again


Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\joeyl\Documents\sadface\031019-6828-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 17134 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff801`1721f000 PsLoadedModuleList = 0xfffff801`175cd150
Debug session time: Sun Mar 10 22:15:09.175 2019 (UTC - 4:00)
System Uptime: 0 days 0:38:20.742
Loading Kernel Symbols
...............................................................
................................................................
........................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 139, {3, ffffd9851bf25530, ffffd9851bf25488, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiSwapThread+501 )

Followup:     MachineOwner
---------

10: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffd9851bf25530, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd9851bf25488, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1


STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING:  10.0.17134.590 (WinBuild.160101.0800)

DUMP_FILE_ATTRIBUTES: 0x8
  Kernel Generated Triage Dump

DUMP_TYPE:  2

BUGCHECK_P1: 3

BUGCHECK_P2: ffffd9851bf25530

BUGCHECK_P3: ffffd9851bf25488

BUGCHECK_P4: 0

TRAP_FRAME:  ffffd9851bf25530 -- (.trap 0xffffd9851bf25530)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffb48aa34eea60 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffb48aa773d670 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80117405417 rsp=ffffd9851bf256c0 rbp=ffffd9851bf25808
 r8=0000000000000002  r9=0000000000000000 r10=ffff80012ddb9180
r11=ffffb48aa3ae95e0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!IopCompleteRequest+0x14be87:
fffff801`17405417 cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffffd9851bf25488 -- (.exr 0xffffd9851bf25488)
ExceptionAddress: fffff80117405417 (nt!IopCompleteRequest+0x000000000014be87)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

CPU_COUNT: c

CPU_MHZ: d42

CPU_VENDOR:  AuthenticAMD

CPU_FAMILY: 17

CPU_MODEL: 8

CPU_STEPPING: 2

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0x139

PROCESS_NAME:  nvcontainer.ex

CURRENT_IRQL:  2

DEFAULT_BUCKET_ID:  FAIL_FAST_CORRUPT_LIST_ENTRY

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000003

ANALYSIS_SESSION_HOST:  PC-JOEY

ANALYSIS_SESSION_TIME:  03-10-2019 22:39:50.0870

ANALYSIS_VERSION: 10.0.17763.132 amd64fre

IRP_ADDRESS: ffff80012ddb9108

LAST_CONTROL_TRANSFER:  from fffff801173d9c69 to fffff801173c90c0

STACK_TEXT:
ffffd985`1bf25208 fffff801`173d9c69 : 00000000`00000139 00000000`00000003 ffffd985`1bf25530 ffffd985`1bf25488 : nt!KeBugCheckEx
ffffd985`1bf25210 fffff801`173da010 : 00000000`00000001 00001f80`00730080 00000000`89610038 ffffb48a`a695caa0 : nt!KiBugCheckDispatch+0x69
ffffd985`1bf25350 fffff801`173d861f : ffffb48a`a7058ca0 ffffd985`1bf25b80 ffffffff`ffffff82 fffff801`1724f1b1 : nt!KiFastFailDispatch+0xd0
ffffd985`1bf25530 fffff801`17405417 : ffffb48a`a34eea40 ffffb48a`a7058ca0 ffffb48a`a34eea40 ffffb48a`20206f49 : nt!KiRaiseSecurityCheckFailure+0x2df
ffffd985`1bf256c0 fffff801`172b9161 : ffff8001`2ddb9180 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopCompleteRequest+0x14be87
ffffd985`1bf257b0 fffff801`172b6601 : 00000000`00000100 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x171
ffffd985`1bf25840 fffff801`172b5bbb : 000000ba`a17ff401 00000000`00000000 00000000`00000000 ffffd985`1bf25968 : nt!KiSwapThread+0x501
ffffd985`1bf25910 fffff801`172b52df : 00000000`7457624f 00000000`00000000 00000000`00000000 ffffb48a`a773d1c0 : nt!KiCommitThreadWait+0x13b
ffffd985`1bf259b0 fffff801`1771bd3c : ffffb48a`a5a2dc20 00000000`00000006 00000000`00000001 ffffd985`1bf25b01 : nt!KeWaitForSingleObject+0x1ff
ffffd985`1bf25a90 fffff801`173d9743 : ffffb48a`a773d080 00000000`00000000 00000000`00000000 ffffb48a`a5a2dc20 : nt!NtWaitForSingleObject+0xfc
ffffd985`1bf25b00 00007ff9`fa0daa24 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000ba`a17ff2c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`fa0daa24


THREAD_SHA1_HASH_MOD_FUNC:  6722c55b9b5bd221c77264f9b98cdb63fac30652

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  b0e8983e61cc4e710118674f3c868d55208da690

THREAD_SHA1_HASH_MOD:  b28610981796779b4ac02f58898fde25728a775c

FOLLOWUP_IP:
nt!KiSwapThread+501
fffff801`172b6601 e9e7fdffff      jmp     nt!KiSwapThread+0x2ed (fffff801`172b63ed)

FAULT_INSTR_CODE:  fffde7e9

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  nt!KiSwapThread+501

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5c5a45ab

IMAGE_VERSION:  10.0.17134.590

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  501

FAILURE_BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiSwapThread

BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiSwapThread

PRIMARY_PROBLEM_CLASS:  0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiSwapThread

TARGET_TIME:  2019-03-11T02:15:09.000Z

OSBUILD:  17134

OSSERVICEPACK:  590

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  784

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID:  0

OSBUILD_TIMESTAMP:  2019-02-05 21:25:47

BUILDDATESTAMP_STR:  160101.0800

BUILDLAB_STR:  WinBuild

BUILDOSVER_STR:  10.0.17134.590

ANALYSIS_SESSION_ELAPSED_TIME:  546

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x139_3_corrupt_list_entry_ktimer_list_corruption_nt!kiswapthread

FAILURE_ID_HASH:  {364d2a10-fb5b-e8e9-9b5b-39c85a1b5a41}

Followup:     MachineOwner
---------