2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8032cf811a8, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ExceptionRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ContextRecord ***
*** ***
*************************************************************************
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3749
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 3750
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 1
Key : Analysis.Init.CPU.mSec
Value: 374
Key : Analysis.Init.Elapsed.mSec
Value: 9768
Key : Analysis.Memory.CommitPeak.Mb
Value: 88
Key : Bugcheck.Code.DumpHeader
Value: 0x1e
Key : Bugcheck.Code.Register
Value: 0x1e
Key : Dump.Attributes.AsUlong
Value: 1008
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
FILE_IN_CAB: 051023-8390-01.dmp
DUMP_FILE_ATTRIBUTES: 0x1008
Kernel Generated Triage Dump
BUGCHECK_CODE: 1e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8032cf811a8
BUGCHECK_P3: 0
BUGCHECK_P4: ffffffffffffffff
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: fffff8032b71c468: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff
BLACKBOXNTFS: 1 (!blackboxntfs)
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
ffff9d01`3d7558c8 fffff803`2ac13ddb : 00000000`0000001e ffffffff`c0000005 fffff803`2cf811a8 00000000`00000000 : nt!KeBugCheckEx
ffff9d01`3d7558d0 fffff803`2ae29e12 : 00000100`00000000 00070000`00000100 00000400`00070000 00010000`00000400 : nt!KiDispatchException+0x7eb
ffff9d01`3d755fb0 fffff803`2ae29de0 : fffff803`2ae3e3f5 00000000`00000002 00000000`00000001 ffff8a86`1380e000 : nt!KxExceptionDispatchOnExceptionStack+0x12
ffffad09`277116f8 fffff803`2ae3e3f5 : 00000000`00000002 00000000`00000001 ffff8a86`1380e000 fffff803`2acd6505 : nt!KiExceptionDispatchOnExceptionStackContinue
ffffad09`27711700 fffff803`2ae39483 : ffff8a86`00000030 00000000`00000000 00000000`0000000a 00000000`00000000 : nt!KiExceptionDispatch+0x135
ffffad09`277118e0 fffff803`2cf811a8 : 2a000000`00000000 52fcf000`00000000 52fd00ff`ffb2092d c78b70ff`ffb2092d : nt!KiGeneralProtectionFault+0x343
ffffad09`27711a7b 00000000`00000000 : 000fff00`00000000 00100100`00000000 00000000`00000000 000000ff`ff8a8600 : pci!PciBusInterface_GetBusData+0x198
CHKIMG_EXTENSION: !chkimg -lo 50 -d !pci
fffff8032cf8119c - pci!PciBusInterface_GetBusData+18c
[ 48:c8 ]
1 error : !pci (fffff8032cf8119c)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
MEMORY_CORRUPTOR: ONE_BIT
STACK_COMMAND: .cxr; .ecxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: memory_corruption
---------
2: kd> !sysinfo machineid
Machine ID Information [From Smbios 2.8, DMIVersion 0, Size=2602]
BiosMajorRelease = 5
BiosMinorRelease = 17
BiosVendor = American Megatrends International, LLC.
BiosVersion = H.G1
BiosReleaseDate = 06/30/2022
SystemManufacturer = Micro-Star International Co., Ltd
SystemProductName = MS-7B86
SystemFamily = To be filled by O.E.M.
SystemVersion = 3.0
SystemSKU = To be filled by O.E.M.
BaseBoardManufacturer = Micro-Star International Co., Ltd
BaseBoardProduct = B450 GAMING PLUS MAX (MS-7B86)
BaseBoardVersion = 3.0
--
10: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffa48896fcd4b8, memory referenced.
Arg2: 0000000000000000, X64: bit 0 set if the fault was due to a not-present PTE.
bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the processor decided the fault was due to a corrupted PTE.
bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
- ARM64: bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: fffff80253ef4c95, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Type
Value: Read
Key : Analysis.CPU.mSec
Value: 2781
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 3170
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 343
Key : Analysis.Init.Elapsed.mSec
Value: 12055
Key : Analysis.Memory.CommitPeak.Mb
Value: 84
Key : Bugcheck.Code.DumpHeader
Value: 0x50
Key : Bugcheck.Code.Register
Value: 0x50
Key : Dump.Attributes.AsUlong
Value: 1008
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
FILE_IN_CAB: 051223-6531-01.dmp
DUMP_FILE_ATTRIBUTES: 0x1008
Kernel Generated Triage Dump
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffa48896fcd4b8
BUGCHECK_P2: 0
BUGCHECK_P3: fffff80253ef4c95
BUGCHECK_P4: 2
READ_ADDRESS: fffff8023e71c468: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffa48896fcd4b8
MM_INTERNAL_CODE: 2
BLACKBOXNTFS: 1 (!blackboxntfs)
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffffa48916fccf40 -- (.trap 0xffffa48916fccf40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=e5ced946b690003f rbx=0000000000000000 rcx=1a3126b9496fffd7
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80253ef4c95 rsp=ffffa48916fcd0d0 rbp=1a3126b9496fffc0
r8=0000000000040286 r9=0000020000000366 r10=fffffefffffffe4d
r11=000000000000007b r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
vgk+0x14e4c95:
fffff802`53ef4c95 488bbc24e8030080 mov rdi,qword ptr [rsp-7FFFFC18h] ss:0018:ffffa488`96fcd4b8=????????????????
Resetting default scope
STACK_TEXT:
ffffa489`16fccd18 fffff802`3de81813 : 00000000`00000050 ffffa488`96fcd4b8 00000000`00000000 ffffa489`16fccf40 : nt!KeBugCheckEx
ffffa489`16fccd20 fffff802`3dc5758c : 00013824`842348f0 00000000`00000000 ffffa489`16fcced9 00000000`00000000 : nt!MiSystemFault+0x22d1a3
ffffa489`16fcce20 fffff802`3de39829 : 00094824`848b48c2 4dd6f749`c6894900 00000100`000001b3 2148c121`48c9894c : nt!MmAccessFault+0x29c
ffffa489`16fccf40 fffff802`53ef4c95 : 00000000`00000022 cbf29ce4`84222325 cbf29ce4`84222325 00000000`00000000 : nt!KiPageFault+0x369
ffffa489`16fcd0d0 00000000`00000022 : cbf29ce4`84222325 cbf29ce4`84222325 00000000`00000000 00005b76`e903290f : vgk+0x14e4c95
ffffa489`16fcd0d8 cbf29ce4`84222325 : cbf29ce4`84222325 00000000`00000000 00005b76`e903290f 00000000`00000000 : 0x22
ffffa489`16fcd0e0 cbf29ce4`84222325 : 00000000`00000000 00005b76`e903290f 00000000`00000000 00000000`000001f4 : 0xcbf29ce4`84222325
ffffa489`16fcd0e8 00000000`00000000 : 00005b76`e903290f 00000000`00000000 00000000`000001f4 340d631b`7bdddcda : 0xcbf29ce4`84222325
SYMBOL_NAME: vgk+14e4c95
MODULE_NAME: vgk
IMAGE_NAME: vgk.sys
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 14e4c95
FAILURE_BUCKET_ID: AV_R_(null)_vgk!unknown_function
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {2c74f9bf-c695-1cb8-996e-ae91d1a2ef92}
Followup: MachineOwner
---------
10: kd> lmvm vgk
Browse full module list
start end module name
fffff802`52a10000 fffff802`53f27000 vgk T (no symbols)
Loaded symbol image file: vgk.sys
Image path: vgk.sys
Image name: vgk.sys
Browse all global symbols functions data
Timestamp: Fri Mar 10 22:16:08 2023 (640B81F8)
CheckSum: 01547633
ImageSize: 01517000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
--
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
BugCheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: fffff80165724e70
Arg3: 00000000ad5dfee0
Arg4: fffff801664cbcc1
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4687
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 5662
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 390
Key : Analysis.Init.Elapsed.mSec
Value: 5340
Key : Analysis.Memory.CommitPeak.Mb
Value: 85
Key : Bugcheck.Code.DumpHeader
Value: 0x1000007f
Key : Bugcheck.Code.Register
Value: 0x7f
Key : Dump.Attributes.AsUlong
Value: 1008
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
FILE_IN_CAB: 051323-10609-01.dmp
DUMP_FILE_ATTRIBUTES: 0x1008
Kernel Generated Triage Dump
BUGCHECK_CODE: 7f
BUGCHECK_P1: 8
BUGCHECK_P2: fffff80165724e70
BUGCHECK_P3: ad5dfee0
BUGCHECK_P4: fffff801664cbcc1
BAD_STACK_POINTER: 00000000ad5dfee0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
00000000`ad5dfee0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiReadyQueueEnumeratorStartNormalQueuesPhase+0x41
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff801664cbcbc - nt!KiReadyQueueEnumeratorStartNormalQueuesPhase+3c
[ 83:03 ]
1 error : !nt (fffff801664cbcbc)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
MEMORY_CORRUPTOR: ONE_BIT
STACK_COMMAND: .cxr; .ecxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: memory_corruption
---------