KERNEL_SECURITY_CHECK_FAILURE (139) - A shadow stack violation has occurred due to mismatched return addresses

Question

My Dell Alienware m18 R2 laptop has been randomly crashing with the same "KERNEL_SECURITY_CHECK_FAILURE" after the latest preview update (KB5077241) (26200.7922).  It got so bad that I restored to before the update, but eventually I went ahead and tried again, and started getting the same problem, although less often as of yet (it has only crashed twice since I upgraded this time).  I originally thought the problem was with my file backup/sync provider, pCloud, because that had stopped working and showed up as the faulting process name, but I reinstalled that and have been getting different processes after that.  It is also possible that it is something to do with docker, because just before it started crashing again, I updated docker and then docker wouldn't start until I restarted the computer.  Docker is nowhere in the debug files though.  It is really frustrating to have just started becoming productive after having set up my developer environment only to have the system crash 15 minutes in and derail my progress for another 10 15 minutes!  I can't find anything in web searches that seems like it is the exact same problem. 

Here is a link to the minidump files: https://umass-my.sharepoint.com/:f:/g/personal/aevansjanes_umass_edu/IgDstYLDCQO0RanQcXDn9sevAcm0Wlhym4wWqqZVyCD9ic0?e=eTgtow

Here is the results from the latest running of WinDBG (there have been many, the PROCESS_NAME has been different almost every time but the error is always KERNEL_SECURITY_CHECK_FAILURE 139

ExtensionGallery settings after reading 'SOFTWARE\Microsoft\Debug Engine' registry:
ExtensionGallery ExtensionRepository: Implicit

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*

************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : true
   AllowNugetExeUpdate : true
   NonInteractiveNuget : true
   AllowNugetMSCredentialProviderInstall : true
   AllowParallelInitializationOfLocalRepositories : true
   EnableRedirectToChakraJsProvider : false

   -- Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.015 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.016 seconds
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 46

Microsoft (R) Windows Debugger Version 10.0.29507.1001 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Develop\PowerShellScripts\Minidump\030526-25140-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 26100 MP (32 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0xfffff807`ae800000 PsLoadedModuleList = 0xfffff807`af6f5100
Debug session time: Thu Mar  5 16:44:06.900 2026 (UTC - 5:00)
System Uptime: 0 days 3:19:35.013
Loading Kernel Symbols
..

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

.............................................................
................................................................
................................................................
................................................................
.......................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000ab`a0b1d018).  Type ".hh dbgerr001" for details
Loading unloaded module list
.........................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff807`aecfba80 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffba80`508d5b30=0000000000000139
3: kd> !analyze -v
Loading Kernel Symbols
..

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

.............................................................
................................................................
................................................................
................................................................
.......................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000ab`a0b1d018).  Type ".hh dbgerr001" for details
Loading unloaded module list
.........................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000039, A shadow stack violation has occurred due to mismatched return addresses
	on the call stack vs the shadow stack.
Arg2: ffffba80508d5e50, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffffba80508d5da8, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1843

    Key  : Analysis.Elapsed.mSec
    Value: 25223

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 2

    Key  : Analysis.Init.CPU.mSec
    Value: 625

    Key  : Analysis.Init.Elapsed.mSec
    Value: 19538

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 124

    Key  : Analysis.Version.DbgEng
    Value: 10.0.29507.1001

    Key  : Analysis.Version.Description
    Value: 10.2511.5.1 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2511.5.1

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x139

    Key  : Bugcheck.Code.TargetModel
    Value: 0x139

    Key  : Dump.Attributes.AsUlong
    Value: 0x21808

    Key  : Dump.Attributes.DiagDataWrittenToHeader
    Value: 1

    Key  : Dump.Attributes.ErrorCode
    Value: 0x0

    Key  : Dump.Attributes.KernelGeneratedTriageDump
    Value: 1

    Key  : Dump.Attributes.LastLine
    Value: Dump completed successfully.

    Key  : Dump.Attributes.ProgressPercentage
    Value: 0

    Key  : FailFast.Name
    Value: CONTROL_INVALID_RETURN_ADDRESS

    Key  : FailFast.Type
    Value: 57

    Key  : Failure.Bucket
    Value: 0x139_39_nt!KiFastFailDispatch

    Key  : Failure.Exception.Code
    Value: 0xc0000409

    Key  : Failure.Exception.Record
    Value: 0xffffba80508d5da8

    Key  : Failure.Hash
    Value: {e8b8c9f6-bfd5-4a13-bdc7-4e23058a5cc2}

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 0x7417df84

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 1

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 0

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 1

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 1

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 1

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 1

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 1

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 1

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 1

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 1

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 1

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 55185662

    Key  : Hypervisor.Flags.ValueHex
    Value: 0x34a10fe

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 1

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 1

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 1

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 1

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 1

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 1

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.Value
    Value: 1015

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 0x3f7

    Key  : WER.System.BIOSRevision
    Value: 1.20.0.0


BUGCHECK_CODE:  139

BUGCHECK_P1: 39

BUGCHECK_P2: ffffba80508d5e50

BUGCHECK_P3: ffffba80508d5da8

BUGCHECK_P4: 0

FILE_IN_CAB:  030526-25140-01.dmp

TAG_NOT_DEFINED_202b:  *** Unknown TAG in analysis list 202b


DUMP_FILE_ATTRIBUTES: 0x21808
  Kernel Generated Triage Dump

FAULTING_THREAD:  ffffd08f0f20a080

TRAP_FRAME:  ffffba80508d7090 -- (.trap 0xffffba80508d7090)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffa80bbcbce000
rdx=ffffa80c936bdbc0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff807af3be791 rsp=ffffba80508d7220 rbp=ffffba80508d72c1
 r8=ffffbf042cf80670  r9=0000000000000001 r10=0000000000000000
r11=fbfff34cdbdd2aa8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KscpCfgDispatchUserCallTargetEsSmep+0x11:
fffff807`af3be791 4f8b1cd3        mov     r11,qword ptr [r11+r10*8] ds:fbfff34c`dbdd2aa8=????????????????
Resetting default scope

EXCEPTION_RECORD:  ffffba80508d5da8 -- (.exr 0xffffba80508d5da8)
ExceptionAddress: fffff807af3be0a4 (nt!_guard_retpoline_icall_handler+0x0000000000000024)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 2
   Parameter[0]: 0000000000000039
   Parameter[1]: ffffcf81a6834f38
Subcode: 0x39 FAST_FAIL_CONTROL_INVALID_RETURN_ADDRESS Shadow stack violation

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1 (!blackboxwinlogon)


CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  python.exe

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000039

EXCEPTION_PARAMETER2:  ffffcf81a6834f38

DEVICE_OBJECT: 000000000000027c

EXCEPTION_STR:  0xc0000409

STACK_TEXT:  
ffffba80`508d5b28 fffff807`aeebece9     : 00000000`00000139 00000000`00000039 ffffba80`508d5e50 ffffba80`508d5da8 : nt!KeBugCheckEx
ffffba80`508d5b30 fffff807`aeebf2f2     : 00000000`00000000 ffffd08f`0453ef68 ffffd08e`96b4c840 fffff807`42f1303d : nt!KiBugCheckDispatch+0x69
ffffba80`508d5c70 fffff807`aeebc81f     : 00000000`00000000 ffffba80`508d6fe8 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xb2
ffffba80`508d5e50 fffff807`af3be0a4     : fffff807`aeeb3e00 fffff807`aeeb435f ffffba80`508d67d0 00000000`00000000 : nt!KiControlProtectionFault+0x3df
ffffba80`508d5fe0 fffff807`aeeb3dff     : fffff807`aeeb435f ffffba80`508d67d0 00000000`00000000 ffffba80`508d6080 : nt!_guard_retpoline_icall_handler+0x24
ffffba80`508d5fe8 fffff807`aeeb435f     : ffffba80`508d67d0 00000000`00000000 ffffba80`508d6080 00000000`00000000 : nt!guard_icall_bugcheck+0x2f
ffffba80`508d5ff0 fffff807`aea2f942     : ffffba80`508d6080 fffff807`ae800000 fffff807`af3be791 fffff807`ae94a4e4 : nt!RtlpExecuteHandlerForException+0xf
ffffba80`508d6020 fffff807`aebe5cef     : ffffba80`508d67d0 ffffba80`508d6cf0 ffffba80`508d67d0 ffffba80`508d6eb0 : nt!RtlDispatchException+0x2d2
ffffba80`508d67a0 fffff807`aeebee45     : 00000000`00000000 00000000`00000000 ffffba80`508d7090 00000000`00000000 : nt!KiDispatchException+0x35f
ffffba80`508d6eb0 fffff807`aeeb9b25     : 00000000`00000000 00000000`00000005 ffffa80b`d9d6a960 ffffa80b`d9d6a968 : nt!KiExceptionDispatch+0x145
ffffba80`508d7090 fffff807`af3be791     : fffff807`424b38a5 fffff807`424b359b ffffbf04`2cf80608 ffffbf04`2cf80608 : nt!KiGeneralProtectionFault+0x365
ffffba80`508d7220 fffff807`424b38a5     : fffff807`424b359b ffffbf04`2cf80608 ffffbf04`2cf80608 00000000`00000000 : nt!KscpCfgDispatchUserCallTargetEsSmep+0x11
ffffba80`508d7228 fffff807`424b2f5e     : fffff807`00000000 ffffa80b`00010000 ffffa80c`936bdbc0 ffffa80c`00000001 : Ntfs!FindNextIndexEntry2+0x675
ffffba80`508d7318 fffff807`42606472     : fffff807`42606472 ffffa80b`d5dd9488 ffffd08e`23c911b0 ffffa80b`d5dd9180 : Ntfs!NtfsContinueIndexEnumeration+0x10e
ffffba80`508d73d8 ffffd08e`6a7b3d18     : fffff807`4256779e ffffd08e`6a7b3d18 ffffd08f`0029a050 ffffd08e`23c911b0 : Ntfs!NtfsQueryDirectory+0xd32
ffffba80`508d75a8 fffff807`4256779e     : ffffd08e`6a7b3d18 ffffd08f`0029a050 ffffd08e`23c911b0 ffffa80b`d5dd9180 : 0xffffd08e`6a7b3d18
ffffba80`508d75b0 fffff807`4256746b     : 00000000`00000000 ffffd08f`0029a050 00000000`00000000 ffffd08e`9991fb10 : Ntfs!NtfsCommonDirectoryControl+0x2ce
ffffba80`508d75f0 fffff807`aeacda8b     : ffffd08f`02176920 ffffd08f`0029a050 ffffd08e`6a7b3d18 ffffba80`508d7618 : Ntfs!NtfsFsdDirectoryControl+0xcb
ffffba80`508d7660 fffff807`aeacda03     : ffffd08e`23069100 00000000`00000000 00000000`00000009 00000000`00000000 : nt!IopfCallDriver+0x5b
ffffba80`508d76a0 fffff807`4038c4ee     : ffffd08e`9991fb10 ffffd08f`02176920 ffffba80`508d77a0 fffff807`4039c0ef : nt!IofCallDriver+0x13
ffffba80`508d76d0 fffff807`4039bb60     : ffffba80`508d77a0 ffffba80`00000000 ffffd08e`19beed00 ffffba80`508d78c0 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3fe
ffffba80`508d7740 fffff807`aeacda8b     : ffffd08e`19beed60 00000000`00060800 ffffd08e`9991fb10 00000000`00030000 : FLTMGR!FltpDispatch+0x280
ffffba80`508d77e0 fffff807`aeacda03     : ffffd08f`0f20a698 00000000`00000000 ffffd08f`0029a070 ffffd08f`0f20a5c0 : nt!IopfCallDriver+0x5b
ffffba80`508d7820 fffff807`af0c34c5     : ffffd08e`9991fb10 ffffba80`508d78c0 ffffd08e`19beed60 00000000`00000000 : nt!IofCallDriver+0x13
ffffba80`508d7850 fffff807`af0c48d8     : 00000000`0000027c 00000000`00000000 00000000`00000000 ffffd08f`0f20a080 : nt!IopSynchronousServiceTail+0x1c5
ffffba80`508d7900 fffff807`aeebe355     : 000000ab`a0de5ee8 00000000`00000000 ffffba80`508d7aa0 000000ab`a0de64d0 : nt!NtQueryDirectoryFileEx+0xd8
ffffba80`508d79b0 00007ff9`c0f24424     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000ab`a0de63f8 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`c0f24424


SYMBOL_NAME:  nt!KiFastFailDispatch+b2

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.26100.7920

STACK_COMMAND: .process /r /p 0xffffd08f0fa33080; .thread 0xffffd08f0f20a080 ; kb

BUCKET_ID_FUNC_OFFSET:  b2

FAILURE_BUCKET_ID:  0x139_39_nt!KiFastFailDispatch

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {e8b8c9f6-bfd5-4a13-bdc7-4e23058a5cc2}

Followup:     MachineOwner
---------

3: kd> .exr 0xffffba80508d5da8
ExceptionAddress: fffff807af3be0a4 (nt!_guard_retpoline_icall_handler+0x0000000000000024)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 2
   Parameter[0]: 0000000000000039
   Parameter[1]: ffffcf81a6834f38
Subcode: 0x39 FAST_FAIL_CONTROL_INVALID_RETURN_ADDRESS Shadow stack violation
3: kd> !devobj 27c f
0000027c: Could not read device object or _DEVICE_OBJECT not found
3: kd> .thread /r /p ffffd08f0f20a080
Implicit thread is now ffffd08f`0f20a080
Implicit process is now ffffd08f`0fa33080
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000ab`a0b1d018).  Type ".hh dbgerr001" for details
3: kd> .exr 0xffffba80508d5da8
ExceptionAddress: fffff807af3be0a4 (nt!_guard_retpoline_icall_handler+0x0000000000000024)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 2
   Parameter[0]: 0000000000000039
   Parameter[1]: ffffcf81a6834f38
Subcode: 0x39 FAST_FAIL_CONTROL_INVALID_RETURN_ADDRESS Shadow stack violation
3: kd> .process /r /p 0xffffd08f0fa33080; .thread 0xffffd08f0f20a080 ; kb
Implicit process is now ffffd08f`0fa33080
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000ab`a0b1d018).  Type ".hh dbgerr001" for details
Implicit thread is now ffffd08f`0f20a080
  *** Stack trace for last set context - .thread/.cxr resets it
 # RetAddr               : Args to Child                                                           : Call Site
00 fffff807`aeebece9     : 00000000`00000139 00000000`00000039 ffffba80`508d5e50 ffffba80`508d5da8 : nt!KeBugCheckEx
01 fffff807`aeebf2f2     : 00000000`00000000 ffffd08f`0453ef68 ffffd08e`96b4c840 fffff807`42f1303d : nt!KiBugCheckDispatch+0x69
02 fffff807`aeebc81f     : 00000000`00000000 ffffba80`508d6fe8 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xb2
03 fffff807`af3be0a4     : fffff807`aeeb3e00 fffff807`aeeb435f ffffba80`508d67d0 00000000`00000000 : nt!KiControlProtectionFault+0x3df
04 fffff807`aeeb3dff     : fffff807`aeeb435f ffffba80`508d67d0 00000000`00000000 ffffba80`508d6080 : nt!_guard_retpoline_icall_handler+0x24
05 fffff807`aeeb435f     : ffffba80`508d67d0 00000000`00000000 ffffba80`508d6080 00000000`00000000 : nt!guard_icall_bugcheck+0x2f
06 fffff807`aea2f942     : ffffba80`508d6080 fffff807`ae800000 fffff807`af3be791 fffff807`ae94a4e4 : nt!RtlpExecuteHandlerForException+0xf
07 fffff807`aebe5cef     : ffffba80`508d67d0 ffffba80`508d6cf0 ffffba80`508d67d0 ffffba80`508d6eb0 : nt!RtlDispatchException+0x2d2
08 fffff807`aeebee45     : 00000000`00000000 00000000`00000000 ffffba80`508d7090 00000000`00000000 : nt!KiDispatchException+0x35f
09 fffff807`aeeb9b25     : 00000000`00000000 00000000`00000005 ffffa80b`d9d6a960 ffffa80b`d9d6a968 : nt!KiExceptionDispatch+0x145
0a fffff807`af3be791     : fffff807`424b38a5 fffff807`424b359b ffffbf04`2cf80608 ffffbf04`2cf80608 : nt!KiGeneralProtectionFault+0x365
0b fffff807`424b38a5     : fffff807`424b359b ffffbf04`2cf80608 ffffbf04`2cf80608 00000000`00000000 : nt!KscpCfgDispatchUserCallTargetEsSmep+0x11
0c fffff807`424b2f5e     : fffff807`00000000 ffffa80b`00010000 ffffa80c`936bdbc0 ffffa80c`00000001 : Ntfs!FindNextIndexEntry2+0x675
0d fffff807`42606472     : fffff807`42606472 ffffa80b`d5dd9488 ffffd08e`23c911b0 ffffa80b`d5dd9180 : Ntfs!NtfsContinueIndexEnumeration+0x10e
0e ffffd08e`6a7b3d18     : fffff807`4256779e ffffd08e`6a7b3d18 ffffd08f`0029a050 ffffd08e`23c911b0 : Ntfs!NtfsQueryDirectory+0xd32
0f fffff807`4256779e     : ffffd08e`6a7b3d18 ffffd08f`0029a050 ffffd08e`23c911b0 ffffa80b`d5dd9180 : 0xffffd08e`6a7b3d18
10 fffff807`4256746b     : 00000000`00000000 ffffd08f`0029a050 00000000`00000000 ffffd08e`9991fb10 : Ntfs!NtfsCommonDirectoryControl+0x2ce
11 fffff807`aeacda8b     : ffffd08f`02176920 ffffd08f`0029a050 ffffd08e`6a7b3d18 ffffba80`508d7618 : Ntfs!NtfsFsdDirectoryControl+0xcb
12 fffff807`aeacda03     : ffffd08e`23069100 00000000`00000000 00000000`00000009 00000000`00000000 : nt!IopfCallDriver+0x5b
13 fffff807`4038c4ee     : ffffd08e`9991fb10 ffffd08f`02176920 ffffba80`508d77a0 fffff807`4039c0ef : nt!IofCallDriver+0x13
14 fffff807`4039bb60     : ffffba80`508d77a0 ffffba80`00000000 ffffd08e`19beed00 ffffba80`508d78c0 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3fe
15 fffff807`aeacda8b     : ffffd08e`19beed60 00000000`00060800 ffffd08e`9991fb10 00000000`00030000 : FLTMGR!FltpDispatch+0x280
16 fffff807`aeacda03     : ffffd08f`0f20a698 00000000`00000000 ffffd08f`0029a070 ffffd08f`0f20a5c0 : nt!IopfCallDriver+0x5b
17 fffff807`af0c34c5     : ffffd08e`9991fb10 ffffba80`508d78c0 ffffd08e`19beed60 00000000`00000000 : nt!IofCallDriver+0x13
18 fffff807`af0c48d8     : 00000000`0000027c 00000000`00000000 00000000`00000000 ffffd08f`0f20a080 : nt!IopSynchronousServiceTail+0x1c5
19 fffff807`aeebe355     : 000000ab`a0de5ee8 00000000`00000000 ffffba80`508d7aa0 000000ab`a0de64d0 : nt!NtQueryDirectoryFileEx+0xd8
1a 00007ff9`c0f24424     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
1b 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`c0f24424
3: kd> !blackboxbsd
Version: 0xc8
Product type: 1

Auto advanced boot: TRUE
Advanced boot menu timeout: 30
Last boot succeeded: TRUE
Last boot shutdown: FALSE
Sleep in progress: FALSE

Power button timestamp: 0x0
System running: TRUE
Connected standby in progress: FALSE
User shutdown in progress: FALSE
System shutdown in progress: FALSE
Sleep in progress: 0
Connected standby scenario instance id: 0
Connected standby entry reason: 12
Connected standby exit reason: 32
System sleep transitions to on: 0
Last reference time: 0x1dcacd5283ea3eb
	2026-03-05T19:20:41.747Z
Last reference time checksum: 0x99787a9f
Last update boot id: 145

Boot attempt count: 1
Last boot checkpoint: TRUE
Checksum: 0x22
Last boot id: 145
Last successful shutdown boot id: 143
Last reported abnormal shutdown boot id: 144

Error info boot id: 0
Error info repeat count: 0
Error info other error count: 0
Error info code: 0
Error info status: 0x0

Power button last press time: 0x1dcac5dab078ee4
	2026-03-05T05:05:21.560Z
Power button cumulative press count: 432
Power button last press boot id: 141
Power button last power watchdog stage: 0x20
Power button watchdog armed: FALSE
Power button shutdown in progress: FALSE
Power button last release time: 0x1dcac5dab366444
	2026-03-05T05:05:21.867Z
Power button cumulative release count: 428
Power button last release boot id: 141
Power button error count: 0
Power button current connected standby phase: 0
Power button transition latest checkpoint id: 0
Power button transition latest checkpoint type: 0
Power button transition latest checkpoint sequence number: 0

Power transition Shutdown Device Type: 0
Power transition Setup In Progress: FALSE
Power transition OOBE In Progress: FALSE
Power transition Sleep Checkpoint Source: 0
Power transition Sleep Checkpoint: 0
Power transition Connected Standby Entry Reason Category: 0
Power transition Connected Standby Exit Reason Category: 0
Power transition Connected Standby Entry Scenario Instance Id: 0x1

Feature Configuration State : Boot Pending

3: kd> !blackboxntfs

NTFS Blackbox Data

0 Slow I/O Timeout Records Found
0 Oplock Break Timeout Records Found
3: kd> !blackboxpnp
    PnpActivityId      : {00000000-0000-0000-0000-000000000000}
    PnpActivityTime    : 134172176633884801
    PnpEventInformation: 3
    PnpEventInProgress : 0
    PnpProblemCode     : 24
    PnpVetoType        : 0
    DeviceId           : HID\{00001812-0000-1000-8000-00805f9b34fb}_Dev_VID&02046d_PID&b03f_REV&0008_d1034123c5cc&Col02\9&321439f9&0&0001
    VetoString         : 

3: kd> !blackboxwinlogon
    ThreadName         : WluiReleaseUI
    IsOperationPending : 0

3: kd> .thread /r /p ffffd08f0f20a080
Implicit thread is now ffffd08f`0f20a080
Implicit process is now ffffd08f`0fa33080
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000ab`a0b1d018).  Type ".hh dbgerr001" for details

Answer 1

The dump points to Android emulator. Try to update it.

Answer 2

Hi,

unfortunately, determining the cause of this issue typically requires the use of the debugger to gather other information.

However, you may try recommendations listed at Resolution section of https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x139--kernel-security-check-failure page.

Run command prompt as administrator, run

chkdsk C: /r /scan

command and show the result.

Run command prompt as administrator and run

fltmc filters

command. Then check all your filters with https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/allocated-altitudes list and try to uninstall non-Microsoft tools.

Answer 3

The dump shows a KERNEL_SECURITY_CHECK_FAILURE (0x139) with parameter 1 = 0x39, which is a shadow stack violation (CONTROL_INVALID_RETURN_ADDRESS). The failing path is inside the NTFS stack while a user‑mode process (python.exe in this dump) is doing a directory query, and the kernel’s control‑flow/stack protection detects a mismatched return address and forces a fast‑fail (0xC0000409).

From the data available, this is a kernel‑mode control‑flow integrity violation, not a simple app crash. On current Windows builds this is almost always caused by:

• A kernel‑mode driver that is not fully compatible with the current build’s Control-flow Enforcement / shadow stack protections, or
• Kernel memory corruption (often from a third‑party filter driver) that corrupts return addresses or function pointers used in NTFS/FLTMGR paths.

The stack shows:

• nt!KiFastFailDispatch → nt!KiControlProtectionFault → nt!_guard_retpoline_icall_handler / guard_icall_bugcheck
• Then into Ntfs!FindNextIndexEntry2 / NtfsQueryDirectory
• With FLTMGR on the path (file‑system filter stack)

That pattern is consistent with a file‑system filter or other kernel driver misbehaving while NTFS is enumerating directories on behalf of python.exe. The “PROCESS_NAME” changing between crashes fits this: any process doing file I/O through the affected path can trigger the same kernel‑mode bug.

Given that the issue started after installing preview build KB5077241 (26100.7922) and is reproducible across different user‑mode processes, the most practical mitigation path is:

1. Avoid the preview build
   • Stay on the last stable (non‑preview) cumulative update where the system is stable. Preview updates can expose stricter kernel protections that some third‑party drivers are not yet ready for.
2. Update or temporarily remove third‑party kernel drivers
   • Focus on anything that hooks file I/O or storage:
     • Backup/sync tools (such as pCloud) – these typically install file‑system filter drivers.
     • Security/AV/EDR products.
     • Disk encryption, snapshot, or backup software.
     • Storage vendor utilities.
   • Make sure all such software is updated to versions explicitly supporting the current Windows 11 build.
   • As a test, clean‑boot with all non‑Microsoft services and drivers disabled (or uninstall the suspected tools) and see whether the 0x139 crashes stop.
3. Check for vendor BIOS/firmware and storage driver updates
   • On a gaming laptop with Hyper‑V enabled (Hypervisor flags are present in the dump), ensure:
     • Latest BIOS/UEFI from Dell for the Alienware m18 R2.
     • Latest Intel/AMD chipset drivers and storage/NVMe drivers from Dell’s support site.
   • Out‑of‑date platform firmware or storage drivers can interact badly with new kernel mitigations.
4. If Docker/Hyper‑V is involved
   • Docker Desktop relies on Hyper‑V / WSL2. Ensure Docker Desktop and WSL2 are fully up to date.
   • As a test, disable Hyper‑V/WSL2 and Docker temporarily and see if the crashes still occur. If they stop, re‑enable them after updating all related components.
5. If the problem persists on the latest stable cumulative update with only Microsoft drivers loaded
   • That points to either a regression in the OS build itself or a hardware/firmware interaction. In that case, open a support case with Microsoft or Dell, providing:
     • The minidumps.
     • System information and driver list.
     • The fact that the bugcheck is 0x139, parameter 1 = 0x39 (shadow stack violation) in Ntfs/FLTMGR paths.

Because the context provided here does not include a specific hotfix or KB for this exact 0x139 shadow stack violation on 26100.7922, the only supported guidance is to roll back from the preview, update/remove third‑party kernel drivers (especially file‑system filters), and work with vendor/Microsoft support if it reproduces on a non‑preview build with only Microsoft drivers.

---

References:

• System crashes with Stop error 0x00000139 in Windows 8.1 and Windows Server 2012 R2