1. Joined : Aug 2016
    Posts : 2
    Windows 10 Pro
       18 Aug 2016 #1

    Friend's desktop BSOD - 0x139 ntkrnlmp.exe


    An online friend of mine has been getting BSODs for half a year now and I asked for the minidump files. Looking at the most recent one (it was the only file he had in his minidumps folder) in WinDBG I get the following:

    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 139, {3, ffffc10069c7f780, ffffc10069c7f6d8, 0}
    
    Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )
    Code:
    kd> !thread
    THREAD ffff960400ac9400  Cid 1bac.4890  Teb: 000000000033b000 Win32Thread: ffff9603feabdac0 RUNNING on processor 2
    Not impersonating
    GetUlongFromAddress: unable to read from fffff8026497c924
    Owning Process            ffff9603efe9e080       Image:         game.bin
    Attached Process          N/A            Image:         N/A
    fffff78000000000: Unable to get shared data
    Wait Start TickCount      14920749     
    Context Switch Count      4852731        IdealProcessor: 1             
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
    UserTime                  00:00:00.000
    KernelTime                00:00:00.000
    Win32 Start Address 0x00000000005023d5
    Stack Init ffffc10069c7fc10 Current ffffc10069c7f900
    Base ffffc10069c80000 Limit ffffc10069c79000 Call 0000000000000000
    Priority 11 BasePriority 8 PriorityDecrement 2 IoPriority 2 PagePriority 5
    Child-SP          RetAddr           : Args to Child                                                           : Call Site
    ffffc100`69c7f458 fffff802`647db129 : 00000000`00000139 00000000`00000003 ffffc100`69c7f780 ffffc100`69c7f6d8 : nt!KeBugCheckEx
    ffffc100`69c7f460 fffff802`647db490 : 00000000`8000e00c 00000000`00000000 ffff2047`f7e2dcfb ffffc100`69c7f830 : nt!KiBugCheckDispatch+0x69
    ffffc100`69c7f5a0 fffff802`647da473 : ffff9603`fe6f7748 00000000`00000001 ffff9603`f944e010 fffff802`64a86b34 : nt!KiFastFailDispatch+0xd0
    ffffc100`69c7f780 fffff802`647f121e : ffff9604`00ac9400 ffff9603`fe6f7700 0012019f`00000000 ffffc100`69c7fb01 : nt!KiRaiseSecurityCheckFailure+0xf3 (TrapFrame @ ffffc100`69c7f780)
    ffffc100`69c7f910 fffff802`646b7ba4 : ffff9603`fa69a370 00000000`00000000 00000000`00000000 00000000`00000003 : nt! ?? ::FNODOBFM::`string'+0x1205e
    ffffc100`69c7f970 fffff802`64b5e6c8 : ffffc100`69c7fa28 00000000`00000000 ffffc100`69c7fb00 00000000`00000003 : nt!KeReleaseSemaphore+0x114
    ffffc100`69c7f9f0 fffff802`647dac93 : ffff9604`00ac9400 00000000`530c7cf0 00000000`00000000 00000000`0033b001 : nt!NtReleaseSemaphore+0x98
    ffffc100`69c7fa80 00000000`530b222c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffc100`69c7fa80)
    00000000`0009ef68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x530b222c
    Code:
    ffffc100`69c7f3b8  fffff807`23aa45b0*** WARNING: Unable to verify timestamp for Wdf01000.sys
    *** ERROR: Module load completed but symbols could not be loaded for Wdf01000.sys
     Wdf01000+0xa45b0
    Code:
    ffffc100`69c7fa48  ffff93b9`3564bddd*** WARNING: Unable to verify timestamp for win32kfull.sys
    *** ERROR: Module load completed but symbols could not be loaded for win32kfull.sys
     win32kfull+0x4bddd
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    KERNEL_SECURITY_CHECK_FAILURE (139)
    A kernel component has corrupted a critical data structure.  The corruption
    could potentially allow a malicious user to gain control of this machine.
    Arguments:
    Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
    Arg2: ffffc10069c7f780, Address of the trap frame for the exception that caused the bugcheck
    Arg3: ffffc10069c7f6d8, Address of the exception record for the exception that caused the bugcheck
    Arg4: 0000000000000000, Reserved
    
    Debugging Details:
    ------------------
    
    
    DUMP_CLASS: 1
    
    DUMP_QUALIFIER: 400
    
    BUILD_VERSION_STRING:  10.0.14393.0 (rs1_release.160715-1616)
    
    SYSTEM_MANUFACTURER:  System manufacturer
    
    SYSTEM_PRODUCT_NAME:  System Product Name
    
    SYSTEM_SKU:  SKU
    
    SYSTEM_VERSION:  System Version
    
    BIOS_VENDOR:  American Megatrends Inc.
    
    BIOS_VERSION:  1801
    
    BIOS_DATE:  03/24/2016
    
    BASEBOARD_MANUFACTURER:  ASUSTeK COMPUTER INC.
    
    BASEBOARD_PRODUCT:  Z170-A
    
    BASEBOARD_VERSION:  Rev 1.xx
    
    DUMP_TYPE:  2
    
    BUGCHECK_P1: 3
    
    BUGCHECK_P2: ffffc10069c7f780
    
    BUGCHECK_P3: ffffc10069c7f6d8
    
    BUGCHECK_P4: 0
    
    TRAP_FRAME:  ffffc10069c7f780 -- (.trap 0xffffc10069c7f780)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=ffff9603ff0c18d8 rbx=0000000000000000 rcx=0000000000000003
    rdx=ffff9603f723e8d8 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff802647f121e rsp=ffffc10069c7f910 rbp=ffffc10054c40180
     r8=0000000000000000  r9=0000000000000000 r10=fffff80264b5e600
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na pe cy
    nt! ?? ::FNODOBFM::`string'+0x1205e:
    fffff802`647f121e cd29            int     29h
    Resetting default scope
    
    EXCEPTION_RECORD:  ffffc10069c7f6d8 -- (.exr 0xffffc10069c7f6d8)
    ExceptionAddress: fffff802647f121e (nt! ?? ::FNODOBFM::`string'+0x000000000001205e)
       ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
      ExceptionFlags: 00000001
    NumberParameters: 1
       Parameter[0]: 0000000000000003
    Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
    
    CPU_COUNT: 4
    
    CPU_MHZ: db0
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 5e
    
    CPU_STEPPING: 3
    
    CPU_MICROCODE: 6,5e,3,0 (F,M,S,R)  SIG: 74'00000000 (cache) 74'00000000 (init)
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  LIST_ENTRY_CORRUPT
    
    BUGCHECK_STR:  0x139
    
    PROCESS_NAME:  game.bin
    
    CURRENT_IRQL:  2
    
    ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
    
    EXCEPTION_CODE_STR:  c0000409
    
    EXCEPTION_PARAMETER1:  0000000000000003
    
    ANALYSIS_SESSION_HOST:  DESKTOP-53APAMQ
    
    ANALYSIS_SESSION_TIME:  08-18-2016 23:47:55.0574
    
    ANALYSIS_VERSION: 10.0.14321.1024 amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff802647db129 to fffff802647cff90
    
    STACK_TEXT:  
    ffffc100`69c7f458 fffff802`647db129 : 00000000`00000139 00000000`00000003 ffffc100`69c7f780 ffffc100`69c7f6d8 : nt!KeBugCheckEx
    ffffc100`69c7f460 fffff802`647db490 : 00000000`8000e00c 00000000`00000000 ffff2047`f7e2dcfb ffffc100`69c7f830 : nt!KiBugCheckDispatch+0x69
    ffffc100`69c7f5a0 fffff802`647da473 : ffff9603`fe6f7748 00000000`00000001 ffff9603`f944e010 fffff802`64a86b34 : nt!KiFastFailDispatch+0xd0
    ffffc100`69c7f780 fffff802`647f121e : ffff9604`00ac9400 ffff9603`fe6f7700 0012019f`00000000 ffffc100`69c7fb01 : nt!KiRaiseSecurityCheckFailure+0xf3
    ffffc100`69c7f910 fffff802`646b7ba4 : ffff9603`fa69a370 00000000`00000000 00000000`00000000 00000000`00000003 : nt! ?? ::FNODOBFM::`string'+0x1205e
    ffffc100`69c7f970 fffff802`64b5e6c8 : ffffc100`69c7fa28 00000000`00000000 ffffc100`69c7fb00 00000000`00000003 : nt!KeReleaseSemaphore+0x114
    ffffc100`69c7f9f0 fffff802`647dac93 : ffff9604`00ac9400 00000000`530c7cf0 00000000`00000000 00000000`0033b001 : nt!NtReleaseSemaphore+0x98
    ffffc100`69c7fa80 00000000`530b222c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0009ef68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x530b222c
    
    
    STACK_COMMAND:  kb
    
    THREAD_SHA1_HASH_MOD_FUNC:  7b1b1b678c193293d57e31051cdfc86482a154c8
    
    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  f1f42a15c3b1873086e7b45d6c7c55af090ccd17
    
    THREAD_SHA1_HASH_MOD:  cb5f414824c2521bcc505eaa03e92fa10922dad8
    
    FOLLOWUP_IP: 
    nt!KiFastFailDispatch+d0
    fffff802`647db490 c644242000      mov     byte ptr [rsp+20h],0
    
    FAULT_INSTR_CODE:  202444c6
    
    SYMBOL_STACK_INDEX:  2
    
    SYMBOL_NAME:  nt!KiFastFailDispatch+d0
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  578998f1
    
    IMAGE_VERSION:  10.0.14393.0
    
    BUCKET_ID_FUNC_OFFSET:  d0
    
    FAILURE_BUCKET_ID:  0x139_3_nt!KiFastFailDispatch
    
    BUCKET_ID:  0x139_3_nt!KiFastFailDispatch
    
    PRIMARY_PROBLEM_CLASS:  0x139_3_nt!KiFastFailDispatch
    
    TARGET_TIME:  2016-08-18T13:54:27.000Z
    
    OSBUILD:  14393
    
    OSSERVICEPACK:  0
    
    SERVICEPACK_NUMBER: 0
    
    OS_REVISION: 0
    
    SUITE_MASK:  272
    
    PRODUCT_TYPE:  1
    
    OSPLATFORM_TYPE:  x64
    
    OSNAME:  Windows 10
    
    OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS
    
    OS_LOCALE:  
    
    USER_LCID:  0
    
    OSBUILD_TIMESTAMP:  2016-07-16 10:16:17
    
    BUILDDATESTAMP_STR:  160715-1616
    
    BUILDLAB_STR:  rs1_release
    
    BUILDOSVER_STR:  10.0.14393.0
    
    ANALYSIS_SESSION_ELAPSED_TIME: 12ffc
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:0x139_3_nt!kifastfaildispatch
    
    FAILURE_ID_HASH:  {36173680-6f08-995f-065a-3d368c996911}
    All drivers are updated according to him.

    Here's the dump I requested from him: Attachment 96815
      My System SpecsSystem Spec


  2. Joined : Sep 2015
    Hellsinki
    Posts : 375
    Windows 10 Home
       19 Aug 2016 #2

    Hello.

    You can recommend to your for friend to do these steps:


    • Use the event log to see if there are higher level events that occur leading up to this stop code.
    • If you recently added hardware to the system, try removing or replacing it. Or check with the manufacturer to see if any patches are available.
    • If new device drivers or system services have been added recently, try removing or updating them. Try to determine what changed in the system that caused the new bug check code to appear.
    • Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. For more information, see Open Event Viewer. Look for critical errors in the system log that occurred in the same time window as the blue screen.
    • Look in Device Manager to see if any devices are marked with the exclamation point (!). Review the events log displayed in driver properties for any faulting driver. Try updating the related driver.
    • Run a virus detection program. Viruses can infect all types of hard disks formatted for Windows, and resulting disk corruption can generate system bug check codes. Make sure the virus detection program checks the Master Boot Record for infections.


    Also in the dump file it says that the process that was running when this BSOD happened was game.bin. Does your friend play an outdated game maybe?
      My System SpecsSystem Spec


  3. Joined : Jun 2015
    Posts : 10,897
    Windows 10 Pro / Windows 10 TP / Windows 8.1 Pro / Windows 7 Pro
       19 Aug 2016 #3

    Hi FizzyBubblech,

    Welcome to the 10forums

    Let your friend try the following to see if system stability improves
    1. Remove all overclocking, RAM, CPU, GPU, while troubleshooting.
    2. Remove Daemon Tools, a program using drivers known for causing instability on Windows.
    3. Remove all ASUS programs while troubleshooting, most of them are known for causing BSODs but we cannot risk the others to be causing problems.
    4. Uninstall Driver Booster 3 and installed drivers (if any)
    5. Check ASUS for BIOS updates
    6. Check the SSD for firmware updates

    Please remove / disable items from the startup in taskmanager
    These programs could interfere with the boot process giving you trouble and increase the boot time.

    warning   Warning
    Programs that claim to update your drivers install either the wrong or corrupted drivers.
    If you have installed any driver with Driver Booster 3, please remove them as it may cause trouble.

    An easy way to get remove these drivers is by using a restore point prior the installation.



    An online friend of mine has been getting BSODs for half a year now
    What has your online friend tried in this half year?
      My System SpecsSystem Spec


  4. Joined : Aug 2016
    Posts : 2
    Windows 10 Pro
       19 Aug 2016 #4

    Hi, and thanks for the replies!

    I just talked to him earlier and I got this:
    1. He has tried turning off overclock, still got BSOD
    2. He's gonna let me know if it still crashes once he removes Daemon
    3. He replaced the processor, motherboard and RAM after he got the crashes and he still gets them. His SSD is also brand new and with a relatively new install of Windows on it
    4. Driver Booster was installed only a few weeks ago and he got crashes way before installing any drivers
    5. NVIDIA driver was cleanly installed
    6. He tried running Twin Sagas (game.bin) again and the BSOD didn't happen, it seems to occur randomly


    To summarize again, he got crashes on his previous system and replaced his processor, RAM, and motherboard along with a new SSD. Crashes still occur, and at random.

    I've suggested removing Daemon and a few drivers and to send to me any new minidumps if he gets another BSOD.

    I'll post it here once I get it, cheers!
      My System SpecsSystem Spec


  5. Joined : Jun 2015
    Posts : 10,897
    Windows 10 Pro / Windows 10 TP / Windows 8.1 Pro / Windows 7 Pro
       19 Aug 2016 #5

    Driver Booster was installed only a few weeks ago and he got crashes way before installing any drivers
    Driver update programs such as Driver Booster can make the current problem worse and add many other problems like
    • system freezes,
    • application errors,
    • performance issues,
    • etc.

    It is why I suggest to remove it and all installed drivers by this program.
      My System SpecsSystem Spec


 


Similar Threads
Thread Forum
BSOD - 0x139 KERNEL_SECURITY_CHECK_FAILURE
Hello, I assembled my desktop several weeks ago, and got several BSOD per day. After a fresh reinstall, I still got problems... Thanks for your help :)
BSOD Crashes and Debugging
BSOD - 0x139 during gaming
Hi! I've had this problem since I bought my PC back in November 2015. Mostly BSODs but can also completely freeze and reboot without any BSOD or dump, the only pattern I can find is that it happens during gaming.
BSOD Crashes and Debugging
Bsod ntkrnlmp.exe
Hi, hoping someone can help me narrow down the exact cause of this blue screen. I believe it is something related to the drivers. When plugging in a video camera drop box displayed a message, after clicking okay this blue screen appeared and the...
BSOD Crashes and Debugging
BSOD because of ntkrnlmp.exe
Hi, my computer keeps on crashing when playing games and WhoCrashed says the problem is to do with ntkrnlmp.exe. I ran the verifier and the dmp and msinfo are below. dmp: Dropbox - 122215-31218-01.dmp msinfo: Dropbox - msinfo.nfo speccy:...
BSOD Crashes and Debugging
BSOD - ntkrnlmp.exe
Experiencing what appears to be random BSOD events. This has been going on for some time now. I've recently switched from Windows 7 to 10, but the problem followed. Bug check points to ntkrnlmp.exe. An internet search has left...
BSOD Crashes and Debugging
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 15:21.
Find Us
Twitter Facebook Google+



Windows 10 Forums