Mini Dump Analysis

Question

Could someone please tell me what this mini-dump says caused my computer to crash and reboot unexpectedly. The computer was not in use at this time and only a browser (Brave) was open (plus all the apps running in the background).

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff858c01e1e2e0, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffff858c01e1e238, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 4765

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 7389

    Key  : Analysis.Init.CPU.mSec
    Value: 999

    Key  : Analysis.Init.Elapsed.mSec
    Value: 194759

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 75

    Key  : Dump.Attributes.InsufficientDumpfileSize
    Value: 1

    Key  : Dump.Attributes.RequiredDumpfileSize
    Value: 0xabd81871

    Key  : FailFast.Name
    Value: CORRUPT_LIST_ENTRY

    Key  : FailFast.Type
    Value: 3

DUMP_FILE_ATTRIBUTES: 0xc
  Insufficient Dumpfile Size
  Kernel Generated Triage Dump

BUGCHECK_CODE:  139

BUGCHECK_P1: 3

BUGCHECK_P2: ffff858c01e1e2e0

BUGCHECK_P3: ffff858c01e1e238

BUGCHECK_P4: 0

TRAP_FRAME:  ffff858c01e1e2e0 -- (.trap 0xffff858c01e1e2e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffdd84d33f0d68 rbx=0000000000000000 rcx=0000000000000003
rdx=000000000000045e rsi=0000000000000000 rdi=0000000000000000
rip=fffff8025dd4e1cf rsp=ffff858c01e1e470 rbp=ffff858c01e1e560
 r8=ffffdd84d33f0a48  r9=0000000000000026 r10=00000000ffffffff
r11=000000000000039f r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!RtlFreeRangeList+0x6f:
fffff802`5dd4e1cf cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffff858c01e1e238 -- (.exr 0xffff858c01e1e238)
ExceptionAddress: fffff8025dd4e1cf (nt!RtlFreeRangeList+0x000000000000006f)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY 

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000003

EXCEPTION_STR:  0xc0000409

STACK_TEXT:  
ffff858c`01e1dfb8 fffff802`5da09169     : 00000000`00000139 00000000`00000003 ffff858c`01e1e2e0 ffff858c`01e1e238 : nt!KeBugCheckEx
ffff858c`01e1dfc0 fffff802`5da09590     : ffffdd84`3c6a4000 fffff802`5d88d479 ffffffff`ffffffff ffff858c`00000004 : nt!KiBugCheckDispatch+0x69
ffff858c`01e1e100 fffff802`5da07923     : 00000000`00000000 ffff858c`00000000 00000000`00000103 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffff858c`01e1e2e0 fffff802`5dd4e1cf     : ffffdd84`2d9daab0 00000000`00000002 00000000`00000000 ffffdd84`2dd58710 : nt!KiRaiseSecurityCheckFailure+0x323
ffff858c`01e1e470 fffff802`5dd4df82     : fffff802`5e244280 00000000`00000000 00000000`00000002 fffff802`5e244280 : nt!RtlFreeRangeList+0x6f
ffff858c`01e1e4a0 fffff802`5dd5eb23     : ffff8d8a`e9050b40 ffff858c`00000000 ffff858c`01e1e500 fffff802`5f5f1600 : nt!ArbCommitAllocation+0x12
ffff858c`01e1e4d0 fffff802`5dd3c71e     : ffffdd84`2dd094d0 00000000`00000002 00550052`00520045 004d0020`00540050 : nt!ArbArbiterHandler+0xe3
ffff858c`01e1e510 fffff802`5dd3b435     : ffff8d8a`e9111cc0 ffff8d8b`419da8f0 ffffdd84`38913770 00000000`00000000 : nt!IopCallArbiter+0xca
ffff858c`01e1e570 fffff802`5dd3d74a     : 00000000`00000000 ffff8d8b`00000001 ffff8d8a`00000000 ffff8d8b`419da8f0 : nt!PnpReleaseResourcesInternal+0x131
ffff858c`01e1e640 fffff802`5dd3d89a     : fffff802`5e244a20 00000000`00000004 00000000`00000000 ffff8d8b`085a9e00 : nt!IopReleaseResources+0xe
ffff858c`01e1e670 fffff802`5dd321d8     : ffffdd84`ffffffff ffff8d8a`e904e680 ffff8d8b`419da8f0 00000000`00000000 : nt!IopLegacyResourceAllocation+0xb6
ffff858c`01e1e730 fffff802`5dd5c1ed     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000308 : nt!IopReleaseDeviceResources+0xa4
ffff858c`01e1e7c0 fffff802`5dd31fe8     : ffff8d8b`419da8f0 00000000`00000000 00000000`00000000 fffff802`5dd31f2f : nt!PnpSurpriseRemoveLockedDeviceNode+0xc9
ffff858c`01e1e820 fffff802`5dd31ce3     : ffff8d8b`419da8f0 ffff858c`01e1e8a0 00000000`00000000 fffff802`5dd31a1c : nt!PnpDeleteLockedDeviceNode+0x88
ffff858c`01e1e860 fffff802`5dd3042e     : ffff8d8b`370f52b0 00000002`00000002 00000000`00000000 00000000`00000000 : nt!PnpDeleteLockedDeviceNodes+0xf7
ffff858c`01e1e8e0 fffff802`5dd2b23b     : ffff858c`01e1ea20 ffff8d8b`419da800 ffff858c`01e1ea00 ffffdd84`00000002 : nt!PnpProcessQueryRemoveAndEject+0x1da
ffff858c`01e1e9c0 fffff802`5dc48efe     : ffffdd84`a1fead30 ffffdd84`3fd905e0 ffff8d8a`e9097300 00000000`00000000 : nt!PnpProcessTargetDeviceEvent+0xeb
ffff858c`01e1e9f0 fffff802`5d8b8515     : ffff8d8a`f986c040 ffff8d8a`f986c040 ffff8d8a`e90973f0 ffff8d8b`156c0550 : nt!PnpDeviceEventWorker+0x2ce
ffff858c`01e1ea70 fffff802`5d955855     : ffff8d8a`f986c040 00000000`00000080 ffff8d8a`e90d3080 00000000`00000080 : nt!ExpWorkerThread+0x105
ffff858c`01e1eb10 fffff802`5d9fe808     : fffff802`578d1180 ffff8d8a`f986c040 fffff802`5d955800 01010101`01010101 : nt!PspSystemThreadStartup+0x55
ffff858c`01e1eb60 00000000`00000000     : ffff858c`01e1f000 ffff858c`01e18000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28

SYMBOL_NAME:  nt!KiFastFailDispatch+d0

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.19041.1288

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  d0

FAILURE_BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {3aede96a-54dd-40d6-d4cb-2a161a843851}

Followup:     MachineOwner

Answer 1

Dear SJC1969,

I'm Dyari. Thanks for reaching out. I will be happy to assist you in this regard.

The minidump file does not name any driver only indicates ntkrnlmp.exe which is a Windows component that means something else drove the system into fault. Or, it could be a RAM issue.

To troubleshoot this issue, kindly try the steps below:

1-Check for updates:

Go to Settings > Update and Security > Check for update > install all the pending updates

2-Uninstall the graphics card driver completely using the DDU free tool:

https://www.guru3d.com/files-details/display-dr...

Then, install the latest driver provided on the manufacturer's website.

3-Uninstall any third-party security software and scan for viruses & malware with the free Malwarebytes:

https://www.malwarebytes.com/mwb-download

4-Run Command Prompt as administrator. Type this command and hit enter:

dism.exe /online /cleanup-image /restorehealth

Then, type this command and hit enter:

sfc /scannow

5-If you are overclocking your PC, try running everything (CPU, GPU, system memory) at their stock speeds. See if the issue is still reproducible. Or, turn off XMP profile or set it to Auto.

6-Download then install the latest version of BIOS & Chipset drivers from the manufacturer's website.

7-Test the RAM with free utility MemTest86, then run a full 8 pass scan to test your RAM for physical errors:

https://www.tenforums.com/tutorials/14201-memte...

8-Run the Windows Memory Diagnostic:

https://www.howtogeek.com/260813/how-to-test-yo...

9-If you are comfortable of doing so, take all the system memory sticks out, examine them for any obvious defects, and then reseat them into the sockets. Make sure that they are seated properly in their slots. If you have multiple sticks of system memory installed and you suspect one is faulty, one thing to try is to reproduce the issue with only one stick of memory module at a time. This will help you to isolate the faulty module.

10-If the issue still persists after the steps above, try to enable driver verifier for 2 days or until you get the BSOD then disable it and share the newly created minidump file:

https://www.tenforums.com/tutorials/5470-enable...

Please do not hesitate to ask if you need further assistance.

Stay safe

____________________________________________________________

Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.