Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\hazar\Downloads\020421-12078-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff803`80c00000 PsLoadedModuleList = 0xfffff803`8182a4b0
Debug session time: Thu Feb 4 20:20:12.632 2021 (UTC + 3:00)
System Uptime: 0 days 9:47:41.729
Loading Kernel Symbols
...............................................................
................................................................
...............................................................
Loading User Symbols
Loading unloaded module list
........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff803`80ff5a80 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff589`967bf4e0=0000000000000018
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffffbe88ffa5c990, Object whose reference count is being lowered
Arg3: 0000000000000002, Reserved
Arg4: ffffffffffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4390
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on VOSTRO-5468
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 11846
Key : Analysis.Memory.CommitPeak.Mb
Value: 79
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 18
BUGCHECK_P1: 0
BUGCHECK_P2: ffffbe88ffa5c990
BUGCHECK_P3: 2
BUGCHECK_P4: ffffffffffffffff
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: TextInputHost.exe
STACK_TEXT:
fffff589`967bf4d8 fffff803`81032cd5 : 00000000`00000018 00000000`00000000 ffffbe88`ffa5c990 00000000`00000002 : nt!KeBugCheckEx
fffff589`967bf4e0 fffff803`81228b1e : ffffbe88`f42a42a0 ffffbe88`ffa5c990 ffffbe88`00000000 00000000`00000000 : nt!ObfDereferenceObjectWithTag+0x1d1b25
fffff589`967bf520 fffff803`811d5f55 : 00000000`00000004 ffffd40d`71378b18 00000000`00000103 00000000`00000000 : nt!ObCloseHandleTableEntry+0x29e
fffff589`967bf660 fffff803`811d823d : ffffbe88`fc781080 ffffbe88`fc781080 ffffffff`ffffff01 ffffbe88`fe3d2798 : nt!ExSweepHandleTable+0xd5
fffff589`967bf710 fffff803`8125d97c : ffffffff`ffffffff ffffbe88`fe3d2340 fffff589`967bf760 fffff803`8126587c : nt!ObKillProcess+0x35
fffff589`967bf740 fffff803`81306976 : ffffbe88`fe3d2340 ffffd40d`5ee10060 fffff589`967bf990 00000000`00000000 : nt!PspRundownSingleProcess+0x204
fffff589`967bf7d0 fffff803`812d26c8 : 00000001`00000001 00000000`00000001 fffff589`967bf9e0 00000026`3f5ca000 : nt!PspExitThread+0x5f6
fffff589`967bf8d0 fffff803`80e67fb7 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff803`80e0ecc6 : nt!KiSchedulerApcTerminate+0x38
fffff589`967bf910 fffff803`80ffa020 : 00000000`00000000 fffff589`967bf9c0 fffff589`967bfb80 00000207`00000000 : nt!KiDeliverApc+0x487
fffff589`967bf9c0 fffff803`8100755f : ffffbe88`fc781080 ffffbe89`013d43e0 00000000`00000000 00000000`00000000 : nt!KiInitiateUserApc+0x70
fffff589`967bfb00 00007fff`0276c6a4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
00000026`3f37f6c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`0276c6a4
SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+1d1b25
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.789
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1d1b25
FAILURE_BUCKET_ID: 0x18_OVER_DEREFERENCE_nt!ObfDereferenceObjectWithTag
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {4139309c-4e9f-52f0-ac5e-4041e7a86a20}
Followup: MachineOwner
---------
drive.google.com
