Blue Screen

Question

Could you please help. When restarting, the PC went to the blue screen and rebooted several times. In addition, I have Windows 11 Pro, for some reason it is indicated in the memory dump that the system is Windows 10.

************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : true
   AllowNugetExeUpdate : true
   NonInteractiveNuget : true
   AllowNugetMSCredentialProviderInstall : true
   AllowParallelInitializationOfLocalRepositories : true

   EnableRedirectToV8JsProvider : false

   -- Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.157 seconds
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 41

Microsoft (R) Windows Debugger Version 10.0.27553.1004 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Primary dump contents written successfully

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 22621 MP (32 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 22621.1.amd64fre.ni_release.220506-1250
Kernel base = 0xfffff807`15a00000 PsLoadedModuleList = 0xfffff807`16613150
Debug session time: Fri Jun 28 20:42:39.493 2024 (UTC + 3:00)
System Uptime: 0 days 0:00:19.147
Loading Kernel Symbols
...............................................................
................................................................
................................................................
....................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`00c26018).  Type ".hh dbgerr001" for details
Loading unloaded module list
............
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff807`15e1a240 48894c2408      mov     qword ptr [rsp+8],rcx ss:ffffcf85`7f356b20=0000000000000139
4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffcf857f356e40, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffffcf857f356d98, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 796

    Key  : Analysis.Elapsed.mSec
    Value: 1454

    Key  : Analysis.IO.Other.Mb
    Value: 13

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 30

    Key  : Analysis.Init.CPU.mSec
    Value: 108

    Key  : Analysis.Init.Elapsed.mSec
    Value: 46536

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 106

    Key  : Bugcheck.Code.KiBugCheckData
    Value: 0x139

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x139

    Key  : Bugcheck.Code.TargetModel
    Value: 0x139

    Key  : Dump.Attributes.AsUlong
    Value: 1800

    Key  : Dump.Attributes.DiagDataWrittenToHeader
    Value: 1

    Key  : Dump.Attributes.ErrorCode
    Value: 0

    Key  : Dump.Attributes.LastLine
    Value: Dump completed successfully.

    Key  : Dump.Attributes.ProgressPercentage
    Value: 100

    Key  : FailFast.Name
    Value: CORRUPT_LIST_ENTRY

    Key  : FailFast.Type
    Value: 3

    Key  : Failure.Bucket
    Value: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

    Key  : Failure.Hash
    Value: {3aede96a-54dd-40d6-d4cb-2a161a843851}

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 1417df84

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 1

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 0

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 1

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 1

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 1

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 1

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 1

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 1

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 1

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 1

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 1

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 21631230

    Key  : Hypervisor.Flags.ValueHex
    Value: 14a10fe

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 1

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 1

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 1

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 1

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 1

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 1

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.Value
    Value: 1015

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 3f7

    Key  : SecureKernel.HalpHvciEnabled
    Value: 1

    Key  : WER.OS.Branch
    Value: ni_release

    Key  : WER.OS.Version
    Value: 10.0.22621.1

BUGCHECK_CODE:  139

BUGCHECK_P1: 3

BUGCHECK_P2: ffffcf857f356e40

BUGCHECK_P3: ffffcf857f356d98

BUGCHECK_P4: 0

FILE_IN_CAB:  MEMORY.DMP

TAG_NOT_DEFINED_202b:  *** Unknown TAG in analysis list 202b

DUMP_FILE_ATTRIBUTES: 0x1800

TRAP_FRAME:  ffffcf857f356e40 -- (.trap 0xffffcf857f356e40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffbd84101e8000 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffbd84074002e0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80715ecaff1 rsp=ffffcf857f356fd0 rbp=000000000000a800
 r8=ffffbd84101e8000  r9=0000000000000000 r10=0000000000000001
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!RtlpHpVsContextAddSubsegment+0x179dc1:
fffff807`15ecaff1 cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffffcf857f356d98 -- (.exr 0xffffcf857f356d98)
ExceptionAddress: fffff80715ecaff1 (nt!RtlpHpVsContextAddSubsegment+0x0000000000179dc1)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY 

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXWINLOGON: 1

PROCESS_NAME:  LightingService.exe

ERROR_CODE: (NTSTATUS) 0xc0000409 -                                                             .                                                                                           .

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000003

EXCEPTION_STR:  0xc0000409

STACK_TEXT:  
ffffcf85`7f356b18 fffff807`15e30129     : 00000000`00000139 00000000`00000003 ffffcf85`7f356e40 ffffcf85`7f356d98 : nt!KeBugCheckEx
ffffcf85`7f356b20 fffff807`15e306f2     : ffff9580`00000000 ffffcf85`7f356c70 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffcf85`7f356c60 fffff807`15e2e3db     : ffffbd84`00000000 fffff807`00000000 00000000`00000000 ffffbd84`10101d00 : nt!KiFastFailDispatch+0xb2
ffffcf85`7f356e40 fffff807`15ecaff1     : ffffbd84`101b1000 ffffbd84`00000001 00000000`0a820000 ffffbd84`074002c0 : nt!KiRaiseSecurityCheckFailure+0x35b
ffffcf85`7f356fd0 fffff807`15c648cb     : 00000000`00000000 ffffbd84`101b1000 00000000`00000000 fffff807`00000010 : nt!RtlpHpVsContextAddSubsegment+0x179dc1
ffffcf85`7f357000 fffff807`15c2d57e     : ffffd10f`00000a81 ffffcdfc`0000a800 ffffffff`00000a82 ffffd10f`edd27080 : nt!RtlpHpVsContextAllocateInternal+0x38b
ffffcf85`7f357070 fffff807`15c2b76b     : 00000000`00000000 00000000`0000a800 00000000`00000000 00000000`00000001 : nt!RtlpHpAllocateHeap+0x12e
ffffcf85`7f357110 fffff807`15c2b18f     : ffffd10f`edc68dc0 00000000`00000fff 00000000`65526d4d 00000000`00000000 : nt!ExAllocateHeapPool+0x5ab
ffffcf85`7f357230 fffff807`15c2d3d6     : 00000000`80000000 00000000`0000a7fa 00000000`65526d4d 00000000`00000000 : nt!ExpAllocatePoolWithTagFromNode+0x5f
ffffcf85`7f357280 fffff807`160f3358     : 00000000`00000003 00000000`00000000 00000000`00016f01 ffffcf85`7f357300 : nt!MiAllocatePool+0x86
ffffcf85`7f3572d0 fffff807`160f28b3     : ffffbd84`10198000 ffffcf85`7f357503 00000000`00016fe0 00000000`002a4000 : nt!MiCompressRelocations+0x118
ffffcf85`7f357340 fffff807`160dd96d     : ffffcf85`7f357760 ffffcf85`7f357589 00000000`00000002 00000000`00000002 : nt!MiRelocateImage+0x53f
ffffcf85`7f3574b0 fffff807`16102e7a     : ffffd10f`ee020190 ffffcf85`7f357760 ffffcf85`7f357760 ffffbd84`0fb3f5c0 : nt!MiCreateNewSection+0x5c9
ffffcf85`7f3575f0 fffff807`16102424     : ffffcf85`7f357620 ffffbd84`101455e0 ffffd10f`ee020190 00000000`00000000 : nt!MiCreateImageOrDataSection+0x2fa
ffffcf85`7f3576e0 fffff807`16102195     : 00000000`01000000 ffffcf85`7f357aa0 00000000`00000001 ffffd10f`ed0139e0 : nt!MiCreateSection+0xf4
ffffcf85`7f357860 fffff807`16101f2c     : 00000000`0146e3e8 00000000`0000000d 00000000`00000000 00000000`00000001 : nt!MiCreateSectionCommon+0x255
ffffcf85`7f357940 fffff807`15e2f805     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateSection+0x5c
ffffcf85`7f3579b0 00007ffb`a7b308e4     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`0146e348 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`a7b308e4

SYMBOL_NAME:  nt!KiFastFailDispatch+b2

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  b2

FAILURE_BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

OS_VERSION:  10.0.22621.1

BUILDLAB_STR:  ni_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {3aede96a-54dd-40d6-d4cb-2a161a843851}

Followup:     MachineOwner
---------

NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2402.24001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2402.24001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2402.24001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2402.24001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2402.24001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2402.24001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2402.24001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2402.24001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2402.24001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2402.24001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2402.24001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2402.24001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis'
NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2402.24001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis'

Answer 1

Dear Анна Корнивец,

Welcome to the Microsoft Community

Thank you for reaching out about the recurring blue screen issue on your Windows 11 Pro system. I understand the concern this has caused, and I'm here to assist you in resolving it.

The discrepancy in the blue screen logs identifying as Windows 10 on a Windows 11 system relates to how core system files and internal version numbers are identified. This is a nominal distinction and does not indicate a problem with your system. Please rest assured that this does not impact the functionality or stability of your Windows 11 operating environment.

Regarding the specific issue recorded in the blue screen log, it appears that LightingService.exe is causing the blue screen on your computer. This software is commonly found on systems with Asus's motherboards and is used to manage RGB lighting for various computer components and peripherals. It is typically associated with components like AURA RGB Lighting or Armoury Crate.

To address this issue, I recommend checking for updates to the LightingService software. Updating the software may resolve the blue screen problem you're experiencing. Alternatively, if you do not use or require this software for your setup, you can consider uninstalling it. Rest assured, as this software is not a core Windows component, removing it should not impact the normal operation of your system.

Please proceed with updating or uninstalling the LightingService software as per your preference. If you encounter any further questions or need additional assistance, please don't hesitate to reach out. I'm here to help resolve any concerns you may have. I look forward to your response.

Best Regards,

Martin | Microsoft Community Support Specialist