SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8000804638e, The address that the exception occurred at
Arg3: ffff8d8e9e7f73a8, Exception Record Address
Arg4: ffff8d8e9e7f6bf0, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for ALSysIO64.sys
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullPtr
Key : AV.Fault
Value: Read
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8000804638e
BUGCHECK_P3: ffff8d8e9e7f73a8
BUGCHECK_P4: ffff8d8e9e7f6bf0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!ExFreeHeapPool+80e
fffff800`0804638e 488b18 mov rbx,qword ptr [rax]
EXCEPTION_RECORD: ffff8d8e9e7f73a8 -- (.exr 0xffff8d8e9e7f73a8)
ExceptionAddress: fffff8000804638e (nt!ExFreeHeapPool+0x000000000000080e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000
CONTEXT: ffff8d8e9e7f6bf0 -- (.cxr 0xffff8d8e9e7f6bf0)
rax=0000000000000000 rbx=00000000dbc380a0 rcx=0000000000000016
rdx=0000000000000000 rsi=0000000000000000 rdi=a2e64eada2e64ead
rip=fffff8000804638e rsp=ffff8d8e9e7f75e0 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=000000000010000b
r11=ffff8d8e9e7f76f8 r12=ffff800000000000 r13=0000000000000002
r14=ffff96811e96dd70 r15=ffffd5896b0d5000
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050282
nt!ExFreeHeapPool+0x80e:
fffff800`0804638e 488b18 mov rbx,qword ptr [rax] ds:002b:00000000`00000000=????????????????
Resetting default scope
CPU_COUNT: c
CPU_MHZ: c7a
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 1
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: NULL_DEREFERENCE
PROCESS_NAME: System
CURRENT_IRQL: 0
FOLLOWUP_IP:
nt!ExFreePool+9
fffff800`0836f0a9 4883c428 add rsp,28h
BUGCHECK_STR: AV
READ_ADDRESS: fffff800085733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
0000000000000000
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 02-26-2020 19:02:37.0262
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff8000836f0a9 to fffff8000804638e
STACK_TEXT:
ffff8d8e`9e7f75e0 fffff800`0836f0a9 : fffff800`15683f60 00000000`00000000 00000000`00000000 00000000`00000065 : nt!ExFreeHeapPool+0x80e
ffff8d8e`9e7f7700 fffff800`156833b0 : 00000000`dbc380c4 00000000`dbc380a0 00000000`00000000 ffffd589`00000000 : nt!ExFreePool+0x9
ffff8d8e`9e7f7730 00000000`dbc380c4 : 00000000`dbc380a0 00000000`00000000 ffffd589`00000000 00000000`00000001 : ALSysIO64+0x33b0
ffff8d8e`9e7f7738 00000000`dbc380a0 : 00000000`00000000 ffffd589`00000000 00000000`00000001 00000000`00000000 : 0xdbc380c4
ffff8d8e`9e7f7740 00000000`00000000 : ffffd589`00000000 00000000`00000001 00000000`00000000 00000000`dbc380c4 : 0xdbc380a0
THREAD_SHA1_HASH_MOD_FUNC: d29150a0e3255a366c5193ce7adf2aa8168f381b
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: d6bb6cdd3d1aa5e2d06e9db4268e3687c74662d7
THREAD_SHA1_HASH_MOD: 8cb46941dd8184072c2e2c4f384730bfe58073f9
FAULT_INSTR_CODE: 28c48348
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExFreePool+9
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.657
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .cxr 0xffff8d8e9e7f6bf0 ; kb
BUCKET_ID_FUNC_OFFSET: 9
FAILURE_BUCKET_ID: AV_nt!ExFreePool
BUCKET_ID: AV_nt!ExFreePool
PRIMARY_PROBLEM_CLASS: AV_nt!ExFreePool
TARGET_TIME: 2020-02-26T12:35:19.000Z
OSBUILD: 18362
OSSERVICEPACK: 657
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2005-04-23 04:40:32
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 5a39
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_nt!exfreepool
FAILURE_ID_HASH: {2ae0a97e-dcd7-47ef-dbfb-430f2cbf58a1}
Followup: Pool_corruption
---------