Kernel bugcheck 0x1E (AV_nt!HvpGetCellMap) recurs 3x on build 26100.9457 / 26200.9457, never on the two prior builds

Richard Sowell 5 Reputation points
2026-09-22T15:26:31.08+00:00

Recurring BSOD on Windows 11 25H2 build 26200.9457 / kernel 10.0.26100.9457. Bugcheck 0x1E (KMODE_EXCEPTION_NOT_HANDLED), parameter 1 = 0xC0000005 (access violation), PROCESS_NAME = Registry, MODULE_NAME = nt, FAILURE_BUCKET_ID = AV_nt!HvpGetCellMap. The faulting instruction is mov rax, qword ptr [rax+rdx*8] at nt!HvpGetCellMap+0x43 with rax = 0xFFFFFFFFFFFFFFFF — a wild cell-map pointer dereference in the registry hive layer. The surviving stack residues show the crash occurs while a hive is being LOADED/validated (NtLoadKeyEx -> CmLoadDifferencingKey -> CmLoadAppKey -> CmpInitHiveFromFile -> CmpCreateHive -> CmpCheckRegistry2 -> HvCheckHive -> CmpFileRead). Occurred 3 times at the identical instruction offset on kernel build 26100.9457, and ZERO times on the two preceding builds on the same machine. First occurrence ~29 hours after KB5129195 (2026-09 Security Update, installed 2026-09-14 22:34) moved the machine to 26100.9457. All local causes have been excluded (see below). Reporting because I could not find this exact signature publicly documented. --- ## ENVIRONMENT | Field | Value | |---|---| | OS | Windows 11 Home, version 25H2 | | Build | 26200.9457 (CurrentBuild 26200, UBR 9457) | | Kernel | nt 10.0.26100.9457 (ntkrnlmp.exe) | | Last cumulative | KB5129195, "2026-09 Security Update (KB5129195) (26200.9457)", installed 2026-09-14 22:34 | | Previous cumulatives | KB5124008 -> 26100.9445 (installed 2026-09-08); prior build 26100.9168 | | CPU | Intel Core i9-14900KF, microcode 0x151 | | Motherboard | MSI PRO Z790-P WIFI (MS-7E06), BIOS A.J0 | | GPU | NVIDIA GeForce RTX 5070 Ti 16 GB, driver 32.0.15.7688 | | RAM | 32 GB (2x16) DDR5, running 5200 MT/s JEDEC (XMP off after BIOS flash) | | System disk | Patriot P400L 2000 GB NVMe | | VBS / Credential Guard | VBS + HVCI (Memory Integrity) ON; Credential Guard DISABLED | | Sleep states | S3 + Hibernate (S0 Low Power Idle unsupported by firmware) | | Later recent BSODs on this machine | none since 2026-09-21 | --- ## CRASH SIGNATURE Bugcheck : 0x1E KMODE_EXCEPTION_NOT_HANDLED BugcheckParameter1 : 0xffffffffc0000005 (STATUS_ACCESS_VIOLATION) BugcheckParameter2 : 0xfffff8028c7c7753 (faulting instruction pointer) BugcheckParameter3 : 0x0 BugcheckParameter4 : 0xffffffffffffffff MODULE_NAME : nt IMAGE_NAME : ntkrnlmp.exe IMAGE_VERSION : 10.0.26100.9457 PROCESS_NAME : Registry FAILURE_BUCKET_ID : AV_nt!HvpGetCellMap SYMBOL_NAME : nt!HvpGetCellMap+43 Faulting instruction and registers: nt!HvpGetCellMap+0x43: mov rax, qword ptr [rax+rdx*8] rax = ffffffffffffffff <-- wild pointer (-1) rdx = ffffffffc0000005

Windows for home | Other | Windows update
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest
  1. DaveM121 936.3K Reputation points Independent Advisor
    2026-09-22T15:59:21.7933333+00:00

    Please upload any minidump files you have, I will check those to see if they provide any insight into a potential cause of the system crashes.

    Please do not upload a very large Memory.dmp file.

    Open Windows File Explorer.

    Navigate to C:\Windows\Minidump

    Copy any minidump files onto your Desktop, then zip those up.

    Upload the zip file to the Cloud (OneDrive... etc.), then choose to share those and get a share link.

    Then post the link here to the zip file, so I can take a look for you.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.