Frequent bugcheck (0x109, Arg4: 1, Ntfs!NtfsCancelRepairRequest)

Kade 1 Reputation point
2021-08-22T00:09:39.877+00:00

Hello!

For a few weeks my desktop has been crashing about once per day, although I've been unable to see any pattern whatsoever (sometimes it's more than a few days, occasionally less than a day, and it doesn't correlate with usage). The desktop is a little less than a year old, and the issue began a bit less than a month ago for no discernable reason (e.g. it did not coincide with me updating to version 21H1 of Windows 10).

It's always the same – a critical structure corruption (0x109) causing a bugcheck. The associated process is always csrss.exe and the failure bucket ID is always 0x109_1_Ntfs!NtfsCancelRepairRequest (see below).

I've looked through the Windows Event Viewer, I've run the Windows Memory Diagnostic, I've run chkdsk to scan and repair any problems with my filesystem, and I've run the Windows System File Checker. I also enabled the Driver Verifier, but so far there've been no violations.

I've spent a few hours duckduckgo-ing and reading through other Microsoft Q&As, and I'm not sure what to do next.

If it's an issue with a driver, I'd just like to know which driver, so that I can either update it or roll it back.

11: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This BugCheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a39fdc61f42f860d, Reserved
Arg2: b3b6e8e846b12559, Reserved
Arg3: fffff80309b0ff70, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
 0   : A generic data region
 1   : Modification of a function or .pdata
 2   : A processor IDT
 3   : A processor GDT
 4   : Type 1 process list corruption
 5   : Type 2 process list corruption
 6   : Debug routine modification
 7   : Critical MSR modification
 8   : Object type
 9   : A processor IVT
 a   : Modification of a system service function
 b   : A generic session data region
 c   : Modification of a session function or .pdata
 d   : Modification of an import table
 e   : Modification of a session import table
 f   : Ps Win32 callout modification
 10  : Debug switch routine modification
 11  : IRP allocator modification
 12  : Driver call dispatcher modification
 13  : IRP completion dispatcher modification
 14  : IRP deallocator modification
 15  : A processor control register
 16  : Critical floating point control register modification
 17  : Local APIC modification
 18  : Kernel notification callout modification
 19  : Loaded module list modification
 1a  : Type 3 process list corruption
 1b  : Type 4 process list corruption
 1c  : Driver object corruption
 1d  : Executive callback object modification
 1e  : Modification of module padding
 1f  : Modification of a protected process
 20  : A generic data region
 21  : A page hash mismatch
 22  : A session page hash mismatch
 23  : Load config directory modification
 24  : Inverted function table modification
 25  : Session configuration modification
 26  : An extended processor control register
 27  : Type 1 pool corruption
 28  : Type 2 pool corruption
 29  : Type 3 pool corruption
 2a  : Type 4 pool corruption
 2b  : Modification of a function or .pdata
 2c  : Image integrity corruption
 2d  : Processor misconfiguration
 2e  : Type 5 process list corruption
 2f  : Process shadow corruption
 30  : Retpoline code page corruption
 101 : General pool corruption
 102 : Modification of win32k.sys

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 3593

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 3654

    Key  : Analysis.Init.CPU.mSec
    Value: 312

    Key  : Analysis.Init.Elapsed.mSec
    Value: 5103

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 80

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


BUGCHECK_CODE:  109

BUGCHECK_P1: a39fdc61f42f860d

BUGCHECK_P2: b3b6e8e846b12559

BUGCHECK_P3: fffff80309b0ff70

BUGCHECK_P4: 1

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME:  csrss.exe

STACK_TEXT:  
ffffd38f`8350fdf8 00000000`00000000     : 00000000`00000109 a39fdc61`f42f860d b3b6e8e8`46b12559 fffff803`09b0ff70 : nt!KeBugCheckEx


CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs
    fffff80309b10018-fffff80309b1001b  4 bytes - Ntfs!NtfsCancelRepairRequest+a8
 [ 6c 24 38 48:00 00 00 00 ]
    fffff80309c00000-fffff80309c00003  4 bytes - Ntfs!NtfsSetEndOfFileInfo+a40
 [ 8b ce e8 fd:78 56 34 12 ]
    fffff80309d59194 - Ntfs!_guard_fids_table <PERF> (Ntfs+0x299194)
 [ 8d:39 ]
    fffff80309d5919c - Ntfs!_guard_fids_table <PERF> (Ntfs+0x29919c) (+0x08)
 [ 8d:39 ]
    fffff80309d592d0 - Ntfs!_guard_fids_table <PERF> (Ntfs+0x2992d0) (+0x134)
 [ 31:30 ]
    fffff80309d592d2 - Ntfs!_guard_fids_table <PERF> (Ntfs+0x2992d2) (+0x02)
 [ 36:38 ]
    fffff80309d592d4 - Ntfs!_guard_fids_table <PERF> (Ntfs+0x2992d4) (+0x02)
 [ 35:31 ]
    fffff80309d594a0 - Ntfs!_guard_fids_table <PERF> (Ntfs+0x2994a0) (+0x1cc)
 [ 31:30 ]
    fffff80309d594a2 - Ntfs!_guard_fids_table <PERF> (Ntfs+0x2994a2) (+0x02)
 [ 36:38 ]
    fffff80309d594a4 - Ntfs!_guard_fids_table <PERF> (Ntfs+0x2994a4) (+0x02)
 [ 35:31 ]
16 errors : !Ntfs (fffff80309b10018-fffff80309d594a4)

SYMBOL_NAME:  Ntfs!NtfsCancelRepairRequest+0

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

IMAGE_VERSION:  10.0.19041.1081

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  0

FAILURE_BUCKET_ID:  0x109_1_Ntfs!NtfsCancelRepairRequest

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {2487b397-51d9-53f6-54aa-fbac2b673b19}

Followup:     MachineOwner
---------
Windows 10
Windows 10
A Microsoft operating system that runs on personal computers and tablets.
11,690 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Docs 15,516 Reputation points
    2021-08-22T04:16:36.603+00:00

    Run the V2 log collector > post a share link into this thread

    https://www.windowsq.com/resources/v2-log-collector.8/
    https://www.tenforums.com/bsod-crashes-debugging/2198-bsod-posting-instructions.html

    .
    .
    .
    .
    .
    Please remember to vote and to mark the replies as answers if they help.

    On the bottom of each post there is:

    Propose as answer = answered the question

    On the left side of each post: Vote = a helpful post
    .
    .
    .
    .
    .

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.