PAGE_FAULT_IN_NONPAGED_AREA

[uragan1987]

compiled as Release x64 on VM Win 20H2 got PAGE_FAULT_IN_NONPAGED_AREA

[dennisbabkin]

Sure. So what's the crash dump saying?

[uragan1987]

`nt!DbgBreakPointWithStatus:

fffff804`143fbd40 cc int 3
kd> g
KDTARGET: Refreshing KD connection
KDTARGET: Refreshing KD connection

*** Fatal System Error: 0x00000050
(0xFFFFFFFFFFFFFFD0,0x0000000000000002,0xFFFFF804142E0014,0x0000000000000002)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

For analysis of this file, run !analyze -v
nt!DbgBreakPointWithStatus:
fffff804`143fbd40 cc int 3
3: kd> !analyze -v
Connected to Windows 10 19041 x64 target at (Fri Apr 1 15:47:32.830 2022 (UTC + 2:00)), ptr64 TRUE
Loading Kernel Symbols
...............................................................
................................................................
............................................................
Loading User Symbols
..
Loading unloaded module list
.....

---

•                                                                         *
  

•                    Bugcheck Analysis                                    *
  

•                                                                         *
  

---

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffd0, memory referenced.
Arg2: 0000000000000002, value 0 = read operation, 1 = write operation.
Arg3: fffff804142e0014, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)

Debugging Details:

KEY_VALUES_STRING: 1

Key  : AV.Type
Value: Write

Key  : Analysis.CPU.mSec
Value: 2343

Key  : Analysis.DebugAnalysisManager
Value: Create

Key  : Analysis.Elapsed.mSec
Value: 19951

Key  : Analysis.Init.CPU.mSec
Value: 1671

Key  : Analysis.Init.Elapsed.mSec
Value: 440308

Key  : Analysis.Memory.CommitPeak.Mb
Value: 102

Key  : WER.OS.Branch
Value: vb_release

Key  : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key  : WER.OS.Version
Value: 10.0.19041.1

BUGCHECK_CODE: 50

BUGCHECK_P1: ffffffffffffffd0

BUGCHECK_P2: 2

BUGCHECK_P3: fffff804142e0014

BUGCHECK_P4: 2

READ_ADDRESS: ffffffffffffffd0

MM_INTERNAL_CODE: 2

PROCESS_NAME: notepad.exe

TRAP_FRAME: ffffa30be15c1d80 -- (.trap 0xffffa30be15c1d80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000073f989ee9f00 rbx=0000000000000000 rcx=0000000000000000
rdx=000073f989ee9faa rsi=0000000000000000 rdi=0000000000000000
rip=fffff804142e0014 rsp=ffffa30be15c1f10 rbp=ffffa30be15c2000
r8=0000000000000000 r9=ffff8c0676116020 r10=ffff8c0676102a50
r11=0000000000001001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!ObfReferenceObject+0x24:
fffff804142e0014 f0480fc15ed0 lock xadd qword ptr [rsi-30h],rbx ds:ffffffffffffffd0=????????????????
Resetting default scope

STACK_TEXT:
ffffa30be15c1328 fffff80414512082 : ffffa30be15c1490 fffff8041437b1d0 fffff80414000000 0000000000000000 : nt!DbgBreakPointWithStatus
ffffa30be15c1330 fffff80414511666 : fffff80400000003 ffffa30be15c1490 fffff80414408e90 0000000000000050 : nt!KiBugCheckDebugBreak+0x12
ffffa30be15c1390 fffff804143f3fa7 : 0000000000000000 0000000000000000 ffffffffffffffd0 0000000000000000 : nt!KeBugCheck2+0x946
ffffa30be15c1aa0 fffff80414486729 : 0000000000000050 ffffffffffffffd0 0000000000000002 ffffa30be15c1d80 : nt!KeBugCheckEx+0x107
ffffa30be15c1ae0 fffff804142eeb80 : ffffa30b77566d4d 0000000000000002 ffffa30be15c1e00 0000000000000000 : nt!MiSystemFault+0x13faf9
ffffa30be15c1be0 fffff8041440205e : 0000000000000000 ffffa30be15c1e90 0000000000000070 ffff8c0676102a40 : nt!MmAccessFault+0x400
ffffa30be15c1d80 fffff804142e0014 : 0000000031637061 ffff8c0676116aa9 ffff8c0600000000 ffffa30be15c1fe0 : nt!KiPageFault+0x35e
ffffa30be15c1f10 ffff8c0676116b91 : 0000000000000000 ffff8c0676102a50 ffff8c067d38f790 0000000000000000 : nt!ObfReferenceObject+0x24
ffffa30be15c1f50 0000000000000000 : ffff8c0676102a50 ffff8c067d38f790 0000000000000000 ffff8c0676116000 : 0xffff8c06`76116b91

SYMBOL_NAME: nt!MiSystemFault+13faf9

MODULE_NAME: nt

STACK_COMMAND: .cxr; .ecxr ; kb

IMAGE_NAME: ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET: 13faf9

FAILURE_BUCKET_ID: AV_W_(null)_nt!MiSystemFault

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {66411fc0-2fe2-a1a3-7539-3b3fcf286ba7}

Followup: MachineOwner

`

Got this