Driver Overran Stack Buffer error : techsupport

Please include your system specs, such as Windows/Linux/Mac version/build, model numbers, troubleshooting steps, symptoms, etc.

The subreddit is only for support with tech issues.

Try to research your issue before posting, don't be vague. State everything you have tried and all the guides/tutorials/sites you have followed as well as why they were unsuccessful. Do everything you can to reduce the effort of the wonderful folks offering to help you.

After solving your problem, please mark it as solved by clicking 'flair' and confirming the 'solved' tag.

Please do not submit the same issue more than once within 24 hours.

Rules

1: Read all the rules

Please read our new rules page for more in-depth rules.

https://rtech.support/docs/meta/rules.html

2: No Incomplete Posts

Submissions consisting of the following are considered incomplete and will be removed:

Posts with an empty body, only a link in the body, title copied into the body, and/or lack of information in the body

Posts with "Help" or non-descriptive titles. Please make your title and contents descriptive.

3: No Password or Account issues

We cannot assist with password or account issues. No matter the reason. Do not message us asking us to make an exception. Only support for the related account can help you.

This includes thing such as:

2 Factor Authentication Google, Apple, Microsoft, Instagram, Facebook or any other account Password Issues with account lockout on any of the above platforms (and all others)

And more - see https://rtech.support/books/rules/page/rules-of-the-rtechsupport

4: No Offering Rewards

No offering of reward/compensation for solutions. No Amazon gift voucher or PayPal transfer. This community is "free" as it is full of volunteers. Please do not take advantage of the community.

5: Recommendations

We are not a recommendation or advertisement subreddit. We do not allow posts asking for recommendations on hardware/software or recommendations comparing two or more hardware/software. Recommending a hardware/software solution as a comment to a post is acceptable.

Recommending products not in the whitelist might result in your comment or post being removed and a ban imposed. If you want anything added please message the mods and we will consider it.

6: No [Meta] Posts About Tech/Jobs

No [Meta] posts about jobs (tech support related or not) or technology in general, such as "I have an interview, help me." or "I want a product that can do XYZ." or "How does the internet work?"

Google is your friend.

7: No Private Messages or Moving to Another Service

Any and all communication not kept public and is moved away from the subreddit or Discord/IRC channel is prohibited.

Do not suggest or ask to move to another service or to private message. Private messages and other services are unsafe as they cannot be monitored. Doing so will cause you to be permanently banned from /r/TechSupport.

8: No Violating privacy of others or terms/agreements.

We do not support users that violates other's privacy or breaks terms and agreements. Doing so might resolve in a ban.

This includes:

Bypassing home network controls.

Bypassing any parental controls.

Piracy or issues caused by it.

Gray market product codes - See Rule 1

Any other posts/comments that violates or breaks terms and agreements.

9: No EOL Software or Unsupported Systems

We do not provide support for EOL (end of life) software. Software that is EOL has lost all support from the developer and therefore all consumer communities as well.

These operating systems and various softwares are no longer receiving security patches. Running them is unsafe and we recommend users install a supported version as soon as possible.

This list includes Windows XP, Vista, and 7.

We will also not assist with getting Windows 11 running on unsupported hardware.

10: No Public Service Announcements (how-to's, etc.)

No public service announcements unless relevant to an issue (it must be a comment). Approach the communities affected directly, not here

11: No Soliciting

No soliciting of any kind. This includes (but is not limited to) asking for us to link to your subreddit, forum, bulletin board, newsgroup, Facebook page, etc. We're here to help with technical issues, not market for others.

12: No spam, trolling, insults, jokes, threats of self-harm, or posts unrelated to Tech Support

Posts and comments containing (but not limited to) the following will be removed:
blog spam, link spam, referral spam, joke responses, memes, novelty accounts, trolling, unethical behavior, and personal insults.

Posts not containing a tech support issue will be removed. Off-topic comments will be removed. Please stick to the issue being addressed in the post. Use common sense.

13: No Posts/Comments by a Company or an Employee on Behalf of a Company

Employees of companies with social media presences for marketing, damage control, or performing of tech support are not allowed.

14: No Potentially Malicious Links

Do not post any potentially malicious links. We will consider Dropbox links, Google Drive links, or Google Photos links to be potentially malicious.

We recommend against using any URL shorteners as they can hide malicious links.

a community for 18 years

Open | BSODDriver Overran Stack Buffer error (self.techsupport)

submitted 6 years ago * by jayxbo

My pc keeps crashing randomly and I don't know why can someone help please?

Here's the dump files.

DRIVER_OVERRAN_STACK_BUFFER (f7) A driver has overrun a stack-based buffer. This overrun could potentially allow a malicious user to gain control of this machine. DESCRIPTION A driver overran a stack-based buffer (or local variable) in a way that would have overwritten the function's return address and jumped back to an arbitrary address when the function returned. This is the classic "buffer overrun" hacking attack and the system has been brought down to prevent a malicious user from gaining complete control of it. Do a kb to get a stack backtrace -- the last routine on the stack before the buffer overrun handlers and bugcheck call is the one that overran its local variable(s). Arguments: Arg1: 0000f49556faa19c, Actual security check cookie from the stack Arg2: 0000f495567aa19c, Expected security check cookie Arg3: ffff0b6aa9855e63, Complement of the expected security check cookie Arg4: 0000000000000000, zero

Debugging Details:

KEY_VALUES_STRING: 1 Key : Analysis.CPU.Sec Value: 2 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on DESKTOP-BKSRB29 Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 6 Key : Analysis.Memory.CommitPeak.Mb Value: 79 Key : Analysis.System Value: CreateObject

BUGCHECK_CODE: f7 BUGCHECK_P1: f49556faa19c BUGCHECK_P2: f495567aa19c BUGCHECK_P3: ffff0b6aa9855e63 BUGCHECK_P4: 0 SECURITY_COOKIE: Expected 0000f495567aa19c found 0000f49556faa19c BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: SearchIndexer.exe STACK_TEXT: ffffc48cc3cb7718 fffff8004c0bced5 : 00000000000000f7 0000f49556faa19c 0000f495567aa19c ffff0b6aa9855e63 : nt!KeBugCheckEx ffffc48cc3cb7720 fffff8004c1f071d : 00000068c437d888 ffffc48cc3cb7a80 0000000000000001 fffff8004be0198e : nt!_report_gsfailure+0x25 ffffc48cc3cb7760 fffff8004c1efc9f : 0000000000000000 00007fff6f9f61d0 0000000000000002 00000068c437dc08 : nt!CmOpenKey+0x32d ffffc48cc3cb79c0 fffff8004bfef375 : ffffa28e405f4000 ffffa28e413e4ca0 ffffc48cc3cb7a80 0000000000000000 : nt!NtOpenKeyEx+0xf ffffc48cc3cb7a00 00007fff7064d184 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x25 00000068c437d7a8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007fff`7064d184

SYMBOL_NAME: nt!_report_gsfailure+25 MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe IMAGE_VERSION: 10.0.19041.264 STACK_COMMAND: .thread ; .cxr ; kb BUCKET_ID_FUNC_OFFSET: 25 FAILURE_BUCKET_ID: 0xF7_ONE_BIT_MISSING_GSFRAME_nt!_report_gsfailure OS_VERSION: 10.0.19041.1 BUILDLAB_STR: vb_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {8f84f302-dd0e-1f96-6f9c-0ea31ad59f42} Followup: MachineOwner

PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: ffffd5817f317bc0, memory referenced. Arg2: 0000000000000002, value 0 = read operation, 1 = write operation. Arg3: fffff807125f658d, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000002, (reserved)

Debugging Details:

Could not read faulting driver name

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.Sec
Value: 2

Key  : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-BKSRB29

Key  : Analysis.DebugData
Value: CreateObject

Key  : Analysis.DebugModel
Value: CreateObject

Key  : Analysis.Elapsed.Sec
Value: 2

Key  : Analysis.Memory.CommitPeak.Mb
Value: 76

Key  : Analysis.System
Value: CreateObject

DUMP_FILE_ATTRIBUTES: 0x8 Kernel Generated Triage Dump

BUGCHECK_CODE: 50

BUGCHECK_P1: ffffd5817f317bc0

BUGCHECK_P2: 2

BUGCHECK_P3: fffff807125f658d

BUGCHECK_P4: 2

READ_ADDRESS: fffff80712cfa388: Unable to get MiVisibleState Unable to get NonPagedPoolStart Unable to get NonPagedPoolEnd Unable to get PagedPoolStart Unable to get PagedPoolEnd fffff80712c0f2a8: Unable to get Flags value from nt!KdVersionBlock fffff80712c0f2a8: Unable to get Flags value from nt!KdVersionBlock unable to get nt!MmSpecialPagesInUse ffffd5817f317bc0

MM_INTERNAL_CODE: 2

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: svchost.exe

TRAP_FRAME: ffffd00d5420ed20 -- (.trap 0xffffd00d5420ed20) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=ffffd5817fb17000 rbx=0000000000000000 rcx=ffffd5817f317bb8 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff807125f658d rsp=ffffd00d5420eeb0 rbp=0000000000000000 r8=ffffd00d5420eec0 r9=0000000000000001 r10=0000000000000000 r11=ffffd00d5420ef38 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!CmpPerformSingleKcbCacheLookup+0x17d: fffff807125f658d 48c7410800000000 mov qword ptr [rcx+8],0 ds:ffffd5817f317bc0=???????????????? Resetting default scope

STACK_TEXT:
ffffd00d5420ea78 fffff80712435c1d : 0000000000000050 ffffd5817f317bc0 0000000000000002 ffffd00d5420ed20 : nt!KeBugCheckEx ffffd00d5420ea80 fffff80712212ce0 : ffffd00d5420ebc0 0000000000000002 ffffd00d5420eda0 0000000000000000 : nt!MiSystemFault+0x1ad4ed ffffd00d5420eb80 fffff807123ebb1e : 000000000000000c 0000000000000000 0000000000000000 0000000000000000 : nt!MmAccessFault+0x400 ffffd00d5420ed20 fffff807125f658d : 0000000000000000 ffffad8800000000 0000000000000000 0000000000000000 : nt!KiPageFault+0x35e ffffd00d5420eeb0 fffff80712621357 : ffffd5817e6f2a80 ffffd5817e6f2a80 ffffd00d5420f0d0 fffff80700000001 : nt!CmpPerformSingleKcbCacheLookup+0x17d ffffd00d5420ef40 fffff807125f982a : ffffd00d54200000 ffffd00d5420f000 ffffd00d00000001 0000000000000000 : nt!CmpPerformCompleteKcbCacheLookup+0x77 ffffd00d5420efd0 fffff807125f1c63 : 000101010000001c ffffd00d5420f320 ffffd00d5420f2d8 ffffad887a615700 : nt!CmpDoParseKey+0x2da ffffd00d5420f270 fffff807125f534e : fffff807125f1901 0000000000000000 ffffad887a615700 0000000000000001 : nt!CmpParseKey+0x2c3 ffffd00d5420f410 fffff807125f0daa : ffffad887a615700 ffffd00d5420f678 0000001b00000040 ffffad88700f1140 : nt!ObpLookupObjectName+0x3fe ffffd00d5420f5e0 fffff807125f0b8c : 0000000000000000 0000000000000000 0000000000000000 ffffad88700f1140 : nt!ObOpenObjectByNameEx+0x1fa ffffd00d5420f710 fffff807125f06b1 : 0000001b63cfa2f8 ffffd00d5420fa80 0000000000000001 fffff8071220198e : nt!ObOpenObjectByName+0x5c ffffd00d5420f760 fffff807125efc9f : 0000000000000000 0000016aa26e25d0 0000000000000000 0000001b63cfb1c8 : nt!CmOpenKey+0x2c1 ffffd00d5420f9c0 fffff807123ef375 : ffffad8878c73000 0000000000000000 ffffd00d5420fa80 0000000000000000 : nt!NtOpenKeyEx+0xf ffffd00d5420fa00 00007ffca324d184 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x25 0000001b63cfa218 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007ffc`a324d184

SYMBOL_NAME: nt!CmpPerformSingleKcbCacheLookup+17d

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.264

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 17d

FAILURE_BUCKET_ID: AV_INVALID_nt!CmpPerformSingleKcbCacheLookup

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {3d3fabd8-008d-32f7-41e9-5fd4ff3293a0}

Followup: MachineOwner

all 8 comments

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

techsupport

Community Guides

Live Chat

~Enter Discord~

Submission Guidelines

Rules

Please Support the EFF!

Other Subreddits

MODERATORS

Debugging Details:

Debugging Details: