Crash in cfgrelayex, Analyzed 2 dumps, total processed 25, rate equals 8.00%

Top 1: Version = 2.7224.1000.620, Total count = 2

dump count = 1

ChildEBP RetAddr  
0438e018 7742e959 ntdll!RtlpEnterCriticalSectionContended+0x8
0438e024 75365feb ntdll!RtlEnterCriticalSection+0x49
0438e398 75360cb4 gdi32full!GetFontRealizationInfo+0xcb
0438e948 75361816 gdi32full!LoadFont+0x76
0438e96c 75362039 gdi32full!FindOrCreateFaceCache+0x98
0438ea70 753693f4 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x7f
0438ee18 753677f6 gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x284
0438f284 753668ef gdi32full!ScriptStringAnalyse+0xa16
0438f434 75366140 gdi32full!LpkCharsetDraw+0x60f
0438f460 7719ae0d gdi32full!LpkDrawTextEx+0x30
0438f4bc 7719aca4 user32!DT_DrawStr+0x5f
0438f51c 7719a7db user32!DT_GetLineBreak+0xa2
0438f5ec 7719a5de user32!DrawTextExWorker+0x1f9
0438f608 741ae6ea user32!DrawTextExW+0x1e
0438f66c 741add84 uxtheme!CTextDraw::GetTextExtent+0xa4
0438f6b4 741a4349 uxtheme!GetThemeTextExtent+0x74
0438f708 741b0fa7 uxtheme!_GetNcCaptionTextSize+0x61
0438f7fc 741b295c uxtheme!CThemeWnd::GetNcWindowMetrics+0x307
0438f8a8 741b2a0f uxtheme!_WindowPosChangedWorker+0x7c
0438f8b4 741af565 uxtheme!OnOwpPostWindowPosChanged+0x1f
0438f904 771a5ef3 uxtheme!ThemePostWndProc+0x355
0438f9ec 771a5aca user32!UserCallWinProcCheckWow+0x363
0438fa50 771acf37 user32!DispatchClientMessage+0xea
0438fa90 77463aed user32!__fnINLPWINDOWPOS+0x37
0438fae0 75e8124c ntdll!KiUserCallbackDispatcher+0x4d
0438fae4 741cd4af win32u!NtUserSetWindowPos+0xc
0438fb10 741b010f uxtheme!OnOwpPreDwmCompositionChanged+0x4f
0438fb6c 771a5e9f uxtheme!ThemePreWndProc+0x43f
0438fc54 771a3c3a user32!UserCallWinProcCheckWow+0x30f
0438fcc8 771a3a00 user32!DispatchMessageWorker+0x22a
0438fcd4 693cf5a1 user32!DispatchMessageW+0x10
0438fcf8 693cf2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
0438fd58 693d196f CfgRelayEx!CConfigCenterStub::Process+0xa7
0438fd64 693effcb CfgRelayEx!CThread::ThreadProc+0x1f
0438fda0 755ffa29 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0438fdb0 774575f4 kernel32!BaseThreadInitThunk+0x19
0438fe0c 774575c4 ntdll!__RtlUserThreadStart+0x2f
0438fe1c 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
03a5f8ac 7c0c345d ntdll!RtlInitUnicodeString+0x1b
03a5f8f4 7c0c3c0f CfgRelayEx!CChannelImpl::Run+0x3d
03a5f8fc 7c0dffcb CfgRelayEx!CChannelImpl::ThreadImpl+0xf
03a5f938 77116359 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
03a5f948 775b7b74 kernel32!BaseThreadInitThunk+0x19
03a5f9a4 775b7b44 ntdll!__RtlUserThreadStart+0x2f
03a5f9b4 00000000 ntdll!_RtlUserThreadStart+0x1b