2: kd> .bugcheck
Bugcheck code 00000050
Arguments ffffb68f`e762ef30 00000000`00000000 fffff803`f25835ad 00000000`00000000
2: kd> !thread
THREAD ffff8c04487d7080 Cid 1b18.1bf8 Teb: 00000000005b1000 Win32Thread: ffff8c04481990b0 RUNNING on processor 2
IRP List:
ffff8c044b1f19a0: (0006,0358) Flags: 00000884 Mdl: 00000000
Unable to read nt!_IRP @ ffff8c0446cf5c70
Not impersonating
GetUlongFromAddress: unable to read from fffff8067e030a24
Owning Process ffff8c044887d080 Image: explorer.exe
Attached Process N/A Image: N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount 158839
Context Switch Count 3693 IdealProcessor: 2
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00007ffea93cdc00
Stack Init ffff8a0d3e125c90 Current ffff8a0d3e125480
Base ffff8a0d3e126000 Limit ffff8a0d3e120000 Call 0000000000000000
Priority 12 BasePriority 8 PriorityDecrement 2 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
ffff8a0d`3e124808 fffff806`7de31fc1 : 00000000`00000050 ffffb68f`e762ef30 00000000`00000000 ffff8a0d`3e124ab0 : nt!KeBugCheckEx
ffff8a0d`3e124810 fffff806`7dccd1af : 00000000`00000110 00000000`00000000 00000000`00000000 ffffb68f`e762ef30 : nt!MiSystemFault+0x195f21
ffff8a0d`3e124910 fffff806`7ddd441e : 00000000`00000000 fffff806`7e56c349 00000000`00000000 ffff8a0d`3e120000 : nt!MmAccessFault+0x34f
ffff8a0d`3e124ab0 fffff803`f25835ad : fffff806`7dca7910 ffff8c04`46746d50 ffff8c04`3d046390 00000000`ffffffff : nt!KiPageFault+0x35e (TrapFrame @ ffff8a0d`3e124ab0)
ffff8a0d`3e124c48 fffff806`7dca7910 : ffff8c04`46746d50 ffff8c04`3d046390 00000000`ffffffff ffff8c04`4c6c5230 : vmhgfs+0x35ad
ffff8a0d`3e124c50 fffff803`f2583dd4 : 00000000`00000000 ffff8c04`4b8b8f70 00000000`00000001 fffff806`7ef3c436 : nt!RtlLookupElementGenericTable+0x30
ffff8a0d`3e124c80 00000000`00000000 : ffff8c04`4b8b8f70 00000000`00000001 fffff806`7ef3c436 ffff8a0d`3e124cb0 : vmhgfs+0x3dd4
2: kd> !irp ffff8c044b1f19a0 1
Irp is active with 4 stacks 2 is current (= 0xffff8c044b1f1ab8)
No Mdl: No System Buffer: Thread ffff8c04487d7080: Irp stack trace.
Flags = 00000884
ThreadListEntry.Flink = ffff8c0446cf5c90
ThreadListEntry.Blink = ffff8c04487d7700
IoStatus.Status = 00000000
IoStatus.Information = 00000000
RequestorMode = 00000001
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = ffff8a0d3e1254b0
UserEvent = 00000000
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = fffff8067dd82e40 nt!IopCsqCancelRoutine
UserBuffer = ffffb68fe0c16040
&Tail.Overlay.DeviceQueueEntry = ffff8c044b1f1a18
Tail.Overlay.Thread = ffff8c04487d7080
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = ffff8c044665efa8
Tail.Overlay.ListEntry.Blink = ffff8c044665efa8
Tail.Overlay.CurrentStackLocation = ffff8c044b1f1ab8
Tail.Overlay.OriginalFileObject = ffff8c044d10def0
Tail.Apc = 4c6c5000
Tail.CompletionKey = ffff8c044c6c5000
cmd flg cl Device File Completion-Context
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
>[IRP_MJ_CREATE(0), N/A(0)]
0 e1 ffff8c044792b9d0 ffff8c044d10def0 fffff806806d1880-ffff8c044946f8d0 Success Error Cancel pending
\FileSystem\vmhgfs mup!MupiUncProviderCompletion
Args: ffff8a0d3e1254e0 01200000 00070000 00000000
[IRP_MJ_CREATE(0), N/A(0)]
0 e0 ffff8c043f8d1c60 ffff8c044d10def0 fffff8067ed1c070-ffff8c04492d59b0 Success Error Cancel
\FileSystem\Mup FLTMGR!FltpSynchronizedOperationCompletion
Args: ffff8a0d3e1254e0 01200000 00070000 00000000
[IRP_MJ_CREATE(0), N/A(0)]
0 0 ffff8c043f66ac20 ffff8c044d10def0 00000000-00000000
\FileSystem\FltMgr
Args: ffff8a0d3e1254e0 01200000 00070000 00000000
2: kd> lmvm vmhgfs
Browse full module list
start end module name
fffff803`f2580000 fffff803`f25ab000 vmhgfs T (no symbols)
Loaded symbol image file: vmhgfs.sys
Image path: vmhgfs.sys
Image name: vmhgfs.sys
Browse all global symbols functions data
Timestamp: Fri Jul 26 06:02:51 2019 (5D3A7B6B)
CheckSum: 0002EDA7
ImageSize: 0002B000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
