Windows 10: BSOD caused by ntkrnlmp.exe nt!_report_gsfailure+25

constant restarts and blue screenwhile playing gta 5 grand rp.PLEASE HELP ME !!!!!!!minidump file link: https://drive.google.com/file/d/1qhYR3eUBLI3swEswzobUFwS_nwkGhAK1/view?usp=drive_link DEBUG ANALYSIS WITH MICROSOFT DEVLOPER KIT Microsoft R Windows Debugger Version 10.0.22621.3233 AMD64 Copyright c Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\sumit\OneDrive\Desktop\031624-11781-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 22621 MP 16 procs

:)

 

BSOD caused by ntkrnlmp.exe ( nt!_report_gsfailure+25 )

Hi

For the past 1-2 weeks i am constantly getting bsod

I analyzed a bit and it shows ntkrnlmp.exe

Here's the dump files: "http://80.211.144.44/Minidump.zip"

Below is the WinDbg output

Microsoft (R) Windows Debugger Version 10.0.16299.15 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\120117-26859-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

************* Path validation summary **************

Response Time (ms) Location

Deferred SRV*C:\SymCache*Symbol information

Symbol search path is: SRV*C:\SymCache*Symbol information

Executable search path is:

Windows 10 Kernel Version 15063 MP (2 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 15063.0.amd64fre.rs2_release.170317-1834

Machine Name:

Kernel base = 0xfffff803`2b890000 PsLoadedModuleList = 0xfffff803`2bbdc5c0

Debug session time: Fri Dec 1 22:24:41.437 2017 (UTC + 3:00)

System Uptime: 0 days 0:51:41.216

Loading Kernel Symbols

...............................................................

................................................................

................................................

Loading User Symbols

Loading unloaded module list

................

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F7, {3a813e180ef0, c9e7111f1660, ffff3618eee0e99f, 0}

Probably caused by : ntkrnlmp.exe ( nt!_report_gsfailure+25 )

Followup: MachineOwner

---------

1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_OVERRAN_STACK_BUFFER (f7)

A driver has overrun a stack-based buffer. This overrun could potentially

allow a malicious user to gain control of this machine.

DESCRIPTION

A driver overran a stack-based buffer (or local variable) in a way that would

have overwritten the function's return address and jumped back to an arbitrary

address when the function returned. This is the classic "buffer overrun"

hacking attack and the system has been brought down to prevent a malicious user

from gaining complete control of it.

Do a kb to get a stack backtrace -- the last routine on the stack before the

buffer overrun handlers and bugcheck call is the one that overran its local

variable(s).

Arguments:

Arg1: 00003a813e180ef0, Actual security check cookie from the stack

Arg2: 0000c9e7111f1660, Expected security check cookie

Arg3: ffff3618eee0e99f, Complement of the expected security check cookie

Arg4: 0000000000000000, zero

Debugging Details:

------------------

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10.0.15063.674 (WinBuild.160101.0800)

SYSTEM_MANUFACTURER: MSI

SYSTEM_PRODUCT_NAME: MS-7267

SYSTEM_SKU: To Be Filled By O.E.M.

SYSTEM_VERSION: 4.0

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: V17.1

BIOS_DATE: 07/11/2007

BASEBOARD_MANUFACTURER: MSI

BASEBOARD_PRODUCT: MS-7267

BASEBOARD_VERSION: 4.0

DUMP_TYPE: 2

BUGCHECK_P1: 3a813e180ef0

BUGCHECK_P2: c9e7111f1660

BUGCHECK_P3: ffff3618eee0e99f

BUGCHECK_P4: 0

SECURITY_COOKIE: Expected 0000c9e7111f1660 found 00003a813e180ef0

CPU_COUNT: 2

CPU_MHZ: 91a

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: f

CPU_STEPPING: b

CPU_MICROCODE: 6,f,b,0 (F,M,S,R) SIG: C1'00000000 (cache) C1'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0xF7

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 2

ANALYSIS_SESSION_HOST: DESKTOP-9INHLTE

ANALYSIS_SESSION_TIME: 12-02-2017 10:39:50.0281

ANALYSIS_VERSION: 10.0.16299.15 amd64fre

LAST_CONTROL_TRANSFER: from fffff8032ba6a905 to fffff8032b9fc580

STACK_TEXT:

ffffcb01`3e1840c8 fffff803`2ba6a905 : 00000000`000000f7 00003a81`3e180ef0 0000c9e7`111f1660 ffff3618`eee0e99f : nt!KeBugCheckEx

ffffcb01`3e1840d0 fffff803`2b8f9550 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!_report_gsfailure+0x25

ffffcb01`3e184110 fffff803`2b8f93fe : 00000000`00000100 ffff9c88`49e0c8c0 00000000`00000000 ffffcb01`3e1842d8 : nt!MiIdentifyPfn+0x100

ffffcb01`3e1841e0 fffff803`2bd3ce1a : 00000000`00000000 ffff9c88`49e0b330 ffff9c88`49e0b000 ffff9c88`49e0b000 : nt!MiIdentifyPfnWrapper+0x3e

ffffcb01`3e184210 fffff803`2bd3c92f : ffff9c88`49445080 08000000`00004421 ffffcb01`3e1843f4 ffff9c88`49e0b000 : nt!PfpPfnPrioRequest+0xca

ffffcb01`3e184290 fffff803`2bd3ab8e : 00000000`0000004f ffff9c88`47d9e190 00000051`8bd7a038 fffff803`2b8c69e8 : nt!PfQuerySuperfetchInformation+0x2bf

ffffcb01`3e1843c0 fffff803`2bd3a83b : 00000000`00000000 0000021e`adfea700 00000000`00000000 00000000`00000000 : nt!ExpQuerySystemInformation+0x22e

ffffcb01`3e184c00 fffff803`2ba07413 : ffff9c88`49445080 00000000`00000000 00000000`00000000 00000051`8bd7caa8 : nt!NtQuerySystemInformation+0x2b

ffffcb01`3e184c40 00007ff9`eee55a64 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

00000051`8bd79ee8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`eee55a64

THREAD_SHA1_HASH_MOD_FUNC: 0621696229749f19418dfeecf88f4c3d2bd5058e

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 1e0bc3642c40aa307336c381675ee4a94c42db8e

THREAD_SHA1_HASH_MOD: 9f457f347057f10e1df248e166a3e95e6570ecfe

FOLLOWUP_IP:

nt!_report_gsfailure+25

fffff803`2ba6a905 cc int 3

FAULT_INSTR_CODE: cccccccc

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!_report_gsfailure+25

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 59cdf43a

IMAGE_VERSION: 10.0.15063.674

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 25

FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure

BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure

PRIMARY_PROBLEM_CLASS: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure

TARGET_TIME: 2017-12-01T19:24:41.000Z

OSBUILD: 15063

OSSERVICEPACK: 674

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2017-09-29 10:20:26

BUILDDATESTAMP_STR: 160101.0800

BUILDLAB_STR: WinBuild

BUILDOSVER_STR: 10.0.15063.674

ANALYSIS_SESSION_ELAPSED_TIME: 2a4b

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xf7_missing_gsframe_nt!_report_gsfailure

FAILURE_ID_HASH: {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}

Followup: MachineOwner

---------

 

Receiving BSOD due to ntkrnlmp.exe ( nt!_report_gsfailure+25 )

I have purchased a new system. The system seems to reboot when I am not using it, which is fortunate. This weekend it finally hung without rebooting with the BSOD stating DRIVER_OVERRAN_STACK_BUFFER. I don't know if this is a hardware issue or just a straight
driver issue. One weird piece of information is that Outlook keeps flashing/refreshing a dozen times and then stops. I have a hunch that it is a video issue. I have downloaded and installed both the latest Nvidia and Intel drivers for the system. Any and all
help is appreciated. Here is the dump file:

Microsoft (R) Windows Debugger Version 10.0.16299.91 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP]

Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*

Executable search path is:

Windows 10 Kernel Version 16299 MP (8 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 16299.15.amd64fre.rs3_release.170928-1534

Machine Name:

Kernel base = 0xfffff801`0c408000 PsLoadedModuleList = 0xfffff801`0c76efd0

Debug session time: Sat Jan 20 05:39:33.243 2018 (UTC - 7:00)

System Uptime: 0 days 2:03:14.301

Loading Kernel Symbols

...............................................................

......Page 6850d not present in the dump file. Type ".hh dbgerr004" for details

..........................................................

................................................................

.....................................

Loading User Symbols

PEB is paged out (Peb.Ldr = 000000e6`5a566018). Type ".hh dbgerr001" for details

Loading unloaded module list

...................

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F7, {fffffc1524ecf743, 9942ee12f296, ffff66bd11ed0d69, 0}

Probably caused by : ntkrnlmp.exe ( nt!_report_gsfailure+25 )

Followup: MachineOwner

---------

7: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_OVERRAN_STACK_BUFFER (f7)

A driver has overrun a stack-based buffer. This overrun could potentially

allow a malicious user to gain control of this machine.

DESCRIPTION

A driver overran a stack-based buffer (or local variable) in a way that would

have overwritten the function's return address and jumped back to an arbitrary

address when the function returned. This is the classic "buffer overrun"

hacking attack and the system has been brought down to prevent a malicious user

from gaining complete control of it.

Do a kb to get a stack backtrace -- the last routine on the stack before the

buffer overrun handlers and bugcheck call is the one that overran its local

variable(s).

Arguments:

Arg1: fffffc1524ecf743, Actual security check cookie from the stack

Arg2: 00009942ee12f296, Expected security check cookie

Arg3: ffff66bd11ed0d69, Complement of the expected security check cookie

Arg4: 0000000000000000, zero

Debugging Details:

------------------

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 16299.15.amd64fre.rs3_release.170928-1534

SYSTEM_MANUFACTURER: LENOVO

SYSTEM_PRODUCT_NAME: 20HH002NUS

SYSTEM_SKU: LENOVO_MT_20HH_BU_Think_FM_ThinkPad P51

SYSTEM_VERSION: ThinkPad P51

BIOS_VENDOR: LENOVO

BIOS_VERSION: N1UET42W (1.16 )

BIOS_DATE: 11/27/2017

BASEBOARD_MANUFACTURER: LENOVO

BASEBOARD_PRODUCT: 20HH002NUS

BASEBOARD_VERSION: SDK0J40697 WIN

DUMP_TYPE: 1

BUGCHECK_P1: fffffc1524ecf743

BUGCHECK_P2: 9942ee12f296

BUGCHECK_P3: ffff66bd11ed0d69

BUGCHECK_P4: 0

SECURITY_COOKIE: Expected 00009942ee12f296 found fffffc1524ecf743

CPU_COUNT: 8

CPU_MHZ: b58

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: 9

CPU_MICROCODE: 6,9e,9,0 (F,M,S,R) SIG: 70'00000000 (cache) 70'00000000 (init)

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0xF7

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: LAP07494

ANALYSIS_SESSION_TIME: 01-22-2018 07:50:59.0252

ANALYSIS_VERSION: 10.0.16299.91 amd64fre

LAST_CONTROL_TRANSFER: from fffff8010c5e59e5 to fffff8010c57d6e0

STACK_TEXT:

fffffc05`24ec76f8 fffff801`0c5e59e5 : 00000000`000000f7 fffffc15`24ecf743 00009942`ee12f296 ffff66bd`11ed0d69 : nt!KeBugCheckEx

fffffc05`24ec7700 fffff801`0c4a948d : ffffbe05`2b0d6600 00000000`00000101 ffffbe05`2d53cc01 ffff880e`00000000 : nt!_report_gsfailure+0x25

fffffc05`24ec7740 fffff801`0c4a8f05 : 00000000`00000002 00000000`00000000 00000000`40580088 000000e6`5ccff820 : nt!IoRemoveIoCompletion+0x1ad

fffffc05`24ec7860 fffff801`0c590203 : fffffc05`24ec7a00 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWaitForWorkViaWorkerFactory+0x305

fffffc05`24ec7a10 00007fff`e0a53784 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

000000e6`5ccff958 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`e0a53784

THREAD_SHA1_HASH_MOD_FUNC: 5b7d88cbf3e6d052d43d8f2eee415aae5d554f53

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: d568592e87296899ded609fe9b7dc71732a65737

THREAD_SHA1_HASH_MOD: f08ac56120cad14894587db086f77ce277bfae84

FOLLOWUP_IP:

nt!_report_gsfailure+25

fffff801`0c5e59e5 cc int 3

FAULT_INSTR_CODE: cccccccc

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!_report_gsfailure+25

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 5a4a1659

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 25

FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure

BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure

PRIMARY_PROBLEM_CLASS: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure

TARGET_TIME: 2018-01-20T12:39:33.000Z

OSBUILD: 16299

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2018-01-01 04:07:05

BUILDDATESTAMP_STR: 170928-1534

BUILDLAB_STR: rs3_release

BUILDOSVER_STR: 10.0.16299.15.amd64fre.rs3_release.170928-1534

ANALYSIS_SESSION_ELAPSED_TIME: 532

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xf7_missing_gsframe_nt!_report_gsfailure

FAILURE_ID_HASH: {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}

Followup: MachineOwner

---------

 

BSOD caused by ntkrnlmp.exe ( nt!_report_gsfailure+25 )

I keep getting a BSOD and i dont know to fix it and it's by ntkrnlmp.exe. Most of the time it happens while a video is playing.
there is minidump file

OneDrive
thanks!