u/DLLNBRAND

Help Analyzing Minidump Windows 11

Based off of the following bugcheck analysis, why is my computer crashing?

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffffa0dd0726460, Address of the trap frame for the exception that caused the BugCheck
Arg3: fffffa0dd07263b8, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1718

Key : Analysis.Elapsed.mSec
Value: 2066

Key : Analysis.IO.Other.Mb
Value: 0

Key : Analysis.IO.Read.Mb
Value: 1

Key : Analysis.IO.Write.Mb
Value: 0

Key : Analysis.Init.CPU.mSec
Value: 484

Key : Analysis.Init.Elapsed.mSec
Value: 6253

Key : Analysis.Memory.CommitPeak.Mb
Value: 82

Key : Analysis.Version.DbgEng
Value: 10.0.29547.1002

Key : Analysis.Version.Description
Value: 10.2602.27.2 amd64fre

Key : Analysis.Version.Ext
Value: 1.2602.27.2

Key : Bugcheck.Code.LegacyAPI
Value: 0x139

Key : Bugcheck.Code.TargetModel
Value: 0x139

Key : Dump.Attributes.AsUlong
Value: 0x21808

Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1

Key : Dump.Attributes.ErrorCode
Value: 0x0

Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1

Key : Dump.Attributes.LastLine
Value: Dump completed successfully.

Key : Dump.Attributes.ProgressPercentage
Value: 0

Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY

Key : FailFast.Type
Value: 3

Key : Failure.Bucket
Value: 0x139_3_CORRUPT_LIST_ENTRY_tpm!Tpm20ResourceMgr::RemovedLoadedResource

Key : Failure.Exception.Code
Value: 0xc0000409

Key : Failure.Exception.Record
Value: 0xfffffa0dd07263b8

Key : Failure.Hash
Value: {1764a007-36a0-ad2e-affa-7bb93db2d908}

Key : Hypervisor.Enlightenments.ValueHex
Value: 0x7497cf94

Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key : Hypervisor.Flags.ApicEnlightened
Value: 1

Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 0

Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key : Hypervisor.Flags.CpuManager
Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 0

Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key : Hypervisor.Flags.Epf
Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key : Hypervisor.Flags.MaxBankNumber
Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key : Hypervisor.Flags.Phase0InitDone
Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key : Hypervisor.Flags.RootScheduler
Value: 0

Key : Hypervisor.Flags.SynicAvailable
Value: 1

Key : Hypervisor.Flags.UseQpcBias
Value: 0

Key : Hypervisor.Flags.Value
Value: 38408431

Key : Hypervisor.Flags.ValueHex
Value: 0x24a10ef

Key : Hypervisor.Flags.VpAssistPage
Value: 1

Key : Hypervisor.Flags.VsmAvailable
Value: 1

Key : Hypervisor.RootFlags.AccessStats
Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key : Hypervisor.RootFlags.IsHyperV
Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key : Hypervisor.RootFlags.Nested
Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key : Hypervisor.RootFlags.Value
Value: 1015

Key : Hypervisor.RootFlags.ValueHex
Value: 0x3f7

Key : WER.System.BIOSRevision
Value: 5.17.0.0

BUGCHECK_CODE: 139

BUGCHECK_P1: 3

BUGCHECK_P2: fffffa0dd0726460

BUGCHECK_P3: fffffa0dd07263b8

BUGCHECK_P4: 0

FILE_IN_CAB: 051426-24093-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b

DUMP_FILE_ATTRIBUTES: 0x21808
Kernel Generated Triage Dump

FAULTING_THREAD: ffffa987aaf1b040

TRAP_FRAME: fffffa0dd0726460 -- (.trap 0xfffffa0dd0726460)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffcb874148d0f0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffa987d1f34078 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8030b949c78 rsp=fffffa0dd07265f0 rbp=fffffa0dd0726770
r8=ffffcb8773223eb0 r9=ffffa987b8d97200 r10=0000000000008001
r11=ffffaa7a7e200000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po cy
tpm!Tpm20ResourceMgr::RemovedLoadedResource+0xc0:
fffff803`0b949c78 cd29 int 29h
Resetting default scope

EXCEPTION_RECORD: fffffa0dd07263b8 -- (.exr 0xfffffa0dd07263b8)
ExceptionAddress: fffff8030b949c78 (tpm!Tpm20ResourceMgr::RemovedLoadedResource+0x00000000000000c0)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1 (!blackboxwinlogon) (!blackboxwinlogonnotify)

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000003

EXCEPTION_STR: 0xc0000409

STACK_TEXT:
fffffa0d`d0726138 fffff803`796be2e9 : 00000000`00000139 00000000`00000003 fffffa0d`d0726460 fffffa0d`d07263b8 : nt!KeBugCheckEx
fffffa0d`d0726140 fffff803`796be8f2 : 00000000`00000000 00000000`00000000 fffffa0d`d0726460 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffffa0d`d0726280 fffff803`796bc528 : ffffcb87`4148d0e0 ffffcb87`9c935dd0 00000000`00000000 00000000`00000082 : nt!KiFastFailDispatch+0xb2
fffffa0d`d0726460 fffff803`0b949c78 : 00000000`00000000 fffffa0d`00000001 fffff803`0b9878a0 0000057a`75c7970e : nt!KiRaiseSecurityCheckFailure+0x368
fffffa0d`d07265f0 fffff803`0b94729d : 00000000`00000000 ffffcb87`2b75c714 ffffcb87`9c935e00 ffffcb87`9c935dd0 : tpm!Tpm20ResourceMgr::RemovedLoadedResource+0xc0
fffffa0d`d0726630 fffff803`0b959410 : ffffcb87`2b5eee30 ffffcb87`00000000 fffffa0d`d0726770 ffffcb87`2b75c714 : tpm!Tpm20ResourceMgr::ProcessUpdatedTpmState+0x199
fffffa0d`d0726670 fffff803`0b9599e5 : ffffa987`00000000 00000000`00000009 00000000`00000009 fffff803`792737e1 : tpm!Tpm20ResourceMgr::SubmitRequest+0xd00
fffffa0d`d0726890 fffff803`0b95a9f2 : fffffa0d`d0726ab0 ffffa987`aaea9700 00000000`00000001 00000000`00000000 : tpm!Tpm20Scheduler::DoUserRequest+0x185
fffffa0d`d07269b0 fffff803`0b95aaa3 : ffffd4f7`00000000 ffffa987`aaea9700 fffff803`0b95aa60 ffffa987`aaea9700 : tpm!Tpm20Scheduler::SchedulerThreadFunction+0x7e2
fffffa0d`d0726bc0 fffff803`7948782a : ffffa987`aaf1b040 fffff803`0b95aa60 ffffba81`08e51180 000f807f`b8bbbdff : tpm!Tpm20Scheduler::SchedulerThreadWrapper+0x43
fffffa0d`d0726bf0 fffff803`796ab424 : ffffba81`08e51180 ffffa987`aaf1b040 fffff803`794877d0 00657461`6c706d65 : nt!PspSystemThreadStartup+0x5a
fffffa0d`d0726c40 00000000`00000000 : fffffa0d`d0727000 fffffa0d`d0721000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34

SYMBOL_NAME: tpm!Tpm20ResourceMgr::RemovedLoadedResource+c0

MODULE_NAME: tpm

IMAGE_NAME: tpm.sys

IMAGE_VERSION: 10.0.26100.8115

STACK_COMMAND: .process /r /p 0xffffa987a84b5040; .thread /r /p 0xffffa987aaf1b040 ; kb

BUCKET_ID_FUNC_OFFSET: c0

FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_tpm!Tpm20ResourceMgr::RemovedLoadedResource

OSPLATFORM_TYPE: x64

OSNAME: Windows 11

FAILURE_ID_HASH: {1764a007-36a0-ad2e-affa-7bb93db2d908}

reddit.com
u/DLLNBRAND — 7 days ago