MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: ffffd900f3ec4158
Arg3: 91000001d6e80005
Arg4: ffffd901050ee2c0
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 403
BUGCHECK_P2: ffffd900f3ec4158
BUGCHECK_P3: 91000001d6e80005
BUGCHECK_P4: ffffd901050ee2c0
BUGCHECK_STR: 0x1a_403
CPU_COUNT: 4
CPU_MHZ: c14
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 30
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: Microsoft.Photo
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-06-2020 18:31:19.0222
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff803657e9730 to fffff803657c14e0
STACK_TEXT:
fffffb0b`e1f9ea28 fffff803`657e9730 : 00000000`0000001a 00000000`00000403 ffffd900`f3ec4158 91000001`d6e80005 : nt!KeBugCheckEx
fffffb0b`e1f9ea30 fffff803`656b11f7 : 00000000`00000003 fffffb0b`e1f9f180 fffffb0b`e1f9f180 fffffb0b`e1f9f0d0 : nt!MiDeletePteRun+0x1d3490
fffffb0b`e1f9ec50 fffff803`656acd12 : ffffc907`7e04e580 ffffd900`f3ec5000 00000000`00004000 00000000`00000000 : nt!MiDeleteVaTail+0x77
fffffb0b`e1f9ec80 fffff803`656acea1 : fffffb0b`e1f9f0d0 ffffd96c`8079f620 00000000`00000000 0a000001`65887867 : nt!MiWalkPageTablesRecursively+0x512
fffffb0b`e1f9ed40 fffff803`656acea1 : fffffb0b`e1f9f0d0 ffffd96c`b6403cf8 00000000`00000000 0a000001`92e85867 : nt!MiWalkPageTablesRecursively+0x6a1
fffffb0b`e1f9ee00 fffff803`656acea1 : fffffb0b`e1f9f0d0 ffffd96c`b65b2018 ffffd96c`00000000 0a000002`034f8867 : nt!MiWalkPageTablesRecursively+0x6a1
fffffb0b`e1f9eec0 fffff803`656ac62c : fffffb0b`e1f9f0d0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiWalkPageTablesRecursively+0x6a1
fffffb0b`e1f9ef80 fffff803`656aaa98 : fffffb0b`e1f9f0d0 00000000`00000002 00000000`00000001 00000000`00000000 : nt!MiWalkPageTables+0x36c
fffffb0b`e1f9f080 fffff803`656b8bf0 : ffffffff`ffffffff ffffc907`7e04e3f8 fffffb0b`00000001 00000000`00000000 : nt!MiDeletePagablePteRange+0x268
fffffb0b`e1f9f420 fffff803`65bc7a5d : ffffc907`7d621080 ffffc907`7d621080 ffffc907`7561e590 ffffc907`7e04e3f0 : nt!MiDeleteVad+0x860
fffffb0b`e1f9f5e0 fffff803`65bd9e14 : ffffc907`7561e590 ffffc907`7fdc7a40 ffffc907`7d621080 00000000`00000000 : nt!MiUnmapVad+0x49
fffffb0b`e1f9f610 fffff803`65bd98cf : ffffc907`7561e8b0 ffffc907`7561e8b0 ffffc907`7e04e080 fffff803`65a6a3c0 : nt!MiCleanVad+0x30
fffffb0b`e1f9f640 fffff803`65c38771 : ffffffff`00000000 ffffffff`ffffffff fffffb0b`e1f9f801 ffffc907`7e04e080 : nt!MmCleanProcessAddressSpace+0x137
fffffb0b`e1f9f6c0 fffff803`65c5e6d3 : ffffc907`7e04e080 ffffda81`0da4e060 fffffb0b`e1f9f8e9 00000000`00000000 : nt!PspRundownSingleProcess+0x139
fffffb0b`e1f9f740 fffff803`65ccd143 : 00000000`00000001 00000000`00000001 000000a3`2a306000 00000000`00000000 : nt!PspExitThread+0x60b
fffffb0b`e1f9f850 fffff803`6563e551 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSchedulerApcTerminate+0x33
fffffb0b`e1f9f890 fffff803`657c5a60 : 00000000`00000001 fffffb0b`e1f9f950 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x481
fffffb0b`e1f9f950 fffff803`657d2dbf : ffffc907`7d621080 000000a3`2bbff3c8 00000000`00007530 00000000`00001cff : nt!KiInitiateUserApc+0x70
fffffb0b`e1f9fa90 00007ffa`2e939a84 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
000000a3`2bbff3a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`2e939a84
THREAD_SHA1_HASH_MOD_FUNC: cf5c972d8494816023066845de37f86a3bfa7253
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 81ac82b94939ed2fe2da690766838295e8f0d74e
THREAD_SHA1_HASH_MOD: a9ca63faa9e43cc61ef524ad38163e6a9ae5c358
FOLLOWUP_IP:
nt!MiDeletePteRun+1d3490
fffff803`657e9730 cc int 3
FAULT_INSTR_CODE: c78b4ccc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiDeletePteRun+1d3490
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 1d3490
FAILURE_BUCKET_ID: 0x1a_403_nt!MiDeletePteRun
BUCKET_ID: 0x1a_403_nt!MiDeletePteRun
PRIMARY_PROBLEM_CLASS: 0x1a_403_nt!MiDeletePteRun
TARGET_TIME: 2019-12-29T08:51:29.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 4340
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x1a_403_nt!mideletepterun
FAILURE_ID_HASH: {6e89a852-58e8-3dbb-af93-60d80dcc29e5}
Followup: MachineOwner
---------
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80027fc89e5, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff80027fc89e5
BUGCHECK_P3: 0
BUGCHECK_P4: ffffffffffffffff
READ_ADDRESS: fffff800283733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
ffffffffffffffff
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!SwapContext+4a5
fffff800`27fc89e5 c3 ret
EXCEPTION_PARAMETER2: ffffffffffffffff
BUGCHECK_STR: 0x1E_c0000005_R
CPU_COUNT: 4
CPU_MHZ: c14
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 30
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-06-2020 18:31:16.0670
ANALYSIS_VERSION: 10.0.18362.1 x86fre
BAD_STACK_POINTER: fffff8002e67c8f8
LAST_CONTROL_TRANSFER: from fffff8002802fda7 to fffff80027fc14e0
STACK_TEXT:
fffff800`2e67c8f8 fffff800`2802fda7 : 00000000`0000001e ffffffff`c0000005 fffff800`27fc89e5 00000000`00000000 : nt!KeBugCheckEx
fffff800`2e67c900 fffff800`27fc2362 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x1689d7
fffff800`2e67cfb0 fffff800`27fc2330 : fffff800`27fd3416 00000000`00000001 ffffa886`0223e7c0 00000000`00000001 : nt!KxExceptionDispatchOnExceptionStack+0x12
ffffa886`0223dbe8 fffff800`27fd3416 : 00000000`00000001 ffffa886`0223e7c0 00000000`00000001 00000000`00000001 : nt!KiExceptionDispatchOnExceptionStackContinue
ffffa886`0223dbf0 fffff800`27fcf1a2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0x116
ffffa886`0223ddd0 fffff800`27fc89e5 : ffeff800`27fc8266 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x322
ffffa886`0223df68 ffeff800`27fc8266 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SwapContext+0x4a5
ffffa886`0223df70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffeff800`27fc8266
THREAD_SHA1_HASH_MOD_FUNC: bbdc858bba54202f2407b02fd047b4a2666b54ef
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 2c0aa6993d12be31889f79c5881d2a355c4a027b
THREAD_SHA1_HASH_MOD: 30a3e915496deaace47137d5b90c3ecc03746bf6
FOLLOWUP_IP:
nt!SwapContext+4a5
fffff800`27fc89e5 c3 ret
FAULT_INSTR_CODE: cb8b48c3
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: nt!SwapContext+4a5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 4a5
FAILURE_BUCKET_ID: 0x1E_c0000005_R_STACKPTR_ERROR_nt!SwapContext
BUCKET_ID: 0x1E_c0000005_R_STACKPTR_ERROR_nt!SwapContext
PRIMARY_PROBLEM_CLASS: 0x1E_c0000005_R_STACKPTR_ERROR_nt!SwapContext
TARGET_TIME: 2020-01-02T10:01:26.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: b11
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x1e_c0000005_r_stackptr_error_nt!swapcontext
FAILURE_ID_HASH: {bd591bce-fa9d-a983-0398-0157fd169b8e}
Followup: MachineOwner
---------
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80410e03612, Address of the instruction which caused the bugcheck
Arg3: ffff83826143d3b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff80410e03612
BUGCHECK_P3: ffff83826143d3b0
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
Ntfs!ReadIndexBuffer+f2
fffff804`10e03612 49397d10 cmp qword ptr [r13+10h],rdi
CONTEXT: ffff83826143d3b0 -- (.cxr 0xffff83826143d3b0)
rax=ffff890a98d31d01 rbx=ffff890a98d31da8 rcx=ffff9d06154e23b9
rdx=0000000000000000 rsi=fff7ae8e562c0018 rdi=0000000000000000
rip=fffff80410e03612 rsp=ffff83826143dda0 rbp=ffff83826143de10
r8=000000000000000f r9=0000000000000000 r10=0000000000000004
r11=0000000000000002 r12=ffff890a98d31da0 r13=fff7ae8e562c0000
r14=0000000000001000 r15=ffff890a990fb170
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
Ntfs!ReadIndexBuffer+0xf2:
fffff804`10e03612 49397d10 cmp qword ptr [r13+10h],rdi ds:002b:fff7ae8e`562c0010=????????????????
Resetting default scope
BUGCHECK_STR: 0x3B_c0000005
CPU_COUNT: 4
CPU_MHZ: c14
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 30
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: nvcontainer.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-06-2020 18:31:13.0876
ANALYSIS_VERSION: 10.0.18362.1 x86fre
DEVICE_OBJECT: 0000000000000ba8
LAST_CONTROL_TRANSFER: from fffff80410e03022 to fffff80410e03612
STACK_TEXT:
ffff8382`6143dda0 fffff804`10e03022 : ffff9d06`1ab96ac8 00000000`00000000 ffff890a`98d31cf0 fffff804`00000004 : Ntfs!ReadIndexBuffer+0xf2
ffff8382`6143de50 fffff804`10dfe80e : ffff890a`990fb170 ffffae8e`31fcad00 00000000`00000000 fffff804`00000000 : Ntfs!FindFirstIndexEntry+0x182
ffff8382`6143df10 fffff804`10e0142b : 00000000`00000000 ffff890a`990fb170 ffff9d06`1ab96ac8 ffff9d06`1ab96ac8 : Ntfs!NtfsRestartIndexEnumeration+0x176
ffff8382`6143e1a0 fffff804`10dffb0c : ffff9d06`1ab96ac8 ffff9d06`1f1f4010 ffff9d06`15fd8180 ffff890a`990fb170 : Ntfs!NtfsQueryDirectory+0xecb
ffff8382`6143e400 fffff804`10dffa1e : 00000000`00000000 00000000`00000008 ffff9d06`1f1f4010 00000000`00000000 : Ntfs!NtfsCommonDirectoryControl+0xa4
ffff8382`6143e440 fffff804`0ea31f79 : 00000000`00000000 ffff9d06`1f1f4010 ffff9d06`1ab96ac8 ffff8382`6143e468 : Ntfs!NtfsFsdDirectoryControl+0xbe
ffff8382`6143e4b0 fffff804`102e55d9 : 00000000`00000000 00000000`00000000 ffff9d06`1c7b10f8 ffff890a`96e75bb0 : nt!IofCallDriver+0x59
ffff8382`6143e4f0 fffff804`102e2bee : ffff8382`6143e590 ffff9d06`190759a8 00000000`00000001 ffff9d06`1c7b10f8 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x159
ffff8382`6143e570 fffff804`10c7ef68 : ffff9d06`1c7b1010 00000000`0000027c ffff8382`6143e789 00000000`00000000 : FLTMGR!FltPerformSynchronousIo+0x2ee
ffff8382`6143e610 fffff804`102e4a5d : ffff9d06`1d484548 ffff8382`6143e768 ffff9d06`00000001 00000000`0000003c : Wof!WofPreDirectoryControlCallback+0x288
ffff8382`6143e6e0 fffff804`102e45a0 : ffff8382`6143e8c0 00000000`00000000 ffff9d06`1d2e600c 00000000`00060800 : FLTMGR!FltpPerformPreCallbacks+0x2fd
ffff8382`6143e7f0 fffff804`102e4112 : 00000000`00000000 ffff8382`6143e8c0 ffff9d06`1d2e6010 ffff8382`6143e8d0 : FLTMGR!FltpPassThroughInternal+0x90
ffff8382`6143e820 fffff804`102e3efe : ffff9d06`1dbce080 00000000`00000001 00000000`00000020 00000000`00000001 : FLTMGR!FltpPassThrough+0x162
ffff8382`6143e8a0 fffff804`0ea31f79 : ffff9d06`1d2e6010 00000000`00000004 ffff8382`6143ea60 00000000`00000000 : FLTMGR!FltpDispatch+0x9e
ffff8382`6143e900 fffff804`0efe95e5 : ffff8382`6143eb80 ffff9d06`1d2e6010 00000000`00000001 ffff9d06`1ff44950 : nt!IofCallDriver+0x59
ffff8382`6143e940 fffff804`0f004acf : 00000000`00000ba8 00000000`00000000 00000000`00000000 ffff8382`6143eb80 : nt!IopSynchronousServiceTail+0x1a5
ffff8382`6143e9e0 fffff804`0ebd2d15 : 00000000`000009c8 ffff8382`6143eb80 ffff9d06`1dda4de0 fffff804`0f0b077d : nt!NtQueryDirectoryFileEx+0xbf
ffff8382`6143ea90 00007ff9`7c07e834 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0000009f`b1efe5c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`7c07e834
THREAD_SHA1_HASH_MOD_FUNC: a84a5d15e2cbcf3fbd2be6ff09739b0da6138956
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 58aeeffb373f31d2a861e2ceca3346c587e2c955
THREAD_SHA1_HASH_MOD: 613dbbc6a918d2074553db4e5eb05ec378e079e0
FOLLOWUP_IP:
Wof!WofPreDirectoryControlCallback+288
fffff804`10c7ef68 0f1f440000 nop dword ptr [rax+rax]
FAULT_INSTR_CODE: 441f0f
SYMBOL_STACK_INDEX: 9
SYMBOL_NAME: Wof!WofPreDirectoryControlCallback+288
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Wof
IMAGE_NAME: Wof.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .cxr 0xffff83826143d3b0 ; kb
BUCKET_ID_FUNC_OFFSET: 288
FAILURE_BUCKET_ID: 0x3B_c0000005_Wof!WofPreDirectoryControlCallback
BUCKET_ID: 0x3B_c0000005_Wof!WofPreDirectoryControlCallback
PRIMARY_PROBLEM_CLASS: 0x3B_c0000005_Wof!WofPreDirectoryControlCallback
TARGET_TIME: 2020-01-02T10:07:13.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 26b3
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x3b_c0000005_wof!wofpredirectorycontrolcallback
FAILURE_ID_HASH: {c4606a74-b269-5e61-6320-9f10cc3e0751}
Followup: MachineOwner
---------
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8056c7fa0bb, The address that the exception occurred at
Arg3: ffff8b0c38445768, Exception Record Address
Arg4: ffff8b0c38444fb0, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullClassPtr
Key : AV.Fault
Value: Read
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8056c7fa0bb
BUGCHECK_P3: ffff8b0c38445768
BUGCHECK_P4: ffff8b0c38444fb0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!ObpRemoveObjectRoutine+5b
fffff805`6c7fa0bb 488b8788000000 mov rax,qword ptr [rdi+88h]
EXCEPTION_RECORD: ffff8b0c38445768 -- (.exr 0xffff8b0c38445768)
ExceptionAddress: fffff8056c7fa0bb (nt!ObpRemoveObjectRoutine+0x000000000000005b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000088
Attempt to read from address 0000000000000088
CONTEXT: ffff8b0c38444fb0 -- (.cxr 0xffff8b0c38444fb0)
rax=0000000000000000 rbx=ffff990eb2fec330 rcx=00000000000000aa
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8056c7fa0bb rsp=ffff8b0c384459a0 rbp=ffffae89ab1799e0
r8=000000000000000f r9=ffffae89b0b8e340 r10=ffffae89b0ec84b0
r11=ffff8b0c38445a10 r12=ffffae89ab179a60 r13=0000000000000001
r14=ffffae89ab1799e0 r15=0000000000000001
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00210246
nt!ObpRemoveObjectRoutine+0x5b:
fffff805`6c7fa0bb 488b8788000000 mov rax,qword ptr [rdi+88h] ds:002b:00000000`00000088=????????????????
Resetting default scope
CPU_COUNT: 4
CPU_MHZ: c14
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 30
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
CURRENT_IRQL: 0
FOLLOWUP_IP:
nt!ObpRemoveObjectRoutine+5b
fffff805`6c7fa0bb 488b8788000000 mov rax,qword ptr [rdi+88h]
BUGCHECK_STR: AV
READ_ADDRESS: fffff8056c7733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
0000000000000088
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000088
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-06-2020 18:31:11.0189
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff8056c2390c4 to fffff8056c7fa0bb
STACK_TEXT:
ffff8b0c`384459a0 fffff805`6c2390c4 : 00000000`00000000 00000000`00000000 ffffae89`ab1799e0 ffff990e`b2fec360 : nt!ObpRemoveObjectRoutine+0x5b
ffff8b0c`38445a00 fffff805`6c28aa73 : ffff8b0c`38445a00 ffff8b0c`38445ae8 ffffae89`ab1799e0 ffff8b0c`38445ae8 : nt!ObfDereferenceObject+0xa4
ffff8b0c`38445a40 fffff805`6c28b940 : 00000000`0000529a ffff8b0c`38445b09 ffffae89`b8d187e0 00000000`00000000 : nt!CcDeleteSharedCacheMap+0x157
ffff8b0c`38445a90 fffff805`6c2bd095 : ffffae89`ab088900 ffffae89`00000000 00000000`0000529a ffff8b0c`3ade7a90 : nt!CcWriteBehindInternal+0x3a0
ffff8b0c`38445b70 fffff805`6c32a7a5 : ffffae89`abde8600 00000000`00000080 ffffae89`ab077040 00000224`bcbbbdfe : nt!ExpWorkerThread+0x105
ffff8b0c`38445c10 fffff805`6c3c8b2a : ffffd681`d3d51180 ffffae89`abde8600 fffff805`6c32a750 73657547`63496d56 : nt!PspSystemThreadStartup+0x55
ffff8b0c`38445c60 00000000`00000000 : ffff8b0c`38446000 ffff8b0c`38440000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a
THREAD_SHA1_HASH_MOD_FUNC: da0edd7bd400f10487369d4d6c75049c64954ec5
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 555b579c211d36a1d9bd3fe968f8bdb876ce0152
THREAD_SHA1_HASH_MOD: 30a3e915496deaace47137d5b90c3ecc03746bf6
FAULT_INSTR_CODE: 88878b48
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ObpRemoveObjectRoutine+5b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .cxr 0xffff8b0c38444fb0 ; kb
BUCKET_ID_FUNC_OFFSET: 5b
FAILURE_BUCKET_ID: AV_nt!ObpRemoveObjectRoutine
BUCKET_ID: AV_nt!ObpRemoveObjectRoutine
PRIMARY_PROBLEM_CLASS: AV_nt!ObpRemoveObjectRoutine
TARGET_TIME: 2020-01-04T09:13:48.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 1c05
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_nt!obpremoveobjectroutine
FAILURE_ID_HASH: {e17dac7a-8c25-c4a4-6b6a-1087fb87207e}
Followup: MachineOwner
---------
RESOURCE_NOT_OWNED (e3)
A thread tried to release a resource it did not own.
Arguments:
Arg1: ffff9a0cdaf687a0, Address of resource
Arg2: ffff9a0cd8dec043, Address of thread
Arg3: ffff9a0cdaee9f50, Address of owner table if there is one
Arg4: 0000000000000002
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: ffff9a0cdaf687a0
BUGCHECK_P2: ffff9a0cd8dec043
BUGCHECK_P3: ffff9a0cdaee9f50
BUGCHECK_P4: 2
CPU_COUNT: 4
CPU_MHZ: c14
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 30
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xE3
PROCESS_NAME: System
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-06-2020 18:31:09.0126
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff800335f5d2f to fffff800335c14e0
STACK_TEXT:
fffffa02`6f844ee8 fffff800`335f5d2f : 00000000`000000e3 ffff9a0c`daf687a0 ffff9a0c`d8dec043 ffff9a0c`daee9f50 : nt!KeBugCheckEx
fffffa02`6f844ef0 fffff800`33501497 : ffff9a0c`0000000e 00000000`00000000 ffff9a0c`d4936af8 ffff9a0c`da2301f0 : nt!ExpReleaseResourceSharedForThreadLite+0x1bf1df
fffffa02`6f844fa0 fffff800`3511e2c9 : ffff9a0c`d4936af8 ffff9a0c`cfa17e40 ffff9a0c`cfe68180 fffff800`3346b53d : nt!ExReleaseResourceForThreadLite+0xe7
fffffa02`6f845000 fffff800`334477d9 : ffff9a0c`d5f0f9a0 ffff9a0c`cfdd0040 ffff9a0c`d5f0f9a0 ffff9a0c`d5f0f9a0 : Ntfs!NtfsMasterIrpAsyncCompletionRoutine+0x219
fffffa02`6f845160 fffff800`334476a7 : ffff9a0c`cfd62060 ffff9a0c`cfd62101 ffff9a0c`d5f0f9a0 ffff9a0c`d5f0fb48 : nt!IopfCompleteRequest+0x119
fffffa02`6f845270 fffff800`35be6e40 : 0000015b`acc2151b ffff9a0c`d62b0ac0 fffffa02`6f8453a0 ffff9a0c`d62b0ac0 : nt!IofCompleteRequest+0x17
fffffa02`6f8452a0 fffff800`334477d9 : ffff9a0c`d963714b 00000000`00000000 732555e1`68744d05 00000000`00000000 : CLASSPNP!TransferPktComplete+0x640
fffffa02`6f8454a0 fffff800`334476a7 : 00000000`01008000 ffff9a0c`cfa21101 ffff9a0c`cfa211b0 ffff8680`63e32fa0 : nt!IopfCompleteRequest+0x119
fffffa02`6f8455b0 fffff800`34f7999d : fffff800`34909980 ffff9a0c`cfa1d260 fffffa02`6f8457b0 00000000`00000000 : nt!IofCompleteRequest+0x17
fffffa02`6f8455e0 fffff800`34f7928a : 00000000`00000000 00000000`00989680 fffffa02`6f8457b0 ffff8680`63e32ef0 : storport!RaidCompleteRequestEx+0x8d
fffffa02`6f8456b0 fffff800`34f8d60c : ffff9a0c`d3d98108 00000000`00000000 00000000`00000000 00000000`00000000 : storport!RaidUnitCompleteRequest+0x5da
fffffa02`6f845850 fffff800`3346ae95 : ffff9a0c`cfac0180 00000000`00000001 fffffa02`6f8458a8 00000000`00000000 : storport!RaidpAdapterRedirectDpcRoutine+0x8c
fffffa02`6f8458f0 fffff800`3346a4ef : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExecuteAllDpcs+0x305
fffffa02`6f845a30 fffff800`335c5024 : ffffffff`00000000 ffff8680`63942180 ffff8680`63953140 ffff9a0c`d81d9080 : nt!KiRetireDpcList+0x1ef
fffffa02`6f845c60 00000000`00000000 : fffffa02`6f846000 fffffa02`6f840000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x84
THREAD_SHA1_HASH_MOD_FUNC: 19f1d0adaf60b1c4cd2620e8b26a8cd66e17ffa1
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 8bed40e28526d9d2230eedeef96ee9da399e619e
THREAD_SHA1_HASH_MOD: eb76f151b80048f989eee82c67cf5bd99ef89187
FOLLOWUP_IP:
CLASSPNP!TransferPktComplete+640
fffff800`35be6e40 0f1f440000 nop dword ptr [rax+rax]
FAULT_INSTR_CODE: 441f0f
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: CLASSPNP!TransferPktComplete+640
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: CLASSPNP
IMAGE_NAME: CLASSPNP.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 9ed6e49
IMAGE_VERSION: 10.0.18362.1216
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 640
FAILURE_BUCKET_ID: 0xE3_CLASSPNP!TransferPktComplete
BUCKET_ID: 0xE3_CLASSPNP!TransferPktComplete
PRIMARY_PROBLEM_CLASS: 0xE3_CLASSPNP!TransferPktComplete
TARGET_TIME: 2020-01-06T14:51:38.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 1d1c
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xe3_classpnp!transferpktcomplete
FAILURE_ID_HASH: {6048cf18-0ef5-4393-3d1d-855a2eb9f6c8}
Followup: MachineOwner
---------
