According to the DRT, it's some third-party driver which provides wrapper functions for port I/O, it'll be a driver which likely used by many different applications. Most likely used by some fan speed or hardware monitoring program.
How do you know that? From the dump file you've provided, I don't see any evidence to suggest that is the case.
Rich (BB code):
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffe78a99f28cd0, Virtual address for the attempted execute.
Arg2: 8a0000018c8009e3, PTE contents.
Arg3: ffff950abd22e550, (reserved) << Trap frame address which you can use with .trap
Arg4: 0000000000000003, (reserved)
The system crashes because something has attempted to execute some code inside of an non-executable page.
Rich (BB code):
1: kd> !pte ffffe78a99f28cd0
VA ffffe78a99f28cd0
PXE at FFFFCCE673399E78 PPE at FFFFCCE6733CF150 PDE at FFFFCCE679E2A678 PTE at FFFFCCF3C54CF940
contains 0A000000056CF863 contains 0A000000053D2863 contains 8A0000018C8009E3 contains 0000000000000000
pfn 56cf ---DA--KWEV pfn 53d2 ---DA--KWEV pfn 18c800 -GLDA--KW-V LARGE PAGE pfn 18c928
Large pages don't have PTEs associated with them so you'll need to check the PDE instead. Notice how the executable bit is clear? This is why the page fault gets raised which then does the NX fault check and crashes the system.
The PTE contents in the second parameter is a bitfield which is already parsed for you by !pte.
Rich (BB code):
1: kd> !load pde; !dpx
=========================================================================================
PDE v11.3 - Copyright 2017 Andrew Richards
=========================================================================================
Start memory scan : 0xffff950abd22e318 ($csp)
End memory scan : 0xffff950abd230000 (Kernel Stack Base)
r9 : 0xffff950abd22e550 : 0xfffff80257ae129b : WppRecorder!WppAutoLogTrace+0x16b
r11 : 0xffff950abd22e548 : 0xfffff80254a0c8d8 : nt!KiPageFault+0x358
0xffff950abd22e338 : 0xffff950abd22e550 : 0xfffff80257ae129b : WppRecorder!WppAutoLogTrace+0x16b
0xffff950abd22e350 : 0xffff950abd22e550 : 0xfffff80257ae129b : WppRecorder!WppAutoLogTrace+0x16b
0xffff950abd22e398 : 0xffff950abd22e550 : 0xfffff80257ae129b : WppRecorder!WppAutoLogTrace+0x16b
0xffff950abd22e3a8 : 0xfffff8025483081f : nt!MmAccessFault+0x4ef
0xffff950abd22e480 : 0xffff950abd22e550 : 0xfffff80257ae129b : WppRecorder!WppAutoLogTrace+0x16b
0xffff950abd22e530 : 0xfffff802940a2285 : ucx01000!RootHub_Pdo_EvtInternalDeviceControlIrpPreprocessCallback+0xb5
0xffff950abd22e548 : 0xfffff80254a0c8d8 : nt!KiPageFault+0x358
0xffff950abd22e550 : 0xfffff80257ae129b : WppRecorder!WppAutoLogTrace+0x16b Trap @ ffff950abd22e550
0xffff950abd22e570 : 0xffffe78aa6dab020 : dt Wdf01000!FxRequestFromLookaside
Unable to load image \SystemRoot\System32\drivers\RzDev_0098.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for RzDev_0098.sys
0xffff950abd22e588 : 0xfffff80256369080 : mouclass!WPP_MAIN_CB
0xffff950abd22e5a8 : 0xfffff80254938a80 : nt!IoReleaseRemoveLockEx
0xffff950abd22e630 : 0xfffff80256369008 : mouclass!WPP_RECORDER_INITIALIZED
0xffff950abd22e640 : 0xfffff80256365073 : mouclass!MouseClassServiceCallback+0x493
*** WARNING: Unable to verify timestamp for win32kbase.sys
0xffff950abd22e698 : 0xffffe78a848fde20 : dt Wdf01000!FxRequestFromLookaside
0xffff950abd22e6f8 : 0xfffff802940a2285 : ucx01000!RootHub_Pdo_EvtInternalDeviceControlIrpPreprocessCallback+0xb5
0xffff950abd22e718 : 0xffffe78a99f28c60 : dt Wdf01000!FxSpinLock
Unable to load image \SystemRoot\System32\drivers\RzCommon.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for RzCommon.sys
0xffff950abd22e788 : 0xfffff802579da977 : Wdf01000!FxDevice::DispatchWithLock+0x267
Those two mentioned drivers (RzCommon.sys & RzDev_0098.sys) are most likely going to be Razer mouse drivers.
