Code:
BugCheck A, {6800036e560, 2, 1, fffff800032e571f}
Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+100 )
Code:
.trap 0xfffff88003ab36c0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000040000124c7 rbx=0000000000000000 rcx=fdffffffffffffff
rdx=000000000000004f rsi=0000000000000000 rdi=0000000000000000
rip=fffff800032e571f rsp=fffff88003ab3850 rbp=fffffa8003a80118
r8=fffff800034fa440 r9=fffffa8003a80000 r10=fffffa8003a80138
r11=fffff88003ab38a8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!MiReplenishPageSlist+0x100:
fffff800`032e571f f00fba6b1000 lock bts dword ptr [rbx+10h],0 ds:00000000`00000010=????????
The lock bts instruction is used to perform a atomic Bit Test and Set operation, which stops any hardware interrupts, interrupting the processor and reading or writing to the same location.
I believe nt!MiReplenishPageSlist is used to update a singly linked list, this since it's a Memory Manager Internal function, and therefore won't be documented. My assumption is based upon two facts, there's a data structure called by Windows to represent the list header of a singly linked list called _SLIST_HEADER, and because of the Assembly instruction called lock bts.
Code:
0: kd> dt nt!_SLIST_HEADER
+0x000 Alignment : Uint8B
+0x008 Region : Uint8B
+0x000 Header8 : <unnamed-tag>
+0x000 Header16 : <unnamed-tag>
+0x000 HeaderX64 : <unnamed-tag>
Code:
0: kd> knL
# Child-SP RetAddr Call Site
00 fffff880`03ab3578 fffff800`032bfde9 nt!KeBugCheckEx
01 fffff880`03ab3580 fffff800`032bea60 nt!KiBugCheckDispatch+0x69
02 fffff880`03ab36c0 fffff800`032e571f nt!KiPageFault+0x260
03 fffff880`03ab3850 fffff800`032e5c4f nt!MiReplenishPageSlist+0x100
04 fffff880`03ab38b0 fffff800`032de1f7 nt!MiRemoveAnyPage+0x24f
05 fffff880`03ab39d0 fffff800`032daa26 nt!MiResolveDemandZeroFault+0x577
06 fffff880`03ab3ac0 fffff800`032be96e nt!MmAccessFault+0x5c6
07 fffff880`03ab3c20 00000000`7346e33d nt!KiPageFault+0x16e
08 00000000`07498104 00000000`00000000 0x7346e33d
Code:
0: kd> !irql
Debugger saved IRQL for processor 0x0 -- 2 (DISPATCH_LEVEL)
Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours: