Microsoft (R) Windows Debugger Version 10.0.25136.1001 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\083122-42078-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 22621 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 22621.1.amd64fre.ni_release.220506-1250
Machine Name:
Kernel base = 0xfffff807`64200000 PsLoadedModuleList = 0xfffff807`64e133f0
Debug session time: Wed Aug 31 21:44:35.225 2022 (UTC + 8:00)
System Uptime: 0 days 1:59:07.095
Loading Kernel Symbols
...............................................................
................................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff807`64621020 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffd782`16d87720=0000000000000018
6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

REFERENCE_BY_POINTER (18)
Arguments:
Arg1: ffffc785685690c0, Object type of the object whose reference count is being lowered
Arg2: ffffc7857c459940, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: 0000000000000001, Reserved
    The reference count of an object is illegal for the current state of the object.
    Each time a driver uses a pointer to an object the driver calls a kernel routine
    to increment the reference count of the object. When the driver is done with the
    pointer the driver calls another kernel routine to decrement the reference count.
    Drivers must match calls to the increment and decrement routines. This BugCheck
    can occur because an object's reference count goes to zero while there are still
    open handles to the object, in which case the fourth parameter indicates the number
    of opened handles. It may also occur when the object's reference count drops below zero
    whether or not there are open handles to the object, and in that case the fourth parameter
    contains the actual value of the pointer references count.

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 406

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 13752

    Key  : Analysis.Init.CPU.mSec
    Value: 249

    Key  : Analysis.Init.Elapsed.mSec
    Value: 46064

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 98

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x18

    Key  : Bugcheck.Code.Register
    Value: 0x18

    Key  : WER.OS.Branch
    Value: ni_release

    Key  : WER.OS.Timestamp
    Value: 2022-05-06T12:50:00Z

    Key  : WER.OS.Version
    Value: 10.0.22621.1


FILE_IN_CAB:  083122-42078-01.dmp

BUGCHECK_CODE:  18

BUGCHECK_P1: ffffc785685690c0

BUGCHECK_P2: ffffc7857c459940

BUGCHECK_P3: 1

BUGCHECK_P4: 1

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  svchost.exe

STACK_TEXT: 
ffffd782`16d87718 fffff807`64685fb9     : 00000000`00000018 ffffc785`685690c0 ffffc785`7c459940 00000000`00000001 : nt!KeBugCheckEx
ffffd782`16d87720 fffff807`648b45a7     : ffffc785`7c459940 00000000`00000000 ffffc785`7c459940 00000000`00000000 : nt!ObfDereferenceObject+0x1f1019
ffffd782`16d87760 fffff807`648b4213     : ffffc785`7c459940 00000000`0012019f 00000000`00000000 00000000`00000000 : nt!IopWriteFile+0x237
ffffd782`16d87880 fffff807`64633965     : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x263
ffffd782`16d87970 00007fff`7ba8ee74     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000fa`ef4fe798 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`7ba8ee74


SYMBOL_NAME:  nt!IopWriteFile+237

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.22621.586

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  237

FAILURE_BUCKET_ID:  0x18_CORRUPT_REF_COUNT_nt!IopWriteFile

OS_VERSION:  10.0.22621.1

BUILDLAB_STR:  ni_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {b98b9672-78a3-6b85-fe80-0ffbe5993abb}

Followup:     MachineOwner
---------

6: kd> lmvm nt
Browse full module list
start             end                 module name
fffff807`64200000 fffff807`65247000   nt         (pdb symbols)          C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\884E972AF789B094E474B5D018EE39D91\ntkrnlmp.pdb
    Loaded symbol image file: ntkrnlmp.exe
    Mapped memory image file: C:\ProgramData\Dbg\sym\ntkrnlmp.exe\A98752E11047000\ntkrnlmp.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Browse all global symbols  functions  data
    Image was built with /Brepro flag.
    Timestamp:        A98752E1 (This is a reproducible build file hash, not a timestamp)
    CheckSum:         00B7DAEC
    ImageSize:        01047000
    File version:     10.0.22621.586
    Product version:  10.0.22621.586
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    Information from resource tables:
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     ntkrnlmp.exe
        OriginalFilename: ntkrnlmp.exe
        ProductVersion:   10.0.22621.586
        FileVersion:      10.0.22621.586 (WinBuild.160101.0800)
        FileDescription:  NT Kernel & System
        LegalCopyright:   © Microsoft Corporation. All rights reserved.HiAdonisHaung,Yourminidumpfilesjustindicatememory(RAM)corruptionnospecificdriverislisted1GotothesupportpageforyourPCorMotherboardonthemanufacturerswebsite,thenfromthere,downloadandinstalltheversionofChipsetdriverstheyrecommendandwhilethere,checkforanyBIOSupdatethatmayneedtobeinstalled2IalsoseeyouhaveaWindowsInsiderversioninstalledonyourPC,itmaybethatversioniscausingthebluescreencrashes,InsiderBuildsdotendtobeunstable.___________________________________________________________________PowertotheDeveloper!MSIGV72-17.3",i7-8750H(HexCore),32GBDDR4,4GBGeForceGTX1050Ti,256GBNVMeM2,2TBHDD
HiAdonisHaungIamDave,Iwillhelpyouwiththis.PleasechecktoseeifyourPCisproducinganyminidumpfiles,Iwillcheckthosetoseeiftheyprovideanyinsightintoapotentialcauseofthesystemcrashes.PleaseNote,IcannotdownloadfromBaiduCloudDrive,pleaseuseadifferentCloudServicefortheupload.OpenWindowsFileExplorer.NavigatetoC:\Windows\MinidumpCopyanyminidumpfilesontoyourDesktop,thenzipthoseup.UploadthezipfiletotheCloud(OneDrive,DropBox.etc.),thenchoosetosharethoseandgetasharelink.Thenpostthelinkheretothezipfile,sowecantakealookforyou.
https://www.dropbox.com/s/ons7xdh9eqrdn4g/Minidump.zip?dl=0
HiAdonisHaung,Yourminidumpfilesjustindicatememory(RAM)corruptionnospecificdriverislisted1GotothesupportpageforyourPCorMotherboardonthemanufacturerswebsite,thenfromthere,downloadandinstalltheversionofChipsetdriverstheyrecommendandwhilethere,checkforanyBIOSupdatethatmayneedtobeinstalled2IalsoseeyouhaveaWindowsInsiderversioninstalledonyourPC,itmaybethatversioniscausingthebluescreencrashes,InsiderBuildsdotendtobeunstable.___________________________________________________________________PowertotheDeveloper!MSIGV72-17.3",i7-8750H(HexCore),32GBDDR4,4GBGeForceGTX1050Ti,256GBNVMeM2,2TBHDD

点赞(57) 打赏

微信小程序

微信扫一扫体验

立即
投稿

微信公众账号

微信扫一扫加关注

发表
评论
返回
顶部