Windows 10 MicrosoftEdgeUpdate.exe caused Bug Check 0x21: QUOTA_UNDERFLOW

M

Manbeartooth

Hello folks!

So I had a BSOD 0x21 this morning right after booting up the OS. It was up for only a few minutes. When I checked the memory DMP with WinDbg it pointed to the MicrosoftEdgeUpdate.exe as the one that cause the quota underflow.

Here is the result of the analysis:


4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

QUOTA_UNDERFLOW (21)
This bugcheck occurs if a kernel component mishandles quota charges and
returns more quota than was previously charged to a particular quota block.
Arguments:
Arg1: 0000000000000000, The process (if any) that was initially charged.
Arg2: 0000000000000001, The quota type in question (paged pool, nonpaged pool, etc.)
Arg3: 00000000400000c0, The initial charge amount to return.
Arg4: 000000003e3995ac, The remaining (unreturned) charge.

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1859

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on MANBEARTOOTHPC

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 1861

Key : Analysis.Memory.CommitPeak.Mb
Value: 79

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 21

BUGCHECK_P1: 0

BUGCHECK_P2: 1

BUGCHECK_P3: 400000c0

BUGCHECK_P4: 3e3995ac

BLACKBOXBSD: 1 (
!blackboxbsd)


BLACKBOXNTFS: 1 (
!blackboxntfs)


BLACKBOXPNP: 1 (
!blackboxpnp)


BLACKBOXWINLOGON: 1

PROCESS_NAME: MicrosoftEdgeUpdate.exe

STACK_TEXT:
ffffed83`63da7488 fffff807`27017ae7 : 00000000`00000021 00000000`00000000 00000000`00000001 00000000`400000c0 : nt!KeBugCheckEx
ffffed83`63da7490 fffff807`2720c666 : ffffed83`63da74f0 ffff8d0c`43d04830 ffffb508`b5ef9da0 fffff807`27853840 : nt!PspReturnQuota+0x1d74f7
ffffed83`63da74f0 fffff807`2720c4f8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpFreeObject+0x116
ffffed83`63da7550 fffff807`26e24eb7 : 00000000`00000000 00000000`00000000 ffffed83`63da76d9 ffff8d0c`43d04860 : nt!ObpRemoveObjectRoutine+0x88
ffffed83`63da75b0 fffff807`271f4bbe : ffffb508`b5ef9da0 00000000`00000000 00000000`00000000 ffffffff`ffffffff : nt!ObfDereferenceObjectWithTag+0xc7
ffffed83`63da75f0 fffff807`272e09a5 : ffffb508`d570d0d8 fffff807`26e22a79 00000000`00000000 00000000`00000000 : nt!ObCloseHandleTableEntry+0x29e
ffffed83`63da7730 fffff807`272c7259 : ffffb508`d570d0a0 ffffb508`bd9e3080 ffffffff`ffffff01 ffffb508`d16664d8 : nt!ExSweepHandleTable+0xd5
ffffed83`63da77e0 fffff807`272ba23f : ffffffff`ffffffff ffffb508`d1666080 ffffed83`63da7830 ffffb508`00000000 : nt!ObKillProcess+0x35
ffffed83`63da7810 fffff807`271e8e32 : ffffb508`d1666080 ffff8d0c`22d30970 00000000`00000000 00000000`00000000 : nt!PspRundownSingleProcess+0x133
ffffed83`63da7890 fffff807`2724e65e : ffffb508`00000000 00000000`00000001 00000000`00000000 00000000`00faa000 : nt!PspExitThread+0x5f6
ffffed83`63da7990 fffff807`26fef475 : ffffb508`d1666080 ffffb508`bd9e3080 ffffed83`63da7a80 ffffb508`d1666080 : nt!NtTerminateProcess+0xde
ffffed83`63da7a00 00000000`77d51cfc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`00caee38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77d51cfc


SYMBOL_NAME: nt!PspReturnQuota+1d74f7

MODULE_NAME:
nt

IMAGE_NAME: ntkrnlmp.exe

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 1d74f7

FAILURE_BUCKET_ID: 0x21_nt!PspReturnQuota

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {e09333c9-b4c4-6d2b-abd9-55f32ac61379}

Followup: MachineOwner
---------


Any thoughts on this error, other than just a random BSOD? Its only happened the one time so far and its Windows... so not super worried unless it continues to happen ;)

Thanks for any insights!


Continue reading...
 
Top Bottom