S
smellyhandz
Guest
Is there a way to resolve this issue?
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (32 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff802`62c00000 PsLoadedModuleList = 0xfffff802`6382a3b0
Debug session time: Sun Nov 8 19:03:07.556 2020 (UTC - 7:00)
System Uptime: 0 days 20:30:26.517
Loading Kernel Symbols
...............................................................
................................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
......................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802`62ff5210 48894c2408 mov qword ptr [rsp+8],rcx ss:ffffda00`f69bf0f0=000000000000007e
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80262ffd147, The address that the exception occurred at
Arg3: ffff96838567d018, Exception Record Address
Arg4: ffffda00f69bf920, Context Record Address
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 3718
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-UPE5VMD
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 5252
Key : Analysis.Memory.CommitPeak.Mb
Value: 102
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff80262ffd147
BUGCHECK_P3: ffff96838567d018
BUGCHECK_P4: ffffda00f69bf920
EXCEPTION_RECORD: ffff96838567d018 -- (.exr 0xffff96838567d018)
ExceptionAddress: fffff80262ffd147 (nt!ExpInterlockedPopEntrySListFault)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffffda00f69bf920 -- (.cxr 0xffffda00f69bf920)
rax=000001f87f21001b rbx=ffff9e8cb39113c0 rcx=ffff9e8cb39113c0
rdx=0006008001000000 rsi=ffff9e8cb2964030 rdi=ffff9e8cb3f2d940
rip=fffff80262ffd147 rsp=ffff96838567d250 rbp=ffff96838567d300
r8=0006008001000000 r9=ffff9e8cb3f2d940 r10=ffff9e8cb39113c0
r11=ffffc9ffc6a00000 r12=0000000000000000 r13=ffff9e8cbcdcbf20
r14=ffff9e8cbd06b080 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00050206
nt!ExpInterlockedPopEntrySListFault:
fffff802`62ffd147 498b08 mov rcx,qword ptr [r8] ds:002b:00060080`01000000=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
PROCESS_NAME: System
READ_ADDRESS: ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
EXCEPTION_STR: 0xc0000005
BAD_STACK_POINTER: ffffda00f69bf0e8
STACK_TEXT:
ffff9683`8567d250 fffff802`b4576d7c : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExpInterlockedPopEntrySListFault
ffff9683`8567d260 fffff802`b4574750 : fffff802`67231a50 00000000`00000000 ffff9e8c`bd06b080 00000000`00000000 : Ndu!PplGenericAllocateFunction+0x1c
ffff9683`8567d2a0 fffff802`670f8cee : 00000000`00000000 ffff9683`8567d3b9 00000000`00000001 ffff9683`8567d4b8 : Ndu!NduInboundMacClassify+0x220
ffff9683`8567d350 fffff802`675314d5 : 00000000`00000000 00000000`0000000e ffff9e8c`b45ec030 00000000`00000050 : NETIO!KfdClassify2+0x19e
ffff9683`8567d420 fffff802`67531270 : ffff9e8c`b16628a0 00000000`00000000 00000000`00000000 00000000`00000001 : wfplwfs!L2InspectNetBufferListsFast+0x165
ffff9683`8567d530 fffff802`66c67ef0 : ffff9e8c`00000009 ffff9e8c`b45ec030 ffff9e8c`b3a681a0 ffff9e8c`b120c201 : wfplwfs!LwfLowerRecvNetBufferLists+0xd0
ffff9683`8567d5f0 fffff802`66c9de2c : ffff9e8c`b3a89100 ffff9683`8567d6c1 ffff9683`8567d688 fffff802`66c62a00 : ndis!ndisCallReceiveHandler+0x60
ffff9683`8567d640 fffff802`66c64a94 : 00000000`004818a1 00000000`00000801 ffff9e8c`b3a681a0 00000000`00000001 : ndis!ndisInvokeNextReceiveHandler+0x148
ffff9683`8567d710 fffff802`73d0944f : ffff9e8c`b45ec030 00000000`00000801 00000000`00000009 ffff9e8c`b45ec030 : ndis!NdisMIndicateReceiveNetBufferLists+0x104
ffff9683`8567d7a0 fffff802`73d0a623 : ffff9e8c`b2964000 ffff9e8c`b425d000 ffff9e8c`b425e800 00000000`00000000 : e1r68x64+0x1944f
ffff9683`8567d800 fffff802`73d121ae : ffff9e8c`b19ff970 ffff0001`00000001 00000000`00000001 00000000`00000001 : e1r68x64+0x1a623
ffff9683`8567d880 fffff802`73d12636 : ffff9e8c`b19ffb70 ffff9e8c`00000000 ffff0001`00000001 ffff0001`00000001 : e1r68x64+0x221ae
ffff9683`8567d900 fffff802`73d11c42 : ffff9e8c`b19ffb70 00000000`fffffffe 00000000`00000001 00000000`00000000 : e1r68x64+0x22636
ffff9683`8567d9c0 fffff802`66cc6cd8 : 00000000`00000000 ffff9683`00000000 00000000`00000000 ffff9e8c`b13ba180 : e1r68x64+0x21c42
ffff9683`8567da10 fffff802`66cc71cc : ffff9e8c`b4503928 00000000`0000000a 00000000`00000001 00000000`00000002 : ndis!ndisMiniportDpc+0xf0
ffff9683`8567daa0 fffff802`66cb7b01 : ffff9e8c`b13b9220 ffff9e8c`b13b9220 ffff9683`8567dba9 fffff802`66c96e00 : ndis!ndisQueuedMiniportDpcWorkItem+0x11c
ffff9683`8567db40 fffff802`62ea29a5 : ffff9e8c`b13ba040 ffff9e8c`b13ba040 fffff802`66c96eb0 00000000`00000002 : ndis!ndisReceiveWorkerThread+0x20c51
ffff9683`8567dc10 fffff802`62ffc868 : ffffda00`f7537180 ffff9e8c`b13ba040 fffff802`62ea2950 2f3a7074`74683386 : nt!PspSystemThreadStartup+0x55
ffff9683`8567dc60 00000000`00000000 : ffff9683`8567e000 ffff9683`85678000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: Ndu!PplGenericAllocateFunction+1c
MODULE_NAME: Ndu
IMAGE_NAME: Ndu.sys
STACK_COMMAND: .cxr 0xffffda00f69bf920 ; kb
BUCKET_ID_FUNC_OFFSET: 1c
FAILURE_BUCKET_ID: AV_STACKPTR_ERROR_Ndu!PplGenericAllocateFunction
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {5c9d4d25-923f-a327-f4cb-5835435797c1}
Followup: MachineOwner
---------
2: kd> lmvm Ndu
Browse full module list
start end module name
fffff802`b4570000 fffff802`b4597000 Ndu # (pdb symbols) C:\ProgramData\Dbg\sym\ndu.pdb\DE8513570D241399F32498307981576C1\ndu.pdb
Loaded symbol image file: Ndu.sys
Mapped memory image file: C:\ProgramData\Dbg\sym\Ndu.sys\ABC6C89427000\Ndu.sys
Image path: \SystemRoot\system32\drivers\Ndu.sys
Image name: Ndu.sys
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: ABC6C894 (This is a reproducible build file hash, not a timestamp)
CheckSum: 000213E1
ImageSize: 00027000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
Continue reading...
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (32 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff802`62c00000 PsLoadedModuleList = 0xfffff802`6382a3b0
Debug session time: Sun Nov 8 19:03:07.556 2020 (UTC - 7:00)
System Uptime: 0 days 20:30:26.517
Loading Kernel Symbols
...............................................................
................................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
......................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802`62ff5210 48894c2408 mov qword ptr [rsp+8],rcx ss:ffffda00`f69bf0f0=000000000000007e
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80262ffd147, The address that the exception occurred at
Arg3: ffff96838567d018, Exception Record Address
Arg4: ffffda00f69bf920, Context Record Address
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 3718
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-UPE5VMD
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 5252
Key : Analysis.Memory.CommitPeak.Mb
Value: 102
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff80262ffd147
BUGCHECK_P3: ffff96838567d018
BUGCHECK_P4: ffffda00f69bf920
EXCEPTION_RECORD: ffff96838567d018 -- (.exr 0xffff96838567d018)
ExceptionAddress: fffff80262ffd147 (nt!ExpInterlockedPopEntrySListFault)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffffda00f69bf920 -- (.cxr 0xffffda00f69bf920)
rax=000001f87f21001b rbx=ffff9e8cb39113c0 rcx=ffff9e8cb39113c0
rdx=0006008001000000 rsi=ffff9e8cb2964030 rdi=ffff9e8cb3f2d940
rip=fffff80262ffd147 rsp=ffff96838567d250 rbp=ffff96838567d300
r8=0006008001000000 r9=ffff9e8cb3f2d940 r10=ffff9e8cb39113c0
r11=ffffc9ffc6a00000 r12=0000000000000000 r13=ffff9e8cbcdcbf20
r14=ffff9e8cbd06b080 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00050206
nt!ExpInterlockedPopEntrySListFault:
fffff802`62ffd147 498b08 mov rcx,qword ptr [r8] ds:002b:00060080`01000000=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
PROCESS_NAME: System
READ_ADDRESS: ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
EXCEPTION_STR: 0xc0000005
BAD_STACK_POINTER: ffffda00f69bf0e8
STACK_TEXT:
ffff9683`8567d250 fffff802`b4576d7c : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExpInterlockedPopEntrySListFault
ffff9683`8567d260 fffff802`b4574750 : fffff802`67231a50 00000000`00000000 ffff9e8c`bd06b080 00000000`00000000 : Ndu!PplGenericAllocateFunction+0x1c
ffff9683`8567d2a0 fffff802`670f8cee : 00000000`00000000 ffff9683`8567d3b9 00000000`00000001 ffff9683`8567d4b8 : Ndu!NduInboundMacClassify+0x220
ffff9683`8567d350 fffff802`675314d5 : 00000000`00000000 00000000`0000000e ffff9e8c`b45ec030 00000000`00000050 : NETIO!KfdClassify2+0x19e
ffff9683`8567d420 fffff802`67531270 : ffff9e8c`b16628a0 00000000`00000000 00000000`00000000 00000000`00000001 : wfplwfs!L2InspectNetBufferListsFast+0x165
ffff9683`8567d530 fffff802`66c67ef0 : ffff9e8c`00000009 ffff9e8c`b45ec030 ffff9e8c`b3a681a0 ffff9e8c`b120c201 : wfplwfs!LwfLowerRecvNetBufferLists+0xd0
ffff9683`8567d5f0 fffff802`66c9de2c : ffff9e8c`b3a89100 ffff9683`8567d6c1 ffff9683`8567d688 fffff802`66c62a00 : ndis!ndisCallReceiveHandler+0x60
ffff9683`8567d640 fffff802`66c64a94 : 00000000`004818a1 00000000`00000801 ffff9e8c`b3a681a0 00000000`00000001 : ndis!ndisInvokeNextReceiveHandler+0x148
ffff9683`8567d710 fffff802`73d0944f : ffff9e8c`b45ec030 00000000`00000801 00000000`00000009 ffff9e8c`b45ec030 : ndis!NdisMIndicateReceiveNetBufferLists+0x104
ffff9683`8567d7a0 fffff802`73d0a623 : ffff9e8c`b2964000 ffff9e8c`b425d000 ffff9e8c`b425e800 00000000`00000000 : e1r68x64+0x1944f
ffff9683`8567d800 fffff802`73d121ae : ffff9e8c`b19ff970 ffff0001`00000001 00000000`00000001 00000000`00000001 : e1r68x64+0x1a623
ffff9683`8567d880 fffff802`73d12636 : ffff9e8c`b19ffb70 ffff9e8c`00000000 ffff0001`00000001 ffff0001`00000001 : e1r68x64+0x221ae
ffff9683`8567d900 fffff802`73d11c42 : ffff9e8c`b19ffb70 00000000`fffffffe 00000000`00000001 00000000`00000000 : e1r68x64+0x22636
ffff9683`8567d9c0 fffff802`66cc6cd8 : 00000000`00000000 ffff9683`00000000 00000000`00000000 ffff9e8c`b13ba180 : e1r68x64+0x21c42
ffff9683`8567da10 fffff802`66cc71cc : ffff9e8c`b4503928 00000000`0000000a 00000000`00000001 00000000`00000002 : ndis!ndisMiniportDpc+0xf0
ffff9683`8567daa0 fffff802`66cb7b01 : ffff9e8c`b13b9220 ffff9e8c`b13b9220 ffff9683`8567dba9 fffff802`66c96e00 : ndis!ndisQueuedMiniportDpcWorkItem+0x11c
ffff9683`8567db40 fffff802`62ea29a5 : ffff9e8c`b13ba040 ffff9e8c`b13ba040 fffff802`66c96eb0 00000000`00000002 : ndis!ndisReceiveWorkerThread+0x20c51
ffff9683`8567dc10 fffff802`62ffc868 : ffffda00`f7537180 ffff9e8c`b13ba040 fffff802`62ea2950 2f3a7074`74683386 : nt!PspSystemThreadStartup+0x55
ffff9683`8567dc60 00000000`00000000 : ffff9683`8567e000 ffff9683`85678000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: Ndu!PplGenericAllocateFunction+1c
MODULE_NAME: Ndu
IMAGE_NAME: Ndu.sys
STACK_COMMAND: .cxr 0xffffda00f69bf920 ; kb
BUCKET_ID_FUNC_OFFSET: 1c
FAILURE_BUCKET_ID: AV_STACKPTR_ERROR_Ndu!PplGenericAllocateFunction
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {5c9d4d25-923f-a327-f4cb-5835435797c1}
Followup: MachineOwner
---------
2: kd> lmvm Ndu
Browse full module list
start end module name
fffff802`b4570000 fffff802`b4597000 Ndu # (pdb symbols) C:\ProgramData\Dbg\sym\ndu.pdb\DE8513570D241399F32498307981576C1\ndu.pdb
Loaded symbol image file: Ndu.sys
Mapped memory image file: C:\ProgramData\Dbg\sym\Ndu.sys\ABC6C89427000\Ndu.sys
Image path: \SystemRoot\system32\drivers\Ndu.sys
Image name: Ndu.sys
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: ABC6C894 (This is a reproducible build file hash, not a timestamp)
CheckSum: 000213E1
ImageSize: 00027000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
Continue reading...