SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M mavi ekran hatası

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffeff7c01a4010, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: 0000000000000000, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000006, (reserved)

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 8218

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 26618

    Key  : Analysis.Init.CPU.mSec
    Value: 1093

    Key  : Analysis.Init.Elapsed.mSec
    Value: 2698

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 78

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


BUGCHECK_CODE:  50

BUGCHECK_P1: ffffeff7c01a4010

BUGCHECK_P2: 0

BUGCHECK_P3: 0

BUGCHECK_P4: 6

READ_ADDRESS: fffff803200fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 ffffeff7c01a4010

MM_INTERNAL_CODE:  6

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

TRAP_FRAME:  fffff68b34852b00 -- (.trap 0xfffff68b34852b00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffeff7fbfdf000 rbx=0000000000000000 rcx=ffffef8034802c28
rdx=ffffeff7c01a4010 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8031f62fc88 rsp=fffff68b34852c90 rbp=ffffcc858aff0c00
 r8=ffffef8000000000  r9=0000007ffffffff8 r10=0000000000000000
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!MmCheckCachedPageStates+0xe8:
fffff803`1f62fc88 488b1a          mov     rbx,qword ptr [rdx] ds:ffffeff7`c01a4010=????????????????
Resetting default scope

STACK_TEXT:
fffff68b`348527d8 fffff803`1f887678     : 00000000`00000050 ffffeff7`c01a4010 00000000`00000000 ffffeff7`fbe00d20 : nt!KeBugCheckEx
fffff68b`348527e0 fffff803`1f728cfd     : fffff68b`34852a20 fffff68b`34852960 fffff68b`34852968 fffff68b`34852978 : nt!MiZeroFault+0x161988
fffff68b`348528d0 fffff803`1f727f7a     : 00000000`00000001 00000000`00000000 fffff68b`34852b80 00000000`00000000 : nt!MiUserFault+0x80d
fffff68b`34852960 fffff803`1f804d5e     : ffffb78c`bbe03000 00000000`00000000 00000000`00001000 00000000`00000000 : nt!MmAccessFault+0x16a
fffff68b`34852b00 fffff803`1f62fc88     : fffff68b`00000000 fffff803`1f715841 ffffcc85`75002340 00000000`000000d0 : nt!KiPageFault+0x35e
fffff68b`34852c90 fffff803`1f62facd     : 00000000`00000000 fffff68b`34853098 00000000`00000000 ffffcc85`8aff0c38 : nt!MmCheckCachedPageStates+0xe8
fffff68b`34852e60 fffff803`1f62e5b5     : 00000000`00001001 00000000`00001000 00000000`ffffff01 fffff68b`00000000 : nt!CcMapAndRead+0xdd
fffff68b`34852ec0 fffff803`1f9fbed9     : fffff68b`34853260 fffff68b`34853098 ffffcc85`00001000 00000000`00000000 : nt!CcPinFileData+0x975
fffff68b`34852fd0 fffff803`2506919f     : 00000000`00000000 ffffffff`fe414000 00000000`00001000 fffff68b`34853260 : nt!CcPinRead+0xd9
fffff68b`34853090 fffff803`25098a12     : 00000000`00000000 ffffcc85`8bab8180 ffffffff`fe414000 ffffcc85`00000001 : Ntfs!NtfsPinStream+0xa3
fffff68b`348530e0 fffff803`250f905d     : fffff68b`34853378 fffff68b`348539b9 ffffb78c`b9fd6080 ffffcc85`8aff0c38 : Ntfs!PinAttributeForRestart+0x92
fffff68b`34853120 fffff803`2516098f     : ffffcc85`8aff0c38 ffffb78c`b9fd6080 ffffb78c`b9fd60a8 00000000`00000000 : Ntfs!DoAction+0x5fc91
fffff68b`34853220 fffff803`250aacd1     : ffffcc85`8aff0c38 00000000`00000000 ffffcc85`8a7380e0 fffff68b`348533d0 : Ntfs!RedoPass+0x5cb
fffff68b`34853370 fffff803`250b65b9     : ffffcc85`8bab81c0 ffffcc85`8bab8180 00000000`00000000 ffffcc85`8bab81c0 : Ntfs!NtfsRestartVolume+0x165
fffff68b`348534e0 fffff803`25026e03     : ffffcc85`8aff0c38 00000000`0191bdda 00000000`24f2eb00 fffff803`24f52ef9 : Ntfs!NtfsMountVolume+0x1259
fffff68b`34853950 fffff803`24f2f214     : ffffcc85`8aff0c38 fffff803`24f2ebc0 00000000`00000000 ffffcc85`8aff0c38 : Ntfs!NtfsCommonFileSystemControl+0xcf
fffff68b`34853a20 fffff803`1f741225     : ffffcc85`85f49040 ffffcc85`85f49040 ffffcc85`7567aa20 ffffcc85`00000000 : Ntfs!NtfsFspDispatch+0x654
fffff68b`34853b70 fffff803`1f6f53b5     : ffffcc85`85f49040 00000000`00000080 ffffcc85`75697180 00000000`00000001 : nt!ExpWorkerThread+0x105
fffff68b`34853c10 fffff803`1f7fe278     : fffff803`1cf8c180 ffffcc85`85f49040 fffff803`1f6f5360 00000000`00000000 : nt!PspSystemThreadStartup+0x55
fffff68b`34853c60 00000000`00000000     : fffff68b`34854000 fffff68b`3484e000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME:  nt!MiZeroFault+161988

MODULE_NAME: nt

IMAGE_VERSION:  10.0.19041.1052

STACK_COMMAND:  .thread ; .cxr ; kb

IMAGE_NAME:  ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET:  161988

FAILURE_BUCKET_ID:  AV_R_INVALID_nt!MiZeroFault

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {4012c162-8821-abc7-6952-420de1d68bbf}

Followup:     MachineOwner
---------



SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common BugCheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8058042ff89, The address that the exception occurred at
Arg3: ffffe200fa867a58, Exception Record Address
Arg4: ffffe200fa867290, Context Record Address

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

    Key  : AV.Fault
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 9843

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 24775

    Key  : Analysis.Init.CPU.mSec
    Value: 1186

    Key  : Analysis.Init.Elapsed.mSec
    Value: 2942

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 84

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


BUGCHECK_CODE:  7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8058042ff89

BUGCHECK_P3: ffffe200fa867a58

BUGCHECK_P4: ffffe200fa867290

EXCEPTION_RECORD:  ffffe200fa867a58 -- (.exr 0xffffe200fa867a58)
ExceptionAddress: fffff8058042ff89 (nt!MmCheckCachedPageStates+0x00000000000003e9)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 00002000000001b0
Attempt to read from address 00002000000001b0

CONTEXT:  ffffe200fa867290 -- (.cxr 0xffffe200fa867290)
rax=0000000000000023 rbx=000000000041f600 rcx=ffffe200fa867d40
rdx=0000200000000198 rsi=ffff95800c5e2000 rdi=0000000000000007
rip=fffff8058042ff89 rsp=ffffe200fa867c90 rbp=ffff800ebfc2ec00
 r8=ffffc88000000000  r9=0000007ffffffff8 r10=0000000fffffffff
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=ffffc8c0075b6ea0
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!MmCheckCachedPageStates+0x3e9:
fffff805`8042ff89 488b5218        mov     rdx,qword ptr [rdx+18h] ds:002b:00002000`000001b0=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

READ_ADDRESS: fffff80580efb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 00002000000001b0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  00002000000001b0

EXCEPTION_STR:  0xc0000005

STACK_TEXT:
ffffe200`fa867c90 fffff805`8042facd     : 00000000`00000000 ffffe200`fa868098 00000000`00000000 ffff800e`bfc2ec78 : nt!MmCheckCachedPageStates+0x3e9
ffffe200`fa867e60 fffff805`8042e5b5     : 00000000`00001001 00000000`00001000 00000000`ffffff01 ffffe200`00000000 : nt!CcMapAndRead+0xdd
ffffe200`fa867ec0 fffff805`807fbed9     : ffffe200`fa868260 ffffe200`fa868098 ffff800e`00001000 00000000`00000000 : nt!CcPinFileData+0x975
ffffe200`fa867fd0 fffff805`84e6919f     : 00000000`00000000 ffffffff`fe414000 00000000`00001000 ffffe200`fa868260 : nt!CcPinRead+0xd9
ffffe200`fa868090 fffff805`84e98a12     : 00000000`00000000 ffff800e`c2447180 ffffffff`fe414000 ffff800e`00000001 : Ntfs!NtfsPinStream+0xa3
ffffe200`fa8680e0 fffff805`84ef905d     : ffffe200`fa868378 ffffe200`fa8689b9 ffffb605`40bd6080 ffff800e`bfc2ec78 : Ntfs!PinAttributeForRestart+0x92
ffffe200`fa868120 fffff805`84f6098f     : ffff800e`bfc2ec78 ffffb605`40bd6080 ffffb605`40bd60a8 00000000`00000000 : Ntfs!DoAction+0x5fc91
ffffe200`fa868220 fffff805`84eaacd1     : ffff800e`bfc2ec78 00000000`00000000 ffff800e`c244c0e0 ffffe200`fa8683d0 : Ntfs!RedoPass+0x5cb
ffffe200`fa868370 fffff805`84eb65b9     : ffff800e`c24471c0 ffff800e`c2447180 00000000`00000000 ffff800e`c24471c0 : Ntfs!NtfsRestartVolume+0x165
ffffe200`fa8684e0 fffff805`84e26e03     : ffff800e`bfc2ec78 00000000`0191bdda 00000000`84d2eb00 fffff805`84d52ef9 : Ntfs!NtfsMountVolume+0x1259
ffffe200`fa868950 fffff805`84d2f214     : ffff800e`bfc2ec78 fffff805`84d2ebc0 00000000`00000000 ffff800e`bfc2ec78 : Ntfs!NtfsCommonFileSystemControl+0xcf
ffffe200`fa868a20 fffff805`80541225     : ffff800e`c1110040 ffff800e`c1110040 ffff800e`b4caabf0 ffff800e`00000000 : Ntfs!NtfsFspDispatch+0x654
ffffe200`fa868b70 fffff805`804f53b5     : ffff800e`c1110040 00000000`00000080 ffff800e`b4c97240 000fa425`bd9bbfff : nt!ExpWorkerThread+0x105
ffffe200`fa868c10 fffff805`805fe278     : fffff805`7cca0180 ffff800e`c1110040 fffff805`804f5360 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffe200`fa868c60 00000000`00000000     : ffffe200`fa869000 ffffe200`fa863000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME:  nt!MmCheckCachedPageStates+3e9

MODULE_NAME: nt

IMAGE_VERSION:  10.0.19041.1052

STACK_COMMAND:  .cxr 0xffffe200fa867290 ; kb

IMAGE_NAME:  ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET:  3e9

FAILURE_BUCKET_ID:  AV_nt!MmCheckCachedPageStates

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {3400d3f2-0a18-41fd-5365-e00970cc23e4}

Followup:     MachineOwner
---------



SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common BugCheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80113a48e1d, The address that the exception occurred at
Arg3: ffff8707756ec8d8, Exception Record Address
Arg4: ffff8707756ec110, Context Record Address

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

    Key  : AV.Dereference
    Value: NullPtr

    Key  : AV.Fault
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 8703

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 26792

    Key  : Analysis.Init.CPU.mSec
    Value: 1155

    Key  : Analysis.Init.Elapsed.mSec
    Value: 2697

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 85

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


BUGCHECK_CODE:  7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff80113a48e1d

BUGCHECK_P3: ffff8707756ec8d8

BUGCHECK_P4: ffff8707756ec110

EXCEPTION_RECORD:  ffff8707756ec8d8 -- (.exr 0xffff8707756ec8d8)
ExceptionAddress: fffff80113a48e1d (nt!MiAddViewsForSection+0x000000000000001d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

CONTEXT:  ffff8707756ec110 -- (.cxr 0xffff8707756ec110)
rax=0000000000000000 rbx=000fffffffffe440 rcx=0000000000000000
rdx=000fffffffffe440 rsi=ffff8707756ecdc0 rdi=ffff8707756ecdd0
rip=fffff80113a48e1d rsp=ffff8707756ecb10 rbp=ffff8707756ecba9
 r8=0000000000000005  r9=0000000000000000 r10=0000000000000040
r11=ffff8707756ecbe0 r12=ffffc48a200d0590 r13=0000000000000001
r14=ffffc48a12de4158 r15=0000000000000040
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!MiAddViewsForSection+0x1d:
fffff801`13a48e1d 4c8b39          mov     r15,qword ptr [rcx] ds:002b:00000000`00000000=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

READ_ADDRESS: fffff801144fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 0000000000000000

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

EXCEPTION_STR:  0xc0000005

STACK_TEXT:
ffff8707`756ecb10 fffff801`13b45b64     : 00000000`0000029c 000fffff`ffffe440 00000000`00000000 00000000`000009d2 : nt!MiAddViewsForSection+0x1d
ffff8707`756ecc10 fffff801`13b4702e     : ffffffff`fe400000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmMapViewInSystemCache+0xc4
ffff8707`756ecd90 fffff801`13a2f85a     : ffffffff`fe400000 ffffc48a`00000000 00000000`00000000 00000000`00000001 : nt!CcGetVacbMiss+0xce
ffff8707`756ece20 fffff801`13a2dcf7     : ffffc48a`00000000 fffff801`00000001 ffff8707`756ecf00 ffff8707`756ecf08 : nt!CcGetVirtualAddress+0x33a
ffff8707`756ecec0 fffff801`13dfbed9     : ffff8707`756ed260 ffff8707`756ed098 ffffc48a`00001000 00000000`00000000 : nt!CcPinFileData+0xb7
ffff8707`756ecfd0 fffff801`19a6919f     : 00000000`00000000 ffffffff`fe414000 00000000`00001000 ffff8707`756ed260 : nt!CcPinRead+0xd9
ffff8707`756ed090 fffff801`19a98a12     : 00000000`00000000 ffffc48a`2054c180 ffffffff`fe414000 ffffc48a`00000001 : Ntfs!NtfsPinStream+0xa3
ffff8707`756ed0e0 fffff801`19af905d     : ffff8707`756ed378 ffff8707`756ed9b9 ffffa100`bffd6080 ffffc48a`1f502d48 : Ntfs!PinAttributeForRestart+0x92
ffff8707`756ed120 fffff801`19b6098f     : ffffc48a`1f502d48 ffffa100`bffd6080 ffffa100`bffd60a8 00000000`00000000 : Ntfs!DoAction+0x5fc91
ffff8707`756ed220 fffff801`19aaacd1     : ffffc48a`1f502d48 00000000`00000000 ffffc48a`205510e0 ffff8707`756ed3d0 : Ntfs!RedoPass+0x5cb
ffff8707`756ed370 fffff801`19ab65b9     : ffffc48a`2054c1c0 ffffc48a`2054c180 00000000`00000000 ffffc48a`2054c1c0 : Ntfs!NtfsRestartVolume+0x165
ffff8707`756ed4e0 fffff801`19a26e03     : ffffc48a`1f502d48 00000000`0191bdda 00000000`1992eb00 fffff801`19952ef9 : Ntfs!NtfsMountVolume+0x1259
ffff8707`756ed950 fffff801`1992f214     : ffffc48a`1f502d48 fffff801`1992ebc0 00000000`00000000 ffffc48a`1f502d48 : Ntfs!NtfsCommonFileSystemControl+0xcf
ffff8707`756eda20 fffff801`13b41225     : ffffc48a`1f2e5040 ffffc48a`1f2e5040 ffffc48a`12c74b70 ffffc48a`00000000 : Ntfs!NtfsFspDispatch+0x654
ffff8707`756edb70 fffff801`13af53b5     : ffffc48a`1f2e5040 00000000`00000080 ffffc48a`12c97180 000fa425`bd9bbfff : nt!ExpWorkerThread+0x105
ffff8707`756edc10 fffff801`13bfe278     : ffffe681`40d5c180 ffffc48a`1f2e5040 fffff801`13af5360 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff8707`756edc60 00000000`00000000     : ffff8707`756ee000 ffff8707`756e8000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME:  nt!MiAddViewsForSection+1d

MODULE_NAME: nt

IMAGE_VERSION:  10.0.19041.1052

STACK_COMMAND:  .cxr 0xffff8707756ec110 ; kb

IMAGE_NAME:  ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET:  1d

FAILURE_BUCKET_ID:  AV_nt!MiAddViewsForSection

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {5737f6ec-d210-baf6-6144-afbb01d4f054}

Followup:     MachineOwner
---------



SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common BugCheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8054282e470, The address that the exception occurred at
Arg3: ffffee02a4cb4c88, Exception Record Address
Arg4: ffffee02a4cb44c0, Context Record Address

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

    Key  : AV.Fault
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 7842

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 22897

    Key  : Analysis.Init.CPU.mSec
    Value: 1077

    Key  : Analysis.Init.Elapsed.mSec
    Value: 3203

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 86

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


BUGCHECK_CODE:  7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8054282e470

BUGCHECK_P3: ffffee02a4cb4c88

BUGCHECK_P4: ffffee02a4cb44c0

EXCEPTION_RECORD:  ffffee02a4cb4c88 -- (.exr 0xffffee02a4cb4c88)
ExceptionAddress: fffff8054282e470 (nt!CcPinFileData+0x0000000000000830)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 000000000028aa1e
Attempt to read from address 000000000028aa1e

CONTEXT:  ffffee02a4cb44c0 -- (.cxr 0xffffee02a4cb44c0)
rax=0000000000000000 rbx=fffffffffe415000 rcx=ffffb883f629ca00
rdx=00000000000002fd rsi=00000000ffffffff rdi=000000000028aa1e
rip=fffff8054282e470 rsp=ffffee02a4cb4ec0 rbp=ffffb883f3c3d518
 r8=0000000000000000  r9=0000000000001000 r10=0000000000000000
r11=ffffee02a4cb5088 r12=0000000000000001 r13=ffffb883f5fc1d70
r14=ffffee02a4cb5098 r15=fffffffffe414000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!CcPinFileData+0x830:
fffff805`4282e470 663917          cmp     word ptr [rdi],dx ds:002b:00000000`0028aa1e=????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

READ_ADDRESS: fffff805432fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 000000000028aa1e

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  000000000028aa1e

EXCEPTION_STR:  0xc0000005

STACK_TEXT:
ffffee02`a4cb4ec0 fffff805`42bfbed9     : ffffee02`a4cb5260 ffffee02`a4cb5098 ffffb883`00001000 00000000`00000000 : nt!CcPinFileData+0x830
ffffee02`a4cb4fd0 fffff805`4766919f     : 00000000`00000000 ffffffff`fe414000 00000000`00001000 ffffee02`a4cb5260 : nt!CcPinRead+0xd9
ffffee02`a4cb5090 fffff805`47698a12     : 00000000`00000000 ffffb883`f73e2180 ffffffff`fe414000 ffffb883`00000001 : Ntfs!NtfsPinStream+0xa3
ffffee02`a4cb50e0 fffff805`476f905d     : ffffee02`a4cb5378 ffffee02`a4cb59b9 ffffdd8a`e9116080 ffffb883`f3c3d518 : Ntfs!PinAttributeForRestart+0x92
ffffee02`a4cb5120 fffff805`4776098f     : ffffb883`f3c3d518 ffffdd8a`e9116080 ffffdd8a`e91160a8 00000000`00000000 : Ntfs!DoAction+0x5fc91
ffffee02`a4cb5220 fffff805`476aacd1     : ffffb883`f3c3d518 00000000`00000000 ffffb883`f5c900e0 ffffee02`a4cb53d0 : Ntfs!RedoPass+0x5cb
ffffee02`a4cb5370 fffff805`476b65b9     : ffffb883`f73e21c0 ffffb883`f73e2180 00000000`00000000 ffffb883`f73e21c0 : Ntfs!NtfsRestartVolume+0x165
ffffee02`a4cb54e0 fffff805`47626e03     : ffffb883`f3c3d518 00000000`0191bdda 00000000`4752eb00 fffff805`47552ef9 : Ntfs!NtfsMountVolume+0x1259
ffffee02`a4cb5950 fffff805`4752f214     : ffffb883`f3c3d518 fffff805`4752ebc0 00000000`00000000 ffffb883`f3c3d518 : Ntfs!NtfsCommonFileSystemControl+0xcf
ffffee02`a4cb5a20 fffff805`42941225     : ffffb883`f6065080 ffffb883`f6065080 ffffb883`e9a7aa20 00000000`00000000 : Ntfs!NtfsFspDispatch+0x654
ffffee02`a4cb5b70 fffff805`428f53b5     : ffffb883`f6065080 00000000`00000080 ffffb883`e9a97240 000fa425`bd9bbfff : nt!ExpWorkerThread+0x105
ffffee02`a4cb5c10 fffff805`429fe278     : ffff9480`bd2d0180 ffffb883`f6065080 fffff805`428f5360 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffee02`a4cb5c60 00000000`00000000     : ffffee02`a4cb6000 ffffee02`a4cb0000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME:  nt!CcPinFileData+830

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.19041.1052

STACK_COMMAND:  .cxr 0xffffee02a4cb44c0 ; kb

BUCKET_ID_FUNC_OFFSET:  830

FAILURE_BUCKET_ID:  AV_nt!CcPinFileData

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {b8f31abd-0bab-dd40-d93b-2ea5c337f628}

Followup:     MachineOwner
---------



SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common BugCheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80412448e1d, The address that the exception occurred at
Arg3: fffff9875862e8d8, Exception Record Address
Arg4: fffff9875862e110, Context Record Address

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

    Key  : AV.Dereference
    Value: NullPtr

    Key  : AV.Fault
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 13077

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 34027

    Key  : Analysis.Init.CPU.mSec
    Value: 1108

    Key  : Analysis.Init.Elapsed.mSec
    Value: 2320

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 86

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


BUGCHECK_CODE:  7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff80412448e1d

BUGCHECK_P3: fffff9875862e8d8

BUGCHECK_P4: fffff9875862e110

EXCEPTION_RECORD:  fffff9875862e8d8 -- (.exr 0xfffff9875862e8d8)
ExceptionAddress: fffff80412448e1d (nt!MiAddViewsForSection+0x000000000000001d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

CONTEXT:  fffff9875862e110 -- (.cxr 0xfffff9875862e110)
rax=0000000000000000 rbx=000fffffffffe440 rcx=0000000000000000
rdx=000fffffffffe440 rsi=fffff9875862edc0 rdi=fffff9875862edd0
rip=fffff80412448e1d rsp=fffff9875862eb10 rbp=fffff9875862eba9
 r8=0000000000000005  r9=0000000000000000 r10=0000000000000040
r11=fffff9875862ebe0 r12=ffffd987c51045d0 r13=0000000000000001
r14=ffffd987b8a19940 r15=0000000000000040
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!MiAddViewsForSection+0x1d:
fffff804`12448e1d 4c8b39          mov     r15,qword ptr [rcx] ds:002b:00000000`00000000=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

READ_ADDRESS: fffff80412efb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 0000000000000000

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

EXCEPTION_STR:  0xc0000005

STACK_TEXT:
fffff987`5862eb10 fffff804`12545b64     : 00000000`0000004a 000fffff`ffffe440 00000000`00000000 00000000`000009d2 : nt!MiAddViewsForSection+0x1d
fffff987`5862ec10 fffff804`1254702e     : ffffffff`fe400000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmMapViewInSystemCache+0xc4
fffff987`5862ed90 fffff804`1242f85a     : ffffffff`fe400000 ffffd987`00000000 00000000`00000000 00000000`00000001 : nt!CcGetVacbMiss+0xce
fffff987`5862ee20 fffff804`1242dcf7     : ffffd987`00000000 fffff804`00000001 fffff987`5862ef00 fffff987`5862ef08 : nt!CcGetVirtualAddress+0x33a
fffff987`5862eec0 fffff804`127fbed9     : fffff987`5862f260 fffff987`5862f098 ffffd987`00001000 00000000`00000000 : nt!CcPinFileData+0xb7
fffff987`5862efd0 fffff804`1466919f     : 00000000`00000000 ffffffff`fe414000 00000000`00001000 fffff987`5862f260 : nt!CcPinRead+0xd9
fffff987`5862f090 fffff804`14698a12     : 00000000`00000000 ffffd987`b6148180 ffffffff`fe414000 ffffd987`00000001 : Ntfs!NtfsPinStream+0xa3
fffff987`5862f0e0 fffff804`146f905d     : fffff987`5862f378 fffff987`5862f9b9 ffffb509`7b416080 ffffd987`b6ad2a28 : Ntfs!PinAttributeForRestart+0x92
fffff987`5862f120 fffff804`1476098f     : ffffd987`b6ad2a28 ffffb509`7b416080 ffffb509`7b4160a8 00000000`00000000 : Ntfs!DoAction+0x5fc91
fffff987`5862f220 fffff804`146aacd1     : ffffd987`b6ad2a28 00000000`00000000 ffffd987`b6ae60e0 fffff987`5862f3d0 : Ntfs!RedoPass+0x5cb
fffff987`5862f370 fffff804`146b65b9     : ffffd987`b61481c0 ffffd987`b6148180 00000000`00000000 ffffd987`b61481c0 : Ntfs!NtfsRestartVolume+0x165
fffff987`5862f4e0 fffff804`14626e03     : ffffd987`b6ad2a28 00000000`0191bdda 00000000`1452eb00 fffff804`14552ef9 : Ntfs!NtfsMountVolume+0x1259
fffff987`5862f950 fffff804`1452f214     : ffffd987`b6ad2a28 fffff804`1452ebc0 00000000`00000000 ffffd987`b6ad2a28 : Ntfs!NtfsCommonFileSystemControl+0xcf
fffff987`5862fa20 fffff804`12541225     : ffffd987`aa8e3040 ffffd987`aa8e3040 ffffd987`aa6aabf0 fffff804`00000000 : Ntfs!NtfsFspDispatch+0x654
fffff987`5862fb70 fffff804`124f53b5     : ffffd987`aa8e3040 00000000`00000080 ffffd987`aa697180 07a0b25c`00000001 : nt!ExpWorkerThread+0x105
fffff987`5862fc10 fffff804`125fe278     : fffff804`0c564180 ffffd987`aa8e3040 fffff804`124f5360 22000761`00000000 : nt!PspSystemThreadStartup+0x55
fffff987`5862fc60 00000000`00000000     : fffff987`58630000 fffff987`5862a000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME:  nt!MiAddViewsForSection+1d

MODULE_NAME: nt

IMAGE_VERSION:  10.0.19041.1052

STACK_COMMAND:  .cxr 0xfffff9875862e110 ; kb

IMAGE_NAME:  ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET:  1d

FAILURE_BUCKET_ID:  AV_nt!MiAddViewsForSection

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {5737f6ec-d210-baf6-6144-afbb01d4f054}

Followup:     MachineOwner
---------