pastebin - collaborative debugging tool
nrubsig.kpaste.net RSS


Crash while unmounting multiple drives
Posted by Anonymous on Fri 4th Sep 2026 17:19
raw | new post

  1.  
  2. Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
  3. Copyright (c) Microsoft Corporation. All rights reserved.
  4.  
  5.  
  6. Loading Dump File [C:\Windows\MEMORY.DMP]
  7. Kernel Bitmap Dump File: Full address space is available
  8.  
  9. Symbol search path is: srv*
  10. Executable search path is:
  11. Windows 10 Kernel Version 19041 MP (8 procs) Free x64
  12. Product: WinNt, suite: TerminalServer SingleUserTS
  13. Built by: 19041.1.amd64fre.vb_release.191206-1406
  14. Machine Name:
  15. Kernel base = 0xfffff806`09400000 PsLoadedModuleList = 0xfffff806`0a02a420
  16. Debug session time: Fri Sep  4 18:13:44.693 2026 (UTC + 2:00)
  17. System Uptime: 0 days 0:07:27.418
  18. Loading Kernel Symbols
  19. ...............................................................
  20. ................................................................
  21. ................................................................
  22.  
  23. Loading User Symbols
  24. ................................................................
  25. ................................................................
  26. ................................................................
  27. ................................................................
  28. ...........................................
  29. Loading unloaded module list
  30. .........................................................................
  31. For analysis of this file, run !analyze -v
  32. 5: kd> !analyze -v
  33. *******************************************************************************
  34. *                                                                             *
  35. *                        Bugcheck Analysis                                    *
  36. *                                                                             *
  37. *******************************************************************************
  38.  
  39. KERNEL_SECURITY_CHECK_FAILURE (139)
  40. A kernel component has corrupted a critical data structure.  The corruption
  41. could potentially allow a malicious user to gain control of this machine.
  42. Arguments:
  43. Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
  44. Arg2: ffffe58d9490f870, Address of the trap frame for the exception that caused the bugcheck
  45. Arg3: ffffe58d9490f7c8, Address of the exception record for the exception that caused the bugcheck
  46. Arg4: 0000000000000000, Reserved
  47.  
  48. Debugging Details:
  49. ------------------
  50.  
  51.  
  52. KEY_VALUES_STRING: 1
  53.  
  54.     Key  : Analysis.CPU.Sec
  55.     Value: 5
  56.  
  57.     Key  : Analysis.DebugAnalysisProvider.CPP
  58.     Value: Create: 8007007e on WINGRENDEL02
  59.  
  60.     Key  : Analysis.DebugData
  61.     Value: CreateObject
  62.  
  63.     Key  : Analysis.DebugModel
  64.     Value: CreateObject
  65.  
  66.     Key  : Analysis.Elapsed.Sec
  67.     Value: 30
  68.  
  69.     Key  : Analysis.Memory.CommitPeak.Mb
  70.     Value: 122
  71.  
  72.     Key  : Analysis.System
  73.     Value: CreateObject
  74.  
  75.  
  76. BUGCHECK_CODE:  139
  77.  
  78. BUGCHECK_P1: 3
  79.  
  80. BUGCHECK_P2: ffffe58d9490f870
  81.  
  82. BUGCHECK_P3: ffffe58d9490f7c8
  83.  
  84. BUGCHECK_P4: 0
  85.  
  86. TRAP_FRAME:  ffffe58d9490f870 -- (.trap 0xffffe58d9490f870)
  87. NOTE: The trap frame does not contain all registers.
  88. Some register values may be zeroed or incorrect.
  89. rax=0000000000000003 rbx=0000000000000000 rcx=0000000000000003
  90. rdx=ffff92057bbfcbf0 rsi=0000000000000000 rdi=0000000000000000
  91. rip=fffff8060fdcb30a rsp=ffffe58d9490fa08 rbp=ffffe58d9490feb9
  92.  r8=fffff8060fdf7078  r9=fffff8060fde8b58 r10=0000000000000000
  93. r11=fffff80609400000 r12=0000000000000000 r13=0000000000000000
  94. r14=0000000000000000 r15=0000000000000000
  95. iopl=0         nv up ei ng nz na pe nc
  96. nfs41_driver!RtlFailFast+0xa:
  97. fffff806`0fdcb30a cd29            int     29h
  98. Resetting default scope
  99.  
  100. EXCEPTION_RECORD:  ffffe58d9490f7c8 -- (.exr 0xffffe58d9490f7c8)
  101. ExceptionAddress: fffff8060fdcb30a (nfs41_driver!RtlFailFast+0x000000000000000a)
  102.    ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  103.   ExceptionFlags: 00000001
  104. NumberParameters: 1
  105.    Parameter[0]: 0000000000000003
  106. Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
  107.  
  108. BLACKBOXBSD: 1 (!blackboxbsd)
  109.  
  110.  
  111. BLACKBOXNTFS: 1 (!blackboxntfs)
  112.  
  113.  
  114. BLACKBOXPNP: 1 (!blackboxpnp)
  115.  
  116.  
  117. BLACKBOXWINLOGON: 1
  118.  
  119. PROCESS_NAME:  explorer.exe
  120.  
  121. ERROR_CODE: (NTSTATUS) 0xc0000409 - Das System hat in dieser Anwendung den  berlauf eines stapelbasierten Puffers ermittelt. Dieser  berlauf k nnte einem b sartigen Benutzer erm glichen, die Steuerung der Anwendung zu  bernehmen.
  122.  
  123. EXCEPTION_CODE_STR:  c0000409
  124.  
  125. EXCEPTION_PARAMETER1:  0000000000000003
  126.  
  127. EXCEPTION_STR:  0xc0000409
  128.  
  129. STACK_TEXT:  
  130. ffffe58d`9490f548 fffff806`09811da9 : 00000000`00000139 00000000`00000003 ffffe58d`9490f870 ffffe58d`9490f7c8 : nt!KeBugCheckEx
  131. ffffe58d`9490f550 fffff806`09812350 : 00000000`00000000 00000000`000000cf 00000000`000010d6 ffff9205`7474d080 : nt!KiBugCheckDispatch+0x69
  132. ffffe58d`9490f690 fffff806`098101f2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
  133. ffffe58d`9490f870 fffff806`0fdcb30a : fffff806`0fdcb18d 00000000`00000003 00000000`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x332
  134. ffffe58d`9490fa08 fffff806`0fdcb18d : 00000000`00000003 00000000`00000000 00000000`00000000 00000000`00000000 : nfs41_driver!RtlFailFast+0xa [C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\km\wdm.h @ 11545]
  135. ffffe58d`9490fa10 fffff806`0fdcb2b7 : fffff806`0fdf7078 ffff9205`7bbfcbf0 fffff806`0fdf7078 00000000`00000007 : nfs41_driver!FatalListEntryError+0x1d [C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\km\wdm.h @ 11779]
  136. ffffe58d`9490fa40 fffff806`0fddcf06 : ffff9205`7bbfcbf0 fffff806`00000000 00000000`00000000 fffff806`0fde8b58 : nfs41_driver!RemoveEntryList+0x57 [C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\km\wdm.h @ 11816]
  137. ffffe58d`9490fa90 fffff806`0fdd621f : ffff9205`7bbfcb90 00000000`00000078 000001dc`a5c59040 ffffffff`ffffffff : nfs41_driver!nfs41_UpcallWaitForReply+0x386 [C:\cygwin64\home\roland_mainz\work\msnfs41_uidmapping\ms-nfs41-client\sys\nfs41sys_updowncall.c @ 569]
  138. ffffe58d`9490fb10 fffff806`0fe06790 : ffff9205`7bd2aa20 ffff9205`00030000 ffffb003`918b5b88 00000000`00000007 : nfs41_driver!nfs41_Create+0x8ff [C:\cygwin64\home\roland_mainz\work\msnfs41_uidmapping\ms-nfs41-client\sys\nfs41sys_openclose.c @ 953]
  139. ffffe58d`9490fcd0 fffff806`0fe07561 : ffff9205`7bd2aa20 ffff9205`7c5f8000 ffffb003`918b5820 ffffe58d`00000000 : nfs41_driver!RxCollapseOrCreateSrvOpen+0x130 [base\fs\rdr2\rdbss\create.c @ 2034]
  140. ffffe58d`9490fd70 fffff806`0fe07000 : ffff9205`7bd2aa20 ffffe58d`00000007 ffffe58d`9490fe90 00000000`00000002 : nfs41_driver!RxCreateFromNetRoot+0x3b1 [base\fs\rdr2\rdbss\create.c @ 2634]
  141. ffffe58d`9490fe00 fffff806`0fde30e2 : ffff9205`7bd2aa20 ffff9205`c0000016 ffff9205`7dc71b80 00000000`00000000 : nfs41_driver!RxCommonCreate+0x3e0 [base\fs\rdr2\rdbss\create.c @ 3729]
  142. ffffe58d`9490ff20 fffff806`0fe039ad : fffff806`0fdf6160 fffff806`09db4100 00000001`00000000 ffff9205`79913080 : nfs41_driver!RxFsdCommonDispatch+0x442 [base\fs\rdr2\rdbss\ntfsd.c @ 848]
  143. ffffe58d`94910020 fffff806`0fdc8800 : ffff9205`7d34b1d0 00000000`00000000 00000000`000e000e 00000000`00000000 : nfs41_driver!RxFsdDispatch+0xfd [base\fs\rdr2\rdbss\ntfsd.c @ 442]
  144. ffffe58d`94910050 fffff806`096d21c5 : ffff9205`79913080 ffff9205`7c5f8010 ffff9205`7d34b260 ffffb003`94d3d4d0 : nfs41_driver!nfs41_FsdDispatch+0x1e0 [C:\cygwin64\home\roland_mainz\work\msnfs41_uidmapping\ms-nfs41-client\sys\nfs41sys_driver.c @ 1262]
  145. ffffe58d`949100b0 fffff806`0df7f558 : 00000000`00000001 fffff806`0df7f31a ffff9205`7d34b280 00000000`00000000 : nt!IofCallDriver+0x55
  146. ffffe58d`949100f0 fffff806`0df7f0a9 : ffffb003`8e018320 00000000`00000000 fffff806`0df78000 ffff9205`7dc6f400 : mup!MupiCallUncProvider+0xb8
  147. ffffe58d`94910160 fffff806`0df7ed7f : 00000000`00000000 00000000`00000008 ffff9205`7dc71b80 ffff9205`7dc6f400 : mup!MupStateMachine+0x59
  148. ffffe58d`94910190 fffff806`096d21c5 : ffff9205`7ca92010 ffff9205`7dc6f400 00000000`00000000 ffff9205`7d34b1d0 : mup!MupCreate+0x1cf
  149. ffffe58d`94910200 fffff806`071e710f : ffff9205`7dc71c00 ffffe58d`949102f0 ffffe58d`949102f9 fffff806`071e5f7a : nt!IofCallDriver+0x55
  150. ffffe58d`94910240 fffff806`07219ee4 : ffffe58d`949102f0 ffff9205`7dc71bd8 ffff9205`76e298d0 00000000`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
  151. ffffe58d`949102b0 fffff806`096d21c5 : ffff9205`7dc71b00 ffff9205`76ef4c20 00000000`00000000 00000000`00000000 : FLTMGR!FltpCreate+0x324
  152. ffffe58d`94910360 fffff806`096d4084 : 00000000`00000000 fffff806`09db418e 00000000`00000080 ffff9205`76e298d0 : nt!IofCallDriver+0x55
  153. ffffe58d`949103a0 fffff806`09a4f829 : ffffe58d`94910650 ffff9205`76ef4c20 ffff9205`7dc71c18 ffffe58d`94910001 : nt!IoCallDriverWithTracing+0x34
  154. ffffe58d`949103f0 fffff806`09a42757 : ffff9205`76ef4c20 ffff9205`76ef4b00 ffff9205`7b571010 ffffb003`8e419901 : nt!IopParseDevice+0x11a9
  155. ffffe58d`94910550 fffff806`09acec8a : ffff9205`7b571001 ffffe58d`949107b8 00000000`00000040 ffff9205`746e9d20 : nt!ObpLookupObjectName+0x1117
  156. ffffe58d`94910720 fffff806`09a0ccb5 : ffffe58d`00000000 00000000`0862d5b0 00000000`0862da40 00000000`0862d580 : nt!ObOpenObjectByNameEx+0x1fa
  157. ffffe58d`94910850 fffff806`09811505 : ffff9205`7c06c080 00000000`00000000 ffff9205`7c06c080 00000000`00000000 : nt!NtQueryAttributesFile+0x1c5
  158. ffffe58d`94910b00 00007ff9`7e94dd44 : 00007ff9`7c1c8c45 00000000`0862d980 00000000`00000000 00000000`08e6fae0 : nt!KiSystemServiceCopyEnd+0x25
  159. 00000000`0862d548 00007ff9`7c1c8c45 : 00000000`0862d980 00000000`00000000 00000000`08e6fae0 00000000`00000021 : ntdll!NtQueryAttributesFile+0x14
  160. 00000000`0862d550 00007ff9`7e2521ca : 00000000`00000000 00000000`0862d8d0 00000000`00000000 00000000`00000000 : KERNELBASE!GetFileAttributesW+0x85
  161. 00000000`0862d5f0 00007ff9`7a098e51 : 00000000`00000000 00000000`00000032 00000000`0862d980 00000000`00000001 : shlwapi!PathFileExistsAndAttributesW+0x5a
  162. 00000000`0862d880 00007ff9`7a14042a : 00000000`00000040 00000000`00000000 00000000`00000000 00000000`00000001 : windows_storage!CDrivesFolder::GetAttributesOf+0x151
  163. 00000000`0862da00 00007ff9`7a0df3af : 00000000`012dd2d0 00000000`00000000 00000000`00000000 00000000`00000007 : windows_storage!CRegFolder::GetAttributesOf+0x1aa
  164. 00000000`0862daa0 00007ff9`7a096ac6 : 00000000`0000001f 00000000`18b00af0 00000000`00000000 00000000`00000000 : windows_storage!SHILAliasTranslate+0x8af
  165. 00000000`0862def0 00007ff9`7a0aaaa4 : 00000000`80070057 00000000`04861200 00000000`00000000 00000000`00000000 : windows_storage!CDesktopFolder::ParseDisplayName+0xce6
  166. 00000000`0862e920 00007ff9`7d7d1027 : 00000000`04950040 00000000`0862eb40 00000000`04950040 00000000`0000000f : windows_storage!CRegFolder::ParseDisplayName+0x134
  167. 00000000`0862ea40 00007ff9`7d7cf105 : 00000000`0484e910 00000000`00000001 00000000`00000000 00000000`0862f2a0 : SHELL32!ReparseRelativeIDListInternal+0x417
  168. 00000000`0862f1a0 00007ff9`7d7c8355 : 00000000`0132b1a8 00000000`0132b1a8 00000000`0132b1a8 00000000`00000000 : SHELL32!CAnyAlias::v_SendNotification+0x165
  169. 00000000`0862f300 00007ff9`7decef5c : 00000000`00000000 00000000`00000008 00000000`00000001 00000000`000100c0 : SHELL32!CChangeNotify::s_WndProc+0x615
  170. 00000000`0862f450 00007ff9`7dece684 : 00000000`00000000 00007ff9`7d7c7d40 00000000`01006800 00000000`01ae7c70 : user32!UserCallWinProcCheckWow+0x50c
  171. 00000000`0862f5e0 00007ff9`7d7f9905 : 00007ff9`7d7c7d40 00000000`00000001 00000000`0484e910 00000000`04874580 : user32!DispatchMessageWorker+0x494
  172. 00000000`0862f660 00007ff9`7d7f934e : 00000000`00000000 00000000`00000000 00000000`0484e910 00007ff9`7dd77f20 : SHELL32!CChangeNotify::_MessagePump+0x525
  173. 00000000`0862f7a0 00007ff9`7c9dbd19 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000218 : SHELL32!CChangeNotify::s_ThreadProc+0x15e
  174. 00000000`0862f860 00007ff9`7e527374 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : shcore!_WrapperThreadProc+0xe9
  175. 00000000`0862f940 00007ff9`7e8fcc91 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14
  176. 00000000`0862f970 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
  177.  
  178.  
  179. FAULTING_SOURCE_LINE:  C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\km\wdm.h
  180.  
  181. FAULTING_SOURCE_FILE:  C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\km\wdm.h
  182.  
  183. FAULTING_SOURCE_LINE_NUMBER:  11545
  184.  
  185. FAULTING_SOURCE_CODE:  
  186.  11541:     )
  187.  11542:
  188.  11543: {
  189.  11544:
  190. >11545:     __fastfail(Code);
  191.  11546: }
  192.  11547:
  193.  11548: #endif // _MSC_VER
  194.  11549:
  195.  11550: //
  196.  
  197.  
  198. SYMBOL_NAME:  nfs41_driver!RtlFailFast+a
  199.  
  200. MODULE_NAME: nfs41_driver
  201.  
  202. IMAGE_NAME:  nfs41_driver.sys
  203.  
  204. STACK_COMMAND:  .thread ; .cxr ; kb
  205.  
  206. BUCKET_ID_FUNC_OFFSET:  a
  207.  
  208. FAILURE_BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_nfs41_driver!RtlFailFast
  209.  
  210. OS_VERSION:  10.0.19041.1
  211.  
  212. BUILDLAB_STR:  vb_release
  213.  
  214. OSPLATFORM_TYPE:  x64
  215.  
  216. OSNAME:  Windows 10
  217.  
  218. FAILURE_ID_HASH:  {7fe0db02-499d-ef29-7ce7-92b961f8dd2f}
  219.  
  220. Followup:     MachineOwner
  221. ---------

Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.

Syntax highlighting:

To highlight particular lines, prefix each line with {%HIGHLIGHT}




All content is user-submitted.
The administrators of this site (kpaste.net) are not responsible for their content.
Abuse reports should be emailed to us at