Windows 10: KERNEL_SECURITY_CHECK_FAILURE 139

Hi.I've been getting BSODs from my Windows 10 laptop for months, but I haven't been able to identify the root cause. So far, it's been happening while I'm using Visual Studio Code and Microsoft Edge is open with several tabs, one of which is playing some video/music. Details of the latest BSOD are as follows taken from WinDbg:NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2210.3001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis'NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2

:)

 

KERNEL_SECURITY_CHECK_FAILURE (139)

Hi MohamedBishr

Greetings! I am Vijay, an Independent Advisor. I am here to work with you on this problem.

A. Analysis Results

File Name: 081819-15328-01.dmp

KERNEL_SECURITY_CHECK_FAILURE (139)

IMAGE_NAME: CLASSPNP.SYS

B. Third Party Drivers

None

C. Recommendations

a. Create a system restore point first so that if something wrong happens you can revert.

Type restore point in Cortana Search > Create a Restore point > Check whether against your drive, Protection is ON or not. If not ON, click Configure button below to Make it ON > Now press Create to create a restore point

b. Some third party drivers are causing BSODs. To know if a third party driver is one of the causes - Enable Driver Verifier and generate dump files and upload to Onedrive and share the link here (Don't forget to turn off Driver Verifier after the job is done).
Do read the instructions carefully particularly how to get back into Windows when you get the crash.

https://www.tenforums.com/tutorials/5470-enable...

Disclaimer - This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product
advertised on the site before you decide to download and install it.

 

KERNEL_SECURITY_CHECK_FAILURE (139)

Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.





Loading Dump File [C:\Users\xiangshuai\Desktop\120622-14859-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available



Symbol search path is: srv*

Executable search path is:

Windows 10 Kernel Version 22000 MP (8 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Machine Name:

Kernel base = 0xfffff807`29200000 PsLoadedModuleList = 0xfffff807`29e29b00

Debug session time: Tue Dec 6 13:52:04.159 2022 (UTC + 8:00)

System Uptime: 0 days 4:34:02.304

Loading Kernel Symbols

..



Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.

Run !sym noisy before .reload to track down problems loading symbols.



.............................................................

................................................................

................................................................

..........................................

Loading User Symbols

Loading unloaded module list

....................

For analysis of this file, run !analyze -v

6: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************



KERNEL_SECURITY_CHECK_FAILURE (139)

A kernel component has corrupted a critical data structure. The corruption

could potentially allow a malicious user to gain control of this machine.

Arguments:

Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).

Arg2: ffffd28736e7ef60, Address of the trap frame for the exception that caused the bugcheck

Arg3: ffffd28736e7eeb8, Address of the exception record for the exception that caused the bugcheck

Arg4: 0000000000000000, Reserved



Debugging Details:

------------------





KEY_VALUES_STRING: 1



Key : Analysis.CPU.Sec

Value: 1



Key : Analysis.DebugAnalysisProvider.CPP

Value: Create: 8007007e on XIANGSHUAI-PC-2



Key : Analysis.DebugData

Value: CreateObject



Key : Analysis.DebugModel

Value: CreateObject



Key : Analysis.Elapsed.Sec

Value: 1



Key : Analysis.Memory.CommitPeak.Mb

Value: 81



Key : Analysis.System

Value: CreateObject





TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b





DUMP_FILE_ATTRIBUTES: 0x1808

Kernel Generated Triage Dump



BUGCHECK_CODE: 139



BUGCHECK_P1: 3



BUGCHECK_P2: ffffd28736e7ef60



BUGCHECK_P3: ffffd28736e7eeb8



BUGCHECK_P4: 0



TRAP_FRAME: ffffd28736e7ef60 -- (.trap 0xffffd28736e7ef60)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=ffffe70d59ae8eb8 rbx=0000000000000000 rcx=0000000000000003

rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000

rip=fffff807294233d9 rsp=ffffd28736e7f0f0 rbp=ffffe70d411c71b0

r8=0000000000000010 r9=0000000000000000 r10=ffffc101c04c9050

r11=fffff80729ef8c00 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei pl nz na pe cy

nt!KiProcessThreadWaitList+0x99:

fffff807`294233d9 cd29 int 29h

Resetting default scope



EXCEPTION_RECORD: ffffd28736e7eeb8 -- (.exr 0xffffd28736e7eeb8)

ExceptionAddress: fffff807294233d9 (nt!KiProcessThreadWaitList+0x0000000000000099)

ExceptionCode: c0000409 (Security check failure or stack buffer overrun)

ExceptionFlags: 00000001

NumberParameters: 1

Parameter[0]: 0000000000000003

Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY



BLACKBOXBSD: 1 (!blackboxbsd)





BLACKBOXNTFS: 1 (!blackboxntfs)





BLACKBOXPNP: 1 (!blackboxpnp)





BLACKBOXWINLOGON: 1



CUSTOMER_CRASH_COUNT: 1



PROCESS_NAME: System



ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>



EXCEPTION_CODE_STR: c0000409



EXCEPTION_PARAMETER1: 0000000000000003



EXCEPTION_STR: 0xc0000409



STACK_TEXT:

ffffd287`36e7ec38 fffff807`29630369 : 00000000`00000139 00000000`00000003 ffffd287`36e7ef60 ffffd287`36e7eeb8 : nt!KeBugCheckEx

ffffd287`36e7ec40 fffff807`296308f2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69

ffffd287`36e7ed80 fffff807`2962e79e : ffffd287`36e7ef90 ffffd287`36e7efa8 ffffd287`36e7f038 ffffe70d`264bad90 : nt!KiFastFailDispatch+0xb2

ffffd287`36e7ef60 fffff807`294233d9 : ffffc101`c0700180 00000000`00000000 ffffd287`36e7f160 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x31e

ffffd287`36e7f0f0 fffff807`294225d6 : 00000000`00000000 00000000`00000001 ffffd287`00000000 00000000`00000002 : nt!KiProcessThreadWaitList+0x99

ffffd287`36e7f160 fffff807`29420a54 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff807`26e93588 : nt!KiProcessExpiredTimerList+0x376

ffffd287`36e7f290 fffff807`2961fd8e : 00000000`00000000 ffffc101`c0700180 ffffc101`c070c240 ffffe70d`4df47080 : nt!KiRetireDpcList+0x714

ffffd287`36e7f540 00000000`00000000 : ffffd287`36e80000 ffffd287`36e79000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e





SYMBOL_NAME: nt!KiProcessExpiredTimerList+376



MODULE_NAME: nt



IMAGE_NAME: ntkrnlmp.exe



IMAGE_VERSION: 10.0.22000.1281



STACK_COMMAND: .thread ; .cxr ; kb



BUCKET_ID_FUNC_OFFSET: 376



FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiProcessExpiredTimerList



OSPLATFORM_TYPE: x64



OSNAME: Windows 10



FAILURE_ID_HASH: {9db7945b-255d-24a1-9f2c-82344e883ab8}



Followup: MachineOwner

---------

 

KERNEL_SECURITY_CHECK_FAILURE

Hi SunderBiticon

Greetings! I am Vijay, an Independent Advisor. I am here to work with you on this problem.

A. Analysis Results

File Name: 042319-10796-01.dmp

KERNEL_SECURITY_CHECK_FAILURE (139)

*** WARNING: Unable to verify timestamp for BEDaisy.sys

IMAGE_NAME: BEDaisy.sys

File Name: 042319-11250-01.dmp

KERNEL_SECURITY_CHECK_FAILURE (139)

*** WARNING: Unable to verify timestamp for BEDaisy.sys

IMAGE_NAME: BEDaisy.sys

File Name: 042319-11406-01.dmp

KERNEL_SECURITY_CHECK_FAILURE (139)

*** WARNING: Unable to verify timestamp for BEDaisy.sys

IMAGE_NAME: BEDaisy.sys

B. Third Party Drivers

BEDaisy.sys - Battle Eye

Drive Date - Mon Feb 25 04:08:41 2019

C. Recommendations

1. Create a system restore point so that if something wrong happens you can revert.

Type restore point in Cortana Search > Create a Restore point > Check whether against your drive, Protection is ON or not. If not ON, click Configure button below to Make it ON > Now press Create to create a restore point

2. The crash is caused by Battle Eye. Update the concerned game to latest so that this driver gets updated.

Do let me know if you require any further help on this. Will be glad to help you.