*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80262c05e4e, Address of the instruction which caused the bugcheck
Arg3: ffff9f81c7098930, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff80262c05e4e
BUGCHECK_P3: ffff9f81c7098930
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!KxWaitForLockOwnerShip+e
fffff802`62c05e4e 48890a mov qword ptr [rdx],rcx
CONTEXT: ffff9f81c7098930 -- (.cxr 0xffff9f81c7098930)
rax=0000000000000000 rbx=ffff9c0e8af17720 rcx=ffff9c0e8af17720
rdx=0008000000000000 rsi=0000000000000001 rdi=fffff8026318d3e0
rip=fffff80262c05e4e rsp=ffff9c0e8af176c0 rbp=ffff9c0e8af17749
r8=0000000000000000 r9=0000000000000000 r10=7ffffffffffffffc
r11=ffff8f7d60600000 r12=0000000000000000 r13=0000000000000000
r14=ffffc38c72b64080 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!KxWaitForLockOwnerShip+0xe:
fffff802`62c05e4e 48890a mov qword ptr [rdx],rcx ds:002b:00080000`00000000=????????????????
Resetting default scope
BUGCHECK_STR: 0x3B_c0000005
CPU_COUNT: 8
CPU_MHZ: 10ef
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 2
CPU_STEPPING: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-18-2019 17:29:24.0505
ANALYSIS_VERSION: 10.0.18362.1 x86fre
BAD_STACK_POINTER: ffff9f81c7097ff8
LAST_CONTROL_TRANSFER: from fffff80262c37d11 to fffff80262c05e4e
STACK_TEXT:
ffff9c0e`8af176c0 fffff802`62c37d11 : 00000000`00000000 ffff8000`f813fbd0 fffff802`63065ba0 00000000`00000000 : nt!KxWaitForLockOwnerShip+0xe
ffff9c0e`8af176f0 fffff802`62c37530 : fffff802`6318d380 00000000`00000000 00000000`00000001 ffff9c0e`8af17a00 : nt!ExpAcquireResourceSharedLite+0x721
ffff9c0e`8af177b0 fffff802`631eca1b : 00000000`00000019 ffff8000`f8e57b70 ffff9c0e`8af17860 fffff802`631f4b3c : nt!ExAcquireResourceSharedLite+0x40
ffff9c0e`8af177f0 fffff802`631f6bba : ffff8000`f8e57b70 ffff9c0e`8af17a00 00000000`00000000 ffff9c0e`8af17940 : nt!CmpLockRegistry+0x3b
ffff9c0e`8af17820 fffff802`631fa0e0 : ffff9c0e`00000000 ffffc38c`6aee1820 00000000`00000624 ffff8000`f8e57b40 : nt!CmpDeleteKeyObject+0xea
ffff9c0e`8af178b0 fffff802`62c3a9a9 : 00000000`00000000 00000000`00000000 ffff9c0e`8af17a39 ffff8000`f8e57b70 : nt!ObpRemoveObjectRoutine+0x80
ffff9c0e`8af17910 fffff802`631ec457 : 00000000`ffff8002 ffff8000`f8e57b40 ffff8000`f8e57b40 ffff8000`f7671640 : nt!ObfDereferenceObjectWithTag+0xc9
ffff9c0e`8af17950 fffff802`631f174e : 00000000`00000628 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObCloseHandleTableEntry+0x2c7
ffff9c0e`8af17a90 fffff802`62dd2d18 : ffffc38c`72b64080 00007fff`3602fca4 ffff9c0e`8af17b80 ffffc38c`725f7a00 : nt!NtClose+0xde
ffff9c0e`8af17b00 00007fff`36f1c2a4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000005b`94c7dca8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`36f1c2a4
THREAD_SHA1_HASH_MOD_FUNC: bc92f026d18b938700135201f9669f747ffe40db
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: a6e6adcb46cd7375bc852d9372740632656a8f6e
THREAD_SHA1_HASH_MOD: bc100a5647b828107ac4e18055e00abcbe1ec406
FOLLOWUP_IP:
nt!KxWaitForLockOwnerShip+e
fffff802`62c05e4e 48890a mov qword ptr [rdx],rcx
FAULT_INSTR_CODE: c70a8948
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KxWaitForLockOwnerShip+e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .cxr 0xffff9f81c7098930 ; kb
BUCKET_ID_FUNC_OFFSET: e
FAILURE_BUCKET_ID: 0x3B_c0000005_STACKPTR_ERROR_nt!KxWaitForLockOwnerShip
BUCKET_ID: 0x3B_c0000005_STACKPTR_ERROR_nt!KxWaitForLockOwnerShip
PRIMARY_PROBLEM_CLASS: 0x3B_c0000005_STACKPTR_ERROR_nt!KxWaitForLockOwnerShip
TARGET_TIME: 2019-12-17T19:09:53.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 2389
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x3b_c0000005_stackptr_error_nt!kxwaitforlockownership
FAILURE_ID_HASH: {d727c4af-27c7-04e4-888d-ab8b74fdce06}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: ffffb703082a9028, Address of the WHEA_ERROR_RECORD structure.
Arg3: 00000000b0800000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000040151, Low order 32-bits of the MCi_STATUS value.
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 0
BUGCHECK_P2: ffffb703082a9028
BUGCHECK_P3: b0800000
BUGCHECK_P4: 40151
BUGCHECK_STR: 0x124_AuthenticAMD
CPU_COUNT: 8
CPU_MHZ: 10ef
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 2
CPU_STEPPING: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: f
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-18-2019 17:31:13.0213
ANALYSIS_VERSION: 10.0.18362.1 x86fre
STACK_TEXT:
ffffcb00`7f84cba8 fffff801`1e1a4fe8 : 00000000`00000124 00000000`00000000 ffffb703`082a9028 00000000`b0800000 : nt!KeBugCheckEx
ffffcb00`7f84cbb0 fffff801`1f1a1920 : ffffb703`03ff7510 00000000`00000000 ffffb703`082a9028 00000000`00000000 : hal!HalBugCheckSystem+0xd8
ffffcb00`7f84cbf0 fffff801`1e540952 : ffffb703`03ff7510 ffffcb00`7f84cc79 00000000`00000000 ffffb703`082a9028 : PSHED!PshedBugCheckSystem+0x10
ffffcb00`7f84cc20 fffff801`1e1a6946 : ffffcb00`7f84cd40 00000000`00000004 ffffb703`03ff7560 ffffb703`03ff7510 : nt!WheaReportHwError+0x382
ffffcb00`7f84cce0 fffff801`1e1a6dda : 00000000`00000010 ffffb703`03ff7560 ffffcb00`7f84ce98 ffffcb00`7f84d0b0 : hal!HalpMcaReportError+0x72
ffffcb00`7f84ce40 fffff801`1e1a6cb4 : ffffb703`03eb49e0 00000000`00000001 ffffcb00`7f84d100 00000000`00000000 : hal!HalpMceHandlerCore+0xf2
ffffcb00`7f84ce90 fffff801`1e1a6007 : ffffb703`03eb49e0 ffffcb00`7f84d130 00000000`00000000 00000000`00000000 : hal!HalpMceHandler+0xe0
ffffcb00`7f84ced0 fffff801`1e1a71a7 : ffffb703`03eb49e0 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalpHandleMachineCheck+0x9b
ffffcb00`7f84cf00 fffff801`1e4a4a20 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalHandleMcheck+0x37
ffffcb00`7f84cf30 fffff801`1e3d04ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiHandleMcheck+0x10
ffffcb00`7f84cf60 fffff801`1e3d0171 : ffff8306`00000000 fffff801`1e3d00ae ffff8306`98889400 00000000`00000000 : nt!KxMcheckAbort+0x7a
ffffcb00`7f84d0a0 fffff801`1e5171aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiMcheckAbort+0x271
ffffdd8c`93a76960 fffff801`1e5168a1 : ffff8306`98889000 ffff8306`986f9a5f 00000000`986f9a5f 00000000`00000000 : nt!RtlCompressBufferXpressHuffStandard+0x18a
ffffdd8c`93a76a60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!RtlCompressBufferXpressHuff+0x61
THREAD_SHA1_HASH_MOD_FUNC: ac6750d57a78ae8c67a46d131c637620a165070a
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 3e8a951fee5f3e79f14acf65b2ad6d9961be2bf2
THREAD_SHA1_HASH_MOD: edfd6ae8b26b771d83a6cb9a81e4dc9760997905
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: AuthenticAMD
IMAGE_NAME: AuthenticAMD
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: 0x124_AuthenticAMD_PROCESSOR_CACHE
BUCKET_ID: 0x124_AuthenticAMD_PROCESSOR_CACHE
PRIMARY_PROBLEM_CLASS: 0x124_AuthenticAMD_PROCESSOR_CACHE
TARGET_TIME: 2019-12-16T16:00:02.000Z
OSBUILD: 18362
OSSERVICEPACK: 476
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2011-12-30 02:28:41
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 27f5
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x124_authenticamd_processor_cache
FAILURE_ID_HASH: {b533751b-676e-7546-bcdc-24e6c40d0064}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80618c05e4e, The address that the exception occurred at
Arg3: fffffc08b62b9998, Exception Record Address
Arg4: ffffb00037898930, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff80618c05e4e
BUGCHECK_P3: fffffc08b62b9998
BUGCHECK_P4: ffffb00037898930
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!KxWaitForLockOwnerShip+e
fffff806`18c05e4e 48890a mov qword ptr [rdx],rcx
EXCEPTION_RECORD: fffffc08b62b9998 -- (.exr 0xfffffc08b62b9998)
ExceptionAddress: fffff80618c05e4e (nt!KxWaitForLockOwnerShip+0x000000000000000e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffffb00037898930 -- (.cxr 0xffffb00037898930)
rax=0000000000000000 rbx=fffffc08b62b9c30 rcx=fffffc08b62b9c30
rdx=2a28000000000000 rsi=0000000000000000 rdi=ffff800aac3274a0
rip=fffff80618c05e4e rsp=fffffc08b62b9bd0 rbp=ffff800ab025a040
r8=0000000000000000 r9=0000000000000000 r10=fffff80618c36990
r11=0000000000000703 r12=fffffc08b62ba2f0 r13=0000000000000000
r14=0000000000000000 r15=0000000000000702
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!KxWaitForLockOwnerShip+0xe:
fffff806`18c05e4e 48890a mov qword ptr [rdx],rcx ds:002b:2a280000`00000000=????????????????
Resetting default scope
CPU_COUNT: 8
CPU_MHZ: 10ef
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 2
CPU_STEPPING: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
FOLLOWUP_IP:
fileinfo!FIPfInterfaceClose+51
fffff806`1df9e511 85ff test edi,edi
BUGCHECK_STR: AV
READ_ADDRESS: fffff806191733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-18-2019 17:31:24.0540
ANALYSIS_VERSION: 10.0.18362.1 x86fre
BAD_STACK_POINTER: ffffb000378980c8
LAST_CONTROL_TRANSFER: from fffff80618c36aa9 to fffff80618c05e4e
STACK_TEXT:
fffffc08`b62b9bd0 fffff806`18c36aa9 : 00000000`00000000 fffff806`18c9f66f 00000000`00000000 ffff800a`00000000 : nt!KxWaitForLockOwnerShip+0xe
fffffc08`b62b9c00 fffff806`1e129d17 : 00000000`00000002 fffffc08`b62ba288 fffffc08`b62ba260 ffff800a`b025a360 : nt!ExReleaseResourceLite+0x119
fffffc08`b62b9c60 fffff806`1e1296cf : ffff800a`b025a300 ffff800a`00000001 fffffc08`b62ba260 ffff800a`b0b2c350 : Ntfs!NtfsCleanupIrpContext+0x4b7
fffffc08`b62b9cc0 fffff806`1e22aee1 : 00000000`00000000 ffff800a`b042f010 00000000`0000ffff ffff800a`a97bfa48 : Ntfs!NtfsExtendedCompleteRequestInternal+0x13f
fffffc08`b62b9d30 fffff806`1e230de9 : ffff9886`5688fb00 00000000`00000000 ffff9886`5688fb00 ffff9886`5688fde8 : Ntfs!NtfsCompleteCleanupRequest+0x51
fffffc08`b62b9d70 fffff806`1e22ab9d : 00000000`00000000 00000000`00000258 00000000`00000000 fffffc08`b62ba230 : Ntfs!NtfsCommonCleanup+0x5dd9
fffffc08`b62ba1c0 fffff806`18c31f79 : ffff800a`b0472010 fffff806`1d6e45a0 ffff800a`b042f3f8 ffff800a`a7465300 : Ntfs!NtfsFsdCleanup+0x1ad
fffffc08`b62ba510 fffff806`1d6e55de : ffff800a`b042f010 ffff800a`b0b2c350 ffff800a`b042f010 fffffc08`b62ba600 : nt!IofCallDriver+0x59
fffffc08`b62ba550 fffff806`1d6e3f16 : fffffc08`b62ba5f0 ffff800a`b0e47768 00000000`00000001 ffff800a`a7465300 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
fffffc08`b62ba5d0 fffff806`18c31f79 : ffff800a`b0b2c350 fffff806`18c31e5d ffff800a`a74e4560 fffffc08`b62ba7e9 : FLTMGR!FltpDispatch+0xb6
fffffc08`b62ba630 fffff806`191e42b8 : 00000000`00000000 ffff800a`b0b2c350 00000000`00000000 ffff800a`b042f010 : nt!IofCallDriver+0x59
fffffc08`b62ba670 fffff806`191ec408 : 00000000`00000000 00000000`00000001 ffff800a`00000000 00000000`00007ffb : nt!IopCloseFile+0x188
fffffc08`b62ba700 fffff806`191f174e : 00000000`00003f70 fffff806`191ec400 00000000`025000a0 fffff806`00000000 : nt!ObCloseHandleTableEntry+0x278
fffffc08`b62ba840 fffff806`18dd2d18 : ffff9886`55800100 fffff806`18c45ed7 fffffc08`b62ba930 00000000`000000ff : nt!NtClose+0xde
fffffc08`b62ba8b0 fffff806`18dc5320 : fffff806`1d7237f0 ffff800a`a74e4ae0 fffff806`192453a0 ffff9886`5eea53e0 : nt!KiSystemServiceCopyEnd+0x28
fffffc08`b62baa48 fffff806`1d7237f0 : ffff800a`a74e4ae0 fffff806`192453a0 ffff9886`5eea53e0 fffff806`191fa0e8 : nt!KiServiceLinkage
fffffc08`b62baa50 fffff806`1df9e511 : fffffc08`b62baae0 ffff9886`568f5440 00000000`00000286 fffff806`18c69d69 : FLTMGR!FltClose+0x10
fffffc08`b62baa80 fffff806`192461ad : fffff806`192453a0 ffff9886`60908f80 ffff9886`60908d90 00000000`00000000 : fileinfo!FIPfInterfaceClose+0x51
fffffc08`b62baac0 fffff806`19245f59 : ffff9886`60908658 fffffc08`b62c8a80 00000000`00000000 01000000`00100000 : nt!PfpOpenHandleClose+0x55
fffffc08`b62bab10 fffff806`1924541c : fffffc08`b62c87a0 ffff800a`b0df7780 ffff800a`a7493bd0 fffff806`19245460 : nt!PfSnCleanupPrefetchSectionInfo+0x45
fffffc08`b62bab40 fffff806`18cbd4b5 : ffff800a`b025a040 ffff800a`a7493bd0 ffff800a`b0df7690 ffff800a`b0df7690 : nt!PfSnSectionInfoCleanupWorkItem+0x7c
fffffc08`b62bab70 fffff806`18d2a7a5 : ffff800a`b025a040 00000000`00000080 ffff800a`a7465300 00000224`acbb3dfe : nt!ExpWorkerThread+0x105
fffffc08`b62bac10 fffff806`18dc8b2a : ffffb000`376e5180 ffff800a`b025a040 fffff806`18d2a750 ff5286cb`ff5286cb : nt!PspSystemThreadStartup+0x55
fffffc08`b62bac60 00000000`00000000 : fffffc08`b62bb000 fffffc08`b62b5000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a
THREAD_SHA1_HASH_MOD_FUNC: d4ed0d04d427c95d12a46eeb12a32a9955ff01db
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 15e2a5f16a30ebe93694f055d4a37efd5bf8ba1e
THREAD_SHA1_HASH_MOD: 7b7a7bacf52db96a164d3c6403c6b4472f70dee7
FAULT_INSTR_CODE: 850fff85
SYMBOL_STACK_INDEX: 11
SYMBOL_NAME: fileinfo!FIPfInterfaceClose+51
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fileinfo
IMAGE_NAME: fileinfo.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 24bbed20
IMAGE_VERSION: 10.0.18362.1216
STACK_COMMAND: .cxr 0xffffb00037898930 ; kb
BUCKET_ID_FUNC_OFFSET: 51
FAILURE_BUCKET_ID: AV_STACKPTR_ERROR_fileinfo!FIPfInterfaceClose
BUCKET_ID: AV_STACKPTR_ERROR_fileinfo!FIPfInterfaceClose
PRIMARY_PROBLEM_CLASS: AV_STACKPTR_ERROR_fileinfo!FIPfInterfaceClose
TARGET_TIME: 2019-12-16T15:23:02.000Z
OSBUILD: 18362
OSSERVICEPACK: 476
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2011-12-30 02:28:41
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 27da
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_stackptr_error_fileinfo!fipfinterfaceclose
FAILURE_ID_HASH: {145d334b-6a8d-8cbf-7bb3-2b9e54b7f605}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8014b7171bb, The address that the exception occurred at
Arg3: ffffc80f3ede2728, Exception Record Address
Arg4: ffffc80f3ede1f70, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8014b7171bb
BUGCHECK_P3: ffffc80f3ede2728
BUGCHECK_P4: ffffc80f3ede1f70
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!RtlCompressBufferXpressHuffStandard+19b
fffff801`4b7171bb 413810 cmp byte ptr [r8],dl
EXCEPTION_RECORD: ffffc80f3ede2728 -- (.exr 0xffffc80f3ede2728)
ExceptionAddress: fffff8014b7171bb (nt!RtlCompressBufferXpressHuffStandard+0x000000000000019b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffffc80f3ede1f70 -- (.cxr 0xffffc80f3ede1f70)
rax=00000000000009c6 rbx=ffffde8d15b96a85 rcx=00000000000000f9
rdx=0000000000000091 rsi=ffffde8d15a45813 rdi=ffffde8d15a457fe
rip=fffff8014b7171bb rsp=ffffc80f3ede2960 rbp=ffffde8d15b96a86
r8=4800000098850f00 r9=ffffde8d15b96a85 r10=00000000000004e3
r11=ffffde8d15b96fd8 r12=ffffde8d15b96fd8 r13=ffffde8d15b95000
r14=0000000000020000 r15=ffffde8d15a2d000
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!RtlCompressBufferXpressHuffStandard+0x19b:
fffff801`4b7171bb 413810 cmp byte ptr [r8],dl ds:002b:48000000`98850f00=??
Resetting default scope
CPU_COUNT: 8
CPU_MHZ: 10ef
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 2
CPU_STEPPING: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
FOLLOWUP_IP:
Wof!FileProvCompressWorkItem+72
fffff801`50be0902 3d17010000 cmp eax,117h
BUGCHECK_STR: AV
READ_ADDRESS: fffff8014b9733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-18-2019 17:31:59.0468
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff8014b7168a1 to fffff8014b7171bb
STACK_TEXT:
ffffc80f`3ede2960 fffff801`4b7168a1 : ffffde8d`15b95000 ffffde8d`15a55a5f ffffde8d`15a55a5f fffff801`50be09e3 : nt!RtlCompressBufferXpressHuffStandard+0x19b
ffffc80f`3ede2a60 fffff801`4b522a9f : ffffcd88`ac1085c4 00000000`00000000 ffffcd88`aa373040 fffff801`4b4bd96c : nt!RtlCompressBufferXpressHuff+0x61
ffffc80f`3ede2ac0 fffff801`50be0902 : 00000000`00000000 fffff801`4b98f240 ffffcd88`ac108788 00000000`00000000 : nt!RtlCompressBuffer+0x6f
ffffc80f`3ede2b20 fffff801`4b4bd4b5 : ffffcd88`aa373040 ffffcd88`9e6612a0 00000000`00000a00 ffffc80f`3ddaaa90 : Wof!FileProvCompressWorkItem+0x72
ffffc80f`3ede2b70 fffff801`4b52a7a5 : ffffcd88`aa373040 00000000`00000080 ffffcd88`9e680300 00000224`acbb3dfe : nt!ExpWorkerThread+0x105
ffffc80f`3ede2c10 fffff801`4b5c8b2a : ffffaa80`35440180 ffffcd88`aa373040 fffff801`4b52a750 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffc80f`3ede2c60 00000000`00000000 : ffffc80f`3ede3000 ffffc80f`3eddd000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a
THREAD_SHA1_HASH_MOD_FUNC: 8eff0922bab3848019bec19e9d6c1232e7591e53
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: b6d4666f6cbf5b605cc28fc1db0c7a8320f83d9a
THREAD_SHA1_HASH_MOD: fb27484ed35b8f178798b5cd9ff5e9e8555a0b61
FAULT_INSTR_CODE: 1173d
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: Wof!FileProvCompressWorkItem+72
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Wof
IMAGE_NAME: Wof.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .cxr 0xffffc80f3ede1f70 ; kb
BUCKET_ID_FUNC_OFFSET: 72
FAILURE_BUCKET_ID: AV_Wof!FileProvCompressWorkItem
BUCKET_ID: AV_Wof!FileProvCompressWorkItem
PRIMARY_PROBLEM_CLASS: AV_Wof!FileProvCompressWorkItem
TARGET_TIME: 2019-12-16T15:21:43.000Z
OSBUILD: 18362
OSSERVICEPACK: 476
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2011-12-30 02:28:41
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 691b
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_wof!fileprovcompressworkitem
FAILURE_ID_HASH: {338de1a7-22ee-9aa6-796c-0520688fc10d}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80132605e4e, The address that the exception occurred at
Arg3: ffff85040a1e6f68, Exception Record Address
Arg4: ffff908069c98930, Context Record Address
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: To be filled by O.E.M.
SYSTEM_PRODUCT_NAME: To be filled by O.E.M.
SYSTEM_SKU: SKU
SYSTEM_VERSION: To be filled by O.E.M.
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 2603
BIOS_DATE: 06/26/2015
BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.
BASEBOARD_PRODUCT: M5A97 R2.0
BASEBOARD_VERSION: Rev 1.xx
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff80132605e4e
BUGCHECK_P3: ffff85040a1e6f68
BUGCHECK_P4: ffff908069c98930
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!KxWaitForLockOwnerShip+e
fffff801`32605e4e 48890a mov qword ptr [rdx],rcx
EXCEPTION_RECORD: ffff85040a1e6f68 -- (.exr 0xffff85040a1e6f68)
ExceptionAddress: fffff80132605e4e (nt!KxWaitForLockOwnerShip+0x000000000000000e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffff908069c98930 -- (.cxr 0xffff908069c98930)
rax=0000000000000003 rbx=ffff85040a1e71f0 rcx=ffff85040a1e71f0
rdx=0008000000000000 rsi=fffff80132a68d80 rdi=0000000000000000
rip=fffff80132605e4e rsp=ffff85040a1e71a0 rbp=ffff85040a1e7240
r8=0000000000000001 r9=0000000000000000 r10=ffffb7dbedf6f000
r11=ffffb7dbedf6f7f8 r12=0000000000000001 r13=0000000000000000
r14=ffffcf0fc004a000 r15=0000000000000001
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!KxWaitForLockOwnerShip+0xe:
fffff801`32605e4e 48890a mov qword ptr [rdx],rcx ds:002b:00080000`00000000=????????????????
Resetting default scope
CPU_COUNT: 8
CPU_MHZ: 10ef
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 2
CPU_STEPPING: 0
BLACKBOXNTFS: 1 (!blackboxntfs)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
FOLLOWUP_IP:
nt!ExFreePool+9
fffff801`3296f0a9 4883c428 add rsp,28h
BUGCHECK_STR: AV
READ_ADDRESS: fffff80132b733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-18-2019 17:32:08.0359
ANALYSIS_VERSION: 10.0.18362.1 x86fre
BAD_STACK_POINTER: ffff908069c980c8
LAST_CONTROL_TRANSFER: from fffff801326b01f9 to fffff80132605e4e
STACK_TEXT:
ffff8504`0a1e71a0 fffff801`326b01f9 : ffff8d80`00007000 fffff801`32a6acc0 00000000`00000000 00000000`00000000 : nt!KxWaitForLockOwnerShip+0xe
ffff8504`0a1e71d0 fffff801`326aea4c : ffff8a80`01f92960 fffff801`32612d89 00000000`00000000 fffff801`32a68c80 : nt!MiRemoveWsle+0x539
ffff8504`0a1e7280 fffff801`3261bca0 : fffff801`32a68c80 ffff8504`0a1e7430 ffffcf0f`c004a000 00000000`00000000 : nt!MiTerminateWsle+0x18c
ffff8504`0a1e7330 fffff801`32657ab2 : 00000000`00000001 fffff801`326420ba ffffbc81`ba34e3a0 00000000`00000100 : nt!MiDeleteSystemPagableVm+0x260
ffff8504`0a1e7500 fffff801`3265798a : 00000000`00000000 ffff8504`0a1e76a1 ffffcf0f`bee001c0 ffffbc81`bf28a5e0 : nt!MmFreePoolMemory+0xf6
ffff8504`0a1e7590 fffff801`3265791e : ffffbc81`ba34e080 ffffffff`ffffffff ffffbc81`bf28a560 00000000`00000000 : nt!RtlpHpEnvFreeVA+0x12
ffff8504`0a1e75c0 fffff801`326104c7 : 00000000`00000001 ffffbc81`bf28a560 00000000`00000000 00000000`00000001 : nt!RtlpHpFreeVA+0x3a
ffff8504`0a1e7600 fffff801`326e7868 : ffffcf0f`c0000000 ffffcf0f`c0000000 ffffcf0f`bee001c0 00000000`00000000 : nt!RtlpHpSegMgrCommit+0x207
ffff8504`0a1e76f0 fffff801`326e735d : ffffcf0f`00007fff ffffcf0f`00000002 00000000`00000000 00000000`00000100 : nt!RtlpHpSegPageRangeCommit+0x124
ffff8504`0a1e7780 fffff801`326e6cae : ffffcf0f`00000000 00000000`00000000 ffffcf0f`c0000020 00000000`00000000 : nt!RtlpHpSegPageRangeCoalesce+0x22d
ffff8504`0a1e7800 fffff801`326462d1 : ffffcf0f`c0010000 00000000`09e1f800 00000000`c00000ff 00000000`00000000 : nt!RtlpHpSegPageRangeShrink+0x12e
ffff8504`0a1e7890 fffff801`3296f0a9 : 00000000`00000010 00000000`00000082 ffff8504`0a1e79d8 01000000`00100000 : nt!ExFreeHeapPool+0x751
ffff8504`0a1e79b0 fffff801`32cb66cc : ffffffff`ffffff00 ffff8504`0a1e7a59 ffffffff`ffffff00 00000000`00000000 : nt!ExFreePool+0x9
ffff8504`0a1e79e0 fffff801`32cb63b3 : ffffffff`ffffff00 ffffffff`ffffffff ffffffff`800004f8 ffffbc81`ba34a9c0 : nt!EtwpUpdateFileHeader+0x164
ffff8504`0a1e7ac0 fffff801`32c1461d : ffffbc81`ba34a9c0 ffffbc81`ba34a9c0 ffffffff`ffffff01 00000000`00000000 : nt!EtwpCreateLogFile+0x17f
ffff8504`0a1e7b90 fffff801`3272a7a5 : ffffffff`fffffffd ffffbc81`ba34e080 00000000`00000080 fffff801`32c14290 : nt!EtwpLogger+0x38d
ffff8504`0a1e7c10 fffff801`327c8b2a : fffff801`2f864180 ffffbc81`ba34e080 fffff801`3272a750 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff8504`0a1e7c60 00000000`00000000 : ffff8504`0a1e8000 ffff8504`0a1e2000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a
THREAD_SHA1_HASH_MOD_FUNC: 409492392bd615e9c4bc29d594e578113ba9d66a
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 7a4413a571856ba7e582e5c34b81f86b70019315
THREAD_SHA1_HASH_MOD: 82d14546c43bd06881f781d6d197c4c7f7ceb9cb
FAULT_INSTR_CODE: 28c48348
SYMBOL_STACK_INDEX: c
SYMBOL_NAME: nt!ExFreePool+9
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.476
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .cxr 0xffff908069c98930 ; kb
BUCKET_ID_FUNC_OFFSET: 9
FAILURE_BUCKET_ID: AV_STACKPTR_ERROR_nt!ExFreePool
BUCKET_ID: AV_STACKPTR_ERROR_nt!ExFreePool
PRIMARY_PROBLEM_CLASS: AV_STACKPTR_ERROR_nt!ExFreePool
TARGET_TIME: 2019-12-16T14:52:33.000Z
OSBUILD: 18362
OSSERVICEPACK: 476
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2011-12-30 02:28:41
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 423b
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_stackptr_error_nt!exfreepool
FAILURE_ID_HASH: {919f7ad7-7d58-1f73-a4f5-b922adf1cbe9}
Followup: Pool_corruption
---------
