BSoD "CRITICAL_PROCESS_DIED" when terminate all sandboxed programs #1316

0x391F · 2021-10-20T08:42:26Z

Describe the bug
BSoD "CRITICAL_PROCESS_DIED" when terminate all sandboxed programs.

To Reproduce
Steps to reproduce the behavior:

Run some programs in Sandboxie.
Click on 'Terminate All Programs'
BSoD "CRITICAL_PROCESS_DIED"

System details and installed software

What is your Windows edition and version?
Windows 10 Enterprise LTSC 2019 x64
What is your current Sandboxie edition and version?
Sandboxie Plus 0.9.8 and Sandboxie 5.53.0 (64-bit)
What was your previous Sandboxie version before the update, if any?
Please mention in which version this bug got introduced, because it acts as a guide for testers and developers.
Please mention any security software running in the background, even if the real-time protection is disabled.

If you have a compatibility issue

Please add a reference link to the program not working properly in Sandboxie.
Please consider to take a log and make it available for analysis: https://git.io/Jwj2y

Additional context
Add any other context about the problem here.

Sandboxie configuration
If applicable, consider to attach your Sandboxie.ini configuration by copying the content on https://gist.github.com and sharing the resulting link. If you decide to paste the configuration here, make sure to use the backticks around strings, like in this working example:

My initial sandboxie.ini settings


[GlobalSettings]

.....

[UserSettings_175D0429]

.....

[DefaultBox]

.....

The text was updated successfully, but these errors were encountered:

DavidXanatos · 2021-10-20T10:38:54Z

do you have a crash dump?
do you know which process died?
is the problem reproducable or a one of occurence?

Zymlex · 2021-10-20T13:23:12Z

I have encountered such a very rare BSOD, in one case was associated with kill of a single process through SandMan. I was not sure that this is not a hardware problem.

ghost · 2021-10-21T10:27:43Z

It was happening for me every time I have tried to shutdown my laptop on Windows 10. Now I have Windows 11. Shutdown seems to work fine. I had only one BSOD but dump was not generated for some reason

Zymlex · 2021-10-21T10:32:07Z

You can use this program to view: https://www.nirsoft.net/utils/blue_screen_view.html the main thing is to select the correct dump in the C:\Windows\MiniDump folder

ghost · 2021-10-21T16:17:30Z

Windbg is better

ghost · 2021-10-22T07:14:37Z

I receive memory management bsod when restarting the computer when Classic v5.51.6 in installed. However I can not be sure it is cause by sandboxie. Anyway, it is the fastest working version my slow pc with Windows 11.
On the other hand v5.53.1 has some hiccups after starting Chrome and it is not so responsive. I will let you know if I still get BSOD. No far no minidumps were created

ImSpecial · 2021-11-10T07:12:12Z

Throwing my hat into the ring too, I've experienced this twice since upgrading from 5.51.5 to 5.53.3, I don't know the cause, it seems pretty rare, but both times, when doing the "terminate all" thing, a BSOD happened.

ghost · 2021-12-23T21:19:59Z

It happens every time I shut down my PC. However dump is never generated. It is enabled though. What's more, it does not seem to happen on restart. It did it on Windows 10 and it still does it after upgrading to Windows 11

ghost · 2021-12-27T22:52:48Z

There is a Windows glitch. If you manually select to use pagefile exclusively on systemdrive, it warns you that minidumps may not be generated at all. They are generated but somehow not saved.
I switched the pagefile setting to system managed on all drives. So it should finally generate a minidump next time

shenm233 · 2022-05-09T15:13:20Z

I also encountered this problem, it may be caused by SbieSvc.exe process.
Software Environment: Windows 10 21H2(19044.1645), Sandboxie v1.0.20 / 5.55.20

windbg_memorydump.txt
memory.dump

3: kd> !thread
THREAD ffffc90972d82080 Cid 0c38.0c9c Teb: 000000883adab000 Win32Thread: 0000000000000000 RUNNING on processor 3
Not impersonating
DeviceMap ffffdc8601446720
Owning Process ffffc90972d650c0 Image: SbieSvc.exe
Attached Process ffffc909721f3080 Image: svchost.exe
Wait Start TickCount 3617322 Ticks: 0
Context Switch Count 1214289 IdealProcessor: 0
UserTime 00:00:07.671
KernelTime 00:00:22.078
Win32 Start Address 0x00007ff6c3d754c0
Stack Init fffffd8c3e3efb90 Current fffffd8c3e3eec70
Base fffffd8c3e3f0000 Limit fffffd8c3e3e9000 Call 0000000000000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
fffffd8c3e3ef838 fffff80669d087e2 : 00000000000000ef ffffc909721f3080 0000000000000000 0000000000000000 : nt!KeBugCheckEx
fffffd8c3e3ef840 fffff80669c0ff81 : 0000000000000000 fffff806696fd8ad 0000000000000002 fffff806696fcec7 : nt!PspCatchCriticalBreak+0x10e
fffffd8c3e3ef8e0 fffff80669ab5b94 : ffffc90900000000 0000000000000000 ffffc909721f3080 ffffc909721f34b8 : nt!PspTerminateAllThreads+0x15ab25
fffffd8c3e3ef950 fffff80669ab5ebc : ffffc90972d650c0 0000000000000000 0000000000000001 0000000000000c9c : nt!PspTerminateProcess+0xe0
fffffd8c3e3ef990 fffff806698092b5 : ffffc909721f3080 ffffc90972d82080 fffffd8c3e3efa80 ffffc90900000000 : nt!NtTerminateProcess+0x9c
fffffd8c3e3efa00 00007ffa4f6ed2f4 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x25 (TrapFrame @ fffffd8c3e3efa00) 000000883bcfea18 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 00000000`00000000 : ntdll!NtTerminateProcess+0x14

ghost · 2022-05-10T20:14:35Z

My apologies. i found out this BSOD was occurring due to Veracrypt issue and only at end of shutting down PC

Zymlex · 2022-05-30T08:15:23Z

It looks like after the updates my problem was solved.

isaak654 · 2022-07-28T13:35:55Z

@0x391F Does this still happen to you?

0x391F · 2022-07-29T10:46:57Z

No, I think.

darkred · 2022-09-15T17:51:33Z

The issue occurred to me.
Software Environment: Windows 11 21H2 x64 (22000.978), Sandboxie Plus v1.3.3 .

BSOD 'CRITICAL_PROCESS_DIED' while terminating all sandboxed programs.

I attach the minidump itself.
Minidump.zip

I also attach the WinDbg output of both the minidump and the MEMORY.dmp:
windbg_minidump.txt
windbg_memorydump.txt

The latter reveals that the BSOD is caused by SbieSvc.exe process.
Also, the latter file is in essence the same as the 2nd attachement of #1316 (comment) .

!thread output:

0: kd> !thread
THREAD ffffd28188bea080  Cid 0cf0.0d98  Teb: 000000da571d6000 Win32Thread: 0000000000000000 RUNNING on processor 0
Not impersonating
DeviceMap                 ffff8f8ce243abc0
Owning Process            ffffd28188baa0c0       Image:         SbieSvc.exe
Attached Process          ffffd281882020c0       Image:         svchost.exe
Wait Start TickCount      5435070        Ticks: 0
Context Switch Count      724745         IdealProcessor: 5
UserTime                  00:00:05.218
KernelTime                00:00:17.703
Win32 Start Address 0x00007ff684f85980
Stack Init ffffba8e071dfb70 Current ffffba8e071df620
Base ffffba8e071e0000 Limit ffffba8e071d9000 Call 0000000000000000
Priority 9 BasePriority 8 PriorityDecrement 16 IoPriority 2 PagePriority 5
Child-SP          RetAddr               : Args to Child                                                           : Call Site
ffffba8e`071df818 fffff801`123ad493     : 00000000`000000ef ffffd281`882020c0 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
ffffba8e`071df820 fffff801`122dfd6f     : ffffd281`882020c0 fffff801`11c4376d 00000000`00000002 fffff801`11c4365b : nt!PspCatchCriticalBreak+0x11b
ffffba8e`071df8b0 fffff801`120c4194     : ffffd281`882020c0 00000000`00000001 ffffd281`882020c0 00000000`00000101 : nt!PspTerminateAllThreads+0x121e2b
ffffba8e`071df920 fffff801`120c3f70     : ffffffff`ffffffff ffffd281`88baa0c0 ffffd281`88bea080 00000000`00000001 : nt!PspTerminateProcess+0xe0
ffffba8e`071df960 fffff801`11e2d375     : ffffd281`00000410 ffffd281`88bea080 ffffd281`882020c0 ffffd281`00000000 : nt!NtTerminateProcess+0xb0
ffffba8e`071df9e0 00007ffb`6c2a4104     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25 (TrapFrame @ ffffba8e`071df9e0)
000000da`595fe9f8 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!NtTerminateProcess+0x14

At the time of the BSOD I had opened this program (extract zip, then rightclick SUMo.exe | 'Run Sandboxed' and tick the 'Run As UAC Administrator' administrator).

isaak654 · 2022-11-19T13:40:00Z

@shenm233 @darkred

At the time of the BSOD I had opened this program (extract zip, then rightclick SUMo.exe | 'Run Sandboxed' and tick the 'Run As UAC Administrator' administrator).

I can't reproduce it with current build v1.5.3 x64 - W10 21H2 x64 + W11 22H2 x64 (empty standard sandboxes).

0x391F · 2022-11-21T02:22:57Z

This bug reproduce today. I run VMware Workstation Pro (17.0.0 build-20800274) in sandbox and a VM is running, then delete contents without terminate all process manually, then BSoD "CRITICAL_PROCESS_DIED" happens.

offhub · 2022-11-27T18:33:31Z

I had this bsod yesterday too on Hyper-V.

APMichael · 2023-03-06T11:11:11Z

@DavidXanatos Are there any findings here? Unfortunately, I also have a BSoD every few weeks (sometimes after months). It always happens when a main program (e.g. Firefox, Edge) is closed and therefore the sandbox is cleaned and closed. I guess it requires some special timing or something, since I haven't managed to reproduce it manually yet either. It is now also happened under the current version 1.8.0. Do you possibly need the memory dump?

ghost · 2023-03-06T14:30:05Z

Do you use any AV or disk encryption software? I guess the dump or windbg analysis is always needed in such case

APMichael · 2023-03-06T16:14:52Z

Do you use any AV or disk encryption software? I guess the dump or windbg analysis is always needed in such case

Just Windows 10's Defender and no encryption software either. I'll send @DavidXanatos the crash/memory dumps if he wants them.

DavidXanatos · 2023-03-06T17:49:16Z

Do you use any AV or disk encryption software? I guess the dump or windbg analysis is always needed in such case

Just Windows 10's Defender and no encryption software either. I'll send @DavidXanatos the crash/memory dumps if he wants them.

yes please

pulsarclarinetokrabee · 2024-05-17T07:25:32Z

In the past few days I've had three BSOD crashes caused by the same issue, upon closing the last sandboxed program the crash occurs. Same configuration as listed here. I will try to downgrade to the previous Sandboxie release and report if there are any changes.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_PROCESS_DIED (ef)
        A critical system process died
Arguments:
Arg1: ffff9485f9cd20c0, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: ffff9485fa98e080, The process object that initiated the termination.
Arg4: 0000000000000000

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 9499

    Key  : Analysis.Elapsed.mSec
    Value: 16898

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 906

    Key  : Analysis.Init.Elapsed.mSec
    Value: 26155

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 92

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0xef

    Key  : Bugcheck.Code.TargetModel
    Value: 0xef

    Key  : CriticalProcessDied.ExceptionCode
    Value: fa9bd080

    Key  : CriticalProcessDied.Process
    Value: LsaIso.exe

    Key  : Dump.Attributes.AsUlong
    Value: 1808

    Key  : Dump.Attributes.DiagDataWrittenToHeader
    Value: 1

    Key  : Dump.Attributes.ErrorCode
    Value: 0

    Key  : Dump.Attributes.KernelGeneratedTriageDump
    Value: 1

    Key  : Dump.Attributes.LastLine
    Value: Dump completed successfully.

    Key  : Dump.Attributes.ProgressPercentage
    Value: 0

    Key  : Failure.Bucket
    Value: 0xEF_LsaIso.exe_BUGCHECK_CRITICAL_PROCESS_fa9bd080_nt!PspCatchCriticalBreak

    Key  : Failure.Hash
    Value: {7e1be42b-a31e-567f-e5f3-cbe7b3dc878c}

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 1417df84

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 1

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 0

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 1

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 1

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 1

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 1

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 1

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 1

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 1

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 1

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 1

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 21631230

    Key  : Hypervisor.Flags.ValueHex
    Value: 14a10fe

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 1

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 1

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 1

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 1

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 1

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 1

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 1

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 1

    Key  : Hypervisor.RootFlags.Value
    Value: 1015

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 3f7


BUGCHECK_CODE:  ef

BUGCHECK_P1: ffff9485f9cd20c0

BUGCHECK_P2: 0

BUGCHECK_P3: ffff9485fa98e080

BUGCHECK_P4: 0

FILE_IN_CAB:  051724-22078-01.dmp

TAG_NOT_DEFINED_202b:  *** Unknown TAG in analysis list 202b


DUMP_FILE_ATTRIBUTES: 0x1808
  Kernel Generated Triage Dump

PROCESS_NAME:  LsaIso.exe

CRITICAL_PROCESS:  LsaIso.exe

ERROR_CODE: (NTSTATUS) 0xfa9bd080 - <Unable to get error code text>

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

STACK_TEXT:  
ffffd283`d5764918 fffff805`67bb1f1b     : 00000000`000000ef ffff9485`f9cd20c0 00000000`00000000 ffff9485`fa98e080 : nt!KeBugCheckEx
ffffd283`d5764920 fffff805`67b2633f     : ffff9485`f9cd20c0 fffff805`674b3fd1 00000000`00000000 fffff805`6756ec97 : nt!PspCatchCriticalBreak+0x11b
ffffd283`d57649b0 fffff805`679e4f1b     : ffff9485`f9cd20c0 00000000`40010004 ffff9485`f9cd20c0 00000000`00000000 : nt!PspTerminateAllThreads+0x14134b
ffffd283`d5764a20 fffff805`679e4cf1     : ffffffff`ffffffff ffff9485`fa98e080 ffff9485`fa9bd080 ffff9485`f9cd20c0 : nt!PspTerminateProcess+0xe7
ffffd283`d5764a60 fffff805`6762d505     : ffff9485`00000244 ffff9485`fa9bd080 ffff9485`f9cd20c0 ffff9486`00000000 : nt!NtTerminateProcess+0xb1
ffffd283`d5764ae0 00007ffb`c564fed4     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000c0`748feb88 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`c564fed4


SYMBOL_NAME:  nt!PspCatchCriticalBreak+11b

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.22621.3593

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  11b

FAILURE_BUCKET_ID:  0xEF_LsaIso.exe_BUGCHECK_CRITICAL_PROCESS_fa9bd080_nt!PspCatchCriticalBreak

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {7e1be42b-a31e-567f-e5f3-cbe7b3dc878c}

Followup:     MachineOwner
---------

2: kd> !thread
THREAD ffff9485fa9bd080  Cid 0c5c.0cac  Teb: 000000c0739ac000 Win32Thread: 0000000000000000 RUNNING on processor 2
Not impersonating
GetUlongFromAddress: unable to read from fffff80567e0bfcc
Owning Process            ffff9485fa98e080       Image:         SbieSvc.exe
Attached Process          ffff9485f9cd20c0       Image:         LsaIso.exe
fffff78000000000: Unable to get shared data
Wait Start TickCount      4242329      
Context Switch Count      185861         IdealProcessor: 0             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x00007ff67597da00
Stack Init ffffd283d5764c70 Current ffffd283d57638d0
Base ffffd283d5765000 Limit ffffd283d575f000 Call 0000000000000000
Priority 8  BasePriority 8  IoPriority 2  PagePriority 5
Child-SP          RetAddr               : Args to Child                                                           : Call Site
ffffd283`d5764918 fffff805`67bb1f1b     : 00000000`000000ef ffff9485`f9cd20c0 00000000`00000000 ffff9485`fa98e080 : nt!KeBugCheckEx
ffffd283`d5764920 fffff805`67b2633f     : ffff9485`f9cd20c0 fffff805`674b3fd1 00000000`00000000 fffff805`6756ec97 : nt!PspCatchCriticalBreak+0x11b
ffffd283`d57649b0 fffff805`679e4f1b     : ffff9485`f9cd20c0 00000000`40010004 ffff9485`f9cd20c0 00000000`00000000 : nt!PspTerminateAllThreads+0x14134b
ffffd283`d5764a20 fffff805`679e4cf1     : ffffffff`ffffffff ffff9485`fa98e080 ffff9485`fa9bd080 ffff9485`f9cd20c0 : nt!PspTerminateProcess+0xe7
ffffd283`d5764a60 fffff805`6762d505     : ffff9485`00000244 ffff9485`fa9bd080 ffff9485`f9cd20c0 ffff9486`00000000 : nt!NtTerminateProcess+0xb1
ffffd283`d5764ae0 00007ffb`c564fed4     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25 (TrapFrame @ ffffd283`d5764ae0)
000000c0`748feb88 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`c564fed4

0x391F · 2024-05-17T08:26:45Z

This bug reproduce yesterday, but unfortunately, crash dump has been disabled.

offhub · 2024-12-07T21:37:32Z

Today, while trying to reproduce issue #4421 on a Windows 11 24H2 virtual machine, I encountered this BSOD once again.

Bugcheck Analysis

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_PROCESS_DIED (ef)
        A critical system process died
Arguments:
Arg1: ffffb30f5cfda240, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: ffffb30f5e765080, The process object that initiated the termination.
Arg4: 0000000000000000

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 4000

    Key  : Analysis.Elapsed.mSec
    Value: 3987

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 812

    Key  : Analysis.Init.Elapsed.mSec
    Value: 21191

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 87

    Key  : Analysis.Version.DbgEng
    Value: 10.0.27725.1000

    Key  : Analysis.Version.Description
    Value: 10.2408.27.01 amd64fre

    Key  : Analysis.Version.Ext
    Value: 1.2408.27.1

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0xef

    Key  : Bugcheck.Code.TargetModel
    Value: 0xef

    Key  : CriticalProcessDied.ExceptionCode
    Value: 5e7c3080

    Key  : CriticalProcessDied.Process
    Value: svchost.exe

    Key  : Dump.Attributes.AsUlong
    Value: 20008

    Key  : Dump.Attributes.KernelGeneratedTriageDump
    Value: 1

    Key  : Failure.Bucket
    Value: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_5e7c3080_nt!PspCatchCriticalBreak

    Key  : Failure.Hash
    Value: {17ba1662-551e-8380-6c19-84afb6ff05d1}

    Key  : Hypervisor.Enlightenments.Value
    Value: 1108980

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 10ebf4

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 1

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 1

    Key  : Hypervisor.Flags.ApicVirtualizationAvailable
    Value: 0

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CoreSchedulerRequested
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 0

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 0

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 1

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 1

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 1

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 0

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 1

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 1

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 659693

    Key  : Hypervisor.Flags.ValueHex
    Value: a10ed

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 1

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 1

    Key  : Hypervisor.RootFlags.AccessStats
    Value: 0

    Key  : Hypervisor.RootFlags.CrashdumpEnlightened
    Value: 0

    Key  : Hypervisor.RootFlags.CreateVirtualProcessor
    Value: 0

    Key  : Hypervisor.RootFlags.DisableHyperthreading
    Value: 0

    Key  : Hypervisor.RootFlags.HostTimelineSync
    Value: 0

    Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
    Value: 0

    Key  : Hypervisor.RootFlags.IsHyperV
    Value: 0

    Key  : Hypervisor.RootFlags.LivedumpEnlightened
    Value: 0

    Key  : Hypervisor.RootFlags.MapDeviceInterrupt
    Value: 0

    Key  : Hypervisor.RootFlags.MceEnlightened
    Value: 0

    Key  : Hypervisor.RootFlags.Nested
    Value: 0

    Key  : Hypervisor.RootFlags.StartLogicalProcessor
    Value: 0

    Key  : Hypervisor.RootFlags.Value
    Value: 0

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 0


BUGCHECK_CODE:  ef

BUGCHECK_P1: ffffb30f5cfda240

BUGCHECK_P2: 0

BUGCHECK_P3: ffffb30f5e765080

BUGCHECK_P4: 0

FILE_IN_CAB:  120724-6171-01.dmp

VIRTUAL_MACHINE:  HyperV

DUMP_FILE_ATTRIBUTES: 0x20008
  Kernel Generated Triage Dump

FAULTING_THREAD:  ffffb30f5e7c3080

PROCESS_NAME:  svchost.exe

CRITICAL_PROCESS:  svchost.exe

ERROR_CODE: (NTSTATUS) 0x5e7c3080 - <Unable to get error code text>

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

STACK_TEXT:  
ffffd900`1ab798f8 fffff806`82b51ae0     : 00000000`000000ef ffffb30f`5cfda240 00000000`00000000 ffffb30f`5e765080 : nt!KeBugCheckEx
ffffd900`1ab79900 fffff806`82d6104f     : ffffb30f`5cfda240 fffff806`82622c24 00000000`00000000 ffffb30f`5cfda240 : nt!PspCatchCriticalBreak+0x128
ffffd900`1ab799a0 fffff806`82d609e7     : ffffb30f`5cfda240 ffffb30f`5cfda408 ffffb30f`5cfda240 00000000`00000000 : nt!PspTerminateAllThreads+0x27b
ffffd900`1ab79a20 fffff806`82d5e9c1     : ffffb30f`5cfda240 00000000`00000001 ffffb30f`5e7c3080 ffffb30f`5e765080 : nt!PspTerminateProcess+0xf7
ffffd900`1ab79a60 fffff806`82a8a255     : ffffb30f`5cfda240 ffffb30f`5e7c3080 01db48e1`4fcd61b6 001c0000`0000000f : nt!NtTerminateProcess+0xd1
ffffd900`1ab79ae0 00007ffc`4df1fbe4     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000ae`bc3ff068 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`4df1fbe4


SYMBOL_NAME:  nt!PspCatchCriticalBreak+128

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.26100.2314

STACK_COMMAND:  .process /r /p 0xffffb30f5e765080; .thread 0xffffb30f5e7c3080 ; kb

BUCKET_ID_FUNC_OFFSET:  128

FAILURE_BUCKET_ID:  0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_5e7c3080_nt!PspCatchCriticalBreak

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {17ba1662-551e-8380-6c19-84afb6ff05d1}

Followup:     MachineOwner
---------

DavidXanatos · 2024-12-16T07:46:08Z

To those who are affected by this issue, do you all have StartRunAlertDenied=y enabled?

APMichael · 2024-12-16T11:04:50Z

To those who are affected by this issue, do you all have StartRunAlertDenied=y enabled?

Thank you for your reply. No, “StartRunAlertDenied=y” is not enabled in the settings.

DavidXanatos · 2024-12-17T09:50:32Z

Please try the next build 1.15.4 i have added a bunch of mitigations which may solve this issue

APMichael · 2024-12-17T12:18:22Z

Great news! Since the crash always occurs randomly and I still haven't found a way to reproducing or forcing it, it may take longer for a feedback.

Thank you very much for taking a closer look at the issue.

DavidXanatos · 2024-12-19T09:07:01Z

1.15.4 is released

0x391F changed the title ~~BSoD "CRITICAL_PROCESS_DIED"~~ BSoD "CRITICAL_PROCESS_DIED" when terminate all sandboxed program Oct 20, 2021

0x391F changed the title ~~BSoD "CRITICAL_PROCESS_DIED" when terminate all sandboxed program~~ BSoD "CRITICAL_PROCESS_DIED" when terminate all sandboxed programs Oct 20, 2021

DavidXanatos added the More Info Needed More information is needed to move forward label Oct 20, 2021

This comment was marked as outdated.

# to view

DavidXanatos added to investigate ToDo To be done and removed More Info Needed More information is needed to move forward labels Dec 23, 2021

isaak654 removed the to investigate label Apr 11, 2022

isaak654 added the Crash Dump Dump file attached for a detailed analysis label May 9, 2022

isaak654 added the Type: BSOD Critical error screen label Jul 27, 2022

isaak654 closed this as completed Jul 29, 2022

isaak654 added Issue: Can't Reproduce The issue cannot be reproduced internally and removed ToDo To be done labels Jul 29, 2022

isaak654 reopened this Sep 27, 2022

isaak654 removed the Issue: Can't Reproduce The issue cannot be reproduced internally label Sep 27, 2022

isaak654 added the Confirmation Pending Further confirmation is requested label Sep 27, 2022

DavidXanatos added Status: Fixed in Next Build Fixed in the next Sandboxie version Fixed ??? Not sure if it was fixed or not labels Dec 17, 2024

DavidXanatos closed this as completed Dec 19, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

BSoD "CRITICAL_PROCESS_DIED" when terminate all sandboxed programs #1316

BSoD "CRITICAL_PROCESS_DIED" when terminate all sandboxed programs #1316

0x391F commented Oct 20, 2021 •

edited

Loading

DavidXanatos commented Oct 20, 2021

Zymlex commented Oct 20, 2021 •

edited

Loading

ghost commented Oct 21, 2021

Zymlex commented Oct 21, 2021

ghost commented Oct 21, 2021

ghost commented Oct 22, 2021 •

edited by ghost

Loading

This comment was marked as outdated.

ImSpecial commented Nov 10, 2021

ghost commented Dec 23, 2021 •

edited by ghost

Loading

ghost commented Dec 27, 2021 •

edited by ghost

Loading

shenm233 commented May 9, 2022 •

edited

Loading

ghost commented May 10, 2022 •

edited by ghost

Loading

Zymlex commented May 30, 2022 •

edited

Loading

isaak654 commented Jul 28, 2022

0x391F commented Jul 29, 2022

darkred commented Sep 15, 2022 •

edited

Loading

isaak654 commented Nov 19, 2022 •

edited

Loading

0x391F commented Nov 21, 2022

offhub commented Nov 27, 2022

APMichael commented Mar 6, 2023

ghost commented Mar 6, 2023 •

edited by ghost

Loading

APMichael commented Mar 6, 2023

DavidXanatos commented Mar 6, 2023

pulsarclarinetokrabee commented May 17, 2024

0x391F commented May 17, 2024

offhub commented Dec 7, 2024 •

edited

Loading

DavidXanatos commented Dec 16, 2024

APMichael commented Dec 16, 2024

DavidXanatos commented Dec 17, 2024

APMichael commented Dec 17, 2024

DavidXanatos commented Dec 19, 2024

BSoD "CRITICAL_PROCESS_DIED" when terminate all sandboxed programs #1316

BSoD "CRITICAL_PROCESS_DIED" when terminate all sandboxed programs #1316

Comments

0x391F commented Oct 20, 2021 • edited Loading

DavidXanatos commented Oct 20, 2021

Zymlex commented Oct 20, 2021 • edited Loading

ghost commented Oct 21, 2021

Zymlex commented Oct 21, 2021

ghost commented Oct 21, 2021

ghost commented Oct 22, 2021 • edited by ghost Loading

This comment was marked as outdated.

ImSpecial commented Nov 10, 2021

ghost commented Dec 23, 2021 • edited by ghost Loading

ghost commented Dec 27, 2021 • edited by ghost Loading

shenm233 commented May 9, 2022 • edited Loading

ghost commented May 10, 2022 • edited by ghost Loading

Zymlex commented May 30, 2022 • edited Loading

isaak654 commented Jul 28, 2022

0x391F commented Jul 29, 2022

darkred commented Sep 15, 2022 • edited Loading

isaak654 commented Nov 19, 2022 • edited Loading

0x391F commented Nov 21, 2022

offhub commented Nov 27, 2022

APMichael commented Mar 6, 2023

ghost commented Mar 6, 2023 • edited by ghost Loading

APMichael commented Mar 6, 2023

DavidXanatos commented Mar 6, 2023

pulsarclarinetokrabee commented May 17, 2024

0x391F commented May 17, 2024

offhub commented Dec 7, 2024 • edited Loading

DavidXanatos commented Dec 16, 2024

APMichael commented Dec 16, 2024

DavidXanatos commented Dec 17, 2024

APMichael commented Dec 17, 2024

DavidXanatos commented Dec 19, 2024

0x391F commented Oct 20, 2021 •

edited

Loading

Zymlex commented Oct 20, 2021 •

edited

Loading

ghost commented Oct 22, 2021 •

edited by ghost

Loading

ghost commented Dec 23, 2021 •

edited by ghost

Loading

ghost commented Dec 27, 2021 •

edited by ghost

Loading

shenm233 commented May 9, 2022 •

edited

Loading

ghost commented May 10, 2022 •

edited by ghost

Loading

Zymlex commented May 30, 2022 •

edited

Loading

darkred commented Sep 15, 2022 •

edited

Loading

isaak654 commented Nov 19, 2022 •

edited

Loading

ghost commented Mar 6, 2023 •

edited by ghost

Loading

offhub commented Dec 7, 2024 •

edited

Loading