Microsoft (R) Windows Debugger Version 10.0.25136.1001 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\083122-42078-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 22621 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 22621.1.amd64fre.ni_release.220506-1250
Machine Name:
Kernel base = 0xfffff807`64200000 PsLoadedModuleList = 0xfffff807`64e133f0
Debug session time: Wed Aug 31 21:44:35.225 2022 (UTC + 8:00)
System Uptime: 0 days 1:59:07.095
Loading Kernel Symbols
...............................................................
................................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff807`64621020 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffd782`16d87720=0000000000000018
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: ffffc785685690c0, Object type of the object whose reference count is being lowered
Arg2: ffffc7857c459940, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: 0000000000000001, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This BugCheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 406
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 13752
Key : Analysis.Init.CPU.mSec
Value: 249
Key : Analysis.Init.Elapsed.mSec
Value: 46064
Key : Analysis.Memory.CommitPeak.Mb
Value: 98
Key : Bugcheck.Code.DumpHeader
Value: 0x18
Key : Bugcheck.Code.Register
Value: 0x18
Key : WER.OS.Branch
Value: ni_release
Key : WER.OS.Timestamp
Value: 2022-05-06T12:50:00Z
Key : WER.OS.Version
Value: 10.0.22621.1
FILE_IN_CAB: 083122-42078-01.dmp
BUGCHECK_CODE: 18
BUGCHECK_P1: ffffc785685690c0
BUGCHECK_P2: ffffc7857c459940
BUGCHECK_P3: 1
BUGCHECK_P4: 1
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: svchost.exe
STACK_TEXT:
ffffd782`16d87718 fffff807`64685fb9 : 00000000`00000018 ffffc785`685690c0 ffffc785`7c459940 00000000`00000001 : nt!KeBugCheckEx
ffffd782`16d87720 fffff807`648b45a7 : ffffc785`7c459940 00000000`00000000 ffffc785`7c459940 00000000`00000000 : nt!ObfDereferenceObject+0x1f1019
ffffd782`16d87760 fffff807`648b4213 : ffffc785`7c459940 00000000`0012019f 00000000`00000000 00000000`00000000 : nt!IopWriteFile+0x237
ffffd782`16d87880 fffff807`64633965 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x263
ffffd782`16d87970 00007fff`7ba8ee74 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000fa`ef4fe798 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`7ba8ee74
SYMBOL_NAME: nt!IopWriteFile+237
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.22621.586
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 237
FAILURE_BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!IopWriteFile
OS_VERSION: 10.0.22621.1
BUILDLAB_STR: ni_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {b98b9672-78a3-6b85-fe80-0ffbe5993abb}
Followup: MachineOwner
---------
6: kd> lmvm nt
Browse full module list
start end module name
fffff807`64200000 fffff807`65247000 nt (pdb symbols) C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\884E972AF789B094E474B5D018EE39D91\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\ProgramData\Dbg\sym\ntkrnlmp.exe\A98752E11047000\ntkrnlmp.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: A98752E1 (This is a reproducible build file hash, not a timestamp)
CheckSum: 00B7DAEC
ImageSize: 01047000
File version: 10.0.22621.586
Product version: 10.0.22621.586
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 10.0.22621.586
FileVersion: 10.0.22621.586 (WinBuild.160101.0800)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.HiAdonisHaung,Yourminidumpfilesjustindicatememory(RAM)corruptionnospecificdriverislisted1GotothesupportpageforyourPCorMotherboardonthemanufacturerswebsite,thenfromthere,downloadandinstalltheversionofChipsetdriverstheyrecommendandwhilethere,checkforanyBIOSupdatethatmayneedtobeinstalled2IalsoseeyouhaveaWindowsInsiderversioninstalledonyourPC,itmaybethatversioniscausingthebluescreencrashes,InsiderBuildsdotendtobeunstable.___________________________________________________________________PowertotheDeveloper!MSIGV72-17.3",i7-8750H(HexCore),32GBDDR4,4GBGeForceGTX1050Ti,256GBNVMeM2,2TBHDD
HiAdonisHaungIamDave,Iwillhelpyouwiththis.PleasechecktoseeifyourPCisproducinganyminidumpfiles,Iwillcheckthosetoseeiftheyprovideanyinsightintoapotentialcauseofthesystemcrashes.PleaseNote,IcannotdownloadfromBaiduCloudDrive,pleaseuseadifferentCloudServicefortheupload.OpenWindowsFileExplorer.NavigatetoC:\Windows\MinidumpCopyanyminidumpfilesontoyourDesktop,thenzipthoseup.UploadthezipfiletotheCloud(OneDrive,DropBox.etc.),thenchoosetosharethoseandgetasharelink.Thenpostthelinkheretothezipfile,sowecantakealookforyou.
https://www.dropbox.com/s/ons7xdh9eqrdn4g/Minidump.zip?dl=0
HiAdonisHaung,Yourminidumpfilesjustindicatememory(RAM)corruptionnospecificdriverislisted1GotothesupportpageforyourPCorMotherboardonthemanufacturerswebsite,thenfromthere,downloadandinstalltheversionofChipsetdriverstheyrecommendandwhilethere,checkforanyBIOSupdatethatmayneedtobeinstalled2IalsoseeyouhaveaWindowsInsiderversioninstalledonyourPC,itmaybethatversioniscausingthebluescreencrashes,InsiderBuildsdotendtobeunstable.___________________________________________________________________PowertotheDeveloper!MSIGV72-17.3",i7-8750H(HexCore),32GBDDR4,4GBGeForceGTX1050Ti,256GBNVMeM2,2TBHDD