Windows 10 crash with csrss.exe

Question

Could this be a bug in windows 10?

I have not seen any hardware or driver problem from the following minidump analysis.

link to dump files : https://1drv.ms/u/s!ApvTS2DUZhP_ayJo8NjrnRu1x-A?e=nERCq7

************* Path validation summary **************
Response Time (ms) Location
Deferred .sympath cache*
Deferred srv*https://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Minidump\CHR011\072421-8671-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

************* Path validation summary **************
Response Time (ms) Location
Deferred .sympath cache*
Deferred srvhttps://msdl.microsoft.com/download/symbols
Symbol search path is: .sympath cache;srv*https://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 10 Kernel Version 18362 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff80420200000 PsLoadedModuleList = 0xfffff80420645f30
Debug session time: Sat Jul 24 12:04:56.113 2021 (UTC + 3:00)
System Uptime: 0 days 4:04:25.106
Loading Kernel Symbols
...............................................................
................................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
........
For analysis of this file, run !analyze -v
9: kd> !analyze -v

---

• *
• Bugcheck Analysis *
• *

  ---

WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: ffff8c895a58a030, String that identifies the problem.
Arg2: ffffffffc0000006, Error Code.
Arg3: 00007ffd4f84865e
Arg4: 0000008be0ebe140

Debugging Details:

---

ETW minidump data unavailable

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.Sec
Value: 3

Key  : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on LTVIL-JF06NX2

Key  : Analysis.DebugData
Value: CreateObject

Key  : Analysis.DebugModel
Value: CreateObject

Key  : Analysis.Elapsed.Sec
Value: 30

Key  : Analysis.Memory.CommitPeak.Mb
Value: 80

Key  : Analysis.System
Value: CreateObject

ERROR_CODE: (NTSTATUS) 0xc000021a - {Fatal System Error} The %hs system process terminated unexpectedly with a status of 0x

EXCEPTION_CODE_STR: c000021a

EXCEPTION_PARAMETER1: ffff8c895a58a030

EXCEPTION_PARAMETER2: ffffffffc0000006

EXCEPTION_PARAMETER3: 00007ffd4f84865e

EXCEPTION_PARAMETER4: 8be0ebe140

BUGCHECK_CODE: c000021a

BUGCHECK_P1: ffff8c895a58a030

BUGCHECK_P2: ffffffffc0000006

BUGCHECK_P3: 7ffd4f84865e

BUGCHECK_P4: 8be0ebe140

PROCESS_NAME: csrss.exe

ADDITIONAL_DEBUG_TEXT: Windows SubSystem

IMAGE_NAME: ntkrnlmp.exe

MODULE_NAME: nt

CUSTOMER_CRASH_COUNT: 1

STACK_TEXT:
ffffc4867c87f198 fffff80420aa8da9 : 000000000000004c 00000000c000021a ffffc4867c87f2f8 ffffc888e24ee390 : nt!KeBugCheckEx
ffffc4867c87f1a0 fffff804207aeea2 : ffffc888dff593b0 ffffc888e24ee390 ffffc888e24ee300 0000000000000100 : nt!PoShutdownBugCheck+0xf9
ffffc4867c87f240 fffff804203cd9e8 : 0000000000000013 ffffc4867c87f8c8 0000000000000001 0000000000000000 : nt!ExpSystemErrorHandler2+0x672
ffffc4867c87f490 fffff80420a012c7 : 00000000c000021a 0000000000000004 0000000000000001 ffffc4867c87f8c8 : nt!ExpSystemErrorHandler+0xd8
ffffc4867c87f4d0 fffff8042092d8b8 : 00000000ffff8001 ffffc888dda8d050 ffffc888dda8d050 ffff8c89443a9e00 : nt!ExpRaiseHardError+0xd3997
ffffc4867c87f850 fffff804203d5755 : 0000000000000e28 ffffc888d551e400 ffffc48600000002 ffffc4867c87f900 : nt!NtRaiseHardError+0x1b8
ffffc4867c87f990 00007ffd4f87fab4 : 00007ffd4c6782e7 0000000000000000 0000000000000000 ffffffffee1e5d00 : nt!KiSystemServiceCopyEnd+0x25
0000008be0ebd8b8 00007ffd4c6782e7 : 0000000000000000 0000000000000000 ffffffffee1e5d00 0000000000000e28 : 0x00007ffd4f87fab4 0000008be0ebd8c0 0000000000000000 : 0000000000000000 ffffffffee1e5d00 0000000000000e28 0000000000000006 : 0x00007ffd4c6782e7

SYMBOL_NAME: nt!ExpSystemErrorHandler2+672

IMAGE_VERSION: 10.0.18362.1621

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 672

FAILURE_BUCKET_ID: 0xc000021a_c0000006_csrss.exe_Terminated_nt!ExpSystemErrorHandler2

OS_VERSION: 10.0.18362.1

BUILDLAB_STR: 19h1_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {07388538-a1cd-d180-f12c-f4c8013feb53}

Followup: MachineOwner

---

Answer 1

Hi,

Please kindly note that dump analysis is currently beyond our Q&A forum scope. If you would like to confirm if the issue is a bug or not. I'd like to suggest that you could contact Microsoft Customer Support and Services to raise a support ticket. Please note that the consulting fee would be refund if it is confirmed as a bug.

Global Customer Service phone numbers:
https://support.microsoft.com/en-us/help/13948/global-customer-service-phone-numbers

Also, I did some research in our case database and found a similar case as yours. The issue in that case is "csrss.exe will fail to start leading the OS to a bugcheck 0xEF".
I am not sure if it is also your problem. But you can try the solution to see if it helps. Please proceed a backup before you make any change.

1. Boot the machine in repair mode.
2. Load the SYSTEM HIVE.
   
   
   
   
3. Check which ControlSet is the current:
   
4. Change the settings under the correspondent ControlSet, in this particular case as Select shows, 001.
   

To reflect the data value:

Command Line: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

5. Unload the HIVE - This part is very important!!!!
   
   
6. Close regedit, exit CMD. Restart the OS.

Appreciate your understanding. And welcome to post any other question or issue to our Q&A forum in future.

Thanks,

----------

If the Answer is helpful, please click "Accept Answer" and upvote it. Thanks.