KERNEL_SECURITY_CHECK_FAILURE (139)

Anonymous

Hello! Recently I have been getting this error a couple of times over multiple days seemingly out of the blue. From what I remember, I was previously behind on a network driver and a Bluetooth driver I think, but that is all I can come up with that could have caused this. I've tried updating drivers, running commands to find and fix corruption (sfc and DISM cmds) nothing was detected. I also have McAfee and scanned for viruses a couple of times. I may have done one or two more things that I can not remember. The full dump file is below. Please help me and thank you for your time! P.S. This is my first time posting here, so if I'm doing something wrong please do tell me.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff8c0b7fcb5700, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffff8c0b7fcb5658, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 2874

    Key  : Analysis.Elapsed.mSec
    Value: 6360

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 531

    Key  : Analysis.Init.Elapsed.mSec
    Value: 6797

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 96

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x139

    Key  : FailFast.Name
    Value: CORRUPT_LIST_ENTRY

    Key  : FailFast.Type
    Value: 3

    Key  : Failure.Bucket
    Value: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiProcessExpiredTimerList

    Key  : Failure.Hash
    Value: {9db7945b-255d-24a1-9f2c-82344e883ab8}

    Key  : Hypervisor.Enlightenments.Value
    Value: 77057948

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 497cf9c

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 1

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 1

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 0

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 1

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 0

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 1

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 1

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 1

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 1

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 1

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 1

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 4853999

    Key  : Hypervisor.Flags.ValueHex
    Value: 4a10ef

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 1

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 1

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 1

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 1

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 1

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 1

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.Value
    Value: 1015

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 3f7

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Version
    Value: 10.0.19041.1

BUGCHECK_CODE:  139

BUGCHECK_P1: 3

BUGCHECK_P2: ffff8c0b7fcb5700

BUGCHECK_P3: ffff8c0b7fcb5658

BUGCHECK_P4: 0

FILE_IN_CAB:  100523-7625-01.dmp

TRAP_FRAME:  ffff8c0b7fcb5700 -- (.trap 0xffff8c0b7fcb5700)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd68c4e81fe80 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80363334008 rsp=ffff8c0b7fcb5890 rbp=ffffd68c4e81fe78
 r8=0000000000000000  r9=0000000000000002 r10=fffff8035debfac0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!KiProcessThreadWaitList+0x88:
fffff803`63334008 cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffff8c0b7fcb5658 -- (.exr 0xffff8c0b7fcb5658)
ExceptionAddress: fffff80363334008 (nt!KiProcessThreadWaitList+0x0000000000000088)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY 

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000003

EXCEPTION_STR:  0xc0000409

STACK_TEXT:  
ffff8c0b`7fcb53d8 fffff803`63410e29     : 00000000`00000139 00000000`00000003 ffff8c0b`7fcb5700 ffff8c0b`7fcb5658 : nt!KeBugCheckEx
ffff8c0b`7fcb53e0 fffff803`63411390     : 00000000`0006fcee fffff803`632429f9 fffff803`6338e130 fffff803`63398e90 : nt!KiBugCheckDispatch+0x69
ffff8c0b`7fcb5520 fffff803`6340f35d     : ffffc280`744c0180 00000000`00000000 00000000`00000000 00000000`0000ffff : nt!KiFastFailDispatch+0xd0
ffff8c0b`7fcb5700 fffff803`63334008     : ffffd68c`3c77a1c0 ffffd68c`5b1f6340 00000000`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x31d
ffff8c0b`7fcb5890 fffff803`6324dcfd     : ffffd68c`4eca0d18 00000000`00000007 ffffc280`744c0180 00000000`00000002 : nt!KiProcessThreadWaitList+0x88
ffff8c0b`7fcb58e0 fffff803`6324cbcd     : 00000000`00000000 fffff803`632f4275 00000000`00140001 00000000`00002572 : nt!KiProcessExpiredTimerList+0x31d
ffff8c0b`7fcb59d0 fffff803`6340166e     : ffffffff`00000000 ffffc280`744c0180 ffffc280`744cb440 ffffd68c`5855a080 : nt!KiRetireDpcList+0x5dd
ffff8c0b`7fcb5c60 00000000`00000000     : ffff8c0b`7fcb6000 ffff8c0b`7fcb0000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e

SYMBOL_NAME:  nt!KiProcessExpiredTimerList+31d

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.19041.3448

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  31d

FAILURE_BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiProcessExpiredTimerList

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {9db7945b-255d-24a1-9f2c-82344e883ab8}

Followup:     MachineOwner
---------

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

12 answers

DaveM121 891.1K Reputation points Independent Advisor

2023-10-05T07:29:49+00:00

Your minidump files just indicate generic memory (RAM) corruption no specific cause is listed.

Do you have any more minidump files you can upload for analysis?
Was this answer helpful?

0 comments No comments
Anonymous

2023-10-05T07:23:24+00:00

Oh, so you need it zipped? No problem.

https://drive.google.com/file/d/1o_LJseYj--HroyC0cqMKRjR4_oBPy-pi/view?usp=drive_link
Was this answer helpful?

0 comments No comments
DaveM121 891.1K Reputation points Independent Advisor

2023-10-05T07:18:08+00:00

Hi, I am Dave, I will help you with this.

Please upload any minidump files you have, I will check those to see if they provide any insight into a potential cause of the system crashes.

Open Windows File Explorer.

Navigate to C:\Windows\Minidump

Copy any minidump files onto your Desktop, then zip those up.

Upload the zip file to the Cloud (OneDrive, DropBox... etc.), then choose to share those and get a share link.

Then post the link here to the zip file, so we can take a look for you.
Was this answer helpful?

0 comments No comments
Anonymous

2023-10-05T07:09:54+00:00

Here is the link: https://drive.google.com/file/d/1SdpCHop6-isMKdQbLYKOxMJHxWVbyt0k/view?usp=drive_link
Was this answer helpful?

0 comments No comments
Anonymous

2023-10-05T06:48:25+00:00

Sorry, not the full file but the analysis based off of WinDBG I will set up the dump file in a second.
Was this answer helpful?

0 comments No comments

Share via

KERNEL_SECURITY_CHECK_FAILURE (139)

12 answers