KERNEL_SECURITY_CHECK_FAILURE crashes, no idea what to do

Question

KERNEL_SECURITY_CHECK_FAILURE crashes, no idea what to do

shizubanashi 20

Been getting crashes at random for a few days now, after some alleged RAM issues, crash log below, would appreciate any help and advice



KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 000000000000000e, The reference count for an object is invalid.
	0X12 : An attempt was made to switch to an invalid jmp_buf context.
	0X13 : An unsafe modification was made to read-only data.
Arg2: ffff9903fa68f3c0, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffff9903fa68f318, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1640

    Key  : Analysis.Elapsed.mSec
    Value: 1678

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 6

    Key  : Analysis.Init.CPU.mSec
    Value: 703

    Key  : Analysis.Init.Elapsed.mSec
    Value: 94209

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 108

    Key  : Analysis.Version.DbgEng
    Value: 10.0.29457.1000

    Key  : Analysis.Version.Description
    Value: 10.2506.23.01 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2506.23.1

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x139

    Key  : Bugcheck.Code.TargetModel
    Value: 0x139

    Key  : Dump.Attributes.AsUlong
    Value: 0x21808

    Key  : Dump.Attributes.DiagDataWrittenToHeader
    Value: 1

    Key  : Dump.Attributes.ErrorCode
    Value: 0x0

    Key  : Dump.Attributes.KernelGeneratedTriageDump
    Value: 1

    Key  : Dump.Attributes.LastLine
    Value: Dump completed successfully.

    Key  : Dump.Attributes.ProgressPercentage
    Value: 0

    Key  : FailFast.Name
    Value: INVALID_REFERENCE_COUNT

    Key  : FailFast.Type
    Value: 14

    Key  : Failure.Bucket
    Value: 0x139_e_INVALID_REFERENCE_COUNT_tcpip!TcpProcessExpiredTcbTimers

    Key  : Failure.Exception.Code
    Value: 0xc0000409

    Key  : Failure.Exception.Record
    Value: 0xffff9903fa68f318

    Key  : Failure.Hash
    Value: {f899362e-37b6-57f9-5f60-949ea29e2443}

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 0x7417df84

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 1

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 0

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 1

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 1

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 1

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 1

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 1

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 1

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 1

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 1

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 1

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 55185662

    Key  : Hypervisor.Flags.ValueHex
    Value: 0x34a10fe

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 1

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 1

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 1

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 1

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 1

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 1

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.Value
    Value: 1015

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 0x3f7

    Key  : WER.System.BIOSRevision
    Value: 18.20.0.0


BUGCHECK_CODE:  139

BUGCHECK_P1: e

BUGCHECK_P2: ffff9903fa68f3c0

BUGCHECK_P3: ffff9903fa68f318

BUGCHECK_P4: 0

FILE_IN_CAB:  102425-12062-01.dmp

TAG_NOT_DEFINED_202b:  *** Unknown TAG in analysis list 202b


DUMP_FILE_ATTRIBUTES: 0x21808
  Kernel Generated Triage Dump

FAULTING_THREAD:  ffffe782ea6bf280

TRAP_FRAME:  ffff9903fa68f3c0 -- (.trap 0xffff9903fa68f3c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=000000000000000e
rdx=00000000ffffff7e rsi=0000000000000000 rdi=0000000000000000
rip=fffff8072ce3c953 rsp=ffff9903fa68f550 rbp=ffff9903fa68f5c9
 r8=ffffe782f8eb6000  r9=000000000000003f r10=ffffe782f8eb61e8
r11=ffffe782f9eb61e8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
tcpip!TcpProcessExpiredTcbTimers+0x483:
fffff807`2ce3c953 cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffff9903fa68f318 -- (.exr 0xffff9903fa68f318)
ExceptionAddress: fffff8072ce3c953 (tcpip!TcpProcessExpiredTcbTimers+0x0000000000000483)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 000000000000000e
Subcode: 0xe FAST_FAIL_INVALID_REFERENCE_COUNT 

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1 (!blackboxwinlogon)


CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  000000000000000e

EXCEPTION_STR:  0xc0000409

STACK_TEXT:  
ffff9903`fa68f098 fffff807`996b1de9     : 00000000`00000139 00000000`0000000e ffff9903`fa68f3c0 ffff9903`fa68f318 : nt!KeBugCheckEx
ffff9903`fa68f0a0 fffff807`996b23f2     : 00000000`00000048 00000000`00000000 00000000`00000001 ffff9903`fa68f370 : nt!KiBugCheckDispatch+0x69
ffff9903`fa68f1e0 fffff807`996b0028     : 00000000`00000000 00000050`1d602a45 ffffffff`ffffff00 ffffb500`9cad1180 : nt!KiFastFailDispatch+0xb2
ffff9903`fa68f3c0 fffff807`2ce3c953     : ffffe782`f89ff0b0 00000000`020d0a54 ffff9903`fa68f5d0 fffff807`993f66ea : nt!KiRaiseSecurityCheckFailure+0x368
ffff9903`fa68f550 fffff807`2ce3b0ac     : 00000000`00000008 ffffe782`f8f101d0 00000000`00989680 ffffb500`00000000 : tcpip!TcpProcessExpiredTcbTimers+0x483
ffff9903`fa68f630 fffff807`99272a67     : 00000000`00000008 00000000`00000000 ffffe782`f8f10208 00000000`323a2d88 : tcpip!TcpPeriodicTimeoutHandler+0xfc
ffff9903`fa68f6a0 fffff807`9926f323     : ffff9903`fa68f9f0 00000000`00000000 00000050`23b7bffd ffffe782`ea6bf280 : nt!KiExecuteAllDpcs+0x687
ffff9903`fa68f8f0 fffff807`9969ee5e     : ffffb500`9cad1180 ffffb500`9cad1180 ffffe782`ea6bf280 ffffe783`11b950c0 : nt!KiRetireDpcList+0x333
ffff9903`fa68fb80 00000000`00000000     : ffff9903`fa690000 ffff9903`fa689000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e


SYMBOL_NAME:  tcpip!TcpProcessExpiredTcbTimers+483

MODULE_NAME: tcpip

IMAGE_NAME:  tcpip.sys

IMAGE_VERSION:  10.0.26100.6899

STACK_COMMAND: .process /r /p 0xfffff80799fcef00; .thread 0xffffe782ea6bf280 ; kb

BUCKET_ID_FUNC_OFFSET:  483

FAILURE_BUCKET_ID:  0x139_e_INVALID_REFERENCE_COUNT_tcpip!TcpProcessExpiredTcbTimers

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {f899362e-37b6-57f9-5f60-949ea29e2443}

Followup:     MachineOwner
---------

1 answer

Your answer

Answer 1

David-M 98,655 Independent Advisor

Hi. I'm David, and I'm happy to help you.

Please share the minidump files.

These files are in C:\Windows\Minidump.

Copy any files you have to your desktop and store them in a ZIP file. Then, upload the ZIP file to the cloud (OneDrive), choose to share it, and get the link.

Then, post the link to the ZIP file here so I can have a look.

I await your reply.

shizubanashi 20 Reputation points

2025-11-10T20:32:57.6966667+00:00

i uploaded them to drive, if that's alright, here's the link

https://drive.google.com/drive/folders/1PnYlMEalM6UTSWFON71vIRFttxRIR9SA?usp=sharing
shizubanashi 20 Reputation points

2025-11-10T21:38:52.72+00:00

i realize these are older files, actually, from another issue i had, the current crashes don't seem to have generated minidumps
David-M 98,655 Reputation points Independent Advisor

2025-11-11T12:02:30.9566667+00:00
Sorry for the delay in reply. I've been offline.

Since the computer is not creating new minidumps, please export and share the log for analysis:

Press Windows + X and select Event Viewer;

Expand Windows Logs and select System;

In the Actions panel on the right, select Filter Current Log;

In Event level, check the boxes Critical, Warning, and Error and click on Ok;

Again, in the Actions panel, select Save Filtered Log File As and save in an easily accessible place.

Then, upload the file to the cloud, choose to share it, and get the link.

Post the link to the file here so I can have a look.

I await your reply.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
shizubanashi 20 Reputation points

2025-11-11T21:49:51.8166667+00:00

i apologize if this double comments as it doesn't seem to have posted after clicking "add comment"

Hello and thanks for the reply, after several hours of no crashes yesterday and today, the computer started crashing again, this time reaching the crash screen and restarting itself, generating minidump files, i've uploaded both the minidumps and the filtered log files to the cloud, here's the link

https://drive.google.com/drive/folders/1V-Da7ycf4rl-AhWEpLvhVqT32Da2ps98?usp=sharing
shizubanashi 20 Reputation points

2025-11-11T21:56:31.52+00:00

The computer started crashing today again, it managed to restart and create minidumps, here's both the minidumps and the filtered log files

https://drive.google.com/drive/folders/1V-Da7ycf4rl-AhWEpLvhVqT32Da2ps98?usp=sharing
David-M 98,655 Reputation points Independent Advisor

2025-11-12T12:24:35.42+00:00

Sorry for the delay in reply. I've been offline.

The minidumps you shared are from October 24th. Are you sure they're related to the problem?

They only mention generic system drivers. No third-party drivers.

Checking your logs, it says that minidumps are being created. The most recent one in the log is named 111125-70531-01.dmp.

Are you sure you're checking the correct folder? The minidumps are located in C:\WINDOWS\Minidump.

I await your reply.

Share via

KERNEL_SECURITY_CHECK_FAILURE crashes, no idea what to do

1 answer

Your answer