Using: C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2601.12001.0_x64__8wekyb3d8bbwe\amd64\kd.exe ************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true EnableRedirectToChakraJsProvider : false -- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.015 seconds ************* Waiting for Debugger Extensions Gallery to Initialize ************** >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.000 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 46 Microsoft (R) Windows Debugger Version 10.0.29507.1001 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\Minidump\030926-32171-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 26100 MP (32 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Kernel base = 0xfffff801`9d600000 PsLoadedModuleList = 0xfffff801`9e4f5100 Debug session time: Mon Mar 9 16:17:08.072 2026 (UTC + 2:00) System Uptime: 0 days 2:22:56.284 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ ............................ Loading User Symbols PEB is paged out (Peb.Ldr = 0000001b`f681c018). Type ".hh dbgerr001" for details Loading unloaded module list .................. For analysis of this file, run !analyze -v 4: kd> kd: Reading initial command '!analyze -v; q' Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ ............................ Loading User Symbols PEB is paged out (Peb.Ldr = 0000001b`f681c018). Type ".hh dbgerr001" for details Loading unloaded module list .................. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_SECURITY_CHECK_FAILURE (139) A kernel component has corrupted a critical data structure. The corruption could potentially allow a malicious user to gain control of this machine. Arguments: Arg1: 000000000000000a, Indirect call guard check detected invalid control transfer. Arg2: 0000000000000000, Address of the trap frame for the exception that caused the BugCheck Arg3: 0000000000000000, Address of the exception record for the exception that caused the BugCheck Arg4: ffff998dc9fed3a0, Reserved Debugging Details: ------------------ KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 6671 Key : Analysis.Elapsed.mSec Value: 5112 Key : Analysis.IO.Other.Mb Value: 0 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 0 Key : Analysis.Init.CPU.mSec Value: 3546 Key : Analysis.Init.Elapsed.mSec Value: 3372 Key : Analysis.Memory.CommitPeak.Mb Value: 93 Key : Analysis.Version.DbgEng Value: 10.0.29507.1001 Key : Analysis.Version.Description Value: 10.2511.5.1 amd64fre Key : Analysis.Version.Ext Value: 1.2511.5.1 Key : Bugcheck.Code.LegacyAPI Value: 0x139 Key : Bugcheck.Code.TargetModel Value: 0x139 Key : Dump.Attributes.AsUlong Value: 0x2180c Key : Dump.Attributes.DiagDataWrittenToHeader Value: 1 Key : Dump.Attributes.ErrorCode Value: 0x0 Key : Dump.Attributes.InsufficientDumpfileSize Value: 1 Key : Dump.Attributes.KernelGeneratedTriageDump Value: 1 Key : Dump.Attributes.LastLine Value: Dump completed successfully. Key : Dump.Attributes.ProgressPercentage Value: 0 Key : Dump.Attributes.RequiredDumpfileSize Value: 0x330b6de71 Key : Failure.Bucket Value: 0x139_a_GUARD_ICALL_CHECK_FAILURE_Wof!WofPreDirectoryControlCallback Key : Failure.Hash Value: {78ac0991-5393-0281-b23b-ce115373dc6d} Key : Hypervisor.Enlightenments.ValueHex Value: 0x7417df84 Key : Hypervisor.Flags.AnyHypervisorPresent Value: 1 Key : Hypervisor.Flags.ApicEnlightened Value: 0 Key : Hypervisor.Flags.ApicVirtualizationAvailable Value: 1 Key : Hypervisor.Flags.AsyncMemoryHint Value: 0 Key : Hypervisor.Flags.CoreSchedulerRequested Value: 0 Key : Hypervisor.Flags.CpuManager Value: 1 Key : Hypervisor.Flags.DeprecateAutoEoi Value: 1 Key : Hypervisor.Flags.DynamicCpuDisabled Value: 1 Key : Hypervisor.Flags.Epf Value: 0 Key : Hypervisor.Flags.ExtendedProcessorMasks Value: 1 Key : Hypervisor.Flags.HardwareMbecAvailable Value: 1 Key : Hypervisor.Flags.MaxBankNumber Value: 0 Key : Hypervisor.Flags.MemoryZeroingControl Value: 0 Key : Hypervisor.Flags.NoExtendedRangeFlush Value: 0 Key : Hypervisor.Flags.NoNonArchCoreSharing Value: 1 Key : Hypervisor.Flags.Phase0InitDone Value: 1 Key : Hypervisor.Flags.PowerSchedulerQos Value: 0 Key : Hypervisor.Flags.RootScheduler Value: 0 Key : Hypervisor.Flags.SynicAvailable Value: 1 Key : Hypervisor.Flags.UseQpcBias Value: 0 Key : Hypervisor.Flags.Value Value: 55185662 Key : Hypervisor.Flags.ValueHex Value: 0x34a10fe Key : Hypervisor.Flags.VpAssistPage Value: 1 Key : Hypervisor.Flags.VsmAvailable Value: 1 Key : Hypervisor.RootFlags.AccessStats Value: 1 Key : Hypervisor.RootFlags.CrashdumpEnlightened Value: 1 Key : Hypervisor.RootFlags.CreateVirtualProcessor Value: 1 Key : Hypervisor.RootFlags.DisableHyperthreading Value: 0 Key : Hypervisor.RootFlags.HostTimelineSync Value: 1 Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled Value: 0 Key : Hypervisor.RootFlags.IsHyperV Value: 1 Key : Hypervisor.RootFlags.LivedumpEnlightened Value: 1 Key : Hypervisor.RootFlags.MapDeviceInterrupt Value: 1 Key : Hypervisor.RootFlags.MceEnlightened Value: 1 Key : Hypervisor.RootFlags.Nested Value: 0 Key : Hypervisor.RootFlags.StartLogicalProcessor Value: 1 Key : Hypervisor.RootFlags.Value Value: 1015 Key : Hypervisor.RootFlags.ValueHex Value: 0x3f7 Key : WER.System.BIOSRevision Value: 1.14.0.0 BUGCHECK_CODE: 139 BUGCHECK_P1: a BUGCHECK_P2: 0 BUGCHECK_P3: 0 BUGCHECK_P4: ffff998dc9fed3a0 FILE_IN_CAB: 030926-32171-01.dmp TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b DUMP_FILE_ATTRIBUTES: 0x2180c Insufficient Dumpfile Size Kernel Generated Triage Dump FAULTING_THREAD: ffff9d89d87020c0 TRAP_FRAME: ffff998dc9fedc40 -- (.trap 0xffff998dc9fedc40) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=ffffcf831e958000 rdx=ffffcf833ef1d040 rsi=0000000000000000 rdi=0000000000000000 rip=fffff8019e1be791 rsp=ffff998dc9feddd0 rbp=ffff998dc9fede71 r8=ffffe40754473a50 r9=0000000000000001 r10=0000000000000000 r11=fbffc2a6bdbc5b58 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!KscpCfgDispatchUserCallTargetEsSmep+0x11: fffff801`9e1be791 4f8b1cd3 mov r11,qword ptr [r11+r10*8] ds:fbffc2a6`bdbc5b58=???????????????? Resetting default scope EXCEPTION_RECORD: 0000000000000000 -- (.exr 0x0) Cannot read Exception record @ 0000000000000000 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 (!blackboxwinlogon) CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: claude.exe DEVICE_OBJECT: 00000000000005a4 STACK_TEXT: ffff998d`c9fecba8 fffff801`9dcb3e1e : 00000000`00000139 00000000`0000000a 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx ffff998d`c9fecbb0 fffff801`9dcb435f : ffff998d`c9fed3a0 00000000`00000000 ffff998d`c9fecc70 00000000`00000000 : nt!guard_icall_handler+0x1e ffff998d`c9fecbe0 fffff801`9d82f942 : ffff998d`c9fecc70 fffff801`9d600000 fffff801`9e1be791 fffff801`9d74a4e4 : nt!RtlpExecuteHandlerForException+0xf ffff998d`c9fecc10 fffff801`9d9e5cef : ffff998d`c9fed3a0 ffff998d`c9fed8a0 ffff998d`c9fed3a0 ffff998d`c9feda60 : nt!RtlDispatchException+0x2d2 ffff998d`c9fed370 fffff801`9dcbee45 : 00000000`00000000 00000000`00000000 ffff998d`c9fedc40 00000000`00000000 : nt!KiDispatchException+0x35f ffff998d`c9feda60 fffff801`9dcb9b25 : 00000000`00000000 00000000`00000004 ffffcf84`8cb79110 ffffcf84`8cb79118 : nt!KiExceptionDispatch+0x145 ffff998d`c9fedc40 fffff801`9e1be791 : fffff801`30f038a5 fffff801`30f0359b ffffe407`544739e0 ffffe407`544739e0 : nt!KiGeneralProtectionFault+0x365 ffff998d`c9feddd0 fffff801`30f038a5 : fffff801`30f0359b ffffe407`544739e0 ffffe407`544739e0 00000000`00000000 : nt!KscpCfgDispatchUserCallTargetEsSmep+0x11 ffff998d`c9feddd8 fffff801`30f02f5e : fffff801`00000000 00000000`00010000 ffffcf83`3ef1d040 ffffcf83`00000001 : Ntfs!FindNextIndexEntry2+0x675 ffff998d`c9fedec8 fffff801`31056472 : fffff801`31056472 ffffcf83`81bea488 ffff9d89`2dc8d1b0 00020000`0078e6d8 : Ntfs!NtfsContinueIndexEnumeration+0x10e ffff998d`c9fedf88 ffff9d89`bda25508 : fffff801`30fb779e ffff9d89`bda25508 ffff9d8a`4e6cd9a0 ffff9d89`2dc8d1b0 : Ntfs!NtfsQueryDirectory+0xd32 ffff998d`c9fee158 fffff801`30fb779e : ffff9d89`bda25508 ffff9d8a`4e6cd9a0 ffff9d89`2dc8d1b0 ffffcf83`81bea180 : 0xffff9d89`bda25508 ffff998d`c9fee160 fffff801`30fb746b : 00000000`00000000 ffff9d8a`4e6cd9a0 00000000`00000000 ffff998d`c9fee381 : Ntfs!NtfsCommonDirectoryControl+0x2ce ffff998d`c9fee1a0 fffff801`9d8cda8b : 00000000`00000000 ffff9d8a`4e6cd9a0 ffff9d89`bda25508 ffff998d`c9fee1c8 : Ntfs!NtfsFsdDirectoryControl+0xcb ffff998d`c9fee210 fffff801`9d8cda03 : 00000000`0000000c 00000000`00000000 00000000`63694d46 fffff801`9e17218d : nt!IopfCallDriver+0x5b ffff998d`c9fee250 fffff801`2f31c4ee : ffff998d`c9fee360 ffff9d89`bd5687c0 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x13 ffff998d`c9fee280 fffff801`2f31ac23 : ffff998d`c9fee318 ffff998d`00010000 ffff9d89`bd568800 ffff998d`c9fee5e0 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3fe ffff998d`c9fee2f0 fffff801`30dd83f5 : ffff9d89`bd5687c0 00000000`0000004e 00000000`00000001 00000000`00000000 : FLTMGR!FltPerformSynchronousIo+0x443 ffff998d`c9fee400 fffff801`2f31baaf : ffff9d8a`43bf10f8 ffff998d`c9fee560 ffff998d`c9fee5e0 ffff9d89`0000004e : Wof!WofPreDirectoryControlCallback+0x695 ffff998d`c9fee4e0 fffff801`2f31b1a0 : ffff998d`c9fee7a0 fffff801`2f310000 00000000`0000000c fffff801`00000000 : FLTMGR!FltpPerformPreCallbacksWorker+0x58f ffff998d`c9fee640 fffff801`2f32c0ef : ffff998d`c9fe8000 00000000`00000000 ffff9d8a`5b673d50 00000000`00000000 : FLTMGR!FltpPassThroughInternal+0xc0 ffff998d`c9fee6f0 fffff801`2f32bb44 : ffff9d8a`2b8cb010 ffff998d`c9fee8c0 ffff9d89`2d656790 00000000`00000000 : FLTMGR!FltpPassThrough+0x29f ffff998d`c9fee740 fffff801`9d8cda8b : ffff9d89`2d656790 00000000`00060800 ffff9d8a`5b673d50 00000000`00030000 : FLTMGR!FltpDispatch+0x264 ffff998d`c9fee7e0 fffff801`9d8cda03 : ffff9d89`d87026d8 00000000`00000000 ffff9d8a`2b8cb030 ffff9d89`d8702600 : nt!IopfCallDriver+0x5b ffff998d`c9fee820 fffff801`9dec34c5 : ffff9d8a`5b673d50 ffff998d`c9fee8c0 ffff9d89`2d656790 00000000`00000000 : nt!IofCallDriver+0x13 ffff998d`c9fee850 fffff801`9dec48d8 : 00000000`000005a4 00000000`00000000 00000000`00000000 ffff9d89`d87020c0 : nt!IopSynchronousServiceTail+0x1c5 ffff998d`c9fee900 fffff801`9dcbec41 : ffff9d89`d87020c0 000001bb`c02526a0 ffff998d`c9feeaa0 000001bb`c0277000 : nt!NtQueryDirectoryFileEx+0xd8 ffff998d`c9fee9b0 00007ffd`2aaa4424 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExitPico+0x496 0000001b`f7bfc328 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`2aaa4424 SYMBOL_NAME: Wof!WofPreDirectoryControlCallback+695 MODULE_NAME: Wof IMAGE_NAME: Wof.sys IMAGE_VERSION: 10.0.26100.5074 STACK_COMMAND: .process /r /p 0xffff9d8a43df3080; .thread 0xffff9d89d87020c0 ; kb BUCKET_ID_FUNC_OFFSET: 695 FAILURE_BUCKET_ID: 0x139_a_GUARD_ICALL_CHECK_FAILURE_Wof!WofPreDirectoryControlCallback OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {78ac0991-5393-0281-b23b-ce115373dc6d} Followup: MachineOwner --------- quit: NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2601.12001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2601.12001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2601.12001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2601.12001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2601.12001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2601.12001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2601.12001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2601.12001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2601.12001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2601.12001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2601.12001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2601.12001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2601.12001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis'