- Apr 23, 2021
- 1
- 0
- 10
Hi, I was starting windows 10, when i got a BSOD. The Minidump file says the following:
icrosoft (R) Windows Debugger Version 10.0.21306.1007 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Usuario\Documents\042321-47750-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff802
Debug session time: Fri Apr 23 09:01:44.292 2021 (UTC - 5:00)
System Uptime: 7 days 9:48:23.418
Loading Kernel Symbols
...............................................................
................................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
..................................................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802
6: kd> !analyze -v
***
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: ffff98856aec74e0, Object type of the object whose reference count is being lowered
Arg2: ffff988579465080, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: 0000000000080000, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3546
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 18165
Key : Analysis.Init.CPU.mSec
Value: 453
Key : Analysis.Init.Elapsed.mSec
Value: 18757
Key : Analysis.Memory.CommitPeak.Mb
Value: 83
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 18
BUGCHECK_P1: ffff98856aec74e0
BUGCHECK_P2: ffff988579465080
BUGCHECK_P3: 1
BUGCHECK_P4: 80000
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
ffffba05
ffffba05
ffffba05
ffffba05
ffffba05
ffffba05
SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+1d1c42
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.928
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1d1c42
FAILURE_BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {fa6b3516-71cb-1e92-b987-b8bebd3458ac}
Followup: MachineOwner
---------
6: kd> !blackboxbsd
Stream size mismatch (expected = 192, read = 176)
6: kd> !analyze -v
***
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: ffff98856aec74e0, Object type of the object whose reference count is being lowered
Arg2: ffff988579465080, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: 0000000000080000, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2827
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 2854
Key : Analysis.Init.CPU.mSec
Value: 4014
Key : Analysis.Init.Elapsed.mSec
Value: 300918
Key : Analysis.Memory.CommitPeak.Mb
Value: 84
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 18
BUGCHECK_P1: ffff98856aec74e0
BUGCHECK_P2: ffff988579465080
BUGCHECK_P3: 1
BUGCHECK_P4: 80000
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
ffffba05
ffffba05
ffffba05
ffffba05
ffffba05
ffffba05
SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+1d1c42
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.928
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1d1c42
FAILURE_BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {fa6b3516-71cb-1e92-b987-b8bebd3458ac}
Followup: MachineOwner
---------
Please help me, I have no idea of what happened
icrosoft (R) Windows Debugger Version 10.0.21306.1007 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Usuario\Documents\042321-47750-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff802
2e800000 PsLoadedModuleList = 0xfffff8022f42a3d0Debug session time: Fri Apr 23 09:01:44.292 2021 (UTC - 5:00)
System Uptime: 7 days 9:48:23.418
Loading Kernel Symbols
...............................................................
................................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
..................................................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802
2ebf5e40 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffba05cc8e5b00=00000000000000186: kd> !analyze -v
***
- *
- Bugcheck Analysis *
- *
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: ffff98856aec74e0, Object type of the object whose reference count is being lowered
Arg2: ffff988579465080, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: 0000000000080000, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3546
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 18165
Key : Analysis.Init.CPU.mSec
Value: 453
Key : Analysis.Init.Elapsed.mSec
Value: 18757
Key : Analysis.Memory.CommitPeak.Mb
Value: 83
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 18
BUGCHECK_P1: ffff98856aec74e0
BUGCHECK_P2: ffff988579465080
BUGCHECK_P3: 1
BUGCHECK_P4: 80000
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
ffffba05
cc8e5af8 fffff8022ec32df2 : 0000000000000018 ffff98856aec74e0 ffff988579465080 0000000000000001 : nt!KeBugCheckExffffba05
cc8e5b00 fffff8022eb2a5f2 : 0000000000000000 0000000000000000 0000000000000000 ffff9885794654d8 : nt!ObfDereferenceObjectWithTag+0x1d1c42ffffba05
cc8e5b40 fffff8022ea25975 : ffff988579b3b5c0 ffff98856ae98ce0 ffff98856ae98ce0 ffff988500000000 : nt!PspReaper+0x72ffffba05
cc8e5b70 fffff8022eb17e85 : ffff988579b3b5c0 0000000000000080 ffff98856ae91040 0000000000000001 : nt!ExpWorkerThread+0x105ffffba05
cc8e5c10 fffff8022ebfd498 : ffffaa01b9936180 ffff988579b3b5c0 fffff8022eb17e30 0000000000000020 : nt!PspSystemThreadStartup+0x55ffffba05
cc8e5c60 0000000000000000 : ffffba05cc8e6000 ffffba05cc8e0000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x28SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+1d1c42
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.928
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1d1c42
FAILURE_BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {fa6b3516-71cb-1e92-b987-b8bebd3458ac}
Followup: MachineOwner
---------
6: kd> !blackboxbsd
Stream size mismatch (expected = 192, read = 176)
6: kd> !analyze -v
***
- *
- Bugcheck Analysis *
- *
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: ffff98856aec74e0, Object type of the object whose reference count is being lowered
Arg2: ffff988579465080, Object whose reference count is being lowered
Arg3: 0000000000000001, Reserved
Arg4: 0000000000080000, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2827
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 2854
Key : Analysis.Init.CPU.mSec
Value: 4014
Key : Analysis.Init.Elapsed.mSec
Value: 300918
Key : Analysis.Memory.CommitPeak.Mb
Value: 84
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 18
BUGCHECK_P1: ffff98856aec74e0
BUGCHECK_P2: ffff988579465080
BUGCHECK_P3: 1
BUGCHECK_P4: 80000
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
ffffba05
cc8e5af8 fffff8022ec32df2 : 0000000000000018 ffff98856aec74e0 ffff988579465080 0000000000000001 : nt!KeBugCheckExffffba05
cc8e5b00 fffff8022eb2a5f2 : 0000000000000000 0000000000000000 0000000000000000 ffff9885794654d8 : nt!ObfDereferenceObjectWithTag+0x1d1c42ffffba05
cc8e5b40 fffff8022ea25975 : ffff988579b3b5c0 ffff98856ae98ce0 ffff98856ae98ce0 ffff988500000000 : nt!PspReaper+0x72ffffba05
cc8e5b70 fffff8022eb17e85 : ffff988579b3b5c0 0000000000000080 ffff98856ae91040 0000000000000001 : nt!ExpWorkerThread+0x105ffffba05
cc8e5c10 fffff8022ebfd498 : ffffaa01b9936180 ffff988579b3b5c0 fffff8022eb17e30 0000000000000020 : nt!PspSystemThreadStartup+0x55ffffba05
cc8e5c60 0000000000000000 : ffffba05cc8e6000 ffffba05cc8e0000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x28SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+1d1c42
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.928
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1d1c42
FAILURE_BUCKET_ID: 0x18_CORRUPT_REF_COUNT_nt!ObfDereferenceObjectWithTag
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {fa6b3516-71cb-1e92-b987-b8bebd3458ac}
Followup: MachineOwner
---------
Please help me, I have no idea of what happened
Facebook
Twitter
Instagram