*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 000000000000001d, An RTL_BALANCED_NODE RBTree entry has been corrupted.
Arg2: fffff205572172b0, Address of the trap frame for the exception that caused the BugCheck
Arg3: fffff20557217208, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for vgk.sys
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 546
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 16231
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 327
Key : Analysis.Init.Elapsed.mSec
Value: 2851
Key : Analysis.Memory.CommitPeak.Mb
Value: 81
Key : Bugcheck.Code.DumpHeader
Value: 0x139
Key : Bugcheck.Code.Register
Value: 0x139
Key : FailFast.Name
Value: INVALID_BALANCED_TREE
Key : FailFast.Type
Value: 29
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 110522-7265-01.dmp
BUGCHECK_CODE: 139
BUGCHECK_P1: 1d
BUGCHECK_P2: fffff205572172b0
BUGCHECK_P3: fffff20557217208
BUGCHECK_P4: 0
TRAP_FRAME: fffff205572172b0 -- (.trap 0xfffff205572172b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=000000000000001d
rdx=ffff838430000020 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8016a224e67 rsp=fffff20557217440 rbp=0000000000000000
r8=ffff83842d001000 r9=ffff83842d001000 r10=ffff838418e00220
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy
nt!RtlRbInsertNodeEx+0x1fdf17:
fffff801`6a224e67 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: fffff20557217208 -- (.exr 0xfffff20557217208)
ExceptionAddress: fffff8016a224e67 (nt!RtlRbInsertNodeEx+0x00000000001fdf17)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000000000000001d
Subcode: 0x1d FAST_FAIL_INVALID_BALANCED_TREE
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: VALORANT.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 000000000000001d
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
fffff205`57216f88 fffff801`6a20b069 : 00000000`00000139 00000000`0000001d fffff205`572172b0 fffff205`57217208 : nt!KeBugCheckEx
fffff205`57216f90 fffff801`6a20b490 : ffff8384`00002000 ffff8384`00000001 ffff8384`29764080 fffff205`57217201 : nt!KiBugCheckDispatch+0x69
fffff205`572170d0 fffff801`6a209823 : 00000000`02000103 00000000`00000000 ff028678`ff008577 ff018477`ff028678 : nt!KiFastFailDispatch+0xd0
fffff205`572172b0 fffff801`6a224e67 : ffff8384`18e001c0 fffff801`6a0f637a ffffffff`ffffffff 00000000`0000007f : nt!KiRaiseSecurityCheckFailure+0x323
fffff205`57217440 fffff801`6a0f637a : ffffffff`ffffffff 00000000`0000007f 00000000`00000000 ffff8384`2d001000 : nt!RtlRbInsertNodeEx+0x1fdf17
fffff205`57217450 fffff801`6a0245a2 : ffff8384`2dfe9028 ffff8384`18e001c0 ff858180`2d000000 ff847e7f`ff868080 : nt!RtlpHpSegPageRangeShrink+0x1ba
fffff205`572174c0 fffff801`6a7b2019 : 00000000`00000000 00000000`00000000 ffff8384`3280e340 01000000`00100000 : nt!ExFreeHeapPool+0x6b2
fffff205`572175a0 fffff801`7db157e4 : 00000000`00000010 00000000`00040216 fffff205`572175f8 00000000`00000018 : nt!ExFreePool+0x9
fffff205`572175d0 00000000`00000010 : 00000000`00040216 fffff205`572175f8 00000000`00000018 ffff8384`281f9b70 : vgk+0x7d57e4
fffff205`572175d8 00000000`00040216 : fffff205`572175f8 00000000`00000018 ffff8384`281f9b70 fffff801`7d36966e : 0x10
fffff205`572175e0 fffff205`572175f8 : 00000000`00000018 ffff8384`281f9b70 fffff801`7d36966e ffff8384`3280e340 : 0x40216
fffff205`572175e8 00000000`00000018 : ffff8384`281f9b70 fffff801`7d36966e ffff8384`3280e340 00000000`00000000 : 0xfffff205`572175f8
fffff205`572175f0 ffff8384`281f9b70 : fffff801`7d36966e ffff8384`3280e340 00000000`00000000 00000000`00000001 : 0x18
fffff205`572175f8 fffff801`7d36966e : ffff8384`3280e340 00000000`00000000 00000000`00000001 ffff8384`281f9b40 : 0xffff8384`281f9b70
fffff205`57217600 ffff8384`3280e340 : 00000000`00000000 00000000`00000001 ffff8384`281f9b40 ffff8384`1c010008 : vgk+0x2966e
fffff205`57217608 00000000`00000000 : 00000000`00000001 ffff8384`281f9b40 ffff8384`1c010008 fffff801`7db12813 : 0xffff8384`3280e340
SYMBOL_NAME: vgk+7d57e4
MODULE_NAME: vgk
IMAGE_NAME: vgk.sys
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 7d57e4
FAILURE_BUCKET_ID: 0x139_1d_INVALID_BALANCED_TREE_vgk!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {5da4f5f7-29a6-72e9-83b2-c89ada253832}
Followup: MachineOwner
---------