BSOD caused by several different code

Question

Hi, I've been running into BSOD very often recently

The BSOD code is not the same every time.

Here's the link of the the minidumps collected this week. https://drive.google.com/file/d/1xaBij1wfNpXbrt01RKFgaPv1p3r8a_zC/view?usp=sharing

Here's the minidump of the most recent one.

My CPU is AMD ryzen 3600

I've tried DISM.exe /Online /Cleanup-image /Restorehealth and RAM check, but it passed and BSOD still happens.

||2:5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 000000000000001e, Type of memory safety violation
Arg2: ffffcf8afc90fe10, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffffcf8afc90fd68, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 3577

    Key  : Analysis.Elapsed.mSec
    Value: 10363

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 1015

    Key  : Analysis.Init.Elapsed.mSec
    Value: 11333

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 166

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x139

    Key  : FailFast.Name
    Value: INVALID_NEXT_THREAD

    Key  : FailFast.Type
    Value: 30

    Key  : Failure.Bucket
    Value: 0x139_1e_INVALID_NEXT_THREAD_IMAGE_ntkrnlmp.exe

    Key  : Failure.Hash
    Value: {64929928-a824-2134-285e-71128496d311}

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Version
    Value: 10.0.19041.1

BUGCHECK_CODE:  139

BUGCHECK_P1: 1e

BUGCHECK_P2: ffffcf8afc90fe10

BUGCHECK_P3: ffffcf8afc90fd68

BUGCHECK_P4: 0

FILE_IN_CAB:  101723-10296-01.dmp

IMAGE_NAME:  ntkrnlmp.exe

MODULE_NAME: ntkrnlmp

FAULTING_MODULE: fffff80553600000 nt

TRAP_FRAME:  ffffcf8afc90fe10 -- (.trap 0xffffcf8afc90fe10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000004 rbx=0000000000000000 rcx=000000000000001e
rdx=fffff805542fdcc0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80553a4a4a7 rsp=ffffcf8afc90ffa0 rbp=ffff8c01dc640180
 r8=00000000000009ec  r9=ffffcf8afc910330 r10=0000000000000000
r11=ffffcf8afc9100b0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KeQueryValuesThread+0x1a8947:
fffff805`53a4a4a7 cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffffcf8afc90fd68 -- (.exr 0xffffcf8afc90fd68)
ExceptionAddress: fffff80553a4a4a7 (nt!KeQueryValuesThread+0x00000000001a8947)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 000000000000001e
Subcode: 0x1e FAST_FAIL_INVALID_NEXT_THREAD 

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  WmiPrvSE.exe

ERROR_CODE: (NTSTATUS) 0xc0000409 -  t         o       {       |   D w           A o         i       h   y           o o   q         C

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  000000000000001e

EXCEPTION_STR:  0xc0000409

STACK_TEXT:  
ffffcf8a`fc90fae8 fffff805`53a11729     : 00000000`00000139 00000000`0000001e ffffcf8a`fc90fe10 ffffcf8a`fc90fd68 : nt!KeBugCheckEx
ffffcf8a`fc90faf0 fffff805`53a11c90     : fffff805`5392af20 fffff805`5391d8e0 ffff8c01`dc640180 ffffbf0e`00000000 : nt!KiBugCheckDispatch+0x69
ffffcf8a`fc90fc30 fffff805`53a0fc5d     : 00000000`00000000 fffff805`53c074d8 ffffcf8a`fc910120 00000000`00000001 : nt!KiFastFailDispatch+0xd0
ffffcf8a`fc90fe10 fffff805`53a4a4a7     : 00000000`00000000 00000000`00000001 00000000`00000005 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x31d
ffffcf8a`fc90ffa0 fffff805`53c34241     : 00000000`00000000 00000000`00000000 fffff805`00000000 fffffed0`fd61ede2 : nt!KeQueryValuesThread+0x1a8947
ffffcf8a`fc910020 fffff805`53c33ed2     : ffffbf0e`2faa1620 ffffbf0e`2faa18a0 ffffbf0e`411f1080 00000000`00000000 : nt!PsQueryStatisticsProcess+0x111
ffffcf8a`fc9100a0 fffff805`53c03261     : 00000000`00000000 ffffbf0e`2faa1040 00000000`ffffffff 00000000`00000000 : nt!ExpCopyProcessInfo+0x42
ffffcf8a`fc910120 fffff805`53bf94a7     : 00000000`00000000 00000000`00008000 00000000`00000000 00000000`00000000 : nt!ExpGetProcessInformation+0x9f1
ffffcf8a`fc910780 fffff805`53bf8657     : 00000000`00000001 000000b9`ae19d4d0 00000215`62ea47c0 00000215`62e72e10 : nt!ExpQuerySystemInformation+0xd07
ffffcf8a`fc910ac0 fffff805`53a10ef8     : ffffbf0e`411f0000 ffffbf0e`3f8d9070 ffffcf8a`fc910b80 ffffbf0e`00000000 : nt!NtQuerySystemInformation+0x37
ffffcf8a`fc910b00 00007fff`9530d6a4     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000b9`ae19d3a8 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`9530d6a4

IMAGE_VERSION:  10.0.19041.3570

STACK_COMMAND:  .cxr; .ecxr ; kb

FAILURE_BUCKET_ID:  0x139_1e_INVALID_NEXT_THREAD_IMAGE_ntkrnlmp.exe

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {64929928-a824-2134-285e-71128496d311}

Followup:     MachineOwner
---------

Answer 1

If no RAM errors are found, to try to force Windows 10 show any faulting drivers, the best option would be to turn on Driver Verifier, let your PC crash 3 times, then you must turn off Driver Verifier, and finally, upload any newly created minidump files

Before you run Driver Verifier, please create a new System Restore Point

https://answers.microsoft.com/en-us/windows/for...

---

Note, if you have any difficulty getting into Windows with Driver Verifier enabled:

Start your PC, just as Windows attempts to load (spinning dots), press and hold Power Button for 5 - 10 seconds to perform a Hard Shut Down

Do this twice

On the third start Windows will boot into the Recovery Environment and from there you can access System Repair, Safe Mode, Command Prompt... etc.

Go to Troubleshoot - Advanced Option - Startup Settings and click Restart

Upon restart, press 4 to enter Safe Mode

Open Command Prompt as Administrator and run these two commands, then restart your PC.

verifier /reset

verifier /bootmode resetonbootfail

Answer 2

Hi Dave,

I ran MemTest86 overnight for 8 scan loops and all of them passed.

Answer 3

That minidump file also listed RAM corruption as contributing to the system crashes, so the next option is to download the widely available free utility MemTest86, then run a full 4 pass scan with that to test your RAM for physical errors

Answer 4

Hi Dave,

Thanks for your reply.

Yesterday I checked the 101723-10296-01.dmp and updated my network card driver.

(Sorry my system language is chinese)

However, it still crashed today. (101723-10750-01.dmp)

Answer 5

HI, I am Dave, I will help you with this.

Your minidump files indicate RAM corruption and the device driver on the Realtek network card as the cause of the system crashes.

Go to the support page for your PC on the manufacturers website, then from there, download and re-install the version of Realtek network card device drivers they provide.