The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff802f123096f, 0x0000000000000000, 0xffffffffffffffff). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: bb63dd9b-5c72-4f67-a42a-55ec46ac2640.

2018-09-10

Question

_{Monday, September 10, 2018 7:05 PM}

Hi everyone,

Recently got a bsod, could you please advise? Checked drive for errors using windows checker -- got no errors.

Loading Dump File [D:\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 17134 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 17134.1.amd64fre.rs4_release.180410-1804
Machine Name:
Kernel base = 0xfffff802`f121e000 PsLoadedModuleList = 0xfffff802`f15cc170
Debug session time: Mon Sep 10 18:27:55.091 2018 (UTC + 3:00)
System Uptime: 20 days 21:44:54.314
Loading Kernel Symbols
...............................................................
..Page 6e0 not present in the dump file. Type ".hh dbgerr004" for details
..............................................................
................................................................
.
Loading User Symbols
PEB is paged out (Peb.Ldr = 0000005d`27af0018). Type ".hh dbgerr001" for details
Loading unloaded module list
.......................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff802f123096f, 0, ffffffffffffffff}

Probably caused by : ntkrnlmp.exe ( nt!SepAccessCheck+16f )

Followup: MachineOwner

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff802f123096f, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:

KEY_VALUES_STRING: 1

TIMELINE_ANALYSIS: 1

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 17134.1.amd64fre.rs4_release.180410-1804

SYSTEM_MANUFACTURER: Dell Inc.

SYSTEM_PRODUCT_NAME: Latitude E6410

SYSTEM_VERSION: 0001

BIOS_VENDOR: Dell Inc.

BIOS_VERSION: A17

BIOS_DATE: 05/12/2017

BASEBOARD_MANUFACTURER: Dell Inc.

BASEBOARD_PRODUCT: 0K2MDD

BASEBOARD_VERSION: A00

DUMP_TYPE: 1

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff802f123096f

BUGCHECK_P3: 0

BUGCHECK_P4: ffffffffffffffff

READ_ADDRESS: ffffffffffffffff

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

FAULTING_IP:
nt!SepAccessCheck+16f
fffff802`f123096f 6641396f04 cmp word ptr [r15+4],bp

EXCEPTION_PARAMETER2: ffffffffffffffff

BUGCHECK_STR: 0x1E_c0000005_R

CPU_COUNT: 4

CPU_MHZ: 9df

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 25

CPU_STEPPING: 2

CPU_MICROCODE: 6,25,2,0 (F,M,S,R) SIG: E'00000000 (cache) E'00000000 (init)

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXPNP: 1 (!blackboxpnp)

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: OfficeClickToRun.exe

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: DESKTOP-0I4H8I7

ANALYSIS_SESSION_TIME: 09-10-2018 21:49:07.0499

ANALYSIS_VERSION: 10.0.17134.12 x86fre

LAST_CONTROL_TRANSFER: from fffff802f12ec5dd to fffff802f13c6ca0

STACK_TEXT:
fffff00e`72b39638 fffff802`f12ec5dd : 00000000`0000001e ffffffff`c0000005 fffff802`f123096f 00000000`00000000 : nt!KeBugCheckEx
fffff00e`72b39640 fffff802`f13d7942 : 00000000`00000000 fffff802`f12358c8 00000000`00000000 ffffa78b`e3170480 : nt!KiDispatchException+0x58d
fffff00e`72b39cf0 fffff802`f13d409c : 00000000`000037ea 00000000`00000000 00000000`00000000 fffff00e`72b3a0dc : nt!KiExceptionDispatch+0xc2
fffff00e`72b39ed0 fffff802`f123096f : 1a000000`cc3ce863 00000000`00000000 00000000`00000000 fffff26e`44e86f88 : nt!KiGeneralProtectionFault+0x2dc
fffff00e`72b3a060 fffff802`f122f9e7 : ffffca0c`7a025060 00000000`00000080 00000000`00720065 fffff279`37228568 : nt!SepAccessCheck+0x16f
fffff00e`72b3a1d0 fffff802`f130256d : ffffa78b`e98ec520 00000800`aad9a8c0 ffffa78b`e98ec520 ffffa78b`ea45e101 : nt!SeAccessCheckWithHintWithAdminlessChecks+0x3f7
fffff00e`72b3a380 fffff806`896937c4 : ffffca0c`71ba8010 ffffca0c`71ba8010 ffffdc89`00000000 ffffca0c`7b62e12c : nt!SeAccessCheckWithHint+0xed
fffff00e`72b3a480 fffff806`8969512c : ffffa78b`e120abd0 ffffa78b`e98ec500 ffffca0c`71ba8010 00000000`00000000 : Ntfs!TxfAccessCheck+0x124
fffff00e`72b3a5f0 fffff806`89694b67 : ffffca0c`71ba8010 ffffa78b`e609c328 ffffa78b`e120abd0 fffff806`897c2c70 : Ntfs!NtfsAccessCheck+0x23c
fffff00e`72b3a810 fffff806`8969487a : 00000000`00000000 00000000`00000000 ffffa78b`e120abd0 ffffa78b`e120ab00 : Ntfs!NtfsCheckExistingFile+0xc7
fffff00e`72b3a8b0 fffff806`896944de : 00000000`00000080 00000000`00000000 ffffa78b`e609c328 ffffca0c`0000006e : Ntfs!NtfsOpenExistingAttr+0xda
fffff00e`72b3a970 fffff806`896928e1 : fffff00e`73ca7190 ffffa78b`e120abd0 ffffca0c`71ba8448 ffffa78b`0000006e : Ntfs!NtfsOpenAttributeInExistingFile+0xa7e
fffff00e`72b3ab50 fffff806`896a4175 : ffffa78b`e609c328 ffffa78b`e120abd0 ffffca0c`71ba8448 ffffa78b`00000010 : Ntfs!NtfsOpenExistingPrefixFcb+0x1e1
fffff00e`72b3ac30 fffff806`896a08ee : ffffa78b`e609c328 ffffa78b`e120abd0 ffffa78b`e04469e8 fffff00e`72b3ae70 : Ntfs!NtfsFindStartingNode+0xd85
fffff00e`72b3acf0 fffff806`8969e26d : ffffa78b`e609c328 ffffa78b`e120abd0 fffff00e`73ca7190 ffffa78b`e9915301 : Ntfs!NtfsCommonCreate+0xe7e
fffff00e`72b3af50 fffff802`f13ca197 : fffff00e`73ca7140 00000000`00e5e288 00000000`00ca1000 00000000`00f5dcbc : Ntfs!NtfsCommonCreateCallout+0x1d
fffff00e`72b3af80 fffff802`f13ca15d : 00000000`00006000 ffffa78b`e9915300 00000000`00000004 fffff802`f12eb1fa : nt!KxSwitchKernelStackCallout+0x27
fffff00e`73ca6f10 fffff802`f12eb1fa : 00000000`00000012 00000000`00000012 00000001`01000100 fffff800`87890100 : nt!KiSwitchKernelStackContinue
fffff00e`73ca6f30 fffff802`f12eb03e : fffff806`8969e250 00000000`00006000 00000000`00000000 ffffca0c`75189230 : nt!KiExpandKernelStackAndCalloutOnStackSegment+0x12a
fffff00e`73ca6fb0 fffff802`f12eaef5 : 00000000`00000008 fffff00e`73ca7140 ffffa78b`e30d8010 ffffa78b`e7773c58 : nt!KiExpandKernelStackAndCalloutSwitchStack+0x9e
fffff00e`73ca7020 fffff802`f12eaead : fffff806`8969e250 fffff00e`73ca7140 ffffa78b`e609c328 ffffa78b`e120abd0 : nt!KeExpandKernelStackAndCalloutInternal+0x35
fffff00e`73ca7080 fffff806`8969e46d : ffffa78b`e609c328 fffff00e`73ca7190 ffffa78b`e609c328 ffffa78b`e120abd0 : nt!KeExpandKernelStackAndCalloutEx+0x1d
fffff00e`73ca70c0 fffff802`f1237199 : ffffa78b`e0446030 ffffa78b`e120abd0 ffffa78b`e554ec00 00000000`00000000 : Ntfs!NtfsFsdCreate+0x1bd
fffff00e`73ca7300 fffff806`87867207 : ffffa78b`e120abd0 ffffa78b`e554ec70 ffffa78b`e120af70 ffffa78b`e1975d70 : nt!IofCallDriver+0x59
fffff00e`73ca7340 fffff806`8789bbcd : fffff00e`73ca73f0 ffffa78b`e120af70 ffffa78b`e46fe960 fffff802`f16fbba7 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x157
fffff00e`73ca73b0 fffff802`f1237199 : fffff00e`73ca7900 00000000`000000c5 ffffa78b`e120af70 ffffa78b`e120abd0 : FLTMGR!FltpCreate+0x2dd
fffff00e`73ca7460 fffff802`f16fa5d3 : 00000000`000000c5 fffff00e`73ca7770 ffffa78b`e554ec70 fffff00e`00000001 : nt!IofCallDriver+0x59
fffff00e`73ca74a0 fffff802`f16e2d9b : fffff802`f16f9e60 fffff802`f16f9e60 fffff00e`00000000 ffffa78b`e1943ac0 : nt!IopParseDevice+0x773
fffff00e`73ca7670 fffff802`f16f870f : ffffa78b`e98ec500 fffff00e`73ca78e8 ffffa78b`00000040 ffffa78b`e056cc60 : nt!ObpLookupObjectName+0x73b
fffff00e`73ca7850 fffff802`f16baffa : 00000000`00000001 00000000`00000028 00000000`00000001 00000000`00000000 : nt!ObOpenObjectByNameEx+0x1df
fffff00e`73ca7990 fffff802`f13d7343 : 000001e0`72f19480 ffffa78b`e04de200 ffffa78b`e9915300 00000000`00000000 : nt!NtQueryAttributesFile+0x19a
fffff00e`73ca7c40 00007ffd`4725a654 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
0000005d`289fca78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`4725a654

THREAD_SHA1_HASH_MOD_FUNC: 280002db7fc5f65792503cdff29ce9c724129cbd

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 35dccb27888be26653c18b7e0ee03624ad7e4831

THREAD_SHA1_HASH_MOD: b45d2b5da50596c463c648ea1ec815f82bd120f8

FOLLOWUP_IP:
nt!SepAccessCheck+16f
fffff802`f123096f 6641396f04 cmp word ptr [r15+4],bp

FAULT_INSTR_CODE: 6f394166

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: nt!SepAccessCheck+16f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 5b63c7b5

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 16f

FAILURE_BUCKET_ID: 0x1E_c0000005_R_nt!SepAccessCheck

BUCKET_ID: 0x1E_c0000005_R_nt!SepAccessCheck

PRIMARY_PROBLEM_CLASS: 0x1E_c0000005_R_nt!SepAccessCheck

TARGET_TIME: 2018-09-10T15:27:55.000Z

OSBUILD: 17134

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2018-08-03 06:10:45

BUILDDATESTAMP_STR: 180410-1804

BUILDLAB_STR: rs4_release

BUILDOSVER_STR: 10.0.17134.1.amd64fre.rs4_release.180410-1804

ANALYSIS_SESSION_ELAPSED_TIME: 2653

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x1e_c0000005_r_nt!sepaccesscheck

FAILURE_ID_HASH: {9cb96747-fd78-dbde-2265-97b945cbc113}

Followup: MachineOwner

All replies (1)

_{Tuesday, September 11, 2018 2:54 PM}

Hi,
This BugCheck was related to memory corruption (probably caused by a driver).
I would like you to see if the problem occurs in Safe Mode.
Also, you can run the following two tests:
1、Check RAM.
How to diagnose memory problems on Windows 10
https://www.windowscentral.com/how-check-your-pc-memory-problems-windows-10
Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
2、Check driver issue using Driver Verifier.
/en-us/windows-hardware/drivers/devtest/driver-verifier#how-to-start-driver-verifier

Hope it could be helpful.

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

Share via

The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff802f123096f, 0x0000000000000000, 0xffffffffffffffff). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: bb63dd9b-5c72-4f67-a42a-55ec46ac2640.

Question

All replies (1)

Additional resources