Hi Wei Li,
thank you for the response.
We already had a case open with Crowdstrike and this is what they tell us:
Our internal team has finished reviewing your issue and provided the following feedback.
A filter below us in the stack is using Shadow File Objects.
One of those file objects is finding its way to the top of the stack,
which in turn makes its way to us.
We try to set a context on it, but because that file object isn't valid at our altitude, it crashes the fltmgr.
This is most likely an FsLogix issue and the customer should raise a ticket with Microsoft (who own FsLogix).
We also have a case open with Microsoft for FsLogix, but still no response since almost one month.
That is why I tried to exclude msedge.exe, because msedge.exe was listed in most of the dumps as "PROCESS_NAME".
msedge.exe is auto-starting on logon and opening the local sharepoint intranet site. Once I disabled autostart for msedge.exe, the server did not crash anymore for around 500 logins/logoffs (we use a tool to do automated logons and logoffs to reproduce the BSOD).
sfc /scannow did tell me "Windows Resource Protection did not find any integrity violations."
I reenabled autostart of medge.exe and the server started crashing again - so I disabled SmartScreen, because I found some discussions from where Cylance and Crowdstrike had some incompatibilities:
https://www.reddit.com/r/crowdstrike/comments/muul48/might_have_found_a_bug_w_win10_20h2_cs_edge/
But even after disabling SmartScreen the server crashed once unil now ( started the test 1 hour ago and have it still running) - but this time it was not msedge.exe - but "PROCESS_NAME: svchost.exe".
Here the full details from minidump:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff9b8edcc7c530, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffff9b8edcc7c488, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2171
Key : Analysis.Elapsed.mSec
Value: 3399
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 249
Key : Analysis.Init.Elapsed.mSec
Value: 10257
Key : Analysis.Memory.CommitPeak.Mb
Value: 87
Key : Bugcheck.Code.LegacyAPI
Value: 0x139
Key : Dump.Attributes.AsUlong
Value: 1008
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : Failure.Bucket
Value: 0x139_3_CORRUPT_LIST_ENTRY_csagent!unknown_function
Key : Failure.Hash
Value: {7426b4cc-64fd-f44e-8cfd-be51c497bc7e}
Key : Hypervisor.Enlightenments.Value
Value: 13088
Key : Hypervisor.Enlightenments.ValueHex
Value: 3320
Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1
Key : Hypervisor.Flags.ApicEnlightened
Value: 0
Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 0
Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0
Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0
Key : Hypervisor.Flags.CpuManager
Value: 0
Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 1
Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 0
Key : Hypervisor.Flags.Epf
Value: 0
Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 0
Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 0
Key : Hypervisor.Flags.MaxBankNumber
Value: 0
Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0
Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 1
Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 0
Key : Hypervisor.Flags.Phase0InitDone
Value: 1
Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0
Key : Hypervisor.Flags.RootScheduler
Value: 0
Key : Hypervisor.Flags.SynicAvailable
Value: 1
Key : Hypervisor.Flags.UseQpcBias
Value: 0
Key : Hypervisor.Flags.Value
Value: 536632
Key : Hypervisor.Flags.ValueHex
Value: 83038
Key : Hypervisor.Flags.VpAssistPage
Value: 1
Key : Hypervisor.Flags.VsmAvailable
Value: 0
Key : Hypervisor.RootFlags.AccessStats
Value: 0
Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 0
Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 0
Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0
Key : Hypervisor.RootFlags.HostTimelineSync
Value: 0
Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0
Key : Hypervisor.RootFlags.IsHyperV
Value: 0
Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 0
Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 0
Key : Hypervisor.RootFlags.MceEnlightened
Value: 0
Key : Hypervisor.RootFlags.Nested
Value: 0
Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 0
Key : Hypervisor.RootFlags.Value
Value: 0
Key : Hypervisor.RootFlags.ValueHex
Value: 0
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffff9b8edcc7c530
BUGCHECK_P3: ffff9b8edcc7c488
BUGCHECK_P4: 0
FILE_IN_CAB: 112423-24906-01.dmp
DUMP_FILE_ATTRIBUTES: 0x1008
Kernel Generated Triage Dump
TRAP_FRAME: ffff9b8edcc7c530 -- (.trap 0xffff9b8edcc7c530)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd389a752b4a0 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80079b2b270 rsp=ffff9b8edcc7c6c0 rbp=ffffd389a26635b0
r8=00000000ffffffff r9=7fffc204a15a55b8 r10=7ffffffffffffffc
r11=ffff9b8edcc7c678 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
FLTMGR!FltpGetFileListCtrl+0x1a8:
fffff800`79b2b270 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff9b8edcc7c488 -- (.exr 0xffff9b8edcc7c488)
ExceptionAddress: fffff80079b2b270 (FLTMGR!FltpGetFileListCtrl+0x00000000000001a8)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: svchost.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Das System hat in dieser Anwendung den berlauf eines stapelbasierten Puffers ermittelt. Dieser berlauf k nnte einem b sartigen Benutzer erm glichen, die Steuerung der Anwendung zu bernehmen.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffff9b8e`dcc7c208 fffff800`78c36f69 : 00000000`00000139 00000000`00000003 ffff9b8e`dcc7c530 ffff9b8e`dcc7c488 : nt!KeBugCheckEx
ffff9b8e`dcc7c210 fffff800`78c374f2 : ffffd389`a7513000 fffff800`78a7595b ffffffff`ffffffff ffff9b8e`00000028 : nt!KiBugCheckDispatch+0x69
ffff9b8e`dcc7c350 fffff800`78c3539e : fffff800`79b246a6 fffff800`79b26872 00000000`00000000 fffff800`78a4b205 : nt!KiFastFailDispatch+0xb2
ffff9b8e`dcc7c530 fffff800`79b2b270 : 00000000`00000000 ffffd389`a26635b0 ffffd389`a752b470 fffff800`79b29daf : nt!KiRaiseSecurityCheckFailure+0x31e
ffff9b8e`dcc7c6c0 fffff800`79b2af06 : ffffc204`bc13b470 ffffd389`a752b470 00000000`00000000 ffff9b8e`dcc7c7f0 : FLTMGR!FltpGetFileListCtrl+0x1a8
ffff9b8e`dcc7c710 fffff800`79b2ae83 : ffff9b8e`dcc7c880 ffff9b8e`dcc7c840 ffffd389`ad34eb00 ffffc204`bc13b4d0 : FLTMGR!SetContextIntoFileList+0x6e
ffff9b8e`dcc7c780 fffff800`e48fa5dc : 00000000`00000000 ffff9b8e`dcc7c840 ffff04d5`cdaea11a fffff800`79b300de : FLTMGR!FltSetFileContext+0x23
ffff9b8e`dcc7c7c0 00000000`00000000 : ffff9b8e`dcc7c840 ffff04d5`cdaea11a fffff800`79b300de ffff9b8e`dcc7c7f0 : csagent+0x7a5dc
SYMBOL_NAME: csagent+7a5dc
MODULE_NAME: csagent
IMAGE_NAME: csagent.sys
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 7a5dc
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_csagent!unknown_function
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {7426b4cc-64fd-f44e-8cfd-be51c497bc7e}
Followup: MachineOwner
---------
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
