Çözüldü DRIVER_OVERRAN_STACK_BUFFER hatası

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.  This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned.  This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and BugCheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 0000b06d13712b44, Actual security check cookie from the stack
Arg2: 0000b06d13712b44, Expected security check cookie
Arg3: ffff4f92ec8ed4bb, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1921

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 9924

    Key  : Analysis.Init.CPU.mSec
    Value: 609

    Key  : Analysis.Init.Elapsed.mSec
    Value: 150921

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 128

    Key  : Bugcheck.Code.DumpHeader
    Value: 0xf7

    Key  : Bugcheck.Code.Register
    Value: 0xf7

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


FILE_IN_CAB:  090822-9531-01.dmp

BUGCHECK_CODE:  f7

BUGCHECK_P1: b06d13712b44

BUGCHECK_P2: b06d13712b44

BUGCHECK_P3: ffff4f92ec8ed4bb

BUGCHECK_P4: 0

SECURITY_COOKIE:  Expected 0000b06d13712b44 found 0000b06d13712b44

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

STACK_TEXT:
ffffa20b`058a7c18 fffff803`6e4b1725     : 00000000`000000f7 0000b06d`13712b44 0000b06d`13712b44 ffff4f92`ec8ed4bb : nt!KeBugCheckEx
ffffa20b`058a7c20 fffff803`6e3fcaf4     : ffffffff`00000000 ffffe281`f770e440 ffffce0c`4af3a080 00000000`000003da : nt!_report_gsfailure+0x25
ffffa20b`058a7c60 00000000`00000000     : ffffa20b`058a8000 ffffa20b`058a2000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x54


SYMBOL_NAME:  nt!_report_gsfailure+25

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.19041.1949

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  25

FAILURE_BUCKET_ID:  0xF7_ONE_BIT_MISSING_GSFRAME_nt!_report_gsfailure

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {8f84f302-dd0e-1f96-6f9c-0ea31ad59f42}

Followup:     MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000002, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8027b2a3577, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1952

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 20624

    Key  : Analysis.Init.CPU.mSec
    Value: 374

    Key  : Analysis.Init.Elapsed.mSec
    Value: 143093

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 127

    Key  : Bugcheck.Code.DumpHeader
    Value: 0xa

    Key  : Bugcheck.Code.Register
    Value: 0xa

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


FILE_IN_CAB:  1.dmp

BUGCHECK_CODE:  a

BUGCHECK_P1: 2

BUGCHECK_P2: 2

BUGCHECK_P3: 1

BUGCHECK_P4: fffff8027b2a3577

WRITE_ADDRESS: fffff8027bcfb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 0000000000000002

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME:  System

TRAP_FRAME:  ffffae065e0a7530 -- (.trap 0xffffae065e0a7530)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000009 rbx=0000000000000000 rcx=fffff8027bd25440
rdx=0000000000000009 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8027b2a3577 rsp=ffffae065e0a76c0 rbp=000000030825b900
 r8=0000000000000029  r9=000000000000ffff r10=000000000000ffff
r11=ffffb601ced00180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KiDeferredReadySingleThread+0x2e7:
fffff802`7b2a3577 000f            add     byte ptr [rdi],cl ds:00000000`00000000=??
Resetting default scope

MISALIGNED_IP:
nt!KiDeferredReadySingleThread+2e7
fffff802`7b2a3577 000f            add     byte ptr [rdi],cl

STACK_TEXT:
ffffae06`5e0a73e8 fffff802`7b40a869     : 00000000`0000000a 00000000`00000002 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffffae06`5e0a73f0 fffff802`7b406b69     : ffffb601`ced00180 fffff802`7bd25440 fffff802`00000000 fffff802`7b38e762 : nt!KiBugCheckDispatch+0x69
ffffae06`5e0a7530 fffff802`7b2a3577     : 0000004d`00000000 ffffc802`8b8020c0 00000000`00000008 00000000`00000000 : nt!KiPageFault+0x469
ffffae06`5e0a76c0 fffff802`7b2d05dd     : 00000000`00135431 ffffae06`5e0a7b10 00000000`00000080 ffffb601`ced00180 : nt!KiDeferredReadySingleThread+0x2e7
ffffae06`5e0a78b0 fffff802`7b29db30     : ffffb601`ced00180 00000000`00000000 ffffc802`9771f1f0 ffffc802`7e6e81c0 : nt!KiReadyThread+0x4d
ffffae06`5e0a78e0 fffff802`7b26766d     : 00000000`00000000 00000000`00000000 00000000`00140001 00000000`00135431 : nt!KiProcessExpiredTimerList+0x290
ffffae06`5e0a79d0 fffff802`7b3fc45e     : ffffffff`00000000 ffffb601`ced00180 ffffb601`ced0b440 ffffc802`9c8780c0 : nt!KiRetireDpcList+0x5dd
ffffae06`5e0a7c60 00000000`00000000     : ffffae06`5e0a8000 ffffae06`5e0a2000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e


SYMBOL_NAME:  nt!KiDeferredReadySingleThread+2e7

IMAGE_VERSION:  10.0.19041.1889

STACK_COMMAND:  .cxr; .ecxr ; kb

MODULE_NAME: AuthenticAMD

IMAGE_NAME:  AuthenticAMD.sys

FAILURE_BUCKET_ID:  IP_MISALIGNED_AuthenticAMD.sys

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {716d112a-8330-4bbb-160c-ec98297019d2}

Followup:     MachineOwner
---------