Share via

STORE_DATA_STRUCTURE_CORRUPTION & MEMORY_MANAGEMENT (1a)

Frosti Cryuki 0 Reputation points
2026-06-16T00:18:09.4933333+00:00

heyo, i've been getting bsod for a few days now trying to figure out whats causing it. i checked and did some test that shows thats its not my 4 ram sticks (16GB) hardware not too sure but, its either that or a driver. Im using WinDbg to review my minidumps and im unsure what to read to find the problem.

3: kd> !analyze -v

Loading Kernel Symbols

...............................................................

................................................................

...............................................

Loading User Symbols

PEB address is NULL !

Loading unloaded module list

......


  •                                                                         *
    
  •                    Bugcheck Analysis                                    *
    
  •                                                                         *
    

STORE_DATA_STRUCTURE_CORRUPTION (1c7)

The store component detected a corruption in its data structures.

Arguments:

Arg1: 0000000000000001, An unhandled exception occurred on the store thread and a chunk heap buffer's hash doesn't match, which is likely the source of the exception.

Arg2: ffffcc8300ab2000, Chunk heap buffer whose hash didn't match.

Arg3: 000000008a1f923c, Expected buffer hash.

Arg4: 00000000001b68b2, Page frame number of the corrupted page.

Debugging Details:


KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec

Value: 1531

Key  : Analysis.Elapsed.mSec

Value: 2592

Key  : Analysis.IO.Other.Mb

Value: 0

Key  : Analysis.IO.Read.Mb

Value: 1

Key  : Analysis.IO.Write.Mb

Value: 0

Key  : Analysis.Init.CPU.mSec

Value: 390

Key  : Analysis.Init.Elapsed.mSec

Value: 8604

Key  : Analysis.Memory.CommitPeak.Mb

Value: 80

Key  : Analysis.Version.DbgEng

Value: 10.0.29547.1002

Key  : Analysis.Version.Description

Value: 10.2602.27.2 amd64fre

Key  : Analysis.Version.Ext

Value: 1.2602.27.2

Key  : Bugcheck.Code.LegacyAPI

Value: 0x1c7

Key  : Bugcheck.Code.TargetModel

Value: 0x1c7

Key  : Failure.Bucket

Value: 0x1C7_1_nt!SmHpBufferProtectEx

Key  : Failure.Hash

Value: {d3fd1234-6d8c-5807-dc3b-dd5ba1369421}

Key  : WER.OS.Branch

Value: vb_release

Key  : WER.OS.Version

Value: 10.0.19041.1

Key  : WER.System.BIOSRevision

Value: 5.17.0.0

BUGCHECK_CODE: 1c7

BUGCHECK_P1: 1

BUGCHECK_P2: ffffcc8300ab2000

BUGCHECK_P3: 8a1f923c

BUGCHECK_P4: 1b68b2

FILE_IN_CAB: 061526-9062-01.dmp

FAULTING_THREAD: ffffcc82f775e080

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1 (!blackboxwinlogon) (!blackboxwinlogonnotify)

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: MemCompression

TRAP_FRAME: ffff800000000000 -- (.trap 0xffff800000000000)

Unable to read trap frame at ffff8000`00000000

Resetting default scope

STACK_TEXT:

ffff9101e2ede678 fffff80153c35510 : 00000000000001c7 0000000000000001 ffffcc8300ab2000 000000008a1f923c : nt!KeBugCheckEx

ffff9101e2ede680 fffff80153b4e524 : b5a98bcab027d049 00000000001b68b2 00000000000002e3 0000000000000002 : nt!SmHpBufferProtectEx+0x1e1db0

ffff9101e2ede6e0 fffff80153d99fc0 : fffff80100000000 ffff9101e2ede7c0 ffff9101e2edfba0 0000000000000001 : nt!SmHpChunkHeapProtect+0x6c

ffff9101e2ede710 fffff80153c1c299 : ffffcc82f7725000 ffff9101e2ede7c0 ffff910100000001 ffff9101e2ede870 : nt!SMKM_STORE<SM_TRAITS>::SmStUnhandledExceptionFilter+0x50

ffff9101e2ede760 fffff80153bcfe32 : fffff80100000003 fffff801538d6c08 ffff9101e2ed9000 ffff9101e2ee0000 : nt!SMKM_STORE<SM_TRAITS>::SmStWorkerThread'::1'::filt$0+0x1b

ffff9101e2ede790 fffff80153c08102 : fffff801538d6c08 ffff9101e2eded70 fffff80153bcfd90 0000000000000000 : nt!_C_specific_handler+0xa2

ffff9101e2ede800 fffff80153b3e817 : ffff9101e2eded70 0000000000000000 ffff9101e2edfba0 fffff80153b2be81 : nt!RtlpExecuteHandlerForException+0x12

ffff9101e2ede830 fffff80153b3c4b6 : ffff9101e2edf748 ffff9101e2edf480 ffff9101e2edf748 0000000008043b20 : nt!RtlDispatchException+0x297

ffff9101e2edef50 fffff80153c11eec : 0000000000001000 ffff9101e2edf7f0 ffff800000000000 0000000000000000 : nt!KiDispatchException+0x186

ffff9101e2edf610 fffff80153c0d752 : 0000000000000000 0000000000000000 0000000000000103 0000000000000000 : nt!KiExceptionDispatch+0x12c

ffff9101e2edf7f0 fffff80153a6bb75 : 000000002005a9a6 ffffcc82f7725050 00000000ffffffff ffff7d19b2432060 : nt!KiPageFault+0x452

ffff9101e2edf980 fffff80153a6a776 : 0000000000000000 0000000000000000 ffff9101e2edfa29 ffffcc82f7725050 : nt!ST_STORE<SM_TRAITS>::StDmCombinePageEntry+0x59

ffff9101e2edf9c0 fffff80153a68422 : 0000000000000000 ffffcc83084e00d0 0000000000000000 fffff80153a68313 : nt!ST_STORE<SM_TRAITS>::StDmPageRemove+0x11a

ffff9101e2edfa90 fffff80153a67956 : ffffcc82f7725000 ffff9101e2edfb58 0000000000000001 ffffcc82f775e080 : nt!ST_STORE<SM_TRAITS>::StWorkItemProcess+0xc2

ffff9101e2edfae0 fffff80153b2be81 : ffff920100000000 ffffcc8200000000 0000000000000000 0000000000000000 : nt!SMKM_STORE<SM_TRAITS>::SmStWorker+0x12a

ffff9101e2edfba0 fffff80153b5d6e5 : ffffcc82f7725000 fffff80153b2be70 ffff9101e2cef368 000fe067bcbbbdff : nt!SMKM_STORE<SM_TRAITS>::SmStWorkerThread+0x11

ffff9101e2edfbd0 fffff80153c065c8 : ffff9201e6650180 ffffcc82f775e080 fffff80153b5d690 0038005f00350032 : nt!PspSystemThreadStartup+0x55

ffff9101e2edfc20 0000000000000000 : ffff9101e2ee0000 ffff9101e2ed9000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x28

SYMBOL_NAME: nt!SmHpBufferProtectEx+1e1db0

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.6456

STACK_COMMAND: .process /r /p 0xffffcc82f7724080; .thread /r /p 0xffffcc82f775e080 ; kb

BUCKET_ID_FUNC_OFFSET: 1e1db0

FAILURE_BUCKET_ID: 0x1C7_1_nt!SmHpBufferProtectEx

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {d3fd1234-6d8c-5807-dc3b-dd5ba1369421}

Followup: MachineOwner


1: kd> !analyze -v
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 0000000d`d8097018).  Type ".hh dbgerr001" for details
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
	the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: ffffb60006ec1a28
Arg3: 0000200000000000
Arg4: 0000000000000000

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1203

    Key  : Analysis.Elapsed.mSec
    Value: 4876

    Key  : Analysis.IO.Other.Mb
    Value: 16

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 20

    Key  : Analysis.Init.CPU.mSec
    Value: 562

    Key  : Analysis.Init.Elapsed.mSec
    Value: 44209

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 75

    Key  : Analysis.Version.DbgEng
    Value: 10.0.29547.1002

    Key  : Analysis.Version.Description
    Value: 10.2602.27.2 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2602.27.2

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x1a

    Key  : Bugcheck.Code.TargetModel
    Value: 0x1a

    Key  : Failure.Bucket
    Value: MEMORY_CORRUPTION_ONE_BIT

    Key  : Failure.Hash
    Value: {e3faf315-c3d0-81db-819a-6c43d23c63a7}

    Key  : MemoryManagement.PFN
    Value: 0x200000000

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Version
    Value: 10.0.19041.1


BUGCHECK_CODE:  1a

BUGCHECK_P1: 41792

BUGCHECK_P2: ffffb60006ec1a28

BUGCHECK_P3: 200000000000

BUGCHECK_P4: 0

FILE_IN_CAB:  061526-13140-01.dmp

FAULTING_THREAD:  ffffcc06eb954080

MEMORY_CORRUPTOR:  ONE_BIT

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  conhost.exe

STACK_TEXT:  
ffffa209`7a7a70b8 fffff803`740b964a     : 00000000`0000001a 00000000`00041792 ffffb600`06ec1a28 00002000`00000000 : nt!KeBugCheckEx
ffffa209`7a7a70c0 fffff803`740b7e7f     : ffffcc06`ec0ec740 00000000`00000000 ffffcc06`00000002 00000000`00000000 : nt!MiDeleteVa+0x153a
ffffa209`7a7a71c0 fffff803`7401c328     : 00000000`00000001 ffffcc06`00000000 ffffcc06`ec0ec590 ffffcc06`eb954080 : nt!MiDeletePagablePteRange+0x48f
ffffa209`7a7a74d0 fffff803`7441ecfb     : ffffcc06`00000000 00000000`00000000 ffffcc06`00000000 ffffcc06`ec0ec0c0 : nt!MiDeleteVad+0x378
ffffa209`7a7a75d0 fffff803`74438aa3     : ffffcc06`e9009340 ffffcc06`e9009340 ffffcc06`e9007e00 ffffcc06`ec0ec0c0 : nt!MiCleanVad+0x43
ffffa209`7a7a7600 fffff803`74404944     : ffffffff`00000000 ffffffff`ffffffff 00000000`00000001 ffffcc06`ec0ec0c0 : nt!MmCleanProcessAddressSpace+0x137
ffffa209`7a7a7680 fffff803`744c3bee     : ffffcc06`ec0ec0c0 ffffa580`49fe0060 ffffa209`7a7a78a9 00000000`00000000 : nt!PspRundownSingleProcess+0x20c
ffffa209`7a7a7710 fffff803`74488708     : ffffcc06`00000000 fffff803`74004301 00000000`00000000 0000000d`d80a2000 : nt!PspExitThread+0x5f6
ffffa209`7a7a7810 fffff803`7404a6cd     : 00000000`00000000 00000000`00000001 00000000`00000101 00000000`00000010 : nt!KiSchedulerApcTerminate+0x38
ffffa209`7a7a7850 fffff803`74202c60     : 00000154`f7fb61c0 ffffa209`7a7a7910 ffffa209`7a7a7ac0 ffffe081`75b9e180 : nt!KiDeliverApc+0x60d
ffffa209`7a7a7910 fffff803`742115af     : 00000000`00000000 ffffa209`7a7a7b40 00000000`00000000 ffffcc06`ec102200 : nt!KiInitiateUserApc+0x70
ffffa209`7a7a7a50 00007ffa`f85d1034     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
0000000d`d7f3fae8 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`f85d1034


MODULE_NAME: hardware

IMAGE_NAME:  memory_corruption

STACK_COMMAND: .process /r /p 0xffffcc06ec0ec0c0; .thread /r /p 0xffffcc06eb954080 ; kb

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {e3faf315-c3d0-81db-819a-6c43d23c63a7}

Followup:     MachineOwner
---------
Windows for home | Windows 10 | Performance and system failures
0 comments No comments

2 answers

Sort by: Most helpful
  1. Jonathan Deives 74,060 Reputation points Independent Advisor
    2026-06-16T00:55:32.6166667+00:00

    The log indicates that the cause of the problem is related to RAM hardware.
    Test your RAM using memtest86 tool and see if any problem is found.

    This link has a tutorial on how to use and perform the test;

    https://www.tenforums.com/tutorials/14201-memtest86-test-ram.html


    Note: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.


    Was this answer helpful?


  2. AI answer

    2026-06-16T00:18:22.8833333+00:00

    Both bug checks point to physical memory corruption rather than a specific driver or app.

    From the dumps:

    1. STORE_DATA_STRUCTURE_CORRUPTION (0x1C7)
      • Arg1 = 1: “An unhandled exception occurred on the store thread and a chunk heap buffer's hash doesn't match, which is likely the source of the exception.”
      • The store component (memory compression / store manager) detected that one of its internal buffers was corrupted.
      • Official documentation states this bug check occurs when the store component detects corruption in its data structures and specifically calls out physical memory corruption as a cause (defective RAM, bad DMA from a driver/device, or firmware/hardware corrupting memory).
    2. MEMORY_MANAGEMENT (0x1A) with parameter 0x41792
      • Meaning: “A corrupt PTE has been detected. Parameter 2 contains the address of the PTE. Parameters 3/4 contain the low/high parts of the PTE.”
      • The analysis flags MEMORY_CORRUPTION_ONE_BIT and MODULE_NAME: hardware / IMAGE_NAME: memory_corruption.
      • The MEMORY_MANAGEMENT documentation explicitly associates many 0x1A variants with hardware errors when PTEs/PFNs are corrupted.

    Taken together, this pattern is consistent with:

    • Single‑bit errors or other corruption in physical RAM, or
    • A driver/device doing incorrect DMA / MDL operations that corrupt physical pages, or
    • Firmware/hardware corrupting memory across power transitions.

    What to do next (based on the docs):

    1. Run Windows Memory Diagnostics
      • Open Control Panel → search for “Memory” → “Diagnose your computer's memory problems”.
      • Let it run the extended test and then check Event Viewer → System log → MemoryDiagnostics-Results for any reported errors.
      • Both the 0x1C7 and 0x12B/0x1A guidance recommend this as the first step to confirm or rule out defective RAM.
    2. If memory diagnostics show errors
      • Treat this as a hardware issue: test with fewer sticks, swap slots, or replace RAM as needed.
    3. If memory diagnostics are clean
      • Suspect a driver or device doing bad DMA / MDL operations:
        • Update chipset, storage, GPU, and any device drivers from the system/motherboard and device vendors.
        • Remove or disable recently added hardware or low‑level utilities (overclocking tools, vendor “tuning” or monitoring software) and see if the crashes stop.
      • Check Event Viewer → System for other critical errors around the same time as the bug checks that might point to a specific device or driver.
    4. Optional deeper debugging
      • If comfortable with WinDbg and the system is stable enough, Driver Verifier can sometimes surface a misbehaving third‑party driver, but it can also cause boot loops if the offending driver is in the boot path. Use it cautiously and ensure a restore point or recovery media is available.

    The key point from the dumps and documentation is that this is not a typical “named driver” crash; it is memory corruption detected by the kernel’s store/memory manager. The supported next step is to thoroughly test RAM and then, if RAM is clean, focus on drivers/devices that can access physical memory (storage, GPU, other PCIe devices, and their associated drivers/firmware).


    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.