Faulting application name: dwm.exe, dwmcore.dll, Fault offset: 0x0000000000266644

[gileli121]

Hi, I got this crash:

Faulting application name: dwm.exe, version: 10.0.22000.1, time stamp: 0x7cbe2305
Faulting module name: dwmcore.dll, version: 10.0.22000.434, time stamp: 0x63ddc963
Exception code: 0xc00001ad
Fault offset: 0x0000000000266644
Faulting process id: 0x329c
Faulting application start time: 0x01d813b6417b7e8e
Faulting application path: C:\WINDOWS\System32\dwm.exe
Faulting module path: C:\WINDOWS\System32\dwmcore.dll
Report Id: 3e16942e-5cee-4bdf-ad17-b34b56e950b3
Faulting package full name: 
Faulting package-relative application ID: 

Copied from Windows event viewer. Happened after about 3 hours of capturing multiple windows at the same time.
Used Windows 11 22000.434

When it happened, the screen was black for a few seconds and few windows became blank forever.

Any idea how to avoid it? Is this is a known issue?
Any idea how to troubleshooting this log?
Do you know what function there is in 0x0000000000266644 in dwmcore.dll or what it does?

Thank you

[robmikh]

It may not be a capture related thing if it happened hours later. If you have diagnostic reporting turned on, the crash will be automatically reported to us.

From this post alone, there isn't enough information. But the crash dump will tell us more once it makes its way to us.

[cambeius]

I just had an update to Win11 a few days ago and the same issue started happening for me.
I have OS build 22621.1265 version 22H2.

I have tried to delete the dwmcore.dll file, ran a sfc /scannow as admin, which readded the file back, but the issue persists.

For me besides the event:

Faulting application name: dwm.exe, version: 10.0.22621.608, time stamp: 0x8783b131
Faulting module name: dwmcore.dll, version: 10.0.22621.900, time stamp: 0xb419c772
Exception code: 0x8898008d
Fault offset: 0x0000000000122e3e
Faulting process ID: 0x0x2C90
Faulting application start time: 0x0x1D946887AD410B0
Faulting application path: C:\WINDOWS\system32\dwm.exe
Faulting module path: C:\WINDOWS\system32\dwmcore.dll
Report ID: 96a9eb66-d92a-44e6-9539-979291d35fee
Faulting package full name:
Faulting package-relative application ID:

I also have the following one:

Faulting application name: Explorer.EXE, version: 10.0.22621.1194, time stamp: 0x506ad647
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000000000000000
Faulting process ID: 0x0x22D0
Faulting application start time: 0x0x1D94688E1A3FD84
Faulting application path: C:\WINDOWS\Explorer.EXE
Faulting module path: unknown
Report ID: e49d35e5-c498-4839-96e6-37a73b99ceb1
Faulting package full name:
Faulting package-relative application ID:

I pulled a dump file from task manager for dwm.exe, here is what it shows in WinDbg:

For analysis of this file, run !analyze -v
win32u!NtUserGetMessage+0x14:
00007ff9`bf391534 c3              ret
0:000> !analyse -v
No export analyse found
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1562

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 53465

    Key  : Analysis.IO.Other.Mb
    Value: 13

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 68

    Key  : Analysis.Init.CPU.mSec
    Value: 62

    Key  : Analysis.Init.Elapsed.mSec
    Value: 85094

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 142

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 1223

    Key  : Timeline.Process.Start.DeltaSec
    Value: 1210

    Key  : WER.OS.Branch
    Value: ni_release

    Key  : WER.OS.Timestamp
    Value: 2022-05-06T12:50:00Z

    Key  : WER.OS.Version
    Value: 10.0.22621.1

    Key  : WER.Process.Version
    Value: 10.0.22621.608


FILE_IN_CAB:  dwm.DMP

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 0000000000000000
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD:  00000638

PROCESS_NAME:  dwm.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.

EXCEPTION_CODE_STR:  80000003

STACK_TEXT:  
00000072`079bf848 00007ff9`c104536a     : 00000000`80000001 00000000`00000000 00007ff6`00000000 00007ff6`00000001 : win32u!NtUserGetMessage+0x14
00000072`079bf850 00007ff6`1667384c     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : user32!GetMessageW+0x2a
00000072`079bf8b0 00007ff6`16673632     : 00007ff9`00000003 00007ff6`16670000 00000000`7ffe0384 00000000`00000000 : dwm!CDwmAppHost::Run+0xbc
00000072`079bf920 00007ff6`16675550     : 00000000`0000000a 00007ff6`166755d9 00000000`00000000 00000000`00000000 : dwm!wWinMain+0x172
00000072`079bf970 00007ff9`c01d26bd     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : dwm!__scrt_common_main_seh+0x110
00000072`079bf9b0 00007ff9`c1b6dfb8     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x1d
00000072`079bf9e0 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x28


STACK_COMMAND:  ~0s; .ecxr ; kb

SYMBOL_NAME:  win32u!NtUserGetMessage+14

MODULE_NAME: win32u

IMAGE_NAME:  win32u.dll

FAILURE_BUCKET_ID:  BREAKPOINT_80000003_win32u.dll!NtUserGetMessage

OS_VERSION:  10.0.22621.1

BUILDLAB_STR:  ni_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  10.0.22621.1265

FAILURE_ID_HASH:  {3112b5eb-303b-e877-0655-90bdfa336126}

Followup:     MachineOwner

[robmikh]

Thanks, it looks like a report was made so it will make its way over to us and we'll investigate.

[cambeius]

I found a workaround, If I keep my GPU at around 30% usage all the time it never crashes anymore, so I just keep Wallpaper Engine running. If I close the WE task then it crashes in ~7minutes.
Because of this I am thinking it's either a hardware issue, or a BIOS setting that needs to change.