Microsoft (R) Windows Debugger Version 10.0.22415.1002 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff802`01c00000 PsLoadedModuleList = 0xfffff802`0282a190
Debug session time: Wed Aug 18 00:13:22.133 2021 (UTC + 2:00)
System Uptime: 0 days 3:45:51.318
Loading Kernel Symbols
...............................................................
................................................................
...........................................................
Loading User Symbols

Loading unloaded module list
......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802`01ff71d0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffae04`a3341640=0000000000000139
5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffae04a3341960, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffffae04a33418b8, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 2218

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 6532

    Key  : Analysis.Init.CPU.mSec
    Value: 436

    Key  : Analysis.Init.Elapsed.mSec
    Value: 120730

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 84

    Key  : FailFast.Name
    Value: CORRUPT_LIST_ENTRY

    Key  : FailFast.Type
    Value: 3

    Key  : Memory.System.Errors.BadPageCount
    Value: 114

    Key  : Memory.System.Errors.ScrubErrors
    Value: 114

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


BUGCHECK_CODE:  139

BUGCHECK_P1: 3

BUGCHECK_P2: ffffae04a3341960

BUGCHECK_P3: ffffae04a33418b8

BUGCHECK_P4: 0

TRAP_FRAME:  ffffae04a3341960 -- (.trap 0xffffae04a3341960)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffb78ffd093a28 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff802020483fa rsp=ffffae04a3341af0 rbp=0000000000000000
 r8=ffffb78ffd093a20  r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac pe cy
nt!KeRemovePriQueue+0x18fcaa:
fffff802`020483fa cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffffae04a33418b8 -- (.exr 0xffffae04a33418b8)
ExceptionAddress: fffff802020483fa (nt!KeRemovePriQueue+0x000000000018fcaa)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

PROCESS_NAME:  System

BAD_PAGES_DETECTED: 72

ERROR_CODE: (NTSTATUS) 0xc0000409 - Il sistema ha rilevato un sovraccarico di un buffer basato su stack in questa applicazione. Il sovraccarico potrebbe consentire a un utente non autorizzato di assumere il controllo dell'applicazione.

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000003

EXCEPTION_STR:  0xc0000409

STACK_TEXT:
ffffae04`a3341638 fffff802`02009169     : 00000000`00000139 00000000`00000003 ffffae04`a3341960 ffffae04`a33418b8 : nt!KeBugCheckEx
ffffae04`a3341640 fffff802`02009590     : ffffb781`05ab8e58 ffffae04`00000002 ffffb781`05ab8e58 fffff802`deadbeef : nt!KiBugCheckDispatch+0x69
ffffae04`a3341780 fffff802`02007923     : 00000000`00000000 00000000`00000000 00000000`00000103 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffae04`a3341960 fffff802`020483fa     : ffffb781`0995a040 fffff802`00000000 00000000`0000000f 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x323
ffffae04`a3341af0 fffff802`01eb84a0     : ffffb781`0995a040 fffff802`01ee5360 ffffb78f`fd093a20 ffffb78f`00000000 : nt!KeRemovePriQueue+0x18fcaa
ffffae04`a3341b70 fffff802`01f55845     : ffffb781`0995a040 00000000`00000080 ffffb78f`fd092040 00000000`00000001 : nt!ExpWorkerThread+0xa0
ffffae04`a3341c10 fffff802`01ffe828     : ffffdf80`b8e40180 ffffb781`0995a040 fffff802`01f557f0 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffae04`a3341c60 00000000`00000000     : ffffae04`a3342000 ffffae04`a333c000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME:  PAGE_NOT_ZERO

MODULE_NAME: hardware

IMAGE_NAME:  hardware_ram

STACK_COMMAND:  .thread ; .cxr ; kb

FAILURE_BUCKET_ID:  PAGE_NOT_ZERO_0x139

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {2d547d65-0fa4-e377-ce77-fe92fd743dbf}

Followup:     MachineOwner
---------

 *** Memory manager detected 114 instance(s) of page corruption, target is likely to have memory corruption.