*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
[COLOR=red]KERNEL_SECURITY_CHECK_FAILURE (139)[/COLOR]
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffd00023521740, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd00023521698, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
TRAP_FRAME: ffffd00023521740 -- (.trap 0xffffd00023521740)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc000261ffed8 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffc000261e77e8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80000a34f0d rsp=ffffd000235218d0 rbp=0000000000000000
r8=0000000000000000 r9=7fffe00007de66b8 r10=ffffe00007de66b8
r11=7ffffffffffffffc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po cy
Ntfs!NtfsFullDeleteLcb+0x5995d:
fffff800`00a34f0d cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffd00023521698 -- (.exr 0xffffd00023521698)
ExceptionAddress: fffff80000a34f0d (Ntfs!NtfsFullDeleteLcb+0x000000000005995d)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT
BUGCHECK_STR: 0x139
PROCESS_NAME: System
CURRENT_IRQL: 1
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. [COLOR=red]This overrun could potentially allow a malicious user to gain control of this application.[/COLOR]
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
LAST_CONTROL_TRANSFER: from fffff804011767e9 to fffff8040116aca0
STACK_TEXT:
ffffd000`23521418 fffff804`011767e9 : 00000000`00000139 00000000`00000003 ffffd000`23521740 ffffd000`23521698 : nt!KeBugCheckEx
ffffd000`23521420 fffff804`01176b10 : ffffe000`000af280 fffff804`012ae1ca 00000000`00000000 00000000`00000020 : nt!KiBugCheckDispatch+0x69
ffffd000`23521560 fffff804`01175d34 : 00000000`00000120 00000000`00000705 ffffffff`ffffffff ffffe000`07de66a0 : nt!KiFastFailDispatch+0xd0
ffffd000`23521740 fffff800`00a34f0d : ffffd000`23521948 00000000`00000000 00000000`00000000 ffffc000`261ffb00 : nt!KiRaiseSecurityCheckFailure+0xf4
ffffd000`235218d0 fffff800`00900de7 : ffffc000`261ffed0 ffffd000`23521b80 ffffc000`261ffb01 ffffc000`261ffb00 : Ntfs!NtfsFullDeleteLcb+0x5995d
ffffd000`23521900 fffff800`009ccb3c : ffffe000`072aa1f8 ffffe000`000c8180 ffffc000`261ffb00 ffffc000`261ffed0 : Ntfs!NtfsTeardownFromLcb+0x137
ffffd000`23521990 fffff800`008f2424 : ffffe000`072aa1f8 ffffd000`23521a91 ffffc000`261ffed0 ffffc000`261ffb00 : Ntfs!NtfsTeardownStructures+0xdc
ffffd000`23521a10 fffff800`0099e4c9 : ffffd000`23521bb8 ffffd000`23521b80 ffffc000`261ffb00 00000000`7346744e : Ntfs!NtfsDecrementCloseCounts+0xd4
ffffd000`23521a50 fffff800`009dadbd : ffffe000`072aa1f8 ffffc000`261ffc30 ffffc000`261ffb00 ffffe000`000c8180 : Ntfs!NtfsCommonClose+0x399
ffffd000`23521b20 fffff804`010be1b9 : fffff804`0144a2c4 fffff800`009daf20 00000000`00000000 ffffe000`015576a0 : Ntfs!NtfsFspCloseInternal+0x1a1
ffffd000`23521c90 fffff804`010aa2e4 : 00000000`00000020 ffffe000`07bbb880 ffffe000`07bbb880 ffffe000`00133900 : nt!ExpWorkerThread+0x2b5
ffffd000`23521d40 fffff804`011712c6 : ffffd000`201e7180 ffffe000`07bbb880 ffffe000`001a2880 ffffd000`23521df0 : nt!PspSystemThreadStartup+0x58
ffffd000`23521da0 00000000`00000000 : ffffd000`23522000 ffffd000`2351c000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff804`01176b10 c644242000 mov byte ptr [rsp+20h],0
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiFastFailDispatch+d0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: [COLOR=red]ntkrnlmp.exe[/COLOR]
DEBUG_FLR_IMAGE_TIMESTAMP: 52718d9c
IMAGE_VERSION: 6.3.9600.16452
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_3_nt!KiFastFailDispatch
BUCKET_ID: 0x139_3_nt!KiFastFailDispatch
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_nt!kifastfaildispatch
FAILURE_ID_HASH: {36173680-6f08-995f-065a-3d368c996911}
Followup: MachineOwner