Windows 2012 R2 crashed and rebooted
For the last couple days, my Windows 2012 R2 DC crashed and rebooted.  Below are the minidumps for the two crashes. I will be updating the network drivers, etc this evening and see if that would help. 
BugCheck 139, {3, ffffd001da67b1e0, ffffd001da67b138, 0}

Probably caused by : NETIO.SYS ( NETIO!NsiEnumerateObjectsAllParametersEx+618 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffd001da67b1e0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd001da67b138, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


TRAP_FRAME:  ffffd001da67b1e0 -- (.trap 0xffffd001da67b1e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe000dec6eef0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffe000dc3e74e0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800d08a25f5 rsp=ffffd001da67b370 rbp=ffffd001da67b409
 r8=0000000000000000  r9=0000000000000000 r10=ffffe000ddea8210
r11=ffffe000dec6ea20 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
NDIS!ndisNsiGetAllInterfaceInformation+0x26795:
fffff800`d08a25f5 cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffffd001da67b138 -- (.exr 0xffffd001da67b138)
ExceptionAddress: fffff800d08a25f5 (NDIS!ndisNsiGetAllInterfaceInformation+0x0000000000026795)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  LIST_ENTRY_CORRUPT

BUGCHECK_STR:  0x139

PROCESS_NAME:  Agent.Service.

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_PARAMETER1:  0000000000000003

LAST_CONTROL_TRANSFER:  from fffff8030735d7e9 to fffff80307351ca0

STACK_TEXT:  
ffffd001`da67aeb8 fffff803`0735d7e9 : 00000000`00000139 00000000`00000003 ffffd001`da67b1e0 ffffd001`da67b138 : nt!KeBugCheckEx
ffffd001`da67aec0 fffff803`0735db10 : 00000000`00000000 00000000`00000000 ffffe000`dad2ab20 fffff803`072bdf3d : nt!KiBugCheckDispatch+0x69
ffffd001`da67b000 fffff803`0735cd34 : ffffd001`da67b3d0 00000000`00000000 ffffe000`df203080 ffffe000`e236d000 : nt!KiFastFailDispatch+0xd0
ffffd001`da67b1e0 fffff800`d08a25f5 : 00000000`ffffe000 ffffe000`dec19460 ffffd001`da67b409 00000000`00000002 : nt!KiRaiseSecurityCheckFailure+0xf4
ffffd001`da67b370 fffff800`d0762878 : ffffd001`da67b510 ffffd001`da67b502 00000000`00000000 00000000`00000001 : NDIS!ndisNsiGetAllInterfaceInformation+0x26795
ffffd001`da67b470 fffff800`d196bfc1 : ffffe000`e236d070 ffffe000`00000070 00000000`1e17d580 00000000`00000000 : NETIO!NsiEnumerateObjectsAllParametersEx+0x618
ffffd001`da67b650 fffff800`d196bbea : 00000000`00000000 ffffe000`dd379580 ffffe000`dd3794b0 00000000`00000000 : nsiproxy!NsippEnumerateObjectsAllParameters+0x201
ffffd001`da67b840 fffff803`0762677f : 00000000`00000000 ffffe000`dd3794b0 ffffe000`dd3794b0 00000000`00000001 : nsiproxy!NsippDispatch+0x5a
ffffd001`da67b880 fffff803`07625d22 : ffffd001`da67ba38 0000000d`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xa4f
ffffd001`da67ba20 fffff803`0735d4b3 : ffffe000`df203080 ffffd001`001f0003 00000000`1e17d468 0000000f`00000001 : nt!NtDeviceIoControlFile+0x56
ffffd001`da67ba90 00007ffa`5770123a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1e17d4e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`5770123a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!NsiEnumerateObjectsAllParametersEx+618
fffff800`d0762878 8bd8            mov     ebx,eax

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  NETIO!NsiEnumerateObjectsAllParametersEx+618

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  540ebbe6

BUCKET_ID_FUNC_OFFSET:  618

FAILURE_BUCKET_ID:  0x139_3_NETIO!NsiEnumerateObjectsAllParametersEx

BUCKET_ID:  0x139_3_NETIO!NsiEnumerateObjectsAllParametersEx

Followup: MachineOwner
---------

2: kd> lmvm NETIO
start             end                 module name
fffff800`d0758000 fffff800`d07d0000   NETIO      (private pdb symbols)  c:\symbol\netio.pdb\1A13EC2D01DC4013A4E57B7EB995FD8F2\netio.pdb
    Loaded symbol image file: NETIO.SYS
    Mapped memory image file: c:\symbol\NETIO.SYS\540EBBE678000\NETIO.SYS
    Image path: \SystemRoot\system32\DRIVERS\NETIO.SYS
    Image name: NETIO.SYS
    Timestamp:        Tue Sep 09 03:35:50 2014 (540EBBE6)
    CheckSum:         0007D1B9
    ImageSize:        00078000
    File version:     6.3.9600.17337
    Product version:  6.3.9600.17337
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.6 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft Windows Operating System
    InternalName:     netio.sys
    OriginalFilename: netio.sys
    ProductVersion:   6.3.9600.17337
    FileVersion:      6.3.9600.17337 (winblue_r3.140908-1537)
    FileDescription:  Network I/O Subsystem


BugCheck 133, {1, 1e00, 0, 0}

Probably caused by : NETIO.SYS ( NETIO!NsiEnumerateObjectsAllParametersEx+618 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000001, The system cumulatively spent an extended period of time at
	DISPATCH_LEVEL or above. The offending component can usually be
	identified with a stack trace.
Arg2: 0000000000001e00, The watchdog period.
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


DPC_TIMEOUT_TYPE:  DPC_QUEUE_EXECUTION_TIMEOUT_EXCEEDED

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT_SERVER

BUGCHECK_STR:  0x133

PROCESS_NAME:  Agent.Service.

CURRENT_IRQL:  d

LAST_CONTROL_TRANSFER:  from fffff8039d389f7e to fffff8039d36eca0

STACK_TEXT:  
fffff803`9ead9c88 fffff803`9d389f7e : 00000000`00000133 00000000`00000001 00000000`00001e00 00000000`00000000 : nt!KeBugCheckEx
fffff803`9ead9c90 fffff803`9d25af67 : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0xadbe
fffff803`9ead9d20 fffff803`9d9ba67f : ffffd000`848e3510 ffffe000`5ce566c8 fffff803`9da069b0 ffffd000`848e3510 : nt!KeClockInterruptNotify+0x787
fffff803`9ead9f40 fffff803`9d2f5143 : fffff803`9da06900 fffff803`9d31d057 00000000`00000000 00000000`00000000 : hal!HalpTimerClockInterrupt+0x4f
fffff803`9ead9f70 fffff803`9d37012a : fffff803`9da06900 ffffe000`5ce566c8 00000000`00000000 00000000`848e3409 : nt!KiCallInterruptServiceRoutine+0xa3
fffff803`9ead9fb0 fffff803`9d37050f : ffffe000`5ce566c8 00000000`24c8e44c ffffe000`5ce566c8 00001f80`008e02e4 : nt!KiInterruptSubDispatchNoLockNoEtw+0xea
ffffd000`848e3130 fffff803`9d2f611e : 00000000`00000000 00000000`00010008 fffff800`a8c668c0 00000000`00000000 : nt!KiInterruptDispatchLBControl+0x11f
ffffd000`848e32c0 fffff803`9d400c2e : fffff803`9d521180 00000000`00000000 fffff803`9d521a60 fffff803`9d4c21a6 : nt!KxWaitForSpinLockAndAcquire+0x22
ffffd000`848e32f0 fffff803`9d2f60f0 : 00000000`00000002 ffffd000`848e3409 ffffd000`848e3409 00000000`00000000 : nt!KiAcquireSpinLockInstrumented+0x62
ffffd000`848e3340 fffff800`a8cd0576 : 00000000`00000002 ffffe000`5ce56010 ffffd000`848e33e0 00000000`00000002 : nt!KeAcquireSpinLockRaiseToDpc+0x40
ffffd000`848e3370 fffff800`a8c0a878 : ffffd000`848e3510 ffffd000`848e3502 00000000`00000000 00000000`00000001 : NDIS!ndisNsiGetAllInterfaceInformation+0x71c
ffffd000`848e3470 fffff800`a9c8ffc1 : ffffe000`629c94f0 ffffe000`00000070 00000000`1e62d360 00000000`00000000 : NETIO!NsiEnumerateObjectsAllParametersEx+0x618
ffffd000`848e3650 fffff800`a9c8fbea : 00000000`00000000 ffffe000`5ebb8460 ffffe000`5ebb8390 00000000`00000000 : nsiproxy!NsippEnumerateObjectsAllParameters+0x201
ffffd000`848e3840 fffff803`9d64377f : 00000000`00000000 ffffe000`5ebb8390 ffffe000`5ebb8390 00000000`00000001 : nsiproxy!NsippDispatch+0x5a
ffffd000`848e3880 fffff803`9d642d22 : ffffd000`848e3a38 0000000d`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xa4f
ffffd000`848e3a20 fffff803`9d37a4b3 : ffffe000`5e79f080 ffffd000`001f0003 00000000`1e62d248 0000000f`00000001 : nt!NtDeviceIoControlFile+0x56
ffffd000`848e3a90 00007fff`f89b123a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1e62d2c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`f89b123a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!NsiEnumerateObjectsAllParametersEx+618
fffff800`a8c0a878 8bd8            mov     ebx,eax

SYMBOL_STACK_INDEX:  b

SYMBOL_NAME:  NETIO!NsiEnumerateObjectsAllParametersEx+618

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  540ebbe6

BUCKET_ID_FUNC_OFFSET:  618

FAILURE_BUCKET_ID:  0x133_ISR_NETIO!NsiEnumerateObjectsAllParametersEx

BUCKET_ID:  0x133_ISR_NETIO!NsiEnumerateObjectsAllParametersEx

Followup: MachineOwner
---------

0: kd> lmvm NETIO
start             end                 module name
fffff800`a8c00000 fffff800`a8c78000   NETIO      (private pdb symbols)  c:\symbol\netio.pdb\1A13EC2D01DC4013A4E57B7EB995FD8F2\netio.pdb
    Loaded symbol image file: NETIO.SYS
    Mapped memory image file: c:\symbol\NETIO.SYS\540EBBE678000\NETIO.SYS
    Image path: \SystemRoot\system32\DRIVERS\NETIO.SYS
    Image name: NETIO.SYS
    Timestamp:        Tue Sep 09 03:35:50 2014 (540EBBE6)
    CheckSum:         0007D1B9
    ImageSize:        00078000
    File version:     6.3.9600.17337
    Product version:  6.3.9600.17337
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.6 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft Windows Operating System
    InternalName:     netio.sys
    OriginalFilename: netio.sys
    ProductVersion:   6.3.9600.17337
    FileVersion:      6.3.9600.17337 (winblue_r3.140908-1537)
    FileDescription:  Network I/O Subsystem
    LegalCopyright:    Microsoft Corporation. All rights reserved.


July 22nd, 2015 3:24pm
Hi,

Make sure if this is network driver related problem:
Restart the server in safe mode with network enabled, if the problem still persists, restart the server in safe mode without network. If the problem doesnt happen, try to update/re-install the network card driver, and then confirm the result.

Besides, you may try to undo the changes(if any) which have been done before this problem happened. and install necessary Windows Update on your server, security update might be helpful for resolving exiting problems.

There are official KBs related, just for your reference:
Bug Check 0x139 KERNEL_SECURITY_CHECK_FAILURE
https://msdn.microsoft.com/en-us/library/windows/hardware/jj569891%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396
Stop error 0x139 in Windows Server 2012 when the thin provisioning threshold is crossed
https://support.microsoft.com/en-us/kb/2867205

Best Regards,
Eve Wang
Free Windows Admin Tool Kit Click here and download it now
July 23rd, 2015 11:02pm
Updating the network drivers and doing the Windows update might had fix it.  I'll monitor it for the next couple weeks to see if there is anymore issue.
July 27th, 2015 6:02pm

Hi,

I look forward to hearing from you.

Best Regards,
Eve Wang
Free Windows Admin Tool Kit Click here and download it now
July 27th, 2015 9:56pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics