************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true EnableRedirectToChakraJsProvider : false -- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds ************* Waiting for Debugger Extensions Gallery to Initialize ************** >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.328 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 45 Microsoft (R) Windows Debugger Version 10.0.27920.1001 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\MEMORY.DMP] Kernel Bitmap Dump File: Full address space is available Primary dump contents written successfully ************* Path validation summary ************** Response Time (ms) Location Deferred srv* Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 26100 MP (32 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Edition build lab: 26100.1.amd64fre.ge_release.240331-1435 Kernel base = 0xfffff802`ce600000 PsLoadedModuleList = 0xfffff802`cf4f4e70 Debug session time: Sat Sep 27 12:10:23.685 2025 (UTC + 1:00) System Uptime: 0 days 14:48:46.953 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ ................... Loading User Symbols ................................................................ ............................ Loading unloaded module list ...................... +------------------------------------------------------------------------+ | This target supports Hardware-enforced Stack Protection. A HW based | | "Shadow Stack" may be available to assist in debugging and analysis. | | See aka.ms/userhsp for more info. | | | | dps @ssp | | | +------------------------------------------------------------------------+ For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff802`ceaf9280 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffa88f`f290dbc0=000000000000007e 9: kd> !analyze -v Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ ................... Loading User Symbols ................................................................ ............................ Loading unloaded module list ...................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e) This is a very common BugCheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff8027c7e09c8, The address that the exception occurred at Arg3: ffffa88ff290ec48, Exception Record Address Arg4: ffffa88ff290e430, Context Record Address Debugging Details: ------------------ Unable to load image \??\C:\Program Files\Riot Vanguard\vgk.sys, Win32 error 0n2 KEY_VALUES_STRING: 1 Key : AV.Type Value: Read Key : Analysis.CPU.mSec Value: 1375 Key : Analysis.Elapsed.mSec Value: 4200 Key : Analysis.IO.Other.Mb Value: 0 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 0 Key : Analysis.Init.CPU.mSec Value: 640 Key : Analysis.Init.Elapsed.mSec Value: 60104 Key : Analysis.Memory.CommitPeak.Mb Value: 124 Key : Analysis.Version.DbgEng Value: 10.0.27920.1001 Key : Analysis.Version.Description Value: 10.2506.23.01 amd64fre Key : Analysis.Version.Ext Value: 1.2506.23.1 Key : Bugcheck.Code.KiBugCheckData Value: 0x7e Key : Bugcheck.Code.LegacyAPI Value: 0x7e Key : Bugcheck.Code.TargetModel Value: 0x7e Key : Dump.Attributes.AsUlong Value: 0x21800 Key : Dump.Attributes.DiagDataWrittenToHeader Value: 1 Key : Dump.Attributes.ErrorCode Value: 0x0 Key : Dump.Attributes.LastLine Value: Dump completed successfully. Key : Dump.Attributes.ProgressPercentage Value: 100 Key : Failure.Bucket Value: AV_vgk!Egg Key : Failure.Exception.Code Value: 0xc0000005 Key : Failure.Exception.IP.Address Value: 0xfffff8027c7e09c8 Key : Failure.Exception.IP.Module Value: Wof Key : Failure.Exception.IP.Offset Value: 0x5409c8 Key : Failure.Exception.Record Value: 0xffffa88ff290ec48 Key : Failure.Hash Value: {fa32322d-bf5c-746b-3c98-f765496b3063} Key : Hypervisor.Enlightenments.ValueHex Value: 0x7417df84 Key : Hypervisor.Flags.AnyHypervisorPresent Value: 1 Key : Hypervisor.Flags.ApicEnlightened Value: 0 Key : Hypervisor.Flags.ApicVirtualizationAvailable Value: 1 Key : Hypervisor.Flags.AsyncMemoryHint Value: 0 Key : Hypervisor.Flags.CoreSchedulerRequested Value: 0 Key : Hypervisor.Flags.CpuManager Value: 1 Key : Hypervisor.Flags.DeprecateAutoEoi Value: 1 Key : Hypervisor.Flags.DynamicCpuDisabled Value: 1 Key : Hypervisor.Flags.Epf Value: 0 Key : Hypervisor.Flags.ExtendedProcessorMasks Value: 1 Key : Hypervisor.Flags.HardwareMbecAvailable Value: 1 Key : Hypervisor.Flags.MaxBankNumber Value: 0 Key : Hypervisor.Flags.MemoryZeroingControl Value: 0 Key : Hypervisor.Flags.NoExtendedRangeFlush Value: 0 Key : Hypervisor.Flags.NoNonArchCoreSharing Value: 1 Key : Hypervisor.Flags.Phase0InitDone Value: 1 Key : Hypervisor.Flags.PowerSchedulerQos Value: 0 Key : Hypervisor.Flags.RootScheduler Value: 0 Key : Hypervisor.Flags.SynicAvailable Value: 1 Key : Hypervisor.Flags.UseQpcBias Value: 0 Key : Hypervisor.Flags.Value Value: 55185662 Key : Hypervisor.Flags.ValueHex Value: 0x34a10fe Key : Hypervisor.Flags.VpAssistPage Value: 1 Key : Hypervisor.Flags.VsmAvailable Value: 1 Key : Hypervisor.RootFlags.AccessStats Value: 1 Key : Hypervisor.RootFlags.CrashdumpEnlightened Value: 1 Key : Hypervisor.RootFlags.CreateVirtualProcessor Value: 1 Key : Hypervisor.RootFlags.DisableHyperthreading Value: 0 Key : Hypervisor.RootFlags.HostTimelineSync Value: 1 Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled Value: 0 Key : Hypervisor.RootFlags.IsHyperV Value: 1 Key : Hypervisor.RootFlags.LivedumpEnlightened Value: 1 Key : Hypervisor.RootFlags.MapDeviceInterrupt Value: 1 Key : Hypervisor.RootFlags.MceEnlightened Value: 1 Key : Hypervisor.RootFlags.Nested Value: 0 Key : Hypervisor.RootFlags.StartLogicalProcessor Value: 1 Key : Hypervisor.RootFlags.Value Value: 1015 Key : Hypervisor.RootFlags.ValueHex Value: 0x3f7 Key : SecureKernel.HalpHvciEnabled Value: 1 Key : WER.OS.Branch Value: ge_release Key : WER.OS.Version Value: 10.0.26100.1 Key : WER.System.BIOSRevision Value: 9.10.0.0 BUGCHECK_CODE: 7e BUGCHECK_P1: ffffffffc0000005 BUGCHECK_P2: fffff8027c7e09c8 BUGCHECK_P3: ffffa88ff290ec48 BUGCHECK_P4: ffffa88ff290e430 FILE_IN_CAB: MEMORY.DMP TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b DUMP_FILE_ATTRIBUTES: 0x21800 FAULTING_THREAD: ffffbe0a134043c0 EXCEPTION_RECORD: ffffa88ff290ec48 -- (.exr 0xffffa88ff290ec48) ExceptionAddress: fffff8027c7e09c8 (vgk!Egg+0x00000000004f937c) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: ffffa88ff290e430 -- (.cxr 0xffffa88ff290e430) rax=fef67fce63fe7560 rbx=ad4e5d91076b484d rcx=4faba7f39d918a9f rdx=00000000f40eec13 rsi=08ecbcb3e136b7b3 rdi=000007fec3d5ffff rip=fffff8027c7e09c8 rsp=ffffa88ff290ee88 rbp=ffffffffffffffff r8=0000000000000001 r9=1ac6361ba3a42719 r10=2f9d78070bf113ec r11=0000000000000400 r12=0000000000403000 r13=f713434c1ec9484d r14=0000000004390cec r15=0000000002018001 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050202 vgk!Egg+0x4f937c: fffff802`7c7e09c8 488b08 mov rcx,qword ptr [rax] ds:002b:fef67fce`63fe7560=???????????????? Resetting default scope BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 (!blackboxwinlogon) PROCESS_NAME: XtuService.exe READ_ADDRESS: ffffffffffffffff ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s. EXCEPTION_CODE_STR: c0000005 EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff EXCEPTION_STR: 0xc0000005 STACK_TEXT: ffffa88f`f290ee88 fffff802`7c43b6ee : fffffedf`05152448 fffffeff`6f828a90 fffffeff`7fb7c140 fffffeff`7fbfdbe0 : vgk!Egg+0x4f937c ffffa88f`f290f600 fffff802`7c2a507a : ffffbe0a`2a489760 00000000`00000000 00000000`00000000 fffff802`7c2a0000 : vgk!Egg+0x1540a2 ffffa88f`f290f630 fffff802`cef86606 : ffffbe0a`2789a0c0 ffffbe0a`2789a0c0 00000000`00000d88 ffffa88f`f290f7a0 : vgk+0x507a ffffa88f`f290f6d0 fffff802`7c2a6a08 : ffffbe09`f1ee3998 ffffa88f`f290f7a0 ffffbe09`f1eb0000 ffffbe09`f1ee3998 : nt!ExEnumHandleTable+0x146 ffffa88f`f290f730 fffff802`7c333c8a : 00000000`00000000 00000000`00000000 ffffa88f`f290faf0 00000000`00000000 : vgk+0x6a08 ffffa88f`f290f7b0 fffff802`cea87c2a : ffffbe0a`134043c0 ffffbe0a`134043c0 00000000`00000080 fffff802`7c2a62f4 : vgk!Egg+0x4c63e ffffa88f`f290fb30 fffff802`ceca0b24 : ffff8700`1c491180 ffffbe0a`134043c0 fffff802`cea87bd0 500c12d7`c36ba8f5 : nt!PspSystemThreadStartup+0x5a ffffa88f`f290fb80 00000000`00000000 : ffffa88f`f2910000 ffffa88f`f2909000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34 SYMBOL_NAME: vgk!Egg+4f937c MODULE_NAME: vgk IMAGE_NAME: vgk.sys IMAGE_VERSION: 1.17.13.23 STACK_COMMAND: .cxr 0xffffa88ff290e430 ; kb BUCKET_ID_FUNC_OFFSET: 4f937c FAILURE_BUCKET_ID: AV_vgk!Egg OS_VERSION: 10.0.26100.1 BUILDLAB_STR: ge_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {fa32322d-bf5c-746b-3c98-f765496b3063} Followup: MachineOwner ---------