Windows 2012 BSOD - dump output

Question

Hello,
1 of our Windows 2012 R2 server has been blue screening to day, any ideas what the bug might be?  It is our Citrix server so many users are logged in most of the time, here is the memory.dmp out put via Windbg:
Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\MEMORY.DMP]
Kernel Bitmap Dump File: Only kernel address space is available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 8 Kernel Version 9600 MP (4 procs) Free x64
Product: Server, suite: TerminalServer
Built by: 9600.17630.amd64fre.winblue_r7.150109-2022
Machine Name:
Kernel base = 0xfffff802`b1a76000 PsLoadedModuleList = 0xfffff802`b1d4f250
Debug session time: Fri May  1 15:55:24.789 2015 (UTC + 1:00)
System Uptime: 0 days 7:53:47.588
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
*                        Bugcheck Analysis                                    *
Use !analyze -v to get detailed debugging information.
BugCheck 139, {3, fffff802b4fe47f0, fffff802b4fe4748, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )
Followup: MachineOwner
0: kd> !analyze -v
*                        Bugcheck Analysis                                    *
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff802b4fe47f0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff802b4fe4748, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
TRAP_FRAME:  fffff802b4fe47f0 -- (.trap 0xfffff802b4fe47f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe001e61412d8 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff802b1c087bb rsp=fffff802b4fe4980 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000002 r10=fffff802b1a76000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe cy
nt! ?? ::FNODOBFM::`string'+0x3190b:
fffff802`b1c087bb cd29            int     29h
Resetting default scope
EXCEPTION_RECORD:  fffff802b4fe4748 -- (.exr 0xfffff802b4fe4748)
ExceptionAddress: fffff802b1c087bb (nt! ?? ::FNODOBFM::`string'+0x000000000003190b)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
DEFAULT_BUCKET_ID:  LIST_ENTRY_CORRUPT
BUGCHECK_STR:  0x139
PROCESS_NAME:  System
CURRENT_IRQL:  2
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_PARAMETER1:  0000000000000003
TAG_NOT_DEFINED_c000000f:  FFFFF802B4FEBFB0
LAST_CONTROL_TRANSFER:  from fffff802b1bd24e9 to fffff802b1bc69a0
STACK_TEXT:  
fffff802`b4fe44c8 fffff802`b1bd24e9 : 00000000`00000139 00000000`00000003 fffff802`b4fe47f0 fffff802`b4fe4748 : nt!KeBugCheckEx
fffff802`b4fe44d0 fffff802`b1bd2810 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff802`b4fe4610 fffff802`b1bd1a34 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
fffff802`b4fe47f0 fffff802`b1c087bb : fffff802`b1d79180 00000000`00000000 fffff802`b4fe4ae0 ffffe001`efac1350 : nt!KiRaiseSecurityCheckFailure+0xf4
fffff802`b4fe4980 fffff802`b1b2a987 : ffffffff`fffe7960 00000000`00000001 fffff802`b4fe4ae0 fffff802`00000002 : nt! ?? ::FNODOBFM::`string'+0x3190b
fffff802`b4fe49e0 fffff802`b1bca4ea : fffff802`b1d79180 fffff802`b1d79180 fffff802`b1dd2a00 ffffe001`ede29080 : nt!KiRetireDpcList+0xa57
fffff802`b4fe4c60 00000000`00000000 : fffff802`b4fe5000 fffff802`b4fdf000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a
STACK_COMMAND:  kb
FOLLOWUP_IP: 
nt!KiFastFailDispatch+d0
fffff802`b1bd2810 c644242000      mov     byte ptr [rsp+20h],0
SYMBOL_STACK_INDEX:  2
SYMBOL_NAME:  nt!KiFastFailDispatch+d0
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  54b0c2f7
BUCKET_ID_FUNC_OFFSET:  d0
FAILURE_BUCKET_ID:  0x139_3_nt!KiFastFailDispatch
BUCKET_ID:  0x139_3_nt!KiFastFailDispatch
Followup: MachineOwner

Answer 1

I usually start with MSDN analytical articles. In this case
https://msdn.microsoft.com/en-us/library/windows/hardware/jj569891(v=vs.85).aspx
HTH
Milos