0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000020, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8044ace9a1e, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4968
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on KAYSERI
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 75962
Key : Analysis.Memory.CommitPeak.Mb
Value: 82
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: a
BUGCHECK_P1: 20
BUGCHECK_P2: 2
BUGCHECK_P3: 1
BUGCHECK_P4: fffff8044ace9a1e
WRITE_ADDRESS: fffff8044b6fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8044b60f2e0: Unable to get Flags value from nt!KdVersionBlock
fffff8044b60f2e0: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
0000000000000020
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: fffff8044f26b6d0 -- (.trap 0xfffff8044f26b6d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000001b713f458dc rbx=0000000000000000 rcx=ffffd70fa2102000
rdx=000001b700000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8044ace9a1e rsp=fffff8044f26b860 rbp=fffff8044f26b960
r8=0000000000000000 r9=0000000000000000 r10=ffffd70faa411fa8
r11=fffff8044f26bb10 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
nt!KiExecuteAllDpcs+0x2ee:
fffff804`4ace9a1e 49894720 mov qword ptr [r15+20h],rax ds:00000000`00000020=????????????????
Resetting default scope
STACK_TEXT:
fffff804`4f26b588 fffff804`4ae05e69 : 00000000`0000000a 00000000`00000020 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff804`4f26b590 fffff804`4ae02169 : ffffb301`a4184970 ffffd70f`aa4976e8 ffffd70f`af0ba000 fffff804`55cdbd87 : nt!KiBugCheckDispatch+0x69
fffff804`4f26b6d0 fffff804`4ace9a1e : fffff804`46cd5240 ffffd70f`a22a8000 00000000`00000000 00000000`00000002 : nt!KiPageFault+0x469
fffff804`4f26b860 fffff804`4ace8d24 : 00000000`00000000 00000000`00000000 00000000`00140001 00000000`00000000 : nt!KiExecuteAllDpcs+0x2ee
fffff804`4f26b9d0 fffff804`4adf7a0e : 00000000`00000000 fffff804`46cd2180 fffff804`4b726600 ffffd70f`b0f6f080 : nt!KiRetireDpcList+0x1f4
fffff804`4f26bc60 00000000`00000000 : fffff804`4f26c000 fffff804`4f266000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e
SYMBOL_NAME: nt!KiExecuteAllDpcs+2ee
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.508
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 2ee
FAILURE_BUCKET_ID: AV_nt!KiExecuteAllDpcs
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {b88a28a0-fcde-99e9-6174-619833d00ab9}
Followup: MachineOwner
---------
0: kd> lmvm nt
Browse full module list
start end module name
fffff804`4aa00000 fffff804`4ba46000 nt (pdb symbols) C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\641F55C592201DCC4F59FACC72EA54DA1\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\ProgramData\Dbg\sym\ntoskrnl.exe\A371A2E91046000\ntoskrnl.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: A371A2E9 (This is a reproducible build file hash, not a timestamp)
CheckSum: 00A611D3
ImageSize: 01046000
File version: 10.0.19041.508
Product version: 10.0.19041.508
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 10.0.19041.508
FileVersion: 10.0.19041.508 (WinBuild.160101.0800)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.