KMODE_EXECPETION_NOT_HANDLED

Robin Wade · Mar 19, 2025

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: 00000027ee394915, The address that the exception occurred at
Arg3: 0000000000000008, Parameter 0 of the exception
Arg4: 00000027ee394915, Parameter 1 of the exception

Debugging Details:
------------------

*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ExceptionRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ContextRecord ***
*** ***
*************************************************************************

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2515

Key : Analysis.Elapsed.mSec
Value: 3597

Key : Analysis.IO.Other.Mb
Value: 0

Key : Analysis.IO.Read.Mb
Value: 1

Key : Analysis.IO.Write.Mb
Value: 0

Key : Analysis.Init.CPU.mSec
Value: 500

Key : Analysis.Init.Elapsed.mSec
Value: 3261

Key : Analysis.Memory.CommitPeak.Mb
Value: 113

Key : Analysis.Version.DbgEng
Value: 10.0.27793.1000

Key : Analysis.Version.Description
Value: 10.2410.02.02 amd64fre

Key : Analysis.Version.Ext
Value: 1.2410.2.2

Key : Bugcheck.Code.LegacyAPI
Value: 0x1e

Key : Bugcheck.Code.TargetModel
Value: 0x1e

Key : Dump.Attributes.AsUlong
Value: 0x21808

Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1

Key : Dump.Attributes.ErrorCode
Value: 0x0

Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1

Key : Dump.Attributes.LastLine
Value: Dump completed successfully.

Key : Dump.Attributes.ProgressPercentage
Value: 0

Key : Failure.Bucket
Value: AV_win32kbase!EtwTraceAcquireExclusiveUserCrit

Key : Failure.Exception.IP.Address
Value: 0x27ee394915

Key : Failure.Hash
Value: {e9b4d84a-dbaf-7c0d-c95b-415d80b8a958}

Key : Hypervisor.Enlightenments.ValueHex
Value: 0x7497cf94

Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key : Hypervisor.Flags.ApicEnlightened
Value: 1

Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 0

Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key : Hypervisor.Flags.CpuManager
Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 0

Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key : Hypervisor.Flags.Epf
Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key : Hypervisor.Flags.MaxBankNumber
Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key : Hypervisor.Flags.Phase0InitDone
Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key : Hypervisor.Flags.RootScheduler
Value: 0

Key : Hypervisor.Flags.SynicAvailable
Value: 1

Key : Hypervisor.Flags.UseQpcBias
Value: 0

Key : Hypervisor.Flags.Value
Value: 38408431

Key : Hypervisor.Flags.ValueHex
Value: 0x24a10ef

Key : Hypervisor.Flags.VpAssistPage
Value: 1

Key : Hypervisor.Flags.VsmAvailable
Value: 1

Key : Hypervisor.RootFlags.AccessStats
Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key : Hypervisor.RootFlags.IsHyperV
Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key : Hypervisor.RootFlags.Nested
Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key : Hypervisor.RootFlags.Value
Value: 1015

Key : Hypervisor.RootFlags.ValueHex
Value: 0x3f7

BUGCHECK_CODE: 1e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: 27ee394915

BUGCHECK_P3: 8

BUGCHECK_P4: 27ee394915

FILE_IN_CAB: 031725-6562-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b

DUMP_FILE_ATTRIBUTES: 0x21808
Kernel Generated Triage Dump

FAULTING_THREAD: ffffb903822420c0

EXCEPTION_PARAMETER1: 0000000000000008

EXCEPTION_PARAMETER2: 00000027ee394915

WRITE_ADDRESS: fffff803a85c34b0: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
00000027ee394915

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: RainbowSix.exe

STACK_TEXT:
fffffe8d`4b4ad5b8 fffff803`a799c176 : 00000000`0000001e ffffffff`c0000005 00000027`ee394915 00000000`00000008 : nt!KeBugCheckEx
fffffe8d`4b4ad5c0 fffff803`a7c8d045 : 00000000`c0000005 00000000`00000000 fffffe8d`4b4add58 fffffe8d`4b4ade00 : nt!KiDispatchException+0xb16
fffffe8d`4b4adcd0 fffff803`a7c88182 : ffffb903`822420c0 00000000`00000000 00000000`00000001 000001a2`b5876d18 : nt!KiExceptionDispatch+0x145
fffffe8d`4b4adeb0 00000027`ee394915 : 00000000`00000001 fffff803`4e74b43d 00000004`07dba837 0000006c`8beff8f0 : nt!KiPageFault+0x442
fffffe8d`4b4ae040 00000000`00000001 : fffff803`4e74b43d 00000004`07dba837 0000006c`8beff8f0 ffffb903`8154cc90 : 0x00000027`ee394915
fffffe8d`4b4ae048 fffff803`4e74b43d : 00000004`07dba837 0000006c`8beff8f0 ffffb903`8154cc90 00000000`00000001 : 0x1
fffffe8d`4b4ae050 fffff803`4e8e3a68 : 00000000`00000000 00000000`00000001 ffffb903`8154cc90 fffff803`4e7dfd70 : win32kbase!EtwTraceAcquireExclusiveUserCrit+0x5d
fffffe8d`4b4ae080 fffff803`4e8ae4a0 : 00000000`ffffffff 00000000`00000000 00000000`00000000 00000000`00040202 : win32kbase!UserCritInternal::`anonymous namespace'::EnterCritInternal+0x60
fffffe8d`4b4ae0b0 fffff803`4f776ee6 : 00000000`ffffffff 00000000`00000001 00000000`000014ff 00000000`00000001 : win32kbase!EnterCrit+0x50
fffffe8d`4b4ae0e0 fffff803`393a10fd : 00000000`000014ff 000001a2`b5876d18 ffffb903`ffffffff 00007ffc`000014ff : win32kfull!NtUserMsgWaitForMultipleObjectsEx+0x46
fffffe8d`4b4aea30 fffff803`a7c8c558 : ffffb903`822420c0 fffffe8d`4b4aeb60 0000006c`8beff8d8 000001a2`b5875000 : win32k!NtUserMsgWaitForMultipleObjectsEx+0x5d
fffffe8d`4b4aea70 00007ffc`e412ac94 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000006c`8beff8b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`e412ac94

SYMBOL_NAME: win32kbase!EtwTraceAcquireExclusiveUserCrit+5d

MODULE_NAME: win32kbase

IMAGE_NAME: win32kbase.sys

IMAGE_VERSION: 10.0.26100.3470

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: 5d

FAILURE_BUCKET_ID: AV_win32kbase!EtwTraceAcquireExclusiveUserCrit

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {e9b4d84a-dbaf-7c0d-c95b-415d80b8a958}

Followup: MachineOwner

Help please.
Click to expand...

:)