R
Raedarius
Guest
Hello,
I have been having trouble with BSODs on several different devices with several different versions of Win 10. Some are running CBB OS versions and recently we have been transitioning to LTSB and now LTSC versions. We keep getting 109(debug check 1f) debug codes referencing the Csrss.exe program. Minidump below. Any help or ideas would be appreciated.
*****************************************************************************************************
Microsoft (R) Windows Debugger Version 10.0.14321.1024 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 14393 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 14393.2848.amd64fre.rs1_release.190305-1856
Machine Name:
Kernel base = 0xfffff802`b2a0e000 PsLoadedModuleList = 0xfffff802`b2d10180
Debug session time: Mon Mar 25 08:16:59.286 2019 (UTC - 5:00)
System Uptime: 3 days 17:04:04.899
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 109, {a3a002676215c713, b3b70eedb496d1ce, ffffc30ec8590380, 1f}
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a002676215c713, Reserved
Arg2: b3b70eedb496d1ce, Reserved
Arg3: ffffc30ec8590380, Failure type dependent information
Arg4: 000000000000001f, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification
8 : Object type
9 : A processor IVT
a : Modification of a system service function
b : A generic session data region
c : Modification of a session function or .pdata
d : Modification of an import table
e : Modification of a session import table
f : Ps Win32 callout modification
10 : Debug switch routine modification
11 : IRP allocator modification
12 : Driver call dispatcher modification
13 : IRP completion dispatcher modification
14 : IRP deallocator modification
15 : A processor control register
16 : Critical floating point control register modification
17 : Local APIC modification
18 : Kernel notification callout modification
19 : Loaded module list modification
1a : Type 3 process list corruption
1b : Type 4 process list corruption
1c : Driver object corruption
1d : Executive callback object modification
1e : Modification of module padding
1f : Modification of a protected process
20 : A generic data region
21 : A page hash mismatch
22 : A session page hash mismatch
23 : Load config directory modification
24 : Inverted function table modification
25 : Session configuration modification
26 : An extended processor control register
27 : Type 1 pool corruption
28 : Type 2 pool corruption
29 : Type 3 pool corruption
101 : General pool corruption
102 : Modification of win32k.sys
Debugging Details:
------------------
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 10.0.14393.2848 (rs1_release.190305-1856)
SYSTEM_MANUFACTURER: Microsoft Corporation
SYSTEM_PRODUCT_NAME: Surface Pro 4
SYSTEM_SKU: Surface_Pro_4
SYSTEM_VERSION: D:0B:08F:1C:03P:38
BIOS_VENDOR: Microsoft Corporation
BIOS_VERSION: 108.1866.769
BIOS_DATE: 10/10/2017
BASEBOARD_MANUFACTURER: Microsoft Corporation
BASEBOARD_PRODUCT: Surface Pro 4
DUMP_TYPE: 2
BUGCHECK_P1: a3a002676215c713
BUGCHECK_P2: b3b70eedb496d1ce
BUGCHECK_P3: ffffc30ec8590380
BUGCHECK_P4: 1f
CPU_COUNT: 4
CPU_MHZ: 9c0
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 4e
CPU_STEPPING: 3
CPU_MICROCODE: 6,4e,3,0 (F,M,S,R) SIG: 9E'00000000 (cache) 9E'00000000 (init)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: BAD_STACK_0x109
BUGCHECK_STR: 0x109
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: RYDER-PC
ANALYSIS_SESSION_TIME: 03-27-2019 12:04:22.0007
ANALYSIS_VERSION: 10.0.14321.1024 amd64fre
STACK_TEXT:
ffff9b80`b7871fb8 00000000`00000000 : 00000000`00000109 a3a00267`6215c713 b3b70eed`b496d1ce ffffc30e`c8590380 : nt!KeBugCheckEx
STACK_COMMAND: kb
THREAD_SHA1_HASH_MOD_FUNC: 81a83ae0317433a47fcc36991983df3b6e638b71
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 6e16edd8c7dd677734fdbcd2397a2e35e9fae964
THREAD_SHA1_HASH_MOD: 76cd06466d098060a9eb26e5fd2a25cb1f3fe0a3
SYMBOL_NAME: ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
BUCKET_ID: BAD_STACK_0x109
PRIMARY_PROBLEM_CLASS: BAD_STACK
FAILURE_BUCKET_ID: BAD_STACK_0x109
TARGET_TIME: 2019-03-25T13:16:59.000Z
OSBUILD: 14393
OSSERVICEPACK: 2848
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2019-03-06 00:04:59
BUILDDATESTAMP_STR: 190305-1856
BUILDLAB_STR: rs1_release
BUILDOSVER_STR: 10.0.14393.2848
ANALYSIS_SESSION_ELAPSED_TIME: 897
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:bad_stack_0x109
FAILURE_ID_HASH: {b4d7023a-05c3-49b2-3ea4-6240fe57d90e}
Followup: MachineOwner
---------
More...
I have been having trouble with BSODs on several different devices with several different versions of Win 10. Some are running CBB OS versions and recently we have been transitioning to LTSB and now LTSC versions. We keep getting 109(debug check 1f) debug codes referencing the Csrss.exe program. Minidump below. Any help or ideas would be appreciated.
*****************************************************************************************************
Microsoft (R) Windows Debugger Version 10.0.14321.1024 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 14393 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 14393.2848.amd64fre.rs1_release.190305-1856
Machine Name:
Kernel base = 0xfffff802`b2a0e000 PsLoadedModuleList = 0xfffff802`b2d10180
Debug session time: Mon Mar 25 08:16:59.286 2019 (UTC - 5:00)
System Uptime: 3 days 17:04:04.899
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 109, {a3a002676215c713, b3b70eedb496d1ce, ffffc30ec8590380, 1f}
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a002676215c713, Reserved
Arg2: b3b70eedb496d1ce, Reserved
Arg3: ffffc30ec8590380, Failure type dependent information
Arg4: 000000000000001f, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification
8 : Object type
9 : A processor IVT
a : Modification of a system service function
b : A generic session data region
c : Modification of a session function or .pdata
d : Modification of an import table
e : Modification of a session import table
f : Ps Win32 callout modification
10 : Debug switch routine modification
11 : IRP allocator modification
12 : Driver call dispatcher modification
13 : IRP completion dispatcher modification
14 : IRP deallocator modification
15 : A processor control register
16 : Critical floating point control register modification
17 : Local APIC modification
18 : Kernel notification callout modification
19 : Loaded module list modification
1a : Type 3 process list corruption
1b : Type 4 process list corruption
1c : Driver object corruption
1d : Executive callback object modification
1e : Modification of module padding
1f : Modification of a protected process
20 : A generic data region
21 : A page hash mismatch
22 : A session page hash mismatch
23 : Load config directory modification
24 : Inverted function table modification
25 : Session configuration modification
26 : An extended processor control register
27 : Type 1 pool corruption
28 : Type 2 pool corruption
29 : Type 3 pool corruption
101 : General pool corruption
102 : Modification of win32k.sys
Debugging Details:
------------------
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 10.0.14393.2848 (rs1_release.190305-1856)
SYSTEM_MANUFACTURER: Microsoft Corporation
SYSTEM_PRODUCT_NAME: Surface Pro 4
SYSTEM_SKU: Surface_Pro_4
SYSTEM_VERSION: D:0B:08F:1C:03P:38
BIOS_VENDOR: Microsoft Corporation
BIOS_VERSION: 108.1866.769
BIOS_DATE: 10/10/2017
BASEBOARD_MANUFACTURER: Microsoft Corporation
BASEBOARD_PRODUCT: Surface Pro 4
DUMP_TYPE: 2
BUGCHECK_P1: a3a002676215c713
BUGCHECK_P2: b3b70eedb496d1ce
BUGCHECK_P3: ffffc30ec8590380
BUGCHECK_P4: 1f
CPU_COUNT: 4
CPU_MHZ: 9c0
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 4e
CPU_STEPPING: 3
CPU_MICROCODE: 6,4e,3,0 (F,M,S,R) SIG: 9E'00000000 (cache) 9E'00000000 (init)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: BAD_STACK_0x109
BUGCHECK_STR: 0x109
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: RYDER-PC
ANALYSIS_SESSION_TIME: 03-27-2019 12:04:22.0007
ANALYSIS_VERSION: 10.0.14321.1024 amd64fre
STACK_TEXT:
ffff9b80`b7871fb8 00000000`00000000 : 00000000`00000109 a3a00267`6215c713 b3b70eed`b496d1ce ffffc30e`c8590380 : nt!KeBugCheckEx
STACK_COMMAND: kb
THREAD_SHA1_HASH_MOD_FUNC: 81a83ae0317433a47fcc36991983df3b6e638b71
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 6e16edd8c7dd677734fdbcd2397a2e35e9fae964
THREAD_SHA1_HASH_MOD: 76cd06466d098060a9eb26e5fd2a25cb1f3fe0a3
SYMBOL_NAME: ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
BUCKET_ID: BAD_STACK_0x109
PRIMARY_PROBLEM_CLASS: BAD_STACK
FAILURE_BUCKET_ID: BAD_STACK_0x109
TARGET_TIME: 2019-03-25T13:16:59.000Z
OSBUILD: 14393
OSSERVICEPACK: 2848
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2019-03-06 00:04:59
BUILDDATESTAMP_STR: 190305-1856
BUILDLAB_STR: rs1_release
BUILDOSVER_STR: 10.0.14393.2848
ANALYSIS_SESSION_ELAPSED_TIME: 897
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:bad_stack_0x109
FAILURE_ID_HASH: {b4d7023a-05c3-49b2-3ea4-6240fe57d90e}
Followup: MachineOwner
---------
More...