Windows 10: ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )

Hello there!


Recently my Gigabyte Aero 15 laptop had a lot of blue screens saying kernel security check failure. It was purchased around 7 months ago and is well-cooled so I do not suspect overheating as the cause.


Here is the WinDbg result for the most recent blue screen:


************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 17134 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 17134.1.amd64fre.rs4_release.180410-1804
Machine Name:
Kernel base = 0xfffff801`4d89f000 PsLoadedModuleList = 0xfffff801`4dc591f0
Debug session time: Thu Jul 26 20:50:51.554 2018 (UTC + 8:00)
System Uptime: 0 days 9:12:36.372
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`00951018). Type ".hh dbgerr001" for details
Loading unloaded module list
.........................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 139, {3, ffff9d8110badfc0, ffff9d8110badf18, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )

Followup: MachineOwner
---------

nt!KeBugCheckEx:
fffff801`4da37430 48894c2408 mov qword ptr [rsp+8],rcx ss:ffff9d81`10badca0=0000000000000139
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff9d8110badfc0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff9d8110badf18, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1


STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 17134.1.amd64fre.rs4_release.180410-1804

SYSTEM_MANUFACTURER: GIGABYTE

SYSTEM_PRODUCT_NAME: P65

SYSTEM_SKU: P65

SYSTEM_VERSION: Default string

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: FB08

BIOS_DATE: 08/21/2017

BASEBOARD_MANUFACTURER: GIGABYTE

BASEBOARD_PRODUCT: P65

BASEBOARD_VERSION: Default string

DUMP_TYPE: 1

BUGCHECK_P1: 3

BUGCHECK_P2: ffff9d8110badfc0

BUGCHECK_P3: ffff9d8110badf18

BUGCHECK_P4: 0

TRAP_FRAME: ffff9d8110badfc0 -- (.trap 0xffff9d8110badfc0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffb5800c20f160 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8014da9530d rsp=ffff9d8110bae150 rbp=ffff9d8110bae1f1
r8=0000000000000000 r9=0000000000000000 r10=ffffb88000007788
r11=0000000000000090 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy
nt!MiUnlinkNodeLargePage+0x12ab1d:
fffff801`4da9530d cd29 int 29h
Resetting default scope

EXCEPTION_RECORD: ffff9d8110badf18 -- (.exr 0xffff9d8110badf18)
ExceptionAddress: fffff8014da9530d (nt!MiUnlinkNodeLargePage+0x000000000012ab1d)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

CPU_COUNT: 8

CPU_MHZ: af8

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: 9

CPU_MICROCODE: 6,9e,9,0 (F,M,S,R) SIG: 70'00000000 (cache) 70'00000000 (init)

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXPNP: 1 (!blackboxpnp)


BUGCHECK_STR: 0x139

PROCESS_NAME: steamwebhelper.exe

CURRENT_IRQL: 2

DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000003

ANALYSIS_SESSION_HOST: DESKTOP-L2R4GKN

ANALYSIS_SESSION_TIME: 07-26-2018 20:55:23.0350

ANALYSIS_VERSION: 10.0.17712.1000 amd64fre

LAST_CONTROL_TRANSFER: from fffff8014da47f69 to fffff8014da37430

STACK_TEXT:
ffff9d81`10badc98 fffff801`4da47f69 : 00000000`00000139 00000000`00000003 ffff9d81`10badfc0 ffff9d81`10badf18 : nt!KeBugCheckEx
ffff9d81`10badca0 fffff801`4da48310 : 00000000`00000202 fffff801`4d930578 00000000`00000000 ffffc109`9adaf080 : nt!KiBugCheckDispatch+0x69
ffff9d81`10badde0 fffff801`4da4691f : ffffb580`0c20be00 fffff801`4dc7a000 fffff801`4dc7b028 00000000`00000a00 : nt!KiFastFailDispatch+0xd0
ffff9d81`10badfc0 fffff801`4da9530d : 00000000`0000000e ffff9d81`10bae1f1 ffffb880`00007000 00000000`00000011 : nt!KiRaiseSecurityCheckFailure+0x2df
ffff9d81`10bae150 fffff801`4d96a6a5 : 00029c3f`00000010 00000000`00000002 00000000`00000000 00000000`00000000 : nt!MiUnlinkNodeLargePage+0x12ab1d
ffff9d81`10bae240 fffff801`4d96a4d0 : fffff801`4db9dbf0 00000000`00000000 00000000`00000002 fffff801`4dc7a000 : nt!MiDemoteLocalLargePage+0x165
ffff9d81`10bae310 fffff801`4d9530fb : 00000000`000000bb 00000000`00000001 00000000`00000000 00000000`00000001 : nt!MiGetFreeOrZeroPageAnyColor+0x60
ffff9d81`10bae350 fffff801`4d952983 : fffff801`4dc7a000 fffff801`000000bb 00000000`000000bb 8a000003`00000000 : nt!MiGetPage+0x2fb
ffff9d81`10bae430 fffff801`4d950a80 : ffff9d81`10bae6e0 ffff9d81`10bae6e0 00000000`00000001 00000000`00000011 : nt!MiGetPageChain+0x173
ffff9d81`10bae560 fffff801`4d95034a : 00000000`00000004 00000000`00000000 ffffffff`ffffffff ffff9d81`10bae6c0 : nt!MiResolvePrivateZeroFault+0x130
ffff9d81`10bae680 fffff801`4d94d038 : ffffc109`a0ad2580 ffff9d81`10bae8f8 00000000`00000000 00000000`00000002 : nt!MiResolveDemandZeroFault+0x20a
ffff9d81`10bae770 fffff801`4d94c32f : ffff9d81`10bae8c0 00001f80`00000000 00000000`00000000 00000000`1b31c000 : nt!MiUserFault+0x8d8
ffff9d81`10bae890 fffff801`4da44ada : 00000000`0cc305e8 00000000`00953000 00000000`006afda0 00000000`77534620 : nt!MmAccessFault+0x11f
ffff9d81`10baea00 00000000`13b5163e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x31a
00000000`007af16c 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x13b5163e


THREAD_SHA1_HASH_MOD_FUNC: 3bc9b08f5fd6905571c5e9128b7012d86cfc6dd7

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 8e7f29b064c3d7d051ba160c7c55492ba4bb4151

THREAD_SHA1_HASH_MOD: 7f608ac2fbce9034a3386b1d51652e4911d30234

FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff801`4da48310 c644242000 mov byte ptr [rsp+20h],0

FAULT_INSTR_CODE: 202444c6

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!KiFastFailDispatch+d0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 5b3f12f4

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: d0

FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

TARGET_TIME: 2018-07-26T12:50:51.000Z

OSBUILD: 17134

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2018-07-06 14:57:56

BUILDDATESTAMP_STR: 180410-1804

BUILDLAB_STR: rs4_release

BUILDOSVER_STR: 10.0.17134.1.amd64fre.rs4_release.180410-1804

ANALYSIS_SESSION_ELAPSED_TIME: d31

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_nt!kifastfaildispatch

FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}

Followup: MachineOwner
---------

:)

 

i7 920 c0 and d0

yes there are 2 different steppings there is the C0/c1 and there is the D0
the D0 Stepping seems to clock better the the C0/C1 stepping
the D0 stepping is newer also

 

Q9650 with D0 Stepping

Is D0 stepping okay for a Q9650?

 

Q9650 with D0 Stepping

there is no such thing as a 9650 with D0 stepping iirc