EA AntiCheat causing SYSTEM_SERVICE_EXCEPTION (0x3B) via ETW SpinLock Corruption
To the EA Engineering and Anti-Cheat Team,
I am writing to report a severe Ring-0 instability issue caused by the current iteration of the EA AntiCheat operating in Battlefield 6. The issue results in hard system reboots and kernel panics (Bugcheck 0x3B) exclusively when running bf6.exe.
I have performed a root-cause analysis on the generated minidumps using WinDbg. The telemetry proves this is not a hardware failure or a standard driver crash, but a direct collision in the Windows kernel caused by your Anti-Cheat engine.
Technical Telemetry & Root Cause:
Bugcheck Code: SYSTEM_SERVICE_EXCEPTION (0x3b)
Exception Code: 0x80000003 (STATUS_BREAKPOINT)
Failing Process: bf6.exe
Failure Bucket ID: 0x3B_80000003_nt!KeReleaseSpinLock
Mechanism of Failure: The stack trace (KiSystemServiceExitPico > PerfInfoLogSysCallExit > EtwpLogKernelEvent) reveals that the crash occurs within the Event Tracing for Windows (ETW) subsystem.
When Windows operates with Virtualization-Based Security (VBS) or Hypervisor Enforced Code Integrity (HVCI) enabled, the EA AntiCheat triggers a race condition when hooking into system calls monitored by the ETW. This collision corrupts a memory SpinLock. When the Windows kernel attempts to release this lock (nt!KeReleaseSpinLock), it detects the memory corruption and triggers an intentional breakpoint (0x80000003) to prevent unpaged pool corruption, resulting in an immediate system halt.
Replication & Mitigation: The issue is 100% reproducible on systems with VBS/Core Isolation active. The temporary mitigation I found requires users to completely disable Windows Memory Integrity (VBS) or rebuild the Anti-Cheat signatures, which is a massive security compromise just to run the game.
Conclusion & Request: Many players experiencing random hard reboots while playing BF6 are likely RMAing their power supplies or GPUs, completely unaware that this is a software-level kernel collision.
I am providing this debug data to accelerate your patching process. If this root-cause analysis proves valuable to your engineering team in resolving this critical Ring-0 vulnerability, I would highly appreciate a token of acknowledgement. If possible, I would love to receive a unique in-game badge, a dog tag, or any Brazil-themed cosmetic item granted to my account.
Best regards,
Minidump using WinDBG from microsoft store:
************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true -- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.015 seconds ************* Waiting for Debugger Extensions Gallery to Initialize ************** >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.016 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 46 Microsoft (R) Windows Debugger Version 10.0.29617.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\Minidumps\080826-26437-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available WARNING: TriageDumpDataExtArray.HeaderSize is 0 WARNING: Failed to read dump data exension data Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 26100 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Kernel base = 0xfffff800`8ac00000 PsLoadedModuleList = 0xfffff800`8baf5350 Debug session time: Sat Aug 8 12:05:37.518 2026 (UTC - 3:00) System Uptime: 0 days 13:12:40.269 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................. Loading User Symbols PEB is paged out (Peb.Ldr = 00000000`002e1018). Type ".hh dbgerr001" for details Loading unloaded module list ...................... For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff800`8b0f9250 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffaf81`63fa4fb0=???????????????? 7: kd> !analyze -v Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................. Loading User Symbols PEB is paged out (Peb.Ldr = 00000000`002e1018). Type ".hh dbgerr001" for details Loading unloaded module list ...................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 0000000080000003, Exception code that caused the BugCheck Arg2: fffff8008ae7e36c, Address of the instruction which caused the BugCheck Arg3: ffffaf8163fa58f0, Address of the context record for the exception that caused the BugCheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 1656 Key : Analysis.Elapsed.mSec Value: 7049 Key : Analysis.IO.Other.Mb Value: 17 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 24 Key : Analysis.Init.CPU.mSec Value: 609 Key : Analysis.Init.Elapsed.mSec Value: 32602 Key : Analysis.Memory.CommitPeak.Mb Value: 86 Key : Analysis.Version.DbgEng Value: 10.0.29617.1000 Key : Analysis.Version.Description Value: 10.2604.29.1 amd64fre Key : Analysis.Version.Ext Value: 1.2604.29.1 Key : Bugcheck.Code.LegacyAPI Value: 0x3b Key : Bugcheck.Code.TargetModel Value: 0x3b Key : Dump.Attributes.AsUlong Value: 0x21808 Key : Dump.Attributes.DiagDataWrittenToHeader Value: 1 Key : Dump.Attributes.ErrorCode Value: 0x0 Key : Dump.Attributes.KernelGeneratedTriageDump Value: 1 Key : Dump.Attributes.LastLine Value: Dump completed successfully. Key : Dump.Attributes.ProgressPercentage Value: 0 Key : Failure.Bucket Value: 0x3B_80000003_nt!KeReleaseSpinLock Key : Failure.Exception.IP.Address Value: 0xfffff8008ae7e36c Key : Failure.Exception.IP.Module Value: nt Key : Failure.Exception.IP.Offset Value: 0x27e36c Key : Failure.Hash Value: {64d2c3bd-0301-92e2-999e-89ccd9f1e9ad} Key : Faulting.IP.Type Value: Paged Key : Hypervisor.Enlightenments.ValueHex Value: 0x7417cf94 Key : Hypervisor.Flags.AnyHypervisorPresent Value: 1 Key : Hypervisor.Flags.ApicEnlightened Value: 1 Key : Hypervisor.Flags.ApicVirtualizationAvailable Value: 0 Key : Hypervisor.Flags.AsyncMemoryHint Value: 0 Key : Hypervisor.Flags.CoreSchedulerRequested Value: 0 Key : Hypervisor.Flags.CpuManager Value: 1 Key : Hypervisor.Flags.DeprecateAutoEoi Value: 0 Key : Hypervisor.Flags.DynamicCpuDisabled Value: 1 Key : Hypervisor.Flags.Epf Value: 0 Key : Hypervisor.Flags.ExtendedProcessorMasks Value: 1 Key : Hypervisor.Flags.HardwareMbecAvailable Value: 1 Key : Hypervisor.Flags.MaxBankNumber Value: 0 Key : Hypervisor.Flags.MemoryZeroingControl Value: 0 Key : Hypervisor.Flags.NoExtendedRangeFlush Value: 0 Key : Hypervisor.Flags.NoNonArchCoreSharing Value: 1 Key : Hypervisor.Flags.Phase0InitDone Value: 1 Key : Hypervisor.Flags.PowerSchedulerQos Value: 0 Key : Hypervisor.Flags.RootScheduler Value: 0 Key : Hypervisor.Flags.SynicAvailable Value: 1 Key : Hypervisor.Flags.UseQpcBias Value: 0 Key : Hypervisor.Flags.Value Value: 38408431 Key : Hypervisor.Flags.ValueHex Value: 0x24a10ef Key : Hypervisor.Flags.VpAssistPage Value: 1 Key : Hypervisor.Flags.VsmAvailable Value: 1 Key : Hypervisor.RootFlags.AccessStats Value: 1 Key : Hypervisor.RootFlags.CrashdumpEnlightened Value: 1 Key : Hypervisor.RootFlags.CreateVirtualProcessor Value: 1 Key : Hypervisor.RootFlags.DisableHyperthreading Value: 0 Key : Hypervisor.RootFlags.HostTimelineSync Value: 1 Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled Value: 0 Key : Hypervisor.RootFlags.IsHyperV Value: 1 Key : Hypervisor.RootFlags.LivedumpEnlightened Value: 1 Key : Hypervisor.RootFlags.MapDeviceInterrupt Value: 1 Key : Hypervisor.RootFlags.MceEnlightened Value: 1 Key : Hypervisor.RootFlags.Nested Value: 0 Key : Hypervisor.RootFlags.StartLogicalProcessor Value: 1 Key : Hypervisor.RootFlags.Value Value: 1015 Key : Hypervisor.RootFlags.ValueHex Value: 0x3f7 Key : Stack.Pointer Value: PRCBException BUGCHECK_CODE: 3b BUGCHECK_P1: 80000003 BUGCHECK_P2: fffff8008ae7e36c BUGCHECK_P3: ffffaf8163fa58f0 BUGCHECK_P4: 0 FILE_IN_CAB: 080826-26437-01.dmp TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b DUMP_FILE_ATTRIBUTES: 0x21808 Kernel Generated Triage Dump FAULTING_THREAD: ffffc10153a76080 CONTEXT: ffffaf8163fa58f0 -- (.cxr 0xffffaf8163fa58f0) rax=ffffc101504dc020 rbx=0000000000000000 rcx=ffffc101591af2f8 rdx=0000000000000000 rsi=ffffc10150bfc000 rdi=ffffc101591af2f8 rip=fffff8008ae7e36c rsp=ffffd109ff88f6b0 rbp=ffffc101591af040 r8=0000000000000000 r9=0000000000000000 r10=0000000000000002 r11=ffffd109ff88f9d8 r12=0000000000000000 r13=0000000000000007 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00040246 nt!KeReleaseSpinLock+0x2c: fffff800`8ae7e36c 440f22c3 mov cr8,rbx Resetting default scope BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 (!blackboxwinlogon) (!blackboxwinlogonnotify) CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: bf6.exe IP_IN_PAGED_CODE: nt!KeReleaseSpinLock+2c fffff800`8ae7e36c 440f22c3 mov cr8,rbx STACK_TEXT: ffffd109`ff88f6b0 fffff800`8ae7d902 : ffffc101`591af040 fffff800`8b0ecb1d ffffc101`591af040 ffffc101`591af040 : nt!KeReleaseSpinLock+0x2c ffffd109`ff88f6e0 fffff800`8ae7d500 : ffffc101`50bfc00e ffffc101`591af040 ffffc101`50bfc000 ffffc101`50bfc000 : nt!EtwpEnqueueAvailableBuffer+0x112 ffffd109`ff88f730 fffff800`8aed0d80 : ffffc101`591af040 00000000`00000ff0 00000000`00001000 00000000`00601802 : nt!EtwpSwitchBuffer+0x150 ffffd109`ff88f770 fffff800`8ae878cf : ffffc101`50bfcf00 00000000`00000001 ffffd109`ff88f8a0 ffffd109`ff88f858 : nt!EtwpReserveTraceBuffer+0x400 ffffd109`ff88f810 fffff800`8afc329b : 001f0003`00000000 00000000`00000000 ffffc101`53a76080 00000000`00000000 : nt!EtwpLogKernelEvent+0x13f ffffd109`ff88f980 fffff800`8b2bfb4c : ffffc101`53a76080 00000000`ffffffff 00000000`00000000 00000000`00000000 : nt!PerfInfoLogSysCallExit+0xab ffffd109`ff88f9e0 00007ffd`b4aa3954 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExitPico+0x4a1 00000002`2e0ffe78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`b4aa3954 SYMBOL_NAME: nt!KeReleaseSpinLock+2c MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe IMAGE_VERSION: 10.0.26100.8875 STACK_COMMAND: .cxr 0xffffaf8163fa58f0 ; kb BUCKET_ID_FUNC_OFFSET: 2c FAILURE_BUCKET_ID: 0x3B_80000003_nt!KeReleaseSpinLock OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {64d2c3bd-0301-92e2-999e-89ccd9f1e9ad} Followup: MachineOwner ---------
Note: Since your Zendesk/support portal employs strict whitelisting and blocks .dmp and .zip attachments, I have uploaded the raw kernel memory dump to my cloud drive. Your engineering team can download and analyze it directly here:
https://drive.google.com/file/d/1WgYR-Sq7HJ7BH8ubpllMAxZiReMmGas1/view?usp=sharing
// BUG REPORT CRÍTICO: EA AntiCheat causando SYSTEM_SERVICE_EXCEPTION (0x3B) via Corrupção de SpinLock no ETW
À Equipe de Engenharia e Anti-Cheat da EA,
Escrevo para relatar um problema severo de instabilidade em Ring-0 causado pela iteração atual do EA AntiCheat operando no Battlefield 6. O problema resulta em reinícios abruptos do sistema (hard reboots) e kernel panics (Bugcheck 0x3B) exclusivamente durante a execução do bf6.exe.
Realizei uma análise de causa raiz nos minidumps gerados utilizando o WinDbg. A telemetria comprova que não se trata de uma falha de hardware ou um crash padrão de driver, mas sim de uma colisão direta no kernel do Windows causada pelo motor do Anti-Cheat de vocês.
Telemetria Técnica e Causa Raiz:
Código do Bugcheck: SYSTEM_SERVICE_EXCEPTION (0x3b)
Código da Exceção: 0x80000003 (STATUS_BREAKPOINT)
Processo Causador: bf6.exe
Failure Bucket ID: 0x3B_80000003_nt!KeReleaseSpinLock
Mecânica da Falha: O stack trace (KiSystemServiceExitPico > PerfInfoLogSysCallExit > EtwpLogKernelEvent) revela que o crash ocorre dentro do subsistema Event Tracing for Windows (ETW).
Quando o Windows opera com a Segurança Baseada em Virtualização (VBS) ou a Integridade de Código Imposta pelo Hypervisor (HVCI) ativadas, o EA AntiCheat aciona uma condição de corrida (race condition) ao realizar hooks nas chamadas de sistema (syscalls) monitoradas pelo ETW. Essa colisão corrompe um SpinLock de memória. Quando o kernel do Windows tenta liberar essa trava (nt!KeReleaseSpinLock), ele detecta a corrupção de memória e dispara um breakpoint intencional (0x80000003) para evitar a corrupção do unpaged pool, resultando na paralisação imediata do sistema.
Replicação e Mitigação: O problema é 100% reproduzível em sistemas com VBS/Isolamento de Núcleo ativos. A mitigação temporária que encontrei exige que os usuários desativem completamente a Integridade de Memória do Windows (VBS) ou reconstruam as assinaturas do Anti-Cheat, o que representa um comprometimento massivo de segurança apenas para conseguir rodar o jogo.
Conclusão e Solicitação: Muitos jogadores que estão enfrentando reinícios abruptos aleatórios ao jogar BF6 provavelmente estão acionando o RMA de suas fontes de alimentação ou GPUs, completamente inconscientes de que se trata de uma colisão de software em nível de kernel.
Estou fornecendo estes dados de debug para acelerar o processo de correção (patching) de vocês. Se esta análise de causa raiz provar ser valiosa para a equipe de engenharia na resolução desta vulnerabilidade crítica em Ring-0, eu apreciaria muito um gesto de reconhecimento. Se possível, gostaria de receber uma insígnia exclusiva no jogo, uma dog tag, ou qualquer item cosmético com a temática do Brasil concedido à minha conta.
Atenciosamente,
Nota: Como o portal de suporte bloqueia anexos .dmp e .zip, extraí o stack trace bruto gerado pelo comando !analyze -v no WinDbg. A equipe de engenharia pode visualizar o log técnico completo aqui:
https://drive.google.com/file/d/1WgYR-Sq7HJ7BH8ubpllMAxZiReMmGas1/view?usp=sharing
