Microsoft (R) Windows Debugger Version 10.0.22549.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\MEMORY.DMP] Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available. Dump completed successfully, progress percentage: 100 ************* Path validation summary ************** Response Time (ms) Location Deferred srv*C:\symbols*https://msdl.microsoft.com/download/symbols Symbol search path is: srv*C:\symbols*https://msdl.microsoft.com/download/symbols Executable search path is: Windows 10 Kernel Version 22000 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Edition build lab: 22000.1.amd64fre.co_release.210604-1628 Machine Name: Kernel base = 0xfffff802`68c00000 PsLoadedModuleList = 0xfffff802`69829b90 Debug session time: Thu Mar 3 00:25:22.205 2022 (UTC + 1:00) System Uptime: 5 days 9:43:40.329 Loading Kernel Symbols ............................................................... ................................................................ ...........................Page 846e7a not present in the dump file. Type ".hh dbgerr004" for details .Page 846f22 not present in the dump file. Type ".hh dbgerr004" for details .................................... ................ Loading User Symbols PEB is paged out (Peb.Ldr = 00000080`363f6018). Type ".hh dbgerr001" for details Loading unloaded module list .................................................. For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff802`690164c0 48894c2408 mov qword ptr [rsp+8],rcx ss:fffffe85`d6beb280=000000000000000a 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 0000000000000028, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80268f1c823, address which referenced memory Debugging Details: ------------------ Page 846e7a not present in the dump file. Type ".hh dbgerr004" for details KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 2312 Key : Analysis.DebugAnalysisManager Value: Create Key : Analysis.Elapsed.mSec Value: 2416 Key : Analysis.Init.CPU.mSec Value: 312 Key : Analysis.Init.Elapsed.mSec Value: 7531 Key : Analysis.Memory.CommitPeak.Mb Value: 99 Key : WER.OS.Branch Value: co_release Key : WER.OS.Timestamp Value: 2021-06-04T16:28:00Z Key : WER.OS.Version Value: 10.0.22000.1 FILE_IN_CAB: MEMORY.DMP DUMP_FILE_ATTRIBUTES: 0x1000 BUGCHECK_CODE: a BUGCHECK_P1: 28 BUGCHECK_P2: 2 BUGCHECK_P3: 0 BUGCHECK_P4: fffff80268f1c823 READ_ADDRESS: 0000000000000028 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 PROCESS_NAME: MsMpEng.exe TRAP_FRAME: fffffe85d6beb3c0 -- (.trap 0xfffffe85d6beb3c0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=ffffaafffffe9ce0 rdx=fffff80269852d50 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80268f1c823 rsp=fffffe85d6beb550 rbp=ffff9f0000000000 r8=fffff80269852c58 r9=0000000000000000 r10=00000000000007ff r11=fffffe85d6beb580 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!MiLockPageInline+0x33: fffff802`68f1c823 724c jb nt!MiLockPageInline+0x81 (fffff802`68f1c871) [br=0] Resetting default scope STACK_TEXT: fffffe85`d6beb278 fffff802`690290a9 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx fffffe85`d6beb280 fffff802`69025200 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69 fffffe85`d6beb3c0 fffff802`68f1c823 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffbe5f`2f97cbe0 : nt!KiPageFault+0x440 fffffe85`d6beb550 fffff802`68f1899f : ffff8002`00000000 00000000`0000009c ffffd401`f1178978 fffff802`68f12cd6 : nt!MiLockPageInline+0x33 fffffe85`d6beb580 fffff802`68f143af : 00000000`0000001c fffffe85`d6beb6e0 ffffd401`f1178978 fffffe85`d6beb940 : nt!MiCreateDecayPfn+0x12f fffffe85`d6beb5e0 fffff802`68f125f7 : 00000000`00000011 00000000`00000003 ffff8002`dbb84d90 fffff802`00000000 : nt!MiFinishHardFault+0x29f fffffe85`d6beb780 fffff802`68ea690b : 00000000`c0033333 00000000`00000001 00007ffe`4c5ef72c 00000000`00000000 : nt!MiIssueHardFault+0x1d7 fffffe85`d6beb880 fffff802`690250f5 : ffff8002`d2cc9080 ffff8002`b81ceaf0 00000080`3affd150 00000000`00000000 : nt!MmAccessFault+0x35b fffffe85`d6beba20 00007ffe`a5bf9d51 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x335 00000080`3affd0a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`a5bf9d51 SYMBOL_NAME: nt!MiLockPageInline+33 MODULE_NAME: nt STACK_COMMAND: .cxr; .ecxr ; kb IMAGE_NAME: ntkrnlmp.exe BUCKET_ID_FUNC_OFFSET: 33 FAILURE_BUCKET_ID: AV_nt!MiLockPageInline OS_VERSION: 10.0.22000.1 BUILDLAB_STR: co_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {e8e645b9-9052-440f-c9a6-e5d533d26fbd} Followup: MachineOwner ---------