S
sagittariusVR
Ever since I installed the Windows 10 1903 update on 6/19/19 my Windows 10 Professional computer started crashing seemingly at random and always displaying constant BSOD. Nearly a year later, my system now seems to have regained its stability thanks to having reported my issue here some time ago and the issue seemingly having been patched.
However, one problem seems to still remain. I still get a BSOD randomly while using my USB TV Tuner device and software. This device used to work perfectly fine before the Windows 1903 update. The BSOD stopCode displayed is always the same:
KERNEL_SECURITY_CHECK_FAILURE (139)
Hopefully the problem can be identified and fixed too in a future Windows patch from the minidumps I am providing. The minidumps can be downloaded as a zip file from the following link (expires in a week): Filebin :: bin 2kf9h3ylqwdasmhg
What follows is what I got from WinDbg (X64) by running an "!analyze -v" command on the latest memory dump (which is included in my upload) of the last BSOD I got:
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 000000000000001e, Type of memory safety violation
Arg2: ffff868c80286b00, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff868c80286a58, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 10.0.18362.720 (WinBuild.160101.0800)
SYSTEM_MANUFACTURER: MSI
SYSTEM_PRODUCT_NAME: MS-7976
SYSTEM_SKU: Default string
SYSTEM_VERSION: 1.0
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 1.L0
BIOS_DATE: 06/28/2018
BASEBOARD_MANUFACTURER: MSI
BASEBOARD_PRODUCT: Z170A GAMING M7 (MS-7976)
BASEBOARD_VERSION: 1.0
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
DUMP_TYPE: 2
BUGCHECK_P1: 1e
BUGCHECK_P2: ffff868c80286b00
BUGCHECK_P3: ffff868c80286a58
BUGCHECK_P4: 0
TRAP_FRAME: ffff868c80286b00 -- (.trap 0xffff868c80286b00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff8c00120a2080 rbx=0000000000000000 rcx=000000000000001e
rdx=fffff804480b0000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8044831738c rsp=ffff868c80286c90 rbp=ffff868c80286d10
r8=0000000000000014 r9=0000000000000000 r10=ffffcc813db45100
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
nt!KiDeferredReadyThread+0x145ccc:
fffff804`4831738c cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff868c80286a58 -- (.exr 0xffff868c80286a58)
ExceptionAddress: fffff8044831738c (nt!KiDeferredReadyThread+0x0000000000145ccc)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000000000000001e
Subcode: 0x1e FAST_FAIL_INVALID_NEXT_THREAD
CPU_COUNT: 8
CPU_MHZ: fa8
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 5e
CPU_STEPPING: 3
CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: C6'00000000 (cache) C6'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: LCore.exe
CURRENT_IRQL: 2
DEFAULT_BUCKET_ID: FAIL_FAST_INVALID_NEXT_THREAD
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 000000000000001e
ANALYSIS_SESSION_HOST: DESKTOP-MAIN
ANALYSIS_SESSION_TIME: 04-08-2020 01:58:08.0530
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff804482841e9 to fffff80448272380
STACK_TEXT:
ffff868c`802867d8 fffff804`482841e9 : 00000000`00000139 00000000`0000001e ffff868c`80286b00 ffff868c`80286a58 : nt!KeBugCheckEx
ffff868c`802867e0 fffff804`48284610 : 00000000`00001000 00000000`00000000 00000000`00000000 00000000`060003ff : nt!KiBugCheckDispatch+0x69
ffff868c`80286920 fffff804`482829a5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffff868c`80286b00 fffff804`4831738c : ffff8c00`000000a9 00000000`00000000 00000000`00040293 fffff804`4817180d : nt!KiRaiseSecurityCheckFailure+0x325
ffff868c`80286c90 fffff804`481d15a3 : ffffcc81`3db45180 00000000`0000000b ffff8c00`13eaf080 fffff804`00000000 : nt!KiDeferredReadyThread+0x145ccc
ffff868c`80286d50 fffff804`481d1385 : ffff8c00`13eae1f0 00000000`00000000 00000000`00000003 ffff8c08`75a5dc18 : nt!KiReadyThread+0x33
ffff868c`80286d80 fffff804`481c14fa : 00000000`00000001 fffff804`00000000 00000000`00000001 00000000`00000001 : nt!KiExitDispatcher+0x105
ffff868c`80286de0 fffff804`481c109a : ffff8c00`00000000 00000000`00000000 00000000`000000fa 00000000`000c9824 : nt!ExpReleaseResourceExclusiveForThreadLite+0x39a
ffff868c`80286ea0 fffff804`48a3168f : 00000000`00000000 fffff804`48a2463b ffff4f5c`6604eee0 00000000`00000018 : nt!ExReleaseResourceAndLeaveCriticalRegion+0x8a
ffff868c`80286f00 ffffadaa`b75d194d : ffffadce`4c3c6a10 00000000`00000000 00000000`00000000 00000000`00000000 : nt!VerifierExReleaseResourceAndLeaveCriticalRegion+0x2f
ffff868c`80286f30 ffffadaa`b73602e1 : 0000042a`00000669 00000000`00000000 00000008`0000000c ffffadce`4c3c6a10 : win32kbase!UserSessionSwitchLeaveCrit+0x5d
ffff868c`80286fb0 ffffadaa`b724efa1 : 00000000`00000002 ffffadce`4c45efe0 00000000`00000000 00000000`00001cff : win32kfull!xxxMsgWaitForMultipleObjectsEx+0x6d
ffff868c`80287060 fffff804`48283c15 : ffff8c00`13eaf080 00000084`4fdaabc8 ffff868c`00000000 00000000`00001cff : win32kfull!NtUserMsgWaitForMultipleObjectsEx+0x3c1
ffff868c`80287990 00007ffd`69ae9a84 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000084`4fdaaba8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`69ae9a84
THREAD_SHA1_HASH_MOD_FUNC: 1ac79891b9db4d4bd13338273c1eee9334bc8320
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 78ce651061ceeff251b6bde82e43fb554ffcddf7
THREAD_SHA1_HASH_MOD: 089f875eb8e26301ebaaf53abd2d2025d55e39fa
FOLLOWUP_IP:
win32kbase!UserSessionSwitchLeaveCrit+5d
ffffadaa`b75d194d 0f1f440000 nop dword ptr [rax+rax]
FAULT_INSTR_CODE: 441f0f
SYMBOL_STACK_INDEX: a
SYMBOL_NAME: win32kbase!UserSessionSwitchLeaveCrit+5d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.719
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 5d
FAILURE_BUCKET_ID: 0x139_1e_INVALID_NEXT_THREAD_win32kbase!UserSessionSwitchLeaveCrit
BUCKET_ID: 0x139_1e_INVALID_NEXT_THREAD_win32kbase!UserSessionSwitchLeaveCrit
PRIMARY_PROBLEM_CLASS: 0x139_1e_INVALID_NEXT_THREAD_win32kbase!UserSessionSwitchLeaveCrit
TARGET_TIME: 2020-04-08T05:35:58.000Z
OSBUILD: 18362
OSSERVICEPACK: 720
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 160101.0800
BUILDLAB_STR: WinBuild
BUILDOSVER_STR: 10.0.18362.720
ANALYSIS_SESSION_ELAPSED_TIME: 750
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_1e_invalid_next_thread_win32kbase!usersessionswitchleavecrit
FAILURE_ID_HASH: {4004f8e5-c772-b0a8-5b89-b65f5cc810d8}
Followup: MachineOwner
---------
Continue reading...
However, one problem seems to still remain. I still get a BSOD randomly while using my USB TV Tuner device and software. This device used to work perfectly fine before the Windows 1903 update. The BSOD stopCode displayed is always the same:
KERNEL_SECURITY_CHECK_FAILURE (139)
Hopefully the problem can be identified and fixed too in a future Windows patch from the minidumps I am providing. The minidumps can be downloaded as a zip file from the following link (expires in a week): Filebin :: bin 2kf9h3ylqwdasmhg
What follows is what I got from WinDbg (X64) by running an "!analyze -v" command on the latest memory dump (which is included in my upload) of the last BSOD I got:
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 000000000000001e, Type of memory safety violation
Arg2: ffff868c80286b00, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff868c80286a58, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 10.0.18362.720 (WinBuild.160101.0800)
SYSTEM_MANUFACTURER: MSI
SYSTEM_PRODUCT_NAME: MS-7976
SYSTEM_SKU: Default string
SYSTEM_VERSION: 1.0
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 1.L0
BIOS_DATE: 06/28/2018
BASEBOARD_MANUFACTURER: MSI
BASEBOARD_PRODUCT: Z170A GAMING M7 (MS-7976)
BASEBOARD_VERSION: 1.0
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
DUMP_TYPE: 2
BUGCHECK_P1: 1e
BUGCHECK_P2: ffff868c80286b00
BUGCHECK_P3: ffff868c80286a58
BUGCHECK_P4: 0
TRAP_FRAME: ffff868c80286b00 -- (.trap 0xffff868c80286b00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff8c00120a2080 rbx=0000000000000000 rcx=000000000000001e
rdx=fffff804480b0000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8044831738c rsp=ffff868c80286c90 rbp=ffff868c80286d10
r8=0000000000000014 r9=0000000000000000 r10=ffffcc813db45100
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
nt!KiDeferredReadyThread+0x145ccc:
fffff804`4831738c cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff868c80286a58 -- (.exr 0xffff868c80286a58)
ExceptionAddress: fffff8044831738c (nt!KiDeferredReadyThread+0x0000000000145ccc)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000000000000001e
Subcode: 0x1e FAST_FAIL_INVALID_NEXT_THREAD
CPU_COUNT: 8
CPU_MHZ: fa8
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 5e
CPU_STEPPING: 3
CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: C6'00000000 (cache) C6'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: LCore.exe
CURRENT_IRQL: 2
DEFAULT_BUCKET_ID: FAIL_FAST_INVALID_NEXT_THREAD
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 000000000000001e
ANALYSIS_SESSION_HOST: DESKTOP-MAIN
ANALYSIS_SESSION_TIME: 04-08-2020 01:58:08.0530
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff804482841e9 to fffff80448272380
STACK_TEXT:
ffff868c`802867d8 fffff804`482841e9 : 00000000`00000139 00000000`0000001e ffff868c`80286b00 ffff868c`80286a58 : nt!KeBugCheckEx
ffff868c`802867e0 fffff804`48284610 : 00000000`00001000 00000000`00000000 00000000`00000000 00000000`060003ff : nt!KiBugCheckDispatch+0x69
ffff868c`80286920 fffff804`482829a5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffff868c`80286b00 fffff804`4831738c : ffff8c00`000000a9 00000000`00000000 00000000`00040293 fffff804`4817180d : nt!KiRaiseSecurityCheckFailure+0x325
ffff868c`80286c90 fffff804`481d15a3 : ffffcc81`3db45180 00000000`0000000b ffff8c00`13eaf080 fffff804`00000000 : nt!KiDeferredReadyThread+0x145ccc
ffff868c`80286d50 fffff804`481d1385 : ffff8c00`13eae1f0 00000000`00000000 00000000`00000003 ffff8c08`75a5dc18 : nt!KiReadyThread+0x33
ffff868c`80286d80 fffff804`481c14fa : 00000000`00000001 fffff804`00000000 00000000`00000001 00000000`00000001 : nt!KiExitDispatcher+0x105
ffff868c`80286de0 fffff804`481c109a : ffff8c00`00000000 00000000`00000000 00000000`000000fa 00000000`000c9824 : nt!ExpReleaseResourceExclusiveForThreadLite+0x39a
ffff868c`80286ea0 fffff804`48a3168f : 00000000`00000000 fffff804`48a2463b ffff4f5c`6604eee0 00000000`00000018 : nt!ExReleaseResourceAndLeaveCriticalRegion+0x8a
ffff868c`80286f00 ffffadaa`b75d194d : ffffadce`4c3c6a10 00000000`00000000 00000000`00000000 00000000`00000000 : nt!VerifierExReleaseResourceAndLeaveCriticalRegion+0x2f
ffff868c`80286f30 ffffadaa`b73602e1 : 0000042a`00000669 00000000`00000000 00000008`0000000c ffffadce`4c3c6a10 : win32kbase!UserSessionSwitchLeaveCrit+0x5d
ffff868c`80286fb0 ffffadaa`b724efa1 : 00000000`00000002 ffffadce`4c45efe0 00000000`00000000 00000000`00001cff : win32kfull!xxxMsgWaitForMultipleObjectsEx+0x6d
ffff868c`80287060 fffff804`48283c15 : ffff8c00`13eaf080 00000084`4fdaabc8 ffff868c`00000000 00000000`00001cff : win32kfull!NtUserMsgWaitForMultipleObjectsEx+0x3c1
ffff868c`80287990 00007ffd`69ae9a84 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000084`4fdaaba8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`69ae9a84
THREAD_SHA1_HASH_MOD_FUNC: 1ac79891b9db4d4bd13338273c1eee9334bc8320
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 78ce651061ceeff251b6bde82e43fb554ffcddf7
THREAD_SHA1_HASH_MOD: 089f875eb8e26301ebaaf53abd2d2025d55e39fa
FOLLOWUP_IP:
win32kbase!UserSessionSwitchLeaveCrit+5d
ffffadaa`b75d194d 0f1f440000 nop dword ptr [rax+rax]
FAULT_INSTR_CODE: 441f0f
SYMBOL_STACK_INDEX: a
SYMBOL_NAME: win32kbase!UserSessionSwitchLeaveCrit+5d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.719
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 5d
FAILURE_BUCKET_ID: 0x139_1e_INVALID_NEXT_THREAD_win32kbase!UserSessionSwitchLeaveCrit
BUCKET_ID: 0x139_1e_INVALID_NEXT_THREAD_win32kbase!UserSessionSwitchLeaveCrit
PRIMARY_PROBLEM_CLASS: 0x139_1e_INVALID_NEXT_THREAD_win32kbase!UserSessionSwitchLeaveCrit
TARGET_TIME: 2020-04-08T05:35:58.000Z
OSBUILD: 18362
OSSERVICEPACK: 720
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 160101.0800
BUILDLAB_STR: WinBuild
BUILDOSVER_STR: 10.0.18362.720
ANALYSIS_SESSION_ELAPSED_TIME: 750
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_1e_invalid_next_thread_win32kbase!usersessionswitchleavecrit
FAILURE_ID_HASH: {4004f8e5-c772-b0a8-5b89-b65f5cc810d8}
Followup: MachineOwner
---------
Continue reading...