ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application.

[RobertDefenbaugh]

I've been getting this message for a bit now, but just recently experienced a BSOD with this in the .dmp file. I was playing No Mans Sky, it froze up, stopped responding, then BSOD'd. I analyzed the .dmp file in Windows, and this is what it gave me:



Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\022121-12953-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff801`36200000 PsLoadedModuleList = 0xfffff801`36e2a390
Debug session time: Sun Feb 21 22:51:45.284 2021 (UTC - 7:00)
System Uptime: 2 days 6:41:49.277
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
......................................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff801`365f5a80 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff800a`24d6fa20=0000000000000139
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff800a24d6fd40, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff800a24d6fc98, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1530

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BOBINHOOD-PC

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 2209

Key : Analysis.Memory.CommitPeak.Mb
Value: 86

Key : Analysis.System
Value: CreateObject

Key : Dump.Attributes.InsufficientDumpfileSize
Value: 1

Key : Dump.Attributes.RequiredDumpfileSize
Value: 0x1125f2de8


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

DUMP_FILE_ATTRIBUTES: 0xc
Insufficient Dumpfile Size
Kernel Generated Triage Dump

BUGCHECK_CODE: 139

BUGCHECK_P1: 3

BUGCHECK_P2: ffff800a24d6fd40

BUGCHECK_P3: ffff800a24d6fc98

BUGCHECK_P4: 0

TRAP_FRAME: ffff800a24d6fd40 -- (.trap 0xffff800a24d6fd40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff908c8fe8e130 rbx=0000000000000000 rcx=0000000000000003
rdx=ffff908c8fe8e010 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8013d5c49e3 rsp=ffff800a24d6fed0 rbp=ffff800a24d6ff01
r8=ffff908c8dd4d130 r9=ffff908c8cdec010 r10=0000000000000001
r11=ffff908beb214000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
dxgmms2!VidSchiUnblockUnorderedWaitQueuePacket+0xaf:
fffff801`3d5c49e3 cd29 int 29h
Resetting default scope

EXCEPTION_RECORD: ffff800a24d6fc98 -- (.exr 0xffff800a24d6fc98)
ExceptionAddress: fffff8013d5c49e3 (dxgmms2!VidSchiUnblockUnorderedWaitQueuePacket+0x00000000000000af)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: NMS.exe

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000003

EXCEPTION_STR: 0xc0000409

STACK_TEXT:
ffff800a`24d6fa18 fffff801`36607a69 : 00000000`00000139 00000000`00000003 ffff800a`24d6fd40 ffff800a`24d6fc98 : nt!KeBugCheckEx
ffff800a`24d6fa20 fffff801`36607e90 : 00000000`000000a0 00000000`000006e3 00000000`00000002 ffff908c`7e051eb0 : nt!KiBugCheckDispatch+0x69
ffff800a`24d6fb60 fffff801`36606223 : 00000000`00000000 ffff908b`e2802340 00000000`ffffffff 00000000`00000001 : nt!KiFastFailDispatch+0xd0
ffff800a`24d6fd40 fffff801`3d5c49e3 : 00000000`400068c0 00000000`4b677844 00000000`00000160 00000000`00000799 : nt!KiRaiseSecurityCheckFailure+0x323
ffff800a`24d6fed0 fffff801`3d5e205f : ffff908c`1f73ce80 00000000`00000000 ffff908b`e2802100 fffff801`3644caf2 : dxgmms2!VidSchiUnblockUnorderedWaitQueuePacket+0xaf
ffff800a`24d6ff00 fffff801`3d5d1c5d : ffff908c`1f73ce80 ffff800a`24d6ff90 ffffba08`9a7bbab0 00000000`00000001 : dxgmms2!VidSchiUnblockUnorderedWaiter+0xa7
ffff800a`24d6ff30 fffff801`3d630b43 : ffff908c`1f73ce80 00000000`00000000 00000000`00008b44 00000000`00000000 : dxgmms2!VidSchTimeoutSyncObject+0xcbd1
ffff800a`24d6ffa0 fffff801`3b9c3a7e : ffff908b`f26b3bb0 ffff908b`f26b3bb0 00000000`40006980 ffffba08`9a7bbba0 : dxgmms2!VidSchDestroySyncObject+0x203
ffff800a`24d70060 fffff801`3b9c4475 : ffff908b`e9202160 ffff800a`24d70110 ffffba08`9a7bbab0 ffffba08`9a7bbab0 : dxgkrnl!DXGSYNCOBJECT:estroy+0x82
ffff800a`24d700a0 fffff801`3b9c9550 : ffff908b`f26b3bb0 ffffba08`89854810 ffff908b`f26b3bb0 ffffba08`89854810 : dxgkrnl!DXGGLOBAL:estroySyncObject+0x285
ffff800a`24d70150 fffff801`3b9c4785 : ffffba08`9a7bbab0 01000000`00100000 ffffba08`9a7bbab0 fffff801`53ace5e9 : dxgkrnl!DXGPROCESS:estroy+0x328
ffff800a`24d703c0 fffff801`3b8b6c11 : 00000000`00000000 ffff908c`74ab7070 00000000`00000000 00000000`00000000 : dxgkrnl!DXGPROCESS:estroyDxgProcess+0x105
ffff800a`24d70510 fffff801`368379df : 00000000`00000000 ffff908b`e9192a60 ffff908c`7d5bb080 00000000`00000000 : dxgkrnl!DxgkProcessNotify+0x1a1
ffff800a`24d70560 fffff801`36862cd4 : ffff908c`7d5bb000 ffff908c`7d5bb080 00000000`00000000 00000000`00000000 : nt!PspCallProcessNotifyRoutines+0x213
ffff800a`24d70630 fffff801`36906ad2 : ffff908c`95dce4f8 00000000`00000000 ffff800a`24d70820 00000000`00000000 : nt!PspExitProcess+0x70
ffff800a`24d70660 fffff801`368d2868 : 00000000`cfffffff 00000000`00000001 00000000`00000000 000000b2`5f200000 : nt!PspExitThread+0x5b2
ffff800a`24d70760 fffff801`36467fb7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSchedulerApcTerminate+0x38
ffff800a`24d707a0 fffff801`365fa020 : 00000000`00000000 ffff800a`24d70850 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x487
ffff800a`24d70850 fffff801`3660755f : 00000000`00000000 00000000`00000000 ffff908c`95dce0c0 ffff908c`7777d2e0 : nt!KiInitiateUserApc+0x70
ffff800a`24d70990 00007ffc`5406d174 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
000000b2`62b0f7a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`5406d174


SYMBOL_NAME: dxgmms2!VidSchiUnblockUnorderedWaitQueuePacket+af

MODULE_NAME: dxgmms2

IMAGE_NAME: dxgmms2.sys

IMAGE_VERSION: 10.0.19041.1136

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: af

FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_dxgmms2!VidSchiUnblockUnorderedWaitQueuePacket

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {8d08175c-e082-4ab2-74cd-2075fb0425a3}

Followup: MachineOwner
---------
I'm stumped as to what's causing it and how to fix it. I did DISM and SFC and no integrity violations were found.

Continue reading...