*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffffca0aac087050, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: 000000208200003c, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 0
BUGCHECK_P2: ffffca0aac087050
BUGCHECK_P3: 1
BUGCHECK_P4: 208200003c
CPU_COUNT: c
CPU_MHZ: d48
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 8
CPU_STEPPING: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: WmiPrvSE.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 11-11-2019 18:07:35.0026
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff803223f729e to fffff803223c1220
STACK_TEXT:
ffffc803`e18a01f8 fffff803`223f729e : 00000000`00000018 00000000`00000000 ffffca0a`ac087050 00000000`00000001 : nt!KeBugCheckEx
ffffc803`e18a0200 fffff803`227f0408 : ffffca0a`ac087700 ffffca0a`adf2a080 ffffca0a`adf2a080 ffffca0a`ac087700 : nt!ObfDereferenceObjectWithTag+0x1bc9fe
ffffc803`e18a0240 fffff803`227e1c58 : 00000000`00000000 00000000`00020000 00000000`00000000 00000000`00000000 : nt!ExpGetProcessInformation+0xf48
ffffc803`e18a08b0 fffff803`227e131b : 00000179`22ad7d80 00000000`00000001 00000179`23e22980 00000000`00000000 : nt!ExpQuerySystemInformation+0x818
ffffc803`e18a0ac0 fffff803`223d2b18 : ffffca0a`aad46080 ffffca0a`ac0b6080 ffffc803`e18a0b80 ffffca0a`acddb760 : nt!NtQuerySystemInformation+0x2b
ffffc803`e18a0b00 00007fff`4eb3c784 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000004d`93fdcf58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`4eb3c784
THREAD_SHA1_HASH_MOD_FUNC: ef6447d890435c7dd09a3fb872d56a74a4236f2a
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 310233984e7b918dc107dad594d31352d8b66099
THREAD_SHA1_HASH_MOD: ee8fcf1fb60cb6e3e2f60ddbed2ec02b5748a693
FOLLOWUP_IP:
nt!ObfDereferenceObjectWithTag+1bc9fe
fffff803`223f729e cc int 3
FAULT_INSTR_CODE: 48d233cc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+1bc9fe
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1bc9fe
FAILURE_BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag
BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag
PRIMARY_PROBLEM_CLASS: 0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag
TARGET_TIME: 2019-11-08T15:32:33.000Z
OSBUILD: 18362
OSSERVICEPACK: 418
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 1650
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x18_corrupt_ref_count_nt!obfdereferenceobjectwithtag
FAILURE_ID_HASH: {fa6b3516-71cb-1e92-b987-b8bebd3458ac}
Followup: MachineOwner
---------
