Server 2019 Domain Controllers BSOD After August/September 2026 CUs (KB5120238 / KB5122876)

Your five domain controllers failing while fourteen member servers remain unaffected is an important pattern, but it does not establish an AD DS defect. The strongest clue is 0xC0000428, which Microsoft identifies as STATUS_INVALID_IMAGE_HASH, indicating an image could not be verified against its catalog.

Since you already examined the dump and Code Integrity operational log, repeating those checks alone is unlikely to help. During a maintenance window, capture a fresh failure on one recoverable DC with Code Integrity verbose logging enabled, then preserve the dump, CBS logs, and boot configuration before recovery. Provide these privately to Microsoft Support, alongside the exact cumulative updates and your writable DC versus RODC results. Ask them to identify the rejected image and confirm any applicable servicing issue. I cannot confirm a documented fix for those updates; disabling signature enforcement would conceal the failure rather than resolve it.