Windows 8.1 - bugcheck 0x109 with 19 as fourth parameter

NTDEV
1

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel
code or
data have been corrupted. There are generally three causes for a corruption:

  1. A driver has inadvertently or deliberately modified critical kernel code
    or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
  2. A developer attempted to set a normal kernel breakpoint using a kernel
    debugger that was not attached when the system was booted. Normal
    breakpoints,
    “bp”, can only be set if the debugger is attached at boot time. Hardware
    breakpoints, “ba”, can be set at any time.
  3. A hardware corruption occurred, e.g. failing RAM holding kernel code or
    data.
    Arguments:
    Arg1: a3a00f58b53c88dd, Reserved
    Arg2: b3b71bdf07bc6aa7, Reserved
    Arg3: fffff80000bf6000, Failure type dependent information
    Arg4: 0000000000000019, Type of corrupted region, can be
    0 : A generic data region
    1 : Modification of a function or .pdata
    2 : A processor IDT
    3 : A processor GDT
    4 : Type 1 process list corruption
    5 : Type 2 process list corruption
    6 : Debug routine modification
    7 : Critical MSR modification

Debugging Details:

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0x109

PROCESS_NAME: System

CURRENT_IRQL: 0

TAG_NOT_DEFINED_c000000f: FFFFD000208B8FB0

LAST_CONTROL_TRANSFER: from fffff80001d661f7 to fffff80001d67214
STACK_TEXT:
ffffd000208b1a28 fffff80001d661f7 : 0000000000000000 ffffe000024b9000
ffffd000208b1b60 ffffd00020887180 : intelppm!MWaitIdle+0x18
ffffd000208b1a30 fffff803c40c8ec3 : ffffd00020887180 ffffd000208b1b00
000000012c464d4c ffffe000021958c0 : intelppm!AcpiCStateIdleExecute+0x17
ffffd000208b1a60 fffff803c40c8957 : ffffd00020887180 ffffd000208b1c8c
ffffd000208b1c90 ffffd000208b1c98 : nt!PpmIdleExecuteTransition+0x3d3
ffffd000208b1c50 fffff803c415dabc : ffffd00020887180 ffffd00020887180
ffffd00020893100 0000000000000000 : nt!PoIdle+0x307
ffffd000208b1da0 0000000000000000 : ffffd000208b2000 ffffd000208ac000
0000000000000000 0000000000000000 : nt!KiIdleLoop+0x2c

I don’t see any definition for region type 19.
I see there was a post earlier on NTDEV but not a public reply there.

Knowingly, we are not doing anything to manipulate any critical kernel
regions.

-Deepak

2

Generally Arg3 points to what is corrupted. Have you tried figuring out what
that is (u, ln, !pool, etc.)?

-scott
OSR

“Deepak Gupta” wrote in message news:xxxxx@ntdev…
CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code
or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal
breakpoints,
“bp”, can only be set if the debugger is attached at boot time. Hardware
breakpoints, “ba”, can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or
data.
Arguments:
Arg1: a3a00f58b53c88dd, Reserved
Arg2: b3b71bdf07bc6aa7, Reserved
Arg3: fffff80000bf6000, Failure type dependent information
Arg4: 0000000000000019, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification

Debugging Details:
------------------

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0x109

PROCESS_NAME: System

CURRENT_IRQL: 0

TAG_NOT_DEFINED_c000000f: FFFFD000208B8FB0

LAST_CONTROL_TRANSFER: from fffff80001d661f7 to fffff80001d67214

STACK_TEXT:
ffffd000208b1a28 fffff80001d661f7 : 0000000000000000 ffffe000024b9000
ffffd000208b1b60 ffffd00020887180 : intelppm!MWaitIdle+0x18
ffffd000208b1a30 fffff803c40c8ec3 : ffffd00020887180 ffffd000208b1b00
000000012c464d4c ffffe000021958c0 : intelppm!AcpiCStateIdleExecute+0x17
ffffd000208b1a60 fffff803c40c8957 : ffffd00020887180 ffffd000208b1c8c
ffffd000208b1c90 ffffd000208b1c98 : nt!PpmIdleExecuteTransition+0x3d3
ffffd000208b1c50 fffff803c415dabc : ffffd00020887180 ffffd00020887180
ffffd00020893100 0000000000000000 : nt!PoIdle+0x307
ffffd000208b1da0 0000000000000000 : ffffd000208b2000 ffffd000208ac000
0000000000000000 0000000000000000 : nt!KiIdleLoop+0x2c

I don’t see any definition for region type 19.
I see there was a post earlier on NTDEV but not a public reply there.

Knowingly, we are not doing anything to manipulate any critical kernel
regions.

-Deepak

3

Thanks Scott for Arg3

3: kd> ln fffff80000bf6000

(fffff80000bf7000) Beep!DriverEntry+0xffffffffffffffff |
(fffff800`00bf7154) Beep!BeepCancel

3: kd> lmvm beep

start end module name

fffff80000bf6000 fffff80000bfe000 Beep (pdb symbols)
c:\symbols\beep.pdb\1DAB482E885243F1B8E2476E7D7047701\beep.pdb

Loaded symbol image file: Beep.SYS

Image path: \SystemRoot\System32\Drivers\Beep.SYS

Image name: Beep.SYS

Timestamp: Sat Jul 27 01:16:40 2013 (51F381E8)

CheckSum: 0000FDE4

ImageSize: 00008000

Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

Looks like beep.sys is being corrupted.

So PG on Win 8.1 seems to be protected modules other NTOS as well.

Thanks again.

-Deepak

On Tue, Aug 20, 2013 at 11:40 AM, Scott Noone wrote:

> Generally Arg3 points to what is corrupted. Have you tried figuring out
> what that is (u, ln, !pool, etc.)?
>
> -scott
> OSR
>
> “Deepak Gupta” wrote in message news:xxxxx@ntdev.
> …
>
> CRITICAL_STRUCTURE_CORRUPTION (109)
> This bugcheck is generated when the kernel detects that critical kernel
> code or
> data have been corrupted. There are generally three causes for a
> corruption:
> 1) A driver has inadvertently or deliberately modified critical kernel code
> or data. See http://www.microsoft.com/whdc/**driver/kernel/64bitPatching.*
> *mspx http:
> 2) A developer attempted to set a normal kernel breakpoint using a kernel
> debugger that was not attached when the system was booted. Normal
> breakpoints,
> “bp”, can only be set if the debugger is attached at boot time. Hardware
> breakpoints, “ba”, can be set at any time.
> 3) A hardware corruption occurred, e.g. failing RAM holding kernel code or
> data.
> Arguments:
> Arg1: a3a00f58b53c88dd, Reserved
> Arg2: b3b71bdf07bc6aa7, Reserved
> Arg3: fffff80000bf6000, Failure type dependent information
> Arg4: 0000000000000019, Type of corrupted region, can be
> 0 : A generic data region
> 1 : Modification of a function or .pdata
> 2 : A processor IDT
> 3 : A processor GDT
> 4 : Type 1 process list corruption
> 5 : Type 2 process list corruption
> 6 : Debug routine modification
> 7 : Critical MSR modification
>
> Debugging Details:
> ------------------
>
>
> DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
>
> BUGCHECK_STR: 0x109
>
> PROCESS_NAME: System
>
> CURRENT_IRQL: 0
>
> TAG_NOT_DEFINED_c000000f: FFFFD000208B8FB0
>
> LAST_CONTROL_TRANSFER: from fffff80001d661f7 to fffff80001d67214
>
> STACK_TEXT:
> ffffd000208b1a28 fffff80001d661f7 : 0000000000000000 ffffe000024b9000
> ffffd000208b1b60 ffffd00020887180 : intelppm!MWaitIdle+0x18
> ffffd000208b1a30 fffff803c40c8ec3 : ffffd00020887180 ffffd000208b1b00
> 000000012c464d4c ffffe000021958c0 : intelppm!**
> AcpiCStateIdleExecute+0x17
> ffffd000208b1a60 fffff803c40c8957 : ffffd00020887180 ffffd000208b1c8c
> ffffd000208b1c90 ffffd000208b1c98 : nt!PpmIdleExecuteTransition+ 0x3d3
> ffffd000208b1c50 fffff803c415dabc : ffffd00020887180 ffffd00020887180
> ffffd00020893100 0000000000000000 : nt!PoIdle+0x307
> ffffd000208b1da0 0000000000000000 : ffffd000208b2000 ffffd000208ac000
> 0000000000000000 0000000000000000 : nt!KiIdleLoop+0x2c
>
> I don’t see any definition for region type 19.
> I see there was a post earlier on NTDEV but not a public reply there.
>
> Knowingly, we are not doing anything to manipulate any critical kernel
> regions.
>
> -Deepak
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/ showlists.cfm?list=ntdevhttp:
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.**cfm?name=ListServerhttp:
></http:></http:></http:>