New
#1
windows 10 -bluescreen while updating sysytem
Hello,
I have trouble with system update causing bluescreen when performing update after laptop restart.
I'd like to explain my situation:
I wanted to install windows 10 on my laptop, but when installer prepared files to install, blue screen occoured. Even stranger was the fact that blue screen happened when tried to install win 10/8.1/7 (on clean two different ssd's).
After that I managed to install windows 10 on ssd on different pc, and moved that ssd to laptop. Bluescreen occoured while loading to windows or seconds after logged into system.
System was stable only in safe mode.
Then I installed linux, and it worked without any issues. After using it for few hours I deleted system, and with last hope installed different version of windows.
And to my suprise everything went perfectly fine. From now I installed every single driver from Lenovo support site, with one exeption, Nvidia drivers was not compatible with that version of windows.
As it turned out windows which I installed is version 1507 (build number 10.0.10240)
So, now I would like to update windows, but when it happens I'm getting
KERNEL_SECURITY_CHECK_FAILURE
-I've tested ram with memtest (8 passes - no errors_
-disabled second gpu in bios
-installed updated drivers (bios included)
Here's minidump
Code:Microsoft (R) Windows Debugger Version 10.0.19041.685 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\laptop\Desktop\MEMORY.DMP] Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available. Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 10240 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 10240.16384.amd64fre.th1.150709-1700 Machine Name: Kernel base = 0xfffff802`d4412000 PsLoadedModuleList = 0xfffff802`d4736f30 Debug session time: Mon Mar 29 11:16:14.485 2021 (UTC + 2:00) System Uptime: 0 days 0:00:02.403 Loading Kernel Symbols ............................................................... ................................................. Loading User Symbols For analysis of this file, run !analyze -v 1: kd> !analyze ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_SECURITY_CHECK_FAILURE (139) A kernel component has corrupted a critical data structure. The corruption could potentially allow a malicious user to gain control of this machine. Arguments: Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove). Arg2: ffffd0017ad04380, Address of the trap frame for the exception that caused the bugcheck Arg3: ffffd0017ad042d8, Address of the exception record for the exception that caused the bugcheck Arg4: 0000000000000000, Reserved Debugging Details: ------------------ BUGCHECK_CODE: 139 BUGCHECK_P1: 3 BUGCHECK_P2: ffffd0017ad04380 BUGCHECK_P3: ffffd0017ad042d8 BUGCHECK_P4: 0 PROCESS_NAME: System ERROR_CODE: (NTSTATUS) 0xc0000409 - System wykry w tej aplikacji przekroczenie buforu opartego na stosie. Przekroczenie mo e umo liwi z o liwemu u ytkownikowi uzyskanie kontroli nad t aplikacj . SYMBOL_NAME: nt!KiFastFailDispatch+d0 MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851} Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_SECURITY_CHECK_FAILURE (139) A kernel component has corrupted a critical data structure. The corruption could potentially allow a malicious user to gain control of this machine. Arguments: Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove). Arg2: ffffd0017ad04380, Address of the trap frame for the exception that caused the bugcheck Arg3: ffffd0017ad042d8, Address of the exception record for the exception that caused the bugcheck Arg4: 0000000000000000, Reserved Debugging Details: ------------------ KEY_VALUES_STRING: 1 Key : Analysis.CPU.Sec Value: 2 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on DESKTOP-6C8LHMF Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 2 Key : Analysis.Memory.CommitPeak.Mb Value: 55 Key : Analysis.System Value: CreateObject BUGCHECK_CODE: 139 BUGCHECK_P1: 3 BUGCHECK_P2: ffffd0017ad04380 BUGCHECK_P3: ffffd0017ad042d8 BUGCHECK_P4: 0 TRAP_FRAME: ffffd0017ad04380 -- (.trap 0xffffd0017ad04380) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=ffffc001a78e2290 rbx=0000000000000000 rcx=0000000000000003 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff801e917e3ad rsp=ffffd0017ad04510 rbp=ffffd0017ad04cc0 r8=0000000000000000 r9=0000000000000000 r10=fffff801e91c5e40 r11=000000000000000f r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na po cy NTFS!NtfsLookupRealAllocation+0x19b1d: fffff801`e917e3ad cd29 int 29h Resetting default scope EXCEPTION_RECORD: ffffd0017ad042d8 -- (.exr 0xffffd0017ad042d8) ExceptionAddress: fffff801e917e3ad (NTFS!NtfsLookupRealAllocation+0x0000000000019b1d) ExceptionCode: c0000409 (Security check failure or stack buffer overrun) ExceptionFlags: 00000001 NumberParameters: 1 Parameter[0]: 0000000000000003 Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY PROCESS_NAME: System ERROR_CODE: (NTSTATUS) 0xc0000409 - System wykry w tej aplikacji przekroczenie buforu opartego na stosie. Przekroczenie mo e umo liwi z o liwemu u ytkownikowi uzyskanie kontroli nad t aplikacj . EXCEPTION_CODE_STR: c0000409 EXCEPTION_PARAMETER1: 0000000000000003 DEVICE_OBJECT: ffffffff80000054 EXCEPTION_STR: 0xc0000409 STACK_TEXT: ffffd001`7ad04058 fffff802`d45695a9 : 00000000`00000139 00000000`00000003 ffffd001`7ad04380 ffffd001`7ad042d8 : nt!KeBugCheckEx ffffd001`7ad04060 fffff802`d45698d0 : 48038b48`00282464 10438b48`0475c085 8d480030`24648348 8948c78b`4c20244c : nt!KiBugCheckDispatch+0x69 ffffd001`7ad041a0 fffff802`d4568af4 : 00000000`00000000 00000000`00000001 00000000`00000001 ffffe001`693f4c00 : nt!KiFastFailDispatch+0xd0 ffffd001`7ad04380 fffff801`e917e3ad : ffffc001`a6d83c80 ffffd001`7ad04cc0 00000000`0000002b ffffc001`a6d83b40 : nt!KiRaiseSecurityCheckFailure+0xf4 ffffd001`7ad04510 fffff801`e916462b : ffffd001`7ad04cc0 ffffc001`a6d83b40 00000000`0000002b ffffd001`7ad047b0 : NTFS!NtfsLookupRealAllocation+0x19b1d ffffd001`7ad04690 fffff801`e916419a : ffffd001`7ad04cc0 ffffc001`a6d83b40 00000000`0000002b ffffd001`7ad047b0 : NTFS!NtfsLookupAllocation+0x57 ffffd001`7ad04740 fffff801`e91639af : ffffd001`7ad04c00 ffffe001`6b481010 ffffd001`7ad04c00 00000000`0002b000 : NTFS!NtfsPrepareSimpleBuffers+0x17a ffffd001`7ad04810 fffff801`e9162b26 : ffffe001`00000001 ffffd001`7ad048c0 ffffd001`7ad04980 00000000`00000000 : NTFS!NtfsPrepareBuffers+0xbb ffffd001`7ad04880 fffff801`e9160f09 : ffffc001`a6d83b40 00000000`001ad272 00000000`00000090 ffffe001`69112180 : NTFS!NtfsNonCachedIo+0x2f6 ffffd001`7ad04af0 fffff801`e91602f2 : ffffd001`7ad04cc0 ffffe001`6b481010 00000000`00000000 ffffe001`00002cd6 : NTFS!NtfsCommonRead+0x9f9 ffffd001`7ad04c90 fffff801`e95151c4 : ffffe001`6b5e6640 ffffe001`6b481010 ffffe001`6b481010 ffffe001`6b481368 : NTFS!NtfsFsdRead+0x1f2 ffffd001`7ad04f10 fffff801`e9513a16 : 00000000`00000000 fffff802`d47549c0 00000000`00000001 fffffa80`00061560 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2a4 ffffd001`7ad04f90 fffff802`d4443698 : ffffe001`6b596768 ffffe001`6b4c2320 ffffe001`6b4c4cf0 fffff6d8`00d3f158 : FLTMGR!FltpDispatch+0xb6 ffffd001`7ad04ff0 fffff802`d4443914 : ffffe001`6b4c4c10 ffffe001`6b4c4bf0 ffffe001`6b4c4c50 ffffd001`7ad050c0 : nt!IoPageRead+0x258 ffffd001`7ad05050 fffff802`d4441be8 : 00000000`00000002 fffff802`d47549c0 ffffe001`6b4c4bf0 00000000`00000000 : nt!MiIssueHardFaultIo+0xbc ffffd001`7ad050d0 fffff802`d443133d : 00000000`c0033333 fffff802`d47549c0 ffffb001`a7e2b000 fffff802`d4754ab8 : nt!MiIssueHardFault+0x168 ffffd001`7ad05170 fffff802`d4447e5e : ffffffff`ffd10d88 00000000`00000000 00000000`00000000 fffff802`d4c6615c : nt!MmAccessFault+0x39d ffffd001`7ad052c0 fffff802`d4447655 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00001000 : nt!MmCheckCachedPageStates+0x71e ffffd001`7ad05460 fffff802`d48257e7 : ffffc001`00000000 00000000`00000000 ffffd001`7ad05501 00000000`00000001 : nt!CcMapAndRead+0xe5 ffffd001`7ad054c0 fffff801`e921b29c : ffffe001`69252190 ffffc001`a7303cc8 00000000`0002c000 fffff802`00015000 : nt!CcMapData+0x97 ffffd001`7ad05530 fffff801`e921f978 : ffffe001`6b5f0728 ffffc001`a6ef05f0 fffffa80`0104ffd0 fffff802`00000000 : NTFS!ReadIndexBuffer+0xdc ffffd001`7ad055e0 fffff801`e921f3b7 : 3fffffff`ffffffff 00000000`00010000 ffffc001`a6ffe1a0 ffffc001`a6d83e08 : NTFS!FindNextIndexEntry+0x328 ffffd001`7ad056a0 fffff801`e921d57d : ffffe001`6b5f0728 ffffc001`a6d83e08 ffffc001`a6d83b40 00000000`00000001 : NTFS!NtfsContinueIndexEnumeration+0xc7 ffffd001`7ad05750 fffff801`e921fc63 : 00000000`00000000 ffffe001`6b494ad0 ffffd001`7ad05c80 00000000`00000000 : NTFS!NtfsQueryDirectory+0x5bd ffffd001`7ad05b30 fffff801`e921fda7 : 00000000`00000000 ffffe001`6b7d7380 ffffe001`6b7d7301 ffffd001`7ad05c80 : NTFS!NtfsCommonDirectoryControl+0xa3 ffffd001`7ad05b70 fffff801`e95151c4 : ffffe001`6b7d7380 ffffe001`6b7d7380 ffffe001`6b5f0728 ffffd001`7ad05b98 : NTFS!NtfsFsdDirectoryControl+0xb7 ffffd001`7ad05be0 fffff801`e9513a16 : ffffe001`6b30a1c0 ffffd001`7ad05f40 ffffffff`80000001 ffffe001`6b282480 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2a4 ffffd001`7ad05c60 fffff802`d483272b : 00000000`00000002 ffffd001`7ad05d41 ffffe001`6b5be7f0 ffffe001`6b5be704 : FLTMGR!FltpDispatch+0xb6 ffffd001`7ad05cc0 fffff802`d48310ef : ffffffff`80000054 00000000`00000000 00000000`00000000 ffffe001`6b596040 : nt!IopSynchronousServiceTail+0x16b ffffd001`7ad05d90 fffff802`d4569263 : 00000000`00000000 00000000`00000000 0000011b`00000020 00000000`00000000 : nt!NtQueryDirectoryFile+0xcf ffffd001`7ad05e50 fffff802`d4561ab0 : fffff801`e943374e 00000000`00000000 ffffd001`7ad06121 00000000`0000800c : nt!KiSystemServiceCopyEnd+0x13 ffffd001`7ad06058 fffff801`e943374e : 00000000`00000000 ffffd001`7ad06121 00000000`0000800c ffffe001`00000000 : nt!KiServiceLinkage ffffd001`7ad06060 fffff801`e94326de : ffffd001`00000001 00000000`00000001 00000000`00000000 00000000`0000800c : CI!I_ReloadCatalogs+0x15a ffffd001`7ad06180 fffff801`e9432449 : ffffe001`690fb140 00000000`00000020 00000000`63734943 ffffffff`ffffffff : CI!I_FindFileOrHeaderHashInCatalogs+0x1f2 ffffd001`7ad062c0 fffff801`e943b4ae : ffffd001`7ad06474 ffffd001`7ad06480 00000000`c0000225 fffff801`e943208b : CI!MinCrypK_VerifyHashInCatalog+0xe1 ffffd001`7ad06350 fffff801`e9437f2a : 00000000`00000000 00000000`00000000 ffffc001`a6ee3001 ffffd001`00000002 : CI!CiVerifyFileHashInCatalogs+0x12e ffffd001`7ad06420 fffff801`e9438d2d : 00000000`00000000 00000000`00000000 00000000`000eb000 00000000`00000000 : CI!CipFindFileHash+0x152 ffffd001`7ad06530 fffff801`e94388fb : ffffc001`a6ee3000 ffffe001`6b5bcb50 ffffe001`6b5a1780 fffff801`eac00000 : CI!CipValidateFileHash+0x2dd ffffd001`7ad06600 fffff801`e943740b : fffff801`e9438a50 00000000`00000000 00000000`00000000 ffffe001`6b5a1780 : CI!CipValidateImageHash+0x8f ffffd001`7ad066a0 fffff802`d48eda63 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : CI!CiValidateImageHeader+0x47b ffffd001`7ad067f0 fffff802`d48ed6c0 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`000eb000 : nt!SeValidateImageHeader+0x83 ffffd001`7ad06870 fffff802`d4847f7c : ffffd001`7ad06b19 00000000`00000000 ffffd001`7ad06b19 00000000`00000010 : nt!MiValidateSectionCreate+0x2a4 ffffd001`7ad06a40 fffff802`d4820f5b : ffffe001`6b5bcb50 ffffd001`7ad06c0c 00000000`00000c02 ffffe001`6b596040 : nt!MiCreateNewSection+0x330 ffffd001`7ad06b60 fffff802`d4934fb8 : ffffd001`7ad06d98 ffffd001`7ad06f00 00000000`00000001 ffffd001`7ad06d90 : nt!MiCreateSection+0x87b ffffd001`7ad06d30 fffff802`d48c6324 : 00000000`00000000 ffffd001`7ad07a80 00000000`00000100 00000000`00000000 : nt!MmCreateSpecialImageSection+0xac ffffd001`7ad06dd0 fffff802`d4569263 : fffff6fb`5ffe57f0 fffff6bf`fcafedd8 ffff0b95`610b7f4f 00000000`00000000 : nt!NtCreateUserProcess+0x508 ffffd001`7ad07990 00007ff9`5fe340ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 000000a3`fe62e5a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`5fe340ea SYMBOL_NAME: nt!KiFastFailDispatch+d0 MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe IMAGE_VERSION: 10.0.10240.16384 STACK_COMMAND: .thread ; .cxr ; kb BUCKET_ID_FUNC_OFFSET: d0 FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch OS_VERSION: 10.0.10240.16384 BUILDLAB_STR: th1 OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851} Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_SECURITY_CHECK_FAILURE (139) A kernel component has corrupted a critical data structure. The corruption could potentially allow a malicious user to gain control of this machine. Arguments: Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove). Arg2: ffffd0017ad04380, Address of the trap frame for the exception that caused the bugcheck Arg3: ffffd0017ad042d8, Address of the exception record for the exception that caused the bugcheck Arg4: 0000000000000000, Reserved Debugging Details: ------------------ KEY_VALUES_STRING: 1 Key : Analysis.CPU.Sec Value: 2 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on DESKTOP-6C8LHMF Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 2 Key : Analysis.Memory.CommitPeak.Mb Value: 55 Key : Analysis.System Value: CreateObject BUGCHECK_CODE: 139 BUGCHECK_P1: 3 BUGCHECK_P2: ffffd0017ad04380 BUGCHECK_P3: ffffd0017ad042d8 BUGCHECK_P4: 0 TRAP_FRAME: ffffd0017ad04380 -- (.trap 0xffffd0017ad04380) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=ffffc001a78e2290 rbx=0000000000000000 rcx=0000000000000003 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff801e917e3ad rsp=ffffd0017ad04510 rbp=ffffd0017ad04cc0 r8=0000000000000000 r9=0000000000000000 r10=fffff801e91c5e40 r11=000000000000000f r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na po cy NTFS!NtfsLookupRealAllocation+0x19b1d: fffff801`e917e3ad cd29 int 29h Resetting default scope EXCEPTION_RECORD: ffffd0017ad042d8 -- (.exr 0xffffd0017ad042d8) ExceptionAddress: fffff801e917e3ad (NTFS!NtfsLookupRealAllocation+0x0000000000019b1d) ExceptionCode: c0000409 (Security check failure or stack buffer overrun) ExceptionFlags: 00000001 NumberParameters: 1 Parameter[0]: 0000000000000003 Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY PROCESS_NAME: System ERROR_CODE: (NTSTATUS) 0xc0000409 - System wykry w tej aplikacji przekroczenie buforu opartego na stosie. Przekroczenie mo e umo liwi z o liwemu u ytkownikowi uzyskanie kontroli nad t aplikacj . EXCEPTION_CODE_STR: c0000409 EXCEPTION_PARAMETER1: 0000000000000003 DEVICE_OBJECT: ffffffff80000054 EXCEPTION_STR: 0xc0000409 STACK_TEXT: ffffd001`7ad04058 fffff802`d45695a9 : 00000000`00000139 00000000`00000003 ffffd001`7ad04380 ffffd001`7ad042d8 : nt!KeBugCheckEx ffffd001`7ad04060 fffff802`d45698d0 : 48038b48`00282464 10438b48`0475c085 8d480030`24648348 8948c78b`4c20244c : nt!KiBugCheckDispatch+0x69 ffffd001`7ad041a0 fffff802`d4568af4 : 00000000`00000000 00000000`00000001 00000000`00000001 ffffe001`693f4c00 : nt!KiFastFailDispatch+0xd0 ffffd001`7ad04380 fffff801`e917e3ad : ffffc001`a6d83c80 ffffd001`7ad04cc0 00000000`0000002b ffffc001`a6d83b40 : nt!KiRaiseSecurityCheckFailure+0xf4 ffffd001`7ad04510 fffff801`e916462b : ffffd001`7ad04cc0 ffffc001`a6d83b40 00000000`0000002b ffffd001`7ad047b0 : NTFS!NtfsLookupRealAllocation+0x19b1d ffffd001`7ad04690 fffff801`e916419a : ffffd001`7ad04cc0 ffffc001`a6d83b40 00000000`0000002b ffffd001`7ad047b0 : NTFS!NtfsLookupAllocation+0x57 ffffd001`7ad04740 fffff801`e91639af : ffffd001`7ad04c00 ffffe001`6b481010 ffffd001`7ad04c00 00000000`0002b000 : NTFS!NtfsPrepareSimpleBuffers+0x17a ffffd001`7ad04810 fffff801`e9162b26 : ffffe001`00000001 ffffd001`7ad048c0 ffffd001`7ad04980 00000000`00000000 : NTFS!NtfsPrepareBuffers+0xbb ffffd001`7ad04880 fffff801`e9160f09 : ffffc001`a6d83b40 00000000`001ad272 00000000`00000090 ffffe001`69112180 : NTFS!NtfsNonCachedIo+0x2f6 ffffd001`7ad04af0 fffff801`e91602f2 : ffffd001`7ad04cc0 ffffe001`6b481010 00000000`00000000 ffffe001`00002cd6 : NTFS!NtfsCommonRead+0x9f9 ffffd001`7ad04c90 fffff801`e95151c4 : ffffe001`6b5e6640 ffffe001`6b481010 ffffe001`6b481010 ffffe001`6b481368 : NTFS!NtfsFsdRead+0x1f2 ffffd001`7ad04f10 fffff801`e9513a16 : 00000000`00000000 fffff802`d47549c0 00000000`00000001 fffffa80`00061560 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2a4 ffffd001`7ad04f90 fffff802`d4443698 : ffffe001`6b596768 ffffe001`6b4c2320 ffffe001`6b4c4cf0 fffff6d8`00d3f158 : FLTMGR!FltpDispatch+0xb6 ffffd001`7ad04ff0 fffff802`d4443914 : ffffe001`6b4c4c10 ffffe001`6b4c4bf0 ffffe001`6b4c4c50 ffffd001`7ad050c0 : nt!IoPageRead+0x258 ffffd001`7ad05050 fffff802`d4441be8 : 00000000`00000002 fffff802`d47549c0 ffffe001`6b4c4bf0 00000000`00000000 : nt!MiIssueHardFaultIo+0xbc ffffd001`7ad050d0 fffff802`d443133d : 00000000`c0033333 fffff802`d47549c0 ffffb001`a7e2b000 fffff802`d4754ab8 : nt!MiIssueHardFault+0x168 ffffd001`7ad05170 fffff802`d4447e5e : ffffffff`ffd10d88 00000000`00000000 00000000`00000000 fffff802`d4c6615c : nt!MmAccessFault+0x39d ffffd001`7ad052c0 fffff802`d4447655 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00001000 : nt!MmCheckCachedPageStates+0x71e ffffd001`7ad05460 fffff802`d48257e7 : ffffc001`00000000 00000000`00000000 ffffd001`7ad05501 00000000`00000001 : nt!CcMapAndRead+0xe5 ffffd001`7ad054c0 fffff801`e921b29c : ffffe001`69252190 ffffc001`a7303cc8 00000000`0002c000 fffff802`00015000 : nt!CcMapData+0x97 ffffd001`7ad05530 fffff801`e921f978 : ffffe001`6b5f0728 ffffc001`a6ef05f0 fffffa80`0104ffd0 fffff802`00000000 : NTFS!ReadIndexBuffer+0xdc ffffd001`7ad055e0 fffff801`e921f3b7 : 3fffffff`ffffffff 00000000`00010000 ffffc001`a6ffe1a0 ffffc001`a6d83e08 : NTFS!FindNextIndexEntry+0x328 ffffd001`7ad056a0 fffff801`e921d57d : ffffe001`6b5f0728 ffffc001`a6d83e08 ffffc001`a6d83b40 00000000`00000001 : NTFS!NtfsContinueIndexEnumeration+0xc7 ffffd001`7ad05750 fffff801`e921fc63 : 00000000`00000000 ffffe001`6b494ad0 ffffd001`7ad05c80 00000000`00000000 : NTFS!NtfsQueryDirectory+0x5bd ffffd001`7ad05b30 fffff801`e921fda7 : 00000000`00000000 ffffe001`6b7d7380 ffffe001`6b7d7301 ffffd001`7ad05c80 : NTFS!NtfsCommonDirectoryControl+0xa3 ffffd001`7ad05b70 fffff801`e95151c4 : ffffe001`6b7d7380 ffffe001`6b7d7380 ffffe001`6b5f0728 ffffd001`7ad05b98 : NTFS!NtfsFsdDirectoryControl+0xb7 ffffd001`7ad05be0 fffff801`e9513a16 : ffffe001`6b30a1c0 ffffd001`7ad05f40 ffffffff`80000001 ffffe001`6b282480 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2a4 ffffd001`7ad05c60 fffff802`d483272b : 00000000`00000002 ffffd001`7ad05d41 ffffe001`6b5be7f0 ffffe001`6b5be704 : FLTMGR!FltpDispatch+0xb6 ffffd001`7ad05cc0 fffff802`d48310ef : ffffffff`80000054 00000000`00000000 00000000`00000000 ffffe001`6b596040 : nt!IopSynchronousServiceTail+0x16b ffffd001`7ad05d90 fffff802`d4569263 : 00000000`00000000 00000000`00000000 0000011b`00000020 00000000`00000000 : nt!NtQueryDirectoryFile+0xcf ffffd001`7ad05e50 fffff802`d4561ab0 : fffff801`e943374e 00000000`00000000 ffffd001`7ad06121 00000000`0000800c : nt!KiSystemServiceCopyEnd+0x13 ffffd001`7ad06058 fffff801`e943374e : 00000000`00000000 ffffd001`7ad06121 00000000`0000800c ffffe001`00000000 : nt!KiServiceLinkage ffffd001`7ad06060 fffff801`e94326de : ffffd001`00000001 00000000`00000001 00000000`00000000 00000000`0000800c : CI!I_ReloadCatalogs+0x15a ffffd001`7ad06180 fffff801`e9432449 : ffffe001`690fb140 00000000`00000020 00000000`63734943 ffffffff`ffffffff : CI!I_FindFileOrHeaderHashInCatalogs+0x1f2 ffffd001`7ad062c0 fffff801`e943b4ae : ffffd001`7ad06474 ffffd001`7ad06480 00000000`c0000225 fffff801`e943208b : CI!MinCrypK_VerifyHashInCatalog+0xe1 ffffd001`7ad06350 fffff801`e9437f2a : 00000000`00000000 00000000`00000000 ffffc001`a6ee3001 ffffd001`00000002 : CI!CiVerifyFileHashInCatalogs+0x12e ffffd001`7ad06420 fffff801`e9438d2d : 00000000`00000000 00000000`00000000 00000000`000eb000 00000000`00000000 : CI!CipFindFileHash+0x152 ffffd001`7ad06530 fffff801`e94388fb : ffffc001`a6ee3000 ffffe001`6b5bcb50 ffffe001`6b5a1780 fffff801`eac00000 : CI!CipValidateFileHash+0x2dd ffffd001`7ad06600 fffff801`e943740b : fffff801`e9438a50 00000000`00000000 00000000`00000000 ffffe001`6b5a1780 : CI!CipValidateImageHash+0x8f ffffd001`7ad066a0 fffff802`d48eda63 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : CI!CiValidateImageHeader+0x47b ffffd001`7ad067f0 fffff802`d48ed6c0 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`000eb000 : nt!SeValidateImageHeader+0x83 ffffd001`7ad06870 fffff802`d4847f7c : ffffd001`7ad06b19 00000000`00000000 ffffd001`7ad06b19 00000000`00000010 : nt!MiValidateSectionCreate+0x2a4 ffffd001`7ad06a40 fffff802`d4820f5b : ffffe001`6b5bcb50 ffffd001`7ad06c0c 00000000`00000c02 ffffe001`6b596040 : nt!MiCreateNewSection+0x330 ffffd001`7ad06b60 fffff802`d4934fb8 : ffffd001`7ad06d98 ffffd001`7ad06f00 00000000`00000001 ffffd001`7ad06d90 : nt!MiCreateSection+0x87b ffffd001`7ad06d30 fffff802`d48c6324 : 00000000`00000000 ffffd001`7ad07a80 00000000`00000100 00000000`00000000 : nt!MmCreateSpecialImageSection+0xac ffffd001`7ad06dd0 fffff802`d4569263 : fffff6fb`5ffe57f0 fffff6bf`fcafedd8 ffff0b95`610b7f4f 00000000`00000000 : nt!NtCreateUserProcess+0x508 ffffd001`7ad07990 00007ff9`5fe340ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 000000a3`fe62e5a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`5fe340ea SYMBOL_NAME: nt!KiFastFailDispatch+d0 MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe IMAGE_VERSION: 10.0.10240.16384 STACK_COMMAND: .thread ; .cxr ; kb BUCKET_ID_FUNC_OFFSET: d0 FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch OS_VERSION: 10.0.10240.16384 BUILDLAB_STR: th1 OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851} Followup: MachineOwner ---------