Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff801`1c800000 PsLoadedModuleList = 0xfffff801`1d42a1d0
Debug session time: Mon Aug 2 01:35:48.424 2021 (UTC - 5:00)
System Uptime: 0 days 0:34:02.129
Loading Kernel Symbols
...............................................................
................................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
................
For analysis of this file, run !analyze -v
4: kd> !analyze -v
Bugcheck Analysis *
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffffe78b9ffb0050, Object whose reference count is being lowered
Arg3: 0000000000000010, Reserved
Arg4: 0000000000000001, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 4
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-CGCGK3T
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 8
Key : Analysis.Memory.CommitPeak.Mb
Value: 86
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: 18
BUGCHECK_P1: 0
BUGCHECK_P2: ffffe78b9ffb0050
BUGCHECK_P3: 10
BUGCHECK_P4: 1
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
PROCESS_NAME: System
LOCK_ADDRESS: fffff8011d444a20 -- (!locks fffff8011d444a20)
Resource @ nt!PiEngineLock (0xfffff8011d444a20) Exclusively owned
Contention Count = 21
Threads: ffffe78ba601e040-01<*>
1 total locks
PNP_TRIAGE_DATA:
Lock address : 0xfffff8011d444a20
Thread Count : 1
Thread address: 0xffffe78ba601e040
Thread wait : 0x1fe88
STACK_TEXT:
fffffe0a`3795f4e8 fffff801`1cc14a34 : 00000000`00000018 00000000`00000000 ffffe78b`9ffb0050 00000000`00000010 : nt!KeBugCheckEx
fffffe0a`3795f4f0 fffff801`1ca719f6 : ffffe78b`9ffb0050 00000000`69706e50 00000000`00001001 00000000`00000fff : nt!ObfReferenceObjectWithTag+0x17de54
fffffe0a`3795f530 fffff801`1ce39c4b : 00000000`c00000bb fffffe0a`3795f600 00000000`000000ff 00000000`00000000 : nt!IoGetAttachedDeviceReferenceWithTag+0x36
fffffe0a`3795f560 fffff801`1cf507f6 : 00000000`c00000bb ffffe78b`86c02a60 fffffe0a`3795f7a8 ffffe78b`86c13de0 : nt!IopSynchronousCall+0x3f
fffffe0a`3795f5d0 fffff801`1cf506d4 : ffffe78b`86c02a60 fffffe0a`3795f7a8 ffffe78b`a601e040 fffff801`1cdd80ce : nt!PnpIrpQueryID+0x56
fffffe0a`3795f660 fffff801`1cf2452d : ffffe78b`86c02a60 fffffe0a`3795f7c0 00000000`00000000 00000000`00000000 : nt!PnpQueryID+0x34
fffffe0a`3795f6c0 fffff801`1cf26df0 : ffffe78b`86c02a60 ffffe78b`86c02a60 00000000`00000001 00000000`00000000 : nt!PiProcessNewDeviceNode+0x11d
fffffe0a`3795f890 fffff801`1cf21666 : ffffe78b`86c02a00 ffffe78b`acdf9601 fffffe0a`3795f9b0 fffff801`00000000 : nt!PipProcessDevNodeTree+0x380
fffffe0a`3795f960 fffff801`1cb6e25a : 00000001`00000003 ffffe78b`86c02a60 00000000`00000000 ffffe78b`acdf9610 : nt!PiRestartDevice+0xba
fffffe0a`3795f9b0 fffff801`1cab8515 : ffffe78b`a601e040 ffffe78b`86a8baa0 fffff801`1d443340 ffffe78b`00000000 : nt!PnpDeviceActionWorker+0x46a
fffffe0a`3795fa70 fffff801`1cb55875 : ffffe78b`a601e040 00000000`00000080 ffffe78b`86b02080 00000000`0000018a : nt!ExpWorkerThread+0x105
fffffe0a`3795fb10 fffff801`1cbfe578 : ffff9981`d3fe0180 ffffe78b`a601e040 fffff801`1cb55820 00000000`0000018a : nt!PspSystemThreadStartup+0x55
fffffe0a`3795fb60 00000000`00000000 : fffffe0a`37960000 fffffe0a`37959000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!ObfReferenceObjectWithTag+17de54
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 17de54
FAILURE_BUCKET_ID: 0x18_nt!ObfReferenceObjectWithTag
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {b6b47bfd-ed1b-fc56-3b01-ddc037f9c59f}
Followup: MachineOwner
4: kd> lmvm nt
Browse full module list
start end module name
fffff801`1c800000 fffff801`1d846000 nt (pdb symbols) C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ntkrnlmp.pdb\F526DBB121425697CBBF4FB22502519F1\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 553DF94C (This is a reproducible build file hash, not a timestamp)
CheckSum: 00A5F158
ImageSize: 01046000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables: