Windows 10 Build 20221.1000 crash when plugin to Razer Core Chroma with Thunderbolt 3

[JackP847]

Hi,


I previously asked a question regarding about. The problem identified was USBPCap.sys. I have uninstalled the program. Then, I plug in the Thunderbolt again. I continue to have a Green screen, this time, the dump is as following, please help.


Best regards,

Jack


___________________




4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffc28d6cb0ea60, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffc28d6cb0e9b8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 10905

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on JP-X1C

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 13492

Key : Analysis.Memory.CommitPeak.Mb
Value: 124

Key : Analysis.System
Value: CreateObject

Key : Dump.Attributes.FilterDumpFile
Value: 1

Key : WER.OS.Branch
Value: rs_prerelease

Key : WER.OS.Timestamp
Value: 2020-09-19T18:57:00Z

Key : WER.OS.Version
Value: 10.0.20221.1000


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b


DUMP_FILE_ATTRIBUTES: 0x1840
Filter Dump

BUGCHECK_CODE: 139

BUGCHECK_P1: 3

BUGCHECK_P2: ffffc28d6cb0ea60

BUGCHECK_P3: ffffc28d6cb0e9b8

BUGCHECK_P4: 0

TRAP_FRAME: ffffc28d6cb0ea60 -- (.trap 0xffffc28d6cb0ea60)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc38db93441e8 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8050e1082f9 rsp=ffffc28d6cb0ebf0 rbp=ffffc38dc64deb18
r8=fffff8051c4e0cf0 r9=ffffc38db9344140 r10=ffffc38db8e9e098
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
Wdf01000!RtlFailFast+0x5:
fffff805`0e1082f9 cd29 int 29h
Resetting default scope

EXCEPTION_RECORD: ffffc28d6cb0e9b8 -- (.exr 0xffffc28d6cb0e9b8)
ExceptionAddress: fffff8050e1082f9 (Wdf01000!RtlFailFast+0x0000000000000005)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000003

EXCEPTION_STR: 0xc0000409

STACK_TEXT:
ffffc28d`6cb0e738 fffff805`09822ca9 : 00000000`00000139 00000000`00000003 ffffc28d`6cb0ea60 ffffc28d`6cb0e9b8 : nt!KeBugCheckEx
ffffc28d`6cb0e740 fffff805`09823110 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffc28d`6cb0e880 fffff805`09821290 : 00000000`00000000 ffffc38d`00000005 ffffc28d`6cb0ec00 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffc28d`6cb0ea60 fffff805`0e1082f9 : 00003c72`47161fd8 ffffc38d`b8e9e020 ffffc38d`b9344080 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x350
ffffc28d`6cb0ebf0 fffff805`1c4e23ca : ffffc38d`c64dee10 ffffc38d`c64dee02 00000000`00000000 ffffc38d`b8e9e020 : Wdf01000!imp_WdfRequestMarkCancelableEx+0x39a49 [minkernel\wdf\framework\shared\core\fxrequestapi.cpp @ 3529]
ffffc28d`6cb0ec70 fffff805`1c4e1508 : 00000000`00000004 ffffc38d`c64dee10 ffffc28d`6cb0ee00 00000000`00000000 : USBXHCI!Bulk_RetrieveNextStage+0x34a
ffffc28d`6cb0ed30 fffff805`0e0ca482 : ffffc28d`6cb0ee19 00000000`00000030 ffffc38d`b7840d70 00003c72`39b215c8 : USBXHCI!Bulk_WdfEvtIoQueueReadyNotification+0xd8
ffffc28d`6cb0eda0 fffff805`0e0c88fe : ffffc38d`b8e9e000 ffffc38d`c64dea02 00000000`00000000 ffffc38d`c64dee10 : Wdf01000!FxIoQueue:ispatchEvents+0x792 [minkernel\wdf\framework\shared\irphandlers\io\fxioqueue.cpp @ 3055]
ffffc28d`6cb0ee80 fffff805`0e0d4f3e : 00000000`00000602 ffffc38d`b8e9e020 00000000`00000000 ffffc28d`6cb0ef51 : Wdf01000!FxIoQueue::QueueRequest+0xae [minkernel\wdf\framework\shared\irphandlers\io\fxioqueue.cpp @ 2371]
ffffc28d`6cb0eef0 fffff805`1c572f13 : ffffc38d`b9344080 fffff805`1c571200 ffffc38d`b9344140 00003c72`48d52338 : Wdf01000!imp_WdfDeviceWdmDispatchIrpToIoQueue+0x5be [minkernel\wdf\framework\shared\core\km\fxdeviceapikm.cpp @ 494]
ffffc28d`6cb0efb0 fffff805`1c5722a5 : ffffc38d`b80cc000 fffff805`0966f20f ffffffff`ffffffff ffffc38d`b9344080 : ucx01000!Urb_USBPORTStyle_ProcessURB+0x413
ffffc28d`6cb0f070 fffff805`0e0c5570 : ffffc38d`b9344140 00000000`00000030 ffffc38d`b5a4fb40 00000000`00000000 : ucx01000!RootHub_Pdo_EvtInternalDeviceControlIrpPreprocessCallback+0xb5
ffffc28d`6cb0f100 fffff805`096704f5 : 00000000`00000004 ffffc38d`b5a4fb40 00000000`00000000 ffffc38d`b9344140 : Wdf01000!FxDevice:ispatchWithLock+0xd0 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1447]
ffffc28d`6cb0f160 fffff805`0e31af9d : ffffc38d`b5a4fb40 ffffc38d`b9344140 ffffc38d`ad606bc0 ffffc28d`00000030 : nt!IofCallDriver+0x55
ffffc28d`6cb0f1a0 fffff805`0e3110d6 : ffffc38d`add0b8d0 00000000`00000007 ffffc38d`b9344600 ffffe781`43694000 : ACPI!ACPIIrpDispatchDeviceControl+0xad
ffffc28d`6cb0f1e0 fffff805`096704f5 : 00000000`00000007 00000000`00000000 ffffc28d`6cb0f309 fffff805`19c47310 : ACPI!ACPIDispatchIrp+0xc6
ffffc28d`6cb0f260 fffff805`19bf757b : 00000000`00000001 fffff805`09e283b4 00000000`00000600 00000000`00000000 : nt!IofCallDriver+0x55
ffffc28d`6cb0f2a0 fffff805`0e0c5570 : ffffc38d`b9344140 ffffc38d`b9344140 ffffc38d`b9344140 ffffc38d`b816dc70 : UsbHub3!HUBPDO_EvtDeviceWdmIrpPreprocess+0x2bb
ffffc28d`6cb0f370 fffff805`096704f5 : 00000000`00000009 ffffc38d`b8ff0e00 00000000`00000000 ffffc38d`b9344140 : Wdf01000!FxDevice:ispatchWithLock+0xd0 [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1447]
ffffc28d`6cb0f3d0 fffff805`0e31af9d : ffffc38d`b8ff0e00 ffffc38d`b9344140 00000000`000000c0 00000000`00000000 : nt!IofCallDriver+0x55
ffffc28d`6cb0f410 fffff805`0e3110d6 : ffffc38d`add0ebe0 00000000`00000007 ffffc38d`b9344648 ffffc38d`b9344080 : ACPI!ACPIIrpDispatchDeviceControl+0xad
ffffc28d`6cb0f450 fffff805`096704f5 : 00000000`00000007 ffffc38d`b9344140 ffffc28d`6cb0f5d9 ffffc38d`b90c41b8 : ACPI!ACPIDispatchIrp+0xc6
ffffc28d`6cb0f4d0 fffff805`1a131de7 : 00000000`00000001 ffffc38d`b9344140 ffffc28d`6cb0f5d9 ffffc38d`00000000 : nt!IofCallDriver+0x55
ffffc28d`6cb0f510 fffff805`1a1319aa : 00000000`00000000 ffffc38d`b90b4968 00000000`00000000 00000000`000000ff : usbccgp!DispatchPdoUrb+0x2d7
ffffc28d`6cb0f640 fffff805`1a131292 : ffffc38d`b9344140 ffffc38d`b90c41b0 ffffc38d`b90c41b8 00000000`00000000 : usbccgp!DispatchPdoInternalDeviceControl+0x1ca
ffffc28d`6cb0f6b0 fffff805`096704f5 : ffffc38d`b90c4060 00000000`00000001 00000000`00000000 00000000`00000000 : usbccgp!USBC_Dispatch+0x282
ffffc28d`6cb0f780 fffff805`0e31af9d : ffffc38d`b9112d70 ffffc38d`b9344140 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x55
ffffc28d`6cb0f7c0 fffff805`0e3110d6 : ffffc38d`aefe3010 00000000`00000007 ffffc38d`b9344648 00000000`00000000 : ACPI!ACPIIrpDispatchDeviceControl+0xad
ffffc28d`6cb0f800 fffff805`096704f5 : 00000000`00000007 ffffc38d`b3fed010 fffff805`052b1100 ffffc38d`b3fed180 : ACPI!ACPIDispatchIrp+0xc6
ffffc28d`6cb0f880 fffff805`05277414 : ffffc38d`b3fed180 ffffc38d`b3fed010 fffff805`052b1108 ffffc38d`b3fed010 : nt!IofCallDriver+0x55
ffffc28d`6cb0f8c0 fffff805`0529ed20 : ffffc38d`b3fed010 fffff805`052b1108 ffffc38d`b3fed010 00000000`00000000 : usbvideo!RegisterInterruptHandler+0xec
ffffc28d`6cb0f8f0 fffff805`052764e7 : 00000000`00000000 00000000`00000000 ffffc38d`b3fed010 00000000`00000000 : usbvideo!InitializeIrpThreadAndQueue+0x88
ffffc28d`6cb0f940 fffff805`0527413d : ffffc38d`b90bccb0 ffffc38d`b90bcbf8 fffff805`052b1108 00000000`00000000 : usbvideo!StartUSBVideoDevice+0x407
ffffc28d`6cb0f9b0 fffff805`1d333084 : ffffc38d`b90bcb30 00000000`00000000 ffffc38d`c52ed9a0 fffff805`0a136600 : usbvideo!USBVideoSetPower+0x6d
ffffc28d`6cb0f9f0 fffff805`096f67cc : ffffc38d`b901a4c0 ffffc38d`c67cd040 fffff805`1d332fb0 ffffc38d`b90bced0 : ks!CKsDevice:assiveWakeDevice+0xd4
ffffc28d`6cb0fa50 fffff805`096128a5 : ffffc38d`c67cd040 00000000`00000080 ffffc38d`adcec040 004fa46f`b19bbfff : nt!ExpWorkerThread+0x11c
ffffc28d`6cb0faf0 fffff805`09814018 : ffffe781`43780180 ffffc38d`c67cd040 fffff805`09612850 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffc28d`6cb0fb40 00000000`00000000 : ffffc28d`6cb10000 ffffc28d`6cb09000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME: USBXHCI!Bulk_RetrieveNextStage+34a

MODULE_NAME: USBXHCI

IMAGE_NAME: USBXHCI.SYS

IMAGE_VERSION: 10.0.20221.1000

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 34a

FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_USBXHCI!Bulk_RetrieveNextStage

OS_VERSION: 10.0.20221.1000

BUILDLAB_STR: rs_prerelease

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {7664763f-c5d4-6ecc-4463-f9090dc998a5}

Followup: MachineOwner
---------

4: kd> lmvm USBXHCI
Browse full module list
start end module name
fffff805`1c4d0000 fffff805`1c56c000 USBXHCI (pdb symbols) C:\ProgramData\Dbg\sym\usbxhci.pdb\41E31EDA280F55B2E12C4650836150D81\usbxhci.pdb
Loaded symbol image file: USBXHCI.SYS
Mapped memory image file: C:\ProgramData\Dbg\sym\USBXHCI.SYS\87B2548E9c000\USBXHCI.SYS
Image path: \SystemRoot\System32\drivers\USBXHCI.SYS
Image name: USBXHCI.SYS
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 87B2548E (This is a reproducible build file hash, not a timestamp)
CheckSum: 000AA46F
ImageSize: 0009C000
File version: 10.0.20221.1000
Product version: 10.0.20221.1000
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: usbxhci.sys
OriginalFilename: usbxhci.sys
ProductVersion: 10.0.20221.1000
FileVersion: 10.0.20221.1000 (WinBuild.160101.0800)
FileDescription: USB XHCI Driver
LegalCopyright: © Microsoft Corporation. All rights reserved.

4: kd> lmDv
start end module name
ffff8697`aaa00000 ffff8697`aacf2000 win32kbase (deferred)
Image path: \SystemRoot\System32\win32kbase.sys
Image name: win32kbase.sys
Browse all global symbols functions data
Timestamp: Thu Jul 24 01:48:57 2025 (68812089)
CheckSum: 002F25B2
ImageSize: 002F2000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
ffff8697`aad00000 ffff8697`ab0b2000 win32kfull (deferred)
Image path: \SystemRoot\System32\win32kfull.sys
Image name: win32kfull.sys
Browse all global symbols functions data
Timestamp: Wed Jan 21 22:40:12 1976 (0B63B2CC)
CheckSum: 003AF62A
ImageSize: 003B2000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
ffff8697`ab0c0000 ffff8697`ab103000 cdd (deferred)
Image path: \SystemRoot\System32\cdd.dll
Image name: cdd.dll
Browse all global symbols functions data
Timestamp: ***** Invalid (FC20B247)
CheckSum: 00042AB0
ImageSize: 00043000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:

-- there are more, but I chop it off...

Continue reading...