BSOD caused by HYPERV being turned on

Hi all,
Version 10.0.19044 build 19044
My system has been stable for around 6 months. Maybe a random crash here and there that I have fixed.

I am in need of a VM to compile some code for an app that I have made. I want to compile and update my app on a clean VM each time for security purposes.

Anyway, I enabled virtualisation (no issues).

Enabled Hyper V and went to shops. While i was out for 1 hour I had 2 BSODS..

Both pointing to the same issue exe

I disabled Hyper V and have left Virtualisation on and havent had a bsod in 15 hours.

I completely understand the "dont use hyper V" but at the same time, my comp is pretty good, decent hardware and not riddled with issues... I really want to get this working but what do i focus on.

I've done mem tests and stick tests on the ram... nothing.

V2 Log

Thanks for any advice

one was steelseries, one was generic, and one was splashtop. none for hyper v

Thanks Tom,
I did take a BSOD out of the dir.. maybe i cut instead of copied.

I had 2 bsods relating to ntkrnlmp.exe

This is the 'error' that I'm getting when virtualisation and HyperV are enabled.

gangel77 said:

Thanks Tom,
I did take a BSOD out of the dir.. maybe i cut instead of copied.

I had 2 bsods relating to ntkrnlmp.exe

This is the 'error' that I'm getting when virtualisation and HyperV are enabled.

see below, highlighting is mine

12: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffffd04707077e0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffffd0470707738, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2062

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 5213

Key : Analysis.Init.CPU.mSec
Value: 109

Key : Analysis.Init.Elapsed.mSec
Value: 1845

Key : Analysis.Memory.CommitPeak.Mb
Value: 75

Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY

Key : FailFast.Type
Value: 3

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: 139

BUGCHECK_P1: 3

BUGCHECK_P2: fffffd04707077e0

BUGCHECK_P3: fffffd0470707738

BUGCHECK_P4: 0

TRAP_FRAME: fffffd04707077e0 -- (.trap 0xfffffd04707077e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff9f02aa45b568 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8005fe61281 rsp=fffffd0470707970 rbp=fffffd0470707a01
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=fffff780000003b0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe cy
nt!KeWaitForSingleObject+0x1e4371:
fffff800`5fe61281 cd29 int 29h
Resetting default scope

EXCEPTION_RECORD: fffffd0470707738 -- (.exr 0xfffffd0470707738)
ExceptionAddress: fffff8005fe61281 (nt!KeWaitForSingleObject+0x00000000001e4371)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: SteelSeriesPrism.exe

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000003

EXCEPTION_STR: 0xc0000409

STACK_TEXT:
fffffd04`707074b8 fffff800`5fe0e129 : 00000000`00000139 00000000`00000003 fffffd04`707077e0 fffffd04`70707738 : nt!KeBugCheckEx
fffffd04`707074c0 fffff800`5fe0e690 : ffff9f02`a82101f0 ffff9f02`aa3f2180 00000000`00000005 fffff800`5ff1c63e : nt!KiBugCheckDispatch+0x69
fffffd04`70707600 fffff800`5fe0c65d : ffffd980`19c80100 ffff9f02`a635c080 ffff9f02`aa3f2080 00000000`00000000 : nt!KiFastFailDispatch+0xd0
fffffd04`707077e0 fffff800`5fe61281 : ffff9f02`00000000 fffff800`600931a1 00000000`00040200 ffff9f02`aa3f21c0 : nt!KiRaiseSecurityCheckFailure+0x31d
fffffd04`70707970 fffff800`60094df1 : ffff9f02`aa45b560 00000000`00000006 00000000`00000001 ffff9f02`aa45b900 : nt!KeWaitForSingleObject+0x1e4371
fffffd04`70707a60 fffff800`60094e9a : ffff9f02`aa3f2080 00000000`00000000 00000000`00000000 000000c0`001da000 : nt!ObWaitForSingleObject+0x91
fffffd04`70707ac0 fffff800`5fe0d8f8 : ffff9f02`aa3f2080 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWaitForSingleObject+0x6a
fffffd04`70707b00 00007ff9`e2acd144 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000061`259ff5e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`e2acd144


SYMBOL_NAME: nt!KiFastFailDispatch+d0

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.2604

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: d0

FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYNTHETIC_WATCHDOG_TIMEOUT (1ca)
A system wide watchdog has expired. This indicates that the system
is hung and not processing timer ticks.
Arguments:
Arg1: 0000000029b08316, The time since the watchdog was last reset, in interrupt time.
Arg2: 00000008bbb00033, The current interrupt time.
Arg3: 00000008bbb30e66, The current QPC timestamp.
Arg4: 000000000000000c, The index of the clock processor.

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1561

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 2921

Key : Analysis.Init.CPU.mSec
Value: 233

Key : Analysis.Init.Elapsed.mSec
Value: 2130

Key : Analysis.Memory.CommitPeak.Mb
Value: 74

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: 1ca

BUGCHECK_P1: 29b08316

BUGCHECK_P2: 8bbb00033

BUGCHECK_P3: 8bbb30e66

BUGCHECK_P4: c

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

STACK_TEXT:
fffff805`69336c68 fffff805`67cbff8a : 00000000`000001ca 00000000`29b08316 00000008`bbb00033 00000008`bbb30e66 : nt!KeBugCheckEx
fffff805`69336c70 fffff805`67cd03f2 : 00000008`bbb30e66 00000000`00000000 fffff805`68217754 00000000`00200082 : nt!HalpWatchdogCheckPreResetNMI+0xba
fffff805`69336cb0 fffff805`67d0ff99 : 00000000`00000001 00000000`ffffffff fffff805`61f4a180 fffff805`67d22910 : nt!HalpPreprocessNmi+0x12
fffff805`69336ce0 fffff805`67c06f42 : 00000000`00000001 fffff805`69336ef0 00000000`00000000 00000000`00000000 : nt!KiProcessNMI+0xc9
fffff805`69336d30 fffff805`67c06d12 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxNmiInterrupt+0x82
fffff805`69336e70 fffff805`67b8fb0d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiNmiInterrupt+0x212
fffff805`693136b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PpmIdleGuestExecute+0x1d


SYMBOL_NAME: nt!HalpWatchdogCheckPreResetNMI+ba

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.2604

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: ba

FAILURE_BUCKET_ID: 0x1CA_nt!HalpWatchdogCheckPreResetNMI

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {0371e589-7840-c49b-e4a9-68d301678bcf}

Followup: MachineOwner
---------

12: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80230a26ca3, Address of the instruction which caused the bugcheck
Arg3: ffffe18fc1e7cfd0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1875

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 2019

Key : Analysis.Init.CPU.mSec
Value: 46

Key : Analysis.Init.Elapsed.mSec
Value: 2157

Key : Analysis.Memory.CommitPeak.Mb
Value: 72

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: 3b

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff80230a26ca3

BUGCHECK_P3: ffffe18fc1e7cfd0

BUGCHECK_P4: 0

CONTEXT: ffffe18fc1e7cfd0 -- (.cxr 0xffffe18fc1e7cfd0)
rax=00ffff9701bd8610 rbx=ffff9701bd86b730 rcx=00000000001f0003
rdx=0000000000000001 rsi=0000000000000b50 rdi=ffffcf86c9affd40
rip=fffff80230a26ca3 rsp=ffffe18fc1e7d9d0 rbp=00000000001f0003
r8=ffffcf86bbbf9001 r9=fffff80230400000 r10=0000fffff80230ac
r11=ffffabf8a5600000 r12=ffffe18fc1e7db08 r13=0000000000000000
r14=9701bd86b7305c1d r15=ffff9701ad816080
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050202
nt!ObpReferenceObjectByHandleWithTag+0x1a3:
fffff802`30a26ca3 384228 cmp byte ptr [rdx+28h],al ds:002b:00000000`00000029=??
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: strwinclt.exe

STACK_TEXT:
ffffe18f`c1e7d9d0 fffff802`30a26aee : ffff9701`c08020c0 00000000`00000002 00000000`00000001 fffff802`30617301 : nt!ObpReferenceObjectByHandleWithTag+0x1a3
ffffe18f`c1e7da60 fffff802`30acb5c0 : 00000000`0e67f99c fffff802`30a28a2a ffff9701`ad816080 00000000`00000000 : nt!ObReferenceObjectByHandle+0x2e
ffffe18f`c1e7dab0 fffff802`3080d9f8 : ffff9701`ad816080 00000000`00000000 ffffe18f`c1e7db18 ffffe18f`c1e7db80 : nt!NtClearEvent+0x50
ffffe18f`c1e7db00 00000000`77361cfc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`0e57ecd8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77361cfc


SYMBOL_NAME: nt!ObpReferenceObjectByHandleWithTag+1a3

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.2486

STACK_COMMAND: .cxr 0xffffe18fc1e7cfd0 ; kb

BUCKET_ID_FUNC_OFFSET: 1a3

FAILURE_BUCKET_ID: 0x3B_c0000005_nt!ObpReferenceObjectByHandleWithTag

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {3d4819ec-af64-be43-ac98-a6e960db3861}

Followup: MachineOwner
---------

Thanks again Tom, I appreciate you are busy.

Could hyperV be triggering these by using rescources or anything? I havent had these issues ever they go away when virtualisation is off.

I dont even have a remote environment at all, its just turned on as a feature and then dies!

gangel77 said:

Thanks again Tom, I appreciate you are busy.

Could hyperV be triggering these by using rescources or anything? I havent had these issues ever they go away when virtualisation is off.

I dont even have a remote environment at all, its just turned on as a feature and then dies!

try removing steelseries and splashtop and then turn it back on to test