*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000007e1b, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80036c172b6, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 7515
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 12831
Key : Analysis.Init.CPU.mSec
Value: 890
Key : Analysis.Init.Elapsed.mSec
Value: 2750
Key : Analysis.Memory.CommitPeak.Mb
Value: 78
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: a
BUGCHECK_P1: 7e1b
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff80036c172b6
READ_ADDRESS: fffff800376fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000007e1b
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: MsMpEng.exe
TRAP_FRAME: ffffeb82e2de1f90 -- (.trap 0xffffeb82e2de1f90)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=0000000000000002
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80036c172b6 rsp=ffffeb82e2de2120 rbp=ffffeb82e2de2800
r8=80040000001ccc18 r9=ffffbc5e2f178000 r10=0000000000000000
r11=fffffb0000000028 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!MiUnlinkPageFromList+0x76:
fffff800`36c172b6 498bb4c778100000 mov rsi,qword ptr [r15+rax*8+1078h] ds:00000000`00001088=????????????????
Resetting default scope
STACK_TEXT:
ffffeb82`e2de1e48 fffff800`36e07d69 : 00000000`0000000a 00000000`00007e1b 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffeb82`e2de1e50 fffff800`36e04069 : 00000000`00000b83 ffffffff`00000000 00000000`00001001 00000000`00000fff : nt!KiBugCheckDispatch+0x69
ffffeb82`e2de1f90 fffff800`36c172b6 : 00000000`00000001 ffffeb82`e2de2450 ffffeb82`e2de2330 00000000`00000000 : nt!KiPageFault+0x469
ffffeb82`e2de2120 fffff800`36c89db9 : ffff9989`1c551200 00000000`00000000 00000000`0000005c ffff9989`1c551200 : nt!MiUnlinkPageFromList+0x76
ffffeb82`e2de21b0 fffff800`36c7c285 : 00000000`00000000 00000000`00000000 ffffeb82`e2de23f0 ffffeb82`e2de23d4 : nt!MmCheckCachedPageStates+0x1339
ffffeb82`e2de2380 fffff800`36c7b20a : ffffbd82`9162d260 00000000`1fd5c040 ffffeb82`e2de2578 00000000`0000709a : nt!CcMapAndCopyInToCache+0x605
ffffeb82`e2de2520 fffff800`3917ad0c : 00000000`00000000 ffffeb82`e2de2800 ffffbd82`90837cd8 00000000`00000000 : nt!CcCopyWriteEx+0xea
ffffeb82`e2de25a0 fffff800`39176993 : ffffbd82`90837cd8 ffffbd82`909d34e0 ffffeb82`e2de2840 00000000`00000000 : Ntfs!NtfsCommonWrite+0x3f0c
ffffeb82`e2de27d0 fffff800`36c52f55 : ffffbd82`92f854e0 ffffbd82`909d34e0 ffffbd82`909d34e0 ffffbd82`8d318c30 : Ntfs!NtfsFsdWrite+0x1d3
ffffeb82`e2de28a0 fffff800`33166ccf : ffffbd82`8d1b6520 ffffbd82`8d319520 ffffbd82`8d35c010 ffffbd82`92faea60 : nt!IofCallDriver+0x55
ffffeb82`e2de28e0 fffff800`331648d3 : ffffeb82`e2de2970 00000000`00000000 ffffeb82`e2de2a00 ffffeb82`e2de2900 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffffeb82`e2de2950 fffff800`36c52f55 : ffffbd82`909d34e0 ffffeb82`e2de2b20 ffffeb82`e2de2ae8 ffffbd82`92faea60 : FLTMGR!FltpDispatch+0xa3
ffffeb82`e2de29b0 fffff800`36ffd928 : 00000000`00000001 ffffbd82`92faea60 00000000`00000001 ffffbd82`909d3910 : nt!IofCallDriver+0x55
ffffeb82`e2de29f0 fffff800`36fe45ff : ffffbd82`00000000 ffffeb82`e2de2c80 00000000`00000000 ffffeb82`e2de2c80 : nt!IopSynchronousServiceTail+0x1a8
ffffeb82`e2de2a90 fffff800`36e077b5 : ffffeb82`e2de2c80 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x66f
ffffeb82`e2de2b90 00007ff9`cff8ce24 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`16aed1d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`cff8ce24
SYMBOL_NAME: nt!MiUnlinkPageFromList+76
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.928
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 76
FAILURE_BUCKET_ID: AV_nt!MiUnlinkPageFromList
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {2506b0de-fb2f-991d-6a7d-ca6f66ee2f73}
Followup: MachineOwner
---------
