Here is what my debugged minidump said.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffd900c1c02000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff960000bce7e, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000007, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef9100
GetUlongFromAddress: unable to read from fffff80002ef91c0
ffffd900c1c02000 Nonpaged pool
FAULTING_IP:
win32k!RFONTOBJ::bGetGlyphMetricsPlus+ae
fffff960`000bce7e 833800 cmp dword ptr [rax],0
MM_INTERNAL_CODE: 7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) x86fre
TRAP_FRAME: fffff88006f1bc30 -- (.trap 0xfffff88006f1bc30)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd900c1c02000 rbx=0000000000000000 rcx=fffff900c2044ca0
rdx=000000000000002f rsi=0000000000000000 rdi=0000000000000000
rip=fffff960000bce7e rsp=fffff88006f1bdc0 rbp=fffff900c0081054
r8=fffff900c2a09a70 r9=fffff900c0081054 r10=0000000000000002
r11=fffff88006f1bec8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
win32k!RFONTOBJ::bGetGlyphMetricsPlus+0xae:
fffff960`000bce7e 833800 cmp dword ptr [rax],0 ds:ffffd900`c1c02000=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002d3e53b to fffff80002cc1bc0
STACK_TEXT:
fffff880`06f1bac8 fffff800`02d3e53b : 00000000`00000050 ffffd900`c1c02000 00000000`00000000 fffff880`06f1bc30 : nt!KeBugCheckEx
fffff880`06f1bad0 fffff800`02cbfcee : 00000000`00000000 ffffd900`c1c02000 fffffa80`00000000 fffff880`06f1c000 : nt! ?? ::FNODOBFM::`string'+0x43781
fffff880`06f1bc30 fffff960`000bce7e : 00000000`00000000 00000000`00000080 fffff900`00000021 706d5447`00287fb4 : nt!KiPageFault+0x16e
fffff880`06f1bdc0 fffff960`00256cf9 : 00000000`00000000 fffff900`c2a09a70 fffff880`06f1c000 00000000`41800000 : win32k!RFONTOBJ::bGetGlyphMetricsPlus+0xae
fffff880`06f1be40 fffff960`000bc587 : 00000000`00000000 fffff880`06f1c490 00000000`00000000 fffff900`c00be010 : win32k!ESTROBJ::vCharPos_H1+0x81
fffff880`06f1bed0 fffff960`00092dc2 : 00000000`41800000 00000000`00000000 fffff880`0000002f fffff880`06f1c490 : win32k!ESTROBJ::vInit+0x27f
fffff880`06f1bf60 fffff960`00269a62 : 00000000`00000000 fffff880`00000016 fffff880`00000009 00000000`00000000 : win32k!GreExtTextOutWLocked+0xb12
fffff880`06f1c380 fffff960`000de79f : 00000000`00000004 fffff960`0024256c fffff880`00000000 fffff900`00ffffff : win32k!GreBatchTextOut+0x26a
fffff880`06f1c420 fffff800`02cc0d5c : fffffa80`03f76b50 00000000`00000016 00000000`00000020 00000000`00000020 : win32k!NtGdiFlushUserBatch+0x377
fffff880`06f1c680 000007fe`fdca7cba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceGdiTebAccess+0x25
00000000`06e0f258 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fe`fdca7cba
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!RFONTOBJ::bGetGlyphMetricsPlus+ae
fffff960`000bce7e 833800 cmp dword ptr [rax],0
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: win32k!RFONTOBJ::bGetGlyphMetricsPlus+ae
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 52f4357b
IMAGE_VERSION: 6.1.7601.18388
FAILURE_BUCKET_ID: X64_0x50_win32k!RFONTOBJ::bGetGlyphMetricsPlus+ae
BUCKET_ID: X64_0x50_win32k!RFONTOBJ::bGetGlyphMetricsPlus+ae
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x50_win32k!rfontobj::bgetglyphmetricsplus+ae
FAILURE_ID_HASH: {9ee66fab-80da-1b9b-5071-e6a36baa92cf}
Followup: MachineOwner
---------