Windows 10: BSOD memory_corruption ( nt!MiLocateWsle+148586 )

Hello together,


i have the following problem....

Several times we got a Blue screen on a device. You find the Windbg analyze below.

I done that analyze but i don´t know the next steps.

How can i find the cause of the blue screen and which are the next steps ?


We changed already the memory of the device and all drivers and firmwares are up to date.



6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: 000000d683569000
Arg3: 0000000000000000
Arg4: fffff30010804310

Debugging Details:
------------------


KEY_VALUES_STRING: 1


TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 14393.2273.amd64fre.rs1_release_1.180427-1811

SYSTEM_MANUFACTURER: LENOVO

SYSTEM_PRODUCT_NAME: 20HJS0N900

SYSTEM_SKU: LENOVO_MT_20HJ_BU_Think_FM_ThinkPad P51

SYSTEM_VERSION: ThinkPad P51

BIOS_VENDOR: LENOVO

BIOS_VERSION: N1UET71W (1.45 )

BIOS_DATE: 07/18/2018

BASEBOARD_MANUFACTURER: LENOVO

BASEBOARD_PRODUCT: 20HJS0N900

BASEBOARD_VERSION: SDK0Q40112 WIN

DUMP_TYPE: 1

BUGCHECK_P1: 41284

BUGCHECK_P2: d683569000

BUGCHECK_P3: 0

BUGCHECK_P4: fffff30010804310

BUGCHECK_STR: 0x1a_41284

CPU_COUNT: 8

CPU_MHZ: bb8

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: 9

CPU_MICROCODE: 6,9e,9,0 (F,M,S,R) SIG: 8E'00000000 (cache) 8E'00000000 (init)

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: NVDisplay.Container.exe

CURRENT_IRQL: 2

ANALYSIS_SESSION_HOST: CDE277455

ANALYSIS_SESSION_TIME: 12-06-2018 14:44:42.0244

ANALYSIS_VERSION: 10.0.17134.226 amd64fre

LAST_CONTROL_TRANSFER: from fffff8022ab7e146 to fffff8022ab5f950

STACK_TEXT:
ffff9880`30926218 fffff802`2ab7e146 : 00000000`0000001a 00000000`00041284 000000d6`83569000 00000000`00000000 : nt!KeBugCheckEx
ffff9880`30926220 fffff802`2aa34f75 : ffff9880`30926380 ffffaa07`58ef6580 000000d6`83569000 00000000`00000000 : nt!MiLocateWsle+0x148586
ffff9880`30926280 fffff802`2aa1c777 : ffffc690`c06002a0 fffff802`2aa500d2 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x465
ffff9880`30926490 fffff802`2aa1af51 : 000000d6`835fffff 000000d6`835fffff 000000d6`83500000 ffffaa07`5888e090 : nt!MiDeleteVad+0x277
ffff9880`309265c0 fffff802`2ae06e3d : 00000000`00000000 000000d6`83500000 ffffaa07`00000000 00000000`00000000 : nt!MiFreeVadRange+0x4d
ffff9880`30926600 fffff802`2ab70a63 : ffffc690`6e747355 00000000`00000030 00000000`00000000 ffffaa07`5593f070 : nt!NtFreeVirtualMemory+0x2dd
ffff9880`30926720 fffff802`2ab63710 : fffff802`2ae68aa0 ffffaa07`57502380 ffff9880`30926900 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
ffff9880`309268b8 fffff802`2ae68aa0 : ffffaa07`57502380 ffff9880`30926900 00000000`00000000 ffffaa07`57502380 : nt!KiServiceLinkage
ffff9880`309268c0 fffff802`2ae283fa : 00000000`00000000 ffffaa07`57502380 00000000`00000000 ffffaa07`58ef6080 : nt!PspExitThread+0x360
ffff9880`30926a00 fffff802`2ae277e8 : ffffaa07`57502380 00000000`00000000 ffffaa07`57502380 00000000`00000000 : nt!PspTerminateThreadByPointer+0x96
ffff9880`30926a40 fffff802`2ab70a63 : ffffaa07`57502380 ffff9880`30926b00 00000000`00000000 ffffaa07`577b54a0 : nt!NtTerminateThread+0x44
ffff9880`30926a80 00000000`50299df9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000d6`835ff808 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x50299df9


THREAD_SHA1_HASH_MOD_FUNC: 3244e260ceb7c386d51cfe60b9e46f18a5cc9515

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: bcf8e58ebdbe47fc947d274a623d90b7f191a07f

THREAD_SHA1_HASH_MOD: dc844b1b94baa204d070855e43bbbd27eee98b94

FOLLOWUP_IP:
nt!MiLocateWsle+148586
fffff802`2ab7e146 cc int 3

FAULT_INSTR_CODE: 2348cccc

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiLocateWsle+148586

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 5ae4097e

STACK_COMMAND: .thread ; .cxr ; kb

IMAGE_NAME: memory_corruption

BUCKET_ID_FUNC_OFFSET: 148586

FAILURE_BUCKET_ID: 0x1a_41284_nt!MiLocateWsle

BUCKET_ID: 0x1a_41284_nt!MiLocateWsle

PRIMARY_PROBLEM_CLASS: 0x1a_41284_nt!MiLocateWsle

TARGET_TIME: 2018-12-06T12:43:43.000Z

OSBUILD: 14393

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2018-04-28 07:41:18

BUILDDATESTAMP_STR: 180427-1811

BUILDLAB_STR: rs1_release_1

BUILDOSVER_STR: 10.0.14393.2273.amd64fre.rs1_release_1.180427-1811

ANALYSIS_SESSION_ELAPSED_TIME: e67

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x1a_41284_nt!milocatewsle

FAILURE_ID_HASH: {31ee660f-2a68-f5e3-7d09-e203f8d0ab9f}

Followup: MachineOwner
---------

:)

 

BSOD Probably caused by : memory_corruption

Hi,

My computer frequently has BSOD. I have used windbg to analyze 800mb dump file as attached bellow:

please help , thank you!

Microsoft (R) Windows Debugger Version 10.0.17763.1 X86

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\lojason\Desktop\LogSubmit\MEMORY.DMP]

Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

************* Path validation summary **************

Response Time (ms) Location

Deferred SRV* C:\Symbols *Symbol information

Symbol search path is: SRV* C:\Symbols *Symbol information

Executable search path is:

Windows 10 Kernel Version 17134 MP (4 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 17134.1.amd64fre.rs4_release.180410-1804

Machine Name:

Kernel base = 0xfffff800`76a92000 PsLoadedModuleList = 0xfffff800`76e4c1f0

Debug session time: Tue Oct 9 09:41:18.421 2018 (UTC + 8:00)

System Uptime: 0 days 15:30:34.265

Loading Kernel Symbols

...............................................................

................................................................

................................................................

..................................

Loading User Symbols

Loading unloaded module list

......................

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 139, {3, ffffd18c7b33f4b0, ffffd18c7b33f408, 0}

Probably caused by : memory_corruption

Followup: memory_corruption

---------

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)

A kernel component has corrupted a critical data structure. The corruption

could potentially allow a malicious user to gain control of this machine.

Arguments:

Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).

Arg2: ffffd18c7b33f4b0, Address of the trap frame for the exception that caused the bugcheck

Arg3: ffffd18c7b33f408, Address of the exception record for the exception that caused the bugcheck

Arg4: 0000000000000000, Reserved

Debugging Details:

------------------

KEY_VALUES_STRING: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 17134.1.amd64fre.rs4_release.180410-1804

SYSTEM_MANUFACTURER: LENOVO

SYSTEM_PRODUCT_NAME: 20F5S1Y60F

SYSTEM_SKU: LENOVO_MT_20F5_BU_Think_FM_ThinkPad X260

SYSTEM_VERSION: ThinkPad X260

BIOS_VENDOR: LENOVO

BIOS_VERSION: R02ET58W (1.31 )

BIOS_DATE: 07/19/2017

BASEBOARD_MANUFACTURER: LENOVO

BASEBOARD_PRODUCT: 20F5S1Y60F

BASEBOARD_VERSION: SDK0J40697 WIN

DUMP_TYPE: 1

BUGCHECK_P1: 3

BUGCHECK_P2: ffffd18c7b33f4b0

BUGCHECK_P3: ffffd18c7b33f408

BUGCHECK_P4: 0

TRAP_FRAME: ffffd18c7b33f4b0 -- (.trap 0xffffd18c7b33f4b0)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=ffffba830c352750 rbx=0000000000000000 rcx=0000000000000003

rdx=ffffba83157cfee0 rsi=0000000000000000 rdi=0000000000000000

rip=fffff80076c64360 rsp=ffffd18c7b33f640 rbp=0000000000000745

r8=00000000ffffffff r9=7fffba830ba4c400 r10=fffff800736c6180

r11=0000000000000040 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei pl nz na po cy

nt!ExDeleteResourceLite+0x172680:

fffff800`76c64360 cd29 int 29h

Resetting default scope

EXCEPTION_RECORD: ffffd18c7b33f408 -- (.exr 0xffffd18c7b33f408)

ExceptionAddress: fffff80076c64360 (nt!ExDeleteResourceLite+0x0000000000172680)

ExceptionCode: c0000409 (Security check failure or stack buffer overrun)

ExceptionFlags: 00000001

NumberParameters: 1

Parameter[0]: 0000000000000003

Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

CPU_COUNT: 4

CPU_MHZ: 9c0

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 4e

CPU_STEPPING: 3

CPU_MICROCODE: 6,4e,3,0 (F,M,S,R) SIG: BE'00000000 (cache) BE'00000000 (init)

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

BUGCHECK_STR: 0x139

PROCESS_NAME: System

CURRENT_IRQL: 2

DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000003

ANALYSIS_SESSION_HOST: ISCNPC0TCPC8

ANALYSIS_SESSION_TIME: 10-09-2018 17:22:44.0479

ANALYSIS_VERSION: 10.0.17763.1 x86fre

STACK_TEXT:

ffffd18c`7b33f188 fffff800`76c3ae69 : 00000000`00000139 00000000`00000003 ffffd18c`7b33f4b0 ffffd18c`7b33f408 : nt!KeBugCheckEx

ffffd18c`7b33f190 fffff800`76c3b210 : ffffba83`141f02b0 fffff800`76ba9de1 ffffba83`141f02b0 00000000`00000000 : nt!KiBugCheckDispatch+0x69

ffffd18c`7b33f2d0 fffff800`76c3981f : ffffba83`160d0c88 00000000`00000000 ffffba83`0ba4c030 ffffaa88`fd01c810 : nt!KiFastFailDispatch+0xd0

ffffd18c`7b33f4b0 fffff800`76c64360 : ffffd18c`7b33f6e0 fffff80c`324f7fa0 ffffaa88`fd01c600 fffff80c`3240feef : nt!KiRaiseSecurityCheckFailure+0x2df

ffffd18c`7b33f640 fffff80c`32411170 : 00000000`00000745 ffffd18c`00000000 ffffba83`0d0b1a00 ffffba83`160d0c88 : nt!ExDeleteResourceLite+0x172680

ffffd18c`7b33f690 fffff80c`324c899f : 00000000`00000745 ffffba83`0d0b1a00 00000000`00000001 ffffba83`160d0c88 : Ntfs!NtfsFreeNonpagedDataFcb+0x20

ffffd18c`7b33f6c0 fffff80c`323fe45d : ffffba83`160d0c88 ffffaa88`f5d62100 ffffaa88`00000000 00000000`00000000 : Ntfs!NtfsDeleteFcb+0x4cf

ffffd18c`7b33f740 fffff80c`324c8cab : ffffba83`160d0c88 ffffba83`0ba4c180 ffffaa88`fd01c6c0 ffffaa88`fd01caf8 : Ntfs!NtfsTeardownFromLcb+0x1fd

ffffd18c`7b33f7e0 fffff80c`3240155a : ffffba83`160d0c88 ffffd18c`7b33f8e1 ffffaa88`fd01caf8 ffffba83`160d0c88 : Ntfs!NtfsTeardownStructures+0xeb

ffffd18c`7b33f860 fffff80c`324d3b9c : ffffd18c`7b33fa00 ffffaa88`00000000 fffff80c`00000000 ffffba83`160d0c88 : Ntfs!NtfsDecrementCloseCounts+0xaa

ffffd18c`7b33f8a0 fffff80c`324f8187 : ffffba83`160d0c88 ffffaa88`fd01c810 ffffaa88`fd01c6c0 ffffba83`0ba4c180 : Ntfs!NtfsCommonClose+0x44c

ffffd18c`7b33f9a0 fffff80c`324f7faf : 00000000`00000000 ffffba83`167cd040 ffffba83`0ba75830 ffffba83`0ba75830 : Ntfs!NtfsFspCloseInternal+0x1c7

ffffd18c`7b33fad0 fffff800`76ad4315 : 00000000`00000200 fffff800`76d02900 ffffba83`0ba75830 fffff800`76e6e8a0 : Ntfs!NtfsFspClose+0xf

ffffd18c`7b33fb00 fffff800`76b76cb7 : ffffba83`167cd040 00000000`00000080 ffffba83`0ba71040 ffffba83`167cd040 : nt!ExpWorkerThread+0xf5

ffffd18c`7b33fb90 fffff800`76c317d6 : ffff8280`b20c0180 ffffba83`167cd040 fffff800`76b76c70 000001cf`570e5ae8 : nt!PspSystemThreadStartup+0x47

ffffd18c`7b33fbe0 00000000`00000000 : ffffd18c`7b340000 ffffd18c`7b339000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

THREAD_SHA1_HASH_MOD_FUNC: 2052fb158b8f728fcb34e2b3fa44f73e09383d8b

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 0df948c287f28a54167085453b91ed984301d068

THREAD_SHA1_HASH_MOD: baf72ea6dc105da5d0f2fb8a45027cf1bace7247

FOLLOWUP_NAME: memory_corruption

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

STACK_COMMAND: .thread ; .cxr ; kb

FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_IMAGE_memory_corruption

BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_IMAGE_memory_corruption

PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_IMAGE_memory_corruption

TARGET_TIME: 2018-10-09T01:41:18.000Z

OSBUILD: 17134

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2018-06-08 17:00:00

BUILDDATESTAMP_STR: 180410-1804

BUILDLAB_STR: rs4_release

BUILDOSVER_STR: 10.0.17134.1.amd64fre.rs4_release.180410-1804

ANALYSIS_SESSION_ELAPSED_TIME: 13f7

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_image_memory_corruption

FAILURE_ID_HASH: {6b711939-e5de-38cb-287e-eb7d8c867a90}

Followup: memory_corruption

---------

0: kd>

ExceptionAddress: fffff80076c64360 (nt!ExDeleteResourceLite+0x0000000000172680)

ExceptionCode: c0000409 (Security check failure or stack buffer overrun)

ExceptionFlags: 00000001

NumberParameters: 1

Parameter[0]: 0000000000000003

Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

 

Receiving BSOD due to ntkrnlmp.exe ( nt!_report_gsfailure+25 )

When the system rebooted, before I enabled the driver verifier, I received the error:

BugCheck 1A, {41201, ffffe10000a00b50, 1000000001, ffff90863d6cb770}

Probably caused by : memory_corruption ( nt!MiGetPageProtection+40b )

I am starting to wonder if I don't have bad memory. Any thoughts?

 

BSOD Probably caused by : memory_corruption?

My computer has started blue screening constantly especially on boot up after I turn it off. Windows has become especially slow task bar rarely works. here is my mini dump file.