Crash in cfgrelayex, Analyzed 2 dumps, total processed 74, rate equals 2.70%

Top 1: Version = 2.7224.1000.620, Total count = 2

dump count = 1

ChildEBP RetAddr  
043be138 7796dfd1 ntdll!_SEH_prolog4_GS+0x19
043be1d0 7796d9e9 ntdll!LdrpGetDelayloadExportDll+0x80
043be46c 7797f6ee ntdll!LdrpHandleProtectedDelayload+0x79
043be4bc 761d3a1c ntdll!LdrResolveDelayLoadedAPI+0x1ee
043be4dc 761dbd53 gdi32full!__delayLoadHelper2+0x28
043be608 761d4faa gdi32full!_tailMerge_textshaping_dll+0xd
043bebb0 761d6f9f gdi32full!LoadFont+0x5b7
043bebd4 761d5a69 gdi32full!FindOrCreateFaceCache+0x98
043becd8 761a9d6c gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x7f
043bf078 761aa196 gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x2ac
043bf184 761a790b gdi32full!ScriptStringAnalyse+0x3e6
043bf2bc 76cec4d8 gdi32full!LpkCharsetDraw+0x53b
043bf2f0 75fec903 gdi32!g_pEdgeGdi+0xc
043bf374 75fec2fd user32!DT_GetLineBreak+0x113
043bf434 7600698e user32!DrawTextExWorker+0x1ed
043bf450 6b8fee89 user32!DrawTextExW+0x1e
043bf8ec 6b8fc349 uxtheme!CThemeWnd::GetNcWindowMetrics+0x809
043bfa38 75fe70c3 uxtheme!_ThemeDefWindowProc+0x899
043bfb2c 75fe6b2a user32!UserCallWinProcCheckWow+0x4d3
043bfb90 75ff0217 user32!DispatchClientMessage+0xea
043bfbd0 779a71dc user32!__fnINLPWINDOWPOS+0x37
043bfc20 7716129c ntdll!KiUserCallbackDispatcher+0x4c
043bfc24 6b92b77f win32u!NtUserSetWindowPos+0xc
043bfc50 6b8fdd73 uxtheme!OnOwpPreDwmCompositionChanged+0x4f
043bfcac 75fe706a uxtheme!ThemePreWndProc+0x413
043bfda0 75fe59c8 user32!UserCallWinProcCheckWow+0x47a
043bfe1c 75fe5500 user32!DispatchMessageWorker+0x4b8
043bfe28 7b89f5a1 user32!DispatchMessageW+0x10
043bfe4c 7b89f2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
043bfeac 7b8a196f CfgRelayEx!CConfigCenterStub::Process+0xa7
043bfeb8 7b8bffcb CfgRelayEx!CThread::ThreadProc+0x1f
043bfef4 766b6839 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
043bff04 7799906f kernel32!BaseThreadInitThunk+0x19
043bff5c 7799903d ntdll!__RtlUserThreadStart+0x2b
043bff6c 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
03a5f8ac 7c0c345d ntdll!RtlInitUnicodeString+0x1b
03a5f8f4 7c0c3c0f CfgRelayEx!CChannelImpl::Run+0x3d
03a5f8fc 7c0dffcb CfgRelayEx!CChannelImpl::ThreadImpl+0xf
03a5f938 77116359 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
03a5f948 775b7b74 kernel32!BaseThreadInitThunk+0x19
03a5f9a4 775b7b44 ntdll!__RtlUserThreadStart+0x2f
03a5f9b4 00000000 ntdll!_RtlUserThreadStart+0x1b