kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the BugCheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffb779a9809ffc, Virtual address for the attempted write.
Arg2: 8a00000000200121, PTE contents.
Arg3: ffffde85d5acf140, (reserved)
Arg4: 000000000000000b, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 1031
Key : Analysis.Elapsed.mSec
Value: 2652
Key : Analysis.IO.Other.Mb
Value: 5
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 36
Key : Analysis.Init.CPU.mSec
Value: 593
Key : Analysis.Init.Elapsed.mSec
Value: 25231
Key : Analysis.Memory.CommitPeak.Mb
Value: 158
Key : Analysis.Version.DbgEng
Value: 10.0.27725.1000
Key : Analysis.Version.Description
Value: 10.2408.27.01 amd64fre
Key : Analysis.Version.Ext
Value: 1.2408.27.1
Key : Bugcheck.Code.LegacyAPI
Value: 0xbe
Key : Bugcheck.Code.TargetModel
Value: 0xbe
Key : Dump.Attributes.AsUlong
Value: 8
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Failure.Bucket
Value: AV_nt!MiSystemFault
Key : Failure.Hash
Value: {d80c40a2-5000-439f-696b-1bd8abb14be3}
BUGCHECK_CODE: be
BUGCHECK_P1: ffffb779a9809ffc
BUGCHECK_P2: 8a00000000200121
BUGCHECK_P3: ffffde85d5acf140
BUGCHECK_P4: b
FILE_IN_CAB: 021225-9718-01.dmp
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
FAULTING_THREAD: ffff96050fcbb040
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: services.exe
TRAP_FRAME: ffffde85d5acf140 -- (.trap 0xffffde85d5acf140)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffb779a9809ffc rbx=0000000000000000 rcx=ffffb779a980a024
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8026b414bf0 rsp=ffffde85d5acf2d8 rbp=ffffde85d5acf470
r8=000000000000002a r9=0000000000000008 r10=ffffb779a980a020
r11=0000000078050136 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe nc
nt!memset+0x30:
fffff802`6b414bf0 4a895408f8 mov qword ptr [rax+r9-8],rdx ds:ffffb779`a9809ffc=????????????????
Resetting default scope
STACK_TEXT:
ffffde85`d5acee98 fffff802`6b445f1b : 00000000`000000be ffffb779`a9809ffc 8a000000`00200121 ffffde85`d5acf140 : nt!KeBugCheckEx
ffffde85`d5aceea0 fffff802`6b238cd0 : ffffde85`d5acf000 00000000`00000003 ffffde85`d5acf1c0 00000000`00000000 : nt!MiSystemFault+0x1ce47b
ffffde85`d5acefa0 fffff802`6b40ea6d : ffffffff`ffffffff 00000000`00000001 ffffa781`10dc4180 fffff802`6b2a3245 : nt!MmAccessFault+0x400
ffffde85`d5acf140 fffff802`6b414bf0 : fffff802`6b2bbc18 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x36d
ffffde85`d5acf2d8 fffff802`6b2bbc18 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!memset+0x30
ffffde85`d5acf2e0 fffff802`6b8d4a27 : 00000000`00000157 00000000`78050137 00000000`7804ffe0 00000000`00000000 : nt!RtlClearBitsEx+0x98
ffffde85`d5acf310 fffff802`6b8d49ac : ffff9605`16225010 00000000`00000001 00000000`00000000 00000000`0000156a : nt!MiMarkRetpolineBits+0x63
ffffde85`d5acf340 fffff802`6b82fe86 : ffff9605`16225010 ffff9605`16225010 ffffde85`d5acf470 00000000`00000001 : nt!MiMarkKernelImageRetpolineBits+0x34
ffffde85`d5acf370 fffff802`6b7755b1 : 00000000`00000000 fffff802`ffffffff ffff509e`00000001 ffffce87`ade672c0 : nt!MiUnloadSystemImage+0x134e9e
ffffde85`d5acf510 fffff802`6b7754de : ffff9605`08c5be00 ffffde85`d5acf840 00000000`00000000 ffffde85`d5acf9b0 : nt!MmUnloadSystemImage+0x41
ffffde85`d5acf540 fffff802`6b632c80 : ffff9605`08c5be00 ffffde85`d5acf840 ffff9605`08c5be00 fffff802`6b666ddf : nt!IopDeleteDriver+0x4e
ffffde85`d5acf590 fffff802`6b25a1a7 : 00000000`00000000 00000000`00000000 ffffde85`d5acf840 ffff9605`08c5be30 : nt!ObpRemoveObjectRoutine+0x80
ffffde85`d5acf5f0 fffff802`6b25a0ce : ffff9605`08c5be30 ffffde85`d5acf9b0 ffff9605`08c5be00 00000000`00060001 : nt!ObfDereferenceObjectWithTag+0xc7
ffffde85`d5acf630 fffff802`6b76d538 : ffff9605`08c5be30 ffffde85`d5acf840 ffffde85`d5acf9b0 00000000`c0000001 : nt!HalPutDmaAdapter+0xe
ffffde85`d5acf660 fffff802`6b89ef0b : ffff9605`0fcbb040 00000000`00000000 00000000`00000001 ffff9605`08c5be30 : nt!IopUnloadDriver+0x250
ffffde85`d5acf790 fffff802`6b412908 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffce87`b07d2060 : nt!NtUnloadDriver+0xb
ffffde85`d5acf7c0 fffff802`6b4036e0 : fffff802`6b84848c ffff9605`0fcbb040 fffff802`6b61851d 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
ffffde85`d5acf958 fffff802`6b84848c : ffff9605`0fcbb040 fffff802`6b61851d 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
ffffde85`d5acf960 fffff802`6b89ef0b : ffff9605`0fcbb040 000000c3`63cfed44 00000000`00000000 00000000`00000000 : nt!IopUnloadDriver+0xdb1a4
ffffde85`d5acfa90 fffff802`6b412908 : 00000000`00004000 ffffde85`d5acfb40 ffffde85`d5acfb40 00000000`00000000 : nt!NtUnloadDriver+0xb
ffffde85`d5acfac0 00007ffe`3f130de4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000c3`63cfecf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`3f130de4
SYMBOL_NAME: nt!MiSystemFault+1ce47b
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.5369
STACK_COMMAND: .process /r /p 0xffff96050ebab200; .thread 0xffff96050fcbb040 ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 1ce47b
FAILURE_BUCKET_ID: AV_nt!MiSystemFault
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {d80c40a2-5000-439f-696b-1bd8abb14be3}
Followup: MachineOwner
---------
