Crash in cfgrelayex, Analyzed 4 dumps, total processed 210, rate equals 1.90%

Top 1: Version = 2.7224.1000.620, Total count = 4

dump count = 1

003ff62c 758114ad ntdll!RtlFreeHeap+0x105
003ff640 508d2d01 kernel32!HeapFree+0x14
003ff654 508d0cf2 CfgRelayEx!_free_base+0x1c
003ff668 508d0da6 CfgRelayEx!free_environment<wchar_t>+0x1a
003ff670 508d11f3 CfgRelayEx!__dcrt_uninitialize_environments_nolock+0x29
003ff674 508d81c5 CfgRelayEx!uninitialize_environment+0x5
003ff68c 508d12e7 CfgRelayEx!__acrt_execute_uninitializers+0x2f
003ff698 508b8fac CfgRelayEx!__acrt_uninitialize+0xf
003ff6a4 508b92fe CfgRelayEx!__scrt_uninitialize_crt+0x1a
003ff6e0 508b918f CfgRelayEx!dllmain_crt_process_detach+0x60
003ff6ec 508b93df CfgRelayEx!dllmain_crt_dispatch+0x4e
003ff72c 508b947d CfgRelayEx!dllmain_dispatch+0xaf
003ff740 77089264 CfgRelayEx!_DllMainCRTStartup+0x1c
003ff760 770a8fa8 ntdll!LdrpCallInitRoutine+0x14
003ff804 770a8e4a ntdll!LdrShutdownProcess+0x1aa
003ff818 75817a3c ntdll!RtlExitUserProcess+0x74
003ff82c 0022275a kernel32!ExitProcessStub+0x12
003ff838 002226ef srvhost!exit_or_terminate_process+0x40
003ff870 00222895 srvhost!common_exit+0xee
003ff884 00217e90 srvhost!exit+0x11
003ff8c4 7581343d srvhost!__scrt_common_main_seh+0x179
003ff8d0 77089802 kernel32!BaseThreadInitThunk+0xe
003ff910 770897d5 ntdll!__RtlUserThreadStart+0x70
003ff928 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
WARNING: Frame IP not in any known module. Following frames may be wrong.
0465f908 00511a40 0x33499d1
0465f960 00a7373d 0x511a40
0465fa0c 00a7355d CfgRelayEx!CChannelImpl::SendImpl+0xad
0465fa50 00a73c0f CfgRelayEx!CChannelImpl::Run+0x13d
0465fa58 00a8ffcb CfgRelayEx!CChannelImpl::ThreadImpl+0xf
0465fa94 7586344d CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0465faa0 77599802 kernel32!BaseThreadInitThunk+0xe
0465fae0 775997d5 ntdll!__RtlUserThreadStart+0x70
0465faf8 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
066bf99c 7609171a ntdll!NtWaitForMultipleObjects+0x15
066bfa38 75d619fc KERNELBASE!WaitForMultipleObjectsEx+0x100
066bfa80 75d6268c kernel32!WaitForMultipleObjectsExImplementation+0xe0
066bfa9c 611b3587 kernel32!WaitForMultipleObjects+0x18
066bfaec 611b3c0f CfgRelayEx!CChannelImpl::Run+0x167
066bfaf4 611cffcb CfgRelayEx!CChannelImpl::ThreadImpl+0xf
066bfb30 75d6343d CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
066bfb3c 77ba9832 kernel32!BaseThreadInitThunk+0xe
066bfb7c 77ba9805 ntdll!__RtlUserThreadStart+0x70
066bfb94 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
04ebe1a0 771f1f6f gdi32full!GetFontRealizationInfo+0x1c
04ebe750 771e7e0b gdi32full!LoadFont+0x70
04ebe774 771e7f62 gdi32full!FindOrCreateFaceCache+0xc7
04ebe880 77186ad5 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x128
04ebec28 771874cb gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x2a5
04ebed44 77188863 gdi32full!ScriptStringAnalyse+0x3eb
04ebeec0 77186723 gdi32full!LpkCharsetDraw+0xa93
04ebef00 7574f57b gdi32full!LpkDrawTextEx+0x203
04ebef64 7574f481 user32!DT_DrawStr+0x69
04ebefbc 7574f07e user32!DT_GetLineBreak+0xf8
04ebf08c 757bcb2e user32!DrawTextExWorker+0x1c4
04ebf0a8 714c09c4 user32!DrawTextExW+0x1e
04ebf10c 714c69aa uxtheme!CTextDraw::GetTextExtent+0x109
04ebf154 714b81bd uxtheme!GetThemeTextExtent+0x8a
04ebf1a8 7148689a uxtheme!_GetNcCaptionTextSize+0x61
04ebf320 71487bde uxtheme!CThemeWnd::GetNcWindowMetrics+0x26a
04ebf404 7148c30f uxtheme!_WindowPosChangedWorker+0x73
04ebf410 714890c0 uxtheme!OnOwpPostWindowPosChanged+0x1f
04ebf478 75744630 uxtheme!ThemePostWndProc+0x340
04ebf574 7574408a user32!UserCallWinProcCheckWow+0x4f0
04ebf5d8 75751487 user32!DispatchClientMessage+0xea
04ebf618 772e91bd user32!__fnINLPWINDOWPOS+0x37
04ebf668 76e412ac ntdll!KiUserCallbackDispatcher+0x4d
04ebf66c 714b643f win32u!NtUserSetWindowPos+0xc
04ebf698 7148a458 uxtheme!OnOwpPreDwmCompositionChanged+0x4f
04ebf718 757445d8 uxtheme!ThemePreWndProc+0x988
04ebf814 75742ec5 user32!UserCallWinProcCheckWow+0x498
04ebf890 75742a10 user32!DispatchMessageWorker+0x4a5
04ebf89c 77ebf5a1 user32!DispatchMessageW+0x10
04ebf8c0 77ebf2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
04ebf920 77ec196f CfgRelayEx!CConfigCenterStub::Process+0xa7
04ebf92c 77edffcb CfgRelayEx!CThread::ThreadProc+0x1f
04ebf968 76c57ba9 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
04ebf978 772dc11b kernel32!BaseThreadInitThunk+0x19
04ebf9d0 772dc09f ntdll!__RtlUserThreadStart+0x2b
04ebf9e0 00000000 ntdll!_RtlUserThreadStart+0x1b