Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\shugo\OneDrive for Business\minidumps\042121-6453-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available WARNING: Whitespace at end of path element Error: Empty Path. WARNING: Whitespace at end of path element Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: WARNING: Whitespace at end of path element Windows 10 Kernel Version 19041 MP (12 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 19041.1.amd64fre.vb_release.191206-1406 Machine Name: Kernel base = 0xfffff805`25600000 PsLoadedModuleList = 0xfffff805`2622a3d0 Debug session time: Wed Apr 21 17:53:36.321 2021 (UTC + 1:00) System Uptime: 0 days 0:00:35.911 Loading Kernel Symbols ............................................................... ................................................................ .............................................. Loading User Symbols Loading unloaded module list .......... For analysis of this file, run !analyze -v 8: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 0000000000000034, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff8052590ae41, address which referenced memory Debugging Details: ------------------ KEY_VALUES_STRING: 1 Key : Analysis.CPU.Sec Value: 7 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on HUGO-XPS13 Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 8 Key : Analysis.Memory.CommitPeak.Mb Value: 97 Key : Analysis.System Value: CreateObject BUGCHECK_CODE: a BUGCHECK_P1: 34 BUGCHECK_P2: 2 BUGCHECK_P3: 0 BUGCHECK_P4: fffff8052590ae41 READ_ADDRESS: fffff805262fb390: Unable to get MiVisibleState Unable to get NonPagedPoolStart Unable to get NonPagedPoolEnd Unable to get PagedPoolStart Unable to get PagedPoolEnd fffff8052620f368: Unable to get Flags value from nt!KdVersionBlock fffff8052620f368: Unable to get Flags value from nt!KdVersionBlock unable to get nt!MmSpecialPagesInUse 0000000000000034 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: Update.exe TRAP_FRAME: ffff8b0859247340 -- (.trap 0xffff8b0859247340) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=ffff8b08592474f8 rbx=0000000000000000 rcx=ffffb9875843bce0 rdx=ffffdf8b76e39828 rsi=0000000000000000 rdi=0000000000000000 rip=fffff8052590ae41 rsp=ffff8b08592474d0 rbp=0000000000000000 r8=ffff8b08592475d8 r9=ffff8b08592475d4 r10=ffffb75badd6e7f8 r11=ffffb75badd6e000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!MiGetImageProtoProtection+0x51: fffff805`2590ae41 8b4b34 mov ecx,dword ptr [rbx+34h] ds:00000000`00000034=???????? Resetting default scope STACK_TEXT: ffff8b08`592471f8 fffff805`25a07d69 : 00000000`0000000a 00000000`00000034 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx ffff8b08`59247200 fffff805`25a04069 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69 ffff8b08`59247340 fffff805`2590ae41 : 00000000`00000000 ffffb987`586a0700 ffffb75b`80001ce8 ffff8b08`59247680 : nt!KiPageFault+0x469 ffff8b08`592474d0 fffff805`2581ffc8 : 00000000`00000380 00000000`00000000 ffffb700`0039d620 00000000`00000400 : nt!MiGetImageProtoProtection+0x51 ffff8b08`59247500 fffff805`2581e9c5 : 00000000`00000000 00000000`00000000 ffff8b08`592475d8 ffff8b08`592475d4 : nt!MiGetPageProtection+0x6a8 ffff8b08`59247580 fffff805`258a4895 : 00000000`00000004 ffff8b08`59247808 00000000`73a74000 00000000`001fffff : nt!MiQueryAddressState+0x4b5 ffff8b08`59247790 fffff805`25c3524c : ffff8b08`59240000 00000000`00000000 ffffb987`00000005 ffffb987`00000000 : nt!MiQueryAddressSpan+0x175 ffff8b08`59247850 fffff805`25c349f5 : 00000000`00000000 00000000`00000000 00000000`77624660 ffffffff`fffffffe : nt!MmQueryVirtualMemory+0x83c ffff8b08`59247a00 fffff805`25a077b8 : 00000000`00000000 00000000`00000000 00000000`77566d4d ffff8b08`59247aa8 : nt!NtQueryVirtualMemory+0x25 ffff8b08`59247a50 00007ffb`b644d184 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28 00000000`0077e3a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`b644d184 SYMBOL_NAME: nt!MiGetImageProtoProtection+51 MODULE_NAME: nt IMAGE_VERSION: 10.0.19041.928 STACK_COMMAND: .thread ; .cxr ; kb IMAGE_NAME: memory_corruption BUCKET_ID_FUNC_OFFSET: 51 FAILURE_BUCKET_ID: AV_nt!MiGetImageProtoProtection OS_VERSION: 10.0.19041.1 BUILDLAB_STR: vb_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {7b3c290c-72a7-7f7b-53ac-dca820030305} Followup: MachineOwner --------- Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\shugo\OneDrive for Business\minidumps\042121-7531-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available WARNING: Whitespace at end of path element Error: Empty Path. WARNING: Whitespace at end of path element Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: WARNING: Whitespace at end of path element Windows 10 Kernel Version 19041 MP (12 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 19041.1.amd64fre.vb_release.191206-1406 Machine Name: Kernel base = 0xfffff807`30800000 PsLoadedModuleList = 0xfffff807`3142a3d0 Debug session time: Wed Apr 21 16:14:09.468 2021 (UTC + 1:00) System Uptime: 0 days 0:01:29.058 Loading Kernel Symbols ............................................................... ................................................................ ................................................ Loading User Symbols Loading unloaded module list .............. For analysis of this file, run !analyze -v 8: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of the PTE. Parameters 3/4 contain the low/high parts of the PTE. Arg2: fffff93fff95c548 Arg3: 0000000000080000 Arg4: 0000000000000000 Debugging Details: ------------------ KEY_VALUES_STRING: 1 Key : Analysis.CPU.Sec Value: 10 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on HUGO-XPS13 Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 25 Key : Analysis.Memory.CommitPeak.Mb Value: 97 Key : Analysis.System Value: CreateObject BUGCHECK_CODE: 1a BUGCHECK_P1: 41792 BUGCHECK_P2: fffff93fff95c548 BUGCHECK_P3: 80000 BUGCHECK_P4: 0 MEMORY_CORRUPTOR: ONE_BIT BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: Teams.exe STACK_TEXT: ffff9e03`3e7def38 fffff807`30a9d0fa : 00000000`0000001a 00000000`00041792 fffff93f`ff95c548 00000000`00080000 : nt!KeBugCheckEx ffff9e03`3e7def40 fffff807`30a0b9e6 : 00000000`00000000 00000000`00000000 00000000`0000002e fffff93f`ff95c548 : nt!MiDeleteVa+0x153a ffff9e03`3e7df040 fffff807`30a0bafb : fffff97c`00000000 ffffce8a`aa1f19c0 ffff9e03`00000000 ffff9e03`3e7df4b0 : nt!MiWalkPageTablesRecursively+0x776 ffff9e03`3e7df0e0 fffff807`30a0bafb : fffff97c`be4fffe0 ffffce8a`aa1f19c0 ffff9e03`00000001 ffff9e03`3e7df4c0 : nt!MiWalkPageTablesRecursively+0x88b ffff9e03`3e7df180 fffff807`30a0bafb : fffff97c`be4ff000 ffffce8a`aa1f19c0 ffff9e03`00000002 ffff9e03`3e7df4d0 : nt!MiWalkPageTablesRecursively+0x88b ffff9e03`3e7df220 fffff807`30a5de6b : 00000000`00000000 ffffce8a`aa1f19c0 00000000`00000003 ffff9e03`3e7df4e0 : nt!MiWalkPageTablesRecursively+0x88b ffff9e03`3e7df2c0 fffff807`30a9b991 : ffff9e03`3e7df460 ffffce8a`00000000 fffff93f`00000002 00000000`00000000 : nt!MiWalkPageTables+0x36b ffff9e03`3e7df3c0 fffff807`30a6baf0 : 00000000`00000001 ffff9e03`00000000 ffffce8a`aa1f1810 ffffce8a`aa44d080 : nt!MiDeletePagablePteRange+0x4f1 ffff9e03`3e7df6d0 fffff807`30e36189 : ffffce8a`aa2859e0 00000000`00000000 ffffce8a`00000000 ffffce8a`00000000 : nt!MiDeleteVad+0x360 ffff9e03`3e7df7e0 fffff807`30e35820 : ffffce8a`aa2859e0 ffffce8a`a79ce010 ffffce8a`aa44d080 00000000`00000000 : nt!MiUnmapVad+0x49 ffff9e03`3e7df810 fffff807`30e33aef : ffffce8a`aa285260 ffffce8a`aa285260 ffffce8a`aa2859e0 ffffce8a`aa1f1340 : nt!MiCleanVad+0x30 ffff9e03`3e7df840 fffff807`30e5dbd4 : ffffffff`00000000 ffffffff`ffffffff 00000000`00000001 ffffce8a`aa1f1340 : nt!MmCleanProcessAddressSpace+0x137 ffff9e03`3e7df8c0 fffff807`30f06a96 : ffffce8a`aa1f1340 ffff820d`563f3060 00000000`00000000 00000000`00000000 : nt!PspRundownSingleProcess+0x20c ffff9e03`3e7df950 fffff807`30f09f8e : ffffce8a`00000000 00000000`00000001 00000000`00000000 000000e0`1bb90000 : nt!PspExitThread+0x5f6 ffff9e03`3e7dfa50 fffff807`30c077b8 : ffffce8a`aa1f1340 ffffce8a`aa44d080 ffff9e03`3e7dfb40 ffff9e03`3e7dfb40 : nt!NtTerminateProcess+0xde ffff9e03`3e7dfac0 00007fff`402ed2a4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28 000000e0`1bcffb48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`402ed2a4 SYMBOL_NAME: ONE_BIT MODULE_NAME: hardware IMAGE_NAME: memory_corruption STACK_COMMAND: .thread ; .cxr ; kb FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT OS_VERSION: 10.0.19041.1 BUILDLAB_STR: vb_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7} Followup: MachineOwner --------- Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\shugo\OneDrive for Business\minidumps\042121-7781-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available WARNING: Whitespace at end of path element Error: Empty Path. WARNING: Whitespace at end of path element Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: WARNING: Whitespace at end of path element Windows 10 Kernel Version 19041 MP (12 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 19041.1.amd64fre.vb_release.191206-1406 Machine Name: Kernel base = 0xfffff801`6bc00000 PsLoadedModuleList = 0xfffff801`6c82a3d0 Debug session time: Wed Apr 21 16:12:16.859 2021 (UTC + 1:00) System Uptime: 0 days 0:00:51.450 Loading Kernel Symbols ............................................................... ................................................................ ................................................ Loading User Symbols Loading unloaded module list .......... For analysis of this file, run !analyze -v 8: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2 contains the address of the PFN for the corrupted page table page. On a 32 bit OS, parameter 2 contains a pointer to the number of used PTEs, and parameter 3 contains the number of used PTEs. Arg2: ffffa18003a2f810 Arg3: 000000000000004d Arg4: 000000000000004e Debugging Details: ------------------ KEY_VALUES_STRING: 1 Key : Analysis.CPU.Sec Value: 7 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on HUGO-XPS13 Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 7 Key : Analysis.Memory.CommitPeak.Mb Value: 98 Key : Analysis.System Value: CreateObject BUGCHECK_CODE: 1a BUGCHECK_P1: 41790 BUGCHECK_P2: ffffa18003a2f810 BUGCHECK_P3: 4d BUGCHECK_P4: 4e BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: WerFault.exe STACK_TEXT: ffff8b09`12f3eb68 fffff801`6c06eb39 : 00000000`0000001a 00000000`00041790 ffffa180`03a2f810 00000000`0000004d : nt!KeBugCheckEx ffff8b09`12f3eb70 fffff801`6bfed8a0 : 00000000`0000004e ffffa180`03b679c0 ffffa180`03a2f810 00000000`00000000 : nt!MiDecreaseUsedPtesCount+0x15d3d9 ffff8b09`12f3ebb0 fffff801`6be9424a : 00000000`0013cd34 80000000`00000000 00000000`00000001 00000000`00000034 : nt!MiReducePteUseCount+0x30 ffff8b09`12f3ebe0 fffff801`6be1d15f : ffff8b09`12f3f010 ffff900f`aa3b9080 00000000`00000000 ffff8b09`12f3f8d0 : nt!MiDeletePteList+0x88a ffff8b09`12f3ecc0 fffff801`6c22f22d : ffff900f`aa3f8080 ffff900f`aa3302b8 ffff900f`00000000 ffff900f`00000000 : nt!MiDecommitPages+0x43f ffff8b09`12f3f890 fffff801`6c22e893 : ffff8b09`12f3fa10 00000000`00000000 ffff8b09`12f3fa10 ffff900f`aa330290 : nt!MiDecommitRegion+0x7d ffff8b09`12f3f910 fffff801`6c22e185 : 00000000`00000000 00000046`42fd9618 00000000`00001000 000001f3`00000004 : nt!MmFreeVirtualMemory+0x6d3 ffff8b09`12f3fa60 fffff801`6c0077b8 : ffff900f`aa3f8080 ffff8b09`00000001 ffff8b09`12f3fb40 ffff8b09`12f3fb40 : nt!NtFreeVirtualMemory+0x95 ffff8b09`12f3fac0 00007ffc`8e74d0e4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28 00000046`42fd9548 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`8e74d0e4 SYMBOL_NAME: nt!MiDecreaseUsedPtesCount+15d3d9 MODULE_NAME: nt IMAGE_VERSION: 10.0.19041.928 STACK_COMMAND: .thread ; .cxr ; kb IMAGE_NAME: memory_corruption BUCKET_ID_FUNC_OFFSET: 15d3d9 FAILURE_BUCKET_ID: 0x1a_41790_nt!MiDecreaseUsedPtesCount OS_VERSION: 10.0.19041.1 BUILDLAB_STR: vb_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {3a4e374b-adfe-575c-a9c4-4050eb1047a4} Followup: MachineOwner --------- Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\shugo\OneDrive for Business\minidumps\042121-7093-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available WARNING: Whitespace at end of path element Error: Empty Path. WARNING: Whitespace at end of path element Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: WARNING: Whitespace at end of path element Windows 10 Kernel Version 19041 MP (12 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 19041.1.amd64fre.vb_release.191206-1406 Machine Name: Kernel base = 0xfffff806`0fe00000 PsLoadedModuleList = 0xfffff806`10a2a3d0 Debug session time: Wed Apr 21 16:05:53.239 2021 (UTC + 1:00) System Uptime: 0 days 0:45:43.829 Loading Kernel Symbols ............................................................... ................................................................ ................................................. Loading User Symbols Loading unloaded module list .................... For analysis of this file, run !analyze -v 5: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc) An attempt was made to execute non-executable memory. The guilty driver is on the stack trace (and is typically the current instruction pointer). When possible, the guilty driver's name (Unicode string) is printed on the bugcheck screen and saved in KiBugCheckDriver. Arguments: Arg1: fffff80611064623, Virtual address for the attempted execute. Arg2: 8000000111b22963, PTE contents. Arg3: ffffea097ecd77a0, (reserved) Arg4: 0000000000000002, (reserved) Debugging Details: ------------------ KEY_VALUES_STRING: 1 Key : Analysis.CPU.Sec Value: 6 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on HUGO-XPS13 Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 7 Key : Analysis.Memory.CommitPeak.Mb Value: 98 Key : Analysis.System Value: CreateObject BUGCHECK_CODE: fc BUGCHECK_P1: fffff80611064623 BUGCHECK_P2: 8000000111b22963 BUGCHECK_P3: ffffea097ecd77a0 BUGCHECK_P4: 2 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: wgc_renderer_host.exe TRAP_FRAME: ffffea097ecd77a0 -- (.trap 0xffffea097ecd77a0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000102 rbx=0000000000000000 rcx=ffffea097ecd79a0 rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80611064623 rsp=ffffea097ecd7930 rbp=ffffea097ecd79c1 r8=0000000100000057 r9=ffffd400c59aa180 r10=0000000000000000 r11=fffff8060fe00000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc fffff806`11064623 d031 sal byte ptr [rcx],1 ds:ffffea09`7ecd79a0=00 Resetting default scope STACK_TEXT: ffffea09`7ecd74b8 fffff806`102719e2 : 00000000`000000fc fffff806`11064623 80000001`11b22963 ffffea09`7ecd77a0 : nt!KeBugCheckEx ffffea09`7ecd74c0 fffff806`1002aed6 : fffff806`11064623 ffffea09`7ecd76c0 fff504bf`00000000 ffff8000`00000000 : nt!MiCheckSystemNxFault+0x1593fa ffffea09`7ecd7500 fffff806`1000c960 : ffff8587`2715b080 00000000`00000011 ffffea09`7ecd7820 00000000`00000000 : nt!MiSystemFault+0x6c6 ffffea09`7ecd7600 fffff806`10203f5e : ffffd400`c5ad8100 ffffce1d`eff92dcf 00000000`00000001 ffff8587`2715b180 : nt!MmAccessFault+0x400 ffffea09`7ecd77a0 fffff806`11064623 : ffff8587`000000dc fffff806`00000000 00000000`00040201 ffff8587`2715b1c0 : nt!KiPageFault+0x35e ffffea09`7ecd7930 ffff8587`000000dc : fffff806`00000000 00000000`00040201 ffff8587`2715b1c0 ffffea09`7ecd79a0 : 0xfffff806`11064623 ffffea09`7ecd7938 fffff806`00000000 : 00000000`00040201 ffff8587`2715b1c0 ffffea09`7ecd79a0 ffff8587`2715b000 : 0xffff8587`000000dc ffffea09`7ecd7940 00000000`00040201 : ffff8587`2715b1c0 ffffea09`7ecd79a0 ffff8587`2715b000 ffff8587`00000000 : 0xfffff806`00000000 ffffea09`7ecd7948 ffff8587`2715b1c0 : ffffea09`7ecd79a0 ffff8587`2715b000 ffff8587`00000000 00000006`6371dd1f : 0x40201 ffffea09`7ecd7950 ffffea09`7ecd79a0 : ffff8587`2715b000 ffff8587`00000000 00000006`6371dd1f 00000000`00000000 : 0xffff8587`2715b1c0 ffffea09`7ecd7958 ffff8587`2715b000 : ffff8587`00000000 00000006`6371dd1f 00000000`00000000 00000000`00000000 : 0xffffea09`7ecd79a0 ffffea09`7ecd7960 ffff8587`00000000 : 00000006`6371dd1f 00000000`00000000 00000000`00000000 00000000`00000001 : 0xffff8587`2715b000 ffffea09`7ecd7968 00000006`6371dd1f : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000001 : 0xffff8587`00000000 ffffea09`7ecd7970 00000000`00000000 : 00000000`00000000 00000000`00000001 00000000`00000001 ffffea09`7ecd7b40 : 0x00000006`6371dd1f SYMBOL_NAME: nt!MiCheckSystemNxFault+1593fa MODULE_NAME: nt IMAGE_VERSION: 10.0.19041.928 STACK_COMMAND: .thread ; .cxr ; kb IMAGE_NAME: memory_corruption BUCKET_ID_FUNC_OFFSET: 1593fa FAILURE_BUCKET_ID: 0xFC_nt!MiCheckSystemNxFault OS_VERSION: 10.0.19041.1 BUILDLAB_STR: vb_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {a6ae5288-6b71-974a-9b09-23f14d998164} Followup: MachineOwner --------- Verbose mode ON. Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\shugo\OneDrive for Business\minidumps\042121-8234-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available WARNING: Whitespace at end of path element Error: Empty Path. WARNING: Whitespace at end of path element Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: WARNING: Whitespace at end of path element Windows 10 Kernel Version 19041 MP (12 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 19041.1.amd64fre.vb_release.191206-1406 Machine Name: Kernel base = 0xfffff801`2ac00000 PsLoadedModuleList = 0xfffff801`2b82a3d0 Debug session time: Wed Apr 21 17:52:36.944 2021 (UTC + 1:00) System Uptime: 0 days 0:00:16.535 Loading Kernel Symbols ............................................................... ................................................................ .............................................. Loading User Symbols Loading unloaded module list ........ For analysis of this file, run !analyze -v 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of the PTE. Parameters 3/4 contain the low/high parts of the PTE. Arg2: ffff87bfff79d408 Arg3: 0000008000000000 Arg4: 0000000000000000 Debugging Details: ------------------ KEY_VALUES_STRING: 1 Key : Analysis.CPU.Sec Value: 9 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on HUGO-XPS13 Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 11 Key : Analysis.Memory.CommitPeak.Mb Value: 96 Key : Analysis.System Value: CreateObject BUGCHECK_CODE: 1a BUGCHECK_P1: 41792 BUGCHECK_P2: ffff87bfff79d408 BUGCHECK_P3: 8000000000 BUGCHECK_P4: 0 MEMORY_CORRUPTOR: ONE_BIT BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: RuntimeBroker.exe STACK_TEXT: fffff981`42e0f0e8 fffff801`2ae9d0fa : 00000000`0000001a 00000000`00041792 ffff87bf`ff79d408 00000080`00000000 : nt!KeBugCheckEx fffff981`42e0f0f0 fffff801`2ae0b9e6 : 00000000`00000000 ffff87c3`dfffbce8 00000000`00000043 ffff87bf`ff79d408 : nt!MiDeleteVa+0x153a fffff981`42e0f1f0 fffff801`2ae0bafb : ffff87c3`00000000 ffffba0f`d095b700 fffff981`00000000 fffff981`42e0f660 : nt!MiWalkPageTablesRecursively+0x776 fffff981`42e0f290 fffff801`2ae0bafb : ffff87c3`e1efffd8 ffffba0f`d095b700 fffff981`00000001 fffff981`42e0f670 : nt!MiWalkPageTablesRecursively+0x88b fffff981`42e0f330 fffff801`2ae0bafb : ffff87c3`e1eff000 ffffba0f`d095b700 fffff981`00000002 fffff981`42e0f680 : nt!MiWalkPageTablesRecursively+0x88b fffff981`42e0f3d0 fffff801`2ae5de6b : 00000000`00000000 ffffba0f`d095b700 00000000`00000003 fffff981`42e0f690 : nt!MiWalkPageTablesRecursively+0x88b fffff981`42e0f470 fffff801`2ae9b991 : fffff981`42e0f610 00000000`00000000 ffff87be`00000002 ffff87c3`00000000 : nt!MiWalkPageTables+0x36b fffff981`42e0f570 fffff801`2ae6baf0 : 00000000`00000001 fffff981`00000000 ffffba0f`d095b550 ffffba0f`d0796040 : nt!MiDeletePagablePteRange+0x4f1 fffff981`42e0f880 fffff801`2b236189 : ffffba0f`d09688a0 00000000`00000000 ffffba0f`00000000 ffffba0f`00000000 : nt!MiDeleteVad+0x360 fffff981`42e0f990 fffff801`2b235820 : ffffba0f`d09688a0 ffffba0f`d08b4ce0 ffffba0f`d0796040 00000000`00000000 : nt!MiUnmapVad+0x49 fffff981`42e0f9c0 fffff801`2b233aef : ffffba0f`d0968580 ffffba0f`d0968580 ffffba0f`d09688a0 ffffba0f`d095b080 : nt!MiCleanVad+0x30 fffff981`42e0f9f0 fffff801`2b25dbd4 : ffffffff`00000000 ffffffff`ffffffff 00000000`00000001 ffffba0f`d095b080 : nt!MmCleanProcessAddressSpace+0x137 fffff981`42e0fa70 fffff801`2b506b92 : fffff801`2b925440 ffffba0f`d095b080 fffff801`2b506b60 00000000`00000200 : nt!PspRundownSingleProcess+0x20c fffff981`42e0fb00 fffff801`2ae25975 : ffffba0f`d0796040 fffff801`2b2d7830 ffffba0f`c4c8fa30 ffffba0f`00000000 : nt!PspProcessRundownWorkerSingle+0x32 fffff981`42e0fb30 fffff801`2af17e85 : ffffba0f`d0796040 00000000`00000080 ffffba0f`c4cc1080 000fe067`b4bbbdff : nt!ExpWorkerThread+0x105 fffff981`42e0fbd0 fffff801`2affd498 : ffffaa00`def80180 ffffba0f`d0796040 fffff801`2af17e30 ff05090c`ff05090c : nt!PspSystemThreadStartup+0x55 fffff981`42e0fc20 00000000`00000000 : fffff981`42e10000 fffff981`42e09000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28 SYMBOL_NAME: ONE_BIT MODULE_NAME: hardware IMAGE_NAME: memory_corruption STACK_COMMAND: .thread ; .cxr ; kb FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT OS_VERSION: 10.0.19041.1 BUILDLAB_STR: vb_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7} Followup: MachineOwner ---------