Solved Windows 11 24H2 won’t boot (BSOD 0x139 KERNEL_SECURITY_CHECK_FAILURE), DISM/SFC can’t repair, NTFS corruption?

Hi all. I need help repairing my existing Windows install without a full reset/reinstall. I already think it's completely cooked, but I have my faith. I hope you don't mind me summarizing my ramblings with ChatGPT here, I'm very tired and don't want to write it all out myself - otherwise it wouldn't have been readable.

System/context

• OS: Windows 11, version 24H2. DISM reports image version 26100.3915 (might be ahead because of updates).
• Dual boot with Linux on same machine. Windows NTFS volume hasn’t been mounted read/write by Linux in months. I did not force-mount or skip chkdsk when it asked me to at any point. Linux is on a different drive.
• Hardware: NVIDIA GPU. NVME system drive, which appears healthy.

It booted fine yesterday. Today it BSODs on every attempt. No startup option (normal, Safe Mode, test signing, etc.) gets me to desktop.

BSOD details

• Stop code: KERNEL_SECURITY_CHECK_FAILURE (0x139).
• dumpstack.log (https://files.catbox.moe/1y4u0e.txt) shows secondary dump callbacks for dxgkrnl/NVIDIA:
  • Mentions nvlddmkm.sys callback, DxgKrnl callback, SecureKernel logs.
• Minidumps/kernel dumps are NOT being written:
  • C:\Windows\Minidump is empty
  • C:\Windows\MEMORY.DMP does not exist
  • ntbtlog.txt is not created even when bootlog is enabled
  • Crash screen sits at “100% complete” indefinitely unless I do necromancy with the bcdedit options.

What I’ve tried:

• Disk checks:
  • chkdsk run multiple times from WinRE/Setup/other environments: no errors, no found.xxx.
  • Drive readable, random files open fine, no SMART failures, and its less than a year old in age.
  • Currently a chkdsk is running from the recovery environment, waiting on that to complete.
• DISM offline repairs from Windows Setup/WinRE:
  • Tried multiple sources:
    • Official Microsoft ISO (24H2)
    • UUP dump ISO built to exact version reported (26100.3915)
    • A newer 24H2 ISO/build (5xxx)
  • Commands used:
    • Code:

      dism /Get-WimInfo /WimFile:G:\Sources\install.wim

      Code:

      dism /Image:D:\ /Cleanup-Image /RestoreHealth /Source:WIM:G:\Sources\install.wim: /LimitAccess

  • Result: DISM fails with “missing replacement payload” or CBS errors. CBS log from one of the attempts (they are more or less the same): https://files.catbox.moe/r8p05o.txt
• SFC (offline):
  • Code:

    sfc /scannow /offbootdir:D:\ /offwindir:D:\Windows

  • Reports corruption, only CoreInkRecognition/handwriting language components with hash mismatch are logged. Fails to repair those. Doesn’t change boot outcome.
• System Restore from WinRE:
  • Fails with 0x80070026, something about WindowsApps → AppxStaging was once printed out.
  • No successful rollback from restore points.
• Uninstall Updates (WinRE):
  • “Uninstall latest quality update” errors generically (“we ran into a problem”) and doesn’t complete. It ran once from the recovery environment and succeeded in uninstalling quality updates, but did not do anything to help.
• Boot/BCD toggles (all reverted now):
  • safeboot minimal/network, testsigning on, nointegritychecks on, hypervisorlaunchtype Off, bootlog Yes, disable auto-restart.
  • Secure Boot switched from Other OS to Windows UEFI - no change, though I did get a different blue screen (Your PC couldn't start properly) going something like 0xc0000001, press enter to try again/esc for recovery. Pressing Enter gave me the BSoD again.
• Driver isolation:
  • nvlddmkm.sys is not present on disk, but dumpstack mentions its callback???
  • Removed NVIDIA display INF from driver store (oem43.inf / nv_dispui) and tried renaming related NVIDIA audio driver (nvhda64v.sys), no change.
  • There are no new found corruptions via chkdsk. Storage/AV/EDR/filter drivers have not been conclusively identified as the cause yet.

Current state

• Windows is not bootable in any mode. No dumps are generated. DISM offline can’t repair due to source/payload/version issues in CBS. SFC only flags handwriting/ink capabilities but doesn’t fix them. System Restore and Uninstall Updates both fail. Drive reads fine and Linux sees the Windows partition without new errors.

What I can do from here

• I can boot Windows Setup (or Recovery Environment) to use the CMD or Linux.
• I can download ISOs or packages from Microsoft/UUP on the same machine (via Linux) and stage them for offline use.
• I cannot use another Windows PC to copy a healthy WinSxS.
• I cannot reinstall or reset or lose data.
• I am a poor idiot who does not keep a backup because I have nowhere to store another 1.5 TB

I am well aware that, by all means, I should just give up and reinstall this, and probably also format the drive because NTFS, the notoriously-trash-file-system has obliterated itself for no apparent reason other than to spite its users. But there's too much stuff on the drive to give up on - 5 years' worth of audio and video production setups and projects alongside coding, plus a bunch of customizations, which is all a giant pain to restore from the ground up. So, I will do anything to restore it instead, at least so I can back up the drive, format it and restore it back onto itself and/or an in-place upgrade.

1) Attempt to rescue important files using a bootable Ubuntu / Linux flash drive



2) Test the drive using Sea Tools bootable Long generic test > take pictures > post images or share links



3) Overnight while sleeping and the next day test RAM > take pictures > post images or share links



4) If the drive fails the Long generic test then replace the drive



5) If the drive passes the Long generic test then clean install Windows


















Run Memtest86+ for 8 or more passes > take pictures > post images or share links

Memtest86+ | The Open-Source Memory Testing Tool

Just 1 error is a test fail and testing can be aborted.

The more the passes the better the testing conditions.

It sometimes takes passes into the 20's to detect malfunctioning RAM.

The RAM can be tested all at one time or one at a time in the same DIMM.

Memtest86+ | The Open-Source Memory Testing Tool

MemTest86+ - Test RAM

zbook said:

1) Attempt to rescue important files using a bootable Ubuntu / Linux flash drive



2) Test the drive using Sea Tools bootable Long generic test > take pictures > post images or share links



3) Overnight while sleeping and the next day test RAM > take pictures > post images or share links



4) If the drive fails the Long generic test then replace the drive



5) If the drive passes the Long generic test then clean install Windows

Create a bootable USB stick with Rufus on Windows | Ubuntu

Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.

tutorials.ubuntu.com

Linux to the rescue! How Ubuntu can help a computer in distress

When disaster strikes your Windows PC, an Ubuntu live drive has all the tools you need to save the day.

www.pcworld.com

[Article] Rescue Files when Windows Won't Start - Microsoft Q&A

📌 Note: This article was originally created by Greg Carmack Windows MVP 2010-20 (ret'd), a valued member on Answers Support Community. It provided meaningful insights and proved helpful to many. We're recreating it here on their behalf to preserve its…

answers.microsoft.com

Clean Install Windows 11

This tutorial will show you step by step on how to clean install Windows 11 at boot on your PC with or without an Internet connection and setup with a local account or Microsoft account. Windows 11 has all the power and security of Windows 10 with a redesigned and refreshed look. It also comes...

www.elevenforum.com

Download Official Windows 11 ISO file from Microsoft

This tutorial will show you how to download an official Windows Server or Windows 11 64-bit or ARM64 ISO file from Microsoft. Microsoft provides ISO files for Windows Server and Windows 11 to download. You can use these ISO files to clean install or in-place upgrade Windows 11. The Flight Hub...

www.elevenforum.com

Download Windows 11

Run Memtest86+ for 8 or more passes > take pictures > post images or share links

Memtest86+ | The Open-Source Memory Testing Tool

Just 1 error is a test fail and testing can be aborted.

The more the passes the better the testing conditions.

It sometimes takes passes into the 20's to detect malfunctioning RAM.

The RAM can be tested all at one time or one at a time in the same DIMM.

Memtest86+ | The Open-Source Memory Testing Tool

MemTest86+ - Test RAM

Click to expand...

After many many hours of messing with it, no it’s not my RAM, no it’s not my storage, Additionally another fresh windows install on a separate drive works fine, so I highly highly doubt it’s a hardware problem. I’ll try my best to back everything up tomorrow.

I’ve gone as far as to manually restore the component store using various KBs and install ISOs to the point where DISM and SFC both report everything is a-okay, and that still produces the same BSoD. I’ve even tried forcing SFC to restore the kernel and various related files - and it did do that. I was not able to get any dumps out of it no matter what configuration I put into it. Something is super deeply broken there, to the point where the kernel can’t even write a dump and I’m starting to lose hope for good.

Maybe I’ll experiment with a debugger if I can somehow actually get attached to it, but honestly I don’t know what to try anymore, seems futile.

When available please post results:



2) Test the drive using Sea Tools bootable Long generic test > take pictures > post images or share links



3) Overnight while sleeping and the next day test RAM > take pictures > post images or share links

Solved. It was not hardware, btw. I did check the drive and the RAM. Briefly. But it was enough to confirm that my couple-month-old high-end storage has not just up and died.

Short version:
After literally exhausting every tool and angle (DISM, SFC, every MS repair method, disabling drivers and services in regedit, BCD options, and even System Restore all giving me the finger), the thing that finally let my install boot was… force detaching my “Dev Drive” (a VHDX ReFS volume). Turns out, something to do with that virtual disk or file system was completely obliterating the kernel during early boot, even though the VHDX *looked* fine mounting it anywhere.

What I actually did:
- Contended with the fact that I have disk corruption because of NTFS
- Ran full *manual* offline SFC/DISM repairs **but only after getting the exact same Build LCU KB from MS Update Catalog** (basically - read missing files in DISM log and find them in a WinSxS-like format - MSUs, windows ISOs, UUPs, what have you. Make sure to mount any WIMs to folders, NOT drives; DISM is a whiny illegitimate)
- Used QEMU to boot the broken install and a clean one with WinDbg the kernel debugger to hunt down the actual crash (0x139 seems like garbage kernel references from a bad driver or stack corruption, but in my case, every relevant third-party .sys was already neutered/renamed/removed by now).
- Noticed a bunch of VHD/vhdmp.sys tags in !pool around the time/memory region of the crash. Immediately red flags popped up in my mind and I remembered the only place I have a VHD in.
- **Temporarily moved/renamed my Dev Drive VHDX file so it couldn’t even be auto-attached at boot. Finally, Windows booted into Safe Mode for the first time in days.**
- Only after booting did I restore the VHDX, mount it manually, check its integrity (refsutil/chkdsk tbh it didnt do anything), and then added it back normally. I first ran an in-place repair install (“Upgrade this PC” from latest ISO) to tidy up any remaining OS-level weirdness, and DISM and SFC a couple times for good measure
- Of course, made a backup *this time*.

Looking back, the VHDX was probably just corrupt enough or simply triggered a ReFS/virtual disk bug with something in the driver very early on in the kernel, to the point where it crashed as soon as it tried to initialize a filesystem, which is probably what made it impossible for it to write any dump files. Seems good now though, so not sure if that was in fact it, but all points to that being the case. I have some filesystem corruption, but it’s superficial like broken permissions on a file here and there, most things do work fine.

Key advice for future wanderers:
- “Missing payload” in DISM offline means you *must* get a matching LCU/KB CAB; base ISOs aren’t enough.
- If you have *anything* like a Dev Drive, Storage Space, unusual VHDs that auto-mount. This was fundamentally a driver issue because the CHD/filesystem driver would break boot in ways that look like driver corruption, but the core cause was a broke VHD.
- Always keep a working backup.
- NTFS is bad when it decides to obliterate itself, and *really* bad.