Glasswire causing bug check code 139 error reboots

GlassWire Help
1

About once a week a i get a bug check code 139 error reboot on my Windows 11 PC running the latest version of Glasswire. The WinDbg analysis gives the follow cause:

EXCEPTION_RECORD: ffffe18bb6c0e4c8 – (.exr 0xffffe18bb6c0e4c8)
ExceptionAddress: fffff80552177798 (gwdrv+0x0000000000007798)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1 (!blackboxwinlogon)

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000003

EXCEPTION_STR: 0xc0000409

STACK_TEXT:
ffffe18bb6c0e248 fffff805ac0bfbe9 : 0000000000000139 0000000000000003 ffffe18bb6c0e570 ffffe18bb6c0e4c8 : nt!KeBugCheckEx
ffffe18bb6c0e250 fffff805ac0c01f2 : ffffa60121538180 ffffa60121538180 0000000000000532 ffffa60121538180 : nt!KiBugCheckDispatch+0x69
ffffe18bb6c0e390 fffff805ac0bde28 : fffff8053dfe7190 0000000000001002 0000000000000000 ffffcf0cf8c30420 : nt!KiFastFailDispatch+0xb2
ffffe18bb6c0e570 fffff80552177798 : ffffcf0cf8d9ead8 0000000000000001 0000000000000003 ffffcf0d355ea210 : nt!KiRaiseSecurityCheckFailure+0x368
ffffe18bb6c0e700 ffffcf0cf8d9ead8 : 0000000000000001 0000000000000003 ffffcf0d355ea210 0000000000000000 : gwdrv+0x7798
ffffe18bb6c0e708 0000000000000001 : 0000000000000003 ffffcf0d355ea210 0000000000000000 ffffcf0cf8d9eae8 : 0xffffcf0cf8d9ead8 ffffe18bb6c0e710 0000000000000003 : ffffcf0d355ea210 0000000000000000 ffffcf0cf8d9eae8 ffffcf0d20381c02 : 0x1 ffffe18bb6c0e718 ffffcf0d355ea210 : 0000000000000000 ffffcf0cf8d9eae8 ffffcf0d20381c02 ffffcf0cf8d9eaf8 : 0x3 ffffe18bb6c0e720 0000000000000000 : ffffcf0cf8d9eae8 ffffcf0d20381c02 ffffcf0cf8d9eaf8 ffffcf0d4394dda0 : 0xffffcf0d355ea210

SYMBOL_NAME: gwdrv+7798

MODULE_NAME: gwdrv

IMAGE_NAME: gwdrv.sys

STACK_COMMAND: .process /r /p 0xffffcf0cee6c6040; .thread 0xffffcf0d45846080 ; kb

BUCKET_ID_FUNC_OFFSET: 7798

FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_gwdrv!unknown_function

OSPLATFORM_TYPE: x64

FAILURE_ID_HASH: {2387f190-e233-2f40-274b-63fe920aa794}

Switching to an older version and using legacy driver problem went away. Returns on going to latest verion. Any ideas on what is causing this?

2

By ‘latest version’ do you mean the 64-bit one or the latest 32-bit one?

3

Hello, I think it could be the non-legacy GlassWire driver. Indeed the common causes of that error are mostly related to drivers Bug Check 0x139 KERNEL_SECURITY_CHECK_FAILURE - Windows drivers | Microsoft Learn Moreover another user had the same issue some months ago KERNEL SECURITY CHECK FAILURE 0x139 That user was using 32-bit GlassWire as the post is dated back to March but I guess that since your OS is 64-bit you were using 64-bit GlassWire before reverting to a older version. If this is the case the same error can occur both on 64-bit GlassWire than on 32-bit GlassWire. Maybe both versions use the same non-legacy driver, I would not know.

The “Use Legacy Driver” installation option has been removed in 64-bit GlassWire and some other users had to revert to 32-bit version to use Legacy driver because they had different issues so I wonder why 64-bit GlassWire was released as official version and not as beta version.