KERNEL_SECURITY_CHECK_FAILURE (139)

Question

I'm having a blue screen and the DMP file shows the following: 

Note: I uploaded the DMP to OneDrive, kindly find the download link below:

https://1drv.ms/u/s!AnV55OtEeJkLsxmmrQ1hGngtnSoE?e=TYir0C

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 000000000000001d, Type of memory safety violation
Arg2: ffff9302e0612da0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff9302e0612cf8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

*** WARNING: Unable to verify checksum for win32k.sys

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 5499

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on CHADAYLE

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.mSec
    Value: 13787

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 89

    Key  : Analysis.System
    Value: CreateObject

    Key  : WER.OS.Branch
    Value: 19h1_release

    Key  : WER.OS.Timestamp
    Value: 2019-03-18T12:02:00Z

    Key  : WER.OS.Version
    Value: 10.0.18362.1

ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE:  139

BUGCHECK_P1: 1d

BUGCHECK_P2: ffff9302e0612da0

BUGCHECK_P3: ffff9302e0612cf8

BUGCHECK_P4: 0

TRAP_FRAME:  ffff9302e0612da0 -- (.trap 0xffff9302e0612da0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc5820f3a9fe8 rbx=0000000000000000 rcx=000000000000001d
rdx=ffffc4820f3a9fe8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80021206d47 rsp=ffff9302e0612f38 rbp=ffff9302e0612ff9
 r8=0000000000000001  r9=0000000000000000 r10=ffffc4820f1cbfe8
r11=ffffc4820f3a9fe8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!RtlRbRemoveNode+0x1a34d7:
fffff800`21206d47 cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffff9302e0612cf8 -- (.exr 0xffff9302e0612cf8)
ExceptionAddress: fffff80021206d47 (nt!RtlRbRemoveNode+0x00000000001a34d7)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 000000000000001d
Subcode: 0x1d FAST_FAIL_INVALID_BALANCED_TREE 

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  000000000000001d

EXCEPTION_STR:  0xc0000409

STACK_TEXT:  
ffff9302`e0612a78 fffff800`211d5929     : 00000000`00000139 00000000`0000001d ffff9302`e0612da0 ffff9302`e0612cf8 : nt!KeBugCheckEx
ffff9302`e0612a80 fffff800`211d5d50     : 00000000`00000000 00000000`00000000 ffff9983`0a694040 1a000000`5d9a6863 : nt!KiBugCheckDispatch+0x69
ffff9302`e0612bc0 fffff800`211d40e3     : 00000000`00000000 fffff800`210cd088 ffff8800`00000000 ffff8844`00000000 : nt!KiFastFailDispatch+0xd0
ffff9302`e0612da0 fffff800`21206d47     : 00000000`000000b1 ffffc482`0f379000 fffff800`2105ef31 ffff9302`e0612ff9 : nt!KiRaiseSecurityCheckFailure+0x323
ffff9302`e0612f38 fffff800`2105ef31     : ffff9302`e0612ff9 ffffc481`ea400280 ffffc482`0f387fe0 ffffc481`ea400280 : nt!RtlRbRemoveNode+0x1a34d7
ffff9302`e0612f50 fffff800`21062bd1     : ffff9302`e0612ff9 00000013`01020000 ffffc482`0f3873a0 ffffc482`0f387eb0 : nt!RtlpHpVsFreeChunkRemove+0x25
ffff9302`e0612f80 fffff800`21061fa9     : 00000013`00000013 ffffc482`0f3873a0 00000002`00000001 00000000`00000000 : nt!RtlpHpVsChunkSplit+0xb31
ffff9302`e0613050 fffff800`2103854a     : ffff9302`000000b2 33333333`00000b00 00000000`00000b00 00000000`00000000 : nt!RtlpHpVsContextAllocateInternal+0x3c9
ffff9302`e06130c0 fffff800`2136e06d     : 00000000`00000001 00000000`00000000 00000000`00000001 00000000`00000000 : nt!ExAllocateHeapPool+0xc6a
ffff9302`e0613200 fffff800`25467aa2     : ffff9302`e06133e0 ffff9302`e0613480 00000000`000012ce 00000000`00000000 : nt!ExAllocatePoolWithTag+0x5d
ffff9302`e0613250 fffff800`2546232d     : fffff800`25430388 ffffc482`0f3dd760 ffffc482`06193000 ffffc482`0f37fe50 : CI!MincryptAlloc+0x1e
ffff9302`e0613280 fffff800`254632a6     : ffff9302`e0613564 ffffc482`0f37fd20 00000000`00000000 000001fc`00000000 : CI!MinCrypK_VerifySignedDataKModeEx+0xa1
ffff9302`e0613380 fffff800`254634f2     : 00000000`c0000225 00000000`c0000225 ffff9302`0000000f 000001fc`da690b90 : CI!I_MinCryptVerifyRFC3161TimeStamp+0x76
ffff9302`e0613510 fffff800`25462732     : 00000000`00000000 ffffc481`f6347678 00000000`00000000 ffff9302`e0613638 : CI!I_MinCryptGetSigningTime+0x12e
ffff9302`e06135b0 fffff800`25448045     : 00000000`00000020 ffffc481`f6347620 00000000`00000000 000001fc`00000000 : CI!MinCrypK_VerifySignedDataKModeEx+0x4a6
ffff9302`e06136b0 fffff800`25449f41     : 00000000`00000020 00000000`00000000 00000000`00002aa1 ffffc481`f6347620 : CI!I_ParseCatalog+0x91
ffff9302`e0613740 fffff800`25447dca     : 00000000`00000000 00000000`00000108 00000000`00002aa1 00000000`00000000 : CI!I_ParseCatalogAndMapHashes+0xa1
ffff9302`e06137c0 fffff800`25448aeb     : ffff9302`e06139a0 ffffc481`f6347620 00000000`0000800c 00000000`00000000 : CI!I_MapCatalog+0x3e6
ffff9302`e06138b0 fffff800`25448699     : 00000000`00000000 ffffc482`0931c200 ffff9302`e0613a11 00000000`00000100 : CI!I_ReloadCatalog+0x263
ffff9302`e0613930 fffff800`2544837e     : 00000000`00000001 ffff9302`00000000 ffffc482`00000000 00000000`00000001 : CI!I_ReloadCatalogDirectory+0x299
ffff9302`e0613a60 fffff800`25446da4     : ffffc482`060a1e20 ffff9302`00000001 ffff9302`e0613bd0 00000000`00000004 : CI!I_ReloadCatalogs+0x17a
ffff9302`e0613ad0 fffff800`25446b45     : ffffc482`00000000 ffff9302`e0613e44 ffff9983`172e8060 fffff800`21043fd7 : CI!I_FindFileOrHeaderHashInCatalogs+0x250
ffff9302`e0613c30 fffff800`25452362     : 00000000`0000800c ffffc482`060a1650 ffff9983`172e8060 ffff9983`0f4878d0 : CI!MinCrypK_FindPageHashesInCatalog+0xb1
ffff9302`e0613ce0 fffff800`2544e107     : ffffc482`0000006f 00000000`00000000 00000000`00000000 00000000`00000004 : CI!CiVerifyPageHashInCatalogs+0x192
ffff9302`e0613de0 fffff800`2544f441     : ffff9302`e0614208 ffff9302`e0614111 00000000`00000000 ffffc482`060a1650 : CI!CipGetPageHashesForFile+0x18f
ffff9302`e0613f40 fffff800`2544e9f9     : ffffc482`060a1650 ffff9983`1627f160 ffff9983`1a0e7080 ffffc482`08856000 : CI!CipValidatePageHash+0x2a1
ffff9302`e0614030 fffff800`2544cd16     : ffff9983`1a0e7084 00000000`00000000 ffff9983`1627f160 00000000`00000000 : CI!CipValidateImageHash+0xed
ffff9302`e0614160 fffff800`2165c756     : 00000000`00000000 fffff800`6dfe0000 00000000`0000000e ffffc482`08856000 : CI!CiValidateImageHeader+0x716
ffff9302`e06142f0 fffff800`2165c27a     : 00000000`00000008 00000000`00000001 00000000`00000001 00000000`00000000 : nt!SeValidateImageHeader+0xd6
ffff9302`e06143a0 fffff800`2166f36f     : ffff9302`e0614570 00000000`00000240 00000000`00000000 00000000`00000000 : nt!MiValidateSectionCreate+0x436
ffff9302`e0614590 fffff800`2166f2b4     : ffff9302`e0614840 ffff9302`e0614840 00000000`00000002 00000000`00000002 : nt!MiValidateSectionSigningPolicy+0x97
ffff9302`e06145f0 fffff800`215d4f56     : 00000000`00000001 ffff9302`e0614800 ffffc481`eebd27d0 ffff9983`10eb4c20 : nt!MiValidateExistingImage+0x364
ffff9302`e06146a0 fffff800`215d6c73     : ffff9983`1627f160 ffff9302`e0614840 ffff9983`0ad05080 ffff9983`1627f160 : nt!MiShareExistingControlArea+0xc2
ffff9302`e06146d0 fffff800`215d70a4     : ffff9983`10eb4c20 00000000`00000000 ffff9983`1627f160 00000000`00000000 : nt!MiCreateImageOrDataSection+0x1a3
ffff9302`e06147c0 fffff800`215d66ff     : 00000000`01000000 ffff9302`e0614b80 00000000`00000001 00000000`00000010 : nt!MiCreateSection+0xf4
ffff9302`e0614940 fffff800`215d6490     : 00000049`f17ac5c8 00000000`0000000d 00000000`00000000 00000000`00000001 : nt!MiCreateSectionCommon+0x1ff
ffff9302`e0614a20 fffff800`211d5358     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateSection+0x60
ffff9302`e0614a90 00007ffe`964fd034     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000049`f17ac578 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`964fd034

SYMBOL_NAME:  CI!MincryptAlloc+1e

MODULE_NAME: CI

IMAGE_NAME:  CI.dll

IMAGE_VERSION:  10.0.18362.1171

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  1e

FAILURE_BUCKET_ID:  0x139_1d_INVALID_BALANCED_TREE_CI!MincryptAlloc

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {d1f76757-8d6b-16ff-6d51-7a783ea174b5}

Followup:     MachineOwner
---------

Answer 1

Another dump..

https://1drv.ms/u/s!AnV55OtEeJkLsxuYheSfwpqU6f8w?e=dtfIpL

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041201, The subtype of the bugcheck.
Arg2: fffff49def88d070
Arg3: 80000400baad2867
Arg4: ffff9d8ce40f70b0

Debugging Details:
------------------

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 4062

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on DESKTOP-5SJDQGC

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.mSec
    Value: 8414

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 74

    Key  : Analysis.System
    Value: CreateObject

    Key  : WER.OS.Branch
    Value: 19h1_release

    Key  : WER.OS.Timestamp
    Value: 2019-03-18T12:02:00Z

    Key  : WER.OS.Version
    Value: 10.0.18362.1

ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE:  1a

BUGCHECK_P1: 41201

BUGCHECK_P2: fffff49def88d070

BUGCHECK_P3: 80000400baad2867

BUGCHECK_P4: ffff9d8ce40f70b0

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  chrome.exe

STACK_TEXT:  
fffff90a`3ac6f548 fffff800`6a82ae68     : 00000000`0000001a 00000000`00041201 fffff49d`ef88d070 80000400`baad2867 : nt!KeBugCheckEx
fffff90a`3ac6f550 fffff800`6a6c6991     : fffff49d`ef88d078 80000400`baad2867 fffff800`00000002 fffff4fa`4ef7c468 : nt!MiGetPageProtection+0x164f18
fffff90a`3ac6f5c0 fffff800`6a6b7e34     : ffff9d8c`f02f4580 00003bdf`11a00000 00003be0`00000000 00000000`001f3fff : nt!MiQueryAddressState+0x5c1
fffff90a`3ac6f7e0 fffff800`6ac04eb7     : fffff90a`00000000 00003bdf`00000004 fffff90a`00000004 000000f5`00000001 : nt!MiQueryAddressSpan+0x1d4
fffff90a`3ac6f8a0 fffff800`6ac04955     : fffff4fa`408c0c98 fffff4fa`7d204600 fffff4fa`7d3e9020 ffff9d8c`f1f405c0 : nt!MmQueryVirtualMemory+0x557
fffff90a`3ac6fa40 fffff800`6a7d5358     : 00000000`00000000 00000000`00000000 00000000`00000000 000000f5`ee5fe638 : nt!NtQueryVirtualMemory+0x25
fffff90a`3ac6fa90 00007ff8`002dcb54     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000f5`ee5fea98 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`002dcb54

SYMBOL_NAME:  nt!MiGetPageProtection+164f18

MODULE_NAME: nt

IMAGE_VERSION:  10.0.18362.1198

STACK_COMMAND:  .thread ; .cxr ; kb

IMAGE_NAME:  ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET:  164f18

FAILURE_BUCKET_ID:  0x1a_41201_nt!MiGetPageProtection

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {c1fe3b27-3ba8-d99e-656f-85f3d58dc669}

Followup:     MachineOwner

Answer 2

So it seems as if my motherboard was already update.

Please see link to the dmp file:

https://1drv.ms/u/s!AnV55OtEeJkLsxo9C3ZRVMs9AiY\_?e=JkJ6co

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000002000, Code Integrity Issue: The caller specified an executable pool type. (Expected: NonPagedPoolNx)
Arg2: fffff8097ecc1d93, The address in the driver's code where the error was detected.
Arg3: 0000000000000000, Pool Type.
Arg4: 0000000000726274, Pool Tag (if provided).

Debugging Details:
------------------

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 4015

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on DESKTOP-5SJDQGC

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.mSec
    Value: 6616

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 74

    Key  : Analysis.System
    Value: CreateObject

    Key  : WER.OS.Branch
    Value: 19h1_release

    Key  : WER.OS.Timestamp
    Value: 2019-03-18T12:02:00Z

    Key  : WER.OS.Version
    Value: 10.0.18362.1

ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE:  c4

BUGCHECK_P1: 2000

BUGCHECK_P2: fffff8097ecc1d93

BUGCHECK_P3: 0

BUGCHECK_P4: 726274

BLACKBOXNTFS: 1 (!blackboxntfs)

PROCESS_NAME:  System

STACK_TEXT:  
ffff808d`a02066f8 fffff806`3f5896e3     : 00000000`000000c4 00000000`00002000 fffff809`7ecc1d93 00000000`00000000 : nt!KeBugCheckEx
ffff808d`a0206700 fffff806`3ef43c1b     : fffff806`3f046878 00000000`00002000 fffff809`7ecc1d93 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0xdf
ffff808d`a0206740 fffff806`3f580b98     : 00000000`00726274 fffff806`3f046878 fffff809`7ecc1d93 ffffd306`bf82afe0 : nt!VfReportIssueWithOptions+0x103
ffff808d`a0206790 fffff806`3f58d6c2     : 00000000`00000000 ffff808d`a0206a30 00000000`00000018 00000000`00000000 : nt!VfCheckPoolType+0x90
ffff808d`a02067d0 fffff809`7ecc1d93     : 00000000`00000000 ffffad04`fd7f3910 00000000`00000000 00000000`00000000 : nt!VerifierExAllocatePoolWithTag+0x62
ffff808d`a0206820 fffff809`7ecc1cf4     : 00000000`00000000 ffff808d`a0206a30 ffffad04`fd7f3910 ffffad04`fd7f3910 : ene+0x1d93
ffff808d`a0206850 fffff809`7ecc14c7     : 00000000`00000000 ffffad04`fd7f3910 ffffffff`80000170 fffff806`3ef93458 : ene+0x1cf4
ffff808d`a0206880 fffff809`7ecc6020     : ffffad05`010ff000 ffffad05`010ff010 ffffad04`fd7f3b20 ffff0abd`3aa26f7b : ene+0x14c7
ffff808d`a0206900 fffff806`3f3245e2     : 00000000`00000000 00000000`00000000 ffffad04`fd7f3910 ffffffff`80000170 : ene+0x6020
ffff808d`a0206930 fffff806`3f62b361     : ffffad04`fdbedee8 ffffad04`fdbedee8 ffff808d`a0206b80 00000000`00000000 : nt!IopLoadDriver+0x4c2
ffff808d`a0206b10 fffff806`3f62a552     : fffff806`00000000 ffffd306`bf82afd0 00000000`00000000 fffff806`3d7d35f0 : nt!IopInitializeSystemDrivers+0x151
ffff808d`a0206bb0 fffff806`3f372412     : fffff806`3d7d35f0 fffff806`3d7d35f0 fffff806`3f3723d0 fffff806`3d7d35f0 : nt!IoInitSystem+0x12
ffff808d`a0206be0 fffff806`3ed4e585     : ffffad04`fa6c5040 fffff806`3f3723d0 fffff806`3d7d35f0 00018ceb`00000004 : nt!Phase1Initialization+0x42
ffff808d`a0206c10 fffff806`3ede6128     : fffff806`3db46180 ffffad04`fa6c5040 fffff806`3ed4e530 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff808d`a0206c60 00000000`00000000     : ffff808d`a0207000 ffff808d`a0201000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28

SYMBOL_NAME:  ene+1d93

MODULE_NAME: ene

IMAGE_NAME:  ene.sys

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  1d93

FAILURE_BUCKET_ID:  0xc4_2000_VRF_ene!unknown_function

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {8c7175c3-41d7-9412-c64e-e43d9572bd5c}

Followup:     MachineOwner
---------

Answer 3

Thank you for the response.

You may continue to check if the BSODs persist after BIOS update - often they are resolved by updating BIOS.

If that doesn't help and you get BSODs, feel free to run the verifier.

Answer 4

Thank you for the quick response. Took me a while to download the BIOS update. I'll do that shortly then enable driver verifer.

Answer 5

Hi Chad,

I am Sumit, an Independent Advisor and a 3 year Windows Insider MVP here to help.

No drivers were named in the crash.

First, disable overclocking or any XMP profiles until we troubleshoot.

Check for BIOS updates on the motherboard(the page isn't working for me right now)

https://www.asus.com/Motherboards/ROG-STRIX-B45...

The next step,

Let us try finding any misbehaving driver

Enable Driver Verifier:

http://answers.microsoft.com/en-us/windows/wiki...

(Must create a Restore point before)

Upload the newer dumps when you get Driver_Verifier_detected_voilation.

Please note that the system might crash before you reach the desktop-if it does please let us know so that we can guide you to disable Verifier.

Standard 3rd party link disclaimer:

There may be links to non-Microsoft websites that would provide accurate and safe information. Watch out for ads on the websites which are frequently classified as a PUP (Potentially Unwanted Products). There is no need to buy paid products to fix your computers as they do more harm than good sometimes.