Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\jstuhlmiller\Desktop\Lauzon10\MEMORY.DMP] Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available. Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 17134 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 17134.1.amd64fre.rs4_release.180410-1804 Machine Name: Kernel base = 0xfffff800`0ca0b000 PsLoadedModuleList = 0xfffff800`0cdb9150 Debug session time: Fri Feb 8 18:21:12.816 2019 (UTC - 5:00) System Uptime: 4 days 8:56:17.904 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ .. Loading User Symbols Loading unloaded module list ..................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 139, {3, ffff988cc7926fd0, ffff988cc7926f28, 0} *** ERROR: Module load completed but symbols could not be loaded for igdkmd64.sys Probably caused by : igdkmd64.sys ( igdkmd64+d2ce ) Followup: MachineOwner --------- 7: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_SECURITY_CHECK_FAILURE (139) A kernel component has corrupted a critical data structure. The corruption could potentially allow a malicious user to gain control of this machine. Arguments: Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove). Arg2: ffff988cc7926fd0, Address of the trap frame for the exception that caused the bugcheck Arg3: ffff988cc7926f28, Address of the exception record for the exception that caused the bugcheck Arg4: 0000000000000000, Reserved Debugging Details: ------------------ KEY_VALUES_STRING: 1 STACKHASH_ANALYSIS: 1 TIMELINE_ANALYSIS: 1 DUMP_CLASS: 1 DUMP_QUALIFIER: 401 BUILD_VERSION_STRING: 17134.1.amd64fre.rs4_release.180410-1804 SYSTEM_MANUFACTURER: LENOVO SYSTEM_PRODUCT_NAME: 10MQS8YG00 SYSTEM_SKU: LENOVO_MT_10MQ_BU_LENOVO_FM_ThinkCentre M710q SYSTEM_VERSION: ThinkCentre M710q BIOS_VENDOR: LENOVO BIOS_VERSION: M1AKT35A BIOS_DATE: 03/21/2018 BASEBOARD_MANUFACTURER: LENOVO BASEBOARD_PRODUCT: 3111 BASEBOARD_VERSION: SDK0J40697 WIN 3305113365045 DUMP_TYPE: 1 BUGCHECK_P1: 3 BUGCHECK_P2: ffff988cc7926fd0 BUGCHECK_P3: ffff988cc7926f28 BUGCHECK_P4: 0 TRAP_FRAME: ffff988cc7926fd0 -- (.trap 0xffff988cc7926fd0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=ffff9d84cd1007e8 rbx=0000000000000000 rcx=0000000000000003 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff8000cb77160 rsp=ffff988cc7927160 rbp=0000000000000000 r8=ffff9d84e0df4960 r9=ffff83001c800000 r10=ffff83001c7b9180 r11=ffff9d84d7b7d700 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz ac po cy nt!KeDeregisterBugCheckReasonCallback+0x80: fffff800`0cb77160 cd29 int 29h Resetting default scope EXCEPTION_RECORD: ffff988cc7926f28 -- (.exr 0xffff988cc7926f28) ExceptionAddress: fffff8000cb77160 (nt!KeDeregisterBugCheckReasonCallback+0x0000000000000080) ExceptionCode: c0000409 (Security check failure or stack buffer overrun) ExceptionFlags: 00000001 NumberParameters: 1 Parameter[0]: 0000000000000003 Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY CPU_COUNT: 8 CPU_MHZ: b58 CPU_VENDOR: GenuineIntel CPU_FAMILY: 6 CPU_MODEL: 9e CPU_STEPPING: 9 CPU_MICROCODE: 6,9e,9,0 (F,M,S,R) SIG: 84'00000000 (cache) 84'00000000 (init) BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXPNP: 1 (!blackboxpnp) BUGCHECK_STR: 0x139 PROCESS_NAME: System CURRENT_IRQL: f DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. EXCEPTION_CODE_STR: c0000409 EXCEPTION_PARAMETER1: 0000000000000003 ANALYSIS_SESSION_HOST: STUHLMILLER10 ANALYSIS_SESSION_TIME: 02-11-2019 15:15:33.0730 ANALYSIS_VERSION: 10.0.17763.132 amd64fre LAST_CONTROL_TRANSFER: from fffff8000cbc5c69 to fffff8000cbb50a0 STACK_TEXT: ffff988c`c7926ca8 fffff800`0cbc5c69 : 00000000`00000139 00000000`00000003 ffff988c`c7926fd0 ffff988c`c7926f28 : nt!KeBugCheckEx ffff988c`c7926cb0 fffff800`0cbc6010 : 00000000`00000000 ffff988c`c7926e60 ffff9d84`debe44c0 fffff800`0caa0086 : nt!KiBugCheckDispatch+0x69 ffff988c`c7926df0 fffff800`0cbc461f : 00000000`00030e03 00000000`00000000 00000000`00000000 fffff800`0cbc5743 : nt!KiFastFailDispatch+0xd0 ffff988c`c7926fd0 fffff800`0cb77160 : 00000000`00000010 00000000`00000086 ffff988c`c7927188 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x2df ffff988c`c7927160 fffff80d`2729d2ce : fffff80d`275e1d90 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeDeregisterBugCheckReasonCallback+0x80 ffff988c`c7927190 fffff80d`25f0d7b9 : 00000000`00000000 ffff9d84`00030e03 fffff80d`25d7b9e8 0000000c`00000003 : igdkmd64+0xd2ce ffff988c`c7927220 fffff80d`25efdaf1 : 00000000`c00000bb ffff988c`c79273b0 ffff9d84`d00d1af0 ffff9d84`d00b1180 : dxgkrnl!DpiDxgkDdiStopDeviceAndReleasePostDisplayOwnership+0x75 ffff988c`c7927280 fffff80d`25efd8cd : 00000000`00000001 00000000`00000000 ffff9d84`d00b1de0 00000000`00000000 : dxgkrnl!DpiFdoStopDeviceAndReleasePostDisplayOwnership+0x71 ffff988c`c79272b0 fffff80d`25ef86c8 : ffff9d84`e2188b40 ffff9d84`e2188b02 ffff9d84`d00b1180 ffff9d84`d00b1030 : dxgkrnl!DpiFdoStopAdapter+0x565 ffff988c`c7927400 fffff80d`25ef7cd5 : 00000000`00000000 fffff800`0cfda300 ffff9d84`e2188b40 ffff9d84`e2188b40 : dxgkrnl!DpiFdoHandleStopDevice+0xd8 ffff988c`c79274b0 fffff80d`25ef638b : ffff9d84`d00b1102 ffff9d84`e2188b40 00000000`c00000bb 00000000`0000000e : dxgkrnl!DpiFdoHandleRemoveDevice+0xa5 ffff988c`c7927500 fffff80d`25db3529 : ffff9d84`d00b1030 00000000`00000000 ffff9d84`e2188b40 00000000`00000000 : dxgkrnl!DpiFdoDispatchPnp+0x5b ffff988c`c7927540 fffff800`0caa3e69 : 00000000`00000000 fffff800`0caa4135 ffff9d84`d00b1030 00000000`69706e04 : dxgkrnl!DpiDispatchPnp+0xe9 ffff988c`c7927660 fffff800`0ceaeb7d : ffff9d84`d00b1030 00000000`00000000 ffff988c`c7927750 fffff800`0cfd05c9 : nt!IofCallDriver+0x59 ffff988c`c79276a0 fffff800`0cfd03a5 : 00000000`00000002 ffff988c`c7927769 ffff9d84`cbe1cd20 ffff9d84`cbe37060 : nt!IopSynchronousCall+0xe5 ffff988c`c7927710 fffff800`0cb4fcb1 : ffffcb06`4e058800 ffff9d84`cbe1cd20 00000000`0000000a ffff9d84`00000000 : nt!IopRemoveDevice+0x105 ffff988c`c79277d0 fffff800`0cfd12a7 : ffff9d84`cbe1cd20 cb3a4008`00000015 60008fb0`00000000 00000000`3f051397 : nt!PnpRemoveLockedDeviceNode+0x1ad ffff988c`c7927830 fffff800`0cfd0fba : 00000000`00000000 ffff988c`c79278b0 ffffcb06`434985c0 00000000`00000001 : nt!PnpDeleteLockedDeviceNode+0x8b ffff988c`c7927870 fffff800`0d0c474b : ffff9d84`cbe37060 ffffcb06`00000002 ffff9d84`cbe37060 ffffcb06`434985c0 : nt!PnpDeleteLockedDeviceNodes+0xba ffff988c`c79278e0 fffff800`0cfd2e26 : ffff988c`c7927a30 ffffcb06`5d8bd800 fffff800`0cf44600 00000000`00000003 : nt!PnpProcessQueryRemoveAndEject+0xf5603 ffff988c`c79279d0 fffff800`0cf449b3 : ffffcb06`4e058800 ffffcb06`5d8bd890 ffffcb06`5d8bd890 00000000`00000000 : nt!PnpProcessTargetDeviceEvent+0xee ffff988c`c7927a00 fffff800`0cac0b05 : 00000000`00000600 ffff9d84`d7b7d700 fffff800`0cf446e0 ffff9d84`c9f08d20 : nt!PnpDeviceEventWorker+0x2d3 ffff988c`c7927a80 fffff800`0cb3b2d7 : ffff9d84`d7b7d700 00000000`00000080 ffff9d84`c9e93040 ffff9d84`d7b7d700 : nt!ExpWorkerThread+0xf5 ffff988c`c7927b10 fffff800`0cbbc516 : ffff8300`1c71a180 ffff9d84`d7b7d700 fffff800`0cb3b290 00000000`0000a5a1 : nt!PspSystemThreadStartup+0x47 ffff988c`c7927b60 00000000`00000000 : ffff988c`c7928000 ffff988c`c7921000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16 THREAD_SHA1_HASH_MOD_FUNC: f7d68aba838cd200abf459c1796a4fcaf954d102 THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 8d09e8eedbb44a7cc68aeed687286b3b22416f8b THREAD_SHA1_HASH_MOD: 41ce8b3fc212ddce9f49b316e22d57ed0473c9ed FOLLOWUP_IP: igdkmd64+d2ce fffff80d`2729d2ce 84c0 test al,al FAULT_INSTR_CODE: 2e75c084 SYMBOL_STACK_INDEX: 5 SYMBOL_NAME: igdkmd64+d2ce FOLLOWUP_NAME: MachineOwner MODULE_NAME: igdkmd64 IMAGE_NAME: igdkmd64.sys DEBUG_FLR_IMAGE_TIMESTAMP: 5c0ebaea IMAGE_VERSION: 25.20.100.6472 STACK_COMMAND: .thread ; .cxr ; kb BUCKET_ID_FUNC_OFFSET: d2ce FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_igdkmd64!unknown_function BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_igdkmd64!unknown_function PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_igdkmd64!unknown_function TARGET_TIME: 2019-02-08T23:21:12.000Z OSBUILD: 17134 OSSERVICEPACK: 0 SERVICEPACK_NUMBER: 0 OS_REVISION: 0 SUITE_MASK: 272 PRODUCT_TYPE: 1 OSPLATFORM_TYPE: x64 OSNAME: Windows 10 OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS OS_LOCALE: USER_LCID: 0 OSBUILD_TIMESTAMP: 2019-01-01 01:44:13 BUILDDATESTAMP_STR: 180410-1804 BUILDLAB_STR: rs4_release BUILDOSVER_STR: 10.0.17134.1.amd64fre.rs4_release.180410-1804 ANALYSIS_SESSION_ELAPSED_TIME: 59e ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_igdkmd64!unknown_function FAILURE_ID_HASH: {d0edad2c-7fcd-bd17-2474-8b343d8af647} Followup: MachineOwner ---------