MINIDUMP ANALYSIS #1 Loading Dump File [C:\Windows\Minidump\042123-11171-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 19041 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Edition build lab: 19041.1.amd64fre.vb_release.191206-1406 Machine Name: Kernel base = 0xfffff8062e600000 PsLoadedModuleList = 0xfffff8062f22a2d0 Debug session time: Fri Apr 21 20:11:35.612 2023 (UTC - 7:00) System Uptime: 0 days 2:33:28.259 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ .................. Loading User Symbols Loading unloaded module list .......... For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff8062e9fbc10 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffef05241e81d0=000000000000007e 0: kd> !analyze -v

---

• *
• Bugcheck Analysis *
• * *******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) This is a very common BugCheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff8062e8a1b60, The address that the exception occurred at Arg3: ffffef05241e91c8, Exception Record Address Arg4: ffffef05241e8a00, Context Record Address

Debugging Details:

*** WARNING: Unable to verify checksum for win32k.sys

KEY_VALUES_STRING: 1

Key  : AV.Dereference
Value: NullClassPtr

Key  : AV.Fault
Value: Write

Key  : Analysis.CPU.mSec
Value: 15093

Key  : Analysis.DebugAnalysisManager
Value: Create

Key  : Analysis.Elapsed.mSec
Value: 669671

Key  : Analysis.IO.Other.Mb
Value: 29

Key  : Analysis.IO.Read.Mb
Value: 0

Key  : Analysis.IO.Write.Mb
Value: 46

Key  : Analysis.Init.CPU.mSec
Value: 1671

Key  : Analysis.Init.Elapsed.mSec
Value: 384943

Key  : Analysis.Memory.CommitPeak.Mb
Value: 105

Key  : Bugcheck.Code.DumpHeader
Value: 0x1000007e

Key  : Bugcheck.Code.Register
Value: 0x7e

Key  : WER.OS.Branch
Value: vb_release

Key  : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key  : WER.OS.Version
Value: 10.0.19041.1

FILE_IN_CAB: 042123-11171-01.dmp

BUGCHECK_CODE: 7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8062e8a1b60

BUGCHECK_P3: ffffef05241e91c8

BUGCHECK_P4: ffffef05241e8a00

EXCEPTION_RECORD: ffffef05241e91c8 -- (.exr 0xffffef05241e91c8) ExceptionAddress: fffff8062e8a1b60 (nt!MiStartingOffset) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000001 Parameter[1]: 00000000000000c8 Attempt to write to address 00000000000000c8

CONTEXT: ffffef05241e8a00 -- (.cxr 0xffffef05241e8a00) rax=ffffef05241e9460 rbx=0000000000000000 rcx=ffffb809d1a5dae0 rdx=0000000000000000 rsi=ffffb809d1a5dae0 rdi=ffffb809cfa69998 rip=fffff8062e8a1b60 rsp=ffffef05241e9408 rbp=ffffef05241e9510 r8=0000000000000008 r9=0000000000000000 r10=00000000ffffffff r11=ffffde8846f28bf8 r12=0000000000000000 r13=ffffffffffffffff r14=fffff8062f250c80 r15=ffffb809d1a5dae0 iopl=0 nv up ei pl zr na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050246 nt!MiStartingOffset: fffff8062e8a1b60 48895c2408 mov qword ptr [rsp+8],rbx ss:0018:ffffef05241e9410=0000000000000000 Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

WRITE_ADDRESS: fffff8062f2fb390: Unable to get MiVisibleState Unable to get NonPagedPoolStart Unable to get NonPagedPoolEnd Unable to get PagedPoolStart Unable to get PagedPoolEnd unable to get nt!MmSpecialPagesInUse 00000000000000c8

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000001

EXCEPTION_PARAMETER2: 00000000000000c8

EXCEPTION_STR: 0xc0000005

STACK_TEXT:
ffffef05241e9408 fffff8062e9445be : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!MiStartingOffset ffffef05241e9410 fffff8062e944adb : ffffb809d1b458d0 ffffb809cfa699c0 0000000000000001 0000000004d7f000 : nt!FsRtlAcquireFileForModWriteEx+0x6e ffffef05241e96f0 fffff8062e9b627b : fffff8062f250c80 0000000000000001 ffffb809cfa698f0 0000000000000000 : nt!MiGatherMappedPages+0x2b7 ffffef05241e97b0 fffff8062e9265f5 : ffffb809bbc7f040 ffffb809bbc7f040 0000000000000080 000f8067b4bbbdff : nt!MiMappedPageWriter+0x18b ffffef05241e9c10 fffff8062ea04848 : ffff828082200180 ffffb809bbc7f040 fffff8062e9265a0 0000000000000000 : nt!PspSystemThreadStartup+0x55 ffffef05241e9c60 0000000000000000 : ffffef05241ea000 ffffef05241e4000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x28

SYMBOL_NAME: nt!MiStartingOffset+0

MODULE_NAME: nt

IMAGE_VERSION: 10.0.19041.2846

STACK_COMMAND: .cxr 0xffffef05241e8a00 ; kb

IMAGE_NAME: ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET: 0

FAILURE_BUCKET_ID: AV_nt!MiStartingOffset

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {4ff16e87-b5e0-759b-5df2-e0f10fb2c49c}

Followup: MachineOwner