Just had another BSOD while logging off exactly two weeks later. I opened the memory.dmp file in Windows debugger. Does the following information explain what's going on? It's over my head.
----
************* Preparing the environment for Debugger Extensions Gallery repositories **************
ExtensionRepository : Implicit
UseExperimentalFeatureForNugetShare : true
AllowNugetExeUpdate : true
NonInteractiveNuget : true
AllowNugetMSCredentialProviderInstall : true
AllowParallelInitializationOfLocalRepositories : true
EnableRedirectToChakraJsProvider : false
-- Configuring repositories
----> Repository : LocalInstalled, Enabled: true
----> Repository : UserExtensions, Enabled: true
>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds
************* Waiting for Debugger Extensions Gallery to Initialize **************
>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.312 seconds
----> Repository : UserExtensions, Enabled: true, Packages count: 0
----> Repository : LocalInstalled, Enabled: true, Packages count: 43
Microsoft (R) Windows Debugger Version 10.0.27793.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
Primary dump contents written successfully
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 26100 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 26100.1.amd64fre.ge_release.240331-1435
Kernel base = 0xfffff806`7a400000 PsLoadedModuleList = 0xfffff806`7b2f47c0
Debug session time: Sat Mar 8 11:30:32.705 2025 (UTC - 5:00)
System Uptime: 1 days 14:51:26.754
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..............
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000018`44720018). Type ".hh dbgerr001" for details
Loading unloaded module list
.................................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`7a8b7ce0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff189`392ef7e0=0000000000000018
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffff808d490240c0, Object whose reference count is being lowered
Arg3: 0000000000000002, Reserved
Arg4: ffffffffffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This BugCheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2078
Key : Analysis.Elapsed.mSec
Value: 2087
Key : Analysis.IO.Other.Mb
Value: 13
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 26
Key : Analysis.Init.CPU.mSec
Value: 843
Key : Analysis.Init.Elapsed.mSec
Value: 35789
Key : Analysis.Memory.CommitPeak.Mb
Value: 97
Key : Analysis.Version.DbgEng
Value: 10.0.27793.1000
Key : Analysis.Version.Description
Value: 10.2410.02.02 amd64fre
Key : Analysis.Version.Ext
Value: 1.2410.2.2
Key : Bugcheck.Code.KiBugCheckData
Value: 0x18
Key : Bugcheck.Code.LegacyAPI
Value: 0x18
Key : Bugcheck.Code.TargetModel
Value: 0x18
Key : Dump.Attributes.AsUlong
Value: 0x21000
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0x0
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 100
Key : Failure.Bucket
Value: 0x18_OVER_DEREFERENCE_nt!ObfDereferenceObjectWithTag
Key : Failure.Hash
Value: {4139309c-4e9f-52f0-ac5e-4041e7a86a20}
Key : Hypervisor.Enlightenments.Value
Value: 0
Key : Hypervisor.Enlightenments.ValueHex
Value: 0x0
Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 0
Key : Hypervisor.Flags.ApicEnlightened
Value: 0
Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 0
Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0
Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0
Key : Hypervisor.Flags.CpuManager
Value: 0
Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 0
Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 0
Key : Hypervisor.Flags.Epf
Value: 0
Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 0
Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1
Key : Hypervisor.Flags.MaxBankNumber
Value: 0
Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0
Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0
Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 0
Key : Hypervisor.Flags.Phase0InitDone
Value: 0
Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0
Key : Hypervisor.Flags.RootScheduler
Value: 0
Key : Hypervisor.Flags.SynicAvailable
Value: 0
Key : Hypervisor.Flags.UseQpcBias
Value: 0
Key : Hypervisor.Flags.Value
Value: 131072
Key : Hypervisor.Flags.ValueHex
Value: 0x20000
Key : Hypervisor.Flags.VpAssistPage
Value: 0
Key : Hypervisor.Flags.VsmAvailable
Value: 0
Key : Hypervisor.RootFlags.AccessStats
Value: 0
Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 0
Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 0
Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0
Key : Hypervisor.RootFlags.HostTimelineSync
Value: 0
Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0
Key : Hypervisor.RootFlags.IsHyperV
Value: 0
Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 0
Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 0
Key : Hypervisor.RootFlags.MceEnlightened
Value: 0
Key : Hypervisor.RootFlags.Nested
Value: 0
Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 0
Key : Hypervisor.RootFlags.Value
Value: 0
Key : Hypervisor.RootFlags.ValueHex
Value: 0x0
Key : SecureKernel.HalpHvciEnabled
Value: 0
Key : WER.OS.Branch
Value: ge_release
Key : WER.OS.Version
Value: 10.0.26100.1
BUGCHECK_CODE: 18
BUGCHECK_P1: 0
BUGCHECK_P2: ffff808d490240c0
BUGCHECK_P3: 2
BUGCHECK_P4: ffffffffffffffff
FILE_IN_CAB: MEMORY.DMP
DUMP_FILE_ATTRIBUTES: 0x21000
FAULTING_THREAD: ffff808d41759080
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
PROCESS_NAME: ProcessGovernor.exe
STACK_TEXT:
fffff189`392ef7d8 fffff806`7a62db66 : 00000000`00000018 00000000`00000000 ffff808d`490240c0 00000000`00000002 : nt!KeBugCheckEx
fffff189`392ef7e0 fffff806`7ac2d9d5 : 00000000`00000001 00000000`00000000 00000000`00101000 00000000`00000000 : nt!ObfDereferenceObjectWithTag+0x66
fffff189`392ef820 fffff806`7ac2c129 : 00000000`00000000 00000000`00000000 fffff189`00000000 ffff808d`490240c0 : nt!ObCloseHandleTableEntry+0x3e5
fffff189`392ef970 fffff806`7aa8c555 : 00000145`b3183e00 00000000`000007ec ffff808d`41759080 00000000`00000000 : nt!NtClose+0xe9
fffff189`392ef9e0 00007fff`fb47f9d4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000018`44bf7cd8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`fb47f9d4
SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+66
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
STACK_COMMAND: .process /r /p 0xffff808d4166d080; .thread 0xffff808d41759080 ; kb
BUCKET_ID_FUNC_OFFSET: 66
FAILURE_BUCKET_ID: 0x18_OVER_DEREFERENCE_nt!ObfDereferenceObjectWithTag
OS_VERSION: 10.0.26100.1
BUILDLAB_STR: ge_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {4139309c-4e9f-52f0-ac5e-4041e7a86a20}
Followup: MachineOwner
---------
4: kd> .thread /r /p ffff808d41759080
Implicit thread is now ffff808d`41759080
Implicit process is now ffff808d`4166d080
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000018`44720018). Type ".hh dbgerr001" for details
