Crash Win 10 MiniDump

Question

Hello ,

Please, can someone help me how to identifify the root cause of this crash !

icrosoft (R) Windows Debugger Version 10.0.25111.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\061822-9453-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff8036a600000 PsLoadedModuleList = 0xfffff8036b22a2b0
Debug session time: Sat Jun 18 12:37:16.986 2022 (UTC + 1:00)
System Uptime: 0 days 0:11:15.700
Loading Kernel Symbols
...............................................................
................................................................
................................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
...................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff8036a9f7dd0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffc70418fadc40=000000000000001e
0: kd> !analyze -v

---

**

Bugcheck Analysis

**

---

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8036f3c321d, The address that the exception occurred at
Arg3: ffffc70418faec78, Parameter 0 of the exception
Arg4: ffffc70418fae4b0, Parameter 1 of the exception

Debugging Details:

------------------

WARNING: Unable to verify timestamp for tap_ovpnconnect.sys

---

---

---

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

---

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

---

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

---

Type referenced: ExceptionRecord

---

---

---

---

---

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

---

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

---

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

---

Type referenced: ContextRecord

---

---

---

---

---

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

---

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

---

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

---

Type referenced: ExceptionRecord

---

---

---

---

---

Either you specified an unqualified symbol, or your debugger

doesn't have full symbol information. Unqualified symbol

resolution is turned off by default. Please either specify a

fully qualified symbol module!symbolname, or enable resolution

of unqualified symbols by typing ".symopt- 100". Note that

enabling unqualified symbol resolution with network symbol

server shares in the symbol path may cause the debugger to

appear to hang for long periods of time when an incorrect

symbol name is typed or the network symbol server is down.

---

For some commands to work properly, your symbol path

must point to .pdb files that have full type information.

---

Certain .pdb files (such as the public OS symbols) do not

contain the required information. Contact the group that

provided you with these symbols if you need this command to

work.

---

Type referenced: ContextRecord

---

---

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec  
Value: 10468  

Key  : Analysis.DebugAnalysisManager  
Value: Create  

Key  : Analysis.Elapsed.mSec  
Value: 27595  

Key  : Analysis.Init.CPU.mSec  
Value: 499  

Key  : Analysis.Init.Elapsed.mSec  
Value: 2715  

Key  : Analysis.Memory.CommitPeak.Mb  
Value: 101  

Key  : WER.OS.Branch  
Value: vb_release  

Key  : WER.OS.Timestamp  
Value: 2019-12-06T14:06:00Z  

Key  : WER.OS.Version  
Value: 10.0.19041.1  

FILE_IN_CAB: 061822-9453-01.dmp

BUGCHECK_CODE: 1e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8036f3c321d

BUGCHECK_P3: ffffc70418faec78

BUGCHECK_P4: ffffc70418fae4b0

EXCEPTION_PARAMETER1: ffffc70418faec78

EXCEPTION_PARAMETER2: ffffc70418fae4b0

WRITE_ADDRESS: fffff8036b2fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffc70418fae4b0

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: OpenVPNConnect.exe

STACK_TEXT:
ffffc70418fadc38 fffff8036ab0fd4f : 000000000000001e ffffffffc0000005 fffff8036f3c321d ffffc70418faec78 : nt!KeBugCheckEx
ffffc70418fadc40 fffff8036aa10866 : ffffc70418fae4b0 fffff8036a9342d5 ffffc70418faeeb0 fffff8036f3c321d : nt!KiFatalFilter+0x1f
ffffc70418fadc80 fffff8036a9cd4af : fffff80300000002 fffff8036a6ca590 ffffc70418fa9000 ffffc70418fb0000 : nt!KeExpandKernelStackAndCalloutInternal$filt$0+0x16
ffffc70418fadcc0 fffff8036aa00c8f : fffff8036a6ca590 ffffc70418fae2a0 fffff8036a9cd410 0000000000000000 : nt!_C_specific_handler+0x9f
ffffc70418fadd30 fffff8036a8dd7b7 : ffffc70418fae2a0 0000000000000000 ffffc70418faf490 fffff8036a827328 : nt!RtlpExecuteHandlerForException+0xf
ffffc70418fadd60 fffff8036a8dc3b6 : ffffc70418faec78 ffffc70418fae9b0 ffffc70418faec78 0000000000000001 : nt!RtlDispatchException+0x297
ffffc70418fae480 fffff8036aa09eac : ffffc70418fae974 0000000000000000 ffffb58d28af25f0 ffffb58d25bfb720 : nt!KiDispatchException+0x186
ffffc70418faeb40 fffff8036aa05be0 : ffffb58d3818ebc0 0000000000000000 ffffc70418faf350 ffffeec77c9db9b6 : nt!KiExceptionDispatch+0x12c
ffffc70418faed20 fffff8036f3c321d : ffffb58d25bad920 ffffb58d00b7c1a0 0000000000400000 ffffb58d37bb8030 : nt!KiGeneralProtectionFault+0x320
ffffc70418faeeb0 fffff8036f400f89 : 0000000000000000 ffffb58d26089111 0000000000000020 0000000000000000 : ndis!ndisNblTrackerTransferOwnershipInternal+0xa1
ffffc70418faef30 fffff8036f463274 : ffffb58d25bad920 ffffb58d00b70000 0000000000000000 0000000000000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x3f219
ffffc70418faf010 fffff8036f462f38 : ffffb58d00b7c1a0 fffff80300000000 ffffc70400000000 ffffc70400000000 : ndis!ndisMIndicateSplitNblChain+0x320
ffffc70418faf0b0 fffff8036f3c1d56 : ffffb58d37581801 ffffc70418faf298 ffffc70418faf200 ffffc70418faf200 : ndis!ndisMIndicateReceiveNblsWithThrottling+0x38
ffffc70418faf0f0 fffff8036f3fde5b : ffffb58d00b7c1a0 ffffb58d33ab4400 ffffb58d00d07a00 fffff8036a82729d : ndis!ndisMTopReceiveNetBufferLists+0x2b6
ffffc70418faf170 fffff8036f403a81 : 0000000000000000 ffffb58d1a83daa0 0000000000000000 ffffb58d37bb8030 : ndis!ndisInvokeNextReceiveHandler+0x4b
ffffc70418faf240 fffff8036f3c804e : ffffb58d1a83daa0 ffffb58d1a83daa0 fffff80300000000 0000000000000001 : ndis!ndisFilterIndicateReceiveNetBufferLists+0x3c611
ffffc70418faf2f0 fffff8036f94131c : ffffb58d1a841010 0000000000000001 0000000000000000 0000000000000001 : ndis!NdisFIndicateReceiveNetBufferLists+0x6e
ffffc70418faf330 fffff8036f3c7ef1 : ffffb58d00000001 ffffb58d37bb8030 0000000000000000 0000000000000001 : wfplwfs!LwfLowerRecvNetBufferLists+0x17c
ffffc70418faf3f0 fffff8036f3d837e : ffffb58d36f0f080 ffffc70418faf5c1 ffffc70418faf5a0 0000000000000000 : ndis!ndisCallReceiveHandler+0x61
ffffc70418faf440 fffff8036a827328 : ffffc70418faf5c1 ffffb58d1a83daa0 ffffb58d00000000 0000000000000002 : ndis!ndisDataPathExpandStackCallback+0x3e
ffffc70418faf490 fffff8036a82729d : fffff8036f3d8340 ffffc70418faf5a0 ffffb58d37bb8030 0000000000000000 : nt!KeExpandKernelStackAndCalloutInternal+0x78
ffffc70418faf500 fffff8036f3fe04c : ffffffffffffffff ffffb58d34609080 0000000000000230 00000000001f0003 : nt!KeExpandKernelStackAndCalloutEx+0x1d
ffffc70418faf540 fffff8036f3c4a94 : 000000000000a8ec 0000000000000000 ffffb58d00b7c1a0 0000000000000000 : ndis!ndisInvokeNextReceiveHandler+0x23c
ffffc70418faf610 fffff80383b138e9 : ffffb58d316f84a0 ffffb58d316f84a0 ffffb58d1b11c010 000000000000000e : ndis!NdisMIndicateReceiveNetBufferLists+0x104
ffffc70418faf6a0 ffffb58d316f84a0 : ffffb58d316f84a0 ffffb58d1b11c010 000000000000000e 0000000000000000 : tap_ovpnconnect+0x38e9
ffffc70418faf6a8 ffffb58d316f84a0 : ffffb58d1b11c010 000000000000000e 0000000000000000 00000000000000db : 0xffffb58d316f84a0 ffffc70418faf6b0 ffffb58d1b11c010 : 000000000000000e 0000000000000000 00000000000000db fffff8036f48a378 : 0xffffb58d316f84a0
ffffc70418faf6b8 000000000000000e : 0000000000000000 00000000000000db fffff8036f48a378 ffffb58d316f84b8 : 0xffffb58d1b11c010 ffffc70418faf6c0 0000000000000000 : 00000000000000db fffff8036f48a378 ffffb58d316f84b8 ffffb58d`371f8670 : 0xe

SYMBOL_NAME: ndis!ndisNblTrackerTransferOwnershipInternal+a1

MODULE_NAME: ndis

IMAGE_NAME: ndis.sys

IMAGE_VERSION: 10.0.19041.1526

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: a1

FAILURE_BUCKET_ID: AV_ndis!ndisNblTrackerTransferOwnershipInternal

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {5a474211-c9ae-b2b1-d319-6f39fd26310b}

Followup: MachineOwner
---------

Regards

Answer 1

Does it also crash when you uninstall OpenVPN?
tap_ovpnconnect.sys is a third party driver.

Answer 2

Hi @Roberto Fonte ,

It's hard to say the root case. I recommend you to install the latest network drivers.

Answer 3

@EckiS ,

It crash only when i try to connecto to the VPN

@T. Kujala

I already install the last driver :( ... Install and reinstall a lot of time even the OpenVpn and Tap network driver.

Thanks

Answer 4

@Roberto Fonte ,

Your computer's Windows version has outdated.

You could install the latest update and check if it helps. Hopefully, it solves the problem even if the os version is not the reason.

https://support.microsoft.com/en-us/windows/get-the-latest-windows-update-7d20e88c-0568-483a-37bc-c3885390d212

Answer 5

@T. Kujala

According Windows my computer is updated