BSOD Kernel_Security_Check_Failure

Question

BSOD Kernel_Security_Check_Failure

M 0

When attempting to launch certain games, or whenever I double-click on any program that is crashing (window with white overlay and spinning wheel where cursor is positioned), I get an instant Kernal_Security_Check_Failure BSOD.

I have run DISM (DISM /Online /Cleanup-Image /CheckHealth), chkdsk (chkdsk /f) and SFC (sfc /scannow) to no avail. I have also updated many of my drivers.

This is what I have for my .dmp file.
Despite it saying my OSNAME is 10, I am running Windows 11.
Please advise!

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff81081b6ee8b0, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffff81081b6ee808, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1218

    Key  : Analysis.Elapsed.mSec
    Value: 1861

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 421

    Key  : Analysis.Init.Elapsed.mSec
    Value: 3331

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 82

    Key  : Analysis.Version.DbgEng
    Value: 10.0.29547.1002

    Key  : Analysis.Version.Description
    Value: 10.2602.27.2 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2602.27.2

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x139

    Key  : Bugcheck.Code.TargetModel
    Value: 0x139

    Key  : Dump.Attributes.AsUlong
    Value: 0x21808

    Key  : Dump.Attributes.DiagDataWrittenToHeader
    Value: 1

    Key  : Dump.Attributes.ErrorCode
    Value: 0x0

    Key  : Dump.Attributes.KernelGeneratedTriageDump
    Value: 1

    Key  : Dump.Attributes.LastLine
    Value: Dump completed successfully.

    Key  : Dump.Attributes.ProgressPercentage
    Value: 0

    Key  : FailFast.Name
    Value: CORRUPT_LIST_ENTRY

    Key  : FailFast.Type
    Value: 3

    Key  : Failure.Bucket
    Value: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

    Key  : Failure.Exception.Code
    Value: 0xc0000409

    Key  : Failure.Exception.Record
    Value: 0xffff81081b6ee808

    Key  : Failure.Hash
    Value: {3aede96a-54dd-40d6-d4cb-2a161a843851}

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 0x7497cf94

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 1

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 1

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 0

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 1

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 0

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 1

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 1

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 1

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 1

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 1

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 1

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 38408431

    Key  : Hypervisor.Flags.ValueHex
    Value: 0x24a10ef

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 1

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 1

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 1

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 1

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 1

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 1

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.Value
    Value: 1015

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 0x3f7

    Key  : WER.System.BIOSRevision
    Value: 5.35.0.0


BUGCHECK_CODE:  139

BUGCHECK_P1: 3

BUGCHECK_P2: ffff81081b6ee8b0

BUGCHECK_P3: ffff81081b6ee808

BUGCHECK_P4: 0

FILE_IN_CAB:  051526-13984-02.dmp

DUMP_FILE_ATTRIBUTES: 0x21808
  Kernel Generated Triage Dump

FAULTING_THREAD:  ffffe184df068080

TRAP_FRAME:  ffff81081b6ee8b0 -- (.trap 0xffff81081b6ee8b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe184bc21f570 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff804c4c6f07a rsp=ffff81081b6eea40 rbp=ffff9f8031191180
 r8=0000000000000000  r9=0000000000000000 r10=ffffe184b18fa401
r11=ffffe184b17d4208 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe cy
nt!KiProcessThreadWaitList+0x17a:
fffff804`c4c6f07a cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffff81081b6ee808 -- (.exr 0xffff81081b6ee808)
ExceptionAddress: fffff804c4c6f07a (nt!KiProcessThreadWaitList+0x000000000000017a)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY 

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1 (!blackboxwinlogon) (!blackboxwinlogonnotify)


CUSTOMER_CRASH_COUNT:  2

PROCESS_NAME:  System

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000003

EXCEPTION_STR:  0xc0000409

STACK_TEXT:  
ffff8108`1b6ee588 fffff804`c50bcee9     : 00000000`00000139 00000000`00000003 ffff8108`1b6ee8b0 ffff8108`1b6ee808 : nt!KeBugCheckEx
ffff8108`1b6ee590 fffff804`c50bd4f2     : 00400000`00000080 fffff804`00000000 03008a11`086070fe 00000000`00000048 : nt!KiBugCheckDispatch+0x69
ffff8108`1b6ee6d0 fffff804`c50bb128     : 00000000`00000000 fffff804`c58159c0 00000000`00000000 fffff804`c4ee2c37 : nt!KiFastFailDispatch+0xb2
ffff8108`1b6ee8b0 fffff804`c4c6f07a     : ffffe184`df068180 ffff9f80`31191180 00000000`00000002 ffffe184`df068080 : nt!KiRaiseSecurityCheckFailure+0x368
ffff8108`1b6eea40 fffff804`c4c6ecc6     : 00000000`00000000 ffffe184`00000001 ffffe184`00000000 00000000`00000000 : nt!KiProcessThreadWaitList+0x17a
ffff8108`1b6eeae0 fffff804`c4c87240     : 00000002`bc1ab000 ffffe184`c8d90100 ffffe184`c8d90100 00000000`00000000 : nt!KiExitDispatcher+0x46
ffff8108`1b6eeb40 fffff804`c504dff3     : 00000000`00000000 ffff8108`1b6eec30 ffff8108`1b6eee50 ffff8108`1b6eee50 : nt!KeInsertQueueApc+0x250
ffff8108`1b6eebf0 fffff804`c533d250     : 00000000`00000000 ffff8108`1b6eee50 ffffe184`c8d90100 ffffe184`b17d4040 : nt!EtwpTraceThreadRundownWithStack+0x12b
ffff8108`1b6eed00 fffff804`c533d1bd     : ffffe184`fcf40040 ffffe184`c8d86080 fffff804`c533d210 ffffe184`b17d4040 : nt!EtwpThreadEnumCallback+0x40
ffff8108`1b6eed30 fffff804`c533dbc0     : ffff8108`1b6eefa0 ffff8108`1b6eee01 ffff8108`1b6eee50 ffffe184`b17d4040 : nt!PsEnumProcessThreads+0x4d
ffff8108`1b6eed60 fffff804`c525dbb7     : 00000000`00002000 ffffe184`b1bd8000 ffffe184`b17d4040 fffff804`c533d8f0 : nt!EtwpProcessEnumCallback+0x2d0
ffff8108`1b6eee00 fffff804`c540e1c5     : 00000000`00002000 ffff8108`1b6eeea0 ffff8108`1b6eefa0 fffff804`c4d686b2 : nt!PsEnumProcesses+0x73
ffff8108`1b6eee30 fffff804`c540dce1     : 00000000`00000000 ffff8108`1b6eefa0 00000000`00000001 ffff8108`1b6eefa0 : nt!EtwpProcessThreadImageRundown+0xb9
ffff8108`1b6eeec0 fffff804`c540dbfd     : 00000000`00000001 ffffe184`b1bd8000 ffffc186`00000016 00000000`00000016 : nt!EtwpKernelTraceRundown+0xbd
ffff8108`1b6eef30 fffff804`c55282df     : 00000000`00000000 00000000`00000016 ffffe184`b1bd8000 ffffc186`d3015080 : nt!EtwpLogKernelTraceRundown+0x4d
ffff8108`1b6eef70 fffff804`c540d7ab     : ffffc186`cb08cb28 80000001`00000020 ffffe184`b1bd8001 ffffc186`b568e2e0 : nt!EtwpCheckGuidAccessAndDoRundown+0x11a923
ffff8108`1b6ef010 fffff804`c544161d     : 00000000`00000001 ffff8108`1b6ef180 00000000`00000000 00000000`00000409 : nt!EtwpEnableDisableSpecialGuids+0x17f
ffff8108`1b6ef080 fffff804`c5482cf2     : 00000000`00000000 ffff8000`00000000 00000000`00000000 fffff804`c4c43b7b : nt!EtwpEnableGuid+0x26d
ffff8108`1b6ef2d0 fffff804`c50bc558     : 00000000`00000011 00000000`00000009 00000000`00000000 00000000`00000000 : nt!NtTraceControl+0x5a2
ffff8108`1b6ef3f0 00007ffa`5af25754     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000c0`549fdc48 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`5af25754


SYMBOL_NAME:  nt!KiFastFailDispatch+b2

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.26100.8457

STACK_COMMAND: .process /r /p 0xffffe184e5285080; .thread /r /p 0xffffe184df068080 ; kb

BUCKET_ID_FUNC_OFFSET:  b2

FAILURE_BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {3aede96a-54dd-40d6-d4cb-2a161a843851}

Followup:     MachineOwner
---------

0 comments

2 answers

Your answer

Answer 1

Jonathan Deives 74,060 Independent Advisor

The log file doesn't indicate any specific cause; check if you have more minidump files.

To find these files, this is the path "C:\Windows\Minidump".

First copy and paste all the minidump files you have to another folder and then zip it. Then upload the ZIP file to the cloud OneDrive.

Choose to share or right click and get the share link.

Please post the link to the ZIP file here so it can be reviewed.

M 0 Reputation points

2026-05-16T00:11:43.14+00:00

https://1drv.ms/u/c/d2e96c0d1e41df11/IQCFc5Z3oUhHT5L3_BN5muR_AZUs5XlSm-fh9ssRIkjJiac?e=1wfn2d This contains all of my minidump files.
Jonathan Deives 74,060 Reputation points Independent Advisor

2026-05-16T00:15:14+00:00

The minidump files do not indicate any driver or hardware causes, only memory corruption.

Try forcing Windows to show failed drivers and produce minidump files, enable Driver Verifier for this.

Before running Driver Verifier, create a new system restore point.

Click on start menu and type "verifier".

Select "Create custom settings (for code developers)" > "Next".

Check all options except "DDI compliance checking" and "Randomized low resource simulation".

Click Next > Select "Select driver names from a list".

Next Select all drivers NOT provided by Microsoft. > Next > Finish.

Restart the system until the BSOD occurs 3 times and minidump files are generated.

If you have problems starting Windows after enabling Driver Verifier, follow these steps:

Start your PC, as soon as Windows tries to load (spinning dots appear), press and hold the power button for 5 to 10 seconds to perform a forced shutdown

Do this three times.

Windows will boot into the Recovery Environment.

Go to Troubleshoot > Advanced Option > Startup Settings and click Restart.

When restarting, press 4 to enter safe mode.

Open command prompt as administrator, run these two commands and restart your PC.

verifier /reset

verifier /bootmode resetonbootfail

Answer 2

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

1 deleted comment

Comments have been turned off. Learn more

Share via

BSOD Kernel_Security_Check_Failure

2 answers

Your answer