Microsoft (R) Windows Debugger Version 10.0.22415.1003 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Temp\BenW_Minidump\092221-9796-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available ************* Path validation summary ************** Response Time (ms) Location Deferred set _NT_SYMBOL_PATH=srv*C:\LocalSymbols*https://msdl.microsoft.com/download/symbols Deferred srv* Symbol search path is: set _NT_SYMBOL_PATH=srv*C:\LocalSymbols*https://msdl.microsoft.com/download/symbols;srv* Executable search path is: Windows 10 Kernel Version 19041 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Edition build lab: 19041.1.amd64fre.vb_release.191206-1406 Machine Name: Kernel base = 0xfffff802`3c000000 PsLoadedModuleList = 0xfffff802`3cc2a3d0 Debug session time: Wed Sep 22 16:35:09.911 2021 (UTC - 5:00) System Uptime: 0 days 0:04:13.615 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ Loading User Symbols Loading unloaded module list ................... For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff802`3c3f5e40 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff8b86`6d3a5110=000000000000001e 14: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common BugCheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff80242ee321d, The address that the exception occurred at Arg3: ffff8b866d3a6148, Parameter 0 of the exception Arg4: ffff8b866d3a5980, Parameter 1 of the exception Debugging Details: ------------------ *** WARNING: Unable to verify timestamp for FortiFilter.sys KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 7405 Key : Analysis.DebugAnalysisManager Value: Create Key : Analysis.Elapsed.mSec Value: 36484 Key : Analysis.Init.CPU.mSec Value: 499 Key : Analysis.Init.Elapsed.mSec Value: 4139 Key : Analysis.Memory.CommitPeak.Mb Value: 80 Key : WER.OS.Branch Value: vb_release Key : WER.OS.Timestamp Value: 2019-12-06T14:06:00Z Key : WER.OS.Version Value: 10.0.19041.1 BUGCHECK_CODE: 1e BUGCHECK_P1: ffffffffc0000005 BUGCHECK_P2: fffff80242ee321d BUGCHECK_P3: ffff8b866d3a6148 BUGCHECK_P4: ffff8b866d3a5980 WRITE_ADDRESS: fffff8023ccfb390: Unable to get MiVisibleState Unable to get NonPagedPoolStart Unable to get NonPagedPoolEnd Unable to get PagedPoolStart Unable to get PagedPoolEnd unable to get nt!MmSpecialPagesInUse ffff8b866d3a5980 EXCEPTION_PARAMETER1: ffff8b866d3a6148 EXCEPTION_PARAMETER2: ffff8b866d3a5980 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: FortiSSLVPNdaemon.exe STACK_TEXT: ffff8b86`6d3a5108 fffff802`3c50f08f : 00000000`0000001e ffffffff`c0000005 fffff802`42ee321d ffff8b86`6d3a6148 : nt!KeBugCheckEx ffff8b86`6d3a5110 fffff802`3c411f76 : ffff8b86`6d3a5980 fffff802`3c3038a5 ffff8b86`6d3a6380 fffff802`42ee321d : nt!KiFatalFilter+0x1f ffff8b86`6d3a5150 fffff802`3c3cc0ef : fffff802`00000002 fffff802`3c0d8e34 ffff8b86`6d3a1000 ffff8b86`6d3a8000 : nt!KeExpandKernelStackAndCalloutInternal$filt$0+0x16 ffff8b86`6d3a5190 fffff802`3c3fecff : fffff802`3c0d8e34 ffff8b86`6d3a5770 fffff802`3c3cc050 00000000`00000000 : nt!_C_specific_handler+0x9f ffff8b86`6d3a5200 fffff802`3c32bff7 : ffff8b86`6d3a5770 00000000`00000000 ffff8b86`6d3a6900 fffff802`3c354518 : nt!RtlpExecuteHandlerForException+0xf ffff8b86`6d3a5230 fffff802`3c32abe6 : ffff8b86`6d3a6148 ffff8b86`6d3a5e80 ffff8b86`6d3a6148 00000000`00000000 : nt!RtlDispatchException+0x297 ffff8b86`6d3a5950 fffff802`3c407eac : 00000000`000001cb 00000000`00000000 00000000`00000000 00000000`00000280 : nt!KiDispatchException+0x186 ffff8b86`6d3a6010 fffff802`3c403be0 : 00000000`00000001 fffff802`3c28a8f2 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0x12c ffff8b86`6d3a61f0 fffff802`42ee321d : ffff8f04`986cac10 ffff8f04`99ac01a0 00000000`00400000 ffff8f04`921e7dc0 : nt!KiGeneralProtectionFault+0x320 ffff8b86`6d3a6380 fffff802`42f20809 : 00000000`00000000 ffff8f04`99a24a21 00000000`00000020 00000000`00000000 : ndis!ndisNblTrackerTransferOwnershipInternal+0xa1 ffff8b86`6d3a6400 fffff802`42f82db4 : ffff8f04`986cac10 ffff8f04`99ac0000 00000000`00000000 8a000003`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x3ea99 ffff8b86`6d3a64e0 fffff802`42f82a78 : ffff8f04`99ac01a0 1a000003`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateSplitNblChain+0x320 ffff8b86`6d3a6580 fffff802`42ee1d56 : 00000000`00000000 00000000`00000000 ffff8f04`9a957740 00000000`00000030 : ndis!ndisMIndicateReceiveNblsWithThrottling+0x38 ffff8b86`6d3a65c0 fffff802`42f1dbdf : ffff8f04`99ac01a0 fffff802`3c20fcf7 ffff8b86`6d3a67e0 00000000`00000000 : ndis!ndisMTopReceiveNetBufferLists+0x2b6 ffff8b86`6d3a6640 fffff802`42f23301 : 00000000`00000000 ffff8f04`91fa0c70 00000000`00000000 ffff8f04`870fd9b0 : ndis!ndisInvokeNextReceiveHandler+0x4b ffff8b86`6d3a6710 fffff802`42ee804e : ffff8f04`91fa0c70 ffff8f04`921e7dc0 00000000`00000000 00000000`00000001 : ndis!ndisFilterIndicateReceiveNetBufferLists+0x3be91 ffff8b86`6d3a67c0 fffff802`50fb1ceb : 00000000`00000000 00000000`00000000 ffff8f04`98e3ba20 ffff8f04`921e7dc0 : ndis!NdisFIndicateReceiveNetBufferLists+0x6e ffff8b86`6d3a6800 00000000`00000000 : 00000000`00000000 ffff8f04`98e3ba20 ffff8f04`921e7dc0 00000000`00000000 : FortiFilter+0x1ceb SYMBOL_NAME: FortiFilter+1ceb MODULE_NAME: FortiFilter IMAGE_NAME: FortiFilter.sys STACK_COMMAND: .thread ; .cxr ; kb BUCKET_ID_FUNC_OFFSET: 1ceb FAILURE_BUCKET_ID: 0x1E_c0000005_FortiFilter!unknown_function OS_VERSION: 10.0.19041.1 BUILDLAB_STR: vb_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {7954c1ab-c6e7-b4a8-4a31-a6f0cc5cfac2} Followup: MachineOwner ---------