afee638
BUGCHECK_P4: ffff8801d013d920
EXCEPTION_RECORD: ffff86898afee638 -- (.exr 0xffff86898afee638)
ExceptionAddress: fffff8002ac58fff (nt!KiCheckPreferredHeteroProcessor+0x000000000000004f)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffff9b8b000000c0
Attempt to read from address ffff9b8b000000c0
CONTEXT: ffff8801d013d920 -- (.cxr 0xffff8801d013d920)
rax=0000000000000004 rbx=0000000000000000 rcx=0000000000000012
rdx=0000000000000000 rsi=ffff9b8b7ee2c040 rdi=ffff9b8b00000000
rip=fffff8002ac58fff rsp=ffff86898afee870 rbp=ffff86898afee8b0
r8=0000000000000000 r9=0000000000000000 r10=0000000000000037
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000004 r15=ffff86898afee9a8
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050286
nt!KiCheckPreferredHeteroProcessor+0x4f:
fffff800`2ac58fff 4c8bbfc0000000 mov r15,qword ptr [rdi+0C0h] ds:002b:ffff9b8b`000000c0=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff8002b6fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8002b60f340: Unable to get Flags value from nt!KdVersionBlock
fffff8002b60f340: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffff9b8b000000c0
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffff9b8b000000c0
EXCEPTION_STR: 0xc0000005
BAD_STACK_POINTER: ffff8801d013d0e8
STACK_TEXT:
ffff8689`8afee870 fffff800`2af19b56 : 00000000`00000000 ffff9b8b`7ee2c040 00000000`00000000 00000000`00000000 : nt!KiCheckPreferredHeteroProcessor+0x4f
ffff8689`8afee8e0 fffff800`2af199b4 : 00000000`00000005 ffff8689`8afee9a8 ffff8689`8afee9a0 ffff8801`d0140180 : nt!KiSendHeteroRescheduleIntRequestHelper+0x156
ffff8689`8afee970 fffff800`2ae6fb1c : ffff8801`ffffffff 00000000`00000000 00000000`00000000 ffff9b8b`87c29158 : nt!KiSendHeteroRescheduleIntRequest+0x74
ffff8689`8afee9a0 fffff800`2acdf38f : ffff9b8b`00000002 ffff9b8b`00000005 00000000`00000000 ffff9b8b`00000000 : nt!KiSwapThread+0x1901bc
ffff8689`8afeea50 fffff800`2ad038a7 : ffff9b8b`00000000 fffff800`00000000 00000000`00000000 00000000`00000000 : nt!KiCommitThreadWait+0x14f
ffff8689`8afeeaf0 fffff800`2ad03450 : ffff9b8b`7cc89340 fffff800`2ac1a9a0 ffff9b8b`7cc8ea20 ffff9b8b`00000000 : nt!KeRemovePriQueue+0x1a7
ffff8689`8afeeb70 fffff800`2aca29a5 : ffff9b8b`7cc89340 00000000`00000080 ffff9b8b`7cc8d040 000f8067`b4bbbdff : nt!ExpWorkerThread+0xa0
ffff8689`8afeec10 fffff800`2adfc868 : ffff8801`d01ea180 ffff9b8b`7cc89340 fffff800`2aca2950 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff8689`8afeec60 00000000`00000000 : ffff8689`8afef000 ffff8689`8afe9000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!KiCheckPreferredHeteroProcessor+4f
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.630
STACK_COMMAND: .cxr 0xffff8801d013d920 ; kb
BUCKET_ID_FUNC_OFFSET: 4f
FAILURE_BUCKET_ID: AV_STACKPTR_ERROR_nt!KiCheckPreferredHeteroProcessor
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {dd4b6f6b-f4db-2a05-fd3d-2e93c29202c5}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffd00e6ba36520, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd00e6ba36478, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6937
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 14409
Key : Analysis.Memory.CommitPeak.Mb
Value: 85
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffd00e6ba36520
BUGCHECK_P3: ffffd00e6ba36478
BUGCHECK_P4: 0
TRAP_FRAME: ffffd00e6ba36520 -- (.trap 0xffffd00e6ba36520)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff9808949cd1d0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffff980896606610 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8014ee45800 rsp=ffffd00e6ba366b0 rbp=0000000000000000
r8=0000000000000002 r9=ffff98089661dc60 r10=0000fffff8014ee4
r11=fffff8014ef1e000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
rt640x64+0x5800:
fffff801`4ee45800 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffd00e6ba36478 -- (.exr 0xffffd00e6ba36478)
ExceptionAddress: fffff8014ee45800 (rt640x64+0x0000000000005800)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffd00e`6ba361f8 fffff801`44007169 : 00000000`00000139 00000000`00000003 ffffd00e`6ba36520 ffffd00e`6ba36478 : nt!KeBugCheckEx
ffffd00e`6ba36200 fffff801`44007590 : ffffd00e`6ba36430 00000000`00000000 ffff9808`00000000 ffff9808`94196008 : nt!KiBugCheckDispatch+0x69
ffffd00e`6ba36340 fffff801`44005923 : ffff9808`00001eb4 ffff9808`975b5060 00060080`00000000 00000001`0000004b : nt!KiFastFailDispatch+0xd0
ffffd00e`6ba36520 fffff801`4ee45800 : ffff9808`949cd000 00000000`00000001 00000000`00000001 ffff9808`9661dc60 : nt!KiRaiseSecurityCheckFailure+0x323
ffffd00e`6ba366b0 ffff9808`949cd000 : 00000000`00000001 00000000`00000001 ffff9808`9661dc60 ffff9808`9661dc01 : rt640x64+0x5800
ffffd00e`6ba366b8 00000000`00000001 : 00000000`00000001 ffff9808`9661dc60 ffff9808`9661dc01 fffff801`46677e25 : 0xffff9808`949cd000
ffffd00e`6ba366c0 00000000`00000001 : ffff9808`9661dc60 ffff9808`9661dc01 fffff801`46677e25 ffff9808`946f31a0 : 0x1
ffffd00e`6ba366c8 ffff9808`9661dc60 : ffff9808`9661dc01 fffff801`46677e25 ffff9808`946f31a0 ffffd00e`6ba36800 : 0x1
ffffd00e`6ba366d0 ffff9808`9661dc01 : fffff801`46677e25 ffff9808`946f31a0 ffffd00e`6ba36800 ffff9808`9661dc60 : 0xffff9808`9661dc60
ffffd00e`6ba366d8 fffff801`46677e25 : ffff9808`946f31a0 ffffd00e`6ba36800 ffff9808`9661dc60 ffff9808`946f40c0 : 0xffff9808`9661dc01
ffffd00e`6ba366e0 fffff801`46677fd2 : fffff801`46677d60 ffffd00e`6ba36849 ffff9808`968033c8 ffff9808`96803380 : ndis!NdisGetThreadObjectCompartmentId+0x2f5
ffffd00e`6ba36740 fffff801`46674927 : fffff801`46af33b0 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!NdisGetThreadObjectCompartmentId+0x4a2
ffffd00e`6ba36780 fffff801`46961b24 : 00000000`00000002 00000000`00000000 00000000`00000001 00000000`00000002 : ndis!NdisReturnNetBufferLists+0x557
ffffd00e`6ba368b0 fffff801`467e5b63 : ffff9808`9661dc60 00000000`00000000 ffff9808`00000001 00000000`00000000 : tcpip!FlpReturnNetBufferListChain+0xd4
ffffd00e`6ba36910 fffff801`469141d1 : ffff9808`968dd660 00000000`00000001 ffff9808`9661dc60 00000000`00000000 : NETIO!NetioDereferenceNetBufferListChain+0x103
ffffd00e`6ba36990 fffff801`4696e57e : ffff9808`96890160 ffff9808`968dd660 fffff801`46961a11 ffffd00e`6ba36e00 : tcpip!IpFlcReceivePreValidatedPackets+0xef1
ffffd00e`6ba36c20 fffff801`43e0d468 : ffff9808`941aa3c0 00000000`00000002 ffffbe00`b7d4b1c0 ffffd00e`6ba36f18 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x12e
ffffd00e`6ba36d70 fffff801`43e0d3dd : fffff801`4696e450 ffffd00e`6ba36f18 ffff9808`91e290e0 fffff801`467e23d3 : nt!KeExpandKernelStackAndCalloutInternal+0x78
ffffd00e`6ba36de0 fffff801`469615ed : 00000000`00000000 00000000`00000000 ffff9808`981d8720 fffff801`46be142f : nt!KeExpandKernelStackAndCalloutEx+0x1d
ffffd00e`6ba36e20 fffff801`46960ccd : 00000000`00000001 ffffd00e`6ba36f80 ffff9808`968dd660 00000000`00000000 : tcpip!NetioExpandKernelStackAndCallout+0x8d
ffffd00e`6ba36e80 fffff801`46671eb0 : ffff9808`94dc2d81 00000000`00000001 ffff9808`968033b0 ffffd00e`6ba37290 : tcpip!FlReceiveNetBufferListChain+0x46d
ffffd00e`6ba37130 fffff801`46671ccb : ffff9808`94632460 ffffd00e`00000001 ffffd00e`00000000 ffff9808`00000001 : ndis!NdisTryAcquireNicActive+0xc00
ffffd00e`6ba37210 fffff801`46677ef0 : ffff9808`946f31a0 ffff9808`9661dc01 ffff9808`946f31a0 00000000`00000001 : ndis!NdisTryAcquireNicActive+0xa1b
ffffd00e`6ba37290 fffff801`466adee3 : ffff9808`9661dc60 ffffd00e`6ba37361 00000000`00000000 fffff801`4eeaa1fd : ndis!NdisGetThreadObjectCompartmentId+0x3c0
ffffd00e`6ba372e0 fffff801`46674a94 : 00000000`0013de4b 00000000`00000001 ffff9808`946f31a0 00000000`00000001 : ndis!NdisWdfNotifyWmiAdapterArrival+0x803
ffffd00e`6ba373b0 fffff801`4ee5ae87 : ffff9808`368f4252 ffff9808`949cd000 ffff9808`9661dc60 00000000`00000000 : ndis!NdisMIndicateReceiveNetBufferLists+0x104
ffffd00e`6ba37440 ffff9808`368f4252 : ffff9808`949cd000 ffff9808`9661dc60 00000000`00000000 00000000`00000001 : rt640x64+0x1ae87
ffffd00e`6ba37448 ffff9808`949cd000 : ffff9808`9661dc60 00000000`00000000 00000000`00000001 ffffbe00`b7d40100 : 0xffff9808`368f4252
ffffd00e`6ba37450 ffff9808`9661dc60 : 00000000`00000000 00000000`00000001 ffffbe00`b7d40100 00000001`00000000 : 0xffff9808`949cd000
ffffd00e`6ba37458 00000000`00000000 : 00000000`00000001 ffffbe00`b7d40100 00000001`00000000 ffff8000`00008001 : 0xffff9808`9661dc60
SYMBOL_NAME: rt640x64+5800
MODULE_NAME: rt640x64
IMAGE_NAME: rt640x64.sys
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 5800
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_rt640x64!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {83de1a17-50f1-fca9-f124-4e4153d267a9}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffb0865e0372b0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffb0865e037208, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 7343
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BORA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 20323
Key : Analysis.Memory.CommitPeak.Mb
Value: 75
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffb0865e0372b0
BUGCHECK_P3: ffffb0865e037208
BUGCHECK_P4: 0
TRAP_FRAME: ffffb0865e0372b0 -- (.trap 0xffffb0865e0372b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff878cfd651800 rbx=0000000000000000 rcx=0000000000000003
rdx=ffff878cfbed3540 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8074856afbc rsp=ffffb0865e037440 rbp=ffffb0865e0374f0
r8=ffff878cfd690200 r9=0000000000000000 r10=0000000000000001
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
rt640x64+0x1afbc:
fffff807`4856afbc cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffb0865e037208 -- (.exr 0xffffb0865e037208)
ExceptionAddress: fffff8074856afbc (rt640x64+0x000000000001afbc)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffb086`5e036f88 fffff807`3a407169 : 00000000`00000139 00000000`00000003 ffffb086`5e0372b0 ffffb086`5e037208 : nt!KeBugCheckEx
ffffb086`5e036f90 fffff807`3a407590 : ffff5650`598ed88f 00000000`00000050 ffff878c`fd923b20 00000000`ffffffff : nt!KiBugCheckDispatch+0x69
ffffb086`5e0370d0 fffff807`3a405923 : ffff878d`00000001 fffff807`3fb446c8 ffff878c`f8fea050 ffffb086`5e037440 : nt!KiFastFailDispatch+0xd0
ffffb086`5e0372b0 fffff807`4856afbc : ffff878c`a87292a6 ffff878c`fbe42000 00000000`00000000 ffff878c`00000001 : nt!KiRaiseSecurityCheckFailure+0x323
ffffb086`5e037440 ffff878c`a87292a6 : ffff878c`fbe42000 00000000`00000000 ffff878c`00000001 ffff878d`00000001 : rt640x64+0x1afbc
ffffb086`5e037448 ffff878c`fbe42000 : 00000000`00000000 ffff878c`00000001 ffff878d`00000001 fffff807`3a2c5eeb : 0xffff878c`a87292a6
ffffb086`5e037450 00000000`00000000 : ffff878c`00000001 ffff878d`00000001 fffff807`3a2c5eeb 00000001`4b4afd01 : 0xffff878c`fbe42000
SYMBOL_NAME: rt640x64+1afbc
MODULE_NAME: rt640x64
IMAGE_NAME: rt640x64.sys
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1afbc
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_rt640x64!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {83de1a17-50f1-fca9-f124-4e4153d267a9}
Followup: MachineOwner
---------
