............................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 139, {3, ffffd000399d3350, ffffd000399d32a8, 0}
*** WARNING: Unable to verify timestamp for NMgamingms.sys
*** ERROR: Module load completed but symbols could not be loaded for NMgamingms.sys
Probably caused by : NMgamingms.sys ( NMgamingms+1cbb )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffd000399d3350, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd000399d32a8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
TRAP_FRAME: ffffd000399d3350 -- (.trap 0xffffd000399d3350)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe00004e9c818 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffe000078746f8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800f7cfc4e2 rsp=ffffd000399d34e0 rbp=0000000000000000
r8=ffffe00004e9a1c8 r9=00000000000007ff r10=ffffd00020c292c0
r11=ffffc0000bc42160 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl nz na po cy
nt!ExInterlockedInsertHeadList+0xae:
fffff800`f7cfc4e2 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffd000399d32a8 -- (.exr 0xffffd000399d32a8)
ExceptionAddress: fffff800f7cfc4e2 (nt!ExInterlockedInsertHeadList+0x00000000000000ae)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT
BUGCHECK_STR: 0x139
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_PARAMETER1: 0000000000000003
LAST_CONTROL_TRANSFER: from fffff800f7d5b7e9 to fffff800f7d4fca0
STACK_TEXT:
ffffd000`399d3028 fffff800`f7d5b7e9 : 00000000`00000139 00000000`00000003 ffffd000`399d3350 ffffd000`399d32a8 : nt!KeBugCheckEx
ffffd000`399d3030 fffff800`f7d5bb10 : 00000000`0f1af573 00000001`00000000 00000003`00000000 00000000`00000003 : nt!KiBugCheckDispatch+0x69
ffffd000`399d3170 fffff800`f7d5ad34 : 00000000`00002478 00000000`00000000 00000000`00000000 00000000`00000080 : nt!KiFastFailDispatch+0xd0
ffffd000`399d3350 fffff800`f7cfc4e2 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffe000`04e9a1b0 : nt!KiRaiseSecurityCheckFailure+0xf4
ffffd000`399d34e0 fffff800`02df5cbb : ffffe000`078746d0 00000000`00000002 ffffe000`0791c2a0 ffffe000`04e9a1b0 : nt!ExInterlockedInsertHeadList+0xae
ffffd000`399d3520 ffffe000`078746d0 : 00000000`00000002 ffffe000`0791c2a0 ffffe000`04e9a1b0 00000000`00000000 : NMgamingms+0x1cbb
ffffd000`399d3528 00000000`00000002 : ffffe000`0791c2a0 ffffe000`04e9a1b0 00000000`00000000 00000000`00000000 : 0xffffe000`078746d0
ffffd000`399d3530 ffffe000`0791c2a0 : ffffe000`04e9a1b0 00000000`00000000 00000000`00000000 ffffd000`399d3580 : 0x2
ffffd000`399d3538 ffffe000`04e9a1b0 : 00000000`00000000 00000000`00000000 ffffd000`399d3580 fffff800`f7e929b1 : 0xffffe000`0791c2a0
ffffd000`399d3540 00000000`00000000 : 00000000`00000000 ffffd000`399d3580 fffff800`f7e929b1 ffffe000`04e9f060 : 0xffffe000`04e9a1b0
STACK_COMMAND: kb
FOLLOWUP_IP:
NMgamingms+1cbb
fffff800`02df5cbb ?? ???
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: NMgamingms+1cbb
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: NMgamingms
IMAGE_NAME: NMgamingms.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a6976ec
FAILURE_BUCKET_ID: 0x139_3_NMgamingms+1cbb
BUCKET_ID: 0x139_3_NMgamingms+1cbb
Followup: MachineOwner
---------