*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000000, A stack-based buffer has been overrun.
Arg2: 0000000000000000, Address of the trap frame for the exception that caused the bugcheck
Arg3: 0000000000000000, Address of the exception record for the exception that caused the bugcheck
Arg4: 0ef5abc35bc0a63b, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6608
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-J7A11VA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 20142
Key : Analysis.Memory.CommitPeak.Mb
Value: 82
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 139
BUGCHECK_P1: 0
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: ef5abc35bc0a63b
TRAP_FRAME: 0000000000000000 -- (.trap 0x0)
EXCEPTION_RECORD: 0000000000000000 -- (.exr 0x0)
Cannot read Exception record @ 0000000000000000
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
fffff806`81a6c7c8 fffff806`7b3fdd1b : 00000000`00000139 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff806`81a6c7d0 fffff806`7b2bdef9 : ffffd00b`ff2d3748 fffff806`81a6c8a9 0ef5abc3`5bc0a63b fffff806`00000002 : nt!guard_icall_bugcheck+0x1b
fffff806`81a6c800 fffff806`7b2bd735 : fffff806`81a6c948 00000000`00000000 fffff806`81a6cb10 ffffd00b`ff2d3760 : nt!KiExpireTimer2+0x429
fffff806`81a6c910 fffff806`7b2e4cc4 : 00000000`00000000 00000000`00000000 00000000`00000008 00000000`0004d9b5 : nt!KiTimer2Expiration+0x165
fffff806`81a6c9d0 fffff806`7b3f8d7e : 00000000`00000000 fffff806`79b09180 fffff806`7bd27600 ffffd00b`fcb55080 : nt!KiRetireDpcList+0x874
fffff806`81a6cc60 00000000`00000000 : fffff806`81a6d000 fffff806`81a67000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e
SYMBOL_NAME: nt!guard_icall_bugcheck+1b
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.630
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1b
FAILURE_BUCKET_ID: 0x139_0_LEGACY_GS_VIOLATION_nt!guard_icall_bugcheck
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {9bee41a7-2ef9-07ca-7e59-7d5a0c6e2d05}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000000027f8, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8076af9d15f, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 7983
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-J7A11VA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 126974
Key : Analysis.Memory.CommitPeak.Mb
Value: 83
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: d1
BUGCHECK_P1: 27f8
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8076af9d15f
READ_ADDRESS: fffff8075fcfb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8075fc0f340: Unable to get Flags value from nt!KdVersionBlock
fffff8075fc0f340: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
00000000000027f8
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: fffff8076246c0e0 -- (.trap 0xfffff8076246c0e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000024f8 rbx=0000000000000000 rcx=ffffe406e1ada0d0
rdx=00000000000024f8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8076af9d15f rsp=fffff8076246c278 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=0000fffff8075f27
r11=000000000000000e r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nvlddmkm+0x28d15f:
fffff807`6af9d15f 48ffa000030000 jmp qword ptr [rax+300h] ds:00000000`000027f8=????????????????
Resetting default scope
STACK_TEXT:
fffff807`6246bf98 fffff807`5f407169 : 00000000`0000000a 00000000`000027f8 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff807`6246bfa0 fffff807`5f403469 : 00000000`00000000 00000000`000007f4 00000000`00000006 00000000`00000003 : nt!KiBugCheckDispatch+0x69
fffff807`6246c0e0 fffff807`6af9d15f : fffff807`6aef2584 ffffe406`ebd0c298 ffffe406`e9a868a0 00000000`00009420 : nt!KiPageFault+0x469
fffff807`6246c278 fffff807`6aef2584 : ffffe406`ebd0c298 ffffe406`e9a868a0 00000000`00009420 00000000`fcef4c20 : nvlddmkm+0x28d15f
fffff807`6246c280 ffffe406`ebd0c298 : ffffe406`e9a868a0 00000000`00009420 00000000`fcef4c20 ffffe406`e1ada0d0 : nvlddmkm+0x1e2584
fffff807`6246c288 ffffe406`e9a868a0 : 00000000`00009420 00000000`fcef4c20 ffffe406`e1ada0d0 fffff807`6aef2e23 : 0xffffe406`ebd0c298
fffff807`6246c290 00000000`00009420 : 00000000`fcef4c20 ffffe406`e1ada0d0 fffff807`6aef2e23 00000000`fcef4c20 : 0xffffe406`e9a868a0
fffff807`6246c298 00000000`fcef4c20 : ffffe406`e1ada0d0 fffff807`6aef2e23 00000000`fcef4c20 00000000`00000000 : 0x9420
fffff807`6246c2a0 ffffe406`e1ada0d0 : fffff807`6aef2e23 00000000`fcef4c20 00000000`00000000 00000000`00000000 : 0xfcef4c20
fffff807`6246c2a8 fffff807`6aef2e23 : 00000000`fcef4c20 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffe406`e1ada0d0
fffff807`6246c2b0 00000000`fcef4c20 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffe406`e1ada0d0 : nvlddmkm+0x1e2e23
fffff807`6246c2b8 00000000`00000000 : 00000000`00000000 00000000`00000000 ffffe406`e1ada0d0 fffff807`6aef3af2 : 0xfcef4c20
SYMBOL_NAME: nvlddmkm+28d15f
MODULE_NAME: nvlddmkm
IMAGE_NAME: nvlddmkm.sys
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 28d15f
FAILURE_BUCKET_ID: AV_nvlddmkm!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {7eea5677-f68d-2154-717e-887e07e55cd3}
Followup: MachineOwner
---------