KERNEL_SECURITY_CHECK_FAILURE (139)绿屏重启

KERNEL_SECURITY_CHECK_FAILURE (139)绿屏重启，dmp文件分析如下：

KERNEL_SECURITY_CHECK_FAILURE (139)

A kernel component has corrupted a critical data structure. The corruption

could potentially allow a malicious user to gain control of this machine.

Arguments:

Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).

Arg2: ffffbc1282fb14d0, Address of the trap frame for the exception that caused the BugCheck

Arg3: ffffbc1282fb1428, Address of the exception record for the exception that caused the BugCheck

Arg4: 0000000000000000, Reserved

Debugging Details:

---

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec

Value: 1531

Key  : Analysis.Elapsed.mSec

Value: 1540

Key  : Analysis.IO.Other.Mb

Value: 0

Key  : Analysis.IO.Read.Mb

Value: 1

Key  : Analysis.IO.Write.Mb

Value: 0

Key  : Analysis.Init.CPU.mSec

Value: 531

Key  : Analysis.Init.Elapsed.mSec

Value: 19965

Key  : Analysis.Memory.CommitPeak.Mb

Value: 85

Key  : Analysis.Version.DbgEng

Value: 10.0.29617.1000

Key  : Analysis.Version.Description

Value: 10.2604.29.1 amd64fre

Key  : Analysis.Version.Ext

Value: 1.2604.29.1

Key  : Bugcheck.Code.LegacyAPI

Value: 0x139

Key  : Bugcheck.Code.TargetModel

Value: 0x139

Key  : FailFast.Name

Value: CORRUPT_LIST_ENTRY

Key  : FailFast.Type

Value: 3

Key  : Failure.Bucket

Value: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiTimerWaitTest

Key  : Failure.Exception.Code

Value: 0xc0000409

Key  : Failure.Exception.Record

Value: 0xffffbc1282fb1428

Key  : Failure.Hash

Value: {efb56395-a173-53f8-073d-d3c8cfd50e2b}

Key  : WER.OS.Branch

Value: rs_prerelease

Key  : WER.OS.Version

Value: 10.0.29648.1000

Key  : WER.System.BIOSRevision

Value: 5.17.0.0

BUGCHECK_CODE: 139

BUGCHECK_P1: 3

BUGCHECK_P2: ffffbc1282fb14d0

BUGCHECK_P3: ffffbc1282fb1428

BUGCHECK_P4: 0

FILE_IN_CAB: 081826-18906-01.dmp

FAULTING_THREAD: ffff816c74a0a280

TRAP_FRAME: ffffbc1282fb14d0 -- (.trap 0xffffbc1282fb14d0)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=ffff816c8a3e5158 rbx=0000000000000000 rcx=0000000000000003

rdx=0000000000000102 rsi=0000000000000000 rdi=0000000000000000

rip=fffff800eb8b93cf rsp=ffffbc1282fb1660 rbp=ffff8c11782b4180

r8=ffffbc1282fb1a28 r9=0000000000000033 r10=0000002e61792093

r11=0000000000000036 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei pl nz ac po cy

nt!KiRemovePrcbWaitEntry+0xbf:

fffff800`eb8b93cf cd29 int 29h

Resetting default scope

EXCEPTION_RECORD: ffffbc1282fb1428 -- (.exr 0xffffbc1282fb1428)

ExceptionAddress: fffff800eb8b93cf (nt!KiRemovePrcbWaitEntry+0x00000000000000bf)

ExceptionCode: c0000409 (Security check failure or stack buffer overrun)

ExceptionFlags: 00000001

NumberParameters: 1

Parameter[0]: 0000000000000003

Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1 (!blackboxwinlogon) (!blackboxwinlogonnotify)

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000003

EXCEPTION_STR: 0xc0000409

STACK_TEXT:

ffffbc1282fb11a8 fffff800ebd541bf : 0000000000000139 0000000000000003 ffffbc1282fb14d0 ffffbc1282fb1428 : nt!KeBugCheckEx

ffffbc1282fb11b0 fffff800ebd548c8 : 0000000000000000 0000000000000000 0000000000000000 0000000100000000 : nt!KiBugCheckDispatch+0x7f

ffffbc1282fb12f0 fffff800ebd5213f : ffffbc1282fb15e0 fffff800eba55378 0000000000000000 0000000000000001 : nt!KiFastFailDispatch+0xc8

ffffbc1282fb14d0 fffff800eb8b93cf : 0000000000000000 0000002e6176d690 fffff800eba802a0 fffff800eba55ca8 : nt!KiRaiseSecurityCheckFailureDispatchTrap+0x95

ffffbc1282fb1660 fffff800eb8c6327 : 0000000000000000 ffff816c8a3e5080 ffff816c8a3e5188 fffff800ebc5788f : nt!KiRemovePrcbWaitEntry+0xbf

ffffbc1282fb1690 fffff800eba8b035 : ffff816c8a3e5180 00000000000000ff ffffbc1282fb1a28 0000000000000102 : nt!KiTimerWaitTest+0x10f

ffffbc1282fb1720 fffff800eba8ac1e : 0000000000000000 0000000000000000 0000000000000000 0000000000000ec0 : nt!KiProcessExpiredTimerList+0xf5

ffffbc1282fb1850 fffff800eba8a9e6 : ffff8c11782b4180 fffff80079b09740 0000002e00000033 ffff816c0000001a : nt!KiExpireTimerTable+0x18e

ffffbc1282fb1920 fffff800eb90d771 : 0000002e61792093 0000000000000000 ffff816c74a0a280 ffff8c11782b4180 : nt!KiTimerExpiration+0x192

ffffbc1282fb19e0 fffff800ebd3f2de : 0000000000000000 ffff816c74a0a200 fffff800ebd3f200 0000000000000000 : nt!KiRetireDpcList+0x271

ffffbc1282fb1c10 0000000000000000 : ffffbc1282fb2000 ffffbc1282fac000 0000000000000000 0000000000000000 : nt!KiIdleLoop+0x9e

SYMBOL_NAME: nt!KiTimerWaitTest+10f

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.29648.1000

STACK_COMMAND: .process /r /p 0xfffff800ec5cef40; .thread /r /p 0xffff816c74a0a280 ; kb

BUCKET_ID_FUNC_OFFSET: 10f

FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiTimerWaitTest

OS_VERSION: 10.0.29648.1000

BUILDLAB_STR: rs_prerelease

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {efb56395-a173-53f8-073d-d3c8cfd50e2b}

Followup: MachineOwner

---