Windows 10: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

Hello,Few days ago i had a random blue screen without any error messages, from there my computer started to randomly reboot due to a TPM error seen in minidump files.After updating the bios as stated on another thread, i got a new error which resulted in a BSOD when rebooting my computer. This time the BSOD has shown the following error : KERNEL_SECURITY_CHECK_FAILUREHere is the minidump file created after that error : https://drive.google.com/file/d/1X_qbX7Xxc9kDxhvf3gvYwaaWfEAPrBK0/view?usp=sharing

:)

 

0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

I'm hoping someone here can help. My son recently rebuilt an old Alienware with new hardware for me, it was on windows 10 and then we upgraded to windows 11 but there were some issues with some of the apps so he made a change to the configuration and I think it's still Windows 11 but it shows as Windows 10. Prior to this rebuild the computer was bsod a few times a week, and unfortunately it still is doing that, sometimes multiple times a day. I've had a couple of people look at this and we can't seem to pinpoint the issue and I'm hopeful that someone here will be able to help. Thank you!

Enclosed is the link for the debug file

https://drive.google.com/file/d/1IrXW9-4BALNZECc6XIkDQrEjUI2zX9um/view?usp=drive_link

 

BSOD 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

Someone help me what is the problem?

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************





A kernel component has corrupted a critical data structure. The corruption

could potentially allow a malicious user to gain control of this machine.

Arguments:

Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).

Arg2: ffffd28e4ded1500, Address of the trap frame for the exception that caused the BugCheck

Arg3: ffffd28e4ded1458, Address of the exception record for the exception that caused the BugCheck

Arg4: 0000000000000000, Reserved



Debugging Details:

------------------





KEY_VALUES_STRING: 1



Key : Analysis.CPU.mSec

Value: 3218



Key : Analysis.DebugAnalysisManager

Value: Create



Key : Analysis.Elapsed.mSec

Value: 3387



Key : Analysis.Init.CPU.mSec

Value: 718



Key : Analysis.Init.Elapsed.mSec

Value: 322116



Key : Analysis.Memory.CommitPeak.Mb

Value: 87



Key : FailFast.Name

Value: CORRUPT_LIST_ENTRY



Key : FailFast.Type

Value: 3



Key : WER.OS.Branch

Value: vb_release



Key : WER.OS.Timestamp

Value: 2019-12-06T14:06:00Z



Key : WER.OS.Version

Value: 10.0.19041.1





FILE_IN_CAB: MEMORY.DMP



BUGCHECK_CODE: 139



BUGCHECK_P1: 3



BUGCHECK_P2: ffffd28e4ded1500



BUGCHECK_P3: ffffd28e4ded1458



BUGCHECK_P4: 0



TRAP_FRAME: ffffd28e4ded1500 -- (.trap 0xffffd28e4ded1500)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=ffffe78e41016010 rbx=0000000000000000 rcx=0000000000000003

rdx=ffffe78e57434000 rsi=0000000000000000 rdi=0000000000000000

rip=fffff80526a3ea76 rsp=ffffd28e4ded1690 rbp=ffffd28e4ded1790

r8=ffffe78e41016008 r9=ffffe78e41016018 r10=ffffe78e4973f000

r11=00000000000000e0 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei pl nz na po cy

nt!RtlpHpLfhSlotAllocate+0x1b1646:

fffff805`26a3ea76 cd29 int 29h

Resetting default scope



EXCEPTION_RECORD: ffffd28e4ded1458 -- (.exr 0xffffd28e4ded1458)

ExceptionAddress: fffff80526a3ea76 (nt!RtlpHpLfhSlotAllocate+0x00000000001b1646)

ExceptionCode: c0000409 (Security check failure or stack buffer overrun)

ExceptionFlags: 00000001

NumberParameters: 1

Parameter[0]: 0000000000000003

Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY



BLACKBOXBSD: 1 (!blackboxbsd)





BLACKBOXNTFS: 1 (!blackboxntfs)





BLACKBOXPNP: 1 (!blackboxpnp)





BLACKBOXWINLOGON: 1



PROCESS_NAME: chrome.exe



ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.



EXCEPTION_CODE_STR: c0000409



EXCEPTION_PARAMETER1: 0000000000000003



EXCEPTION_STR: 0xc0000409



STACK_TEXT:

ffffd28e`4ded11d8 fffff805`26a09569 : 00000000`00000139 00000000`00000003 ffffd28e`4ded1500 ffffd28e`4ded1458 : nt!KeBugCheckEx

ffffd28e`4ded11e0 fffff805`26a09990 : ffffe78e`56a80080 ffffd28e`4ded13b9 00000000`0000000c 0000000f`ffffffff : nt!KiBugCheckDispatch+0x69

ffffd28e`4ded1320 fffff805`26a07d23 : 00000000`ffffffff 00000000`00000001 ffffe78e`5c5d2550 00000000`00000028 : nt!KiFastFailDispatch+0xd0

ffffd28e`4ded1500 fffff805`26a3ea76 : 00000000`00000000 ffffe78e`573871c0 ffffe78e`573870c0 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x323

ffffd28e`4ded1690 fffff805`2688cab1 : ffffe78e`41010340 ffffe78e`41012640 ffffe78e`41016000 fffff805`000000d0 : nt!RtlpHpLfhSlotAllocate+0x1b1646

ffffd28e`4ded17e0 fffff805`26fb21c4 : ffffe78e`00000000 00000000`00000050 00000000`74696157 ffffe78e`5c5d2550 : nt!ExAllocateHeapPool+0x2b1

ffffd28e`4ded1920 fffff805`26c746f9 : ffffe78e`408f62a0 00000000`00000000 00000000`00000000 ffffe78e`00000000 : nt!ExAllocatePoolWithTag+0x64

ffffd28e`4ded1970 fffff805`26c7b06c : ffffe78e`00000008 ffffe78e`408b2201 ffffd28e`00000000 ffffd28e`4ded1a30 : nt!ObpAllocateObject+0x199

ffffd28e`4ded19f0 fffff805`26ce4f59 : 0000025f`63af59b0 ffffd28e`4ded1b80 00000000`00000001 fffff805`26a08fb8 : nt!ObCreateObjectEx+0xfc

ffffd28e`4ded1a70 fffff805`26a08fb8 : ffffe78e`573870c0 000000dc`7adfea00 ffffd28e`4ded1b80 00000000`00000000 : nt!NtCreateWaitCompletionPacket+0x89

ffffd28e`4ded1b00 00007ff8`01e4e684 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28

000000dc`7adfe968 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`01e4e684





SYMBOL_NAME: nt!KiFastFailDispatch+d0



MODULE_NAME: nt



IMAGE_NAME: ntkrnlmp.exe



STACK_COMMAND: .cxr; .ecxr ; kb



BUCKET_ID_FUNC_OFFSET: d0



FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch



OS_VERSION: 10.0.19041.1



BUILDLAB_STR: vb_release



OSPLATFORM_TYPE: x64



OSNAME: Windows 10



FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}



Followup: MachineOwner

---------

 

ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )

Hello there!

Recently my Gigabyte Aero 15 laptop had a lot of blue screens saying kernel security check failure. It was purchased around 7 months ago and is well-cooled so I do not suspect overheating as the cause.

Here is the WinDbg result for the most recent blue screen: