Loading Kernel Symbols
...............................................................
................................................................
...........................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000032`0ae2c018). Type ".hh dbgerr001" for details
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: ffff8b3ffcc2f628
Arg3: 0000000000000002
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 671
Key : Analysis.Elapsed.mSec
Value: 723
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 281
Key : Analysis.Init.Elapsed.mSec
Value: 1384
Key : Analysis.Memory.CommitPeak.Mb
Value: 72
Key : Analysis.Version.DbgEng
Value: 10.0.28000.2114
Key : Analysis.Version.Description
Value: 10.2506.23.01 amd64fre
Key : Analysis.Version.Ext
Value: 1.2506.23.1
Key : Bugcheck.Code.LegacyAPI
Value: 0x1a
Key : Bugcheck.Code.TargetModel
Value: 0x1a
Key : Dump.Attributes.AsUlong
Value: 0x8
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Failure.Bucket
Value: MEMORY_CORRUPTION_ONE_BIT
Key : Failure.Hash
Value: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Key : MemoryManagement.PFN
Value: 0x0
Key : WER.System.BIOSRevision
Value: 5.17.0.0
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: ffff8b3ffcc2f628
BUGCHECK_P3: 2
BUGCHECK_P4: 0
FILE_IN_CAB: 100325-9984-01.dmp
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
FAULTING_THREAD: ffffb589ba97d080
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1 (!blackboxwinlogon)
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: TeamViewer.exe
STACK_TEXT:
ffff8182`cd8d7d48 fffff801`410b964a : 00000000`0000001a 00000000`00041792 ffff8b3f`fcc2f628 00000000`00000002 : nt!KeBugCheckEx
ffff8182`cd8d7d50 fffff801`4100c4d6 : 00000000`00000000 00000000`00000000 00000000`0000002f ffff8b3f`fcc2f628 : nt!MiDeleteVa+0x153a
ffff8182`cd8d7e50 fffff801`4100c5eb : ffff8b45`00000000 ffffb589`b6311700 ffff8182`00000000 ffff8182`cd8d82c0 : nt!MiWalkPageTablesRecursively+0x776
ffff8182`cd8d7ef0 fffff801`4100c5eb : ffff8b45`a2cfff30 ffffb589`b6311700 ffff8182`00000001 ffff8182`cd8d82d0 : nt!MiWalkPageTablesRecursively+0x88b
ffff8182`cd8d7f90 fffff801`4100c5eb : ffff8b45`a2cff000 ffffb589`b6311700 ffff8182`00000002 ffff8182`cd8d82e0 : nt!MiWalkPageTablesRecursively+0x88b
ffff8182`cd8d8030 fffff801`410095eb : 00000000`00000000 ffffb589`b6311700 00000000`00000003 ffff8182`cd8d82f0 : nt!MiWalkPageTablesRecursively+0x88b
ffff8182`cd8d80d0 fffff801`410b7ee1 : ffff8182`cd8d8270 ffffb589`00000000 ffffb589`00000002 fffff801`00000000 : nt!MiWalkPageTables+0x36b
ffff8182`cd8d81d0 fffff801`4101c328 : 00000000`00000001 ffffb589`00000000 ffffb589`b6311550 ffffb589`ba97d080 : nt!MiDeletePagablePteRange+0x4f1
ffff8182`cd8d84e0 fffff801`4141e889 : ffffb589`00000000 00000000`00000000 ffffb589`00000000 ffffb589`b6311080 : nt!MiDeleteVad+0x378
ffff8182`cd8d85e0 fffff801`4141ece8 : ffffb589`bbc25560 ffffb589`bc5d6a20 ffffb589`ba97d080 00000000`00000000 : nt!MiUnmapVad+0x49
ffff8182`cd8d8610 fffff801`41438aa3 : ffffb589`bbc257e0 ffffb589`bbc257e0 ffffb589`bbc25560 ffffb589`b6311080 : nt!MiCleanVad+0x30
ffff8182`cd8d8640 fffff801`41404944 : ffffffff`00000000 ffffffff`ffffffff 00000000`00000001 ffffb589`b6311080 : nt!MmCleanProcessAddressSpace+0x137
ffff8182`cd8d86c0 fffff801`414c3bee : ffffb589`b6311080 ffff900b`268ca060 ffff8182`cd8d88e9 00000000`00000000 : nt!PspRundownSingleProcess+0x20c
ffff8182`cd8d8750 fffff801`41488708 : 0000007f`40010004 00000000`00000001 00000000`00000000 00000032`0ae43000 : nt!PspExitThread+0x5f6
ffff8182`cd8d8850 fffff801`4104a6cd : ffff8182`cd8d8aa8 ffff8182`cd8d8b80 ffff8182`cd8d8a68 fffff801`41004540 : nt!KiSchedulerApcTerminate+0x38
ffff8182`cd8d8890 fffff801`41202c10 : 00000000`00000000 ffff8182`cd8d8950 ffff8182`cd8d8b00 00000032`0baffcd8 : nt!KiDeliverApc+0x60d
ffff8182`cd8d8950 fffff801`412115af : ffffb589`ba97d080 00000032`0baffc08 ffff8182`cd8d8aa8 00000032`0baff758 : nt!KiInitiateUserApc+0x70
ffff8182`cd8d8a90 00007ff9`af3ad614 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
00000032`0baffbe8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`af3ad614
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .process /r /p 0xffffb589b6311080; .thread 0xffffb589ba97d080 ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
Loading Kernel Symbols
...............................................................
................................................................
................................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800362c1524, The address that the exception occurred at
Arg3: fffff58fd11b8338, Exception Record Address
Arg4: fffff58fd11b7b70, Context Record Address
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Type
Value: Read
Key : Analysis.CPU.mSec
Value: 671
Key : Analysis.Elapsed.mSec
Value: 729
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 234
Key : Analysis.Init.Elapsed.mSec
Value: 1064
Key : Analysis.Memory.CommitPeak.Mb
Value: 80
Key : Analysis.Version.DbgEng
Value: 10.0.28000.2114
Key : Analysis.Version.Description
Value: 10.2506.23.01 amd64fre
Key : Analysis.Version.Ext
Value: 1.2506.23.1
Key : Bugcheck.Code.LegacyAPI
Value: 0x1000007e
Key : Bugcheck.Code.TargetModel
Value: 0x1000007e
Key : Dump.Attributes.AsUlong
Value: 0x8
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Failure.Bucket
Value: AV_nt!RtlRbRemoveNode
Key : Failure.Exception.Code
Value: 0xc0000005
Key : Failure.Exception.IP.Address
Value: 0xfffff800362c1524
Key : Failure.Exception.IP.Module
Value: nt
Key : Failure.Exception.IP.Offset
Value: 0x2c1524
Key : Failure.Exception.Record
Value: 0xfffff58fd11b8338
Key : Failure.Hash
Value: {9b43c07a-2da2-b63c-46ab-1c788c8a28c1}
Key : WER.System.BIOSRevision
Value: 5.17.0.0
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff800362c1524
BUGCHECK_P3: fffff58fd11b8338
BUGCHECK_P4: fffff58fd11b7b70
FILE_IN_CAB: 100425-7640-01.dmp
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
FAULTING_THREAD: ffffbd885fb3c040
EXCEPTION_RECORD: fffff58fd11b8338 -- (.exr 0xfffff58fd11b8338)
.exr 0xfffff58fd11b8338
ExceptionAddress: fffff800362c1524 (nt!RtlRbRemoveNode+0x00000000000003b4)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000090
Attempt to read from address 0000000000000090
CONTEXT: fffff58fd11b7b70 -- (.cxr 0xfffff58fd11b7b70)
.cxr 0xfffff58fd11b7b70
rax=ffffce81a37ae808 rbx=ffffce8183c00290 rcx=0000000000000000
rdx=ffffce81a37ae888 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800362c1524 rsp=fffff58fd11b8578 rbp=ffffce81a2b4c888
r8=0000000000000080 r9=0000000000000000 r10=0000000000000001
r11=ffffce81a2b4c888 r12=fffff58fd11b8678 r13=ffffce8183c00280
r14=0000000000000000 r15=ffffce81aafc7890
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050246
nt!RtlRbRemoveNode+0x3b4:
fffff800`362c1524 41f6401001 test byte ptr [r8+10h],1 ds:002b:00000000`00000090=??
.cxr
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1 (!blackboxwinlogon)
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff80036cfb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000090
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000090
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
fffff58f`d11b8578 fffff800`362c078d : ffffce81`a44ce000 ffffce81`83c00280 ffffce81`a44d5880 ffffce81`a44d5880 : nt!RtlRbRemoveNode+0x3b4
fffff58f`d11b8590 fffff800`362c0622 : ffff9b01`00000000 00010076`08020006 00000000`00000008 00000000`00000802 : nt!RtlpHpVsFreeChunkRemove+0x2d
fffff58f`d11b85c0 fffff800`362c0818 : fffff58f`d11b86e0 ffffce81`a44ce000 ffffce81`a44d5fe0 00000000`00000265 : nt!RtlpHpVsChunkCoalesce+0xa2
fffff58f`d11b8610 fffff800`362bf207 : fffff58f`d11b86e0 fffff800`00000802 00000000`00000000 00000000`00000000 : nt!RtlpHpVsChunkFree+0x48
fffff58f`d11b8670 fffff800`362bf103 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffce81`83c00280 : nt!RtlpHpVsContextFreeInternal+0xb7
fffff58f`d11b86b0 fffff800`362c1f65 : ffffce81`a44dbfe0 00000000`00000000 ffffce81`83c00280 ffff9b01`12d41440 : nt!RtlpHpVsContextFreeList+0x53
fffff58f`d11b8710 fffff800`362c2914 : ffffe280`0771f3c0 ffffce81`83c00100 00000000`00000000 ffffce81`a44dc000 : nt!RtlpHpVsContextFree+0xd5
fffff58f`d11b8750 fffff800`362c281d : ffffce81`83c00000 ffffce81`a44dd810 fffff58f`d11b88d8 fffff800`00001820 : nt!RtlpHpSegFree+0x84
fffff58f`d11b8790 fffff800`362c2389 : ffffce81`a39db800 ffffce81`83c00000 ffffce81`a44dc000 ffffce81`a44dd810 : nt!RtlpHpFreeHeap+0x8d
fffff58f`d11b87e0 fffff800`369b4149 : ffffbd88`6be96d30 ffffce81`a44dc000 01000000`00100000 00000000`00000000 : nt!ExFreeHeapPool+0x239
fffff58f`d11b88a0 fffff800`36635978 : 00000000`00000302 00000000`000800a1 fffff800`36c50d80 ffffce81`a39db800 : nt!ExFreePool+0x9
fffff58f`d11b88d0 fffff800`3638752d : 00000000`00000001 00000000`00000000 fffff58f`d11b89a0 ffffbd88`6be96bd8 : nt!MiSegmentDelete+0x148
fffff58f`d11b8920 fffff800`363bcef9 : 00000000`00000000 fffff800`00000001 00000000`00000000 00000000`00000000 : nt!MiProcessDereferenceList+0xc1
fffff58f`d11b89e0 fffff800`3635d6e5 : ffffbd88`5fb3c040 ffffbd88`5fb3c040 00000000`00000080 fffff800`363bcdd0 : nt!MiDereferenceSegmentThread+0x129
fffff58f`d11b8c10 fffff800`36406578 : fffff800`33f5a180 ffffbd88`5fb3c040 fffff800`3635d690 00000000`00000000 : nt!PspSystemThreadStartup+0x55
fffff58f`d11b8c60 00000000`00000000 : fffff58f`d11b9000 fffff58f`d11b3000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!RtlRbRemoveNode+3b4
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.6328
STACK_COMMAND: .cxr 0xfffff58fd11b7b70 ; kb
BUCKET_ID_FUNC_OFFSET: 3b4
FAILURE_BUCKET_ID: AV_nt!RtlRbRemoveNode
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {9b43c07a-2da2-b63c-46ab-1c788c8a28c1}
Followup: MachineOwner
---------
Loading Kernel Symbols
...............................................................
................................................................
............................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000058`78f6d018). Type ".hh dbgerr001" for details
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
contains the address of the PFN for the corrupted page table page.
On a 32 bit OS, parameter 2 contains a pointer to the number of used
PTEs, and parameter 3 contains the number of used PTEs.
Arg2: ffffa20015f106b0
Arg3: 000000000000003f
Arg4: 0000000000000040
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 718
Key : Analysis.Elapsed.mSec
Value: 836
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 203
Key : Analysis.Init.Elapsed.mSec
Value: 867
Key : Analysis.Memory.CommitPeak.Mb
Value: 72
Key : Analysis.Version.DbgEng
Value: 10.0.28000.2114
Key : Analysis.Version.Description
Value: 10.2506.23.01 amd64fre
Key : Analysis.Version.Ext
Value: 1.2506.23.1
Key : Bugcheck.Code.LegacyAPI
Value: 0x1a
Key : Bugcheck.Code.TargetModel
Value: 0x1a
Key : Dump.Attributes.AsUlong
Value: 0x8
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Failure.Bucket
Value: 0x1a_41790_nt!MiDeletePteRun
Key : Failure.Hash
Value: {27ce5d5a-97b1-faf0-183f-c86809269d56}
Key : WER.System.BIOSRevision
Value: 5.17.0.0
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41790
BUGCHECK_P2: ffffa20015f106b0
BUGCHECK_P3: 3f
BUGCHECK_P4: 40
FILE_IN_CAB: 100525-7734-01.dmp
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
FAULTING_THREAD: ffffc884f27d62c0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1 (!blackboxwinlogon)
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: msedgewebview2
STACK_TEXT:
ffffbd88`bf4b4c78 fffff805`7d037daa : 00000000`0000001a 00000000`00041790 ffffa200`15f106b0 00000000`0000003f : nt!KeBugCheckEx
ffffbd88`bf4b4c80 fffff805`7d0bb238 : 00000000`00000003 ffffbd88`bf4b5448 fffff1bf`fe5d4000 00000000`00000000 : nt!MiDeletePteRun+0x17da
ffffbd88`bf4b4e90 fffff805`7d00c9cd : 00000000`00000000 ffffc884`eec49700 ffffbd88`bf4b52e0 fffff1bf`fe5d3e38 : nt!MiDeleteVaTail+0x78
ffffbd88`bf4b4ec0 fffff805`7d00c5eb : fffff1f8`00000000 ffffc884`eec49700 ffffbd88`00000000 ffffbd88`bf4b5330 : nt!MiWalkPageTablesRecursively+0xc6d
ffffbd88`bf4b4f60 fffff805`7d00c5eb : fffff1f8`fc6fff90 ffffc884`eec49700 ffffbd88`00000001 ffffbd88`bf4b5340 : nt!MiWalkPageTablesRecursively+0x88b
ffffbd88`bf4b5000 fffff805`7d00c5eb : fffff1f8`fc6ff000 ffffc884`eec49700 ffffbd88`00000002 ffffbd88`bf4b5350 : nt!MiWalkPageTablesRecursively+0x88b
ffffbd88`bf4b50a0 fffff805`7d0095eb : 00000000`00000000 ffffc884`eec49700 00000000`00000003 ffffbd88`bf4b5360 : nt!MiWalkPageTablesRecursively+0x88b
ffffbd88`bf4b5140 fffff805`7d0b7ee1 : ffffbd88`bf4b52e0 ffffc884`00000000 ffffc884`00000002 fffff805`00000000 : nt!MiWalkPageTables+0x36b
ffffbd88`bf4b5240 fffff805`7d01c328 : 00000000`00000001 ffffc884`00000000 ffffc884`eec49550 ffffc884`f27d62c0 : nt!MiDeletePagablePteRange+0x4f1
ffffbd88`bf4b5550 fffff805`7d41e889 : ffffc884`00000000 00000000`00000000 ffffc884`00000000 ffffc884`eec49080 : nt!MiDeleteVad+0x378
ffffbd88`bf4b5650 fffff805`7d41ece8 : ffffc884`eba65070 ffffc884`ed282a20 ffffc884`f27d62c0 00000000`00000000 : nt!MiUnmapVad+0x49
ffffbd88`bf4b5680 fffff805`7d438aa3 : ffffc884`f3534940 ffffc884`f3534940 ffffc884`eba65070 ffffc884`eec49080 : nt!MiCleanVad+0x30
ffffbd88`bf4b56b0 fffff805`7d404944 : ffffffff`00000000 ffffffff`ffffffff 00000000`00000001 ffffc884`eec49080 : nt!MmCleanProcessAddressSpace+0x137
ffffbd88`bf4b5730 fffff805`7d4c3bee : ffffc884`eec49080 ffff8005`e0161360 ffffbd88`bf4b5959 00000000`00000000 : nt!PspRundownSingleProcess+0x20c
ffffbd88`bf4b57c0 fffff805`7d488708 : ffffc884`00000000 fffff805`7d0c6701 00000000`00000001 00000058`78f82000 : nt!PspExitThread+0x5f6
ffffbd88`bf4b58c0 fffff805`7d04a6cd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSchedulerApcTerminate+0x38
ffffbd88`bf4b5900 fffff805`7d202c10 : 00000000`00000000 ffffbd88`bf4b59c0 ffffbd88`bf4b5b00 0000019d`82ba7868 : nt!KiDeliverApc+0x60d
ffffbd88`bf4b59c0 fffff805`7d2115af : ffffc884`f27d62c0 ffffc884`f2e42be0 00000000`00000000 00000000`00000000 : nt!KiInitiateUserApc+0x70
ffffbd88`bf4b5b00 00007ffd`065ad574 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
00000058`78c9fb18 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`065ad574
SYMBOL_NAME: nt!MiDeletePteRun+17da
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.6328
STACK_COMMAND: .process /r /p 0xffffc884eec49080; .thread 0xffffc884f27d62c0 ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 17da
FAILURE_BUCKET_ID: 0x1a_41790_nt!MiDeletePteRun
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {27ce5d5a-97b1-faf0-183f-c86809269d56}
Followup: MachineOwner
---------
Loading Kernel Symbols
...............................................................
................................................................
...............................................................
Loading User Symbols
Loading unloaded module list
....................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8000e6f8345, The address that the exception occurred at
Arg3: ffff9a02478fb0b8, Exception Record Address
Arg4: ffff9a02478fa8f0, Context Record Address
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Type
Value: Read
Key : Analysis.CPU.mSec
Value: 781
Key : Analysis.Elapsed.mSec
Value: 970
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 218
Key : Analysis.Init.Elapsed.mSec
Value: 861
Key : Analysis.Memory.CommitPeak.Mb
Value: 89
Key : Analysis.Version.DbgEng
Value: 10.0.28000.2114
Key : Analysis.Version.Description
Value: 10.2506.23.01 amd64fre
Key : Analysis.Version.Ext
Value: 1.2506.23.1
Key : Bugcheck.Code.LegacyAPI
Value: 0x1000007e
Key : Bugcheck.Code.TargetModel
Value: 0x1000007e
Key : Dump.Attributes.AsUlong
Value: 0x8
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Failure.Bucket
Value: AV_nt!RtlDeleteNoSplay
Key : Failure.Exception.Code
Value: 0xc0000005
Key : Failure.Exception.IP.Address
Value: 0xfffff8000e6f8345
Key : Failure.Exception.IP.Module
Value: nt
Key : Failure.Exception.IP.Offset
Value: 0x2f8345
Key : Failure.Exception.Record
Value: 0xffff9a02478fb0b8
Key : Failure.Hash
Value: {bebce8cf-2824-8195-e433-1ad6c75dc3f0}
Key : WER.System.BIOSRevision
Value: 5.17.0.0
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8000e6f8345
BUGCHECK_P3: ffff9a02478fb0b8
BUGCHECK_P4: ffff9a02478fa8f0
FILE_IN_CAB: 100725-8015-01.dmp
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
FAULTING_THREAD: ffffbe8578d14040
EXCEPTION_RECORD: ffff9a02478fb0b8 -- (.exr 0xffff9a02478fb0b8)
.exr 0xffff9a02478fb0b8
ExceptionAddress: fffff8000e6f8345 (nt!RtlDeleteNoSplay+0x0000000000000035)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffff9a02478fa8f0 -- (.cxr 0xffff9a02478fa8f0)
.cxr 0xffff9a02478fa8f0
rax=ffff8883f9744ef8 rbx=ffff8883f9744ef8 rcx=0000000000000000
rdx=ff7fbe857a622df0 rsi=ffffffffffffffff rdi=ff7fbe857a622df0
rip=fffff8000e6f8345 rsp=ffff9a02478fb2f0 rbp=ffffbe857a622de8
r8=ffffffffffffffff r9=ffffffffffffffff r10=fffff8000e6f8310
r11=ffff8cfb2f400000 r12=0000000000000000 r13=ffff9a02478fb8f0
r14=ffffbe857a622df0 r15=0000000000000706
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050246
nt!RtlDeleteNoSplay+0x35:
fffff800`0e6f8345 48890f mov qword ptr [rdi],rcx ds:002b:ff7fbe85`7a622df0=????????????????
.cxr
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1 (!blackboxwinlogon)
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff8000f0fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
ffff9a02`478fb2f0 fffff800`0ba58b50 : 00000000`00000000 fffff800`0e6cb16e ffffbe85`78d14040 ffffbe85`7a622de8 : nt!RtlDeleteNoSplay+0x35
ffff9a02`478fb320 fffff800`0ba8a5cb : ffffbe85`7a622df0 fffff800`00000000 00000000`00000000 ffffffff`ffffffff : FLTMGR!TreeUnlinkMulti+0x90
ffff9a02`478fb370 fffff800`0ba8ab32 : ffffbe85`7a622de8 00000000`00000705 ffffffff`ffffffff ffffbe85`6c44c718 : FLTMGR!FltpDeleteContextList+0x4b
ffff9a02`478fb3a0 fffff800`0ba8b09a : ffffbe85`7a622da0 ffffbe85`7a622da8 ffffbe85`7a622da0 ffffbe85`7a622da0 : FLTMGR!CleanupStreamListCtrl+0x4a
ffff9a02`478fb3e0 fffff800`0ea68309 : ffff8884`15ffc7f8 ffffbe85`7a622da8 00000000`00000000 ffff9a02`478fb8f0 : FLTMGR!DeleteStreamListCtrlCallback+0xba
ffff9a02`478fb420 fffff800`11f33d8b : ffff8884`15ffc7c0 ffff9a02`478fb568 ffff9a02`478fb8f0 00000000`00000705 : nt!FsRtlTeardownPerStreamContexts+0xc9
ffff9a02`478fb460 fffff800`11f33b16 : ffff8884`15ffc7c0 ffff9a02`478fb8ff ffffbe85`6c4629f8 ffff8884`00000000 : Ntfs!NtfsDeleteScb+0x17b
ffff9a02`478fb500 fffff800`11e19795 : 00000000`00000001 ffff8884`15ffc7c0 ffffbe85`73785650 00000000`00000000 : Ntfs!NtfsRemoveScb+0x66
ffff9a02`478fb560 fffff800`11f338ac : ffff9a02`478fb8f0 00000000`00000000 ffff8884`15ffc660 ffffbe85`6c462100 : Ntfs!NtfsPrepareFcbForRemoval+0x75
ffff9a02`478fb5a0 fffff800`11e18f56 : ffff9a02`478fb8f0 ffff8884`15ffc7c0 ffff8884`15ffcb78 ffff8884`15ffc660 : Ntfs!NtfsTeardownStructures+0x9c
ffff9a02`478fb620 fffff800`11ef5a02 : ffff9a02`478fb8f0 fffff800`11f0a510 00000000`00000000 ffff8884`15ffc600 : Ntfs!NtfsDecrementCloseCounts+0xf6
ffff9a02`478fb680 fffff800`11f0b8b4 : ffff9a02`478fb8f0 ffff8884`15ffc7c0 ffff8884`15ffc660 ffffbe85`6c462180 : Ntfs!NtfsCommonClose+0xac2
ffff9a02`478fb750 fffff800`11f0a598 : 00000000`0000001c fffff800`0f125440 00000000`00000000 00000000`00000000 : Ntfs!NtfsFspCloseInternal+0x244
ffff9a02`478fb8b0 fffff800`0e6418f5 : ffffbe85`78d14040 fffff800`11f0a510 ffffbe85`63943a20 fffff800`00000000 : Ntfs!NtfsFspClose+0x88
ffff9a02`478fbb70 fffff800`0e75d6e5 : ffffbe85`78d14040 00000000`00000080 ffffbe85`638c5080 00000000`00000000 : nt!ExpWorkerThread+0x105
ffff9a02`478fbc10 fffff800`0e806578 : ffff9d01`b8763180 ffffbe85`78d14040 fffff800`0e75d690 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff9a02`478fbc60 00000000`00000000 : ffff9a02`478fc000 ffff9a02`478f6000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!RtlDeleteNoSplay+35
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.6328
STACK_COMMAND: .cxr 0xffff9a02478fa8f0 ; kb
BUCKET_ID_FUNC_OFFSET: 35
FAILURE_BUCKET_ID: AV_nt!RtlDeleteNoSplay
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {bebce8cf-2824-8195-e433-1ad6c75dc3f0}
Followup: MachineOwner
---------
Loading Kernel Symbols
...............................................................
................................................................
.............................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 0000003f`70463018). Type ".hh dbgerr001" for details
Loading unloaded module list
..........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8021ce64a34, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ExceptionRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ContextRecord ***
*** ***
*************************************************************************
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 765
Key : Analysis.Elapsed.mSec
Value: 817
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 250
Key : Analysis.Init.Elapsed.mSec
Value: 891
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : Analysis.Version.DbgEng
Value: 10.0.28000.2114
Key : Analysis.Version.Description
Value: 10.2506.23.01 amd64fre
Key : Analysis.Version.Ext
Value: 1.2506.23.1
Key : Bugcheck.Code.LegacyAPI
Value: 0x1e
Key : Bugcheck.Code.TargetModel
Value: 0x1e
Key : Dump.Attributes.AsUlong
Value: 0x8
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Failure.Bucket
Value: AV_R_nt!ExpAllocateHandleTableEntry
Key : Failure.Exception.IP.Address
Value: 0xfffff8021ce64a34
Key : Failure.Exception.IP.Module
Value: nt
Key : Failure.Exception.IP.Offset
Value: 0x664a34
Key : Failure.Hash
Value: {6b8304f7-d11f-53f4-fe7b-d90fb154d6da}
Key : WER.System.BIOSRevision
Value: 5.17.0.0
BUGCHECK_CODE: 1e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8021ce64a34
BUGCHECK_P3: 0
BUGCHECK_P4: ffffffffffffffff
FILE_IN_CAB: 100825-7390-01.dmp
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
FAULTING_THREAD: ffff9d0ffa5f8540
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: fffff8021d4fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1 (!blackboxwinlogon)
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: dllhost.exe
STACK_TEXT:
fffffb84`62da1e58 fffff802`1cc7f1f3 : 00000000`0000001e ffffffff`c0000005 fffff802`1ce64a34 00000000`00000000 : nt!KeBugCheckEx
fffffb84`62da1e60 fffff802`1cc11eec : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x142ec3
fffffb84`62da2520 fffff802`1cc0d2ef : 00000000`00000000 00000000`00000000 00000000`00000000 fffffb84`62da28e0 : nt!KiExceptionDispatch+0x12c
fffffb84`62da2700 fffff802`1ce64a34 : ffffd607`0924e0c0 ffff9d0f`00000001 000000ab`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x32f
fffffb84`62da2890 fffff802`1ce648d8 : ffff9d0f`00006400 ffff9d0f`f792da40 ffffd607`0924e080 ffff9d0f`fa5f8540 : nt!ExpAllocateHandleTableEntry+0xe4
fffffb84`62da28e0 fffff802`1cec4383 : ffff9d0f`f792da40 00000000`00000000 fffffb84`62da2bc0 ffff9d0f`f792d540 : nt!ExCreateHandleEx+0x78
fffffb84`62da2930 fffff802`1cec1c3a : ffff9d0f`fad21080 fffffb84`62da3870 ffff9d0f`e6293600 fffffb84`62da3300 : nt!PspAllocateThread+0x57b
fffffb84`62da2ac0 fffff802`1cec17f6 : fffffb84`62da3ad8 fffffb84`62da3ae0 fffffb84`62da3ae8 fffffb84`62da3af0 : nt!PspCreateThread+0x22e
fffffb84`62da2d80 fffff802`1cc11508 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffff3f`fe3eea48 : nt!NtCreateThreadEx+0x266
fffffb84`62da3600 fffff802`1cc02360 : fffff802`1ce5c9a6 ffff9d0f`f5298ef8 00000000`00000000 00000000`00000010 : nt!KiSystemServiceCopyEnd+0x28
fffffb84`62da3808 fffff802`1ce5c9a6 : ffff9d0f`f5298ef8 00000000`00000000 00000000`00000010 00000000`00000000 : nt!KiServiceLinkage
fffffb84`62da3810 fffff802`1cadc9a4 : ffff9d0f`f5298cf0 ffff9d0f`f5298cf0 ffff9d0f`f5298cf0 00000000`00000b10 : nt!RtlpCreateUserThreadEx+0x156
fffffb84`62da3950 fffff802`1ca42a61 : 00000000`00000000 fffffb84`62da3a30 ffff9d0f`f5298e28 00000000`00000000 : nt!ExpWorkerFactoryCreateThread+0x10c
fffffb84`62da3a10 fffff802`1ca4274b : ffff9d0f`f5298cf0 fffffb84`62da3ae8 ffff9d0f`f9b62648 ffff9d01`06cedbc0 : nt!ExpWorkerFactoryCheckCreate+0x201
fffffb84`62da3a70 fffff802`1cc11508 : ffff9d0f`fa5f8540 ffff9d0f`00000000 ffff9d0f`f5298cf0 ffff9d0f`00000000 : nt!NtReleaseWorkerFactoryWorker+0x26b
fffffb84`62da3b00 00007ffc`7ebb0304 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000003f`707ff958 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`7ebb0304
SYMBOL_NAME: nt!ExpAllocateHandleTableEntry+e4
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.6328
STACK_COMMAND: .process /r /p 0xffff9d0ffad21080; .thread 0xffff9d0ffa5f8540 ; kb
BUCKET_ID_FUNC_OFFSET: e4
FAILURE_BUCKET_ID: AV_R_nt!ExpAllocateHandleTableEntry
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {6b8304f7-d11f-53f4-fe7b-d90fb154d6da}
Followup: MachineOwner
---------
