NTFS_FILE_SYSTEM bugcheck on Windows 10 November Update 2019

Today I woke up my PC from sleep, and when it booted up none of my screens connected to it would wake up. All I got was a black screen, and no activity from both my mouse and keyboard.

I restarted my PC, to force Windows to load the data from hiberfil.sys rather than from RAM, and at first it seemed like it booted up fine, but after a few seconds it crashed with a NTFS_FILE_SYSTEM bugcheck.

After further analysis of the minidump file, I traced the issue down and discovered that the bugcheck has been keybase.exe's fault.

(I know for a fact that it's not an hard drive issue, since both Windows and the pagefile are stored in an SSD, which has about 85% of serviceable life left.)

Here's the full WinDbg analysis:
```
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 000000af000c09ca
Arg2: 000000000002ce76
Arg3: 000000003af17000
Arg4: 000000003af17000

Debugging Details:
------------------

KEY_VALUES_STRING: 1

Key : Analysis.CPU.Sec
Value: 2

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on BREEZY-PC

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.Sec
Value: 4

Key : Analysis.Memory.CommitPeak.Mb
Value: 75

Key : Analysis.System
Value: CreateObject

Key : Dump.Attributes.InsufficientDumpfileSize
Value: 1

DUMP_FILE_ATTRIBUTES: 0xc
Insufficient Dumpfile Size
Kernel Generated Triage Dump

BUGCHECK_CODE: 24

BUGCHECK_P1: af000c09ca

BUGCHECK_P2: 2ce76

BUGCHECK_P3: 3af17000

BUGCHECK_P4: 3af17000

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: keybase.exe

STACK_TEXT:
ffffb580`4a15d468 fffff804`5023f110 : 00000000`00000024 000000af`000c09ca 00000000`0002ce76 00000000`3af17000 : nt!KeBugCheckEx
ffffb580`4a15d470 fffff804`50237007 : ffffa38f`00000000 00000019`00000002 00000000`2ce76000 00000000`00000000 : Ntfs!NtfsPagingFileIo+0x10840
ffffb580`4a15d580 fffff804`4ce31f39 : ffffa38f`fb509ba0 ffffa38f`ef4c8010 ffffa38f`ef4c83f8 ffffffff`ffffff00 : Ntfs!NtfsFsdRead+0x23087
ffffb580`4a15d640 fffff804`4f7155de : 00000000`00000000 ffffb580`4a15d720 ffffa38f`ef4c8010 ffffb580`4a15d730 : nt!IofCallDriver+0x59
ffffb580`4a15d680 fffff804`4f713f16 : ffffb580`4a15d720 0002ee76`00000084 ffffa381`13169901 ffffffff`0000000d : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
ffffb580`4a15d700 fffff804`4ce31f39 : ffffa38f`ef4c8010 fffff804`4ce545fb 00000001`00000000 00000000`00000005 : FLTMGR!FltpDispatch+0xb6
ffffb580`4a15d760 fffff804`4ce541e3 : 00000000`00000005 ffffa38f`ef4c8010 ffffa381`131699a0 ffffa381`13169a60 : nt!IofCallDriver+0x59
ffffb580`4a15d7a0 fffff804`4ce8e005 : ffffa381`13169950 fffffa80`60017410 ffffa381`131699b0 ffffa381`13169970 : nt!IoPageReadEx+0x1d3
ffffb580`4a15d810 fffff804`4ce8d759 : 00000000`00000002 ffffb580`4a15d8f0 ffffb580`4a15da58 fffff804`4ce74ee6 : nt!MiIssueHardFaultIo+0xc1
ffffb580`4a15d860 fffff804`4ce72f9b : 00000000`c0033333 00000000`00000001 000000c0`02e82000 ffffa38f`f997e080 : nt!MiIssueHardFault+0x489
ffffb580`4a15d960 fffff804`4cfcf320 : 00000000`00b68308 ffffb580`4a15db80 00000000`022e4da5 ffffa38f`f99dea60 : nt!MmAccessFault+0x40b
ffffb580`4a15db00 00000000`00461042 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x360
000000c0`02004a50 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x461042

SYMBOL_NAME: Ntfs!NtfsPagingFileIo+10840

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

IMAGE_VERSION: 10.0.18362.145

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 10840

FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsPagingFileIo

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {d671f571-ce88-c0f6-1555-417ad557fd4c}

Followup: MachineOwner
---------
```

I also attached the minidump, in case it's needed for further analysis by the Keybase team.
[111219-20906-01.zip](https://github.com/keybase/keybase-issues/files/3838559/111219-20906-01.zip)

Start by reviewing the attached 111219-20906-01.zip minidump and the WinDbg output, focusing on the keybase.exe process and the Ntfs.sys paging-file stack on Windows 10 build 18362.145. Reproduce the sleep or hibernation scenario if possible and determine whether Keybase triggers the bugcheck; done means identifying a confirmed cause and a validated fix or mitigation.

Written by the indexing model from the issue text.