*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff8a0199fc6b0, 1, fffff8800103eb37, 2}
Could not read faulting driver name
Probably caused by : memory_corruption
Followup: memory_corruption
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a0199fc6b0, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff8800103eb37, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d070e0
fffff8a0199fc6b0
FAULTING_IP:
fltmgr!TreeInsert+7b
fffff880`0103eb37 4c899248894a18 mov qword ptr [rdx+184A8948h],r10
MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x50
PROCESS_NAME: services.exe
CURRENT_IRQL: 1
TRAP_FRAME: fffff8800287fb10 -- (.trap 0xfffff8800287fb10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a001553d68 rbx=0000000000000000 rcx=fffffa8005ec0898
rdx=fffff8a001553d68 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800103eb37 rsp=fffff8800287fca8 rbp=fffff8a001553da0
r8=fffffa8005e37320 r9=fffffa8006123010 r10=fffff8a000efced8
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
fltmgr!TreeInsert+0x7b:
fffff880`0103eb37 4c899248894a18 mov qword ptr [rdx+184A8948h],r10 ds:cde0:fffff8a0`199fc6b0=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002b4e8f2 to fffff80002acf740
STACK_TEXT:
fffff880`0287f9a8 fffff800`02b4e8f2 : 00000000`00000050 fffff8a0`199fc6b0 00000000`00000001 fffff880`0287fb10 : nt!KeBugCheckEx
fffff880`0287f9b0 fffff800`02acd82e : 00000000`00000001 00000000`00000000 fffff880`00000200 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x40ec0
fffff880`0287fb10 fffff880`0103eb37 : fffff880`0103e65f 00000000`00000000 fffffa80`05ec0820 fffffa80`0567cde0 : nt!KiPageFault+0x16e
fffff880`0287fca8 fffff880`0103e65f : 00000000`00000000 fffffa80`05ec0820 fffffa80`0567cde0 fffff880`02881000 : fltmgr!TreeInsert+0x7b
fffff880`0287fcb0 fffff880`0105b5ef : 00000000`00008000 fffffa80`05ec0820 fffffa80`06123010 fffff880`0287fee8 : fltmgr!FltpGetFileNameInformation+0x37f
fffff880`0287fd30 fffff880`0164eada : fffffa80`0567cde0 00000000`00000000 00000000`00000594 fffffa80`062abd40 : fltmgr!FltGetFileNameInformationUnsafe+0x7f
fffff880`0287fda0 fffff880`0164edb3 : 00000000`00000000 fffff880`02880ca0 00000000`00000594 00000000`00000000 : tcpip!WfpAleCaptureImageFileName+0x3a
fffff880`0287fdf0 fffff880`0164f02e : fffffa80`05e37320 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!WfpCreateProcessNotifyRoutine+0x63
fffff880`0287fed0 fffff800`02d99e8f : fffffa80`05e37320 fffff880`02880ca0 fffffa80`05e37320 00000000`00000002 : tcpip!CreateProcessNotifyRoutineEx+0xe
fffff880`0287ff00 fffff800`02d7b277 : fffffa80`05e6d060 fffffa80`05e3d060 fffff880`028801b0 fffff880`028800ec : nt!PspInsertThread+0x74f
fffff880`02880080 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateUserProcess+0x732
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !fltmgr
fffff8800103eb39 - fltmgr!TreeInsert+7d
[ 12:92 ]
1 error : !fltmgr (fffff8800103eb39)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
)
