Hi, please help. After 1–2 hours of the computer running, regardless of its load, a blue screen and a kernel mode heap corruption error appear.

SteenH 0 Reputation points
2026-09-10T12:54:09.9633333+00:00
ExtensionGallery settings after reading 'SOFTWARE\Microsoft\Debug Engine' registry:
ExtensionGallery ExtensionRepository: Implicit

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*

************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : true
   AllowNugetExeUpdate : true
   NonInteractiveNuget : true
   AllowNugetMSCredentialProviderInstall : true
   AllowParallelInitializationOfLocalRepositories : true

   -- Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.016 seconds
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 46

Microsoft (R) Windows Debugger Version 10.0.29617.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\091026-7234-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 26100 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0xfffff805`abe00000 PsLoadedModuleList = 0xfffff805`accf4770
Debug session time: Thu Sep 10 22:30:42.712 2026 (UTC + 10:00)
System Uptime: 0 days 2:41:23.380
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 0000001b`9b0bb018).  Type ".hh dbgerr001" for details
Loading unloaded module list
.......................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff805`ac2b8b00 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffc700`7c06e8a0=000000000000013a





ExtensionGallery settings after reading 'SOFTWARE\Microsoft\Debug Engine' registry:
ExtensionGallery ExtensionRepository: Implicit

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*

************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : true
   AllowNugetExeUpdate : true
   NonInteractiveNuget : true
   AllowNugetMSCredentialProviderInstall : true
   AllowParallelInitializationOfLocalRepositories : true

   -- Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.031 seconds
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 46

Microsoft (R) Windows Debugger Version 10.0.29617.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\090826-6031-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*
Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 26100 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0xfffff806`b6200000 PsLoadedModuleList = 0xfffff806`b70f4770
Debug session time: Tue Sep  8 20:21:52.628 2026 (UTC + 10:00)
System Uptime: 0 days 22:42:10.297
Loading Kernel Symbols
...............................................................
................................................................
..................................................
Loading User Symbols

Loading unloaded module list
......................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`b66b8b00 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffc304`428fb450=000000000000013a

Windows for home | Other | Performance and system failures

2 answers

Sort by: Newest
  1. David-M 125.2K Reputation points Independent Advisor
    2026-09-10T13:26:48.73+00:00

    Hi. I'm David, and I'm happy to help you.


    Please share the minidump files.

    These files are in C:\Windows\Minidump.

    Copy any files you have to your desktop and store them in a ZIP file. Then, upload the ZIP file to the cloud (OneDrive), choose to share it, and get the link.

    Then, post the link to the ZIP file here so I can have a look.


    Looking forward to your reply.

    Was this answer helpful?


  2. AI answer

    2026-09-10T12:54:42.03+00:00

    KERNEL_MODE_HEAP_CORRUPTION (0x13A) means the kernel mode heap manager detected heap corruption.

    From the documented parameter meanings, the most important next step is to check Parameter 1 from !analyze -v in each dump. That value identifies the corruption pattern, for example:

    • 0x6: features consistent with a buffer overrun
    • 0x7: features consistent with a buffer underrun
    • 0xB: features consistent with use-after-free
    • 0xD: corrupt free list, possibly from use-after-free or adjacent buffer overflow
    • 0x11: possible double-free or heap corruption
    • 0x17: corruption in a delay free list, likely use-after-free or adjacent buffer overflow

    The dump text provided only shows the bug check 0x13A, not the !analyze -v output with the parameter values or the faulting driver, so the exact offending component cannot be identified from this data alone.

    Actionable next steps:

    1. In WinDbg, run !analyze -v on each minidump.
    2. Record these fields from each dump:
      • Arg1
      • MODULE_NAME
      • IMAGE_NAME
      • PROCESS_NAME
      • stack trace entries near the top
    3. Compare multiple dump files. If the same driver or module appears repeatedly, that is the strongest lead.
    4. Use Event Viewer and check the System log for errors in the same time window as the blue screen.
    5. In Device Manager, look for devices with an exclamation mark and review the device/driver events.
    6. If hardware or drivers were added recently, remove, replace, or update them.
    7. If new drivers or system services were added recently, remove or update them.
    8. Run the hardware diagnostics supplied by the system manufacturer, especially memory diagnostics.
    9. If BIOS or hardware compatibility changed recently, check whether a BIOS update from the manufacturer is applicable.
    10. Configure the system to save an Automatic memory dump so future crashes provide better data:
      • Search Advanced system settings
      • Advanced tab → Startup and RecoverySettings
      • Write debugging informationAutomatic memory dump
      • Restart the computer

    For deeper analysis, the documented debugger commands for this stop code are:

    • !analyze
    • !heap

    If the crashes continue after basic driver and hardware checks, multiple dump files should be examined together because recurring patterns are specifically called out as important for finding the root cause.


    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.