1: kd> !analyze -v Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ..................................... Loading User Symbols Loading unloaded module list ......... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: ffffffffffffffd0, memory referenced. Arg2: 0000000000000002, X64: bit 0 set if the fault was due to a not-present PTE. bit 1 is set if the fault was due to a write, clear if a read. bit 3 is set if the processor decided the fault was due to a corrupted PTE. bit 4 is set if the fault was due to attempted execute of a no-execute PTE. - ARM64: bit 1 is set if the fault was due to a write, clear if a read. bit 3 is set if the fault was due to attempted execute of a no-execute PTE. Arg3: fffff806ebe39ad3, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000002, (reserved) Debugging Details: ------------------ *** WARNING: Unable to verify timestamp for pffilter.sys KEY_VALUES_STRING: 1 Key : AV.Type Value: Write Key : Analysis.CPU.mSec Value: 1890 Key : Analysis.Elapsed.mSec Value: 6034 Key : Analysis.IO.Other.Mb Value: 8 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 27 Key : Analysis.Init.CPU.mSec Value: 1125 Key : Analysis.Init.Elapsed.mSec Value: 42909 Key : Analysis.Memory.CommitPeak.Mb Value: 106 Key : Analysis.Version.DbgEng Value: 10.0.27829.1001 Key : Analysis.Version.Description Value: 10.2503.24.01 amd64fre Key : Analysis.Version.Ext Value: 1.2503.24.1 Key : Bugcheck.Code.LegacyAPI Value: 0x50 Key : Bugcheck.Code.TargetModel Value: 0x50 Key : Failure.BucketValue: AV_W_(null)_pffilter!unknown_function Key : Failure.Exception.IP.Address Value: 0xfffff806ebe39ad3 Key : Failure.Exception.IP.Module Value: nt Key : Failure.Exception.IP.Offset Value: 0x439ad3 Key : Failure.Hash Value: {7a022701-1126-fdfe-bfac-f099a661ff04} Key : WER.OS.Branch Value: ge_release Key : WER.OS.Version Value: 10.0.26100.1 BUGCHECK_CODE: 50 BUGCHECK_P1: ffffffffffffffd0 BUGCHECK_P2: 2 BUGCHECK_P3: fffff806ebe39ad3 BUGCHECK_P4: 2 FILE_IN_CAB: 060725-24890-01.dmp FAULTING_THREAD: ffffac05359a3080 READ_ADDRESS: fffff806ec9c34c0: Unable to get MiVisibleState Unable to get NonPagedPoolStart Unable to get NonPagedPoolEnd Unable to get PagedPoolStart Unable to get PagedPoolEnd unable to get nt!MmSpecialPagesInUse ffffffffffffffd0 MM_INTERNAL_CODE: 2 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System STACK_TEXT: ffffbc0d<code>5fe270b8 fffff806</code>ebd1fca4 : 00000000<code>00000050 ffffffff</code>ffffffd0 00000000<code>00000002 ffffbc0d</code>5fe27320 : nt!KeBugCheckEx ffffbc0d<code>5fe270c0 fffff806</code>ebca8da0 : 00000000<code>00000002 ffff8000</code>00000000 ffffffff<code>ffffffd0 0000007f</code>fffffff8 : nt!MiSystemFault+0x7a0 ffffbc0d<code>5fe271b0 fffff806</code>ec0b41cb : ffffac05<code>51d7f010 00000000</code>00000000 00000000<code>00000001 ffffac05</code>51d7f080 : nt!MmAccessFault+0x630 ffffbc0d<code>5fe27320 fffff806</code>ebe39ad3 : ffffbc0d<code>5fe276a0 00000000</code>00000000 00000000<code>00000000 00000000</code>00000000 : nt!KiPageFault+0x38b ffffbc0d<code>5fe274b0 fffff806</code>ec253a13 : 00000000<code>00000000 ffffac05</code>3dfffb60 fffff806<code>eba00000 ffffbc0d</code>5fe275b9 : nt!ObReferenceObjectByPointerWithTag+0x53 ffffbc0d<code>5fe274f0 fffff806</code>9b2e32df : 00000000<code>00000000 00000000</code>00000000 ffffac05<code>40386000 00000003</code>2d789a16 : nt!ObOpenObjectByPointer+0x93 ffffbc0d<code>5fe27760 00000000</code>00000000 : 00000000<code>00000000 ffffac05</code>40386000 00000003<code>2d789a16 00000000</code>00000000 : pffilter+0x32df SYMBOL_NAME: pffilter+32df MODULE_NAME: pffilter IMAGE_NAME: pffilter.sys STACK_COMMAND: .process /r /p 0xffffac05336c0040; .thread 0xffffac05359a3080 ; kb BUCKET_ID_FUNC_OFFSET: 32df FAILURE_BUCKET_ID: AV_W_(null)_pffilter!unknown_function OS_VERSION: 10.0.26100.1 BUILDLAB_STR: ge_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {7a022701-1126-fdfe-bfac-f099a661ff04} Followup: MachineOwner ---------
1: kd> !analyze -v Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ..................................... Loading User Symbols Loading unloaded module list ......... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: ffffffffffffffd0, memory referenced. Arg2: 0000000000000002, X64: bit 0 set if the fault was due to a not-present PTE. bit 1 is set if the fault was due to a write, clear if a read. bit 3 is set if the processor decided the fault was due to a corrupted PTE. bit 4 is set if the fault was due to attempted execute of a no-execute PTE. - ARM64: bit 1 is set if the fault was due to a write, clear if a read. bit 3 is set if the fault was due to attempted execute of a no-execute PTE. Arg3: fffff806ebe39ad3, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000002, (reserved) Debugging Details: ------------------ *** WARNING: Unable to verify timestamp for pffilter.sys KEY_VALUES_STRING: 1 Key : AV.Type Value: Write Key : Analysis.CPU.mSec Value: 1890 Key : Analysis.Elapsed.mSec Value: 6034 Key : Analysis.IO.Other.Mb Value: 8 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 27 Key : Analysis.Init.CPU.mSec Value: 1125 Key : Analysis.Init.Elapsed.mSec Value: 42909 Key : Analysis.Memory.CommitPeak.Mb Value: 106 Key : Analysis.Version.DbgEng Value: 10.0.27829.1001 Key : Analysis.Version.Description Value: 10.2503.24.01 amd64fre Key : Analysis.Version.Ext Value: 1.2503.24.1 Key : Bugcheck.Code.LegacyAPI Value: 0x50 Key : Bugcheck.Code.TargetModel Value: 0x50 Key : Failure.BucketValue: AV_W_(null)_pffilter!unknown_function Key : Failure.Exception.IP.Address Value: 0xfffff806ebe39ad3 Key : Failure.Exception.IP.Module Value: nt Key : Failure.Exception.IP.Offset Value: 0x439ad3 Key : Failure.Hash Value: {7a022701-1126-fdfe-bfac-f099a661ff04} Key : WER.OS.Branch Value: ge_release Key : WER.OS.Version Value: 10.0.26100.1 BUGCHECK_CODE: 50 BUGCHECK_P1: ffffffffffffffd0 BUGCHECK_P2: 2 BUGCHECK_P3: fffff806ebe39ad3 BUGCHECK_P4: 2 FILE_IN_CAB: 060725-24890-01.dmp FAULTING_THREAD: ffffac05359a3080 READ_ADDRESS: fffff806ec9c34c0: Unable to get MiVisibleState Unable to get NonPagedPoolStart Unable to get NonPagedPoolEnd Unable to get PagedPoolStart Unable to get PagedPoolEnd unable to get nt!MmSpecialPagesInUse ffffffffffffffd0 MM_INTERNAL_CODE: 2 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System STACK_TEXT: ffffbc0d<code>5fe270b8 fffff806</code>ebd1fca4 : 00000000<code>00000050 ffffffff</code>ffffffd0 00000000<code>00000002 ffffbc0d</code>5fe27320 : nt!KeBugCheckEx ffffbc0d<code>5fe270c0 fffff806</code>ebca8da0 : 00000000<code>00000002 ffff8000</code>00000000 ffffffff<code>ffffffd0 0000007f</code>fffffff8 : nt!MiSystemFault+0x7a0 ffffbc0d<code>5fe271b0 fffff806</code>ec0b41cb : ffffac05<code>51d7f010 00000000</code>00000000 00000000<code>00000001 ffffac05</code>51d7f080 : nt!MmAccessFault+0x630 ffffbc0d<code>5fe27320 fffff806</code>ebe39ad3 : ffffbc0d<code>5fe276a0 00000000</code>00000000 00000000<code>00000000 00000000</code>00000000 : nt!KiPageFault+0x38b ffffbc0d<code>5fe274b0 fffff806</code>ec253a13 : 00000000<code>00000000 ffffac05</code>3dfffb60 fffff806<code>eba00000 ffffbc0d</code>5fe275b9 : nt!ObReferenceObjectByPointerWithTag+0x53 ffffbc0d<code>5fe274f0 fffff806</code>9b2e32df : 00000000<code>00000000 00000000</code>00000000 ffffac05<code>40386000 00000003</code>2d789a16 : nt!ObOpenObjectByPointer+0x93 ffffbc0d<code>5fe27760 00000000</code>00000000 : 00000000<code>00000000 ffffac05</code>40386000 00000003<code>2d789a16 00000000</code>00000000 : pffilter+0x32df SYMBOL_NAME: pffilter+32df MODULE_NAME: pffilter IMAGE_NAME: pffilter.sys STACK_COMMAND: .process /r /p 0xffffac05336c0040; .thread 0xffffac05359a3080 ; kb BUCKET_ID_FUNC_OFFSET: 32df FAILURE_BUCKET_ID: AV_W_(null)_pffilter!unknown_function OS_VERSION: 10.0.26100.1 BUILDLAB_STR: ge_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {7a022701-1126-fdfe-bfac-f099a661ff04} Followup: MachineOwner ---------
