MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000061948, The subtype of the bugcheck.
Arg2: 0000000000000000
Arg3: 0000000000000001
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 61948
BUGCHECK_P2: 0
BUGCHECK_P3: 1
BUGCHECK_P4: 0
BUGCHECK_STR: 0x1a_61948
CPU_COUNT: 4
CPU_MHZ: dac
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 1
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-07-2020 01:31:05.0622
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff80081a404c2 to fffff800819c14e0
STACK_TEXT:
ffff8f82`839ef998 fffff800`81a404c2 : 00000000`0000001a 00000000`00061948 00000000`00000000 00000000`00000001 : nt!KeBugCheckEx
ffff8f82`839ef9a0 fffff800`81817229 : 00000000`00000002 00000000`00000001 00000000`00000001 00000000`00000000 : nt!MiDereferenceIoPages+0x14af16
ffff8f82`839efa30 fffff800`818b11f7 : 00000000`00000003 ffff8f82`839f0180 ffff8f82`839f0180 ffff8f82`839f00d0 : nt!MiDeletePteRun+0xf89
ffff8f82`839efc50 fffff800`818acd12 : ffffaf04`fb49b900 ffff90bf`feb45788 00000000`00000000 00000000`00000000 : nt!MiDeleteVaTail+0x77
ffff8f82`839efc80 fffff800`818acea1 : ffff8f82`839f00d0 ffff90c8`5fff5a28 00000000`00000000 0a000002`38ab0867 : nt!MiWalkPageTablesRecursively+0x512
ffff8f82`839efd40 fffff800`818acea1 : ffff8f82`839f00d0 ffff90c8`642fffa8 00000000`00000000 0a000002`38797867 : nt!MiWalkPageTablesRecursively+0x6a1
ffff8f82`839efe00 fffff800`818acea1 : ffff8f82`839f00d0 ffff90c8`643217f8 ffff90c8`00000000 0a000002`3c274867 : nt!MiWalkPageTablesRecursively+0x6a1
ffff8f82`839efec0 fffff800`818ac62c : ffff8f82`839f00d0 ffff90c8`64321908 ffff8f82`00000000 ffff8f82`839f0049 : nt!MiWalkPageTablesRecursively+0x6a1
ffff8f82`839eff80 fffff800`818aaa98 : ffff8f82`839f00d0 00000000`00000002 00000000`00000001 00000000`00000000 : nt!MiWalkPageTables+0x36c
ffff8f82`839f0080 fffff800`818b8bf0 : ffffffff`ffffffff ffffaf04`fb49b778 ffff8f82`00000001 00000000`00000000 : nt!MiDeletePagablePteRange+0x268
ffff8f82`839f0420 fffff800`81dc7a5d : ffffaf04`fb7f5080 ffffaf04`fb7f5080 ffffaf04`fb4a9740 ffffaf04`fb49b770 : nt!MiDeleteVad+0x860
ffff8f82`839f05e0 fffff800`81dd9e14 : ffffaf04`fb4a9740 ffffaf04`fb48ed40 ffffaf04`fb7f5080 00000000`00000000 : nt!MiUnmapVad+0x49
ffff8f82`839f0610 fffff800`81dd98cf : ffffaf04`fb4b2660 ffffaf04`fb4b2660 ffffaf04`fb49b400 fffff800`81c6a3c0 : nt!MiCleanVad+0x30
ffff8f82`839f0640 fffff800`81e38771 : ffffffff`00000000 ffffffff`ffffffff ffff8f82`839f0801 ffffaf04`fb49b400 : nt!MmCleanProcessAddressSpace+0x137
ffff8f82`839f06c0 fffff800`81e5e6d3 : ffffaf04`fb49b400 ffffe703`87c57770 ffff8f82`839f08e9 00000000`00000000 : nt!PspRundownSingleProcess+0x139
ffff8f82`839f0740 fffff800`81ecd143 : ffffaf04`000005bb ffff8f82`839f0801 00000000`003e2000 fffff800`8183e527 : nt!PspExitThread+0x60b
ffff8f82`839f0850 fffff800`8183e551 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSchedulerApcTerminate+0x33
ffff8f82`839f0890 fffff800`819c5a60 : ffff8f82`839f0b01 ffff8f82`839f0950 00000000`00000001 00000000`00000000 : nt!KiDeliverApc+0x481
ffff8f82`839f0950 fffff800`819d2dbf : 00000000`00000000 ffff8f82`839f0b80 ffffaf04`fb7f5080 00000000`08def558 : nt!KiInitiateUserApc+0x70
ffff8f82`839f0a90 00007ffd`887fcc14 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
00000000`08def538 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`887fcc14
THREAD_SHA1_HASH_MOD_FUNC: e0b3ea397b28567c1892727cd05f12769e19b6db
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: dd633bfca007cc046c1d6caef1a720b24537971b
THREAD_SHA1_HASH_MOD: 65e960981daf68eaa3f111ef44aadfdc4bfefe1e
FOLLOWUP_IP:
nt!MiDereferenceIoPages+14af16
fffff800`81a404c2 cc int 3
FAULT_INSTR_CODE: 1bacc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiDereferenceIoPages+14af16
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 14af16
FAILURE_BUCKET_ID: 0x1a_61948_nt!MiDereferenceIoPages
BUCKET_ID: 0x1a_61948_nt!MiDereferenceIoPages
PRIMARY_PROBLEM_CLASS: 0x1a_61948_nt!MiDereferenceIoPages
TARGET_TIME: 2020-01-06T16:48:02.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 4826
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x1a_61948_nt!midereferenceiopages
FAILURE_ID_HASH: {16899f95-043e-78ea-0aba-e664d76c4fc5}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffffe0c984616d0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffffe0c98461628, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 3
BUGCHECK_P2: fffffe0c984616d0
BUGCHECK_P3: fffffe0c98461628
BUGCHECK_P4: 0
TRAP_FRAME: fffffe0c984616d0 -- (.trap 0xfffffe0c984616d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff868b407457e8 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80307648b10 rsp=fffffe0c98461860 rbp=ffff868b40fe0080
r8=0000000000000001 r9=0000000000000000 r10=7fffffffffffff00
r11=ffffc5002cf40180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KiExitDispatcher+0x160:
fffff803`07648b10 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: fffffe0c98461628 -- (.exr 0xfffffe0c98461628)
ExceptionAddress: fffff80307648b10 (nt!KiExitDispatcher+0x0000000000000160)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: 4
CPU_MHZ: dac
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 1
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: opera.exe
CURRENT_IRQL: 2
DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY
ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-07-2020 01:31:02.0170
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff803077d32e9 to fffff803077c14e0
STACK_TEXT:
fffffe0c`984613a8 fffff803`077d32e9 : 00000000`00000139 00000000`00000003 fffffe0c`984616d0 fffffe0c`98461628 : nt!KeBugCheckEx
fffffe0c`984613b0 fffff803`077d3710 : 00000000`00000001 00000000`00000000 fffff803`05289180 fffff803`0755eb95 : nt!KiBugCheckDispatch+0x69
fffffe0c`984614f0 fffff803`077d1aa5 : 00000000`05060608 00000000`00000001 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
fffffe0c`984616d0 fffff803`07648b10 : 00000000`00000000 00000000`00000000 ffff868b`40081001 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x325
fffffe0c`98461860 fffff803`076a50e9 : ffff868b`407457e0 00000000`00000000 ffff868b`40fe0080 ffffc500`2cf40180 : nt!KiExitDispatcher+0x160
fffffe0c`984618c0 fffff803`07c52140 : ffff868b`3f6b83a0 ffff868b`40fe0080 ffff868b`40fe0000 ffff868b`40081080 : nt!KeRequestTerminationThread+0xed
fffffe0c`984619a0 fffff803`07c5184f : 00000000`00000008 ffff868b`40fe0080 00000000`00000000 00000000`00000000 : nt!PspTerminateThreadByPointer+0x80
fffffe0c`984619e0 fffff803`07c39fc0 : ffff868b`403b5080 00000000`00000000 ffff868b`3f6b80c0 ffff868b`3f6b80c0 : nt!PspTerminateAllThreads+0xcb
fffffe0c`98461a50 fffff803`07c39da9 : ffffffff`ffffffff fffffe0c`98461b80 ffff868b`3f6b80c0 fffff803`07cb0701 : nt!PspTerminateProcess+0xe0
fffffe0c`98461a90 fffff803`077d2d18 : ffff868b`00001968 ffff868b`40081080 ffff868b`3f6b80c0 00000000`00000000 : nt!NtTerminateProcess+0xa9
fffffe0c`98461b00 00007ffc`cd23c644 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000031`121feef8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`cd23c644
THREAD_SHA1_HASH_MOD_FUNC: 8b6fd936d5d89d4457bb69a2b0b933d76732fd69
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 049103aace12c6aa588cf829f7956e0fa9f35cca
THREAD_SHA1_HASH_MOD: b28610981796779b4ac02f58898fde25728a775c
FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff803`077d3710 c644242000 mov byte ptr [rsp+20h],0
FAULT_INSTR_CODE: 202444c6
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiFastFailDispatch+d0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
TARGET_TIME: 2020-01-01T09:32:03.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 4a1e
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_nt!kifastfaildispatch
FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}
Followup: MachineOwner
---------
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80678842bb4, Address of the instruction which caused the bugcheck
Arg3: fffff68de976aac0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff80678842bb4
BUGCHECK_P3: fffff68de976aac0
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!RtlpHpVsContextAllocateInternal+204
fffff806`78842bb4 3309 xor ecx,dword ptr [rcx]
CONTEXT: fffff68de976aac0 -- (.cxr 0xfffff68de976aac0)
rax=ffff0005f395db18 rbx=ffffd205ede00280 rcx=ffff0005f395db10
rdx=0000000000000000 rsi=0000000000000000 rdi=ffffd205ede00000
rip=fffff80678842bb4 rsp=fffff68de976b4b0 rbp=00000000006e0000
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=fffff68de976b58c
r14=ffffd205ede00290 r15=fffff68de976b5c0
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050286
nt!RtlpHpVsContextAllocateInternal+0x204:
fffff806`78842bb4 3309 xor ecx,dword ptr [rcx] ds:002b:ffff0005`f395db10=????????
Resetting default scope
BUGCHECK_STR: 0x3B_c0000005
CPU_COUNT: 4
CPU_MHZ: dac
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 1
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-07-2020 01:30:58.0067
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff8067883330e to fffff80678842bb4
STACK_TEXT:
fffff68d`e976b4b0 fffff806`7883330e : 00000000`0000006e 00000000`000006c0 00000000`000006c0 ffffd205`ede00000 : nt!RtlpHpVsContextAllocateInternal+0x204
fffff68d`e976b520 fffff806`78b6f06d : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`0000067c : nt!ExAllocateHeapPool+0xc0e
fffff68d`e976b660 fffff806`78de9a50 : ffffbf0e`a389d7a0 00000000`00000000 00000000`00000000 ffffd205`00000000 : nt!ExAllocatePoolWithTag+0x5d
fffff68d`e976b6b0 fffff806`78ddc36d : ffffbf0e`00000008 ffffbf0e`a3899600 00000000`00000000 fffff68d`e976b770 : nt!ObpAllocateObject+0x1a0
fffff68d`e976b730 fffff806`78ddbb72 : ffffd205`f358c730 fffff68d`e976b8c8 ffffd205`f381db50 ffffbf0e`ab02fe90 : nt!ObCreateObjectEx+0xfd
fffff68d`e976b7a0 fffff806`78dc9c49 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffd205`f39879a0 : nt!SepDuplicateToken+0x102
fffff68d`e976b880 fffff806`78dcf062 : ffffd205`f39879a0 00000000`00000000 00000000`00000000 00000000`000000c0 : nt!SeCopyClientToken+0x65
fffff68d`e976b910 fffff806`78dcec32 : ffffd205`f358c730 00000000`00000000 ffffbf0e`aac83600 00000000`00000001 : nt!SepCreateClientSecurityEx+0x132
fffff68d`e976b980 fffff806`78dcc638 : 00000224`2572ac00 ffffd205`f3987980 00000000`00000000 ffffbf0e`aac81a00 : nt!SeCreateClientSecurity+0x112
fffff68d`e976ba20 fffff806`78dc3f84 : 00000224`2572ac10 fffff68d`e976bb80 00000224`2572abf0 00000000`00000001 : nt!AlpcpCreateSecurityContext+0x90
fffff68d`e976ba80 fffff806`789d2d18 : ffffbf0e`aaccb340 00000224`2572abe0 fffff68d`e976bb80 ffffbf0e`aac81a00 : nt!NtAlpcCreateSecurityContext+0x134
fffff68d`e976bb00 00007ffb`2611d054 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000ea`fd4fe128 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`2611d054
THREAD_SHA1_HASH_MOD_FUNC: 5811bd1ea32517330ebd519ed8a952ae023a04b6
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 2b2f279f038c2709c899ff6e6510032755feddbe
THREAD_SHA1_HASH_MOD: dc844b1b94baa204d070855e43bbbd27eee98b94
FOLLOWUP_IP:
nt!RtlpHpVsContextAllocateInternal+204
fffff806`78842bb4 3309 xor ecx,dword ptr [rcx]
FAULT_INSTR_CODE: d330933
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!RtlpHpVsContextAllocateInternal+204
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .cxr 0xfffff68de976aac0 ; kb
BUCKET_ID_FUNC_OFFSET: 204
FAILURE_BUCKET_ID: 0x3B_c0000005_nt!RtlpHpVsContextAllocateInternal
BUCKET_ID: 0x3B_c0000005_nt!RtlpHpVsContextAllocateInternal
PRIMARY_PROBLEM_CLASS: 0x3B_c0000005_nt!RtlpHpVsContextAllocateInternal
TARGET_TIME: 2019-12-31T13:00:59.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 2458
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x3b_c0000005_nt!rtlphpvscontextallocateinternal
FAILURE_ID_HASH: {c0957ae0-3dcd-d699-97a3-84fa3a6586ca}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff9609dfd41160, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff9609dfd410b8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 3
BUGCHECK_P2: ffff9609dfd41160
BUGCHECK_P3: ffff9609dfd410b8
BUGCHECK_P4: 0
TRAP_FRAME: ffff9609dfd41160 -- (.trap 0xffff9609dfd41160)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff9a8000009788 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80632dea43a rsp=ffff9609dfd412f0 rbp=ffff9609dfd41391
r8=0000000000000000 r9=0000000000000000 r10=0000000000000002
r11=0000000000000090 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!MiUnlinkNodeLargePage+0x1d1a1a:
fffff806`32dea43a cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff9609dfd410b8 -- (.exr 0xffff9609dfd410b8)
ExceptionAddress: fffff80632dea43a (nt!MiUnlinkNodeLargePage+0x00000000001d1a1a)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: 4
CPU_MHZ: dac
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 1
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 2
DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY
ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-07-2020 01:30:53.0346
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff80632dd32e9 to fffff80632dc14e0
STACK_TEXT:
ffff9609`dfd40e38 fffff806`32dd32e9 : 00000000`00000139 00000000`00000003 ffff9609`dfd41160 ffff9609`dfd410b8 : nt!KeBugCheckEx
ffff9609`dfd40e40 fffff806`32dd3710 : ffff818d`c0607080 fffff806`38412177 ffff818d`c0607080 00000100`00000000 : nt!KiBugCheckDispatch+0x69
ffff9609`dfd40f80 fffff806`32dd1aa5 : 00000000`00090600 00000000`00091800 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffff9609`dfd41160 fffff806`32dea43a : 00000000`00000000 00000000`00000000 00000000`00000000 fffff806`32c7754a : nt!KiRaiseSecurityCheckFailure+0x325
ffff9609`dfd412f0 fffff806`32c842cb : 00007ff8`00000010 ffff9780`00000002 00000000`00000000 00000000`00000000 : nt!MiUnlinkNodeLargePage+0x1d1a1a
ffff9609`dfd413e0 fffff806`32c840ee : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiDemoteLocalLargePage+0x16b
ffff9609`dfd414c0 fffff806`32c78576 : 00000000`00000000 00000000`00000000 00000000`00000000 ffff9b3f`00000000 : nt!MiGetFreeOrZeroPageAnyColor+0x62
ffff9609`dfd41500 fffff806`32c513c9 : fffff806`3306a3c0 ffff9609`00000033 ffff818d`bcd04ed8 818dbcd0`00000000 : nt!MiGetPage+0x346
ffff9609`dfd415e0 fffff806`32c7a4a8 : ffff9609`dfd41880 ffffc88f`5148cd88 ffff9780`0b52df20 ffff9609`dfd41858 : nt!MiResolveMappedFileFault+0x339
ffff9609`dfd41710 fffff806`32c74bcc : ffff9609`dfd41880 00000000`00000000 ffff9609`dfd41858 ffffc88f`5148cd88 : nt!MiResolveProtoPteFault+0xaf8
ffff9609`dfd41810 fffff806`32c72d09 : 00000000`00000100 00000000`00000100 00000000`c0000016 00000000`00000000 : nt!MiDispatchFault+0x80c
ffff9609`dfd41960 fffff806`32dcf520 : ffff818d`c0607080 000001ca`c464f308 00000000`00008000 0000003f`00000000 : nt!MmAccessFault+0x169
ffff9609`dfd41b00 00007ff8`82f11d8d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x360
0000003f`982fe568 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`82f11d8d
THREAD_SHA1_HASH_MOD_FUNC: 65e852231aba98309f13d8fb1531e4627eb3b355
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 43fa75a0776a9e913f8671b47ede47ac5025a331
THREAD_SHA1_HASH_MOD: fe34192f63d13620a8987d294372ee74d699cfee
FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff806`32dd3710 c644242000 mov byte ptr [rsp+20h],0
FAULT_INSTR_CODE: 202444c6
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiFastFailDispatch+d0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
TARGET_TIME: 2019-12-28T07:47:05.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 5dd0
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_nt!kifastfaildispatch
FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}
Followup: MachineOwner
---------