PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffc9174e1c5580, memory referenced.
Arg2: 0000000000000002, value 0 = read operation, 1 = write operation.
Arg3: fffff8007690acd5, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: MSI
SYSTEM_PRODUCT_NAME: MS-7926
SYSTEM_SKU: To be filled by O.E.M.
SYSTEM_VERSION: 1.0
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: V1.13
BIOS_DATE: 02/16/2016
BASEBOARD_MANUFACTURER: MSI
BASEBOARD_PRODUCT: Z97 GAMING 9 ACK (MS-7926)
BASEBOARD_VERSION: 1.0
DUMP_TYPE: 2
BUGCHECK_P1: ffffc9174e1c5580
BUGCHECK_P2: 2
BUGCHECK_P3: fffff8007690acd5
BUGCHECK_P4: 2
READ_ADDRESS: fffff80076d733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
ffffc9174e1c5580
FAULTING_IP:
nt!RtlDeleteNoSplay+35
fffff800`7690acd5 48890f mov qword ptr [rdi],rcx
MM_INTERNAL_CODE: 2
CPU_COUNT: 8
CPU_MHZ: fa0
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 3c
CPU_STEPPING: 3
CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 25'00000000 (cache) 25'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: MsMpEng.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-31-2019 12:24:14.0223
ANALYSIS_VERSION: 10.0.18362.1 x86fre
DEVICE_OBJECT: ffffc90700000000
TRAP_FRAME: fffffd0f2ca52c20 -- (.trap 0xfffffd0f2ca52c20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc9074e1b89b8 rbx=0000000000000000 rcx=0000000000000000
rdx=ffffc9174e1c5580 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8007690acd5 rsp=fffffd0f2ca52db0 rbp=ffffc9074e1c5578
r8=ffffffffffffffff r9=ffffffffffffffff r10=fffff8007690aca0
r11=ffff85fbc4400000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!RtlDeleteNoSplay+0x35:
fffff800`7690acd5 48890f mov qword ptr [rdi],rcx ds:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800769e33d6 to fffff800769c1220
STACK_TEXT:
fffffd0f`2ca52978 fffff800`769e33d6 : 00000000`00000050 ffffc917`4e1c5580 00000000`00000002 fffffd0f`2ca52c20 : nt!KeBugCheckEx
fffffd0f`2ca52980 fffff800`76872edf : fffffd0f`2ca52cc0 00000000`00000002 00000000`00000000 ffffc917`4e1c5580 : nt!MiSystemFault+0x1d66a6
fffffd0f`2ca52a80 fffff800`769cf320 : 00000000`00000398 ffff8506`3f28e890 ffff8506`3f2e7018 00000000`73634946 : nt!MmAccessFault+0x34f
fffffd0f`2ca52c20 fffff800`7690acd5 : 00000000`00000103 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x360
fffffd0f`2ca52db0 fffff800`7a718539 : ffffc907`4e1b89b8 fffff800`76839bdd ffffc907`44deb0c0 ffffc907`4e1c5578 : nt!RtlDeleteNoSplay+0x35
fffffd0f`2ca52de0 fffff800`7a74db5b : ffffc907`4e1c5580 fffff800`00000000 00000000`00000001 ffffffff`ffffffff : FLTMGR!TreeUnlinkMulti+0x99
fffffd0f`2ca52e30 fffff800`7a7503df : ffffc907`4e1c5530 00000000`00000745 ffffc907`3aea45f8 ffffc907`3aea4658 : FLTMGR!FltpDeleteContextList+0x4b
fffffd0f`2ca52e60 fffff800`7a750383 : 00000000`00000745 ffffc907`3aea4060 ffffc907`4e1c5530 ffffc907`4e1c5530 : FLTMGR!CleanupFileListCtrl+0x3b
fffffd0f`2ca52ea0 fffff800`76ebd911 : ffffc907`4e125930 ffffc907`4e1c5538 00000000`00000001 00000000`0000a8b8 : FLTMGR!DeleteFileListCtrlCallback+0xc3
fffffd0f`2ca52ee0 fffff800`7b1e3940 : fffffd0f`2ca52fd0 ffffc907`4e125930 00000000`0000a8b8 ffffc907`3aea7180 : nt!FsRtlTeardownPerFileContexts+0xa1
fffffd0f`2ca52f20 fffff800`7b122317 : ffffc907`00000000 ffff8506`36607700 ffff8506`00000275 ffff8506`00008000 : Ntfs!NtfsDeleteFcb+0x430
fffffd0f`2ca52fa0 fffff800`7b1e31de : ffffc907`45d3b018 ffffc907`3aea7180 ffff8506`3f2e7010 ffff8506`3f2e7458 : Ntfs!NtfsTeardownFromLcb+0x267
fffffd0f`2ca53040 fffff800`7b12669a : ffffc907`45d3b018 fffffd0f`2ca53141 ffff8506`3f2e7458 ffffc907`45d3b018 : Ntfs!NtfsTeardownStructures+0xee
fffffd0f`2ca530c0 fffff800`7b2049cc : fffffd0f`2ca53200 ffff8506`00000000 ffffc907`00000001 ffffc907`45d3b018 : Ntfs!NtfsDecrementCloseCounts+0xaa
fffffd0f`2ca53100 fffff800`7b203911 : ffffc907`45d3b018 ffff8506`3f2e7170 ffff8506`3f2e7010 ffffc907`3aea7180 : Ntfs!NtfsCommonClose+0x45c
fffffd0f`2ca531e0 fffff800`7b25d1d0 : 00000000`00000003 00000000`00000018 00000000`00000003 00000000`00000003 : Ntfs!NtfsFspCloseInternal+0x241
fffffd0f`2ca53340 fffff800`7b13a557 : ffff8506`31f8a9f0 ffffc907`4718d3b0 ffff8506`31f8a9f0 ffffc907`4718d3b0 : Ntfs!NtfsFlushVolume+0x130
fffffd0f`2ca53460 fffff800`7b126297 : ffffc907`46abbd48 ffffc907`4718d3b0 ffffc907`3ace5d30 00000000`00000001 : Ntfs!NtfsVolumeDasdIo+0x1ef
fffffd0f`2ca53520 fffff800`7b12418c : fffffd0f`2ca53720 ffffc907`4718d3b0 fffffd0f`2ca53720 ffffc907`46abbd48 : Ntfs!NtfsCommonRead+0x1ef7
fffffd0f`2ca536e0 fffff800`76831f39 : ffffc907`45d5da40 ffffc907`4718d3b0 ffffc907`4718d7e0 00000000`00000000 : Ntfs!NtfsFsdRead+0x20c
fffffd0f`2ca537a0 fffff800`7a7155de : 00000000`00000000 fffffd0f`2ca53880 ffffc907`4718d3b0 fffffd0f`2ca53890 : nt!IofCallDriver+0x59
fffffd0f`2ca537e0 fffff800`7a713f16 : fffffd0f`2ca53880 00000000`00000000 fffffd0f`2ca53a01 fffff800`76df1035 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
fffffd0f`2ca53860 fffff800`76831f39 : ffffc907`4718d3b0 00000000`000004c0 00000000`00000000 00000000`00000000 : FLTMGR!FltpDispatch+0xb6
fffffd0f`2ca538c0 fffff800`76de93f5 : 00000000`00000000 ffffc907`45a86760 ffffc907`45a867b0 ffffc907`45a86760 : nt!IofCallDriver+0x59
fffffd0f`2ca53900 fffff800`76de55cf : ffffc907`00000000 00000000`00000000 00000000`00000000 fffffd0f`2ca53b80 : nt!IopSynchronousServiceTail+0x1a5
fffffd0f`2ca539a0 fffff800`769d2b18 : 00000000`000006ac 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x59f
fffffd0f`2ca53a90 00007ffb`2ddfc184 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000033`ea47bd28 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`2ddfc184
THREAD_SHA1_HASH_MOD_FUNC: e732d7c5a652ff63dd3b158dd1f6af08602049b2
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 45cd941106567908d11f87f05580767505c7bf45
THREAD_SHA1_HASH_MOD: aa62a9cc472e4160c00f822491fb0300bea2366f
FOLLOWUP_IP:
nt!RtlDeleteNoSplay+35
fffff800`7690acd5 48890f mov qword ptr [rdi],rcx
FAULT_INSTR_CODE: 480f8948
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!RtlDeleteNoSplay+35
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 35
FAILURE_BUCKET_ID: AV_INVALID_nt!RtlDeleteNoSplay
BUCKET_ID: AV_INVALID_nt!RtlDeleteNoSplay
PRIMARY_PROBLEM_CLASS: AV_INVALID_nt!RtlDeleteNoSplay
TARGET_TIME: 2019-12-30T23:45:19.000Z
OSBUILD: 18362
OSSERVICEPACK: 418
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 792a
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_invalid_nt!rtldeletenosplay
FAILURE_ID_HASH: {59bc1287-1489-a801-1af8-c2d45de5ce4f}
Followup: MachineOwner
---------