Windows 10 + Google Drive File Stream + Executable = BSOD SYSTEM_SERVICE_EXCEPTION (3B)

Question

Haven't really found a satisfying solution to this problem.

I have Windows 10 Home x64.
I have Google Drive, and Drive File Stream installed and syncing my drive. Most files are online until I interact with them, and it downloads them locally (pretty standard).

When I double-click on an .exe file, Windows BSOD straight away.

SYSTEM_SERVICE_EXCEPTION (0x0000003B)

When I right-click the file and choose: Drive File Stream > 'Available offline'
then double-click, it also BSOD.

I have tried completely removing DFS from Windows and reinstalling.
I have used it on two Windows installs now, with the same result.

Tried taking this up with Google, who said that it is not supported to run executables from DFS, and suggested using Backup and Sync instead.

I haven't tried that yet, but I feel like it's going backwards. They said that it is not a bug with Drive File Stream, but with Windows.

If I take this problem to Microsoft, they'll simply blame Google.

Does anyone have any ideas?

Thanks in advance!

Answer 1

Ok so after getting WinDbg running and analysing, I found that there is a program installed that was related to the crash. Uninstalling this program has resolved the issue.

Below is the WinDbg output with information redacted. You can see the areas I have written SuspectProgram.

Microsoft (R) Windows Debugger Version 10.0.19041.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\User\Desktop\052220-6984-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 18362 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff806`15200000 PsLoadedModuleList = 0xfffff806`15648170
Debug session time: Fri May 22 15:45:40.875 2020 (UTC + 10:00)
System Uptime: 0 days 21:04:23.193
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
........
For analysis of this file, run !analyze -v
3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff806153a0cb6, Address of the instruction which caused the bugcheck
Arg3: ffff9e8f9d6bde60, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for SuspectProgram.sys

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 3

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on COMPUTERNAME

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 10

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 79

    Key  : Analysis.System
    Value: CreateObject


BUGCHECK_CODE:  3b

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff806153a0cb6

BUGCHECK_P3: ffff9e8f9d6bde60

BUGCHECK_P4: 0

CONTEXT:  ffff9e8f9d6bde60 -- (.cxr 0xffff9e8f9d6bde60)
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=ffff9e8f9d6b005c rsi=ffffa20fcd3f9990 rdi=00000000000031e0
rip=fffff806153a0cb6 rsp=ffff9e8f9d6be858 rbp=ffff9e8f9d6beb89
 r8=0000000000000000  r9=0000000000000000 r10=ffff9e8f9d6be8f0
r11=ffffa20fe0c5e080 r12=0000000000000001 r13=0000000000000000
r14=000000000000000a r15=fffff80615705ef0
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050246
nt!wcsrchr+0x6:
fffff806`153a0cb6 0fb701          movzx   eax,word ptr [rcx] ds:002b:00000000`00000000=????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  explorer.exe

BAD_PAGES_DETECTED: 1

STACK_TEXT:  
ffff9e8f`9d6be858 fffff806`2f322201 : ffffa20f`dc94a080 ffffd80d`4ea09b80 ffffa20f`c72b9040 fffff806`158d35c1 : nt!wcsrchr+0x6
ffff9e8f`9d6be860 ffffa20f`dc94a080 : ffffd80d`4ea09b80 ffffa20f`c72b9040 fffff806`158d35c1 00000000`00000000 : SuspectProgram+0x2201
ffff9e8f`9d6be868 ffffd80d`4ea09b80 : ffffa20f`c72b9040 fffff806`158d35c1 00000000`00000000 00000000`00000000 : 0xffffa20f`dc94a080
ffff9e8f`9d6be870 ffffa20f`c72b9040 : fffff806`158d35c1 00000000`00000000 00000000`00000000 ffffffff`80003f0c : 0xffffd80d`4ea09b80
ffff9e8f`9d6be878 fffff806`158d35c1 : 00000000`00000000 00000000`00000000 ffffffff`80003f0c 00000000`000031e0 : 0xffffa20f`c72b9040
ffff9e8f`9d6be880 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpCloseHandle+0x85


SYMBOL_NAME:  PAGE_NOT_ZERO

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

STACK_COMMAND:  .cxr 0xffff9e8f9d6bde60 ; kb

FAILURE_BUCKET_ID:  PAGE_NOT_ZERO_0x3B_c0000005

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {e53488a4-f53d-5828-4e8b-03e3e9cba4c2}

Followup:     MachineOwner
---------

 *** Memory manager detected 1 instance(s) of page corruption, target is likely to have memory corruption.