Microsoft (R) Windows Debugger Version 10.0.21306.1007 AMD64Copyright (c) Microsoft Corporation. All rights reserved.Loading Dump File [C:\Windows\minidump\082623-12718-01.dmp]Mini Kernel Dump File: Only registers and stack trace are availableSymbol search path is: srv*Executable search path is: Windows 10 Kernel Version 18362 MP (6 procs) Free x64Product: WinNt, suite: TerminalServer SingleUserTSMachine Name:Kernel base = 0xfffff806`40c00000 PsLoadedModuleList = 0xfffff806`41048210Debug session time: Sat Aug 26 21:41:13.344 2023 (UTC + 8:00)System Uptime: 0 days 0:17:00.154Loading Kernel Symbols.Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.Run !sym noisy before .reload to track down problems loading symbols..................................................................................................................................................................................................................Loading User SymbolsLoading unloaded module list.............For analysis of this file, run !analyze -vnt!KeBugCheckEx:fffff806`40dc1220 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff9c88`30a664d0=00000000000001395: kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************KERNEL_SECURITY_CHECK_FAILURE (139)A kernel component has corrupted a critical data structure. The corruptioncould potentially allow a malicious user to gain control of this machine.Arguments:Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).Arg2: ffff9c8830a667f0, Address of the trap frame for the exception that caused the bugcheckArg3: ffff9c8830a66748, Address of the exception record for the exception that caused the bugcheckArg4: 0000000000000000, ReservedDebugging Details:------------------KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 2014 Key : Analysis.DebugAnalysisManager Value: Create Key : Analysis.Elapsed.mSec Value: 21696 Key : Analysis.Init.CPU.mSec Value: 624 Key : Analysis.Init.Elapsed.mSec Value: 975029 Key : Analysis.Memory.CommitPeak.Mb Value: 74 Key : FailFast.Name Value: CORRUPT_LIST_ENTRY Key : FailFast.Type Value: 3DUMP_FILE_ATTRIBUTES: 0x8 Kernel Generated Triage DumpBUGCHECK_CODE: 139BUGCHECK_P1: 3BUGCHECK_P2: ffff9c8830a667f0BUGCHECK_P3: ffff9c8830a66748BUGCHECK_P4: 0TRAP_FRAME: ffff9c8830a667f0 -- (.trap 0xffff9c8830a667f0)NOTE: The trap frame does not contain all registers.Some register values may be zeroed or incorrect.rax=ffffe78cad003f18 rbx=0000000000000000 rcx=0000000000000003rdx=ffffe78ccacbc001 rsi=0000000000000000 rdi=0000000000000000rip=fffff80640df4f4b rsp=ffff9c8830a66980 rbp=ffff9c8830a66a80 r8=ffffe78cad003f08 r9=ffffe78cad003f18 r10=ffffe78cc1970000r11=ffffe78cad001b40 r12=0000000000000000 r13=0000000000000000r14=0000000000000000 r15=0000000000000000iopl=0 nv up ei pl nz na po cynt!RtlpHpLfhSlotAllocate+0x1c174b:fffff806`40df4f4b cd29 int 29hResetting default scopeEXCEPTION_RECORD: ffff9c8830a66748 -- (.exr 0xffff9c8830a66748)ExceptionAddress: fffff80640df4f4b (nt!RtlpHpLfhSlotAllocate+0x00000000001c174b) ExceptionCode: c0000409 (Security check failure or stack buffer overrun) ExceptionFlags: 00000001NumberParameters: 1 Parameter[0]: 0000000000000003Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY BLACKBOXBSD: 1 (!blackboxbsd)BLACKBOXNTFS: 1 (!blackboxntfs)BLACKBOXPNP: 1 (!blackboxpnp)BLACKBOXWINLOGON: 1CUSTOMER_CRASH_COUNT: 1PROCESS_NAME: svchost.exeERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>EXCEPTION_CODE_STR: c0000409EXCEPTION_PARAMETER1: 0000000000000003EXCEPTION_STR: 0xc0000409STACK_TEXT: ffff9c88`30a664c8 fffff806`40dd30e9 : 00000000`00000139 00000000`00000003 ffff9c88`30a667f0 ffff9c88`30a66748 : nt!KeBugCheckExffff9c88`30a664d0 fffff806`40dd3510 : ffff8003`26442740 fffff806`40c36a3a 00000000`00000000 ffff8003`26442d2c : nt!KiBugCheckDispatch+0x69ffff9c88`30a66610 fffff806`40dd18a5 : 00000000`00000150 fffff806`4374e24c ffffe78c`cb435550 ffff8003`3282b190 : nt!KiFastFailDispatch+0xd0ffff9c88`30a667f0 fffff806`40df4f4b : 00000000`000000ff 00000000`0000003a 00000000`000caadc 00000000`00000050 : nt!KiRaiseSecurityCheckFailure+0x325ffff9c88`30a66980 fffff806`40c33254 : ffffe78c`ad000340 ffffe78c`ad001b40 ffffe78c`ad003f00 fffff806`00000050 : nt!RtlpHpLfhSlotAllocate+0x1c174bffff9c88`30a66ae0 fffff806`40f6f06d : ffff9c88`00000001 00000000`00000000 00000000`00000000 00000000`00000038 : nt!ExAllocateHeapPool+0xb94ffff9c88`30a66c20 fffff806`9cbfa350 : ffff9c88`30a66f28 ffff9c88`30a66d20 00000000`00000000 00000000`00000000 : nt!ExAllocatePoolWithTag+0x5dffff9c88`30a66c70 fffff806`9cbf5b9e : 00000000`00000000 00000000`00000000 ffff8003`2e3bf060 ffff9c88`30a66f28 : bindflt!BfAllocateUnicodeString+0x30ffff9c88`30a66ca0 fffff806`9cbe35c7 : ffff8003`2ac3bb30 00000000`00000000 00000000`00000000 ffff9c88`30a66d10 : bindflt!BfMappingLookup+0x106ffff9c88`30a66d60 fffff806`9cbee754 : ffff8003`2ac3bb30 00000000`00000000 ffff9c88`30a66ee0 00000000`00000000 : bindflt!BfCombinedMappingLookup+0x11bffff9c88`30a66de0 fffff806`43714a5d : ffff8003`347ec9a0 00000000`00000000 00000000`00000000 00000000`00000000 : bindflt!BfPreCreate+0x3d4ffff9c88`30a67170 fffff806`437145a0 : ffff9c88`30a672f0 ffff9c88`30a67300 ffff9c88`30a67200 00000000`00000000 : FLTMGR!FltpPerformPreCallbacks+0x2fdffff9c88`30a67280 fffff806`4374cd13 : fffff806`43739060 00000000`00000090 00000000`00000000 00000000`00000000 : FLTMGR!FltpPassThroughInternal+0x90ffff9c88`30a672b0 fffff806`40c31f39 : 00000000`00000000 fffff806`411e5905 00000000`00000000 00000000`00000000 : FLTMGR!FltpCreate+0x2f3ffff9c88`30a67360 fffff806`40c30fe4 : 00000000`00000003 00000000`00000000 00000000`00000000 fffff806`40c317a3 : nt!IofCallDriver+0x59ffff9c88`30a673a0 fffff806`411e5ffb : ffff9c88`30a67660 fffff806`411e5905 ffff9c88`30a675d0 ffff8003`334dbab0 : nt!IoCallDriverWithTracing+0x34ffff9c88`30a673f0 fffff806`411ecfcf : ffff8003`2625f8f0 ffff8003`2625f805 ffff8003`351d4560 00000000`00000001 : nt!IopParseDevice+0x62bffff9c88`30a67560 fffff806`411eb431 : ffff8003`351d4500 ffff9c88`30a677a8 000000e8`00000840 ffff8003`226f5380 : nt!ObpLookupObjectName+0x78fffff9c88`30a67720 fffff806`41230300 : 00000000`00000001 000000e8`dbafe9b8 00000000`00000001 00000000`00000000 : nt!ObOpenObjectByNameEx+0x201ffff9c88`30a67860 fffff806`4122fa38 : 000000e8`dbafe980 00000000`00100021 000000e8`dbafe9b8 000000e8`dbafe9a8 : nt!IopCreateFile+0x820ffff9c88`30a67900 fffff806`40dd2b15 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtOpenFile+0x58ffff9c88`30a67990 00007ff8`c6bbc724 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25000000e8`dbafe938 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`c6bbc724SYMBOL_NAME: bindflt!BfAllocateUnicodeString+30MODULE_NAME: bindfltIMAGE_NAME: bindflt.sysIMAGE_VERSION: 10.0.18362.592STACK_COMMAND: .thread ; .cxr ; kbBUCKET_ID_FUNC_OFFSET: 30FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_bindflt!BfAllocateUnicodeStringOSPLATFORM_TYPE: x64OSNAME: Windows 10FAILURE_ID_HASH: {fc69b160-4bfa-42b0-fd70-69b75ce7ed08}Followup: MachineOwner---------5: kd> lmvm bindfltBrowse full module liststart end module namefffff806`9cbe0000 fffff806`9cc01000 bindflt # (pdb symbols) C:\ProgramData\Dbg\sym\bindflt.pdb\40BD96D55954F7724523CE18110C35B91\bindflt.pdb Loaded symbol image file: bindflt.sys Mapped memory image file: C:\ProgramData\Dbg\sym\bindflt.sys\29520F5A21000\bindflt.sys Image path: bindflt.sys Image name: bindflt.sys Browse all global symbols functions data Image was built with /Brepro flag. Timestamp: 29520F5A (This is a reproducible build file hash, not a timestamp) CheckSum: 000219DF ImageSize: 00021000 File version: 10.0.18362.592 Product version: 10.0.18362.592 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 Information from resource tables: CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: bindflt.sys OriginalFilename: bindflt.sys ProductVersion: 10.0.18362.592 FileVersion: 10.0.18362.592 (WinBuild.160101.0800) FileDescription: Windows Bind Filter Driver LegalCopyright: © Microsoft Corporation. All rights reserved.