Originally Added to Website: 14 Sep 2009
Last
Updated (<— link shows ALL
updates):
21 Oct 2014
Updates are now limited to adding new BSOD's. The sheer number of new BSOD KB articles is too daunting to keep up with.
When the Windows 10 DDK is released I will add the new BSOD codes.
23 Jul 2014
Added WinDbg
Output Example for STOP 0x153
21 Mar 2014
Added Usual Cause:
memory to STOP 0x74
KB 2931772 -
STOP 0x50 - Win7 SP1/Server 2008 R2 SP1
KB 2920540
- STOP 0xc0000005 - Win8.1/Server 2012 R2
KB
2916627 - STOP 0x8E - Win7/Server 2008 R2
KB
2927725 - STOP 0x101/0x133 -
Win8/Server 2012
KB 2911204 - STOP 0x9F -
Win7/Win8.1/Server 2008 R2/Server 2012 R2
PAGE INFORMATION:
Initial document from the bugcodes.h file in the Windows 7
SDK v7.0; Debugging Tools
For Windows - dated 17 January 2009; Additional information added
as it became verifiable on the web.
- Updated for Win8 on 09May2012 -
added 20 bugchecks
- Updated for Win8.1 on 01Oct2013 - added 23
bugchecks
Some information on Windows NT/2000 links has been left out due to the
enormous number of KB articles available.
As of 02 Apr 2012, I have discontinued listing Windows
2000 articles.
This page will continue to list articles for XP and later OS's for the
foreseeable future.
At last count (20 Nov 2013) there were more than 406 different STOP error messages in
this
listing.
Copyright registered 15 Oct 2009
Take me straight to the BSOD
listing (abbreviated to make looking it up easier)...
Take me to the long
Table of Contents listing...
Take me to the General
Information about BSOD's section...
Take me to the Specific
STOP message troubleshooting section...
Take me to the General
STOP message troubleshooting section...
Please notify me if you find anything wrong, missing, new, or just have
a comment.
I post as usasma
on these forums:
-
Sysnative Forums (preferred method of contact)
- Microsoft
Answers
- Eight Forums
If referring to a specific STOP error message, please attach/upload the
Minidump files (from C:\Windows\Minidump) with your comments.
GENERAL INFORMATION
ABOUT BSOD's:
A BSOD is also known by many other names:
- Blue Screen of Death (hence the BSOD acronym)
- STOP error
- Crash dump
- Memory dump
- Bug Check
- BCCode
A
BSOD is an error that causes Windows to STOP (hence the name "STOP
error"). This is done because the potential exists for damage
to
your system - and Windows is designed to "fail fast" in order to
protect your hardware.
STOP error numbers can either be
the full number (0x0000007B for example), or in "shorthand" (0x7B is
shorthand for 0x0000007B). Capitalization doesn't usually
matter.
It's
been my experience that most STOP errors are caused by 3rd party
drivers - either device drivers, or drivers that are a part of a
software installation. The next most common reason (again,
IME)
is hardware troubles - either broken hardware or compatibility
problems. Finally, there's Windows corruptions - this is
rarer
than the other 2 but it does happen.
To make this easy on
you, just follow through the pages here. If you don't
understand
something, ask on the forums. Due to the great variety of
STOP
errors it's not essential that you understand everything that is said
here - but progressing through each of the steps/links will help you
with resolving a BSOD issue.
Specific
STOP message troubleshooting:
Troubleshooting
specific STOP messages (2000,
but steps do apply to other OS's also)
Contains steps for troubleshooting STOP
0xA, 0x1E, 0x23, 0x24, 0x2E, 0x3F, 0x58, 0x7B, 0x7F, 0xB4, and 0xBE
Troubleshooting
Common Stop Messages (2000,
but steps do apply to other OS's also)
Contains steps for troubleshooting STOP 0xA, 0x1E, 0x24, 0x2E, 0x50,
0x77, 0x79, 0x7A, 0x7B, 0x7F, 0xC0000021A, and 0xC0000221
Troubleshooting
specific Stop messages (Server
2003,
but steps do apply to other OS's also)
Contains links for:
STOP 0x1E - How to
troubleshoot a "Stop error code 0x0000001E
(KMODE_EXCEPTION_NOT_HANDLED)" error message
STOP 0x117 (BSOD not always visible) -
Display driver stopped
responding and has recovered Error message in Windows
Vista or Windows 7
General
STOP message troubleshooting:
First, ensure that you have disabled auto-restart
& enabled mini-dumps - Instructions here: setmini.html
- Blue
Screen Preparation Before Contacting Microsoft (2000 -
but steps do apply to other OS's also)
Submit the information to Microsoft if the system wants to.
Quite
often you won't get any response back - but if you do, it'll be worth
the trouble.
- Troubleshooting
Stop messages: general strategies (Server 2003
- but steps do apply to other OS's also)
-
How to fix BlueScreen (STOP)
errors that cause Windows Vista to shut down or
restart unexpectedly
-
How to read the small memory
dump files that Windows creates for debugging
- BSOD preliminaries - prelim.html
- WinDbg
Analysis Report
generation - dbgrpt.html
- What I do when
analyzing
a BSOD (dated 6/14/2009) - http://www.sevenforums.com/general-discussion/13020-bsod-tcpip-sys-crash.html#post129991
This is an actual analysis of a BSOD, so the context of the entire
topic is important to the procedures that are followed there.
More info on BSOD stuff:
http://www.carrona.org/bsod.html
Misc Tools/Information:
Windows does not create a
memory dump file when a Stop error occurs in Windows 8 or Windows Server 2012
Using Driver Verifier to
identify issues with Windows drivers for advanced users
Description of Windows Kernel event ID 41 error in Windows 7 or in
Windows Server 2008 R2: "The system has rebooted without cleanly
shutting down first"
Secondary dump data
is limited to 256 MB in Windows 7 and Windows Server 2008 R2
A
hotfix is available that enables a Windows 7-based or Windows Server 2008
R2-based computer to create a memory dump file without a page file
Overview of memory
dump file options for Windows 2000, Windows XP, Windows Server 2003,
Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2
Unable to install
updates in Windows Vista, Windows 7, Windows Server 2008 and Windows
Server 2008 R2
Troubleshoot problems
installing and uninstalling programs on Windows-based computers
Description of
Microsoft Internet Information Services (IIS) 5.0 and 6.0 status codes
Description of Code
10-related errors that Device Manager generates in Windows-based
computers
How to use the Debug
Diagnostics tool to troubleshoot a process that has stopped responding
in IIS
How to disable IP
version 6 (IPv6) or its specific components in Windows 7, in Windows
Vista, in Windows Server 2008 R2, and in Windows Server 2008
Troubleshoot network
connection problems in Windows
How to use the Debug
Diagnostics tool to troubleshoot an IIS process that stops unexpectedly
THE BSOD LISTING:
You can find your error message by searching the page for the STOP
Error number ( 0x00000000: ) or the SYMBOLIC_NAME
Or, you can use the links below...
The Table of
Contents Links will take you to the actual (long) Table of Contents.
The actual Table
of Contents contains links to the entry for that
particular error (approx 349 entries).
Table
of Contents Links:
(go
to top of page)
Example Entry
STOP -1073741502
STOP 0x00000001 - STOP 0x0000000F
STOP 0x00000010 - STOP 0x0000001F
STOP 0x00000020 - STOP 0x0000002F
STOP 0x00000030 - STOP 0x0000003F
STOP 0x00000040 - STOP 0x0000004F
STOP 0x00000050 - STOP 0x0000005F
STOP 0x00000060 - STOP 0x0000006F
STOP 0x00000070 - STOP 0x0000007F
STOP 0x00000080 - STOP 0x0000008F
STOP 0x00000090 - STOP 0x0000009F
STOP 0x000000A0 - STOP 0x000000AF
STOP 0x000000B0 - STOP 0x000000BF
STOP 0x000000C0 - STOP 0x000000CF
STOP 0x000000D0 - STOP 0x000000DF
STOP 0x000000E0 - STOP 0x000000EF
STOP 0x000000F0 - STOP 0x000000FF
STOP 0x000000MN
STOP 0x00000100 - STOP 0x0000010F
STOP 0x00000110 - STOP 0x0000011F
STOP 0x00000120 - STOP 0x0000012F
STOP 0x00000130 - STOP 0x0000013F
STOP
0x00000140 - STOP 0x0000014F
STOP 0x00000150 - STOP 0x0000015F
STOP
0x00000160 - STOP 0x00000162
STOP 0x00000333
STOP 0x00000360/420
STOP 0x00000BFE
STOP 0x0000C1F5
STOP 0x00020001
STOP 0x1000000a - STOP 0x100000ea
STOP 0x40000082 - STOP 0x400000ad
STOP 0x70860002
STOP 0x80070246
STOP 0x80080005
STOP 0x8086
STOP 0x9087
STOP 0xA0000001
STOP 0xBADB0D00
STOP 0xC0000005 - STOP 0xC0000415
STOP 0xDEADDEAD
STOP 0xE0010002
Table
Of Contents (go
to top of page)
- Example Entry:
- STOP -1073741502
- STOP 0x00000001:
APC_INDEX_MISMATCH
- STOP 0x00000002: DEVICE_QUEUE_NOT_BUSY
- STOP 0x00000003: INVALID_AFFINITY_SET
- STOP 0x00000004:
INVALID_DATA_ACCESS_TRAP
- STOP 0x00000005:
INVALID_PROCESS_ATTACH_ATTEMPT
- STOP 0x00000006:
INVALID_PROCESS_DETACH_ATTEMPT
- STOP 0x00000007:
INVALID_SOFTWARE_INTERRUPT
- STOP 0x00000008:
IRQL_NOT_DISPATCH_LEVEL
- STOP 0x00000009:
IRQL_NOT_GREATER_OR_EQUAL
- STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL
- STOP 0x0000000B:
NO_EXCEPTION_HANDLING_SUPPORT
- STOP 0x0000000C:
MAXIMUM_WAIT_OBJECTS_EXCEEDED
- STOP 0x0000000D:
MUTEX_LEVEL_NUMBER_VIOLATION
- STOP 0x0000000E: NO_USER_MODE_CONTEXT
- STOP 0x0000000F:
SPIN_LOCK_ALREADY_OWNED
- STOP 0x00000010:
SPIN_LOCK_NOT_OWNED
- STOP 0x00000011:
THREAD_NOT_MUTEX_OWNER
- STOP 0x00000012:
TRAP_CAUSE_UNKNOWN
- STOP 0x00000013:
EMPTY_THREAD_REAPER_LIST
- STOP 0x00000014:
CREATE_DELETE_LOCK_NOT_LOCKED
- STOP 0x00000015:
LAST_CHANCE_CALLED_FROM_KMODE
- STOP 0x00000016:
CID_HANDLE_CREATION
- STOP 0x00000017:
CID_HANDLE_DELETION
- STOP 0x00000018:
REFERENCE_BY_POINTER
- STOP 0x00000019:
BAD_POOL_HEADER
- STOP 0x0000001A:
MEMORY_MANAGEMENT
- STOP 0x0000001B:
PFN_SHARE_COUNT
- STOP 0x0000001C:
PFN_REFERENCE_COUNT
- STOP 0x0000001D:
NO_SPIN_LOCK_AVAILABLE
- STOP 0x0000001E:
KMODE_EXCEPTION_NOT_HANDLED
- STOP 0x0000001F:
SHARED_RESOURCE_CONV_ERROR
- STOP 0x00000020:
KERNEL_APC_PENDING_DURING_EXIT
- STOP 0x00000021:
QUOTA_UNDERFLOW
- STOP 0x00000022:
FILE_SYSTEM
- STOP 0x00000023:
FAT_FILE_SYSTEM
- STOP 0x00000024:
NTFS_FILE_SYSTEM
- STOP 0x00000025:
NPFS_FILE_SYSTEM
- STOP 0x00000026:
CDFS_FILE_SYSTEM
- STOP 0x00000027:
RDR_FILE_SYSTEM
- STOP 0x00000028:
CORRUPT_ACCESS_TOKEN
- STOP 0x00000029:
SECURITY_SYSTEM
- STOP 0x0000002A:
INCONSISTENT_IRP
- STOP 0x0000002B:
PANIC_STACK_SWITCH
- STOP 0x0000002C:
PORT_DRIVER_INTERNAL
- STOP 0x0000002D:
SCSI_DISK_DRIVER_INTERNAL
- STOP 0x0000002E:
DATA_BUS_ERROR
- STOP 0x0000002F:
INSTRUCTION_BUS_ERROR
- STOP 0x00000030:
SET_OF_INVALID_CONTEXT
- STOP 0x00000031:
PHASE0_INITIALIZATION_FAILED
- STOP 0x00000032:
PHASE1_INITIALIZATION_FAILED
- STOP 0x00000033:
UNEXPECTED_INITIALIZATION_CALL
- STOP 0x00000034:
CACHE_MANAGER
- STOP 0x00000035:
NO_MORE_IRP_STACK_LOCATIONS
- STOP 0x00000036:
DEVICE_REFERENCE_COUNT_NOT_ZERO
- STOP 0x00000037:
FLOPPY_INTERNAL_ERROR
- STOP 0x00000038:
SERIAL_DRIVER_INTERNAL
- STOP 0x00000039:
SYSTEM_EXIT_OWNED_MUTEX
- STOP 0x0000003A:
SYSTEM_UNWIND_PREVIOUS_USER
- STOP 0x0000003B:
SYSTEM_SERVICE_EXCEPTION
- STOP 0x0000003C:
INTERRUPT_UNWIND_ATTEMPTED
- STOP 0x0000003D:
INTERRUPT_EXCEPTION_NOT_HANDLED
- STOP 0x0000003E:
MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED
- STOP 0x0000003F:
NO_MORE_SYSTEM_PTES
- STOP 0x00000040:
TARGET_MDL_TOO_SMALL
- STOP 0x00000041:
MUST_SUCCEED_POOL_EMPTY
- STOP 0x00000042:
ATDISK_DRIVER_INTERNAL
- STOP 0x00000043:
NO_SUCH_PARTITION
- STOP 0x00000044:
MULTIPLE_IRP_COMPLETE_REQUESTS
- STOP 0x00000045:
INSUFFICIENT_SYSTEM_MAP_REGS
- STOP 0x00000046:
DEREF_UNKNOWN_LOGON_SESSION
- STOP 0x00000047:
REF_UNKNOWN_LOGON_SESSION
- STOP 0x00000048:
CANCEL_STATE_IN_COMPLETED_IRP
- STOP 0x00000049:
PAGE_FAULT_WITH_INTERRUPTS_OFF
- STOP 0x0000004A:
IRQL_GT_ZERO_AT_SYSTEM_SERVICE
- STOP 0x0000004B:
STREAMS_INTERNAL_ERROR
- STOP 0x0000004C:
FATAL_UNHANDLED_HARD_ERROR
- STOP 0x0000004D:
NO_PAGES_AVAILABLE
- STOP 0x0000004E:
PFN_LIST_CORRUPT
- STOP 0x0000004F:
NDIS_INTERNAL_ERROR
- STOP 0x00000050:
PAGE_FAULT_IN_NONPAGED_AREA
- STOP 0x00000051:
REGISTRY_ERROR
- STOP 0x00000052:
MAILSLOT_FILE_SYSTEM
- STOP 0x00000053:
NO_BOOT_DEVICE
- STOP 0x00000054:
LM_SERVER_INTERNAL_ERROR
- STOP 0x00000055:
DATA_COHERENCY_EXCEPTION
- STOP 0x00000056:
INSTRUCTION_COHERENCY_EXCEPTION
- STOP 0x00000057:
XNS_INTERNAL_ERROR
- STOP 0x00000058:
FTDISK_INTERNAL_ERROR
- STOP 0x00000059:
PINBALL_FILE_SYSTEM
- STOP 0x0000005A:
CRITICAL_SERVICE_FAILED
- STOP 0x0000005B:
SET_ENV_VAR_FAILED
- STOP 0x0000005C:
HAL_INITIALIZATION_FAILED
- STOP 0x0000005D:
UNSUPPORTED_PROCESSOR
- STOP 0x0000005E:
OBJECT_INITIALIZATION_FAILED
- STOP 0x0000005F:
SECURITY_INITIALIZATION_FAILED
- STOP 0x00000060:
PROCESS_INITIALIZATION_FAILED
- STOP 0x00000061:
HAL1_INITIALIZATION_FAILED
- STOP 0x00000062:
OBJECT1_INITIALIZATION_FAILED
- STOP 0x00000063:
SECURITY1_INITIALIZATION_FAILED
- STOP 0x00000064:
SYMBOLIC_INITIALIZATION_FAILED
- STOP 0x00000065:
MEMORY1_INITIALIZATION_FAILED
- STOP 0x00000066:
CACHE_INITIALIZATION_FAILED
- STOP 0x00000067:
CONFIG_INITIALIZATION_FAILED
- STOP 0x00000068:
FILE_INITIALIZATION_FAILED
- STOP 0x00000069:
IO1_INITIALIZATION_FAILED
- STOP 0x0000006A:
LPC_INITIALIZATION_FAILED
- STOP 0x0000006B:
PROCESS1_INITIALIZATION_FAILED
- STOP 0x0000006C:
REFMON_INITIALIZATION_FAILED
- STOP 0x0000006D:
SESSION1_INITIALIZATION_FAILED
- STOP 0x0000006E:
SESSION2_INITIALIZATION_FAILED
- STOP 0x0000006F:
SESSION3_INITIALIZATION_FAILED
- STOP 0x00000070:
SESSION4_INITIALIZATION_FAILED
- STOP 0x00000071:
SESSION5_INITIALIZATION_FAILED
- STOP 0x00000072:
ASSIGN_DRIVE_LETTERS_FAILED
- STOP 0x00000073:
CONFIG_LIST_FAILED
- STOP 0x00000074:
BAD_SYSTEM_CONFIG_INFO
- STOP 0x00000075:
CANNOT_WRITE_CONFIGURATION
- STOP 0x00000076:
PROCESS_HAS_LOCKED_PAGES
- STOP 0x00000077:
KERNEL_STACK_INPAGE_ERROR
- STOP 0x00000078:
PHASE0_EXCEPTION
- STOP 0x00000079:
MISMATCHED_HAL
- STOP 0x0000007A:
KERNEL_DATA_INPAGE_ERROR
- STOP 0x0000007B:
INACCESSIBLE_BOOT_DEVICE
- STOP 0x0000007C:
BUGCODE_NDIS_DRIVER
- STOP 0x0000007D:
INSTALL_MORE_MEMORY
- STOP 0x0000007E:
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
- STOP 0x0000007F:
UNEXPECTED_KERNEL_MODE_TRAP
- STOP 0x00000080:
NMI_HARDWARE_FAILURE
- STOP 0x00000081:
SPIN_LOCK_INIT_FAILURE
- STOP 0x00000082:
DFS_FILE_SYSTEM
- STOP 0x00000083:
OFS_FILE_SYSTEM
- STOP 0x00000084:
RECOM_DRIVER
- STOP 0x00000085:
SETUP_FAILURE
- STOP 0x00000086:
AUDIT_FAILURE
- STOP 0x00000087:
- STOP 0x00000088:
- STOP 0x00000089:
- STOP 0x0000008A:
- STOP 0x0000008B:
MBR_CHECKSUM_MISMATCH
- STOP 0x0000008C:
- STOP 0x0000008D:
- STOP 0x0000008E:
KERNEL_MODE_EXCEPTION_NOT_HANDLED
- STOP 0x0000008F:
PP0_INITIALIZATION_FAILED
- STOP 0x00000090:
PP1_INITIALIZATION_FAILED
- STOP 0x00000091:
WIN32K_INIT_OR_RIT_FAILURE
- STOP 0x00000092:
UP_DRIVER_ON_MP_SYSTEM
- STOP 0x00000093:
INVALID_KERNEL_HANDLE
- STOP 0x00000094:
KERNEL_STACK_LOCKED_AT_EXIT
- STOP 0x00000095:
PNP_INTERNAL_ERROR
- STOP 0x00000096:
INVALID_WORK_QUEUE_ITEM
- STOP 0x00000097:
BOUND_IMAGE_UNSUPPORTED
- STOP 0x00000098:
END_OF_NT_EVALUATION_PERIOD
- STOP 0x00000099:
INVALID_REGION_OR_SEGMENT
- STOP 0x0000009A:
SYSTEM_LICENSE_VIOLATION
- STOP 0x0000009B:
UDFS_FILE_SYSTEM
- STOP 0x0000009C:
MACHINE_CHECK_EXCEPTION
- STOP 0x0000009D:
- STOP 0x0000009E:
USER_MODE_HEALTH_MONITOR
- STOP 0x0000009F:
DRIVER_POWER_STATE_FAILURE
- STOP 0x000000A0:
INTERNAL_POWER_ERROR
- STOP 0x000000A1:
PCI_BUS_DRIVER_INTERNAL
- STOP 0x000000A2:
MEMORY_IMAGE_CORRUPT
- STOP 0x000000A3:
ACPI_DRIVER_INTERNAL
- STOP 0x000000A4:
CNSS_FILE_SYSTEM_FILTER
- STOP 0x000000A5:
ACPI_BIOS_ERROR
- STOP 0x000000A6:
FP_EMULATION_ERROR
- STOP 0x000000A7:
BAD_EXHANDLE
- STOP 0x000000A8:
BOOTING_IN_SAFEMODE_MINIMAL
- STOP 0x000000A9:
BOOTING_IN_SAFEMODE_NETWORK
- STOP 0x000000AA:
BOOTING_IN_SAFEMODE_DSREPAIR
- STOP 0x000000AB:
SESSION_HAS_VALID_POOL_ON_EXIT
- STOP 0x000000AC:
HAL_MEMORY_ALLOCATION
- STOP 0x000000AD:
VIDEO_DRIVER_DEBUG_REPORT_REQUEST
- STOP 0x000000AE:
- STOP 0x000000AF:
- STOP 0x000000B0:
- STOP 0x000000B1:
- STOP 0x000000B2:
- STOP 0x000000B3:
- STOP 0x000000B4:
VIDEO_DRIVER_INIT_FAILURE
- STOP 0x000000B5:
BOOTLOG_LOADED
- STOP 0x000000B6:
BOOTLOG_NOT_LOADED
- STOP 0x000000B7:
BOOTLOG_ENABLED
- STOP 0x000000B8:
ATTEMPTED_SWITCH_FROM_DPC
- STOP 0x000000B9:
CHIPSET_DETECTED_ERROR
- STOP 0x000000BA:
SESSION_HAS_VALID_VIEWS_ON_EXIT
- STOP 0x000000BB:
NETWORK_BOOT_INITIALIZATION_FAILED
- STOP 0x000000BC:
NETWORK_BOOT_DUPLICATE_ADDRESS
- STOP 0x000000BD:
INVALID_HIBERNATED STATE
- STOP 0x000000BE:
ATTEMPTED_WRITE_TO_READONLY_MEMORY
- STOP 0x000000BF:
MUTEX_ALREADY_OWNED
- STOP 0x000000C0:
PCI_CONFIT_SPACE_ACCESS_FAILURE
- STOP 0x000000C1:
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION
- STOP 0x000000C2:
BAD_POOL_CALLER
- STOP 0x000000C3:
BUGCODE_PSS_MESSAGE_SIGNATURE
- STOP 0x000000C4:
DRIVER_VERIFIER_DETECTED_VIOLATION
- STOP 0x000000C5:
DRIVER_CORRUPTED_EXPOOL
- STOP 0x000000C6:
DRIVER_CAUGHT_MODIFYING_FREED_POOL
- STOP 0x000000C7:
TIMER_OR_DPC_INVALID
- STOP 0x000000C8:
IRQL_UNEXPECTED_VALUE
- STOP 0x000000C9:
DRIVER_VERIFIER_IOMANAGER_VIOLATION
- STOP 0x000000CA:
PNP_DETECTED_FATAL_ERROR
- STOP 0x000000CB:
DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS
- STOP 0x000000CC:
PAGE_FAULT_IN_FREED_SPECIAL_POOL
- STOP 0x000000CD:
PAGE_FAULT_BEYOND_END_OF_ALLOCATION
- STOP 0x000000CE:
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS
- STOP 0x000000CF:
TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE
- STOP 0x000000D0:
DRIVER_CORRUPTED_MMPOOL
- STOP 0x000000D1:
DRIVER_IRQL_NOT_LESS_OR_EQUAL
- STOP 0x000000D2:
BUGCODE_ID_DRIVER
- STOP 0x000000D3:
DRIVER_PORTION_MUST_BE_NONPAGED
- STOP 0x000000D4:
SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD
- STOP 0x000000D5:
DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL
- STOP 0x000000D6:
DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION
- STOP 0x000000D7:
DRIVER_UNMAPPING_INVALID_VIEW
- STOP 0x000000D8:
DRIVER_USED_EXCESSIVE_PTES
- STOP 0x000000D9:
LOCKED_PAGES_TRACKER_CORRUPTION
- STOP 0x000000DA:
SYSTEM_PTE_MISUSE
- STOP 0x000000DB:
DRIVER_CORRUPTED_SYSPTES
- STOP 0x000000DC:
DRIVER_INVALID_STACK_ACCESS
- STOP 0x000000DD:
???BIOS IS NOT ACPI COMPLIANT???
- STOP 0x000000DE:
POOL_CORRUPTION_IN_FILE_AREA
- STOP 0x000000DF:
IMPERSONATING_WORKER_THREAD
- STOP 0x000000E0:
ACPI_BIOS_FATAL_ERROR
- STOP 0x000000E1:
WORKER_THREAD_RETURNED_AT_BAD_IRQL
- STOP 0x000000E2:
MANUALLY_INITIATED_CRASH
- STOP 0x000000E3:
RESOURCE_NOT_OWNED
- STOP 0x000000E4:
WORKER_INVALID
- STOP 0x000000E5:
POWER_FAILURE_SIMULATE
- STOP 0x000000E6:
DRIVER_VERIFIER_DMA_VIOLATION
- STOP 0x000000E7:
INVALID_FLOATING_POINT_STATE
- STOP 0x000000E8:
INVALID_CANCEL_OF_FILE_OPEN
- STOP 0x000000E9:
ACTIVE_EX_WORKER_THREAD_TERMINATION
- STOP 0x000000EA:
THREAD_STUCK_IN_DEVICE_DRIVER
- STOP 0x000000EB:
DIRTY_MAPPED_PAGES_CONGESTION
- STOP 0x000000EC:
SESSION_HAS_VALID_SPECIAL_POOL_ON_EXIT
- STOP 0x000000ED:
UNMOUNTABLE_BOOT_VOLUME
- STOP 0x000000EE:
- STOP 0x000000EF:
CRITICAL_PROCESS_DIED
- STOP 0x000000F0:
- STOP 0x000000F1:
SCSI_VERIFIER_DETECTED_VIOLATION
- STOP 0x000000F2:
HARDWARE_INTERRUPT_STORM
- STOP 0x000000F3:
DISORDERLY_SHUTDOWN
- STOP 0x000000F4:
CRITICAL_OBJECT_TERMINATION
- STOP 0x000000F5:
FLTMGR_FILE_SYSTEM
- STOP 0x000000F6:
PCI_VERIFIER_DETECTED_VIOLATION
- STOP 0x000000F7:
DRIVER_OVERRAN_STACK_BUFFER
- STOP 0x000000F8:
RAMDISK_BOOT_INITIALIZATION_FAILED
- STOP 0x000000F9:
DRIVER_RETURNED_STATUS_REPARSE_FOR_VOLUME_OPEN
- STOP 0x000000FA:
HTTP_DRIVER_CORRUPTED
- STOP 0x000000FB:
RECURSIVE_MACHINE_CHECK
- STOP 0x000000FC:
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
- STOP 0x000000FD:
DIRTY_NOWRITE_PAGES_CONGESTION
- STOP 0x000000FE:
BUGCODE_USB_DRIVER
- STOP 0x000000FF:
RESERVE_QUEUE_OVERFLOW
- STOP 0x000000MN:
- STOP 0x00000100:
LOADER_BLOCK_MISMATCH
- STOP 0x00000101:
CLOCK_WATCHDOG_TIMEOUT
- STOP 0x00000102:
DPC_WATCHDOG_TIMEOUT
- STOP 0x00000103:
MUP_FILE_SYSTEM
- STOP 0x00000104:
AGP_INVALID_ACCESS
- STOP 0x00000105:
AGP_GART_CORRUPTION
- STOP 0x00000106:
AGP_ILLEGALLY_REPROGRAMMED
- STOP 0x00000107:
KERNEL_EXPAND_STACK_ACTIVE
- STOP 0x00000108:
THIRD_PARTY_FILE_SYSTEM_FAILURE
- STOP 0x00000109:
CRITICAL_STRUCTURE_CORRUPTION
- STOP 0x0000010A:
APP_TAGGING_INITIALIZATION_FAILED
- STOP 0x0000010B:
DFSC_FILE_SYSTEM
- STOP 0x0000010C:
FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION
- STOP 0x0000010D:
WDF_VIOLATION
- STOP 0x0000010E:
VIDEO_MEMORY_MANAGEMENT_INTERNAL
- STOP 0x0000010F:
RESOURCE_MANAGER_EXCEPTION_NOT_HANDLED
- STOP 0x00000110:
DRIVER_INVALID_CRUNTIME_PARAMETER
- STOP 0x00000111:
RECURSIVE_NMI
- STOP 0x00000112:
MSRPC_STATE_VIOLATION
- STOP 0x00000113:
VIDEO_DXGKRNL_FATAL_ERROR
- STOP 0x00000114:
VIDEO_SHADOW_DRIVER_FATAL_ERROR
- STOP 0x00000115:
AGP_INTERNAL
- STOP 0x00000116:
VIDEO_TDR_ERROR
- STOP 0x00000117:
VIDEO_TDR_TIMEOUT_DETECTED
- STOP 0x00000118:
NTHV_GUEST_ERROR
- STOP 0x00000119:
VIDEO_SCHEDULER_INTERNAL_ERROR
- STOP 0x0000011A:
EM_INITIALIZATION_FAILURE
- STOP 0x0000011B:
DRIVER_RETURNED_HOLDING_CANCEL_LOCK
- STOP 0x0000011C:
ATTEMPTED_WRITE_TO_CM_PROTECTED_STORAGE
- STOP 0x0000011D:
EVENT_TRACING_FATAL_ERROR
- STOP 0x0000011E:
TOO_MANY_RECURSIVE_FAULTS
- STOP 0x0000011F:
INVALID_DRIVER_HANDLE
- STOP 0x00000120:
BITLOCKER_FATAL_ERROR
- STOP 0x00000121:
DRIVER_VIOLATION
- STOP 0x00000122:
WHEA_INTERNAL_ERROR
- STOP 0x00000123:
CRYPTO_SELF_TEST_FAILURE
- STOP 0x00000124:
WHEA_UNCORRECTABLE_ERROR
- STOP 0x00000125:
NMR_INVALID_STATE
- STOP 0x00000126:
NETIO_INVALID_POOL_CALLER
- STOP 0x00000127:
PAGE_NOT_ZERO
- STOP 0x00000128:
WORKER_THREAD_RETURNED_WITH_BAD_IO_PRIORITY
- STOP 0x00000129:
WORKER_THREAD_RETURNED_WITH_BAD_PAGING_IO_PRIORITY
- STOP 0x0000012A:
MUI_NO_VALID_SYSTEM_LANGUAGE
- STOP 0x0000012B:
FAULTY_HARDWARE_CORRUPTED_PAGE
- STOP 0x0000012C:
EXFAT_FILE_SYSTEM
- STOP 0x0000012D:
VOLSNAP_OVERLAPPED_TABLE_ACCESS
- STOP 0x0000012E:
INVALID_MDL_RANGE
- STOP 0x0000012F:
VHD_BOOT_INITIALIZATION_FAILED
- STOP 0x00000130:
DYNAMIC_ADD_PROCESSOR_MISMATCH
- STOP 0x00000131:
INVALID_EXTENDED_PROCESSOR_STATE
- STOP 0x00000132:
RESOURCE_OWNER_POINTER_INVALID
- STOP 0x00000133:
DPC_WATCHDOG_VIOLATION
- STOP 0x00000134:
DRIVE_EXTENDER
- STOP 0x00000135:
REGISTRY_FILTER_DRIVER_EXCEPTION
- STOP 0x00000136:
VHD_BOOT_HOST_VOLUME_NOT_ENOUGH_SPA
- STOP 0x00000137: WIN32K_HANDLE_MANAGER
- STOP 0x00000138: GPIO_CONTROLLER_DRIVER_ERROR
- STOP 0x00000139: KERNEL_SECURITY_CHECK_FAILURE
- STOP 0x0000013A: KERNEL_MODE_HEAP_CORRUPTION
- STOP 0x0000013B: PASSIVE_INTERRUPT_ERROR
- STOP 0x0000013C: INVALID_IO_BOOST_STATE
- STOP 0x0000013D: CRITICAL_INITIALIZATION_FAILURE
- STOP 0x0000013E: Not documented in the Win8 DP
SDK v8.0
- STOP 0x0000013F: Not documented in the Win8 DP
SDK v8.0
- STOP 0x00000140: STORAGE_DEVICE_ABNORMALITY_DETECTED
- STOP 0x00000141: VIDEO_ENGINE_TIMEOUT_DETECTED
- STOP 0x00000142: VIDEO_TDR_APPLICATION_BLOCKED
- STOP 0x00000143: PROCESSOR_DRIVER_INTERNAL
- STOP 0x00000144: BUGCODE_USB3_DRIVER
- STOP 0x00000145: SECURE_BOOT_VIOLATION
- STOP 0x00000146: NDIS_NET_BUFFER_LIST_INFO_ILLEGALLY_TRANSFERRED
- STOP 0x00000147: ABNORMAL_RESET_DETECTED
- STOP 0x00000148: IO_OBJECT_INVALID
- STOP 0x00000149: REFS_FILE_SYSTEM
- STOP 0x0000014A: KERNEL_WMI_INTERNAL
- STOP 0x0000014B: SOC_SUBSYSTEM_FAILURE
- STOP 0x0000014C: FATAL_ABNORMAL_RESET_ERROR
- STOP 0x0000014D: EXCEPTION_SCOPE_INVALID
- STOP 0x0000014E: SOC_CRITICAL_DEVICE_REMOVED
- STOP 0x0000014F: PDC_WATCHDOG_TIMEOUT
- STOP 0x00000150: TCPIP_AOAC_NIC_ACTIVE_REFERENCE_LEAK
- STOP 0x00000151: UNSUPPORTED_INSTRUCTION_MODE
- STOP 0x00000152: INVALID_PUSH_LOCK_FLAGS
- STOP 0x00000153: KERNEL_LOCK_ENTRY_LEAKED_ON_THREAD_TERMINATION
- STOP 0x00000154: UNEXPECTED_STORE_EXCEPTION
- STOP 0x00000155: OS_DATA_TAMPERING
- STOP 0x00000156: WINSOCK_DETECTED_HUNG_CLOSESOCKET_LIVEDUMP
- STOP 0x00000157: KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION
- STOP 0x00000158: ILLEGAL_IOMMU_PAGE_FAULT
- STOP 0x00000159: HAL_ILLEGAL_IOMMU_PAGE_FAULT
- STOP 0x0000015A: SDBUS_INTERNAL_ERROR
- STOP 0x0000015B: WORKER_THREAD_RETURNED_WITH_SYSTEM_PAGE_PRIORITY_ACTIVE
- STOP 0x0000015C: PDC_WATCHDOG_TIMEOUT_LIVEDUMP
- STOP 0x0000015D: SOC_SUBSYSTEM_FAILURE_LIVEDUMP
- STOP 0x0000015E: BUGCODE_NDIS_DRIVER_LIVE_DUMP
- STOP 0x0000015F: CONNECTED_STANDBY_WATCHDOG_TIMEOUT_LIVEDUMP
- STOP 0x00000160: WIN32K_ATOMIC_CHECK_FAILURE
- STOP 0x00000161: LIVE_SYSTEM_DUMP
- STOP 0x00000162: KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE
- STOP 0x00000333:
- STOP 0x00000360: XBOX_360_SYSTEM_CRASH
- STOP 0x00000420: XBOX_360_SYSTEM_CRASH_RESERVED
- STOP 0x00000BFE: BC_BLUETOOTH_VERIFIER_FAULT
- STOP 0x0000C1F5:
- STOP 0x00020001: HYPERVISOR_ERROR
- STOP 0x1000000A: IRQL_NOT_LESS_OR_EQUAL
- STOP 0x10000050: PAGE_FAULT_IN_NONPAGED_AREA_M
- STOP 0x1000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
- STOP 0x1000007F: UNEXPECTED_KERNEL_MODE_TRAP_M
- STOP 0x1000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
- STOP 0x100000B8: ATTEMPTED_SWITCH_FROM_DPC
- STOP 0x100000CF: TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE
- STOP 0x100000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
- STOP 0x100000D6: DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION_M
- STOP 0x100000EA: THREAD_STUCK_IN_DEVICE_DRIVER_M
- STOP 0x40000082: BUGCODE_PSS_MESSAGE
- STOP 0x40000083: BUGCHECK_TECH_INFO
- STOP 0x40000087: WINDOWS_NT_CSD_STRING
- STOP 0x40000088: WINDOWS_NT_INFO_STRING
- STOP 0x40000089: WINDOWS_NT_MP_STRING
- STOP 0x4000008A: THREAD_TERMINATE_HELD_MUTEX
- STOP 0x4000008B: BUGCODE_PSS_CRASH_INIT
- STOP 0x4000008C: BUGCODE_PSS_CRASH_PROGRESS
- STOP 0x4000008D: BUGCODE_PSS_CRASH_DONE
- STOP 0x4000009D: WINDOWS_NT_INFO_STRING_PLURAL
- STOP 0x4000009E: WINDOWS_NT_RC_STRING
- STOP 0x400000AD: VIDEO_DRIVER_DEBUG_REPORT_REQUEST
- STOP 0x70860002:
- STOP 0x80080005: CO_E_SERVER_EXEC_FAILURE
- STOP 0x8086:
- STOP 0x9087:
- STOP 0x9088:
- STOP 0xA0000001:
- STOP 0xBADB0D00:
- STOP 0xC0000005:
- STOP 0xC000000D:
- STOP 0xC0000034:
- STOP 0xC000009A: STATUS_INSUFFICIENT_RESOURCES
- STOP 0xC0000135: UNABLE_TO_LOCATE_DLL
- STOP 0xC0000142: DLL Initialization Failure
- STOP 0xC0000218: STATUS_CANNOT_LOAD_REGISTRY_FILE
- STOP 0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED Changed to
WINLOGON_FATAL_ERROR in Win8 DP SDK v8.0
- STOP 0xC0000221: STATUS_IMAGE_CHECKSUM_MISMATCH
- STOP 0xC0000244: AUDIT_FAILED
- STOP 0xC000026C: ???FATAL SYSTEM ERROR???
- STOP 0xC00002CB: Security Accounts
Manager initialization failed
- STOP 0xC00002E2: Directory Services could not start because of the
following error:
- STOP 0xC00002E3: ???STATUS_SAM_INIT_FAILURE???
- STOP 0xC0000415: Unknown Error
- STOP 0xDEADDEAD: MANUALLY_INITIATED_CRASH1
- STOP 0xE0010002
Example
Entry:
STOP 0x00000000:
SYMBOLIC_NAME (go
to top of page)
Usual causes:
Text
MSDN Listing
(Win2K ResKit): Link
AUMHA
Listing:
Link
Knowledge
Base Articles:
Link(s)
WinDbg
Help File Entry:
Text
WinDbg
Output Example (I have example dump
files):
Text
Usual causes: Power Shell Console.Write method?
Knowledge
Base Articles:
KB 2701373
"0xC0000142" or "-1073741502" Stop error when many PowerShell scripts call the
Console.Write method or when you try to start many console applications on a
PowerShell console in Windows 7 or in Windows
Server 2008 R2
WinDbg
Help File Entry:
WinDbg
Output Example:
Usual causes:
Checked build kernel error. I suspect that this can be caused
by
something else, as I've seen 2 of these over the past several months -
and none appeared to be a checked build
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818748.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557419(v=VS.85).aspx
Knowledge
Base Articles:
KB 935936
You
receive a Stop error message on a Windows Vista-based
computer: "Stop
0x00000001 (0x00000000, 0x7FFDC000, 0X0000FFFF, 0X00000000)"
KB 942836 Stop
error
message when you try to print content that includes a bitmap on a
Windows Vista-based
computer: "Stop 0x00000001"
KB 2203330 "STOP: 0x00000001"
error occurs in Windows Server
2008 R2 or in Windows
7
KB 2619041
"0x00000001" Stop error in Windows Server
2008 R2 or in Windows 7
WinDbg
Help File Entry:
The APC_INDEX_MISMATCH bug
check has a value of 0x00000001. This indicates that there has been a
mismatch in the APC state index.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The address of the system function (system call) |
| 2 |
The value of the following bit computation:
Thread->ApcStateIndex << 8 |
Previous ApcStateIndex
|
| 3 |
The value of Thread->KernelApcDisable
|
| 4 |
The value of the previous KernelApcDisable
|
Cause
The most common cause of
this bug check is when a file system has a mismatched sequence of KeEnterCriticalRegion
calls and KeLeaveCriticalRegion calls.
Comments
This is a kernel internal
error which can occur only on a checked build. This error occurs on
exit from a system call.
WinDbg
Output Example:
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->KernelApcDisable field. A negative value indicates that
a driver
has disabled APC calls without re-enabling them. A positive
value indicates
that the reverse is true. This check is made on exit from a system call.
Arguments:
Arg1: 8287872f, address of system function (system call)
Arg2: 00000000, Thread->ApcStateIndex << 8 |
Previous ApcStateIndex
Arg3: 00010000, Thread->KernelApcDisable
Arg4: 00000000, Previous KernelApcDisable
STOP 0x00000002:
DEVICE_QUEUE_NOT_BUSY (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818752.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557475(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The DEVICE_QUEUE_NOT_BUSY
bug check has a value of 0x00000002.
This bug check appears very
infrequently.
WinDbg
Output Example:
DEVICE_QUEUE_NOT_BUSY (2)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818756.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558969(v=VS.85).aspx
Knowledge
Base Articles:
KB 841005 You
receive a
"Stop 0x00000003" error message on your Windows XP-based
computer
WinDbg
Help File Entry:
The INVALID_AFFINITY_SET bug
check has a value of 0x00000003.
This bug check appears very
infrequently.
WinDbg
Output Example:
INVALID_AFFINITY_SET (3)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000004:
INVALID_DATA_ACCESS_TRAP (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818763.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559022(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The INVALID_DATA_ACCESS_TRAP
bug check has a value of 0x00000004.
This bug check appears very
infrequently.
WinDbg
Output Example:
INVALID_DATA_ACCESS_TRAP
(4)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000005:
INVALID_PROCESS_ATTACH_ATTEMPT (go
to top of page)
Usual causes:
Specific known issue with XP SP2/Server 2003 and certain Antivirus or
Firewall programs
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818767.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559087(v=VS.85).aspx
AUMHA
Listing: http://aumha.org/a/stop.php#0x05
Knowledge
Base Articles:
KB885958 Your
Windows Server
2003-based terminal server that uses the UPHClean
utility to unload user profiles when users log off may suddenly stop
responding
KB887742 You
receive the Stop error "Stop 0x05 (INVALID_PROCESS_ATTACH_ATTEMPT)" in
Windows XP
Service Pack 2 or Windows Server 2003
KB 908674
Stop error message on
an Exchange Server 2003 server:
"INVALID_PROCESS_ATTACH_ATTEMPT (5)"(STOP 0x5)
WinDbg
Help File Entry:
The
INVALID_PROCESS_ATTACH_ATTEMPT bug check has a value of 0x00000005.
This bug check appears very
infrequently.
WinDbg
Output Example:
INVALID_PROCESS_ATTACH_ATTEMPT
(5)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000006:
INVALID_PROCESS_DETACH_ATTEMPT (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818771.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559160(v=VS.85).aspx
Knowledge
Base Articles:
KB 833314 You
randomly
receive a "stop 0x00000006" error message (2000)
WinDbg
Help File Entry:
The
INVALID_PROCESS_DETACH_ATTEMPT bug check has a value of 0x00000006.
This bug check appears very
infrequently.
WinDbg
Output Example:
INVALID_PROCESS_DETACH_ATTEMPT
(6)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000007:
INVALID_SOFTWARE_INTERRUPT (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818775.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559247(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
INVALID_SOFTWARE_INTERRUPT bug check has a value of 0x00000007.
This bug check appears very
infrequently.
WinDbg
Output Example:
INVALID_SOFTWARE_INTERRUPT
(7)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000008:
IRQL_NOT_DISPATCH_LEVEL (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818780.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559278(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The IRQL_NOT_DISPATCH_LEVEL
bug check has a value of 0x00000008.
This bug check appears very
infrequently.
WinDbg
Output Example:
IRQL_NOT_DISPATCH_LEVEL (8)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000009:
IRQL_NOT_GREATER_OR_EQUAL (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818783.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559337(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
IRQL_NOT_GREATER_OR_EQUAL bug check has a value of 0x00000009.
This bug check appears very
infrequently.
WinDbg
Output Example:
IRQL_NOT_GREATER_OR_EQUAL
(9)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000000A:
IRQL_NOT_LESS_OR_EQUAL (go
to top of page)
Usual causes:
Kernel mode driver, System Service, BIOS, Windows, Virus scanner,
Backup tool, compatibility
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818787.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560129(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x0a
Knowledge
Base Articles:
KB 157936 SMC9232N
Driver Causing Multiple STOP Messages (NT)
KB 183169 Possible
Resolutions to STOP 0x0A, 0x01E, and 0x50 Errors (NT,
2000)
KB 193532 Stop
0x0000000A When Running Executable from Floppy Disk (NT)
KB 227301 STOP:
0x0000000A When You Dual Boot with Windows NT 4.0 on the Same Partition
(NT,
2000)
KB 244617 How
to Use Driver Verifier to Troubleshoot Windows Drivers (2000, XP, Server 2003)
KB 245538 "STOP
0x0000000A" Error Message While Using Rcmdsvc.exe (NT, 2000 Server)
KB 266196 Backup
Exec
8.0 May Cause "Stop 0x0000000A" or Sporadic Reboots (2000)
KB 289205 STOP Errors
0x00000023 and 0x0000000A in Fastfat.sys When a Program Queries the
File System (2000
Server)
KB 307129 "Fatal
System Error" When You Try to Use a Hewlett-Packard 5100C ScanJet (XP)
KB 308605 Stop
0x00000048 or Stop 0x0000000A Caused By Named Pipe File System
(Npfs.sys) (NT)
KB 310628 Easy
CD
Creator 5.0 does not function in Windows XP
KB 310918 "Stop
0x0000000A" Error Message When You Fast Switch Between Users (XP)
KB 311564 "Stop
0x0000000A Irql_Not_Less_or_Equal" Error Message During Windows XP
Upgrade
KB 311806 Windows
XP
restarts when you try to shut down your computer
KB 313687 A
"Stop
0x0000000A" Error Message Occurs If SetTcpInfo Is Required to Wait (2000)
KB 314063 You
receive a
"Stop 0x0000000A" error message in Windows XP
KB 315377 A
"Stop:
0x0000000a" Error Occurs After You Install an HP ScanJet 5100c or 5200c
Scanner (2000)
KB 316676 "STOP
0x0000000A" Error Message When You Change from AC Power to DC Power (XP)
KB 319810 A
Computer May Hang During a Heavy Load with an Ericsson HIS Modem (2000, XP)
KB 321420 "Stop
0x0000000A" Error Message and Computer Stops Responding When You Use
Dial-up RAS Connection (2000)
KB 321613 Stop
0x0a
Error in nt!ExpBoostOwnerThread() on Windows 2000 Server
KB 326189 "Stop" Errors
Occur in ObpDestroySecurityDescriptorHeader (NT Server)
KB 329175 Rdbss.sys
May
Cause STOP 0xA Error (2000)
KB 818501 How to debug a system
after you receive "Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)"
(XP)
KB 816054 "STOP
0x0000000a" Error Message During the Dynamics.exe Process in Great
Plains 7.5 (2000)
KB 818326 STOP
0x0000001D or STOP 0x000000A Stop Error Occurs in Ndis.sys (XP)
KB 819895 STOP
0x0000000A Error When Computer Performs Intensive Operations on USB
Drives (2000,
XP,
Server 2003)
KB 824025 You
Receive a
"STOP 0x0000000a" Error Message That Is Related to the Wdmaud.sys
Driver (2000)
KB 824679 Stop
Error
"0x0000000A" Occurs During a Period of High Hard Disk Activity (2000)
KB 833763 You receive a "Stop
error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)" or a "Stop error code
0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)" on a Windows
2000-based computer
KB 836049 Windows
Server 2003
stops responding with a Stop 0x0000000A error
KB 837384 "Stop:
0x0000000A (00000063, 0000001c, 00000000, parameter4)" error message on
a Windows 2000-based
computer
KB 840551
Intermittent errors in IA64 editions of Windows Server 2003: Stop error code 0x0000009C
(MACHINE_CHECK_EXCEPTION), Stop error code 0x00000024
(NTFS_FILE_SYSTEM), or Stop error code 0x0000000A
(IRQL_NOT_LESS_OR_EQUAL)
KB 841475
Stop error code 0x0000000A in srv.sys during Windows
Server 2003 startup
KB 867778 You
may
receive a "Stop 0X0000000A" Stop error in Ntoskrnl.exe on a Windows 2000-based
computer
KB 892000 You
may receive a "Stop" error message on a computer that is running
Windows Server
2003, Windows 2000,
Windows Small Business Server 2003,
Small Business Server 2000, or Windows XP
KB 897079 A
diagnostic program may immediately close and you may receive a "STOP
0x00000050" or "STOP 0x0000000A" error message in Windows Server 2003,
Windows 2000, or
Windows XP
KB 897574 You
may
receive a
Stop error message after you insert media into a removable disk device
in Windows XP,
Windows Server
2003, or Windows 2000
KB 902069 You
may
receive a "Stop 0x0000000A" error message when you shut down or restart
a computer that is running Windows Server 2003
KB 907353 You
receive a
Stop error message when you use a hardware device on a computer that is
running Windows 2000
KB 908265 You
may
receive a "STOP 0x0000000A" error message on a Windows 2000-based
computer that is running Windows Services for UNIX
KB 908369 You
may receive a "Stop 0x0000000A" error message when a processor on a
Windows Server
2003-based computer resumes from a C1 idle state
KB 910835 Error
message
in Windows Server
2003: "Stop 0x0000000A (0x00000806, 0x00000002,
0x00000000, 0x804fd3aa) IRQL_NOT_LESS_OR_EQUAL"
KB 929338 Stop
error message in Windows XP
with Service Pack 2: "STOP 0x0000001a:
MEMORY_MANAGEMENT" or "STOP 0x0000000a: IRQL_NOT_LESS_OR_EQUAL"
KB 929777 Error
message
when you try to install Windows Vista
on a computer that uses more than 3 GB of RAM: "STOP 0x0000000A"
KB 930261 You
randomly
receive a "Stop 0x0000000A" error in Storport.sys when you start
Windows Vista
KB 932755
An updated Storport
storage driver is available for Windows Server
2003
KB 935806 Troubleshooting
Stop error messages that may occur when you try to install Windows Vista
KB 935920 When
the
Emulex
Elxsli2.sys driver is installed, you may receive a Stop error message
after you upgrade your computer to Windows Server 2003
Service Pack 1
KB 936192 Error
message
on a computer that is running Windows Server 2003:
"Stop 0x0000000a"
KB 936456 Stop
error message when you run a filter driver that calls the
"CmRegisterCallback" routine to register a "RegistryCallback" routine
on a Windows XP
SP2-based computer: "STOP: 0x0000000A"
KB 937455 You
may
receive various Stop error messages on a computer that is running
Windows Server
2003
KB 940984 Stop
error
message if you use two USB streaming-video cameras on a Windows XP
SP2-based computer: "STOP 0x0000000A"
KB 941492 Stop
error
message when the computer resumes from hibernation in Windows Vista:
"STOP 0x0000000A"
KB 941507 Stop
error
message when you start a portable Windows Vista-based
computer that has the lid closed: "STOP: 0x0000000A"
KB 945577 Error
message when a portable Windows Vista-based
computer that has an
integrated or external USB camera device resumes from long-term suspend
mode: "0x000000E4" or "0x0000000A"
KB 949695 Stop
error when you try to hibernate or to resume a Windows Server
2008-based computer or a Windows Vista-based
computer after you run the
"Common Scenario Stress with IO" test: "0x0000000A"
KB 951149 Stop
error on
a Windows Server
2008-based terminal server when the server is running
under a heavy load: "0x0000000A"
KB 954029 Stop error when you
resume a Windows Vista-based
computer that is connected to a USB optical disc drive from standby
"STOP: 0x000000E4" or "STOP: 0x0000000A"
KB 956029 Stop
error when you resume a Windows Vista-based
computer that is connected
to a USB optical disc drive from standby "STOP: 0x000000E4" or "STOP:
0x0000000A"
KB 958867 You
receive a "Stop 0x00000050" or "Stop 0x0000000A" error message when you
hot-replace memory on a Windows Server 2008-based
computer
KB 959660 Stop
error message if you use two USB streaming-video cameras at the same
time on a computer that is running Windows Vista
or Windows Server
2008: "STOP 0x0000000A"
KB 961324 Stop
error message when you run the Dynamic Partition Testing for a Hot
Replace test that is included in the Windows Logo Kit in Windows Vista
or Windows Server
2008: "Stop 0x0000000A"
KB 961799 A Stop error occurs on a
Windows Server 2003-based server when
a user accesses shared files on the server by using an SMB connection
KB 967352 Stop
error
message
when you put a computer that is running Windows Vista
or Windows Server
2008 into hibernation: "STOP 0x000000A0," "STOP
0x0000007a," or "STOP
0x00000077"
KB 969432 Stop
code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL) when multiple legacy SMB
clients manage shared files on a Windows Server 2003-based
file server
at the same time
KB 969550 A
Stop error
occurs on an HP ProLiant server that has the firmware from an
E200/E200i HP Smart Array SAS/SATA controller installed on any Windows
Server platform (2000
Server, Server
2003, Server
2008)
KB 970938 Stop
error when you try to put a Windows Vista
Service Pack 1-based or
Windows Server
2008-based computer into hibernation: "Stop 0x0000000A"
KB 971280 Random
Stop
errors
on a Windows Server
2003-based computer that performs input/output to
file shares hosted on another computer or to a network-attached storage
device
KB 973482 Stop error 0x0A, or Stop
error 0x7E may occur on a computer that is running Windows Vista or Windows Server 2008
KB 975986 Stop error message on a
computer that is running Windows Server 2003 SP2 and
that has almost 4 GB or more of physical memory: "0x00000050" or
"0x0000000A"
KB 976529 Stop error message after
you install a WFP callout driver in Windows Vista SP2 or in
Windows Server 2008 SP2:
"STOP: 0x0000000A"
KB 976746 Error message when a
Windows Server 2008 R2-based
or a Windows 7-based
computer enters hibernation: "STOP: 0x0000000A"
KB 977287 An error message
unexpectedly appears after you create a mirrored volume on a computer
that is running Windows Server
2008 or Windows Vista:
"Stop 0x0000000a IRQL_NOT_LESS_OR_EQUAL"
KB 978571
Stop error message
when you try to put the computer into hibernation (S4) in Windows 7 or in Windows Server 2008 R2: "Stop error code 0x0000000A
(IRQL_NOT_LESS_OR_EQUAL)"
KB 979128 Stop error in Windows Server 2003 SP2:
"0x0000000A IRQL_NOT_LESS_OR_EQUAL"
KB 979444 Error message on a blue
screen on a computer that is running Windows 7 or Windows Server 2008 R2: "STOP:
0x0000000A"
KB 979551 "0x0000000A" error
message when you use CHAP authentication to start a computer that is
running Windows Vista
or Windows Server 2008
from an iSCSI device
KB 979711
Stop error message on a computer that is running
Windows 7 or Windows Server 2008 R2
and that has iSCSI storage: "0x0000000A"
KB 979903 "STOP 0x000000A" Stop
error when there is a request to allocate a large amount of contiguous
physical memory in Windows Server 2008 R2 or Windows 7
KB 982327 "STOP: 0x0000000A
IRQL_NOT_LESS_OR_EQUAL" Stop error message when you try to put the
computer into hibernation (S4) in Windows Vista or in Windows Server 2008
KB 982488 You receive an incorrect
Stop error message when you send a WHEA handler NMI in Windows Vista and in Windows Server 2008
KB 2028982 "0x0000000A" Stop error
message in Windows Vista
or in Windows Server
2008 if iSCSI storage is installed
KB 2479442 Stop error during
startup in Windows Server 2008 or in
Windows
Vista
KB 2517752 "0x0000000A" Stop error
occurs during the shutdown process on a computer that is running
Windows Server 2008
and that has more than 64 processors installed
KB 2536875 "0x0000000A" stop error
occurs if one or more iSCSI disks are installed on a computer that is
running Windows Server 2008 R2
KB 2547257 "0x0000007E"
or "0x0000000A" Stop error occurs when you play and at the same time
record TV content on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2549036 "0x0000000A"
stop error occurs when several applications access the same network
share file by using the MapViewOfFile() API on a computer that is
running Windows 7
or Windows Server 2008
R2
KB 2577968 "0x0000000a" Stop error
occurs on a computer that has a mirrored volume and that is running
Windows Server 2008 R2 or Windows 7
KB 2582260
"0x0000000A" Stop error when you perform ETW tracing on the Afd.sys
driver in
Windows 7 or in Windows
Server 2008 R2
KB 2591837
FIX: Stop error on a
server that is running Forefront Threat Management Gateway 2010:
"IRQL_NOT_LESS_OR_EQUAL (a)" (Server OS's)
KB 2633799
You randomly receive various Stop errors when you change the network
adapter teaming configuration in Windows Server
2008 or in Windows Vista
KB 2673977
"0x0000000A" Stop
error when you disable a network adapter that is used for iSCSI in
Windows 7 or in Windows
Server 2008 R2
KB 2723222
"0x0000000A" Stop error in
Windows Vista,
Windows 7, Windows Server 2008 or
Windows Server 2008 R2
KB 2732487
"0x0000000a" Stop error code when you resume a Windows
7-based computer from sleep or from hibernation
KB 2776366
"0x0000000A" Stop error on a Windows Server 2008 R2-based
Hyper-V server that has many pass-through disks
KB 2807832
"0x0000000A" Stop error
in Windows 7 or Windows
Server 2008 R2
KB 2845653
"0x0000000A" Stop error when you perform a live migration of a virtual machine
on a Windows Server 2012-based cluster
KB 2846833
"0x0000000A" Stop error when you try to resume a
Windows 8-based computer from sleep mode
Many more NT results in 20
pages of this search: http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000000a&x=4&y=15&mkt=en-US&FORM=QBME1&l=1
WinDbg
Help File Entry:
The IRQL_NOT_LESS_OR_EQUAL
bug check has a value of 0x0000000A. This indicates that Microsoft
Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL
or above.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory referenced |
| 2 |
IRQL at time of reference |
| 3 |
0: Read
1: Write
|
| 4 |
Address which referenced memory |
Cause
This bug check is issued if
paged memory (or invalid memory) is accessed when the IRQL is too high.
The error that generates
this bug check usually occurs after the installation of a faulty device
driver, system service, or BIOS.
If you encounter bug check
0xA while upgrading to a later version of Windows, this error might be
caused by a device driver, a system service, a virus scanner, or a
backup tool that is incompatible with the new version.
Resolving
the Problem
If a kernel debugger is
available, obtain a stack trace.
To resolve an
error caused by a faulty device driver, system service, or BIOS
- Restart your computer.
- Press F8 at the character-based menu that displays the
operating system choices.
- Select the Last Known Good Configuration
option from the Windows Advanced Options menu. This
option is most effective when only one driver or service is added at a
time.
To resolve an
error caused by an incompatible device driver, system service, virus
scanner, or backup tool
- Check the System Log in Event Viewer
for error messages that might identify the device or driver that caused
the error.
- Try disabling memory caching of the BIOS.
- Run the hardware diagnostics supplied by the system
manufacturer, especially the memory scanner. For details on these
procedures, see the owner's manual for your computer.
- Make sure the latest Service Pack is installed.
- If your system has small computer system interface (SCSI)
adapters, contact the adapter manufacturer to obtain updated Windows
drivers. Try disabling sync negotiation in the SCSI BIOS, checking the
cabling and the SCSI IDs of each device, and confirming proper
termination.
- For integrated device electronics (IDE) devices, define the
onboard IDE port as Primary only. Also, check each IDE device for the
proper master/subordinate/stand-alone setting. Try removing all IDE
devices except for hard disks.
If the message appears
during an installation of Windows, make sure that the computer and all
installed peripherals are listed in the Microsoft Windows Marketplace
Tested Products List.
Here is a debugging example:
kd> .bugcheck [Lists bug check data.]
Bugcheck code 0000000a
Arguments 00000000 0000001c 00000000 00000000
kd> kb [Lists the stack trace.]
ChildEBP RetAddr Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194
kd> kv [Lists the trap frames.]
ChildEBP RetAddr Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint (FPO: [0,0,0])
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256 (FPO: [0,0] TrapFrame @ 8013eee8)
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194
kd> .trap 8013eee8 [Gets the registers for the trap frame at the time of the fault.]
eax=dec80201 ebx=ffdff420 ecx=8013c71c edx=000003f8 esi=00000000 edi=87038e10
eip=00000000 esp=8013ef5c ebp=8013ef64 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
ErrCode = 00000000
00000000 ??????????????? [The current instruction pointer is NULL.]
kd> kb [Gives the stack trace before the fault.]
ChildEBP RetAddr Args to Child
8013ef68 fe551aa1 ff690268 00000002 fe5620d2 NT!_DbgBreakPoint
8013ef74 fe5620d2 fe5620da ff690268 80404690
NDIS!_EthFilterIndicateReceiveComplete+0x31
8013ef64 00000246 fe551aa1 ff690268 00000002 elnkii!_ElnkiiRcvInterruptDpc+0x1d0
Comments
Before upgrading to a new
version of Windows, remove all third-party device drivers and system
services, and disable any virus scanners. Contact the software
manufacturers to obtain updates of these third-party tools.
WinDbg
Output Example:
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid)
address at an
interrupt request level (IRQL) that is too high. This is
usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00720075, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 =
write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only
on chips which support this level of status)
Arg4: 81c1dfe9, address which referenced memory
STOP 0x0000000B:
NO_EXCEPTION_HANDLING_SUPPORT (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818791.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560171(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
NO_EXCEPTION_HANDLING_SUPPORT bug check has a value of 0x0000000B.
This bug check appears very
infrequently.
WinDbg
Output Example:
NO_EXCEPTION_HANDLING_SUPPORT
(b)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000000C:
MAXIMUM_WAIT_OBJECTS_EXCEEDED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818794.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560236(v=VS.85).aspx
Knowledge
Base Articles:
KB 2869679
"0x0000000C MAXIMUM_WAIT_OBJECTS_EXCEEDED" Stop error on a Windows Server-based
computer with many IP addresses (Server 2008,
Server 2008 R2;
Server 2012)
WinDbg
Help File Entry:
The
MAXIMUM_WAIT_OBJECTS_EXCEEDED bug check has a value of 0x0000000C. This
indicates that the current thread exceeded the permitted number of wait
objects.
Parameters
None
Cause
This bug check results from
the improper use of KeWaitForMultipleObjects or FsRtlCancellableWaitForMultipleObjects.
The caller may pass a
pointer to a buffer in this routine's WaitBlockArray
parameter. The system will use this buffer to keep track of wait
objects.
If a buffer is supplied, the
Count parameter may not exceed MAXIMUM_WAIT_OBJECTS.
If no buffer is supplied, the Count parameter may
not exceed THREAD_WAIT_OBJECTS.
If the value of Count
exceeds the allowable value, this bug check is issued.
WinDbg
Output Example:
MAXIMUM_WAIT_OBJECTS_EXCEEDED
(c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000000D:
MUTEX_LEVEL_NUMBER_VIOLATION (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818798.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560311(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
MUTEX_LEVEL_NUMBER_VIOLATION bug check has a value of 0x0000000D.
This bug check appears very
infrequently.
WinDbg
Output Example:
MUTEX_LEVEL_NUMBER_VIOLATION
(d)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818809.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560360(v=VS.85).aspx
Knowledge
Base Articles:
KB 104903 Stop
Message
Error 0x0000000E (NT)
KB 126462 Windows
NT
Setup Err Msg on NEC Express/II: STOP 0x0000000E
KB 303853 You
receive a "Stop 0x0000000E" error message, or CPU usage increases to
100 percent when a computer disconnects from a remote access session on
your Windows 2000-based
computer
WinDbg
Help File Entry:
The NO_USER_MODE_CONTEXT bug
check has a value of 0x0000000E.
This bug check appears very
infrequently.
WinDbg
Output Example:
NO_USER_MODE_CONTEXT (e)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000000F:
SPIN_LOCK_ALREADY_OWNED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818815.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560412(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The SPIN_LOCK_ALREADY_OWNED
bug check has a value of 0x0000000F. This indicates that a request for
a spin lock has been initiated when the spin lock was already owned.
Parameters
None
Cause
Typically, this error is
caused by a recursive request for a spin lock. It can also occur if
something similar to a recursive request for a spin lock has been
initiated—for example, when a spin lock has been acquired by a thread,
and then that same thread calls a function, which also tries to acquire
a spin lock. The second attempt to acquire a spin lock is not blocked
in this case because doing so would result in an unrecoverable
deadlock. If the calls are made on more than one processor, then one
processor will be blocked until the other processor releases the lock.
This error can also occur,
without explicit recursion, when all threads and all spin locks are
assigned an IRQL. Spin lock IRQLs are always greater than or equal to
DPC level, but this is not true for threads. However, a thread that is
holding a spin lock must maintain an IRQL greater than or equal to that
of the spin lock. Decreasing the thread IRQL below the IRQL level of
the spin lock that it is holding allows another thread to be scheduled
on the processor. This new thread could then attempt to acquire the
same spin lock.
Resolving the Problem
Ensure that you are not
recursively acquiring the lock. And, for threads that hold a spin lock,
ensure that you are not decreasing the thread IRQL to a level below the
IRQL of the spin lock that it is holding.
WinDbg
Output Example:
SPIN_LOCK_ALREADY_OWNED (f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818821.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557243(v=VS.85).aspx
Knowledge
Base Articles:
KB 820841 A
"Stop
0x00000010" Error Occurs in Scsiport.sys in Windows 2000
KB 822384 Some
Windows
2000 Hotfixes May Cause a Conflict with Service Pack 4 for Windows 2000
WinDbg
Help File Entry:
The SPIN_LOCK_NOT_OWNED bug
check has a value of 0x00000010.
This bug check appears very
infrequently.
WinDbg
Output Example:
SPIN_LOCK_NOT_OWNED (10)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000011:
THREAD_NOT_MUTEX_OWNER (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818825.aspx
MSDN
Listing (WDK):
http://msdn.microsoft.com/en-us/library/ff557303(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The THREAD_NOT_MUTEX_OWNER
bug check has a value of 0x00000011.
This bug check appears very
infrequently.
WinDbg
Output Example:
THREAD_NOT_MUTEX_OWNER (11)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818830.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557348(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x12
Knowledge
Base Articles:
KB 297088 Problems
When
You Use Sound Blaster Live Driver with Your Windows 2000-Based
Computer
WinDbg
Help File Entry:
The TRAP_CAUSE_UNKNOWN bug
check has a value of 0x00000012. This indicates that an unknown
exception has occurred.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The unexpected interrupt |
| 2 |
The unknown floating-point exception |
| 3 |
The enabled and asserted status bits. See the processor
definition for details. |
| 4 |
Reserved |
WinDbg
Output Example:
TRAP_CAUSE_UNKNOWN (12)
Arguments:
Arg1: 0000000000000000, Unexpected interrupt.
Arg2: 0000000000000000, Unknown floating point exception.
Arg3: 0000000000000000, The enabled and asserted status bits (see
processor definition).
Arg4: 0000000000000000
STOP 0x00000013:
EMPTY_THREAD_REAPER_LIST (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818835.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557361(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The EMPTY_THREAD_REAPER_LIST
bug check has a value of 0x00000013.
This bug check appears very
infrequently.
WinDbg
Output Example:
EMPTY_THREAD_REAPER_LIST
(13)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000014:
CREATE_DELETE_LOCK_NOT_LOCKED (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557367(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
CREATE_DELETE_LOCK_NOT_LOCKED bug check has a value of 0x00000014.
This bug check appears very
infrequently.
WinDbg
Output Example:
CREATE_DELETE_LOCK_NOT_LOCKED
(14)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000015:
LAST_CHANCE_CALLED_FROM_KMODE (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818840.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557375(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
LAST_CHANCE_CALLED_FROM_KMODE bug check has a value of 0x00000015.
This bug check appears very
infrequently.
WinDbg
Output Example:
LAST_CHANCE_CALLED_FROM_KMODE
(15)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
http://msdn.microsoft.com/en-us/library/ms818843.aspx
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818843(v=MSDN.10).aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557378(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The CID_HANDLE_CREATION bug
check has a value of 0x00000016.
This bug check appears very
infrequently.
WinDbg
Output Example:
CID_HANDLE_CREATION (16)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
http://msdn.microsoft.com/en-us/library/ms818848.aspx
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818848(v=MSDN.10).aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557381(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The CID_HANDLE_DELETION bug
check has a value of 0x00000017.
This bug check appears very
infrequently.
WinDbg
Output Example:
CID_HANDLE_DELETION (17)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Device driver, kernel, hardware
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818851.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557386(v=VS.85).aspx
Knowledge
Base Articles:
KB 957463 Stop
error on a Windows Vista
Service Pack 1-based or Windows Server
2008-based computer that has an integrated graphics
adapter and a
discrete graphics adapter: "Stop 0x00000018"
KB 967776 Stop
errors in
Windows Vista
or Windows Server
2008: “Stop: 0x00000018” or “STOP: 0x000000C2”
WinDbg
Help File Entry:
The REFERENCE_BY_POINTER bug
check has a value of 0x00000018. This indicates that the reference
count of an object is illegal for the current state of the object.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Object type of the object whose reference count is
being lowered. |
| 2 |
Object whose reference count is being lowered. |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
The reference count of an
object is illegal for the current state of the object. Each time a
driver uses a pointer to an object, the driver calls a kernel routine
to increase the reference count of the object by one. When the driver
is done with the pointer, the driver calls another kernel routine to
decrease the reference count by one.
Drivers must match calls to
the routines that increase (reference) and decrease (dereference)
the reference count. This bug check is caused by an inconsistency in
the object’s reference count. Typically, the inconsistency is caused by
a driver that decreases the reference count of an object too many
times, making extra calls that dereference the object. This bug check
can occur because an object's reference count goes to zero while there
are still open handles to the object. It might also occur when the
object’s reference count drops below zero, whether or not there are
open handles to the object.
Resolving the Problem
Make sure that the driver
matches calls to the routines that increase and decrease the reference
count of the object. Make sure that your driver does not make extra
calls to routines that dereference the object (see Parameter 2).
You can use a debugger to
help analyze this problem. To find the handle and pointer count on the
object, use the !object debugger command.
kd> !object address
Where address
is the address of the object given in Parameter 2.
WinDbg
Output Example:
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 88237ce0, Object type of the object whose reference count is
being lowered
Arg2: 88235130, Object whose reference count is being lowered
Arg3: 00000012, Reserved
Arg4: 81d0a391, Reserved
The reference count of an object is
illegal for the current state of the object.
Each time a driver uses a pointer to an
object the driver calls a kernel routine
to increment the reference count of the
object. When the driver is done with the
pointer the driver calls another kernel
routine to decrement the reference count.
Drivers must match calls to the
increment and decrement routines. This bugcheck
can occur because an object's reference
count goes to zero while there are still
open handles to the object, in which
case the fourth parameter indicates the number
of opened handles. It may also occur
when the object?s reference count drops below zero
whether or not there are open handles to
the object, and in that case the fourth parameter
contains the actual value of the pointer
references count.
Usual causes:
Device driver
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818860.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557389(v=VS.85).aspx
AUMHA
Listing: http://aumha.org/a/stop.php#0x19
Problem w/ESET and SandBoxie (thanks to
RedScare!):
http://windows7forums.com/blue-screen-death-bsod/84555-bsods-shortly-after-startup.html#post272422
Knowledge
Base Articles:
KB 156731 Windows
NT
Err. Msg: Stop 0x00000019 in NTFS
KB 179129 STOP
0x0000000A or 0x00000019 Due to Modified Teardrop Attack (NT)
KB 295624 "Stop
0x00000050" or "Stop 0x00000019" While Printing Extended Characters to
a PostScript Printer (NT)
KB 883516 You receive Stop error
code 0x00000019 or Stop error code 0x00000050 in the Tcpip.sys file on
a Windows 2000 Server-based computer
KB 884585 When
you back up to EMC Clarion storage devices in a SAN environment, your
Windows Server
2003-based computer may stop responding after you restart
KB 892260 You
may
receive a "STOP: 0x00000019" error message on a Windows Server 2003-based
computer
KB 905795 When
you try to control a Systems Management Server 2003 client from a
remote location, you experience a Stop error on the Systems Management
Server 2003
client
KB 925259 Error
message when a Delayed Write Failure event is reported in Windows
Server 2003:
"Stop 0x00000019 - BAD_POOL_HEADER" or "Stop 0xCD
PAGE_FAULT_BEYOND_END_OF_ALLOCATION"
KB 931479 The
print server experiences a Stop error when you use the Point and Print
feature to print to a shared printer in Windows Vista (XP, Server 2003)
KB 934177 FIX:
Error message when you connect a scanner or a digital camera to a
computer that is running Windows Vista
or Windows XP
Service Pack 2:
"BAD_POOL_HEADER STOP"
KB 934326 FIX:
Stop
error message when you run the Client for NFS service in Microsoft
Windows Services
for UNIX 3.5: "Stop 0x00000019"
KB 935920 When
the Emulex Elxsli2.sys driver is installed, you may receive a Stop
error message after you upgrade your computer to Windows Server 2003
Service Pack 1
KB 946226 FIX:
You receive a "Stop 0x00000019" error message or a "Stop 0x000000c4"
error message when you access NFS resources by using User Name Mapping
(MS Svcs
for Unix)
KB 947979 FIX:
Stop error message on a computer that has the Gateway for NFS component
of Windows Services
for UNIX 3.5 installed: "Stop 0x00000019"
KB 948289
Error message on a Windows Server 2003-based
computer: "Stop error code 0x00000019"
KB 949531 Stop
error message when you try to install Windows Server 2008
on a computer
that is connected to an iSCSI target LUN by using an iSCSI bootable
network adapter: "STOP 0x00000019"
KB 955015 Stop
error
message on a Windows Server
2008-based computer when the NFS feature is enabled:
"Stop: 0x00000019"
KB 970693 Stop
error message in Windows Server
2008
or Windows Vista
after you
uninstall or reinstall a wireless network adapter driver: "0x00000019
BAD_POOL_HEADER"
KB 971280 Random
Stop errors on a Windows Server
2003-based
computer that performs
input/output to file shares hosted on another computer or to a
network-attached storage device
KB 973026 Error
message on a computer that is running Windows Vista
or on Windows
Server 2008
that has the IPMI driver installed: "Stop 0x00000019"
KB 973097 Stop error message when
the Smb.sys driver is unloaded on a computer that is running Windows Server 2003: "Stop
0x00000019"
KB 974201 Stop
error message when you retrieve WMI connection statistics for iSCSI
after you change the iSCSI configurations on a computer that is running
Windows Server 2008 or Windows Vista: "0x00000019 BAD_POOL_HEADER"
KB 976443 Stop
error message when you retrieve WMI connection statistics for iSCSI
after you change the iSCSI configurations on a computer that is running
Windows Server 2008 R2
or Windows 7:
"0x00000019 BAD_POOL_HEADER"
KB 2280732 You receive Stop error
message 0x000000CD or 0x00000019 on a computer that is running Windows Server 2003 when
corrupted registry hive files are loaded
KB 2669443
"0x00000019" Stop error when you use Internet Explorer 8 to browse webpages in
Windows Vista or in Windows
Server 2008
KB 2712746
"0x00000019" Stop error when you run an SNMP application on a computer that is
running Windows Vista or Windows
Server 2008
KB 2832829
"0x00000019" Stop error when you try to shut down a
Windows 7 or Windows Server 2008 R2-based
computer
WinDbg
Help File Entry:
The BAD_POOL_HEADER bug
check has a value of 0x00000019. This indicates that a pool header is
corrupt.
Parameters
The following parameters are
displayed on the blue screen. Parameter 1 indicates the type
of violation. The meaning of the other parameters depends on the value
of Parameter 1.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
| 0x2 |
The pool entry being checked |
The size of the pool block |
0 |
The special pool pattern check failed.
(The owner has likely corrupted the pool block.)
|
| 0x3 |
The pool entry being checked |
The read-back flink freelist value |
The read-back blink freelist value |
The pool freelist is corrupt.
(In a healthy list, the values of Parameters 2, 3, and 4 should be
identical.)
|
| 0x5 |
One of the pool entries |
Reserved |
The other pool entry |
A pair of adjacent pool entries have headers that
contradict each other. At least one of them is corrupt. |
| 0x6 |
One incorrectly-calculated entry |
Reserved |
The bad entry that caused the miscalculation |
The pool block header's previous size is too large. |
| 0x7 |
0 |
Reserved |
The bad pool entry |
The pool block header size is corrupt. |
| 0x8 |
0 |
Reserved |
The bad pool entry |
The pool block header size is zero. |
| 0x9 |
One incorrectly-calculated entry |
Reserved |
The bad entry that caused the miscalculation |
The pool block header size is corrupted (it is too
large). |
| 0xA |
The pool entry that should have been found |
Reserved |
The virtual address of the page that should have
contained the pool entry |
The pool block header size is corrupt. |
| 0x20 |
The pool entry that should have been found |
The next pool entry |
Reserved |
The pool block header size is corrupt. |
Cause
The pool is already
corrupted at the time of the current request.
This may or may not be due
to the caller.
Resolving
the Problem
The internal pool links must
be walked to figure out a possible cause of the problem.
Then you can use special
pool for the suspect pool tags, or use Driver Verifier on the suspect
driver. The !analyze
extension may be of help in pinpointing the suspect driver, but this is
frequently not the case with pool corrupters.
WinDbg
Output Example:
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the
driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 89d147d8, The pool entry we were looking for within the page.
Arg3: 89d14808, The next pool entry.
Arg4: 08060007, (reserved)
Usual causes:
Device driver, memory, kernel
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818864.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557391(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x1a
Knowledge
Base Articles:
KB 839037 You
receive a
"STOP 0x0000001a" error message on a Windows 2000-based
multiprocessor computer
KB 885272 You
receive a "Stop 0x0000001a" Stop error message on your Windows 2000
Server-based computer that has Physical Address Extensions
(PAE) enabled
KB 929338 Stop
error message in Windows XP
with Service Pack 2: "STOP 0x0000001a:
MEMORY_MANAGEMENT" or "STOP 0x0000000a: IRQL_NOT_LESS_OR_EQUAL"
KB 932094 Error
message when you try to play a movie file that has an .mov extension by
using QuickTime 7 in Windows Vista:
"STOP 0x1A MEMORY_MANAGEMENT"
KB 957967 Stop
error
message on a Windows Server
2008-based computer that has the Hyper-V role installed:
"STOP 0x0000001A"
KB 981791 "STOP:
0x0000001a" error message on a computer that has an Intel Westmere
processor together with the Hyper-V role installed on Windows Server 2008 or on
Windows Server 2008 R2
More STOP errors in this search:
http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000001a&x=3&y=9&mkt=en-US&FORM=QBME1&l=1
WinDbg
Help File Entry:
The MEMORY_MANAGEMENT bug
check has a value of 0x0000001A. This indicates that a severe memory
management error occurred.
Parameters
The following parameters are
displayed on the blue screen. Parameter 1 is the only
parameter of interest; this identifies the exact violation.
| Parameter 1 |
Cause of Error |
| 0x1 |
The fork clone block reference count is corrupt. (This
only occurs on checked builds of Windows.) |
| 0x777 |
The caller is unlocking a system cache address that is
not currently locked. (This address was either never mapped or is being
unlocked twice.) |
| 0x778 |
The system is using the very last system cache view
address, instead of preserving it. |
0x780
0x781 |
The PTEs mapping the argument system cache view have
been corrupted. |
| 0x1000 |
A caller of MmGetSystemAddressForMdl*
tried to map a fully-cached physical page as non-cached. This action
would cause a conflicting hardware translation buffer entry, and so it
was refused by the operating system. Since the caller specified "bug
check on failure" in the requesting MDL, the system had no choice but
to issue a bug check in this instance. |
| 0x1010 |
The caller is unlocking a pageable section that is not
currently locked. (This section was either never locked or is being
unlocked twice.) |
| 0x1234 |
The caller is trying lock a nonexistent pageable
section. |
| 0x1235 |
The caller is trying to protect an MDL with an invalid
mapping. |
| 0x3451 |
The PTEs of a kernel thread stack that has been swapped
out are corrupted. |
0x8888
0x8889 |
Internal memory management structures are corrupted. |
| 0x41283 |
The working set index encoded in the PTE is corrupted. |
| 0x41284 |
A PTE or the working set list is corrupted. |
| 0x41286 |
The caller is trying to free an invalid pool address. |
| 0x41785 |
The working set list is corrupted. |
| 0x41287 |
Internal memory management structures are corrupted. To
further investigate the cause, a kernel memory dump file is needed. |
| 0x61940 |
A PDE has been unexpectedly invalidated. |
| 0x03030303 |
The boot loader is broken. (This value applies only to
Intel Itanium machines.) |
| Other |
An unknown memory management error occurred. |
WinDbg
Output Example:
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must
be individually examined.
Arguments:
Arg1: 00005003, The subtype of the bugcheck.
Arg2: c0802000
Arg3: 000066e0
Arg4: 0a272d40
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818868.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557399(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The PFN_SHARE_COUNT bug
check has a value of 0x0000001B.
This bug check appears very
infrequently.
WinDbg
Output Example:
PFN_SHARE_COUNT (1b)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818873.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557401(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The PFN_REFERENCE_COUNT bug
check has a value of 0x0000001C.
This bug check appears very
infrequently.
WinDbg
Output Example:
PFN_REFERENCE_COUNT (1c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000001D:
NO_SPIN_LOCK_AVAILABLE (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818877.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557404(v=VS.85).aspx
Knowledge
Base Articles:
KB 818326 STOP
0x0000001D or STOP 0x000000A Stop Error Occurs in Ndis.sys (XP)
WinDbg
Help File Entry:
The NO_SPIN_LOCK_AVAILABLE
bug check has a value of 0x0000001D.
This bug check appears very
infrequently.
WinDbg
Output Example:
NO_SPIN_LOCK_AVAILABLE (1d)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000001E:
KMODE_EXCEPTION_NOT_HANDLED (go
to top of page)
Usual causes:
Device driver, hardware, System service, compatibility, Remote control
programs, memory, BIOS
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818890.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557408(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x1e
Knowledge
Base Articles:
KB 132470 STOP
Msg:
0x0000000A or 0x0000001E When Using PING (NT)
KB 157936 SMC9232N
Driver Causing Multiple STOP Messages (NT)
KB 161703 "Stop:
0x0000001E" Error Message During Setup (NT, 2000)
KB 195857 Open
Handles
Cause STOP 0x0000001E or STOP 0x00000024 (NT, 2000)
KB 264223 How
to
Troubleshoot "Stop 0x0000001E" with First Parameter of 0xC0000044 (NT, 2000)
KB 269593 "Stop
0x0000001e" in Win32k.sys When You Quit a Program (2000)
KB 278999 Stop
0x0000001E in Win32k.sys When Using Animated Mouse Pointers (2000)
KB 279640 "Stop
0x0000001e" on Windows 2000
Server
KB 284154 STOP
0X0000001E in Protcls.sys When You Undock a Toshiba Tecra 8100 (XP)
KB 294690 "Stop
0x0000001E" Error Message in Ntoskrnl.exe (2000)
KB 294728
Error message: "Stop error code 0x0000001E
(KMODE_EXCEPTION_NOT_HANDLED)" in Win32k.sys or a "Stop error code
0xC000021A" (2000/NT 4.0)
KB 302971 "Stop
0x1E" or
"Stop 0xc5" After You Install Service Pack 2 and You Use Logitech Mouse
Drivers (2000)
KB 306119 Stop
0x0000001E Loading Adobe Type Manager Font Driver (2000)
KB 307128 "STOP
0x0000001E KMODE_EXCEPTION_NOT_HANDLED" Error Message from Aspi32.sys (XP)
KB 314451 "STOP
0x0000001E" Error Message During Windows Setup (XP)
KB 317153 Stop
0x0000001e or Stop 0x00000050 Error in Navap.sys When You Use Norton
AutoProtect Feature (NT
Server, 2000
Server)
KB 811014
"Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED in
NTOSKRNL.EXE)" error message after you install pcAnywhere (2000)
KB 815265 "STOP
0x00000051" or "STOP 0x0000001E" error message when you start
Configuration Manager in Windows 2000 Server
or in Windows XP
KB 816047 STOP 0x1E in Win32k.sys
Error May Occur in Windows 2000
or Windows XP
Professional
KB 824288
"Stop error code
0x0000001E" in Mup.sys after you apply Windows 2000 SP4
KB 828514
Intermittent "Stop
error code 0x0000001E" error message (XP,
Server 2000, Server
2003)
KB 833763
You receive a "Stop
error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)" or a "Stop error code
0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)" on a Windows 2000-based computer
KB 835312
You receive a Stop
error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED) on a Windows
2000-based computer
KB 839427
You receive a Stop
error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED) error on a Windows
2000-based computer
KB 840110
You may receive a Stop
error code 0x0000001E (0xc0000005) message when the Rdpdd.dll function
in Windows
2000 Terminal Services receives a null
value
KB 904374
You receive a "Stop
0x0000001e" error message after you install Update Rollup 1 for Windows
2000 Service Pack 4
KB 911028 When
you use a
32-bit program to print a document from a 64-bit version of Microsoft
Windows, you may receive a Stop error message, or objects on the page
are omitted (XP,
Server 2003)
KB 961799 A Stop error occurs on a
Windows Server 2003-based server when
a user accesses shared files on the server by using an SMB connection
KB 2381191 0x0000001E Stop code
error occurs on a computer that is running an IA-64-based
version of Windows Server 2008 R2
KB 2479442 Stop error during
startup in Windows Server 2008 or in
Windows
Vista
KB 2521220 "0x0000001E" Stop error
when you perform disk I/O-intensive operations on dynamic disks in
Windows Server 2008
or in Windows Server
2008 R2
KB 2554414 "0x0000001E" Stop error
when you add some NFS shares to a DFS namespace or to a DFS Replication
group in Windows Server
2008 R2
KB 2636573
FIX: The guest operating system may crash when you perform a live
migration of Hyper-V virtual machines in a Windows Server 2008 R2 environment
KB 2655104
"0x0000001E" Stop error on a computer that is running an x64-based version of
Windows Vista SP2 or of Windows
Server 2008 SP2
KB
2719347
Stop error when a
Windows 7-based or Windows
Server 2008 R2-based computer crashes randomly
KB 2764302
"0x0000001E" Stop error
occurs intermittently in Windows 7 SP1 and
Windows Server 2008 R2 SP1
KB 2888929
"KMODE_EXCEPTION_NOT_HANDLED" Stop error when a driver tries to close static
streams for USB 3.0 devices in Windows RT 8.1,
Windows 8.1, or Windows
Server 2012 R2
More STOP message articles at this
search: http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000001e&x=10&y=10&mkt=en-US&FORM=QBME1&l=1
WinDbg
Help File Entry:
The
KMODE_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000001E. This
indicates that a kernel-mode program generated an exception which the
error handler did not catch.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The exception code that was not handled |
| 2 |
The address at which the exception occurred |
| 3 |
Parameter 0 of the exception |
| 4 |
Parameter 1 of the exception |
Cause
This is a very common bug
check. To interpret it, you must identify which exception was generated.
Common exception codes
include:
- 0x80000002: STATUS_DATATYPE_MISALIGNMENT
An unaligned data reference was encountered.
- 0x80000003: STATUS_BREAKPOINT
A breakpoint or ASSERT was encountered when no kernel
debugger was attached to the system.
- 0xC0000005: STATUS_ACCESS_VIOLATION
A memory access violation occurred. (Parameter 4
of the bug check is the address that the driver attempted to access.)
For a complete list of
exception codes, see the ntstatus.h file located
in the inc directory of the Windows Driver Kit.
Resolving the Problem
If you are not
equipped to debug this problem, you should use some basic
troubleshooting techniques. If a driver is identified in the bug check
message, disable the driver or check with the manufacturer for driver
updates. Try changing video adapters. Check with your hardware vendor
for any BIOS updates. Disable BIOS memory options such as caching or
shadowing.
If you plan to
debug this problem, you may find it difficult to obtain a
stack trace. Parameter 2 (the exception address) should
pinpoint the driver or function that caused this problem.
If exception code 0x80000003
occurs, this indicates that a hard-coded breakpoint or assertion was
hit, but the system was started with the /NODEBUG
switch. This problem should rarely occur. If it occurs repeatedly, make
sure a kernel debugger is connected and the system is started with the /DEBUG
switch.
If exception code 0x80000002
occurs, the trap frame will supply additional information.
If the specific cause of the
exception is unknown, the following should be considered:
Hardware
incompatibility. First, make sure that any new hardware
installed is listed in the Microsoft Windows Marketplace Tested
Products List.
Faulty device
driver or system service. In addition, a faulty device
driver or system service might be responsible for this error. Hardware
issues, such as BIOS incompatibilities, memory conflicts, and IRQ
conflicts can also generate this error.
If a driver is listed by
name within the bug check message, disable or remove that driver.
Disable or remove any drivers or services that were recently added. If
the error occurs during the startup sequence and the system partition
is formatted with NTFS file system, you might be able to use Safe Mode
to rename or delete the faulty driver. If the driver is used as part of
the system startup process in Safe Mode, you need to start the computer
by using the Recovery Console to access the file.
If the problem is associated
with Win32k.sys, the source of the error might be a
third-party remote control program. If such software is installed, the
service can be removed by starting the system using the Recovery
Console and deleting the offending system service file.
Check the System Log in Event
Viewer for additional error messages that might help pinpoint
the device or driver that is causing bug check 0x1E. Disabling memory
caching of the BIOS might also resolve the error. You should also run
hardware diagnostics, especially the memory scanner, supplied by the
system manufacturer. For details on these procedures, see the owner's
manual for your computer.
The error that generates
this message can occur after the first restart during Windows Setup, or
after Setup is finished. A possible cause of the error is a system BIOS
incompatibility. BIOS problems can be resolved by upgrading the system
BIOS version.
To get a stack
trace if the normal stack tracing procedures fail
- Use the kb
(Display Stack Backtrace) command to display
parameters in the stack trace. Look for the call to NT!PspUnhandledExceptionInSystemThread.
(If this function is not listed, see the note below.)
- The first parameter to NT!PspUnhandledExceptionInSystemThread
is a pointer to a structure, which contains pointers to an except
statement:typedef struct _EXCEPTION_POINTERS {
PEXCEPTION_RECORD ExceptionRecord;
PCONTEXT ContextRecord;
} EXCEPTION_POINTERS, *PEXCEPTION_POINTERS;
ULONG PspUnhandledExceptionInSystemThread(
IN PEXCEPTION_POINTERS ExceptionPointers
)
Use the dd (Display
Memory) command on that address to display the
necessary data.
- The first retrieved value is an exception record and the
second is a context record. Use the .exr (Display
Exception Record) command and the .cxr (Display
Context Record) command with these two values as
their arguments, respectively.
- After the .cxr command executes, use
the kb command to display a stack trace that is
based on the context record information. This stack trace indicates the
calling stack where the unhandled exception occurred.
Note This
procedure assumes that you can locate NT!PspUnhandledExceptionInSystemThread.
However, in some cases (such as an access violation crash) you will not
be able to do this. In that case, look for ntoskrnl!KiDispatchException.
The third parameter passed to this function is a trap frame address.
Use the .trap (Display
Trap Frame) command with this address to set the Register
Context to the proper value. You can then perform stack
traces and issue other commands.
Here is an example of bug
check 0x1E on an x86 processor:
kd> .bugcheck get the bug check data
Bugcheck code 0000001e
Arguments c0000005 8013cd0a 00000000 0362cffff
kd> kb start with a stack trace
FramePtr RetAddr Param1 Param2 Param3 Function Name
8013ed5c 801263ba 00000000 00000000 fe40cb00 NT!_DbgBreakPoint
8013eecc 8013313c 0000001e c0000005 8013cd0a NT!_KeBugCheckEx+0x194
fe40cad0 8013318e fe40caf8 801359ff fe40cb00 NT!PspUnhandledExceptionInSystemThread+0x18
fe40cad8 801359ff fe40cb00 00000000 fe40cb00 NT!PspSystemThreadStartup+0x4a
fe40cf7c 8013cb8e fe43a44c ff6ce388 00000000 NT!_except_handler3+0x47
00000000 00000000 00000000 00000000 00000000 NT!KiThreadStartup+0xe
kd> dd fe40caf8 L2 dump EXCEPTION_POINTERS structure
0xFE40CAF8 fe40cd88 fe40cbc4 ..@...@.
kd> .exr fe40cd88 first DWORD is the exception record
Exception Record @ FE40CD88:
ExceptionCode: c0000005
ExceptionFlags: 00000000
Chained Record: 00000000
ExceptionAddress: 8013cd0a
NumberParameters: 00000002
Parameter[0]: 00000000
Parameter[1]: 0362cfff
kd> .cxr fe40cbc4 second DWORD is the context record
CtxFlags: 00010017
eax=00087000 ebx=00000000 ecx=03ff0000 edx=ff63d000 esi=0362cfff edi=036b3fff
eip=8013cd0a esp=fe40ce50 ebp=fe40cef8 iopl=0 nv dn ei pl nz ac po cy
vip=0 vif=0
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010617
0x8013cd0a f3a4 rep movsb
kd> kb kb gives stack for context record
ChildEBP RetAddr Args to Child
fe40ce54 80402e09 ff6c4000 ff63d000 03ff0000 NT!_RtlMoveMemory@12+0x3e
fe40ce68 80403c18 ffbc0c28 ff6ce008 ff6c4000 HAL!_HalpCopyBufferMap@20+0x49
fe40ce9c fe43b1e4 ff6cef90 ffbc0c28 ff6ce009 HAL!_IoFlushAdapterBuffers@24+0x148
fe40ceb8 fe4385b4 ff6ce388 6cd00800 ffbc0c28 QIC117!_kdi_FlushDMABuffers@20+0x28
fe40cef8 fe439894 ff6cd008 ffb6c820 fe40cf4c QIC117!_cqd_CmdReadWrite@8+0x26e
fe40cf18 fe437d92 ff6cd008 ffb6c820 ff6e4e50 QIC117!_cqd_DispatchFRB@8+0x210
fe40cf30 fe43a4f5 ff6cd008 ffb6c820 00000000 QIC117!_cqd_ProcessFRB@8+0x134
fe40cf4c 80133184 ff6ce388 00000000 00000000 QIC117!_kdi_ThreadRun@4+0xa9
fe40cf7c 8013cb8e fe43a44c ff6ce388 00000000 NT!_PspSystemThreadStartup@8+0x40
WinDbg
Output Example:
KMODE_EXCEPTION_NOT_HANDLED
(1e)
This is a very common bugcheck. Usually the exception address
pinpoints
the driver/function that caused the problem. Always note this
address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002508f6d, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
STOP 0x0000001F:
SHARED_RESOURCE_CONV_ERROR (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818893.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557414(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
SHARED_RESOURCE_CONV_ERROR bug check has a value of 0x0000001F.
This bug check appears very
infrequently.
WinDbg
Output Example:
SHARED_RESOURCE_CONV_ERROR
(1f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000020:
KERNEL_APC_PENDING_DURING_EXIT (go
to top of page)
Usual causes:
Device driver, kernel
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818895.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557421(v=VS.85).aspx
Knowledge
Base Articles:
KB 905539 You
may receive a "Stop 0x00000020" error message on a computer that is
running Windows Small Business Server 2003 or Windows Server 2003
KB 920911 Stop
error
message on a Windows Server
2003-based computer: "Stop 0x00000020"
WinDbg
Help File Entry:
The
KERNEL_APC_PENDING_DURING_EXIT bug check has a value of 0x00000020.
This indicates that an asynchronous procedure call (APC) was still
pending when a thread exited.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The address of the APC found pending during exit |
| 2 |
The thread's APC disable count |
| 3 |
The current IRQL |
| 4 |
Reserved |
Cause
The key data item is the
thread's APC disable count (Parameter 2). If this is non-zero,
it will indicate the source of the problem.
The APC disable count is
decremented each time a driver calls KeEnterCriticalRegion,
KeWaitForSingleObject, KeWaitForMultipleObjects,
KeWaitForMutexObject, or FsRtlEnterFileSystem.
The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion,
KeReleaseMutex, or FsRtlExitFileSystem.
Since these calls should
always be in pairs, this value should be zero when a thread exits. A
negative value indicates that a driver has disabled APC calls without
re-enabling them. A positive value indicates that the reverse is true.
If you ever see this error,
be very suspicious of all drivers installed on the machine — especially
unusual or non-standard drivers.
This current IRQL
(Parameter 3) should be zero. If it is not, that a driver's
cancellation routine may have caused this bug check by returning at an
elevated IRQL. In this case, carefully note what was running (and what
was closing) at the time of the crash, and note all of the installed
drivers at the time of the crash. The cause in this case is usually a
severe bug in a driver.
WinDbg
Output Example:
KERNEL_APC_PENDING_DURING_EXIT
(20)
The key data item is the thread's APC disable count.
If this is non-zero, then this is the source of the problem.
The APC disable count is decremented each time a driver calls
KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a
mutex. The APC
disable count is incremented each time a driver calls
KeLeaveCriticalRegion,
FsRtlExitFileSystem, or KeReleaseMutex. Since these calls
should always be in
pairs, this value should be zero when a thread exits. A
negative value
indicates that a driver has disabled APC calls without re-enabling
them. A
positive value indicates that the reverse is true.
If you ever see this error, be very suspicious of all drivers installed
on the
machine -- especially unusual or non-standard drivers. Third
party file
system redirectors are especially suspicious since they do not generally
receive the heavy duty testing that NTFS, FAT, RDR, etc receive.
This current IRQL should also be 0. If it is not, that a
driver's
cancelation routine can cause this bugcheck by returning at an elevated
IRQL. Always attempt to note what you were doing/closing at
the
time of the crash, and note all of the installed drivers at the time of
the crash. This symptom is usually a severe bug in a third
party
driver.
Arguments:
Arg1: 0000000000000000, The address of the APC found pending during
exit.
Arg2: 0000000000000000, The thread's APC disable count
Arg3: 0000000000000000, The current IRQL
Arg4: 0000000000000000
Usual causes:
Device driver
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818898.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557424(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The QUOTA_UNDERFLOW bug
check has a value of 0x00000021. This indicates that quota charges have
been mishandled by returning more quota to a particular block than was
previously charged.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The process that was initially charged, if available. |
| 2 |
The quota type. For the list of all possible quota type
values, see the header file Ps.h in the Windows
Driver Kit (WDK). |
| 3 |
The initial charged amount of quota to return. |
| 4 |
The remaining amount of quota that was not returned. |
WinDbg
Output Example:
QUOTA_UNDERFLOW (21)
This bugcheck occurs if a kernel component mishandles quota charges and
returns more quota than was previously charged to a particular quota
block.
Arguments:
Arg1: 0000000000000000, The process (if any) that was initially charged.
Arg2: 0000000000000000, The quota type in question (paged pool,
nonpaged pool, etc.)
Arg3: 0000000000000000, The initial charge amount to return.
Arg4: 0000000000000000, The remaining (unreturned) charge.
Usual causes:
http://msdn.microsoft.com/en-us/library/ms818901.aspx
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818901(v=MSDN.10).aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557425(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The FILE_SYSTEM bug check
has a value of 0x00000022.
This bug check appears very
infrequently.
WinDbg
Output Example:
FILE_SYSTEM (22)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Disk corruption, insufficient physical memory, Device driver, Indexing,
Resident antivirus, backup, defrag programs, Disk/Drive failing/failure
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818907.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557429(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x23
Knowledge
Base Articles:
KB 289205 STOP Errors 0x00000023
and 0x0000000A in Fastfat.sys When a Program Queries the File System (2000 Server)
KB 305358 A
"Stop 0x23"
Error Message Appears When You Use Removable Media with the Same
Attributes (2000)
KB 899327 You
may receive a "Stop 0x00000023" error message after you remove a USB
floppy drive cable from a Windows Server 2003-based
computer
KB 900626 Stop
error message when you suddenly remove a storage device from a computer
that is running Windows XP:
"STOP 0x00000023 FAT_FILE_SYSTEM"
KB 913318 Stop
error
message when you insert and then remove a removable storage media on a
Windows XP-based
computer: "STOP 0x00000023"
WinDbg
Help File Entry:
The FAT_FILE_SYSTEM bug
check has a value of 0x00000023. This indicates that a problem occurred
in the FAT file system.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Specifies source file and line number information. The
high 16 bits (the first four hexadecimal digits after the "0x")
identify the source file by its identifier number. The low 16 bits
identify the source line in the file where the bug check occurred. |
| 2 |
If FatExceptionFilter is on the
stack, this parameter specifies the address of the exception record. |
| 3 |
If FatExceptionFilter is on the
stack, this parameter specifies the address of the context record. |
| 4 |
Reserved |
Cause
One possible cause of this
bug check is disk corruption. Corruption in the file system or bad
blocks (sectors) on the disk can induce this error. Corrupted SCSI and
IDE drivers can also adversely affect the system's ability to read and
write to the disk, thus causing the error.
Another possible cause is
depletion of nonpaged pool memory. If the nonpaged pool memory is
completely depleted, this error can stop the system. However, during
the indexing process, if the amount of available nonpaged pool memory
is very low, another kernel-mode driver requiring nonpaged pool memory
can also trigger this error.
Resolving the Problem
To debug this
problem: Use the .cxr (Display
Context Record) command with Parameter 3,
and then use kb (Display
Stack Backtrace).
To resolve a disk
corruption problem: Check Event Viewer for error messages
from SCSI and FASTFAT (System Log) or Autochk (Application Log) that
might help pinpoint the device or driver that is causing the error. Try
disabling any virus scanners, backup programs, or disk defragmenter
tools that continually monitor the system. You should also run hardware
diagnostics supplied by the system manufacturer. For details on these
procedures, see the owner's manual for your computer. Run Chkdsk /f /r
to detect and resolve any file system structural corruption. You must
restart the system before the disk scan begins on a system partition.
To resolve a
nonpaged pool memory depletion problem: Add new physical
memory to the computer. This will increase the quantity of nonpaged
pool memory available to the kernel.
WinDbg
Output Example:
FAT_FILE_SYSTEM (23)
If you see FatExceptionFilter on the
stack then the 2nd and 3rd
parameters are the exception record and
context record. Do a .cxr
on the 3rd parameter and then kb to
obtain a more informative stack
trace.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Disk corruption, insufficient physical memory, Device driver, Indexing,
Resident antivirus, backup, defrag programs, Disk/Drive failing/failure
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818912.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557433(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x24
Knowledge
Base Articles:
KB 142648 STOP
0x00000024 in Ntfs.sys (NT)
KB 195857 Open Handles
Cause STOP 0x0000001E or STOP 0x00000024 (NT, 2000)
KB 228888 Error message
in Windows 2000:
"Stop 0x24" or "NTFS_FILE_SYSTEM"
KB 840551
Intermittent errors in IA64 editions of Windows Server 2003: Stop error code 0x0000009C
(MACHINE_CHECK_EXCEPTION), Stop error code 0x00000024
(NTFS_FILE_SYSTEM), or Stop error code 0x0000000A
(IRQL_NOT_LESS_OR_EQUAL)
KB 910311 Error
message
in Windows Server
2003: "STOP: 0x00000024 (0x0019033c, 0xf4d7d42c,
0xf4d7d128, 0xf7197421) "
KB 934454
FIX: Error message on a Windows Server 2003
R2-based computer that has the Server for NFS component
installed: "STOP 0x0000008E" or "STOP 0x00000024"
KB 935806 Troubleshooting
Stop error messages that may occur when you try to install Windows Vista
KB 937455 You
may
receive various Stop error messages on a computer that is running
Windows Server
2003
KB 954495
Stop error 0x24 may
occur on a computer that has file system filter drivers installed in
Windows
Server 2003 and in Windows
XP Professional x64 Edition
KB 957535
Error message on a computer that is running Windows
Vista Service Pack 1 or Windows Server
2008: "Stop 0x00000024"
KB 961799
A Stop error occurs on
a Windows Server 2003-based server
when a user accesses shared files on the server by using an SMB
connection
KB 969550 A
Stop error
occurs on an HP ProLiant server that has the firmware from an
E200/E200i HP Smart Array SAS/SATA controller installed on any Windows
Server platform (2000
Server, Server
2003, Server
2008)
KB 975663 Stop error message on a
computer that is running Windows Server 2008 SP2 or
Windows Vista SP2:
"0x00000024 NTFS_FILE_SYSTEM"
KB 2792165
"0x00000024" Stop error when a third-party application unmounts a corrupted
storage volume on a Windows Server 2008 SP2-based
storage server
KB 2824200
"0x00000024" or "0x00000050" Stop error on a computer that is running Windows
Vista or Windows
Server 2008
WinDbg
Help File Entry:
The NTFS_FILE_SYSTEM bug
check has a value of 0x00000024. This indicates a problem occurred in ntfs.sys,
the driver file that allows the system to read and write to NTFS drives.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Specifies source file and line number information. The
high 16 bits (the first four hexadecimal digits after the "0x")
identify the source file by its identifier number. The low 16 bits
identify the source line in the file where the bug check occurred. |
| 2 |
If NtfsExceptionFilter is on the
stack, this parameter specifies the address of the exception record. |
| 3 |
If NtfsExceptionFilter is on the
stack, this parameter specifies the address of the context record. |
| 4 |
Reserved |
Cause
One possible cause of this
bug check is disk corruption. Corruption in the NTFS file system or bad
blocks (sectors) on the hard disk can induce this error. Corrupted SCSI
and IDE drivers can also adversely affect the system's ability to read
and write to disk, thus causing the error.
Another possible cause is
depletion of nonpaged pool memory. If the nonpaged pool memory is
completely depleted, this error can stop the system. However, during
the indexing process, if the amount of available nonpaged pool memory
is very low, another kernel-mode driver requiring nonpaged pool memory
can also trigger this error.
Resolving the Problem
To debug this
problem: Use the .cxr (Display
Context Record) command with Parameter 3,
and then use kb (Display
Stack Backtrace).
To resolve a disk
corruption problem: Check Event Viewer for error messages
from SCSI and FASTFAT (System Log) or Autochk (Application Log) that
might help pinpoint the device or driver that is causing the error. Try
disabling any virus scanners, backup programs, or disk defragmenter
tools that continually monitor the system. You should also run hardware
diagnostics supplied by the system manufacturer. For details on these
procedures, see the owner's manual for your computer. Run Chkdsk /f /r
to detect and resolve any file system structural corruption. You must
restart the system before the disk scan begins on a system partition.
To resolve a
nonpaged pool memory depletion problem: Either add new
physical memory to the computer (thus increasing the quantity of
nonpaged pool memory available to the kernel), or reduce the number of
files on the Services for Macintosh (SFM) volume.
WinDbg
Output Example:
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the
stack then the 2nd and 3rd
parameters are the exception record and
context record. Do a .cxr
on the 3rd parameter and then kb to
obtain a more informative stack
trace.
Arguments:
Arg1: 001904ab
Arg2: 8e854430
Arg3: 8e85412c
Arg4: 81b5d1c4
Usual causes:
Insufficient physical memory, Indexing, Device driver
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818917.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557436(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The NPFS_FILE_SYSTEM bug
check has a value of 0x00000025. This indicates that a problem occurred
in the NPFS file system.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Specifies source file and line number information. The
high 16 bits (the first four hexadecimal digits after the "0x")
identify the source file by its identifier number. The low 16 bits
identify the source line in the file where the bug check occurred. |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
One possible cause of this
bug check is depletion of nonpaged pool memory. If the nonpaged pool
memory is completely depleted, this error can stop the system. However,
during the indexing process, if the amount of available nonpaged pool
memory is very low, another kernel-mode driver requiring nonpaged pool
memory can also trigger this error.
Resolving the Problem
To resolve a
nonpaged pool memory depletion problem: Add new physical
memory to the computer. This will increase the quantity of nonpaged
pool memory available to the kernel.
WinDbg
Output Example:
NPFS_FILE_SYSTEM (25)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Disk corruption, insufficient physical memory, Device driver, Indexing,
Resident antivirus, backup, defrag programs, Disk/Drive failing/failure
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818922.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557441(v=VS.85).aspx
Knowledge
Base Articles:
KB 124284 STOP 0x00000026 when
Accessing a CD Using an Indirect Path (NT)
WinDbg
Help File Entry:
The CDFS_FILE_SYSTEM bug
check has a value of 0x00000026. This indicates that a problem occurred
in the CD file system.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Specifies source file and line number information. The
high 16 bits (the first four hexadecimal digits after the "0x")
identify the source file by its identifier number. The low 16 bits
identify the source line in the file where the bug check occurred. |
| 2 |
If CdExceptionFilter is on the
stack, this parameter specifies the address of the exception record. |
| 3 |
If CdExceptionFilter is on the
stack, this parameter specifies the address of the context record. |
| 4 |
Reserved |
Cause
One possible cause of this
bug check is disk corruption. Corruption in the file system or bad
blocks (sectors) on the disk can induce this error. Corrupted SCSI and
IDE drivers can also adversely affect the system's ability to read and
write to the disk, thus causing the error.
Another possible cause is
depletion of nonpaged pool memory. If the nonpaged pool memory is
completely depleted, this error can stop the system. However, during
the indexing process, if the amount of available nonpaged pool memory
is very low, another kernel-mode driver requiring nonpaged pool memory
can also trigger this error.
Resolving the Problem
To debug this
problem: Use the .cxr (Display
Context Record) command with Parameter 3,
and then use kb (Display
Stack Backtrace).
To resolve a disk
corruption problem: Check Event Viewer for error messages
from SCSI and FASTFAT (System Log) or Autochk (Application Log) that
might help pinpoint the device or driver that is causing the error. Try
disabling any virus scanners, backup programs, or disk defragmenter
tools that continually monitor the system. You should also run hardware
diagnostics supplied by the system manufacturer. For details on these
procedures, see the owner's manual for your computer. Run Chkdsk /f /r
to detect and resolve any file system structural corruption. You must
restart the system before the disk scan begins on a system partition.
To resolve a
nonpaged pool memory depletion problem: Add new physical
memory to the computer. This will increase the quantity of nonpaged
pool memory available to the kernel.
WinDbg
Output Example:
CDFS_FILE_SYSTEM (26)
If you see CdExceptionFilter on the
stack then the 2nd and 3rd
parameters are the exception record and
context record. Do a .cxr
on the 3rd parameter and then kb to
obtain a more informative stack
trace.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Insufficient physical memory, Indexing, Device driver
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818927.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557446(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x27
Knowledge
Base Articles:
KB 261939 "Stop
0x00000027 RDR_FILE_SYSTEM" Error Message During Shutdown (2000 Server)
KB 310916 XADM:
When the
File System Accesses Items Created in Workflow-Enabled Folders, a
Bugcheck May Occur (2000
Server)
KB 831128 "STOP
0x00000027 in mrxsmb.sys" error message when you try to copy files to a
network-attached storage device (2000)
KB 892932 You
receive a Stop error message when you use the Remote Installation
Service to deploy a Windows Server 2003
Remote Installation Preparation
image on a client computer
KB 919030 Error
message that you receive when you open a protected document on a
computer that is running a 64-bit version of Windows Server 2003:
"STOP
0x00000027"
KB 937278 Error
message when multiple processes access a file that is in an NFS shared
folder on a Windows Server
2003 R2-based computer that has Client for
NFS installed: "STOP 0x00000027"
KB 952185 A
Windows Server 2003-based
computer restarts unexpectedly, and a Stop error "0x00000027" occurs
KB 974759 Stop error message on a
computer that is running Windows Server 2008 or Windows
Vista:
"0x00000027 RDR_FILE_SYSTEM"
KB 978972
Stop error message when you rename a file or folder by using a DFS
shared path on a computer that is running Windows Server 2003: "Stop error code 0x00000027
(RDR_FILE_SYSTEM)"
KB 981109 "0x00000027" Stop error
when you try to log on a client computer that is running Windows 7 or Windows Server 2008 R2
KB 2487035 "0x00000027" Stop error
when you try to access earlier versions of
shared files that are hosted on a remote file server in Windows Vista
or in Windows Server
2008
KB 2494418
"0x00000027" Stop error occurs when you access shared network resources
by using the SMB 2.0 protocol in Windows Server
2008 R2 or in Windows 7
KB 2500603 "0x00000027" Stop error
occurs when you redirect some folders to network share in Windows Vista or in Windows Server 2008
KB 2584874
"0x00000027" Stop error when you try to access a shared network resource in
Windows Server 2008 R2 or in
Windows 7
KB 2624677
"0x00000027" Stop error when you access a shared network resource that
is hosted on a computer that is running Windows Server 2008 R2 or Windows
7
KB 2639032
"0x0000003B," "0x00000027," and "0x0000007e" Stop errors when a
connection to a CSV is lost on a Windows Server
2008 R2-based failover cluster
KB 2696083
"0x00000027" Stop error when you redirect folders to a network share in Windows
Vista SP2 or in Windows
Server 2008 SP2
KB 2780130
"0x00000027" Stop error
when you try to use a redirected smart card to log on to a
Windows 7 or Windows
Server 2008 R2-based remote computer
KB 2839149
Stop Error 0x00000027 in Rdbss.sys on a computer that is running
Windows 7 or Windows
Server 2008 R2
KB 2870965
"0x00000027" Stop error when
you try to access some shared resources in Windows
Vista SP2 or Windows Server 2008 SP2
WinDbg
Help File Entry:
The RDR_FILE_SYSTEM bug
check has a value of 0x00000027. This indicates that a problem occurred
in the SMB redirector file system.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The high 16 bits (the first four hexadecimal digits
after the "0x") identify the type of problem. Possible values include:
0xCA550000 RDBSS_BUG_CHECK_CACHESUP
0xC1EE0000 RDBSS_BUG_CHECK_CLEANUP
0xC10E0000 RDBSS_BUG_CHECK_CLOSE
0xBAAD0000 RDBSS_BUG_CHECK_NTEXCEPT
|
| 2 |
If RxExceptionFilter is on the
stack, this parameter specifies the address of the exception record. |
| 3 |
If RxExceptionFilter is on the
stack, this parameter specifies the address of the context record. |
| 4 |
Reserved |
Cause
One possible cause of this
bug check is depletion of nonpaged pool memory. If the nonpaged pool
memory is completely depleted, this error can stop the system. However,
during the indexing process, if the amount of available nonpaged pool
memory is very low, another kernel-mode driver requiring nonpaged pool
memory can also trigger this error.
Resolving the Problem
To debug this
problem: Use the .cxr (Display
Context Record) command with Parameter 3,
and then use kb (Display
Stack Backtrace).
To resolve a
nonpaged pool memory depletion problem: Add new physical
memory to the computer. This will increase the quantity of nonpaged
pool memory available to the kernel.
WinDbg
Output Example:
RDR_FILE_SYSTEM (27)
If you see RxExceptionFilter on the
stack then the 2nd and 3rd parameters are the
exception record and context record. Do
a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter
is the RDBSS bugcheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE =
0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: baad0075
Arg2: bde817c4
Arg3: bde814c0
Arg4: 90ae9b4d
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818930.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557448(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The CORRUPT_ACCESS_TOKEN bug
check has a value of 0x00000028.
This bug check appears very
infrequently.
WinDbg
Output Example:
CORRUPT_ACCESS_TOKEN (28)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818934.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557452(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The SECURITY_SYSTEM bug
check has a value of 0x00000029.
This bug check appears very
infrequently.
WinDbg
Output Example:
SECURITY_SYSTEM (29)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Device driver
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818938.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557457(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The INCONSISTENT_IRP bug
check has a value of 0x0000002A. This indicates that an IRP was found
to contain inconsistent information.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The address of the IRP that was found to be
inconsistent |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
An IRP was discovered to be
in an inconsistent state. Usually this means some field of the IRP was
inconsistent with the remaining state of the IRP. An example would be
an IRP that was being completed, but was still marked as being queued
to a driver's device queue.
Comments
This bug check code is not
currently being used in the system, but exists for debugging purposes.
WinDbg
Output Example:
INCONSISTENT_IRP (2a)
An IRP was encountered that was in an inconsistent state; i.e., some
field
or fields of the IRP were inconsistent w/the remaining state of the IRP.
An example would be an IRP that was being completed, but was still
marked
as being queued to a driver's device queue. This bugcheck
code is not
currently being used in the system, but exists for debugging purposes.
Arguments:
Arg1: 0000000000000000, Address of the IRP that was found to be
inconsistent
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Device driver, ?memory
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818941.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557460(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The PANIC_STACK_SWITCH bug
check has a value of 0x0000002B. This indicates that the kernel mode
stack was overrun.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The trap frame |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
This error normally appears
when a kernel-mode driver uses too much stack space. It can also appear
when serious data corruption occurs in the kernel.
WinDbg
Output Example:
PANIC_STACK_SWITCH (2b)
This error indicates that the kernel mode stack was overrun. This
normally
occurs when a kernel-mode driver uses too much stack space.
It can also
occur when serious data corruption occurs in the kernel.
Arguments:
Arg1: 0000000000000000, Trap Frame
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818943.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557461(v=VS.85).aspx
Knowledge
Base Articles:
KB 301353 "Stop
0x2c"
Error Message in Scsiport.sys When Returning from Hibernation (2000)
WinDbg
Help File Entry:
The PORT_DRIVER_INTERNAL bug
check has a value of 0x0000002C.
This bug check appears very
infrequently.
WinDbg
Output Example:
PORT_DRIVER_INTERNAL (2c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000002D:
SCSI_DISK_DRIVER_INTERNAL (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818950.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557463(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
SCSI_DISK_DRIVER_INTERNAL bug check has a value of 0x0000002D.
This bug check appears very
infrequently.
WinDbg
Output Example:
SCSI_DISK_DRIVER_INTERNAL
(2d)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Defective memory (not just RAM), Hard disk corruption, BIOS, SCSI
controller, Network adapter, reseat adapter cards, Device driver,
malware
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818953.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557468(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x2e
Knowledge
Base Articles:
KB 185787 STOP
0x0000002E on Alpha with ISA Sound Card (NT)
KB 218132 Troubleshooting
"STOP 0x0000002E" or "DATA_BUS_ERROR" Error Message (2000)
WinDbg
Help File Entry:
The DATA_BUS_ERROR bug check
has a value of 0x0000002E. This typically indicates that a parity error
in system memory has been detected.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Virtual address that caused the fault |
| 2 |
Physical address that caused the fault |
| 3 |
Processor status register (PSR) |
| 4 |
Faulting instruction register (FIR) |
Cause
This error is almost always
caused by a hardware problem — a configuration issue, defective
hardware, or incompatible hardware.
The most common hardware
problems that can cause this error are defective RAM, Level 2 (L2) RAM
cache errors, or video RAM errors. Hard disk corruption can also cause
this error.
This bug check can also be
caused when a device driver attempts to access an address in the 0x8xxxxxxx
range that does not exist (in other words, that does not have a
physical address mapping).
Resolving the Problem
Resolving a
hardware problem: If hardware has recently been added to the
system, remove it to see if the error recurs.
If existing hardware has
failed, remove or replace the faulty component. You should run hardware
diagnostics supplied by the system manufacturer to determine which
hardware component has failed. For details on these procedures, see the
owner's manual for your computer. Check that all adapter cards in the
computer are properly seated. Use an ink eraser or an electrical
contact treatment, available at electronics supply stores, to ensure
that adapter card contacts are clean.
If the problem occurs on a
newly installed system, check the availability of updates for the BIOS,
the SCSI controller or network cards. Updates of this kind are
typically available on the Web site or the bulletin board system (BBS)
of the hardware manufacturer.
If the error occurs after
installing a new or updated device driver, the driver should be removed
or replaced. If, under this circumstance, the error occurs during
startup and the system partition is formatted with NTFS, you might be
able to use Safe Mode to rename or delete the faulty driver.
If the driver is used as
part of the system startup process in Safe Mode, you need to start the
computer using the Recovery Console in order to access the file.
For additional error
messages that might help pinpoint the device or driver that is causing
the error, check the System Log in Event Viewer. Disabling memory
caching or shadowing in the BIOS might also resolve this error. In
addition, check the system for viruses, using any up-to-date commercial
virus scanning software that examines the Master Boot Record of the
hard disk. All Windows file systems can be infected by viruses.
Resolving a hard
disk corruption problem: Run Chkdsk /f /r
on the system partition. You must restart the system before the disk
scan begins. If you cannot start the system due to the error, use the
Recovery Console and run Chkdsk /r.
Warning If
your system partition is formatted with the file allocation table (FAT)
file system, the long filenames used by Windows can be damaged if
Scandisk or another Microsoft MS-DOS-based hard disk tool is used to
verify the integrity of your hard disk from MS-DOS. Always use the
version of Chkdsk that matches your Windows version.
WinDbg
Output Example:
DATA_BUS_ERROR (2e)
This bugcheck is normally caused by a parity error in the system memory.
This error can also be caused by a driver accessing a bad virtual
address whose backing physical address does not exist.
Arguments:
Arg1: 0000000000000000, Virtual address that caused the fault
Arg2: 0000000000000000, Physical address that caused the fault.
Arg3: 0000000000000000, Processor status register (PSR)
Arg4: 0000000000000000, Faulting instruction register (FIR)
STOP 0x0000002F:
INSTRUCTION_BUS_ERROR (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818956.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557471(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The INSTRUCTION_BUS_ERROR
bug check has a value of 0x0000002F.
This bug check appears very
infrequently.
WinDbg
Output Example:
INSTRUCTION_BUS_ERROR (2f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000030:
SET_OF_INVALID_CONTEXT (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818959.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557478(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The SET_OF_INVALID_CONTEXT
bug check has a value of 0x00000030. This indicates that the stack
pointer in a trap frame had an invalid value.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The new stack pointer |
| 2 |
The old stack pointer |
| 3 |
The trap frame address |
| 4 |
0 |
Cause
This bug check occurs when
some routine attempts to set the stack pointer in the trap frame to a
lower value than the current stack pointer value.
If this error were not
caught, it would cause the kernel to run with a stack pointer pointing
to stack which is no longer valid.
WinDbg
Output Example:
SET_OF_INVALID_CONTEXT (30)
Attempt to set the stack pointer in the trap frame to a lower value than
the current stack pointer value. This would cause
the kernel run with a
stack pointer pointing to stack which is no longer valid.
Arguments:
Arg1: 0000000000000000, New stack pointer
Arg2: 0000000000000000, Old stack pointer
Arg3: 0000000000000000, TrapFrame address
Arg4: 0000000000000000, 0
STOP 0x00000031:
PHASE0_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818963.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557479(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
PHASE0_INITIALIZATION_FAILED bug check has a value of 0x00000031. This
indicates that system initialization failed.
Parameters
None
Cause
System initialization failed
at a very early stage.
Resolving the Problem
A debugger is required to
analyze this.
WinDbg
Output Example:
PHASE0_INITIALIZATION_FAILED
(31)
System init failed early on. A
debugger is required to analyze this.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000032:
PHASE1_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818967.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557483(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
PHASE1_INITIALIZATION_FAILED bug check has a value of 0x00000032. This
indicates that system initialization failed.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The NT status code that describes why the system
initialization failed |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
WinDbg
Output Example:
PHASE1_INITIALIZATION_FAILED
(32)
Arguments:
Arg1: 0000000000000000, NT status code that describes why the system
initialization failed.
Arg2: 0000000000000000, (reserved)
Arg3: 0000000000000000, (reserved)
Arg4: 0000000000000000
STOP 0x00000033:
UNEXPECTED_INITIALIZATION_CALL (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818970.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557488(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
UNEXPECTED_INITIALIZATION_CALL bug check has a value of 0x00000033.
This bug check appears very
infrequently.
WinDbg
Output Example:
UNEXPECTED_INITIALIZATION_CALL
(33)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Insufficient physical memory, Indexing, Device driver
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818973.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557491(v=VS.85).aspx
Knowledge
Base Articles:
KB 2800422
"0x00000034" Stop error
and file corruption when you burn a Live File System formatted disc in
Windows 7 or Windows
Server 2008 R2
WinDbg
Help File Entry:
The CACHE_MANAGER bug check
has a value of 0x00000034. This indicates that a problem occurred in
the file system's cache manager.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Specifies source file and line number information. The
high 16 bits (the first four hexadecimal digits after the "0x")
identify the source file by its identifier number. The low 16 bits
identify the source line in the file where the bug check occurred. |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
One possible cause of this
bug check is depletion of nonpaged pool memory. If the nonpaged pool
memory is completely depleted, this error can stop the system. However,
during the indexing process, if the amount of available nonpaged pool
memory is very low, another kernel-mode driver requiring nonpaged pool
memory can also trigger this error.
Resolving the Problem
To resolve a
nonpaged pool memory depletion problem: Add new physical
memory to the computer. This will increase the quantity of nonpaged
pool memory available to the kernel.
WinDbg
Output Example:
CACHE_MANAGER (34)
See the comment for FAT_FILE_SYSTEM
(0x23)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000035:
NO_MORE_IRP_STACK_LOCATIONS (go
to top of page)
Usual causes:
Device driver, ?memory
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818976.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557494(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x35
OSROnline Listing: http://www.osronline.com/article.cfm?article=337
Knowledge
Base Articles:
KB 906866 You
may receive a "STOP 0x00000035 NO_MORE_IRP_STACK_LOCATIONS" error
message when you try to log on to a domain (Server 2003,
XP)
WinDbg
Help File Entry:
The
NO_MORE_IRP_STACK_LOCATIONS bug check has a value of 0x00000035. This
bug check occurs when the IoCallDriver packet has
no more stack locations remaining.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Address of the IRP |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
A higher-level driver has
attempted to call a lower-level driver through the IoCallDriver
interface, but there are no more stack locations in the packet. This
will prevent the lower-level driver from accessing its parameters.
This is a disastrous
situation, since the higher level driver is proceeding as if it has
filled in the parameters for the lower level driver (as required). But
since there is no stack location for the latter driver, the former has
actually written off the end of the packet. This means that some other
memory has been corrupted as well.
WinDbg
Output Example:
NO_MORE_IRP_STACK_LOCATIONS
(35)
A higher level driver has attempted to call a lower level driver through
the IoCallDriver() interface, but there are no more stack locations in
the
packet, hence, the lower level driver would not be able to access its
parameters, as there are no parameters for it. This is a
disasterous
situation, since the higher level driver "thinks" it has filled in the
parameters for the lower level driver (something it MUST do before it
calls
it), but since there is no stack location for the latter driver, the
former
has written off of the end of the packet. This means that
some other memory
has probably been trashed at this point.
Arguments:
Arg1: fffffa8011d42010, Address of the IRP
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000036:
DEVICE_REFERENCE_COUNT_NOT_ZERO (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818980.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557496(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
DEVICE_REFERENCE_COUNT_NOT_ZERO bug check has a value of 0x00000036.
This indicates that a driver attempted to delete a device object that
still had a positive reference count.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The address of the device object |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
A device driver has
attempted to delete one of its device objects from the system, but the
reference count for that object was non-zero.
This means there are still
outstanding references to the device. (The reference count indicates
the number of reasons why this device object cannot be deleted.)
This is a bug in the calling
device driver.
WinDbg
Output Example:
DEVICE_REFERENCE_COUNT_NOT_ZERO
(36)
A device driver has attempted to delete one of its device objects from
the
system but the reference count for that object was non-zero, meaning
that
there are still outstanding references to the device. (The
reference count
indicates the number of reasons why this device object cannot be
deleted.)
This is a bug in the calling device driver.
Arguments:
Arg1: 0000000000000000, Address of the device object
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000037:
FLOPPY_INTERNAL_ERROR (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818986.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557498(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The FLOPPY_INTERNAL_ERROR
bug check has a value of 0x00000037.
This bug check appears very
infrequently.
WinDbg
Output Example:
FLOPPY_INTERNAL_ERROR (37)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000038:
SERIAL_DRIVER_INTERNAL (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818989.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558936(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The SERIAL_DRIVER_INTERNAL
bug check has a value of 0x00000038.
This bug check appears very
infrequently.
WinDbg
Output Example:
SERIAL_DRIVER_INTERNAL (38)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000039:
SYSTEM_EXIT_OWNED_MUTEX (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms818992.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558941(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The SYSTEM_EXIT_OWNED_MUTEX
bug check has a value of 0x00000039. This indicates that the worker
routine returned without releasing the mutex object that it owned.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The address of the worker routine that caused the
error. |
| 2 |
The parameter passed to the worker routine. |
| 3 |
The address of the work item. |
| 4 |
Reserved. |
Cause
The worker routine returned
while it still owned a mutex object. The current worker thread will
proceed to run other unrelated work items, and the mutex will never be
released.
Resolving the Problem
A debugger is required to
analyze this problem. To find the driver that caused the error, use the
ln (List Nearest Symbols) debugger command:
kd> ln address
Where address is the worker
routine given in Parameter 1.
WinDbg
Output Example:
SYSTEM_EXIT_OWNED_MUTEX
(39)
Arguments:
Arg1: 8261f8fa
Arg2: 00000000
Arg3: 82746500
Arg4: 00000000
STOP 0x0000003A:
SYSTEM_UNWIND_PREVIOUS_USER (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818995.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558945(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
SYSTEM_UNWIND_PREVIOUS_USER bug check has a value of 0x0000003A.
This bug check appears very
infrequently.
WinDbg
Output Example:
SYSTEM_UNWIND_PREVIOUS_USER
(3a)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000003B:
SYSTEM_SERVICE_EXCEPTION (go
to top of page)
Usual causes:
System service, Device driver, graphics driver, ?memory
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms818997.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558949(v=VS.85).aspx
Knowledge
Base Articles:
KB 914215 Error
message that is similar to the following when a volume is dismounted on
a Windows Server
2003-based computer: "STOP 0x0000003B
SYSTEM_SERVICE_EXCEPTION"
KB 918564 Error
message after you install the Windows Server 2003 Scalable Networking
Pack in Windows Server
2003: "STOP 0x0000008E" or "STOP: 0x0000003B"
KB 923187 Error
message
in x64-based versions of Windows Server 2003:
"Stop 0x0000003B (c0000005, fffffadca82a63d4, fffffadca35fb4f0, 0)"
KB 941410 The
computer crashes, and you receive a "Stop 0x0000003b" error message
after you enable large image-based page files in Windows Server 2003
KB 951684 A
computer that is running Windows Server 2008
for Itanium-Based Systems
may restart unexpectedly when you hot-replace CPUs, and a Stop error
message occurs: "0x0000003B"
KB 979762 Stop error in Windows Vista and in Windows Server 2008 when you
try to print a document: "0x0000003B" or "0x0000007f"
KB 980932 "STOP 0x0000003B" Stop
error on a computer that is running Windows 7 or Windows Server 2008 R2 when
you use some IEEE 1394 devices
KB 2260182 "0x0000003B"
Stop error may occur when you run an App-V application on a computer
that has App-V RDS client installed and that is running Windows 7 or Windows Server 2008 R2
KB 2286188 Stop
error when you try to wake the computer up from or try to enter
hibernate (the S4 power state) or standby (the S3 power state) in
Windows Vista or
in Windows Server 2008:
"Stop 0x0000003B SYSTEM_SERVICE_EXCEPTION"
KB 2359223 "0x0000003B" Stop
error occurs in Windows Server 2008 R2
and in Windows 7 when an application
or a service performs a GUI-related operation
KB 2487324
"0x0000003B" or "0x0000007f" Stop errors may occur when you try to
print a document in Windows Server 2008 R2
KB 2518298 "0x0000003B" Stop error
on a terminal server in Windows Server 2008
KB 2525246 "0x0000003B" Stop error
when you remotely control a Remote Desktop session in Windows Server 2008 R2
KB 2584454
"0x0000003B" Stop error when you run certain applications in
Windows 7 or in Windows
Server 2008 R2
KB 2639032
"0x0000003B," "0x00000027," and "0x0000007e" Stop errors when a
connection to a CSV is lost on a Windows Server
2008 R2-based failover cluster
KB 2666484
"0x0000003B" Stop
error on Windows Server 2008 R2-based
RD Session Host servers that use an RD Connection Broker
KB 2678763
When the Filestream
feature is enabled in SQL Server 2008,
you receive a Stop error, and the computer restarts unexpectedly
KB 2705742
"0x0000003B" Stop error when
you use a Citrix XenApp application in Windows 7
or in Windows Server 2008 R2
KB
2719704
"0x0000003B" or "0x000000D5" Stop error in Windows 7
or in Windows Server 2008 R2
KB 2748302
Stop error when you use a Citrix XenApp application in
Windows 7 or in Windows Server 2008 R2
KB 2780102
"0x0000003B" Stop error when a Remote Desktop Connection Broker and a
Windows 7 SP1 or Windows
Server 2008 R2 SP1-based computer are in an RDS
farm
KB 2785338
"0x0000003b" Stop error when the memory usage of memory-mapped file is high in
Windows 7 or Windows
Server 2008 R2
More STOP error messages at this search
link: http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000003b&x=7&y=14&mkt=en-US&FORM=QBME1&l=1
WinDbg
Help File Entry:
The SYSTEM_SERVICE_EXCEPTION
bug check has a value of 0x0000003B. This indicates that an exception
happened while executing a routine that transitions from non-privileged
code to privileged code.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The exception that caused the bug check |
| 2 |
The address of the exception record for the exception
that caused the bug check |
| 3 |
The address of the context record for the exception
that caused the bug check |
| 4 |
0 |
Cause
This error has been linked
to excessive paged pool usage and may occur due to user-mode graphics
drivers crossing over and passing bad data to the kernel code.
WinDbg
Output Example:
SYSTEM_SERVICE_EXCEPTION
(3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000124283, Address of the exception record for the
exception that caused the bugcheck
Arg3: fffff88003f42ff0, Address of the context record for the exception
that caused the bugcheck
Arg4: 0000000000000000, zero.
STOP 0x0000003C:
INTERRUPT_UNWIND_ATTEMPTED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms819002.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558955(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
INTERRUPT_UNWIND_ATTEMPTED bug check has a value of 0x0000003C.
This bug check appears very
infrequently.
WinDbg
Output Example:
INTERRUPT_UNWIND_ATTEMPTED
(3c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000003D:
INTERRUPT_EXCEPTION_NOT_HANDLED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms819004.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558963(v=VS.85).aspx
Knowledge
Base Articles:
KB 2494666
Stop errors may occur
after you use the Driver Verifier manager to apply standard settings to
all drivers in
Windows 7 or in Windows
Server 2008 R2
WinDbg
Help File Entry:
The
INTERRUPT_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000003D.
This bug check appears very
infrequently.
WinDbg
Output Example:
INTERRUPT_EXCEPTION_NOT_HANDLED
(3d)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: fffffa6007024333
STOP 0x0000003E:
MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED
(go
to top of page)
Usual causes:
All processors aren't the same type and level
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms819006.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558965(v=VS.85).aspx
Knowledge
Base Articles:
KB 973879 You
receive a "Stop 0x0000003E" error message when you try to install
Windows Vista
Service Pack 2 or Windows Server 2008
Service Pack 2 on a
computer that has certain multiple processors
WinDbg
Help File Entry:
The
MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED bug check has a value of
0x0000003E. This indicates that the system has multiple processors, but
they are asymmetric in relation to one another.
Parameters
None
Cause
In order to be symmetric,
all processors must be of the same type and level. This system contains
processors of different types (for example, a Pentium processor and an
80486 processor).
WinDbg
Output Example:
MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED
(3e)
The system has multiple processors, but they are asymmetric in relation
to one another. In order to be symmetric all processors must
be of
the same type and level. For example, trying to mix a Pentium
level
processor with an 80486 would cause this bugcheck.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Device driver, Video driver, backup utilities, disk-intensive
applications
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819008.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558968(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x3f
Knowledge
Base Articles:
KB 145882 STOP
0x3f and
events 1001 and 2021 appear on heavily used IIS (Server 2008)
KB 256004 How
to
troubleshoot "STOP 0x0000003F" and "STOP 0x000000D8" error messages in
Windows Server
2003, Windows XP,
and Windows 2000
KB 294301 How
to
troubleshoot fatal system errors in Access 2002 running on Microsoft
Windows 2000
KB 304101 Backup
program
is unsuccessful when you back up a large system volume (NT Server,
2000 Server,
Server 2003)
KB 955033 Stop
0x0000003F or STOP 0x000000D8 occurs on Windows Server 2003
computer with Veritas Backup installed
WinDbg
Help File Entry:
The NO_MORE_SYSTEM_PTES bug
check has a value of 0x0000003F. This is the result of a system which
has performed too many I/O actions. This has resulted in fragmented
system page table entries (PTE).
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
0: system expansion PTE type
1: nonpaged pool expansion PTE type
|
| 2 |
Size of memory request |
| 3 |
Total free system PTEs |
| 4 |
Total system PTEs |
Cause
In almost all cases, the
system is not actually out of PTEs. Rather, a driver has requested a
large block of memory, but there is no contiguous block of sufficient
size to satisfy this request.
Often video drivers will
allocate large amounts of kernel memory that must succeed. Some backup
programs do the same.
Resolving the Problem
A possible
work-around: Modify the registry to increase the total
number of system PTEs. If this does not help, remove any
recently-installed software, especially backup utilities or
disk-intensive applications.
Debugging the
problem: The following method can be used to debug bug check
0x3F.
First, get a stack trace,
and use the !sysptes 3
extension command.
Then set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\TrackPtes
equal to DWORD 1, and reboot. This will cause the system to save stack
traces.
This allows you to display
more detailed information about the PTE owners. For example:
0: kd> !sysptes 4
0x2c47 System PTEs allocated to mapping locked pages
VA MDL PageCount Caller/CallersCaller
f0e5db48 eb6ceef0 1 ntkrpamp!MmMapLockedPages+0x15/ntkrpamp!IopfCallDriver+0x35
f0c3fe48 eb634bf0 1 netbt!NbtTdiAssociateConnection+0x1f/netbt!DelayedNbtProcessConnect+0x17c
f0db38e8 eb65b880 1 mrxsmb!SmbMmAllocateSessionEntry+0x89/mrxsmb!SmbCepInitializeExchange+0xda
f8312568 eb6df880 1 rdbss!RxCreateFromNetRoot+0x3d7/rdbss!RxCreateFromNetRoot+0x93
f8363908 eb685880 1 mrxsmb!SmbMmAllocateSessionEntry+0x89/mrxsmb!SmbCepInitializeExchange+0xda
f0c54248 eb640880 1 rdbss!RxCreateFromNetRoot+0x3d7/rdbss!RxCreateFromNetRoot+0x93
f0ddf448 eb5f3160 1 mrxsmb!MrxSmbUnalignedDirEntryCopyTail+0x387/mrxsmb!MRxSmbCoreInformation+0x36
f150bc08 eb6367b0 1 mrxsmb!MrxSmbUnalignedDirEntryCopyTail+0x387/mrxsmb!MRxSmbCoreInformation+0x36
f1392308 eb6fba70 1 netbt!NbtTdiOpenAddress+0x1fb/netbt!DelayedNbtProcessConnect+0x17c
eb1bee64 edac5000 200 VIDEOPRT!pVideoPortGetDeviceBase+0x118/VIDEOPRT!VideoPortMapMemory+0x45
f139b5a8 edd4b000 12 rdbss!FsRtlCopyWrite2+0x34/rdbss!RxDriverEntry+0x149
eb41f400 ede92000 20 VIDEOPRT!pVideoPortGetDeviceBase+0x139/VIDEOPRT!VideoPortGetDeviceBase+0x1b
eb41f198 edf2a000 20 NDIS!NdisReadNetworkAddress+0x3a/NDIS!NdisFreeSharedMemory+0x58
eb41f1e4 eb110000 10 VIDEOPRT!pVideoPortGetDeviceBase+0x139/VIDEOPRT!VideoPortGetDeviceBase+0x1b
......
If the system runs out of
PTEs again after the TrackPtes registry value has
been set, bug
check 0xD8 (DRIVER_USED_EXCESSIVE_PTES) will be issued
instead of 0x3F. The name of the driver causing this error will be
displayed as well.
WinDbg
Output Example:
NO_MORE_SYSTEM_PTES (3f)
No System PTEs left. Usually caused by a driver not cleaning
up
properly. If kernel debugger available get stack trace and
"!sysptes 3".
Set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\TrackPtes
to a DWORD 1 value and reboot. Then the system will save
stack traces
so the guilty driver can be identified. There is no other way
to find out
which driver is neglecting to clean up the I/Os.
A bugcheck DRIVER_USED_EXCESSIVE_PTES will then occur if the system
runs out of
PTEs again and the offending driver's name will be printed.
Arguments:
Arg1: 0000000000000000, PTE Type (0 - system expansion, 1 nonpaged pool
expansion)
Arg2: 0000000000000000, Requested size
Arg3: 0000000000000000, Total free system PTEs
Arg4: 0000000000000000, Total system PTEs
Usual causes:
Device driver
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819198.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558972(v=VS.85).aspx
Knowledge
Base Articles:
KB 187302 Stop
0x00000040 in NetBT Protocol (NT)
KB 967787 Stop
error message when you have the TCP Chimney feature enabled and the TCP
transfer buffer size is set to 32 MB in Windows Vista,
Windows Server
2008, or Windows Server
2003:
"Stop 0x00000040 TARGET_MDL_TOO_SMALL"
WinDbg
Help File Entry:
The TARGET_MDL_TOO_SMALL bug
check has a value of 0x00000040. This indicates that a driver has
improperly used IoBuildPartialMdl.
Parameters
None
Cause
This is a driver bug. A
driver has called the IoBuildPartialMdl function
and passed it an MDL to map part of a source MDL, but the target MDL is
not large enough to map the entire range of addresses requested.
Resolving the Problem
The source and target MDLs,
as well as the address range length to be mapped, are the first,
second, and fourth arguments to the IoBuildPartialMdl
function. Therefore, doing a stack trace on this particular function
might help during the debugging process. Ensure that your code is
correctly calculating the necessary size for the target MDL for the
address range length that you are passing to this function.
WinDbg
Output Example:
TARGET_MDL_TOO_SMALL (40)
A driver has called the IoBuildPartialMdl() function and passed it an
MDL
to map part of a source MDL, but the target MDL is not large enough to
map
the entire range of addresses requested. This is a driver
bug. The source
and target MDLs, as well as the address range length to be mapped are
the
arguments to the IoBuildPartialMdl() function, i.e.;
IoBuildPartialMdl(
IN PMDL SourceMdl,
IN OUT PMDL TargetMdl,
IN PVOID VirtualAddress,
IN ULONG Length
)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000041:
MUST_SUCCEED_POOL_EMPTY (go
to top of page)
Usual causes:
Device driver, ?memory
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819202.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558974(v=VS.85).aspx
Knowledge
Base Articles:
KB 833213 You
receive a
"STOP 0x00000041" error message on a computer that is running Windows NT Server
4.0
KB 904375 You
receive a
"STOP 0x00000041 MUST_SUCCEED_POOL_EMPTY" error message on a Windows 2000
Service Pack 4-based computer
WinDbg
Help File Entry:
The MUST_SUCCEED_POOL_EMPTY
bug check has a value of 0x00000041. This indicates that a kernel-mode
thread has requested too much must-succeed pool.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The size of the request that could not be satisfied |
| 2 |
The number of pages used from nonpaged pool |
| 3 |
The number of requests from nonpaged pool larger than
PAGE_SIZE |
| 4 |
The number of pages available |
Cause
In Microsoft
Windows 2000, only a small amount of must-succeed pool is
permitted. In Windows XP and later, no driver is permitted to
request must-succeed pool.
If a must-succeed request
cannot be filled, this bug check is issued.
Resolving the Problem
Replace or rewrite the
driver which is making the request. A driver should not request
must-succeed pool. Instead, it should ask for normal pool and
gracefully handle the scenario where the pool is temporarily empty.
The kb (Display
Stack Backtrace) command will show the driver that
caused the error.
Additionally, it is possible
that a second component has depleted the must-succeed pool. To
determine if this is the case, first use the kb
command. Then use !vm 1
to display total pool usage, !poolused 2
to display per-tag nonpaged pool usage, and !poolused 4
to display per-tag paged pool usage. The component associated with the
tag using the most pool is probably the source of the problem.
WinDbg
Output Example:
MUST_SUCCEED_POOL_EMPTY
(41)
No component should ever ask for must-succeed pool as if there is none
left,
the system crashes. Instead, components should ask for normal
pool and
gracefully handle the scenario where the pool is temporarily
empty. This
bugcheck definitely reveals a bug in the caller (use kb to identify the
caller).
In addition, the fact that the pool is empty may be either a transient
condition
or possibly a leak in another component (distinguish between the 2
cases by
following the directions below).
Type kb to show the calling stack.
Type !vm 1 to display total pool usage.
Then type !poolused 2 to display per-tag nonpaged pool usage.
Then type !poolused 4 to display per-tag paged pool usage.
The crash should be looked at by the tag owner that is consuming the
most pool.
Arguments:
Arg1: 0000000000000000, size of the request that could not be satisfied
Arg2: 0000000000000000, number of pages used of nonpaged pool
Arg3: 0000000000000000, number of > PAGE_SIZE requests from
nonpaged pool
Arg4: 0000000000000000, number of pages available
STOP 0x00000042:
ATDISK_DRIVER_INTERNAL (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819204.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558976(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The ATDISK_DRIVER_INTERNAL
bug check has a value of 0x00000042.
This bug check appears very
infrequently.
WinDbg
Output Example:
ATDISK_DRIVER_INTERNAL (42)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819206.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558978(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The NO_SUCH_PARTITION bug
check has a value of 0x00000043.
This bug check appears very
infrequently.
WinDbg
Output Example:
NO_SUCH_PARTITION (43)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000044:
MULTIPLE_IRP_COMPLETE_REQUESTS (go
to top of page)
Usual causes:
Device driver(s)
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms819207.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558982(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x44
Knowledge
Base Articles:
KB 294876 "Stop
0x00000044 Multiple_IRP_Complete_Requests" Error Message During a
Shutdown or Standby Operation (2000)
KB 296734 STOP
0x00000044 Error Message Appears While You Are Using MSMQ (2000)
KB 832212 "Stop
0x00000044" error message when the HP Insight Management Agent is
configured (2000,
Server 2003)
KB 839619 You
receive a
"Stop 0x00000044 Multiple_IRP_Complete_Requests" error message on
Windows XP
Professional
KB 867774 "Stop
0x00000044" error message on a Windows 2000-based
computer that uses a Gigabit network adapter
KB 930570 Error
message
in the Usbhub.sys process when you wake a Windows Vista-based
computer from sleep or from hibernation: "STOP 0x00000044"
KB 935192 Error message
when you resume a Windows XP-based
computer from hibernation after you apply hotfix 918005: "Stop
0x00000044" or “Stop 0x000000F4”
KB 942528 You
randomly
receive a "STOP 0x00000044" error message after you install a
third-party program on a Windows Server 2003-based
computer
KB 973056 Stop
0x44
(MULTIPLE_IRP_COMPLETE_REQUESTS) Disabling Idle USB Device with
KMDF-based Driver (Vista)
KB 977694 Stop error message when
you access shared files in Windows Server 2008 or in
Windows Vista:
0x00000044 or 0x000000CC
KB 980143 "0x00000044" Stop error
message when you use MPIO DSM in Windows Server 2008 R2 to
manage a storage device that is connected by Fibre Channel or by Fibre
Channel over Ethernet
KB 2549724 "0x00000044" Stop error
when you access shared files in Windows Server 2008 R2 or in Windows 7
KB 2552033
"0x00000044" Stop error on a computer that is running
Windows 7 or Windows Server 2008 R2
WinDbg
Help File Entry:
The
MULTIPLE_IRP_COMPLETE_REQUESTS bug check has a value of 0x00000044.
This in2280732228073222807322280732dicates
that a driver has tried to requested an IRP be completed
that is already complete.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The address of the IRP |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
A driver has called IoCompleteRequest
to ask that an IRP be completed, but the packet has already been
completed.
Resolving the Problem
This is a tough bug to find
because the simplest case — a driver that attempted to complete its own
packet twice — is usually not the source of the problem. More likely,
two separate drivers each believe that they own the packet, and each
has attempted to complete it. The first request succeeds, and the
second fails, resulting in this bug check.
Tracking down which drivers
in the system caused the error is difficult, because the trail of the
first driver has been covered by the second. However, the driver stack
for the current request can be found by examining the device object
fields in each of the stack locations.
WinDbg
Output Example:
MULTIPLE_IRP_COMPLETE_REQUESTS
(44)
A driver has requested that an IRP be completed (IoCompleteRequest()),
but
the packet has already been completed. This is a tough bug to
find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened. Rather, two separate
drivers each
believe that they own the packet, and each attempts to complete
it. The
first actually works, and the second fails. Tracking down
which drivers
in the system actually did this is difficult, generally because the
trails
of the first driver have been covered by the second. However,
the driver
stack for the current request can be found by examining the DeviceObject
fields in each of the stack locations.
Arguments:
Arg1: 0000000000000000, Address of the IRP
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000045:
INSUFFICIENT_SYSTEM_MAP_REGS (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms819209.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558984(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
INSUFFICIENT_SYSTEM_MAP_REGS bug check has a value of 0x00000045.
This bug check appears very
infrequently.
WinDbg
Output Example:
INSUFFICIENT_SYSTEM_MAP_REGS
(45)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000046:
DEREF_UNKNOWN_LOGON_SESSION (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819211.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558987(v=VS.85).aspx
Knowledge
Base Articles:
KB 157936 SMC9232N
Driver Causing Multiple STOP Messages (NT)
WinDbg
Help File Entry:
The
DEREF_UNKNOWN_LOGON_SESSION bug check has a value of 0x00000046.
This bug check appears very
infrequently.
WinDbg
Output Example:
DEREF_UNKNOWN_LOGON_SESSION
(46)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000047:
REF_UNKNOWN_LOGON_SESSION (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819213.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558991(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
REF_UNKNOWN_LOGON_SESSION bug check has a value of 0x00000047.
This bug check appears very
infrequently.
WinDbg
Output Example:
REF_UNKNOWN_LOGON_SESSION
(47)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000048:
CANCEL_STATE_IN_COMPLETED_IRP (go
to top of page)
Usual causes:
Device driver(s)
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819214.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558993(v=VS.85).aspx
Knowledge
Base Articles:
KB 308605 Stop
0x00000048 or Stop 0x0000000A Caused By Named Pipe File System
(Npfs.sys) (NT)
KB 331484 "Stop
0x00000048" occurs when you stop the Computer Browser service (2000)
KB 983169
"Stop error code
0x00000048 CANCEL_STATE_IN_COMPLETED_IRP" error message in Windows
Server 2003 Service Pack 2
WinDbg
Help File Entry:
The
CANCEL_STATE_IN_COMPLETED_IRP bug check has a value of 0x00000048. This
indicates that an I/O request packet (IRP) was completed, and then was
subsequently canceled.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
A pointer to the IRP |
| 2 |
The cancel routine set by the driver |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
An IRP that had a Cancel
routine set was completed normally, without cancellation. But after it
was complete, a driver called the IRP's Cancel
routine.
This could be caused by a
driver that completed the IRP and then attempted to cancel it.
It could also be caused by
two drivers each trying to access the same IRP in an improper way.
Resolving the Problem
The cancel routine parameter
can be used to determine which driver or stack caused the bug check.
WinDbg
Output Example:
CANCEL_STATE_IN_COMPLETED_IRP
(48)
This bugcheck indicates that an I/O Request Packet (IRP) that is to be
cancelled, has a cancel routine specified in it -- meaning that the
packet
is in a state in which the packet can be cancelled -- however, the
packet
no longer belongs to a driver, as it has entered I/O
completion. This is
either a driver bug, or more than one driver is accessing the same
packet,
which is not likely and much more difficult to find. The cancel routine
parameter will provide a clue as to which driver or stack is the
culprit.
Arguments:
Arg1: 0000000000000000, Pointer to the IRP
Arg2: 0000000000000000, Cancel routine set by the driver.
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000049:
PAGE_FAULT_WITH_INTERRUPTS_OFF (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819216.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff558996(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
PAGE_FAULT_WITH_INTERRUPTS_OFF bug check has a value of 0x00000049.
This bug check appears very
infrequently.
WinDbg
Output Example:
PAGE_FAULT_WITH_INTERRUPTS_OFF
(49)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000004A:
IRQL_GT_ZERO_AT_SYSTEM_SERVICE (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819218.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559001(v=VS.85).aspx
Knowledge
Base Articles:
KB 969873 A
Stop error occurs when you profile an application in Visual Studio 2008
SP1 on a computer that uses an AMD processor and has Hyper-V enabled
WinDbg
Help File Entry:
The
IRQL_GT_ZERO_AT_SYSTEM_SERVICE bug check has a value of 0x0000004A.
This indicates that a thread is returning to user mode from a system
call when its IRQL is still above PASSIVE_LEVEL.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The address of the system function (system call
routine) |
| 2 |
The current IRQL |
| 3 |
0 |
| 4 |
0 |
WinDbg
Output Example:
IRQL_GT_ZERO_AT_SYSTEM_SERVICE
(4a)
Returning to usermode from a system call at an IRQL >
PASSIVE_LEVEL.
Arguments:
Arg1: 0000000077b90aca, Address of system function (system call routine)
Arg2: 000000000000000c, Current IRQL
Arg3: 0000000000000000, 0
Arg4: fffff98013565ca0, 0
STOP 0x0000004B:
STREAMS_INTERNAL_ERROR (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819221.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559007(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The STREAMS_INTERNAL_ERROR
bug check has a value of 0x0000004B.
This bug check appears very
infrequently.
WinDbg
Output Example:
STREAMS_INTERNAL_ERROR (4b)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000004C:
FATAL_UNHANDLED_HARD_ERROR (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819224.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559010(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
FATAL_UNHANDLED_HARD_ERROR bug check has a value of 0x0000004C.
This bug check appears very
infrequently.
WinDbg
Output Example:
FATAL_UNHANDLED_HARD_ERROR
(4c)
If a hard error occurs during system booting before windows is up, and
the hard error is a real error, the system will blue screen crash.
Some common cases are:
x218 - This means a necessary registry
hive file could not be
loaded. The obvious reason is if it is corrupt or missing.
In this case, either the Emergency Repair Disk or a
reinstall is required.
Some less obvious reasons are that the driver has corrupted
the registry data while loading into memory, or the memory
where the registry file was loaded is not actually memory.
x21a - This means that either winlogon,
or csrss (windows) died
unexpectedly. The exit code tells more information.
Usually
it is c0000005 meaning that an unhandled exception crashed
either of these processes.
x221 - This means that a driver is
corrupt, or a system DLL was
detected to be corrupt.
Safeboot or boot an alternate OS (or reinstall)
and then make sure the on disk file that is listed as bad
matches the version on CD and replace if necessary. In some
cases, random corruption can mean that there is a hardware
problem in the I/O path to the file.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Device driver, memory
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms841500.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559012(v=VS.85).aspx
Knowledge
Base Articles:
KB 907419 A
computer
that is running Windows Powered Network-Attached Storage 2.01 may stop
responding
KB 960772
The system may
generate Stop error 0x4D when an application uses the VirtualLock
function to lock pages in Windows Server 2003
or in Windows
XP Professional x64 Edition
WinDbg
Help File Entry:
The NO_PAGES_AVAILABLE bug
check has a value of 0x0000004D. This indicates that no free pages are
available to continue operations.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The total number of dirty pages |
| 2 |
The number of dirty pages destined for the page file |
| 3 |
Windows XP and Windows 2000: The
size of the nonpaged pool available at the time the bug check occurred
Windows Server 2003 and later: Reserved
|
| 4 |
Windows 2000: The number of
transition pages that are currently stranded
Windows XP and later: The most recent modified
write error status.
|
Cause
To see general memory
statistics, use the !vm 3
extension.
This bug check can occur for
any of the following reasons:
- A driver has blocked, deadlocking the modified or mapped
page writers. Examples of this include mutex deadlocks or accesses to
paged out memory in file system drivers or filter drivers. This
indicates a driver bug.
If Parameter 1 or Parameter 2 is large,
then this is a possibility. Use !vm 3.
- A storage driver is not processing requests. Examples of
this are stranded queues and non-responding drives. This indicates a
driver bug.
If Parameter 1 or Parameter 2 is large,
then this is a possibility. Use !vm 8,
followed by !process 0 7.
- A high-priority realtime thread has starved the balance set
manager from trimming pages from the working set, or starved the
modified page writer from writing them out. This indicates a bug in the
component that created this thread.
This situation is difficult to analyze. Try using !ready.
Try also !process 0 7
to list all threads and see if any have accumulated excessive kernel
time as well as what their current priorities are. Such processes may
have blocked out the memory management threads from making pages
available.
- Windows XP and Windows 2000: Not enough
pool is available for the storage stack to write out modified pages.
This indicates a driver bug.
If Parameter 3 is small, then this is a
possibility. Use !vm
and !poolused 2.
- Windows 2000: All the processes have
been trimmed to their minimums and all modified pages written, but
still no memory is available. The freed memory must be stuck in
transition pages with non-zero reference counts — thus they cannot be
put on the freelist.
A driver is neglecting to unlock the pages preventing the
reference counts from going to zero which would free the pages. This
may be due to transfers that never finish, causing the driver routines
to run endlessly, or to other driver bugs.
If Parameter 4 is large, then this is a
possibility. But it is very hard to find the driver. Try the !process 0 1
extension and look for any drivers that have a lot of locked pages.
If the problem cannot be
found, then try booting with a kernel debugger attached from the
beginning, and monitor the situation.
WinDbg
Output Example:
NO_PAGES_AVAILABLE (4d)
No free pages available to continue operations.
If kernel debugger available "!vm 3".
This bugcheck can occur for the following reasons:
1. A driver has blocked, deadlocking the modified or mapped
page writers. Examples of this include mutex deadlocks or
accesses to paged out memory in filesystem drivers, filter
drivers, etc. This indicates a driver bug.
If parameter 1 or 2 is large, then this is a possibility. Type
"!vm 3" in the kernel debugger.
2. The storage driver(s) are not processing
requests. Examples
of this are stranded queues, non-responding drives, etc. This
indicates a driver bug.
If parameter 1 or 2 is large, then this is a possibility. Type
"!process 0 7" in the kernel debugger.
3. Not enough pool is available for the storage stack to
write out
modified pages. This indicates a driver bug.
If parameter 3 is small, then this is a possibility. Type
"!vm" and "!poolused 2" in the kernel debugger.
4. A high priority realtime thread has starved the balance set
manager from trimming pages and/or starved the modified writer
from writing them out. This indicates a bug in the component
that created this thread.
This one is hard to determine, try "!ready"
5. All the processes have been trimmed to their minimums and
all
modified pages written, but still no memory is available. The
freed memory must be stuck in transition pages with non-zero
reference counts - thus they cannot be put on the freelist.
A driver is neglecting to unlock the pages preventing the
reference counts from going to zero which would free the pages.
This may be due to transfers that never finish and the driver
never aborts or other driver bugs.
If parameter 4 is large, then this is a possibility. But it
is very hard to find the driver. Try "!process 0 1" and look
for any that have a lot of locked pages.
If the problem cannot be found, then try booting with /DEBUG and a
kernel
debugger attached, so if it reproduces, a debug session can be initiated
to identify the cause.
Arguments:
Arg1: 0000000000000000, Total number of dirty pages
Arg2: 0000000000000000, Number of dirty pages destined for the
pagefile(s).
Arg3: 0000000000000000, Internal flags.
Arg4: 0000000000000000, Most recent modified write error status.
Usual causes:
Device driver, ?memory
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms841511.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559014(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x4e
OSROnline Listing: http://www.osronline.com/article.cfm?article=334
Knowledge
Base Articles:
KB 139281 STOP
Msg:
0x0000004E or 0x0000000A Under Heavy Computer Usage (NT)
KB 920872 Audio
playback does not play the audio file from the correct position after
you pause it, and you randomly receive a Stop error message when you
try to play audio files in Windows XP
Service Pack 2 (SP2)
KB 969550 A
Stop error occurs on an HP ProLiant server that has the firmware from
an E200/E200i HP Smart Array SAS/SATA controller installed on any
Windows Server platform (2000
Server,
Server 2003,
Server 2008)
KB 2447725 "0x00000004E" Stop
error occurs when some users try to access shared files in Windows Server 2008 or in
Windows Vista
KB 2853579
"0x0000004E" Stop error when shadow copying fails on a computer that is running
Windows Server 2012
WinDbg
Help File Entry:
The PFN_LIST_CORRUPT bug
check has a value of 0x0000004E. This indicates that the page frame
number (PFN) list is corrupted.
Parameters
The following parameters are
displayed on the blue screen. Parameter 1
indicates the type of violation. The meaning of the other parameters
depends on the value of Parameter 1.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
| 0x01 |
The ListHead value that was
corrupted |
The number of pages available |
0 |
The list head was corrupt. |
| 0x02 |
The entry in the list that is being removed |
The highest physical page number |
The reference count of the entry being removed |
A list entry was corrupt. |
| 0x07 |
The page frame number |
The current share count |
0 |
A driver has unlocked a certain page more times than it
locked it. |
| 0x8F |
New page number |
Old page number |
0 |
The free or zeroed page listhead is corrupt. |
| 0x99 |
Page frame number |
Current page state |
0 |
A page table entry (PTE) or PFN is corrupt. |
| 0x9A |
Page frame number |
Current page state |
The reference count of the entry that is being removed |
A driver attempted to free a page that is still locked
for IO. |
Cause
This error is typically
caused by a driver passing a bad memory descriptor list. For example,
the driver might have called MmUnlockPages twice
with the same list.
If a kernel debugger is
available, examine the stack trace.
WinDbg
Output Example:
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie:
calling
MmUnlockPages twice with the same list, etc). If a kernel
debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0008dd83, page frame number
Arg3: 00000002, current page state
Arg4: 0008de02, 0
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms841523.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559017(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x4f
Knowledge
Base Articles:
WinDbg
Help File Entry:
The NDIS_INTERNAL_ERROR bug
check has a value of 0x0000004F.
This bug check appears very
infrequently.
WinDbg
Output Example:
NDIS_INTERNAL_ERROR (4f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000050:
PAGE_FAULT_IN_NONPAGED_AREA (go
to top of page)
Usual causes:
Defective hardware (particularly memory - but not just RAM), Faulty
system service, Antivirus, Device driver, NTFS corruption,
BIOS
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms841534.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559023(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x50
OSROnline Listing: http://www.osronline.com/article.cfm?article=335
Knowledge
Base Articles:
KB 171003 "Stop
0x50"
Error Message While Installing Windows (NT, 2000)
KB 196389 STOP
0x0000000A or STOP 0x00000050 in NTOSKRNL.EXE (NT)
KB 250975 STOP
Errors
When Running MITAC 6133 Laptop on Battery Power (2000)
KB 252192 "Stop
0x00000050" in Ntfs.sys Under Stress Accessing Freed FCB (2000)
KB 286154 STOP
0X0000001E in Protcls.sys When You Undock a Toshiba Tecra 8100 (XP)
KB 310628 Easy
CD
Creator 5.0 does not function in Windows XP
KB 315335 "STOP
0x0000008e" error message during Windows XP
setup
KB 317153 Stop
0x0000001e or Stop 0x00000050 Error in Navap.sys When You Use Norton
AutoProtect Feature (NT
Server, 2000
Server)
KB 323256 Stop
0x50
Error Message When You Rename a Large Number of Files on Windows 2000
KB 326189 "Stop"
Errors
Occur in ObpDestroySecurityDescriptorHeader (NT Server)
KB 329293 STOP:
0x00000050 Page_Fault_In_Non-Paged_Area Error After Installing Service
Pack 1 (SP1) (XP)
KB 329772
"Stop error code 0x00000050" occurs when you start the computer for the
first time (2000)
KB 810982
"Stop error code
0x00000050 (PAGE_FAULT_IN_NON_PAGED_AREA)" error message in
Sentinel.sys when you start your computer (2000)
KB 811016
"Stop error code
0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA)" when you use a PC card (2000)
KB 812343
Network activity causes your computer to stop responding, and you
receive "Stop error code 0x00000050 (FAULT_IN_NONPAGED_AREA)" (2000)
KB 830848
Windows Server 2003 crashes
intermittently, and you receive a "Stop error code 0x00000050" error
message
KB 831239
"Stop error code
0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA) in ppbint.dll" error message
when you open a document (NT, 2000)
KB 883516 You receive Stop error
code 0x00000019 or Stop error code 0x00000050 in the Tcpip.sys file on
a Windows 2000 Server-based computer
KB 889681
You receive a "Stop
error code 0x00000050" error message on your Windows 2000-based computer
KB 894278 The
computer may automatically restart, or you may receive a "serious
error" message or a Stop error message in Windows Server 2003,
in
Windows XP,
or in Windows 2000
KB 903251 You
may
receive an error message on a Windows-based computer: "STOP 0x00000050"
or "STOP 0x0000008e" (2000,
XP,
Server 2003)
KB 911028 When
you use a
32-bit program to print a document from a 64-bit version of Microsoft
Windows, you may receive a Stop error message, or objects on the page
are omitted (XP,
Server 2003)
KB 923150 When
you
restart
Windows Server
2003 after you use the Driver Verifier utility, you may
receive a Stop error: "STOP 0x00000050" or "STOP 0x000000F4"
KB 929637
Error message during Windows Vista
startup if the Nero InCD program is installed and if the "Special pool"
feature is enabled in the Driver Verifier utility: "Stop 00000050"
KB 950298
Error message on a
Windows
Server 2003-based file server: "Stop
error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA)"
KB 951418 Stop error in Win7 and in Win2008 R2: "0x00000050
PAGE_FAULT_IN_NONPAGED_AREA"
KB 951880
Stop error when
Windows
Server 2003-based server restarts
unexpectedly: "Stop 0x00000050"
KB 952844 You
receive a "STOP: 0x00000050" error message when you start a Windows
Server 2003-based
computer by using the iSCSI Boot Initiator
KB 955066
Windows Server 2003 Terminal Server
may crash during the terminal session logoff process, and you may
receive a Stop error message: "Stop error code 0x00000050
(PAGE_FAULT_IN_NONPAGED_AREA)"
KB 955803 Stop
error
during the shutdown process on a Windows Server 2008
or Windows Vista
SP1-based computer: "Stop 0x00000050"
KB 956182
Stop error message
when you try to perform directory listing of a NFS share that is
mounted on a Windows
Server 2008-based NFS client: "STOP
0x00000050"
KB 957187
Stop error if you use some OpenType fonts on a computer that is running
Windows
Server 2003, Windows
Vista, or Windows Server 2008:
"Stop error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA)"
KB 957319 You
receive a
"Stop 0x00000050" or "Stop 0x0000008E" error message when you restart a
Windows XP-based
computer
KB 958282
Stop error message when an application calls the NtGdiRectInRegion
function on a Windows XP-based
computer: "Stop 0x00000050"
KB 958867 You
receive a
"Stop 0x00000050" or "Stop 0x0000000A" error message when you
hot-replace memory on a Windows Server 2008-based
computer
KB 959338
You receive a
PAGE_FAULT_IN_NONPAGED_AREA Stop error when you print a document from a
Windows
Server 2003 server that is running as
a terminal server
KB 959828 Stop
error on a Windows Server
2003 SP2-based terminal server or a Windows Server 2008 SP2-based
terminal server when users print documents in terminal sessions:
"0x0000008E" or "0x00000050"
KB 960852
Stop error when an
application calls the SystemParametersInfo function on a Windows
Server 2003-based computer: "0x00000050"
KB 960882 Error
message when a Windows Server
2003-based
computer is shutting down: "Stop 0x000000CE" or "Stop 0x00000050"
KB 961799 A Stop error occurs on a
Windows Server 2003-based server when
a user accesses shared files on the server by using an SMB connection
KB 965497 You
receive the Stop error 0x00000050 and then the computer restarts
automatically if the OpenFileById function opens a folder and then the
handle returned is used to rename files on a computer that is running
Windows Server 2008
or Windows Vista
KB 966319
During user logon or logoff, you receive stop error code 0x00000050,
and the system restarts automatically on a computer that is running
Windows
Server 2008 or Windows
Vista SP1
KB 969550 A
Stop error
occurs on an HP ProLiant server that has the firmware from an
E200/E200i HP Smart Array SAS/SATA controller installed on any Windows
Server platform (2000
Server, Server
2003, Server
2008)
KB 970694 (not working) "Stop 0x50"
error - Enabling/disabling Bluetooth on Vista
with Feature Pack for Wireless
KB 971075 Error message on a
computer that runs Windows Server 2003 or Windows
XP x64 Edition:
"Stop 0x00000050"
KB 971251 Stop error code on a
computer that is running Windows Server 2003 Service Pack 2:
"0x00000050"
KB 973092 Stop error code occurs
on a computer that is running Windows Server 2003 Service Pack 2:
"0x00000050 PAGE_FAULT_IN_NONPAGED_AREA"
KB 973350 (Link Not Working) "Stop 0x50"
error - Enabling/disabling Bluetooth on
Vista/Server 2008
KB 973618 Stop error when a
surprise removal of a USB host controller occurs on a computer that is
running Windows Server
2003: "Stop 0x00000050"
KB 974560 Error message during
stress tests on a computer that is running Windows 7 if Driver
Verifier is enabled: "Stop 0x00000050"
KB 975070 Error
message
after you apply update 973879: "Stop 0x0000007e" or "Stop 0x00000050" (Vista,
Server 2008)
KB 975192 Error message after you
enable or disable Microsoft Bluetooth Enumerator in Device Manager on a
Windows Vista-based
computer that has Windows Vista Feature Pack for Wireless installed:
“Stop 0x00000050”
KB 975986 Stop error message on a
computer that is running Windows Server 2003 SP2 and
that has almost 4 GB or more of physical memory: "0x00000050" or
"0x0000000A"
KB 976452 Error message on a blue
screen when you perform an operation to a DFS server from a computer
that is running Windows Vista
or Windows Server 2008:
"PAGE_FAULT_IN_NONPAGED_AREA"
KB 976748 Stop error code after
you install Microsoft Multipath I/O (MPIO) on a computer that is
running Windows Server
2008: "0x000000D1" or "0x00000050"
KB 979538 "Stop 0x0000007E" or
"Stop 0x00000050" Stop error message in Windows 7 or Windows Server 2008 R2
KB 980135 Stop error message if
under heavy load in Windows Server 2008 and in
Windows Vista:
"Stop 0x00000050"
KB 981471
Stop error code
0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA) in Windows Server 2003 SP2
KB 987574 You
may
receive a
Stop error message after you insert media into a removable disk device
in Windows XP,
Windows Server
2003, or Windows 2000
KB 2028815 "0x00000050" Stop error
message occurs when you use multiple volume managers in Windows Server 2008
KB 2279561 "0x00000050" Stop error
occurs on a terminal server that is running Windows Server 2003 if a user
mode printer driver is used in a terminal server session
KB 2280072 "0x00000050" Stop error
on a computer that is running Windows Vista or Windows Server 2008
KB 2460912
"0x0000007E" or "0x00000050" Stop error when you create snapshots of a
volume in Windows Server 2008 R2 or
in
Windows 7
KB 2516405 "0x00000050" Stop error
occurs when you run an application that uses the RegSetValueEx function
on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2633799
You randomly receive various Stop errors when you change the network
adapter teaming configuration in Windows Server
2008 or in Windows Vista
KB 2637924
"0x00000050" Stop error when you disconnect a HID during the system startup
process in Windows 7 or in Windows
Server 2008 R2
KB 2691226
Stop 0x50 on Windows
Server 2008 R2 with RealVNC VNC Server
4.6 (Windows 7 also)
KB 2695584
"0x0000007E" or "0X00000050" Stop error when you run the Common Scenario Stress
with IO test in Windows 7 or in Windows
Server 2008 R2
KB 2709236
0x00000050 Stop error when
Windows tries to back up registry hives on a computer that is running Windows
Vista SP2 or Windows
Server 2008 SP2
KB 2719594
"0x00000050" Stop error in Windows 7 or in
Windows Server 2008 R2
KB 2727941
"0x00000050" Stop error when you create a volume snapshot in Windows
Vista, in Windows
Server 2008, in Windows 7 or in Windows
Server 2008 R2
KB 2781406
"0x00000050" Stop error and an automatic restart on a Windows
Server 2008 R2-based computer
KB 2787113
"0x00000050" Stop error when you create a snapshot by using the VSS in Windows
Vista or in Windows
Server 2008
KB 2788573
"0x00000050" Stop error when you run a WFP-based application to register a
callout routine in Windows 7 or Windows
Server 2008 R2
KB 2795491
"0x00000050" Stop error after a registry hive that contains many registry
entries and subkeys is loaded in Windows Server 2008
SP2
KB 2824200
"0x00000024" or "0x00000050" Stop error on a computer that is running Windows
Vista or Windows
Server 2008
KB 2834026
"0x00000050" Stop error when you try to create a virtual machine or copy a VHD
or VHDX file to a SMB share in Windows Server 2012
KB 2834140
"0x00000050" Stop error after you install update 2670838 on a computer that is
running Windows 7 SP1 or Windows
Server 2008 R2 SP1
KB 2902124
Stop error 0x50 occurs
in Ndis.sys on a Windows 8-based or Windows
Server 2012-based computer (0xD5 when running
Verifier)
KB 2931772
"0x00000050" Stop error on the terminal server that is running
Windows 7 SP1 or Windows
Server 2008 R2 SP1 when a session is
disconnected
Many more STOP errors in this search:
http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x00000019&x=10&y=3&mkt=en-US&FORM=QBME1&l=1
WinDbg
Help File Entry:
The
PAGE_FAULT_IN_NONPAGED_AREA bug check has a value of 0x00000050. This
indicates that invalid system memory has been referenced.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory address referenced |
| 2 |
0: Read operation
1: Write operation
|
| 3 |
Address that referenced memory (if known) |
| 4 |
Reserved |
If the driver responsible
for the error can be identified, its name is printed on the blue screen
and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
Cause
Bug check 0x50 usually
occurs after the installation of faulty hardware or in the event of
failure of installed hardware (usually related to defective RAM, be it
main memory, L2 RAM cache, or video RAM).
Another common cause is the
installation of a faulty system service.
Antivirus software can also
trigger this error, as can a corrupted NTFS volume.
Resolving the Problem
Resolving a faulty
hardware problem: If hardware has been added to the system
recently, remove it to see if the error recurs. If existing hardware
has failed, remove or replace the faulty component. You should run
hardware diagnostics supplied by the system manufacturer. For details
on these procedures, see the owner's manual for your computer.
Resolving a faulty
system service problem: Disable the service and confirm that
this resolves the error. If so, contact the manufacturer of the system
service about a possible update. If the error occurs during system
startup, restart your computer, and press F8 at the character-mode menu
that displays the operating system choices. At the resulting Windows Advanced
Options menu, choose the Last Known Good
Configuration option. This option is most effective when only
one driver or service is added at a time.
Resolving an
antivirus software problem: Disable the program and confirm
that this resolves the error. If it does, contact the manufacturer of
the program about a possible update.
Resolving a
corrupted NTFS volume problem: Run Chkdsk /f /r
to detect and repair disk errors. You must restart the system before
the disk scan begins on a system partition. If the hard disk is SCSI,
check for problems between the SCSI controller and the disk.
Finally, check the System
Log in Event Viewer for additional error messages that might help
pinpoint the device or driver that is causing the error. Disabling
memory caching of the BIOS might also resolve it.
Comments
Typically, this address is
in freed memory or is simply invalid.
This cannot be protected by
a try - except handler — it can only be protected
by a probe.
WinDbg
Output Example:
PAGE_FAULT_IN_NONPAGED_AREA
(50)
Invalid system memory was referenced. This cannot be
protected by try-except,
it must be protected by a Probe. Typically the address is
just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffe0d408, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 9712ebd2, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000000, (reserved)
Usual causes:
Hardware failure, File system corruption, Security issues
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms841638.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559026(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x51
Knowledge
Base Articles:
KB 321771 You
Receive a
"Stop 0x51 (REGISTRY_ERROR)" Error Message (2000)
KB 810558 "Stop
0x00000051 REGISTRY_ERROR" Error Message When You Back Up the Registry
Hive (2000)
KB 815265 "STOP
0x00000051" or "STOP 0x0000001E" error message when you start
Configuration Manager in Windows 2000 Server
or in Windows XP
KB 834728 You
receive a
"Stop 0x00000051" error message during registry restoration (2000)
KB 838213 List
of base
operating system fixes in Windows XP
Service Pack 2 and Windows XP Tablet
PC Edition 2005
KB 898792 A
fix is available for a registry problem on Dell PowerEdge servers that
have specific nonnative disk controllers and factory installed versions
of Windows Server
2003
KB 907317 You
receive a "Stop 0x00000051 REGISTRY_ERROR" message when a corrupted
user profile is loaded on a computer that is running Windows Server 2003
KB 925844 Error
message
when a Windows Server
2003-based computer is running under high stress: "STOP
0x00000051 REGISTRY_ERROR"
KB 940795 Error
message
after you install Windows Server 2003
Service Pack 1 or Service Pack 2 on a Dell PowerEdge server: "Stop
0x00000051"
WinDbg
Help File Entry:
The REGISTRY_ERROR bug check
has a value of 0x00000051. This indicates that a severe registry error
has occurred.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Reserved |
| 2 |
Reserved |
| 3 |
The pointer to the hive (if available) |
| 4 |
If the hive is corrupt, the return code of HvCheckHive
(if available) |
Cause
Something has gone wrong
with the registry. If a kernel debugger is available, get a stack trace.
This error may indicate that
the registry encountered an I/O error while trying to read one of its
files. This can be caused by hardware problems or file system
corruption.
It may also occur due to a
failure in a refresh operation, which is used only in by the security
system, and then only when resource limits are encountered.
WinDbg
Output Example:
REGISTRY_ERROR (51)
Something has gone badly wrong with the registry. If a kernel
debugger
is available, get a stack trace. It can also indicate that the registry
got
an I/O error while trying to read one of its files, so it can be caused
by
hardware problems or filesystem corruption.
It may occur due to a failure in a refresh operation, which is used only
in by the security system, and then only when resource limits are
encountered.
Arguments:
Arg1: 0000000000000000, (reserved)
Arg2: 0000000000000000, (reserved)
Arg3: 0000000000000000, depends on where Windows bugchecked, may be
pointer to hive
Arg4: 0000000000000000, depends on where Windows bugchecked, may be
return code of
HvCheckHive if the hive is corrupt.
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms841797.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559031(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The MAILSLOT_FILE_SYSTEM bug
check has a value of 0x00000052.
This bug check appears very
infrequently.
WinDbg
Output Example:
MAILSLOT_FILE_SYSTEM (52)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms842023.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559035(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The NO_BOOT_DEVICE bug check
has a value of 0x00000053.
This bug check appears very
infrequently.
WinDbg
Output Example:
NO_BOOT_DEVICE (53)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000054:
LM_SERVER_INTERNAL_ERROR (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms842035.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559040(v=VS.85).aspx
Knowledge
Base Articles:
KB 313169 "Stop
0x00000054" Error Message in Windows 2000
KB 912947 Error
message
when you install a Volume Shadow Copy Service update on a Windows Server 2003
SP1-based computer: "STOP: 0x00000054 (0x00361595, 0xf12db001,
0x00000000, 0x00000000)"
WinDbg
Help File Entry:
The LM_SERVER_INTERNAL_ERROR
bug check has a value of 0x00000054.
This bug check appears very
infrequently.
WinDbg
Output Example:
LM_SERVER_INTERNAL_ERROR
(54)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000055:
DATA_COHERENCY_EXCEPTION (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms842046.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559044(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The DATA_COHERENCY_EXCEPTION
bug check has a value of 0x00000055.
This bug check appears very
infrequently.
WinDbg
Output Example:
DATA_COHERENCY_EXCEPTION
(55)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000056:
INSTRUCTION_COHERENCY_EXCEPTION (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms842057.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559049(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
INSTRUCTION_COHERENCY_EXCEPTION bug check has a value of 0x00000056.
This bug check appears very
infrequently.
WinDbg
Output Example:
INSTRUCTION_COHERENCY_EXCEPTION
(56)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819226.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559054(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The XNS_INTERNAL_ERROR bug
check has a value of 0x00000057.
This bug check appears very
infrequently.
WinDbg
Output Example:
XNS_INTERNAL_ERROR (57)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000058:
FTDISK_INTERNAL_ERROR (go
to top of page)
Usual causes:
Booting system from wrong copy of a mirrored volume
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819227.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559058(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x58
Knowledge
Base Articles:
KB 128630 How
to Recover
From a STOP 0x00000058 FTDISK_INTERNAL_ERROR (NT Server,
2000 Server)
WinDbg
Help File Entry:
The FTDISK_INTERNAL_ERROR
bug check has a value of 0x00000058. This is issued if the system is
booted from the wrong copy of a mirrored partition.
Parameters
None
Cause
The hives are indicating
that the mirror is valid, but it is not. The hives should actually be
pointing to the shadow partition.
This is almost always caused
by the primary partition being revived.
Resolving the Problem
Reboot the system from the
shadow partition.
WinDbg
Output Example:
VOLMGRX_INTERNAL_ERROR (58)
Windows cannot boot from a secondary plex of a mirrored volume when the
mirror
is not up to date. Please boot from the primary plex of the mirrored
volume.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Indexing, Device driver, Insufficient memory
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819229.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559061(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The PINBALL_FILE_SYSTEM bug
check has a value of 0x00000059. This indicates that a problem occurred
in the Pinball file system.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Specifies source file and line number information. The
high 16 bits (the first four hexadecimal digits after the "0x")
identify the source file by its identifier number. The low 16 bits
identify the source line in the file where the bug check occurred. |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
One possible cause of this
bug check is depletion of nonpaged pool memory. If the nonpaged pool
memory is completely depleted, this error can stop the system. However,
during the indexing process, if the amount of available nonpaged pool
memory is very low, another kernel-mode driver requiring nonpaged pool
memory can also trigger this error.
Resolving the Problem
To resolve a
nonpaged pool memory depletion problem: Add new physical
memory to the computer. This will increase the quantity of nonpaged
pool memory available to the kernel.
WinDbg
Output Example:
PINBALL_FILE_SYSTEM (59)
See the comment for FAT_FILE_SYSTEM
(0x23)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000005A:
CRITICAL_SERVICE_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819231.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559064(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x5a
Knowledge
Base Articles:
WinDbg
Help File Entry:
The CRITICAL_SERVICE_FAILED
bug check has a value of 0x0000005A.
This bug check appears very
infrequently.
WinDbg
Output Example:
CRITICAL_SERVICE_FAILED
(5a)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819232.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559066(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The SET_ENV_VAR_FAILED bug
check has a value of 0x0000005B.
This bug check appears very
infrequently.
WinDbg
Output Example:
SET_ENV_VAR_FAILED (5b)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000005C:
HAL_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
System couldn't initialize the HAL - many causes. Hardware,
file system, boot corruption, etc
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819234.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559069(v=VS.85).aspx
Knowledge
Base Articles:
KB 965228 Windows
Server 2008
IA-64 systems cannot start, and Stop error 0x0000005C is generated on a
computer that has many of I/O SAPIC controllers installed
KB 2303458
A fix is available for three
issues in the x2APIC mode in x64-based versions of Windows
Server 2008 R2
KB 2508054
"0x0000005C" Stop
error code or assertion failure in the startup process if you enable
Driver Verifier in Windows Server 2008 R2
KB 2616137
Adding the Hyper-V role in Windows Server
2008 R2 may cause a Stop 0x5C on reboot if x2APIC is enabled
WinDbg
Help File Entry:
The
HAL_INITIALIZATION_FAILED bug check has a value of 0x0000005C.
This indicates that the HAL
initialization failed.
WinDbg
Output Example:
HAL_INITIALIZATION_FAILED
(5c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000005D:
UNSUPPORTED_PROCESSOR (go
to top of page)
Usual causes:
Unsupported processor
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819236.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559072(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The UNSUPPORTED_PROCESSOR
bug check has a value of 0x0000005D. This indicates that the computer
is attempting to run Windows on an unsupported processor.
Parameters
None
Cause
Windows requires a
higher-grade processor than the one you are using.
WinDbg
Output Example:
UNSUPPORTED_PROCESSOR (5d)
386 - System failed because the
processor is only a 386 or
compatible. The system
requires a Pentium (or higher) compatible processor.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000005E:
OBJECT_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms819238.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559078(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
OBJECT_INITIALIZATION_FAILED bug check has a value of 0x0000005E.
This bug check appears very
infrequently.
WinDbg
Output Example:
OBJECT_INITIALIZATION_FAILED
(5e)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000005F:
SECURITY_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819244.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559085(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
SECURITY_INITIALIZATION_FAILED bug check has a value of 0x0000005F.
This bug check appears very
infrequently.
WinDbg
Output Example:
SECURITY_INITIALIZATION_FAILED
(5f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000060:
PROCESS_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819246.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559094(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
PROCESS_INITIALIZATION_FAILED bug check has a value of 0x00000060.
This bug check appears very
infrequently.
WinDbg
Output Example:
PROCESS_INITIALIZATION_FAILED
(60)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000061:
HAL1_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819248.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559097(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
HAL1_INITIALIZATION_FAILED bug check has a value of 0x00000061.
This bug check appears very
infrequently.
WinDbg
Output Example:
HAL1_INITIALIZATION_FAILED
(61)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000062:
OBJECT1_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819250.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559104(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
OBJECT1_INITIALIZATION_FAILED bug check has a value of 0x00000062.
This bug check appears very
infrequently.
WinDbg
Output Example:
OBJECT1_INITIALIZATION_FAILED
(62)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 000000000000000
STOP 0x00000063:
SECURITY1_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819251.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559108(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
SECURITY1_INITIALIZATION_FAILED bug check has a value of 0x00000063.
This bug check appears very
infrequently.
WinDbg
Output Example:
SECURITY1_INITIALIZATION_FAILED
(63)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000064:
SYMBOLIC_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819254.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559117(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
SYMBOLIC_INITIALIZATION_FAILED bug check has a value of 0x00000064.
This bug check appears very
infrequently.
WinDbg
Output Example:
SYMBOLIC_INITIALIZATION_FAILED
(64)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000065:
MEMORY1_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819258.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559120(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
MEMORY1_INITIALIZATION_FAILED bug check has a value of 0x00000065.
This bug check appears very
infrequently.
WinDbg
Output Example:
MEMORY1_INITIALIZATION_FAILED
(65)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000066:
CACHE_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819262.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559123(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
CACHE_INITIALIZATION_FAILED bug check has a value of 0x00000066.
This bug check appears very
infrequently.
WinDbg
Output Example:
CACHE_INITIALIZATION_FAILED
(66)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000067:
CONFIG_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
Shouldn't happen :0) - Insufficient paged pool early in the boot
sequence prevents registry from loading, could also be (IMO) a problem
with the registry being too large for the system memory (but very
unlikely)
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819267.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559126(v=VS.85).aspx
Knowledge
Base Articles:
KB 317053 "STOP
0x00000067" Error Message When You Attempt to Start Windows (NT, 2000)
WinDbg
Help File Entry:
The
CONFIG_INITIALIZATION_FAILED bug check has a value of 0x00000067. This
bug check indicates that the registry configuration failed.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
Reserved |
| 2 |
The location selector |
| 3 |
The NT status code |
| 4 |
Reserved |
Cause
The registry could not
allocate the pool that it needed to contain the registry files. This
situation should never occur, because the register allocates this pool
early enough in system initialization so that plenty of paged pool
should be available.
WinDbg
Output Example:
CONFIG_INITIALIZATION_FAILED
(67)
This means the registry couldn't allocate the pool needed to contain the
registry files. This should never happen, since it is early
enough in
system initialization that there is always plenty of paged pool
available.
Arguments:
Arg1: 0000000000000000, (reserved)
Arg2: 0000000000000000, location selector
Arg3: 0000000000000000, NT status code
Arg4: 0000000000000000
STOP 0x00000068:
FILE_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819268.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559132(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
FILE_INITIALIZATION_FAILED bug check has a value of 0x00000068.
This bug check appears very
infrequently.
WinDbg
Output Example:
FILE_INITIALIZATION_FAILED
(68)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000069:
IO1_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
Improper setup, Improper configuration after setup
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819274.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559133(v=VS.85).aspx
Knowledge
Base Articles:
KB 826727 Computer
Stops
Responding, and You Receive a "Stop 0x00000069" Error Message (2000 Server,
Server 2003)
WinDbg
Help File Entry:
The
IO1_INITIALIZATION_FAILED bug check has a value of 0x00000069. This bug
check indicates that the initialization of the I/O system failed for
some reason.
Parameters
None
Cause
There is very little
information available to analyze this error.
Most likely, the setup
routine has improperly installed the system, or a user has reconfigured
the system.
WinDbg
Output Example:
IO1_INITIALIZATION_FAILED
(69)
Initialization of the I/O system failed for some reason.
There is
very little information available. In general, setup really
made
some bad decisions about the installation of the system, or the user has
reconfigured the system.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000006A:
LPC_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819277.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559137(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
LPC_INITIALIZATION_FAILED bug check has a value of 0x0000006A.
This bug check appears very
infrequently.
WinDbg
Output Example:
LPC_INITIALIZATION_FAILED
(6a)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000006B:
PROCESS1_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
Hard drive, Cables, Missing boot files, Disabled driver
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819280.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559142(v=VS.85).aspx
Knowledge
Base Articles:
KB 307012 "Stop
0x0000006B" After Installing a Windows 2000
Service Pack
KB 311562 "An
Unexpected
Error (768) Occurred at Line 5118@ind:Xp\Client\Boot\Setup\Setup.c"
Error Message During Windows XP
Setup
KB 319026 Random
Pool
Corruption Is Caused by Rdbss.sys (2000)
KB 327536 "Stop
0x0000006b" or Setup stops responding at "Setup is starting Windows"
when you install a Windows XP SP1
client image from a Windows
2000-based RIS server
KB 330134 STOP:
0x0000006B "Process1_ Initialization_Failed" error message when you try
to upgrade to Windows XP
KB 967551 Rollup update
for the volsnap.sys driver in Windows Server 2003
KB 981833 "STOP: 0x0000006B" Stop
error message during startup on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2746140
You receive "0x0000006B" and
"0XC000021A" Stop error message after uninstalling McAfee Agent 4.6.2 in Windows
Vista,
Windows 7, Windows
Server 2008 or Windows
Server 2008 R2
WinDbg
Help File Entry:
The
PROCESS1_INITIALIZATION_FAILED bug check has a value of 0x0000006B.
This bug check indicates that the initialization of the Microsoft
Windows operating system failed.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The NT status code that caused the failure |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
Any part of the disk
subsystem can cause the PROCESS1_INITIALIZATION_FAILED bug check,
including bad disks, bad or incorrect cables, mixing different ATA-type
devices on the same chain, or drives that are not available becuase of
hardware regeneration.
This bug check can also be
caused by a missing file from the boot partition or by a driver file
that a user accidentally disabled in the Drivers
tab.
WinDbg
Output Example:
PROCESS1_INITIALIZATION_FAILED
(6b)
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that caused the
failure.
Arg2: 0000000000000000, (reserved)
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000006C:
REFMON_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819283.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559147(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
REFMON_INITIALIZATION_FAILED bug check has a value of 0x0000006C.
This bug check appears very
infrequently.
WinDbg
Output Example:
REFMON_INITIALIZATION_FAILED
(6c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000006D:
SESSION1_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
See ntstatus.h in the SDK to look up the value of parameter 1
(ntstatus.h also located at this link: ntstatus.html
)
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819286.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559152(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
SESSION1_INITIALIZATION_FAILED bug check has a value of 0x0000006D.
This bug check indicates that the initialization of the Microsoft
Windows operating system failed.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The NT status code that caused the initialization
failure |
| 2 |
0 |
| 3 |
0 |
| 4 |
0 |
WinDbg
Output Example:
SESSION1_INITIALIZATION_FAILED
(6d)
1 - Indicates the NT status code that
caused the failure.
DESCRIPTION
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000006E:
SESSION2_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
See ntstatus.h in the SDK to look up the value of parameter 1
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819287.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559154(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
SESSION2_INITIALIZATION_FAILED bug check has a value of 0x0000006E.
This bug check indicates that the initialization of the Microsoft
Windows operating system failed.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The NT status code that caused the Windows operating
system to conclude that initialization failed |
| 2 |
0 |
| 3 |
0 |
| 4 |
0 |
WinDbg
Output Example:
SESSION2_INITIALIZATION_FAILED
(6e)
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that tripped
Windows into thinking
that initialization failed.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000006F:
SESSION3_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
See ntstatus.h in the SDK to look up the value of parameter 1
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819290.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559156(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x6f
Knowledge
Base Articles:
KB 153742 STOP
0x0000006F During System Initialization (NT, 2000)
KB 236086 System or
Boot Disk Listed as Dynamic Unreadable in Disk Management (2000)
KB 939008 Error
message when you start a Windows Vista-based
computer on which Windows
ReadyBoost is running: "STOP: 0x0000006F SESSION3 INITIALIZATION FAILED"
WinDbg
Help File Entry:
The
SESSION3_INITIALIZATION_FAILED bug check has a value of 0x0000006F.
This bug check indicates that the initialization of the Microsoft
Windows operating system initialization.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The NT status code that caused the Windows operating
system to conclude that initialization failed |
| 2 |
0 |
| 3 |
0 |
| 4 |
0 |
WinDbg
Output Example:
SESSION3_INITIALIZATION_FAILED
(6f)
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that tripped
Windows into thinking
that initialization failed.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000070:
SESSION4_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
See ntstatus.h in the SDK to look up the value of parameter 1
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819291.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559167(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
SESSION4_INITIALIZATION_FAILED bug check has a value of 0x00000070.
This bug check indicates that the initialization of the Microsoft
Windows operating system failed.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The NT status code that caused the Windows operating
system to conclude that initialization failed |
| 2 |
0 |
| 3 |
0 |
| 4 |
0 |
WinDbg
Output Example:
SESSION4_INITIALIZATION_FAILED
(70)
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that tripped
Windows into thinking
that initialization failed.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000071:
SESSION5_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
See ntstatus.h in the SDK to look up the value of parameter 1
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819294.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559171(v=VS.85).aspx
Knowledge
Base Articles:
KB 887359 You
receive a "STOP 0x00000071" error message after you install the 811493
(MS03-013) security update on your Windows 2000
Professional-based
computer
WinDbg
Help File Entry:
The
SESSION5_INITIALIZATION_FAILED bug check has a value of 0x00000071.
This bug check indicates that the initialization of the Microsoft
Windows operating system failed.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The NT status code that caused the Windows operating
system to conclude that initialization failed |
| 2 |
0 |
| 3 |
0 |
| 4 |
0 |
WinDbg
Output Example:
SESSION5_INITIALIZATION_FAILED
(71)
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that tripped
Windows into thinking
that initialization failed.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000072:
ASSIGN_DRIVE_LETTERS_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819296.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559178(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
ASSIGN_DRIVE_LETTERS_FAILED bug check has a value of 0x00000072.
This bug check appears very
infrequently.
WinDbg
Output Example:
ASSIGN_DRIVE_LETTERS_FAILED
(72)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Disk issues, File system issues, Low disk space, Low memory available
for pool allocation
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819301.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559183(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The CONFIG_LIST_FAILED bug
check has a value of 0x00000073. This bug check indicates that one of
the top-level registry keys, also known as core system hives, cannot be
linked in the registry tree.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
1 |
| 2 |
The NT status code that led the Windows operating
system to assume that it failed to load the hive |
| 3 |
The index of the hive in the hive list |
| 4 |
A pointer to a UNICODE_STRING structure that contains
the file name of the hive |
Cause
The registry hive that
cannot be linked might be SAM, SECURITY, SOFTWARE, or DEFAULT. The hive
is valid, because it was loaded successfully.
Examine Parameter 2
to see why the hive could not be linked in the registry tree. One
common cause of this error is that the Windows operating system is out
of disk space on the system drive. (In this situation, this parameter
is 0xC000017D, STATUS_NO_LOG_SPACE.) Another common problem is that an
attempt to allocate pool has failed. (In this situation, Parameter 2 is
0xC000009A, STATUS_INSUFFICIENT_RESOURCES.) You must investigate other
status codes.
WinDbg
Output Example:
CONFIG_LIST_FAILED (73)
Indicates that one of the core system hives cannot be linked in the
registry tree. The hive is valid, it was loaded OK. Examine the 2nd
bugcheck argument to see why the hive could not be linked in the
registry tree.
This can be either SAM, SECURITY, SOFTWARE or DEFAULT. One common reason
for this to happen is if you are out of disk space on the system drive
(in which case param 2 is 0xC000017D - STATUS_NO_LOG_SPACE) or an
attempt
to allocate pool has failed (in which case param 2 is 0xC000009A -
STATUS_INSUFFICIENT_RESOURCES). Other status codes must be individually
investigated.
Arguments:
Arg1: 0000000000000000, 1
Arg2: 0000000000000000, Indicates the NT status code that tripped
Windows into
thinking that it had failed to load the
hive.
Arg3: 0000000000000000, Index of hive in hivelist
Arg4: 0000000000000000, Pointer to UNICODE_STRING containing filename
of hive
STOP 0x00000074:
BAD_SYSTEM_CONFIG_INFO (go
to top of page)
Usual causes:
System hive corruption, Missing registry keys/values, bad memory
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819304.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559188(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x74
Knowledge
Base Articles:
KB 283433 Cannot
Start
Windows XP
After You Install Windows 2000
KB 326679 "STOP
0x00000074 BAD_SYSTEM_CONFIG_INFO" Error Message When You Start Your
Computer (XP)
WinDbg
Help File Entry:
The BAD_SYSTEM_CONFIG_INFO
bug check has a value of 0x00000074. This bug check indicates that
there is an error in the registry.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
Reserved |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
The NT status code (if it is available) |
Cause
The BAD_SYSTEM_CONFIG_INFO
bug check occurs if the SYSTEM hive is corrupt. However, this
corruption is unlikely, because the boot loader, known as NT Loader
(NTLDR) in versions of Windows prior to Vista, checks a hive for
corruption when it loads the hive.
This bug check can also
occur if some critical registry keys and values are missing. These keys
and values might be missing if a user manually edited the registry.
Resolving
the Problem
Try restarting the computer
by selecting "last known good configuration" in the boot options.
If the restart does not fix
the problem, the registry damage is too extensive. You must reinstall
the OS or use the Emergency Repair Disk (ERD) that you previously
created by using the Windows Backup tool.
WinDbg
Output Example:
BAD_SYSTEM_CONFIG_INFO (74)
Can indicate that the SYSTEM hive loaded by the osloader/NTLDR
was corrupt. This is unlikely, since the osloader will check
a hive to make sure it isn't corrupt after loading it.
It can also indicate that some critical registry keys and values
are not present. (i.e. somebody used regedt32 to delete
something
that they shouldn't have) Booting from LastKnownGood may fix
the problem, but if someone is persistent enough in mucking with
the registry they will need to reinstall or use the Emergency
Repair Disk.
Arguments:
Arg1: 0000000000000000, (reserved)
Arg2: 0000000000000000, (reserved)
Arg3: 0000000000000000, (reserved)
Arg4: 0000000000000000, usually the NT status code.
STOP 0x00000075:
CANNOT_WRITE_CONFIGURATION (go
to top of page)
Usual causes:
Shouldn't happen :0) - Insufficient paged pool early in the boot
sequence prevents registry from loading, could also be (IMO) a problem
with the registry being too large for the system memory (but very
unlikely)
MSDN Listing
(Win2K ResKit): http://msdn.microsoft.com/en-us/library/ms819308.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559192(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
CANNOT_WRITE_CONFIGURATION bug check has a value of 0x00000075. This
bug check indicates that the SYSTEM registry hive file cannot be
converted to a mapped file.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
1 |
| 2 |
The NT status code that led the Windows operating
system to assume that it had failed to convert the hive |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
The
CANNOT_WRITE_CONFIGURATION bug check typically occurs if the system is
out of pool and the Windows operating system cannot reopen the hive.
This bug check should almost
never occur, because the conversion of the hive file occurs early
enough during system initialization so that enough pool should be
available.
WinDbg
Output Example:
CANNOT_WRITE_CONFIGURATION
(75)
This will result if the SYSTEM hive file cannot be converted to a
mapped file. This usually happens if the system is out of pool and
we cannot reopen the hive.
Normally you shouldn't see this as the conversion happens at early
during system initialization, so enough pool should be available.
Arguments:
Arg1: 0000000000000000, 1
Arg2: 0000000000000000, Indicates the NT status code that tripped
Windows into
thinking that it had failed to convert
the hive.
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000076:
PROCESS_HAS_LOCKED_PAGES (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819309.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559194(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x76
Knowledge
Base Articles:
KB 256010 "STOP
0x00000076 - PROCESS_HAS_LOCKED_PAGES" error message in Windows 2000,
Windows XP
Professional, and Windows Server 2003,
Standard Edition
KB 825760 You
Receive
Stop Error 0x00000076 or 0x000000CB When You Quit Your Backup Software (2000, XP)
KB 825820 "0x00000076"
or "0x000000CB" Stop Error Occurs When Windows 2000 Server
Tries to Run a Process on a Remote Server
KB 895473 The
computer
restarts, you receive an error message, or an event is logged in the
System log on a Windows Server
2003-based
computer that is running in PAE mode and that has a Sybase database
installed
KB 951033 Stop
error
message on a Windows Server
2003-based computer that has Citrix Presentation Server
4.5 installed: "0x00000076" or "0x000000CB"
KB 979742 "0x000000CB" Stop error
or "0x00000076" Stop error in Windows Vista or in Windows Server 2008 when you
access shared network resources by using SMB version 1 protocol on the
computer
WinDbg
Help File Entry:
The PROCESS_HAS_LOCKED_PAGES
bug check has a value of 0x00000076. This bug check indicates that a
driver failed to release locked pages after an I/O operation.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
0 |
| 2 |
The process address. |
| 3 |
The number of locked pages. |
| 4 |
A pointer to driver stacks (if they are enabled).
Otherwise, this parameter is 0. |
Cause
A driver failed to release pages that it locked.
Resolving the Problem
First, use the !search
extension on the current process pointer throughout all of physical
memory. This extension might find at least one memory descriptor list
(MDL) that points to the current process. Next, use !search
on each MDL that you find to obtain the I/O request packet (IRP) that
points to the current process. From this IRP, you can identify which
driver is leaking the pages.
Otherwise, you can detect
which driver caused the error by editing the registry:
- In the \\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
registry key, create or edit the TrackLockedPages
value, and then set it equal to DWORD 1.
- Restart the computer.
The system then saves stack
traces, so you can easily identify the driver that caused the problem.
If the driver causes the same error again, bug
check 0xCB (DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS) is issued,
and the name of the driver that causes this error is displayed.
WinDbg
Output Example:
PROCESS_HAS_LOCKED_PAGES
(76)
Caused by a driver not cleaning up correctly after an I/O.
Arguments:
Arg1: 0000000000000000, Locked memory pages found in process being
terminated.
Arg2: 0000000000000000, Process address.
Arg3: 0000000000000000, Humber of locked pages.
Arg4: 0000000000000000, Pointer to driver stacks (if enabled) or 0 if
not.
Issue a !search over all of physical
memory for the current process pointer.
This will yield at least one MDL which
points to it. Then do another !search
for each MDL found, this will yield the
IRP(s) that point to it, revealing
which driver is leaking the pages.
Otherwise, set
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\TrackLockedPages to a DWORD 1
value and reboot. Then the system
will save stack traces so the guilty
driver can be easily identified.
When you enable this flag, if the driver
commits the error again you will
see a different bugcheck -
DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (0xCB) -
which can identify the offending
driver(s).
STOP 0x00000077:
KERNEL_STACK_INPAGE_ERROR (go
to top of page)
Usual causes:
Memory, Corrupt paging file, File system errors, Disk errors, Bad
cables, BIOS, Missing Service Pack, Bad motherboard, Virus infection
(particulary in the MBR), Improperly seated cards
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819312.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559197(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x77
Knowledge
Base Articles:
KB 228753 Troubleshooting
"Stop 0x00000077" or "KERNEL_STACK_INPAGE_ERROR" (NT, 2000)
KB 315266 You
receive an
error message on a Windows XP-based
computer: "Stop 0x00000077" or "KERNEL_STACK_INPAGE_ERROR"
KB 950415 Error
message on a computer that is running the Windows operating system:
"Stop 0x00000077 KERNEL_STACK_INPAGE_ERROR" (2000, XP, Server 2003)
KB 954429 You
experience problems on a multiprocessor computer that is running
Windows Server
2003, Windows Vista,
or Windows Server
2008 when you
resume the computer from hibernation
KB 956871 The system
may crash when you put a Windows Vista-based
computer or a Windows Server
2008-based computer into hibernation
KB 967352 Stop
error
message when you put a computer that is running Windows Vista
or Windows Server
2008 into hibernation: "STOP 0x000000A0," "STOP
0x0000007a," or "STOP 0x00000077"
KB 977178 You receive various Stop
error messages in Windows
7 or in Windows Server 2008 R2 when you
resume a computer that has a large SATA hard disk
KB 2498326
Stop Error on Windows Server 2008 R2
During Upgrade of FCoE Adapter Driver
WinDbg
Help File Entry:
The
KERNEL_STACK_INPAGE_ERROR bug check has a value of 0x00000077. This bug
check indicates that the requested page of kernel data from the paging
file could not be read into memory.
Parameters
The four parameters that
listed in the message have two possible meanings.
If the first parameter is 0,
1, or 2, the parameters have the following meaning.
| Parameter |
Description |
| 1 |
0: The page of kernel data was
retrieved from page cache.
1: The page was retrieved from a disk.
2: The page was retrieved from a disk, the
storage stack returned SUCCESS, but Status.Information
is not equal to PAGE_SIZE.
|
| 2 |
The value that appears in the stack where the signature
should be. |
| 3 |
0 |
| 4 |
The address of the signature on the kernel stack |
If the first parameter is
any value other than 0, 1, or 2, the parameters have the following
meaning.
| Parameter |
Description |
| 1 |
The status code |
| 2 |
The I/O status code |
| 3 |
The page file number |
| 4 |
The offset into page file |
Cause
If the first parameter is 0
or 1, the stack signature in the kernel stack was not found. This error
is probably caused by defective hardware, such as a RAM error.
If the first parameter is 2,
the driver stack returned an inconsistent status for the read of the
page. For example, the driver stack returned a success status even
though it did not read the whole page.
If the first parameter is
any value other than 0, 1, or 2, the value of the first parameter is an
NTSTATUS error code that the driver stack returns after it tries to
retrieve the page of kernel data. You can determine the exact cause of
this error from the I/O status code (the second parameter). Some common
status codes include the following:
- 0xC000009A, or STATUS_INSUFFICIENT_RESOURCES, indicates a
lack of nonpaged pool resources. This status code indicates a driver
error in the storage stack. (The storage stack should always be able to
retrieve this data, regardless of software resource availability.)
- 0xC000009C, or STATUS_DEVICE_DATA_ERROR, indicates bad
blocks (sectors) on the hard disk.
- 0xC000009D, or STATUS_DEVICE_NOT_CONNECTED, indicates
defective or loose cabling, termination, or that the controller does
not see the hard disk drive.
- 0xC000016A, or STATUS_DISK_OPERATION_FAILED, indicates bad
blocks (sectors) on the hard disk.
- 0xC0000185, or STATUS_IO_DEVICE_ERROR, indicates improper
termination or defective cabling on SCSI devices or that two devices
are trying to use the same IRQ.
These status codes are the
most common ones that have specific causes. For more information about
other possible status codes that might be returned, see the Ntstatus.h
file in the Microsoft Windows Driver Kit (WDK).
A virus infection can also
cause this bug check.
Resolving the Problem
Resolving a bad
block problem: If you can restart the computer after the
error, Autochk runs automatically and attempts to map the bad sector to
prevent it from being used anymore.
If Autochk does not scan the
hard disk for errors, you can manually start the disk scanner. Run Chkdsk
/f /r on the system partition. You must restart the computer
before the disk scan begins. If you cannot start the system because the
error, use the Recovery Console and run Chkdsk /r.
Warning If
your system partition is formatted with the FAT file system, the long
file names that the Windows operating system uses might be damaged if
you use Scandisk or another MS-DOS-based hard disk tool to verify the
integrity of your hard disk drive from MS-DOS. Always use the version
of Chkdsk that matches your version of the Windows operating system.
Resolving a
defective hardware problem: If the I/O status is 0xC0000185
and the paging file is on an SCSI disk, check the disk cabling and SCSI
termination for problems.
Resolving a failing
RAM problem: Run the hardware diagnostics that the system
manufacturer supplies, especially the memory scanner. For more
information about these procedures, see the owner's manual for your
computer.
Check that all the adapter
cards in the computer are properly seated. Use an ink eraser or an
electrical contact treatment, available at electronics supply stores,
to ensure adapter card contacts are clean.
Check the System Log in
Event Viewer for additional error messages that might help identify the
device that is causing the error. You can also disable memory caching
of the BIOS to try to resolve this error.
Make sure that the latest
Windows Service Pack is installed.
If the preceding steps fail
to resolve the error, take the system motherboard to a repair facility
for diagnostic testing. A crack, a scratched trace, or a defective
component on the motherboard can cause this error.
Resolving a virus
infection: Check your computer for viruses by using any
up-to-date, commercial virus scanning software that examines the Master
Boot Record of the hard disk. All Windows file systems can be infected
by viruses.
See Also
Bug
Check 0x7A (KERNEL_DATA_INPAGE_ERROR)
WinDbg
Output Example:
KERNEL_STACK_INPAGE_ERROR
(77)
The requested page of kernel data could not be read in.
Caused by
bad block in paging file or disk controller error.
In the case when the first arguments is 0 or 1, the stack signature
in the kernel stack was not found. Again, bad hardware.
An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or
C000016AL (STATUS_DISK_OPERATION_FAILED) normally indicates
the data could not be read from the disk due to a bad
block. Upon reboot autocheck will run and attempt to map out
the bad
sector. If the status is C0000185 (STATUS_IO_DEVICE_ERROR)
and the paging
file is on a SCSI disk device, then the cabling and termination should
be
checked. See the knowledge base article on SCSI termination.
Arguments:
Arg1: c0000056, status code
Arg2: c0000056, i/o status code
Arg3: 00000000, page file number
Arg4: 126fb000, offset into page file
KERNEL_STACK_INPAGE_ERROR (77)
The requested page of kernel data could not be read in.
Caused by
bad block in paging file or disk controller error.
In the case when the first arguments is 0 or 1, the stack signature
in the kernel stack was not found. Again, bad hardware.
An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or
C000016AL (STATUS_DISK_OPERATION_FAILED) normally indicates
the data could not be read from the disk due to a bad
block. Upon reboot autocheck will run and attempt to map out
the bad
sector. If the status is C0000185 (STATUS_IO_DEVICE_ERROR)
and the paging
file is on a SCSI disk device, then the cabling and termination should
be
checked. See the knowledge base article on SCSI termination.
Arguments:
Arg1: 0000000000000000, (page was retrieved from page cache)
Arg2: 0000000000000000, value found in stack where signature should be
Arg3: 0000000000000000, 0
Arg4: 0000000000000000, address of signature on kernel stack
Usual causes:
Break set in boot sequence without a debugger being enabled
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819314.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559206(v=VS.85).aspx
Knowledge
Base Articles:
KB 184758 STOP
0x78 When
NonPagedPoolSize > Seven-eighths of Physical Memory (NT)
KB 980358
Stop error when you startup Windows
Preinstallation Environment (PE) on a computer that has the
Pentium 233 MHz MMX process installed: "STOP 0x00000078"
WinDbg
Help File Entry:
The PHASE0_EXCEPTION bug
check has a value of 0x00000078.
This bug check occurs when
an unexpected break is encountered during HAL initialization. This
break can occur if you have set the /break
parameter in your boot settings but have not enabled kernel debugging.
WinDbg
Output Example:
PHASE0_EXCEPTION (78)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
HAL doesn't match ntoskrnl.exe (or Ntkrnlmp.exe)
and/or the system
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819317.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559209(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x79
Knowledge
Base Articles:
KB 329972 "STOP
0x00000079 mismatched_hal" error message occurs after you install
Windows XP
on a Windows Server
2003-based computer
KB 833143 You
receive a
"0x00000079 (0x00000004, 0x0000AC31, 0x00000000, 0x00000000)" stop
error message when you start a Windows XP-based
or a Windows 2000-based
guest PC in Virtual
PC 2004
KB 841384 STOP
0x00000079" error message appears on a Windows NT
4.0-based computer
WinDbg
Help File Entry:
The MISMATCHED_HAL bug check
has a value of 0x00000079. This bug check indicates that the Hardware
Abstraction Layer (HAL) revision level or configuration does not match
that of the kernel or the computer.
Parameters
The following parameters
appear on the blue screen. Parameter 1 indicates the type of
mismatch.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause. |
| 0x1 |
The major processor control block (PRCB) level of Ntoskrnl.exe. |
The major PRCB level of Hal.dll. |
Reserved |
The PRCB release levels are mismatched. (Something is
out of date.) |
| 0x2 |
The build type of Ntoskrnl.exe. |
The build type of Hal.dll. |
Reserved |
The build types are mismatched. |
| 0x3 |
The size of the loader parameter extension. |
The major version of the loader parameter extension. |
The minor version of the loader parameter extension. |
The loader (ntldr) and HAL versions
are mismatched. |
When Parameter 1
equals 0x2, the following build type codes are used:
- 0: Multiprocessor-enabled free build
- 1: Multiprocessor-enabled checked build
- 2: Single-processor free build
- 3: Single-processor checked build
Cause
The MISMATCHED_HAL bug check
often occurs when a user manually updates Ntoskrnl.exe or
Hal.dll.
The error can also indicate
that one of those two files is out of date. For example, the HAL might
be designed for Microsoft Windows 2000 and the kernel is
designed for Windows XP. Or the computer might erroneously
have a multiprocessor HAL and a single-processor kernel installed, or
vice versa.
The Ntoskrnl.exe
kernel file is for single-processor systems and Ntkrnlmp.exe is
for multiprocessor systems. However, these file names correspond to the
files on the installation media.After you have installed the Windows
operating system, the file is renamed to Ntoskrnl.exe,
regardless of the source file that is used. The HAL file also uses the
name Hal.dll after installation, but there are
several possible HAL files on the installation media. For more
information, see "Installing the Checked Build" in the Windows Driver
Kit (WDK).
Resolving the Problem
Restart the computer by
using the product CD or the Windows Setup disks. At the Welcome screen,
press F10 to start the Recovery Console. Use the Copy
command to copy the correct HAL or kernel file from the original CD
into the appropriate folder on the hard disk. The Copy
command detects whether the file that you are copying is in the
Microsoft compressed file format. If so, it automatically expands the
file that is copied on the target drive.
WinDbg
Output Example:
MISMATCHED_HAL (79)
The HAL revision level and HAL configuration type does not match that
of the kernel or the machine type. This would probably happen
if the
user has manually updated either ntoskrnl.exe or hal.dll and managed to
get a conflict.
You have an MP (multi-processor) Hal and a UP (uni-processor) Kernel,
or the reverse.
Arguments:
Arg1: 0000000000000000, type of mismatch
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000007A:
KERNEL_DATA_INPAGE_ERROR (go
to top of page)
Usual causes:
Memory, Paging file corruption, File system, Hard drive, Cabling, Virus
infection, Improperly seated cards, BIOS, Bad motherboard, Missing
Service Pack
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819320.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559211(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x7a
OSROnline Listing: http://www.osronline.com/article.cfm?article=336
Knowledge
Base Articles:
KB 250975 STOP
Errors
When Running MITAC 6133 Laptop on Battery Power (2000)
KB 275149 Error
Message
"Stop 0x0000007A" Occurs During Setup on an ATA66-based Computer (2000)
KB 293857 "Stop
0x0000007" Error Message Because of a Memory Leak in the Daprotim.sys
File (2000)
KB 327020 Error
Message
Occurs When You Start Disk Management After Extending a Hardware Array (2000)
KB 330100 Connecting
a
hard disk drive in slave only mode leads to system halt during resume
from standby (XP,
Server 2003)
KB 913379 BIOS
manufacturers should not clear the IDE Decode Enable bit in the _STM
ACPI method (2000,
XP,
Server 2003,
Vista)
KB 954429 You
experience problems on a multiprocessor computer that is running
Windows Server
2003, Windows Vista,
or Windows Server
2008 when you
resume the computer from hibernation
KB 956871 The system
may crash when you put a Windows Vista-based
computer or a Windows Server
2008-based computer into hibernation
KB 967352 Stop
error
message
when you put a computer that is running Windows Vista
or Windows Server
2008 into hibernation: "STOP 0x000000A0," "STOP
0x0000007a," or "STOP
0x00000077"
KB 977178 You receive various Stop
error messages in Windows
7 or in Windows Server 2008 R2 when you
resume a computer that has a large SATA hard disk
KB 2494016 Stop error 0x0000007a
occurs on a virtual machine that is running on a Windows Server 2008 R2-based
failover cluster with a cluster shared volume, and the state of the CSV
is switched to redirected access
KB 2498326
Stop Error on Windows Server 2008 R2
During Upgrade of FCoE Adapter Driver
KB 2848061
0x0000007a Stop error when you resume a Windows 8-based
computer from Hibernate mode
WinDbg
Help File Entry:
The KERNEL_DATA_INPAGE_ERROR
bug check has a value of 0x0000007A. This bug check indicates that the
requested page of kernel data from the paging file could not be read
into memory.
Parameters
The four parameters that are
listed in the message can have three possible meanings. If the first
parameter is 1 or 2, or 3 and the third parameter is 0, the parameters
have the following definitions.
| Parameter |
Description |
| 1 |
The lock type that was held (1, 2, or 3) |
| 2 |
The error status (usually an I/O status code) |
| 3 |
If Lock Type is 1: the current
process
If Lock Type is 2 or 3: 0
|
| 4 |
The virtual address that could not be paged into memory |
If the first parameter is 3
(and the third parameter is nonzero) or 4, the parameters have the
following definitions.
| Parameter |
Description |
| 1 |
The lock type that was held (3 or 4) |
| 2 |
The error status (typically an I/O status code) |
| 3 |
The address of the InPageSupport structure |
| 4 |
The faulting address |
Otherwise, the parameters
have the following definitions.
| Parameter |
Description |
| 1 |
The address of the page table entry (PTE) |
| 2 |
The error status (usually an I/O status code) |
| 3 |
The PTE contents |
| 4 |
The faulting address |
Cause
Frequently, you can
determine the cause of the KERNEL_DATA_INPAGE_ERROR bug check from the
error status (Parameter 2). Some common status codes include
the following:
- 0xC000009A, or STATUS_INSUFFICIENT_RESOURCES, indicates a
lack of nonpaged pool resources.
- 0xC000009C, or STATUS_DEVICE_DATA_ERROR, typically
indicates bad blocks (sectors) on the hard disk.
- 0xC000009D, or STATUS_DEVICE_NOT_CONNECTED, indicates
defective or loose cabling, termination, or that the controller does
not see the hard disk.
- 0xC000016A, or STATUS_DISK_OPERATION_FAILED, indicates bad
blocks (sectors) on the hard disk.
- 0xC0000185, or STATUS_IO_DEVICE_ERROR, indicates improper
termination or defective cabling on SCSI devices or that two devices
are trying to use the same IRQ.
These status codes are the
most common ones that have specific causes. For more information about
other possible status codes that can be returned, see the Ntstatus.h
file in the Microsoft Windows Driver Kit (WDK).
Another common cause of this
error message is defective hardware or failing RAM.
A virus infection can also
cause this bug check.
Resolving the Problem
Resolving a bad
block problem: An I/O status code of 0xC000009C or 0xC000016A
typically indicates that the data could not be read from the disk
because of a bad block (sector). If you can restart the computer after
the error, Autochk runs automatically and attempts to map the bad
sector to prevent it from being used anymore.
If Autochk does not scan the
hard disk for errors, you can manually start the disk scanner. Run Chkdsk
/f /r on the system partition. You must restart the computer
before the disk scan begins. If you cannot start the computer because
of the error, use the Recovery Console and run Chkdsk /r.
Warning If
your system partition is formatted with the FAT file system, the long
file names that the Windows operating system uses might be damaged if
you use Scandisk or another MS-DOS-based hard disk tool to verify the
integrity of your hard disk from MS-DOS. Always use the version of
Chkdsk that matches your version of Windows.
Resolving a
defective hardware problem: If the I/O status is C0000185 and
the paging file is on an SCSI disk, check the disk cabling and SCSI
termination for problems.
Resolving a failing
RAM problem: Run the hardware diagnostics that the system
manufacturer supplies, especially the memory scanner. For more
information about these procedures, see the owner's manual for your
computer.
Check that all the adapter
cards in the computer are properly seated. Use an ink eraser or an
electrical contact treatment, available at electronics supply stores,
to ensure adapter card contacts are clean.
Check the System Log in
Event Viewer for additional error messages that might help identify the
device that is causing the error. You can also disable memory caching
of the BIOS to try to resolve this error.
Make sure that the latest
Windows Service Pack is installed.
If the preceding steps do
not resolve the error, take the system motherboard to a repair facility
for diagnostic testing. A crack, a scratched trace, or a defective
component on the motherboard can cause this error.
Resolving a virus
infection: Check your computer for viruses by using any
up-to-date, commercial virus scanning software that examines the Master
Boot Record of the hard disk. All Windows file systems can be infected
by viruses.
See Also
Bug
Check 0x77 (KERNEL_STACK_INPAGE_ERROR)
WinDbg
Output Example:
KERNEL_DATA_INPAGE_ERROR
(7a)
The requested page of kernel data could not be read in.
Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed
because
a filesystem failed to make forward progress.
Arguments:
Arg1: 8dd047f8, lock type that was held (value 1,2,3, or PTE address)
Arg2: c0000056, error status (normally i/o status code)
Arg3: 2d113864, current process (virtual address for lock type 3, or
PTE)
Arg4: 902f90ba, virtual address that could not be in-paged (or PTE
contents if arg1 is a PTE address)
STOP 0x0000007B:
INACCESSIBLE_BOOT_DEVICE (go
to top of page)
Usual causes:
Hard drive, File system, Boot sequence errors, Device driver, Virus
infection (in particular check the MBR)
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819323.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559218(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x7b
Knowledge
Base Articles:
KB 303786
Missing [SysprepMassStorage] section causes a "Stop error code
0x0000007B (INACCESSABLE_BOOT_DEVICE)" error message on Windows
XP Sysprep images
KB 311724 Error
messages
when you try to gain access to an NTFS volume (2000 Server)
KB 314082 You
receive a
Stop 0x0000007B error after you move the Windows XP
system disk to another computer
KB 316401 "STOP
0x0000007B" error message when you restart your Windows XP-based
computer
KB 324103 Advanced
troubleshooting for "Stop 0x0000007B" errors in Windows XP
KB 822051 How
to
troubleshoot "Stop 0x0000007B" error messages that occur when you run
Windows 2000
Setup
KB 822052 How
to
troubleshoot "Stop 0x0000007B" error messages in Windows 2000
KB 826901 "Stop
0x0000007B" error message after you remove Dell OpenManage software in
Windows 2000
Server
KB 839210 "STOP
0x0000007B: INACCESSIBLE_BOOT_DEVICE" error message when you start your
computer from a WinPE CD-ROM or from a Windows Server 2003
CD-ROM by using a USB CD-ROM device
KB 883114 "STOP
0x0000007B: INACCESSIBLE_BOOT_DEVICE" error message when you use a USB
CD-ROM device to install Windows Server 2003
or Windows 2000
KB 922976 Error
message
when you start a Windows
7 or
Windows Vista-based
computer after you change the SATA mode of the boot drive: "STOP
0x0000007B INACCESSABLE_BOOT_DEVICE"
KB 935806 Troubleshooting
Stop error messages that may occur when you try to install Windows Vista
KB 942813 Stop
error when you try to restart a Windows PE 2.0 system that uses AMD
Barcelona processor and that has the Operating System Capabilities
(OSC) method enabled in the BIOS: "STOP: 0x0000007B
(INACCESSIBLE_BOOT_DEVICE)" (Vista)
KB 957018
Stop error on a
computer that is running an Itanium-based
version of Windows Server 2008 and that has Qlogic 8-gigabyte
Fibre Channel cards installed: "STOP 0x0000007B"
KB 975453 Error message when you
start a Windows 7-based
computer after you attach a RAID disk: "STOP 0x0000007B
INACCESSABLE_BOOT_DEVICE"
KB 976042 Windows
may fail to boot from an iSCSI drive if networking hardware is changed
(Server 2008 R2)
KB 2134360 Stop error 0x7B and
installation may fail when you try to upgrade to a Windows Server 2008-based or a
Windows Server 2008 R2-based
computer that has SAN drives that are managed by EMC's PowerPath Device
Specific Module (DSM)
KB 2344941 "0x0000007B" Stop error
when you replace an iSCSI or PCI Express
network adapter or a motherboard with an identical device on a Windows
Server 2008 R2-based
or Windows 7-based
computer
KB 2487376 FIX: Stop error when
you replace an iSCSI network adapter or a
motherboard by using an identical device on a Windows Server 2008-based
or Windows Vista-based
computer: "0x0000007B"
KB 2507616 "0x0000007B" Stop error
after replacing or switching to an alternate iSCSI boot adapter on a
Windows Server 2008 R2-based
or Windows 7-based
computer
KB 2550978 "0x0000007B" Stop error
after you replace an identical iSCSI network adapter in Windows Server 2008 R2 SP1 or
in Windows 7 SP1
KB 2673509
You receive error: Stop error code 0x0000007B
(INACCESSIBLE_BOOT_DEVICE) after you install Windows Updates (Vista/Win7)
KB 2743013
STOP 0x0000007B error on reboot after Bitlocker drive encryption (Win7)
KB 2773300
"Stop 0x0000007B" error
after you use a Group Policy setting to prevent the installation of devices in
Windows 7 and Windows
Server 2008 R2
WinDbg
Help File Entry:
The INACCESSIBLE_BOOT_DEVICE
bug check has a value of 0x0000007B. This bug check indicates that the
Microsoft Windows operating system has lost access to the system
partition during startup.
Parameters
The following parameters
appear in the message.
| Parameter |
Description |
| 1 |
The address of a UNICODE_STRING structure, or the
address of the device object that could not be mounted |
| 2 |
0 |
| 3 |
0 |
| 4 |
0 |
To determine the meaning of
Parameter 1, look at the data that it points to. If the first
word (USHORT) at this address is even, Parameter 1 is the
beginning of a Unicode string. If the first word (USHORT) at this
address is 0x3, Parameter 1 is the first field (Type) of a
device object.
- If this parameter points to a device object, the file
system that was supposed to read the boot device failed to initialize
or simply did not recognize the data on the boot device as a file
system structure. In this situation, the specified device object is the
object that could not be mounted.
- If this parameter points to a Unicode string, you must read
the first 8 bytes at this address. These bytes form the UNICODE_STRING
structure, which is defined as follows:
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
The Length field gives the actual
length of the string. The Buffer field points to
the beginning of the string (Buffer is always be at
least 0x80000000.)
The actual string contains the Advanced RISC Computing
(ARC) specification name of the device that the boot was being
attempted from. ARC names are a generic way to identify devices in the
ARC environment.
Cause
The INACCESSIBLE_BOOT_DEVICE
bug check frequently occurs because of a boot device failure. During
I/O system initialization, the boot device driver might have failed to
initialize the boot device (typically a hard disk). File system
initialization might have failed because it did not recognize the data
on the boot device. Also, repartitioning the system partition or
installing a new SCSI adapter or disk controller might induce this
error.
This error can also occur
because of incompatible disk hardware. If the error occurred at the
initial setup of the system, the system might have been installed on an
unsupported disk or SCSI controller. Some controllers are supported
only by drivers that are in the Windows Driver Library (WDL). (These
drivers require the user to do a custom installation.)
Resolving the Problem
This error always occurs
while the system is starting. This error frequently occurs before the
debugger connection is established, so debugging can be difficult or
impossible.
Resolving a failed
boot device problem: If a boot device is at fault, you must
edit the boot options.For more information about changing these
options, see Configuring
Software on the Target Computer .
Resolving an
incompatible disk hardware problem: If Setup autodetects the
controller, you might have to skip detection and use a specific
manufacturer's disk to load the driver. Also, check the availability of
updates for the system BIOS and SCSI controller firmware. Updates of
this kind are typically available on the Web site or BBS of the
hardware manufacturer.
Remove any recently added
hardware, especially hard disk drives or controllers, to see if the
error is resolved. If the problematic hardware is a hard disk drive,
the disk firmware version might be incompatible with your version of
the Windows operating system. Contact the manufacturer for updates. If
you removed another piece of hardware and the error is resolved, IRQ or
I/O port conflicts likely exist. Reconfigure the new device according
to the manufacturer's instructions.
Confirm that all hard disk
drivers, hard disk controllers, and SCSI adapters are listed in the
Microsoft Windows Marketplace Tested Products List.
If you recently added a
driver, restart your computer, and press F8 at the character-based menu
that displays the operating system choices. In the Advanced
Options menu, select the Last Known Good
Configuration option. This option is most effective when you
add only one driver or service at a time.
In addition, check your
computer for viruses by using any up-to-date, commercial virus scanning
software that examines the Master Boot Record of the hard disk. All
Windows file systems can be infected by viruses.
This error can also occur
because of hard disk corruption. Run Chkdsk /f /r
on the system partition. You must restart the computer before the disk
scan begins. If you cannot start the computer because of the error, use
the Recovery Console and run Chkdsk /r.
If you cannot start the
system in the last known good configuration, you should try to start
off the Windows CD. Then, you can run Chkdsk from
the Repair Console.
Warning If
your system partition is formatted with the FAT file system, the long
file names that the Windows operating system uses might be damaged if
you use Scandisk or another MS-DOS-based hard disk tool to verify the
integrity of your hard disk drive from MS-DOS. Always use the version
of Chkdsk that matches your version of Windows.
If your system has SCSI
adapters, contact the adapter manufacturer to obtain updated Windows
drivers. Try disabling sync negotiation in the SCSI BIOS, checking the
cabling and the SCSI IDs of each device, and confirming proper
termination. For IDE devices, define the onboard IDE port as Primary
only. Also check each IDE device for the proper master/subordinate/stand
alone setting. Try removing all IDE devices except for hard
disks. Finally, check the System Log in Event Viewer for additional
error messages that might help identify the device or driver that is
causing the error.
To analyze this
error: Run an lm (List
Loaded Modules) command in the debugger. Verify
that the following drivers were loaded: disk, classpnp,
ftdisk, partmgr, and FAT
or NTFS.
kd> lm
start end module name
80001000 80016000 hal (deferred)
80016000 80018c40 bootvid (deferred)
80019000 8001dfc0 pciidex (deferred)
8001e000 8001ff60 dmload (deferred)
80086000 80086980 pciide (deferred)
802c1000 802cc000 pci (deferred)
802cc000 802d39a0 isapnp (deferred)
802d4000 802ed000 ftdisk (deferred)
802ed000 802f3820 mountmgr (deferred)
802f4000 802fad40 fdc (deferred)
802fb000 802fdc20 partmgr (deferred)
802fe000 802fef00 wmilib (deferred)
8039b000 803b8000 dmio (deferred)
803b8000 803cb000 atapi (deferred)
803cb000 803d1560 disk (deferred)
803d2000 803d8e80 classpnp (deferred)
803d9000 803fa000 fastfat (deferred)
80400000 80540000 nt (pdb symbols) \\localsymbols\symbols\exe\ntoskrnl.dbg
80540000 80546f20 ksecdd (deferred)
80547000 80554620 cnss (deferred)
80555000 80579000 ndis (deferred)
You probably have pci
or isapnp loaded. Also make sure your
controller drivers are loaded. That is, make sure Atapi.sys
is loaded with the channel drivers (pciide and pciidex
or intelid) or scsiport.sys is
loaded with the appropriate miniport driver.
It is helpful to know as
much as possible about the boot device that Windows is installed on.
For example, you can investigate the following items:
- Find out what type of controller the boot device is
connected to (SCSI, IDE, 1394, etc). Find the manufacturer of non-IDE
controllers (Adaptec, Symbios, and so on).
- Note the SCSI ID of the boot device if you are using SCSI.
- Indicate if other devices are attached to the same
controller that the boot device is on (CD-ROM drives, zip drives, and
so on).
- Note the file system that is used on the drive.
The !devnode
extension gives you more information, if you know what your boot
devices are.
Typically Plug and Play
cannot assign resources to the boot device. You can verify this
restriction by finding an entry for the service. If the status flags
include DNF_INSUFFICIENT_RESOURCES or do not include DNF_STARTED or
DNF_ENUMERATED, you have found the problem. Try !devnode 0 1 scsi
or !devnode 0 1 atapi to
save some time instead of dumping the whole device tree.
WinDbg
Output Example:
INACCESSIBLE_BOOT_DEVICE
(7b)
During the initialization of the I/O system, it is possible that the
driver
for the boot device failed to initialize the device that the system is
attempting to boot from, or it is possible for the file system that is
supposed to read that device to either fail its initialization or to
simply
not recognize the data on the boot device as a file system structure
that
it recognizes. In the former case, the argument (#1) is the
address of a
Unicode string data structure that is the ARC name of the device from
which
the boot was being attempted. In the latter case, the
argument (#1) is the
address of the device object that could not be mounted.
If this is the initial setup of the system, then this error can occur if
the system was installed on an unsupported disk or SCSI
controller. Note
that some controllers are supported only by drivers which are in the
Windows
Driver Library (WDL) which requires the user to do a custom
install. See
the Windows Driver Library for more information.
This error can also be caused by the installation of a new SCSI adapter
or
disk controller or repartitioning the disk with the system
partition. If
this is the case, on x86 systems the boot.ini file must be edited or on
ARC
systems setup must be run. See the "Advanced Server System
Administrator's
User Guide" for information on changing boot.ini.
If the argument is a pointer to an ARC name string, then the format of
the
first two (and in this case only) longwords will be:
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
That is, the first longword will contain something like 00800020 where
20
is the actual length of the Unicode string, and the next longword will
contain the address of buffer. This address will be in system
space, so
the high order bit will be set.
If the argument is a pointer to a device object, then the format of the
first
word will be:
USHORT Type;
That is, the first word will contain a 0003, where the Type code will
ALWAYS
be 0003.
Note that this makes it immediately obvious whether the argument is a
pointer
to an ARC name string or a device object, since a Unicode string can
never
have an odd number of bytes, and a device object will always have a Type
code of 3.
Arguments:
Arg1: 0000000000000000, Pointer to the device object or Unicode string
of ARC name
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Device driver, ?Network hardware
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559221(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The BUGCODE_NDIS_DRIVER bug
check has a value of 0x0000007C. This bug check indicates that a
problem occurred with an NDIS driver.
Parameters
The following parameters
appear on the blue screen. Parameter 1 indicates the type of
violation. The meaning of the other parameters depends on the value of
Parameter 1.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
| 0x01 |
The address of the miniport block |
The number of bytes that are requested |
The current IRQL |
A driver called NdisMAllocateSharedMemory
at a raised IRQL. |
| 0x02 |
The address of the miniport block |
The shared memory page that was corrupted |
The address of NDIS_WRAPPER_CONTEXT that keeps track of
the driver's shared memory allocations |
During a call to NdisMAllocateSharedMemory,
NDIS detected that a previously-allocated shared memory page had been
corrupted. |
| 0x03 |
The address of the miniport block |
The page that contains the shared memory |
The virtual address of the shared memory |
A driver called NdisMFreeSharedMemory[Async]
with a shared memory pointer that had already been freed. |
| 0x04 |
The address of NDIS_M_DRIVER_BLOCK |
The address of DRIVER_OBJECT |
0 |
AddDevice was called with a driver
that is not on the list of drivers that are registered with NDIS.
(Enabled only on special instrumented NDIS.)
|
0x05
0x06 |
The address of the miniport block |
The address of the packet descriptor that the driver
uses |
The address of the packet array that contained this
packet descriptor |
An Ethernet driver indicated that it received a packet
by using a packet descriptor that the protocol stack is currently
using. |
| 0x07 |
The address of the miniport block |
The address of the packet descriptor that the driver
uses |
The address of the packet array that contained this
packet descriptor |
An FDDI driver indicated that it received a packet by
using a packet descriptor that the protocol stack is currently using. |
| 0x08 |
The address of the miniport block |
The address of NDIS_MINIPORT_INTERRUPT |
0 |
A miniport driver did not deregister its interrupt
during the halt process. |
| 0x09 |
The address of the miniport block |
The address of the miniport driver's timer queue
(NDIS_MINIPORT_TIMER) |
0 |
A miniport driver stopped without successfully
canceling all its timers. |
| 0x0A |
The address of NDIS_M_DRIVER_BLOCK |
The address of DRIVER_OBJECT |
The reference count for the miniport driver |
A miniport driver is getting unloaded prematurely. |
| 0x0B |
The address of the miniport block |
The address of NDIS_MINIPORT_INTERRUPT |
0 |
A miniport driver failed its initialization without
deregistering its interrupt. |
| 0x0C |
The address of the miniport block |
The address of the miniport driver's timer queue
(NDIS_MINIPORT_TIMER) |
0 |
A miniport driver failed its initialization without
successfully canceling all its timers. |
| 0x0D |
The address of the miniport block |
The address of NDIS_MINIPORT_INTERRUPT |
0 |
A miniport driver did not deregister its interrupt
during the halt process. (The halt was called from the initialize
routine after the miniport driver returned success from its initialize
handler.) |
| 0x0E |
The address of the miniport block |
The address of the miniport driver's timer queue
(NDIS_MINIPORT_TIMER) |
0 |
A miniport driver stopped without successfully
canceling all its timers. (The halt was called from the initialize
routine after the miniport driver returned success from its initialize
handler.) |
| 0x0F |
The address of the miniport block |
The reset status |
AddressingReset (BOOLEAN) |
A miniport driver called NdisMResetComplete
without any pending reset request. |
| 0x10 |
The address of the miniport block |
The address of NDIS_MINIPORT_INTERRUPT |
0 |
After resuming from a low-power state, a miniport
driver failed its initialization without deregistering its interrupt. |
| 0x11 |
The address of the miniport block |
The address of the miniport driver's timer queue
(NDIS_MINIPORT_TIMER) |
0 |
After resuming from a low-power state, a miniport
driver failed its initialization without successfully canceling all its
timers. |
| 0x12 |
The address of the miniport block |
The address of the packet descriptor that the driver
uses |
The address of the packet array that contained this
packet descriptor |
A miniport driver indicated that it received a packet
by using a packet descriptor that the protocol stack is currently
using. |
| 0x13 |
The address of the miniport block |
The address of the packet descriptor that the driver
uses |
The address of the packet array that contained this
packet descriptor |
A Token-Ring miniport driver indicated that it received
a packet by using a packet descriptor that the protocol stack currently
uses. |
Cause
Parameter 1
indicates the specific cause of the BUGCODE_NDIS_DRIVER bug check.
If one of the bug check
parameters specifies the address of the miniport block, you can obtain
more information by using !ndiskd.miniport
together with this address.
If one of the bug check
parameters specifies the address of the packet descriptor that the
driver uses, you can obtain more information by using !ndiskd.pkt
together with this address.
Comments
This bug check code occurs
only on Microsoft Windows Server 2003 and later versions of
Windows. In Windows 2000 and Windows XP, the
corresponding code is bug
check 0xD2 (BUGCODE_ID_DRIVER).
WinDbg
Output Example:
BUGCODE_NDIS_DRIVER (7c)
This is the NDIS Driver Bugcheck for Windows Server 2003 and later.
For Windows 2000 and Windows XP, see 0xD2, BUGCODE_ID_DRIVER.
Arguments:
Arg1: 0000000000000000, NDIS BugCheck Code
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Self explanatory
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819332.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559232(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The INSTALL_MORE_MEMORY bug
check has a value of 0x0000007D. This bug check indicates that there is
not enough memory to start up the Microsoft Windows operating system.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The number of physical pages that are found |
| 2 |
The lowest physical page |
| 3 |
The highest physical page |
| 4 |
0 |
Cause
The Windows operating system
does not have sufficient memory to complete the startup process.
Resolving the Problem
Install more memory.
WinDbg
Output Example:
INSTALL_MORE_MEMORY (7d)
Not enough memory to boot Windows.
Arguments:
Arg1: 0000000000000000, Number of physical pages found
Arg2: 0000000000000000, Lowest physical page
Arg3: 0000000000000000, Highest physical page
Arg4: 0000000000000000, 0
STOP 0x0000007E:
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (go
to top of page)
Usual causes:
Insufficient disk space, Device driver, Video card, BIOS, Breakpoint
with no debugger attached, Hardware incompatibility, Faulty system
service, Memory, 3rd party remote control,
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559239(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x7e
Knowledge
Base Articles:
KB 310628 Easy
CD
Creator 5.0 does not function in Windows XP
KB 321637 When
you use a
Creative Labs SoundBlaster 16 Joystick with a game port in Windows XP,
you receive a "serious error" or a "STOP: 0x0000007E" error message
KB 330182 How
to
troubleshoot a Stop 0x0000007E error in Windows XP
KB 818966 "STOP:
0x0000007E" Error Message When You Install Windows XP
Disk Image from a Remote Installation Services Server
KB 820362 Error
Message: STOP 0x0000007e (0xc0000005, 0xf72ddc76, 0xf791e920,
0xf791e570) (Server
2003)
KB 839641 You
receive a
stop error 0x7E in Pci.sys (2000, XP, Server 2003)
KB 884868
Stop error code
0x0000007E occurs after you disconnect your USB 2.0 flash storage
device (XP)
KB 900485
Error message in Windows XP Service Pack 2:
"Stop 0x7E"
KB 906099 Error
message
on a Windows Server
2003-based computer: "STOP 0x0000007E"
KB 924083
FIX: You receive stop
error 0x7E on a Windows Server 2003
computer that is running the Server for NFS service and that has McAfee
VirusScan Enterprise 8.0i installed
KB 929734
You have problems
after you resume a Windows Vista-based
computer from sleep or from hibernation
KB 930311 Occasional
error message on a portable Windows Vista-based
computer that wakes from sleep to perform network-related tasks: "STOP
0x0000007E"
KB 930979 You
may
receive a "Stop 0x0000007E" error message after you enable the
BitLocker Drive Encryption feature in Windows Vista
KB 932755
An updated Storport
storage driver is available for Windows Server
2003
KB 935806 Troubleshooting
Stop error messages that may occur when you try to install Windows Vista
KB 939180 Stop
error
message when an application that uses Winsock is running on a Windows Server 2003-based
computer: "Stop 0x0000007E"
KB 940322 Error
message
after you enable the ETW trace log on a computer that is running
Windows XP:
"0x0000007E (0xC0000005, parameter2, parameter3, parameter4 )
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 941021 Error
message
when you repeatedly restart a Windows Vista-based
computer: "Stop 0x0000007E"
KB 942237 Error
message
after you wake a Windows XP-based
computer from standby or from hibernation: "Stop 0x0000007E
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 950570 Error
message
when you start a multiprocessor computer that runs Windows Vista:
"STOP: 0x0000007E"
KB 953356 Error
message after you upgrade a computer that uses a processor other than
an Intel processor to Windows XP
Service Pack 2 or to Windows XP
Service Pack 3: "STOP: 0x0000007E"
KB 953403
Stop error when you
attach a Niveus Ice Vault Disc Changer to a Windows Vista SP1-based computer or to a Windows Server 2008-based computer: "STOP:
0x0000007E"
KB 953531 A
"0x0000007E"
Stop error occurs in Windows Server 2008
after you unmount and delete a persistent VSS snapshot
KB 953794 The
error
"Stop 0x0000007E" occurs when you try to shut down a Windows Server 2003
based computer with a Broadcom NIC installed but disabled
KB 954589 Stop
error
message when you plug a USB storage device into the USB port of a
Windows Vista
SP1-based or Windows Server
2008-based computer: "Stop 0x0000007E
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 958092 After
the
Terminal Services mirror driver is disconnected from a Windows Server 2008-based
or Windows Vista-based
remote computer, you receive a Stop error on the remote computer: "Stop
0x0000007E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 960038 You
receive a
"0x0000007E" Stop error on Windows Server 2008-based
computers that host Hyper-V virtual machines when you use the Hyper-V
writer to back up virtual machines
KB 960652
Stop error when you
copy a file from a redirected disk to a Windows Server 2003-based terminal server in a
terminal server session: "0x0000007E"
KB 961799 A Stop error occurs on a
Windows Server 2003-based server when
a user accesses shared files on the server by using an SMB connection
KB 962943 FIX:
You receive a Stop 0x0000007e error message on a blue screen when the
AppPoolCredentials attribute is set to true and you use a domain
account as the application pool identity in IIS 7.0 (Vista,
Server 2008)
KB 965494 Stop
error
when a registry management problem occurs on a Windows Server 2008
or Windows Vista
SP1-based computer: "0x0000007E"
KB 967544
Stop error message
after you add a new device that supports MSI-X interrupts on a computer
that is running Windows Vista or
Windows
Server 2008: "0x0000007E"
KB 967999
Stop error message
when you start a Windows Server 2008-based
computer from an iSCSI boot device that is connected over MPIO
paths:"Stop 0x0000007E"
KB 968451 Stop
error
message when you enable File Server Resource Manager quota management
on an NTFS volume on a Windows Server 2003
R2-based computer: "Stop 0x0000007E"
KB 969550 A
Stop error
occurs on an HP ProLiant server that has the firmware from an
E200/E200i HP Smart Array SAS/SATA controller installed on any Windows
Server platform (2000
Server, Server
2003, Server
2008)
KB 971280 Random Stop
errors
on a Windows Server
2003-based computer that performs input/output to
file shares hosted on another computer or to a network-attached storage
device
KB 973482 Stop error 0x0A, or Stop
error 0x7E may occur on a computer that is running Windows Vista or Windows Server 2008
KB 974598 You receive a "Stop
0x0000007E" error on the first restart after you enable Hyper-V on a
Windows Server 2008 R2-based
computer
KB 975070 Error
message
after you apply update 973879: "Stop 0x0000007e" or "Stop 0x00000050" (Vista,
Server 2008)
KB 977001 Stop
error code when you enable shadow copies on a volume that is larger
than 64 terabytes on a computer that is running Windows Server 2008 or Windows
Vista:
"0x0000007E"
KB 979538 "Stop 0x0000007E" or
"Stop 0x00000050" Stop error message in Windows 7 or Windows Server 2008 R2
KB 979557
Stop error message on a terminal server that is running a 64-bit
version of Windows Server 2008 when a
user remotely controls another terminal server session: "Stop error
code 0x0000007E (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED)"
KB 980082 Stop error in Win7 and in Win2008 R2 when you run a
backup application: "0x0000007E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 981122 Stop error in Windows Server 2003 SP2:
"0x0000007E"
KB 981751 "0x0000007E" Stop error
in Windows Server 2008
or in Windows Vista
KB 983615 "Stop 0x0000007E
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED" error when the GPU is under heavy
load conditions in Windows
7 or Windows Server
2008 R2
KB 2299380 "0x0000007E" Stop error
when you back up a Windows Server 2008 R2-based
or Windows 7-based
computer that is running virtual machines
KB 2394911 Stop error "0x000000D1"
or "0x0000007E" in an SMB2 environment in Windows 7 or in
Windows Server 2008 R2
KB 2431799 Stop error 0x0000007E
occurs when multiple users establish Remote Desktop Services sessions
to a Windows Server
2008 R2-based computer
KB 2460907 "0x0000007E" Stop error
when you create snapshots in Windows Server 2008 or in
Windows Vista
KB 2460912
"0x0000007E" or "0x00000050" Stop error when you create snapshots of a
volume in Windows Server 2008 R2 or
in
Windows 7
KB 2479442 Stop error during
startup in Windows Server 2008 or in
Windows
Vista
KB 2511500 "0x0000007E" Stop error
after you perform a hot removal of a PCI device in Windows 7 or in
Windows Server 2008 R2
KB 2528614 Operating system
intermittently crashes with a "0x0000007E" Stop error message on a
computer that is running Windows
7 or Windows Server
2008 R2
KB 2547257 "0x0000007E"
or "0x0000000A" Stop error occurs when you play and at the same time
record TV content on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2548124 "0x0000007E" Stop error
when you run a VSS-based backup application in Windows 7 or in
Windows Server 2008 R2
KB 2579274
"0x0000007E" Stop error message when a connection is reset on a computer that is
running Windows 7 or Windows
Server 2008 R2
KB 2591271
"0x0000007E" Stop error when you restart a computer that is running
Windows
Server 2008 R2 or
Windows 7
KB 2614451
"STOP: 0x0000007E" error occurs when you write some data onto a CD or
DVD in Windows Server 2008 R2 or in
Windows 7
KB 2639032
"0x0000003B,"
"0x00000027," and "0x0000007e" Stop errors when a connection to a CSV
is lost on a Windows
Server 2008 R2-based failover cluster
KB 2695584
"0x0000007E" or "0X00000050" Stop error when you run the Common Scenario Stress
with IO test in Windows 7 or in Windows
Server 2008 R2
KB 2705368
"0x0000007E" Stop error when you use McAfee Device Control tool or a similar
tool to restrict USB audio in Windows XP SP3
KB 2768523
"0x0000007E" Stop error after you configure a computer to host a web service in
Windows Server 2008 R2
KB 2831184
"0x0000007E" Stop error when a file on a Windows 7 SP1-based
or Windows Server 2008 R2 SP1-based computer is
opened from multiple client computers
KB 2854942
"0x0000007E" Stop error when you remove a USB HID device from a Windows
XP SP3-based computer
KB 2857407
"0x0000007E" Stop error when
you try to shut down a Windows 8 or Windows
Server 2012-based computer
More STOP error messages at these search
links: http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x00000024&x=13&y=11&mkt=en-US&FORM=QBME1&l=1
http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000007e&x=11&y=11&mkt=en-US&FORM=QBME1&l=1
WinDbg
Help File Entry:
The
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED bug check has a value of
0x0000007E. This bug check indicates that a system thread generated an
exception that the error handler did not catch.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The exception code that was not handled |
| 2 |
The address where the exception occurred |
| 3 |
The address of the exception record |
| 4 |
The address of the context record |
Cause
The
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED bug check is a very common bug
check. To interpret it, you must identify which exception was generated.
Common exception codes
include the follwoing:
- 0x80000002: STATUS_DATATYPE_MISALIGNMENT indicates an
unaligned data reference was encountered.
- 0x80000003: STATUS_BREAKPOINT indicates a breakpoint or
ASSERT was encountered when no kernel debugger was attached to the
system.
- 0xC0000005: STATUS_ACCESS_VIOLATION indicates a memory
access violation occurred.
For a complete list of
exception codes, see the Ntstatus.h file that is
located in the inc directory of the Microsoft
Windows Driver Kit (WDK).
Resolving the Problem
If you are not equipped to
debug this problem, you should use some basic troubleshooting
techniques.
- Make sure you have enough disk space.
- If a driver is identified in the bug check message, disable
the driver or check with the manufacturer for driver updates.
- Try changing video adapters.
- Check with your hardware vendor for any BIOS updates.
- Disable BIOS memory options such as caching or shadowing.
If you plan to
debug this problem, you might find it difficult to obtain a
stack trace. Parameter 2 (the exception address) should
identify the driver or function that caused this problem.
If exception code 0x80000003
occurs, a hard-coded breakpoint or assertion was hit, but the system
was started with the /NODEBUG switch. This problem
should rarely occur. If it occurs repeatedly, make sure that a kernel
debugger is connected and the system is started with the /DEBUG
switch.
If exception code 0x80000002
occurs, the trap frame supplies additional information.
If you do not know the
specific cause of the exception, consider the following issues:
- Hardware incompatibility. Make sure
that any new hardware that is installed is listed in the Microsoft
Windows Marketplace Tested Products List.
- Faulty device driver or system service. A
faulty device driver or system service might be responsible for this
error. Hardware issues, such as BIOS incompatibilities, memory
conflicts, and IRQ conflicts can also generate this error.
If a driver is listed by
name within the bug check message, disable or remove that driver.
Disable or remove any drivers or services that were recently added. If
the error occurs during the startup sequence and the system partition
is formatted with NTFS file system, you might be able to use Safe Mode
to rename or delete the faulty driver. If the driver is used as part of
the system startup process in Safe Mode, you must start the computer by
using the Recovery Console to access the file.
If the problem is associated
with Win32k.sys, the source of the error might be a
third-party remote control program. If such software is installed, you
can remove the service by starting the computer by using the Recovery
Console and then deleting the offending system service file.
Check the System Log in Event
Viewer for additional error messages that might help identify
the device or driver that is causing bug check 0x7E.
You can also disable memory
caching of the BIOS might to try to resolve the error. You should also
run hardware diagnostics, especially the memory scanner, that the
system manufacturer supplies. For more information about these
procedures, see the owner's manual for your computer.
The error that generates
this message can occur after the first restart during Windows Setup, or
after Setup is finished. A possible cause of the error is lack of disk
space for installation and system BIOS incompatibilities. For problems
during Windows installation that are associated with lack of disk
space, reduce the number of files on the target hard disk drive. Check
for and delete any temporary files that you do not have to have,
Internet cache files, application backup files, and .chk files
that contain saved file fragments from disk scans. You can also use
another hard disk drive with more free space for the installation. You
can resolve BIOS problems by upgrading the system BIOS version.
WinDbg
Output Example:
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
(7e)
This is a very common bugcheck. Usually the exception address
pinpoints
the driver/function that caused the problem. Always note this
address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Exception Record Address
Arg4: 0000000000000000, Context Record Address
STOP 0x0000007F:
UNEXPECTED_KERNEL_MODE_TRAP (go
to top of page)
Usual causes:
Memory corruption, Hardware (memory in particular), Overclocking
failure, Installing a faulty
or mismatched hardware (especially memory) or a failure after
installing it, 3rd party firewall, Device drivers, SCSI/network/BIOS
updates needed,
Improperly seated cards, Incompatible storage devices, Overclocking,
Virus scanner, Backup tool, Bad motherboard, Missing Service Pack
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819336.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559244(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x7f
Knowledge
Base Articles:
KB 137539 General
causes
of "STOP 0x0000007F" errors (NT, 2000, XP)
KB 316526 Error
Message:
"STOP 0x0000007F" During Setup on Hewlett Packard Pavilion 7840 (XP)
KB 317214
Terminal Server unexpectedly restarts, or you receive "Stop error code
0x0000007F" (2000)
KB 822789 You
receive a
"Stop 0x0000007F" error message or your computer unexpectedly restarts (NT, 2000, XP, Server 2003)
KB 827188
You receive a "Stop
error code 0x0000007F" in Windows 2000
KB 835281 You receive a "Stop
error code 0x0000007F" (UNEXPECTED_KERNEL_MODE_TRAP) error message and
your Windows 2000-based computer
restarts
KB 838804 You
receive a
"0x0000007F" stop error on a Windows 2000-based
computer
KB 839540
Stop error code 0x0000007f EXCEPTION_DOUBLE_FAULT occurs in Windows
2000 Server
KB 842465 Stop
7F,
0x00000008 (double-fault) error occurs because of a single-bit error in
the ESP register (2000,
XP,
Server 2003)
KB 870908 Command
AntiVirus version 4.62.4 causes an error message on a blue screen in
Windows XP
Service Pack 2
KB 907353 You
receive a
Stop error message when you use a hardware device on a computer that is
running Windows 2000
KB 928006
You receive a "STOP:
0x0000007f" error message or the computer automatically restarts in
Windows
Server 2003
KB 935843 Error
message
when you try to print after you install the GDI security update 925902:
"Stop 0x0000007F" (2000,
XP)
KB 941020 You
receive occasional Stop errors after you install a driver that manages
on-board flash memory on a Windows Vista-based
computer
KB 944824
Stop error message on a computer that has ISA Server
2006 installed: "Stop error code 0x0000007f
(UNEXPECTED_KERNEL_MODE_TRAP)"
KB 947471
Stop error message on a Windows Server 2003-based
computer that has Symantec AntiVirus software installed: "Stop error
code 0x0000007f (UNEXPECTED_KERNEL_MODE_TRAP)"
KB 959523
Stop error after you
install KB951376, you use the Add Bluetooth Device Wizard, you find
many Bluetooth devices, and then you try to put a Windows Vista-based or Windows Server 2008-based computer to sleep: "STOP
0x0000007F"
KB 971128
Stop error when
multiple third-party network drivers are installed on a computer that
is running Windows
Server 2008 or Windows
Vista: "0x0000007F" or "0x0000008E"
KB 972907 Stop error message on a
computer that is running Windows Vista or Windows Server 2008: "STOP:
0x0000007F"
KB 979762 Stop error in Windows Vista and in Windows Server 2008 when you
try to print a document: "0x0000003B" or "0x0000007f"
KB 981180
Stop error message when you run an application that transfers data by
using the UDP protocol in Windows Server
2008 R2 or in
Windows 7: "STOP 0x0000007F"
KB 2254637 "0x0000007F" Stop error
occurs when the connection to some shared files is lost on a computer
that is running Windows Vista,
Windows Server 2008,
Windows 7 or
Windows Server 2008 R2
KB 2487324
"0x0000003B" or "0x0000007f" Stop errors may occur when you try to
print a document in Windows Server 2008 R2
KB 2498368
Error: 0x7F, Stop: 0x0000007F or Windows Live Mail fails to launch
after installing Windows update KB2454826 (Windows
7/Server 2008 R2)
KB 2502285 "0x0000007F" Stop error
after you install Windows 7 Service Pack 1 in Windows 7 (Windows 7 SP1)
KB 2519736 Stop error message in
Windows Server 2008 R2
SP1 or in Windows
7 SP1: "STOP: 0x0000007F"
KB 2531771 "0x0000007F" Stop error
when you try to wake the computer from Sleep (S3) mode if you use
offline files in Windows Vista
or in Windows Server
2008
KB 2592339
"0x0000007f" Stop error or system stops responding on a computer that
is running Windows Server 2008 R2 or
Windows 7 when you connect to it by
using the RDP protocol
More error messages at this link:
http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000007f&x=9&y=10&mkt=en-US&FORM=QBME1&l=1
WinDbg
Help File Entry:
The
UNEXPECTED_KERNEL_MODE_TRAP bug check has a value of 0x0000007F. This
bug check indicates that the Intel CPU generated a trap and the kernel
failed to catch this trap.
This trap could be a bound
trap (a trap the kernel is not permitted to catch) or a double
fault (a fault that occurred while processing an earlier
fault, which always results in a system failure).
Parameters
The first parameter that
appears on the blue screen specifies the trap number.
The most common trap codes
include the following:
- 0x00000000, or Divide by Zero Error, indicates that a DIV
instruction is executed and the divisor is zero. Memory corruption,
other hardware problems, or software failures can cause this error.
- 0x00000004, or Overflow, occurs when the processor executes
a call to an interrupt handler when the overflow (OF) flag is set.
- 0x00000005, or Bounds Check Fault, indicates that the
processor, while executing a BOUND instruction, finds that the operand
exceeds the specified limits. A BOUND instruction ensures that a signed
array index is within a certain range.
- 0x00000006, or Invalid Opcode, indicates that the processor
tries to execute an invalid instruction. This error typically occurs
when the instruction pointer has become corrupted and is pointing to
the wrong location. The most common cause of this error is hardware
memory corruption.
- 0x00000008, or Double Fault, indicates that an exception
occurs during a call to the handler for a prior exception. Typically,
the two exceptions are handled serially. However, there are several
exceptions that cannot be handled serially, and in this situation the
processor signals a double fault. There are two common causes of a
double fault:
- A kernel stack overflow. This overflow occurs when a
guard page is hit, and the kernel tries to push a trap frame. Because
there is no stack left, a stack overflow results, causing the double
fault. If you think this overview has occurred, use !thread
to determine the stack limits, and then use kb (Display
Stack Backtrace) with a large parameter (for
example, kb 100) to display the full
stack.
- A hardware problem.
The less-common trap codes
include the following:
- 0x00000001 — A system-debugger call
- 0x00000003 — A debugger breakpoint
- 0x00000007 — A hardware coprocessor instruction with no
coprocessor present
- 0x0000000A — A corrupted Task State Segment
- 0x0000000B — An access to a memory segment that was not
present
- 0x0000000C — An access to memory beyond the limits of a
stack
- 0x0000000D — An exception not covered by some other
exception; a protection fault that pertains to access violations for
applications
For other trap numbers, see
an Intel architecture manual.
Cause
Bug check 0x7F typically
occurs after you install a faulty or mismatched hardware (especially
memory) or if installed hardware fails.
A double fault can occur
when the kernel stack overflows. This overflow occurs if multiple
drivers are attached to the same stack. For example, if two file system
filter drivers are attached to the same stack and then the file system
recurses back in, the stack overflows.
Resolving the Problem
Debugging:
Always begin with the !analyze
extension.
If this extension is not
sufficient, use the kv (Display
Stack Backtrace) debugger command.
After using one of these
commands, use kv again to display the new stack.
Troubleshooting: If
you recently added hardware to the computer, remove it to see if the
error recurs. If existing hardware has failed, remove or replace the
faulty component. Run hardware diagnostics that the system manufacturer
supplies to determine which hardware component failed.
The memory scanner is
especially important. Faulty or mismatched memory can cause this bug
check. For more informaiton about these procedures, see the owner's
manual for your computer. Check that all adapter cards in the computer
are properly seated. Use an ink eraser or an electrical contact
treatment, available at electronics supply stores, to ensure adapter
card contacts are clean.
If the error appears on a
newly installed system, check the availability of updates for the BIOS,
the SCSI controller, or network cards. These kind of updates are
typically available on the Web site or BBS of the hardware manufacturer.
Confirm that all hard disk
drives, hard disk controllers, and SCSI adapters are listed in the
Microsoft Windows Marketplace Tested Products List.
If the error occurred after
the installation of a new or updated device driver, you should remove
or replace the driver. If, under this circumstance, the error occurs
during the startup sequence and the system partition is formatted with
NTFS, you might be able to use Safe Mode to rename or delete the faulty
driver. If the driver is used as part of the system startup process in
Safe Mode, you have to start the computer by using the Recovery Console
in order to access the file.
Also restart your computer,
and then press F8 at the character-based menu that displays the
operating system choices. At the Advanced Options
menu, select the Last Known Good Configuration
option. This option is most effective when you add only one driver or
service at a time.
Overclocking (setting the
CPU to run at speeds above the rated specification) can cause this
error. If you have overclocked the computer that is experiencing the
error, return the CPU to the default clock speed setting.
Check the System Log in
Event Viewer for additional error messages that might help identify the
device or driver that is causing the error. You can also disable memory
caching of the BIOS to try to resolve the problem.
If you encountered this
error while upgrading to a new version of the Windows operating system,
the error might be caused by a device driver, a system service, a virus
scanner, or a backup tool that is incompatible with the new version. If
possible, remove all third-party device drivers and system services and
disable any virus scanners before you upgrade. Contact the software
manufacturer to obtain updates of these tools. Also make sure that you
have installed the latest Windows Service Pack.
Finally, if all the above
steps do not resolve the error, take the system motherboard to a repair
facility for diagnostic testing. A crack, a scratched trace, or a
defective component on the motherboard can also cause this error.
WinDbg
Output Example:
UNEXPECTED_KERNEL_MODE_TRAP
(7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in
the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff80002af243d
Usual causes:
Hardware malfuntion
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559250(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x80
Knowledge
Base Articles:
KB 822720 The
computer
stops responding (hangs) on boot in Windows 2000 Server,
or you receive a "Stop 0x00000080" error message when you add or remove
a hot swap drive
KB 982488 You receive an incorrect
Stop error message when you send a WHEA handler NMI in Windows Vista and in Windows Server 2008
WinDbg
Help File Entry:
The NMI_HARDWARE_FAILURE bug
check has a value of 0x00000080. This bug check indicates that a
hardware malfunction has occurred.
Parameters
None
Cause
A variety of hardware
malfunctions can cause the NMI_HARDWARE_FAILURE bug check. The exact
cause is difficult to determine.
Resolving the Problem
Remove any hardware or
drivers that have been recently installed. Make sure that all memory
modules are of the same type.
WinDbg
Output Example:
NMI_HARDWARE_FAILURE (80)
This is typically due to a hardware malfunction. The hardware
supplier should
be called.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000081:
SPIN_LOCK_INIT_FAILURE (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819338.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559255(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The SPIN_LOCK_INIT_FAILURE
bug check has a value of 0x00000081.
This bug check appears very
infrequently.
WinDbg
Output Example:
SPIN_LOCK_INIT_FAILURE (81)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819341.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559261(v=VS.85).aspx
Knowledge
Base Articles:
KB 811814 XADM:
"Stop
0x00000082" Error Message When You Mount Exchange IFS as the DFS Root (2000 Server)
KB 885443 You
receive a "Stop 0x00000082" error after you install Windows XP
Service
Pack 2 or after you install security update 890859 in Windows 2000
KB 930184 Error
message
when a volume is dismounted on a Windows Server 2003
SP1-based computer: "STOP 0x00000082"
WinDbg
Help File Entry:
The DFS_FILE_SYSTEM bug
check has a value of 0x00000082.
This bug check appears very
infrequently.
WinDbg
Output Example:
DFS_FILE_SYSTEM (82)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819344.aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (83)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819347.aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (84)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Assorted setup failures - see parameters below
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819348.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559264(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The SETUP_FAILURE bug check
has a value of 0x00000085. This bug check indicates that a fatal error
occurred during setup.
Parameters
The following parameters
appear on the blue screen. Parameter 1 indicates the type of
violation. Parameter 4 is not used. The meaning of the other
parameters depends on the value of Parameter 1.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Cause |
| 0x0 |
0 |
0 |
The OEM HAL font is not a valid .fon
format file, so setup cannot display text.
This cause indicates that Vgaxxx.fon on the boot
floppy or CD is damaged.
|
| 0x1 |
The precise video initialization failure:
0: NtCreateFile of
\device\video0
1: IOCTL_VIDEO_QUERY_NUM_AVAIL_MODES
2: IOCTL_VIDEO_QUERY_AVAIL_MODES
3: The desired video mode is not supported.
This value indicates an internal setup error.
4: IOCTL_VIDEO_SET_CURRENT_MODE (unable to set
video mode)
5: IOCTL_VIDEO_MAP_VIDEO_MEMORY
6: IOCTL_VIDEO_LOAD_AND_SET_FONT
|
The status code from the NT API call, if appropriate |
Video initialization failed.
This failure might indicate that the disk that contains Vga.sys
(or another video driver that is appropriate to the computer) is
damaged or that the computer has video hardware that the Microsoft
Windows operating system cannot communicate with.
|
| 0x2 |
0 |
0 |
Out of memory.
|
| 0x3 |
The precise keyboard initialization failure:
0: NtCreateFile of
\device\KeyboardClass0 failed. (Setup did not find a keyboard connected
to the computer.)
1: Unable to load keyboard layout DLL. (Setup
could not load the keyboard layout file. This failure indicates that
the CD or floppy disk is missing a file, such as Kbdus.dll
for the U.S. release or another layout DLL for localized releases.)
|
0 |
Keyboard initialization failed.
This failure might indicate that the disk that contains the keyboard
driver (I8042prt.sys or Kbdclass.sys)
is damaged or that the computer has keyboard hardware that Windows
cannot communicate with. This failure might also mean that the keyboard
layout DLL could not be loaded.
|
| 0x4 |
0 |
0 |
Setup could not resolve the ARC device path name of the
device that setup was started from.
This error is an internal setup error.
|
| 0x5 |
Reserved |
Reserved |
Partitioning sanity check failed.
This error indicates a bug in a disk driver.
|
WinDbg
Output Example:
SETUP_FAILURE (85)
(NOTE: Textmode setup no longer uses bugchecks to bail out of
serious
error conditions. Therefore, you will never encounter a
bugcheck 0x85.
All bugchecks have been replaced with friendlier and (where possible)
more descriptive error messages. Some of the former
bugchecks, however,
have simply been replaced by our own bugcheck screen, and the codes for
these error conditions are the same as before. These are
documented below.)
The first extended bugcheck field is a code indicating what the
problem is, and the other fields are used differently depending on
that value.
Arguments:
Arg1: 0000000000000000, The oem hal font is not a valid .fon format
file, and so setup
is unable to display text.
This indicates that vgaxxx.fon on the
boot floppy or CD-ROM
is damaged.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (86)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (87)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (88)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (89)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (8a)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000008B:
MBR_CHECKSUM_MISMATCH (go
to top of page)
Usual causes:
Virus infection, MBR corruption, File system issues, Hard drive issues
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559268(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The MBR_CHECKSUM_MISMATCH
bug check has a value of 0x0000008B. This bug check indicates that a
mismatch has occurred in the MBR checksum.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The disk signature from MBR |
| 2 |
The MBR checksum that the OS Loader calculates |
| 3 |
The MBR checksum that the system calculates |
| 4 |
Reserved |
Cause
The MBR_CHECKSUM_MISMATCH
bug check occurs during the boot process when the MBR checksum that the
Microsoft Windows operating system calculates does not match the
checksum that the loader passes in.
This error typically
indicates a virus.
Resolving the Problem
There are many forms of
viruses and not all can be detected. Typically, the newer viruses
usually can be detected only by a virus scanner that has recently been
upgraded. You should boot with a write-protected disk that contains a
virus scanner and try to clean out the infection.
WinDbg
Output Example:
MBR_CHECKSUM_MISMATCH (8b)
This message occurs during the boot process when the MBR checksum the
system
calculates does not match the checksum passed in by the loader. This is
usually
an indication of a virus. There are many forms of viruses and not all
can be
detected. The newer ones usually can only be detected by a virus
scanner that
has recently been upgraded. Boot a write-protected disk containing a
virus
scanner and attempt to clean out the infection.
Arguments:
Arg1: 0000000000000000, Disk Signature from MBR.
Arg2: 0000000000000000, MBR checksum calculated by osloader.
Arg3: 0000000000000000, MBR checksum calculated by system.
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (8c)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (8d)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000008E:
KERNEL_MODE_EXCEPTION_NOT_HANDLED (go
to top of page)
Usual causes:
Insufficient disk space, Device driver, Video card, BIOS, Breakpoint in
startup without having a debugger attached, Hardware incompatibility,
Faulty system service, 3rd party remote control, Memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559271(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x8e
Knowledge
Base Articles:
KB 315335 "STOP
0x0000008e" error message during Windows XP
setup
KB 325154 A
"STOP
0x0000008E" Error Message Occurs in Wdmaud.sys (XP)
KB 330187 A "STOP:
0x0000008E" error message occurs when you change the hardware
acceleration setting (XP)
KB 813818 STOP
0x0000008E error message on a blue screen and your computer does not
enter hibernation or standby after you remove an IEEE 1394 storage
device (XP)
KB 817873
"Stop error code 0x0000008E" error message occurs when you upgrade to
Windows
Server 2003
KB 823303
“Failed To Install Product Catalog” Error Message When You Install
Windows
XP
KB 827663 You
receive a
random "0x0000008E" error message on a blue screen in Windows XP
KB 829422 A "Stop error code
0x0000008E (KERNEL_MODE_EXCEPTION_NOT_HANDLED)" error occurs when a
Terminal Services client prints a document (Server
2003)
KB 834450 "Stop
0x0000008E" error message in Win32k.sys when you use the keyboard to
access a program menu in Windows XP
KB 840216 Stop
0x0000008e error occurs on a server that is running Microsoft Windows Server 2003
KB 893239 You
may
receive a
Stop error message on a blue screen when you start a Microsoft Windows
Server 2003-based
computer or a Microsoft Windows XP-based
computer
KB 903251 You
may
receive an error message on a Windows-based computer: "STOP 0x00000050"
or "STOP 0x0000008e" (2000,
XP,
Server 2003)
KB 905909
You occasionally
receive a "Stop 0x0000008e" error message and the computer may
occasionally stop responding in Windows Server
2003
KB 907966
A Windows
Server 2003-based computer crashes and
then generates the following error message: "STOP: 0x0000008E"
KB 918564 Error message
after you install the Windows Server 2003 Scalable Networking Pack in
Windows Server
2003: "STOP 0x0000008E" or "STOP: 0x0000003B"
KB 920192
Error message in the
win32k!xxxMenuWindowProc+b4f process in Windows Server
2003 or Windows XP: "Stop 0x0000008e"
KB 929161
You receive a Stop
error message on a Windows Server 2003 SP1
or Windows
Server 2003 SP2-based computer when a
device is suddenly disconnected from a host bus adapter
KB 930916 Error
message
when you try to open files on an NTFS file system volume on a Windows XP-based
computer: "Stop 0x0000008E"
KB 932755
An updated Storport
storage driver is available for Windows Server
2003
KB 934454
FIX: Error message on a Windows Server 2003
R2-based computer that has the Server for NFS component
installed: "STOP 0x0000008E" or "STOP 0x00000024"
KB 935806 Troubleshooting
Stop error messages that may occur when you try to install Windows Vista
KB 944056 Error
message
when you try to shut down or to restart a Windows Vista-based
portable computer that has Bluetooth devices installed: “Stop:
0x0000008E”
KB 945658 General
troubleshooting for an error message that you may receive randomly in
Windows XP:
"Stop 0x0000008E"
KB 947479
Error message on a
Windows
Server 2003-based computer: "Stop
error code 0x0000008E"
KB 952679
Stop error message
when an application calls the NtGdiBitBlt function on a Windows
Server 2003 SP2-based computer:
"0x0000008E"
KB 955044
Stop error when an application calls the NtGdiBitBlt function on a
Windows
Server 2008 or Windows
Vista Service Pack 1-based computer:
"0x0000008E"
KB 957319 You
receive a
"Stop 0x00000050" or "Stop 0x0000008E" error message when you restart a
Windows XP-based
computer
KB 957877
Stop error on a
Windows
Server 2003-based terminal server that
has hotfix 951749 installed: "0x0000008E"
KB 959252 Error
message when you switch the operating system from a dual monitor
setting to a single monitor setting on a Windows XP-based
computer or
on a Windows Server
2003-based computer that has the security update
954211 installed: "Stop 0x0000008E"
KB 959828 Stop
error on a Windows Server
2003 SP2-based terminal server or a Windows Server 2008 SP2-based
terminal server when users print documents in terminal sessions:
"0x0000008E" or "0x00000050"
KB 969550 A
Stop error
occurs on an HP ProLiant server that has the firmware from an
E200/E200i HP Smart Array SAS/SATA controller installed on any Windows
Server platform (2000
Server, Server
2003, Server
2008)
KB 971128
Stop error when
multiple third-party network drivers are installed on a computer that
is running Windows
Server 2008 or Windows
Vista: "0x0000007F" or "0x0000008E"
KB 977456 Stop
error when you run an application that has a WS_CHILD styled
message-only window in Windows Server 2003 SP2 or in
Windows XP Professional
x64 Edition SP2: "Stop 0x0000008E"
KB 2494629 A
"0x0000008E" Stop error occurs when you set the message storage limit
for a Message Queuing queue to be larger than 4 GB in a 32-bit version
of Windows Server 2003
KB 2494666
Stop errors may occur
after you use the Driver Verifier manager to apply standard settings to
all drivers in
Windows 7 or in Windows
Server 2008 R2
KB 2581128
"0x0000008E" Stop error may occur when a user logs off a Windows
Server 2003 Terminal Server session
from a client computer
KB 2652034
"0x0000008E" Stop
error when
Windows 7 enters and then resumes from
standby repeatedly if Windows XP Mode is running
KB 2724781
"0x0000008E" Stop error in Windows 7 or in
Windows Server 2008 R2
KB 2791374
Stop error 0x8E occurs on Windows XP when you
print with an XPS printer driver
KB 2801465
"0x0000008E" Stop error when you print a document that has a private character
embedded in Windows Server 2008
KB 2805853
"0x0000008E" Stop error
on a computer that is running Windows 7 or
Windows Server 2008 R2
KB 2846226
Stop Error 0x0000008E on a computer that is running
Windows 7 SP1 or Windows Server 2008 R2 SP1
KB 2871206
STOP 0x8e error when printing a document on a printer shared by a Windows
Server 2003 print server
KB 2916627
Stop Error 0x0000008E (KERNEL_MODE_EXCEPTION_NOT_HANDLED) when you try to access
DFS in Windows 7 or Windows
Server 2008 R2
More BSOD's at this link: http://search.microsoft.com/results.aspx?mkt=en-US&q=stop%3A%200x0000008e&qsc0=0&l=1&first=1&FORM=PEME
WinDbg
Help File Entry:
The
KERNEL_MODE_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000008E.
This bug check indicates that a kernel-mode application generated an
exception that the error handler did not catch.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The exception code that was not handled |
| 2 |
The address where the exception occurred |
| 3 |
The trap frame |
| 4 |
Reserved |
Cause
The
KERNEL_MODE_EXCEPTION_NOT_HANDLED bug check is a very common bug check.
To interpret it, you must identify which exception was generated.
Common exception codes
include the following:
- 0x80000002: STATUS_DATATYPE_MISALIGNMENT indicates that an
unaligned data reference was encountered.
- 0x80000003: STATUS_BREAKPOINT indicates that a breakpoint
or ASSERT was encountered when no kernel debugger was attached to the
system.
- 0xC0000005: STATUS_ACCESS_VIOLATION indicates that a memory
access violation occurred.
For a complete list of
exception codes, see the Ntstatus.h file that is
located in the inc directory of the Microsoft
Windows Driver Kit (WDK).
Resolving the Problem
If you are not equipped to
debug this problem, you should use some basic troubleshooting
techniques:
- Make sure you have enough disk space.
- If a driver is identified in the bug check message, disable
the driver or check with the manufacturer for driver updates.
- Try changing video adapters.
- Check with your hardware vendor for any BIOS updates.
- Disable BIOS memory options such as caching or shadowing.
If you plan to debug this
problem, you might find it difficult to obtain a stack trace.
Parameter 2 (the exception address) should identify the driver
or function that caused this problem.
If exception code 0x80000003
occurs, a hard-coded breakpoint or assertion was hit, but the computer
was started with the /NODEBUG switch. This problem
should rarely occur. If it occurs repeatedly, make sure that a kernel
debugger is connected and that the computer is started with the /DEBUG
switch.
If exception code 0x80000002
occurs, the trap frame supplies additional information.
If you do not know the
specific cause of the exception, consider the following items:
- Hardware incompatibility. Make sure
that any new hardware installed is listed in the Microsoft Windows
Marketplace Tested Products List.
- Faulty device driver or system service. A
faulty device driver or system service might be responsible for this
error. Hardware issues, such as BIOS incompatibilities, memory
conflicts, and IRQ conflicts can also generate this error.
If the bug check message
lists a driver by name , disable or remove that driver. Also, disable
or remove any drivers or services that were recently added. If the
error occurs during the startup sequence and the system partition is
formatted with NTFS file system, you might be able to use Safe Mode to
rename or delete the faulty driver. If the driver is used as part of
the system startup process in Safe Mode, you have to start the computer
by using the Recovery Console to access the file.
If the problem is associated
with Win32k.sys, the source of the error might be a
third-party remote control program. If such software is installed, you
can remove the service by starting the system by using the Recovery
Console and then deleting the offending system service file.
Check the System Log in Event
Viewer for additional error messages that might help identify
the device or driver that is causing bug check 0x1E. You can disable
memory caching of the BIOS to try to resolve the error. You should also
run hardware diagnostics, especially the memory scanner, that the
system manufacturer supplies. For more information about these
procedures, see the owner's manual for your computer.
The error that generates
this message can occur after the first restart during Windows Setup, or
after Setup is finished. A possible cause of the error is lack of disk
space for installation and system BIOS incompatibilities. For problems
during Windows installation that are associated with lack of disk
space, reduce the number of files on the target hard disk drive. Check
for and delete any temporary files that you do not have to have,
Internet cache files, application backup files, and .chk files
that contain saved file fragments from disk scans. You can also use
another hard disk drive with more free space for the installation.
You can resolve BIOS
problems by upgrading the system BIOS version.
WinDbg
Output Example:
KERNEL_MODE_EXCEPTION_NOT_HANDLED
(8e)
This is a very common bugcheck. Usually the exception address
pinpoints
the driver/function that caused the problem. Always note this
address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This
means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should
never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this
breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 0000db6e, The address that the exception occurred at
Arg3: 00000000, Trap Frame
Arg4: 00000000
STOP 0x0000008F:
PP0_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819356.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559274(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
PP0_INITIALIZATION_FAILED bug check has a value of 0x0000008F. This bug
check indicates that the Plug and Play (PnP) manager could not be
initialized.
Parameters
None
Cause
An error occurred during
Phase 0 initialization of the kernel-mode PnP manager.
WinDbg
Output Example:
PP0_INITIALIZATION_FAILED
(8f)
This message occurs if phase 0 initialization of the kernel-mode Plug
and
Play Manager failed.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000090:
PP1_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819362.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559280(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
PP1_INITIALIZATION_FAILED bug check has a value of 0x00000090. This bug
check indicates that the Plug and Play (PnP) manager could not be
initialized.
Parameters
None
Cause
An error occurred during
Phase 1 initialization of the kernel-mode PnP manager.
Phase 1 is where most of the
initialization is done, including setting up the registry files and
other environment settings for drivers to call during the subsequent
I/O initialization.
WinDbg
Output Example:
PP1_INITIALIZATION_FAILED
(90)
This message occurs if phase 1 initialization of the kernel-mode Plug
and
Play Manager failed. This is where most of the initialization
is done,
including setting up the environment (registry, etc.) for drivers to
subsequently call during I/O init.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000091:
WIN32K_INIT_OR_RIT_FAILURE (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819363.aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (91)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000092:
UP_DRIVER_ON_MP_SYSTEM (go
to top of page)
Usual causes:
Wrong device driver loaded
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819366.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559285(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The UP_DRIVER_ON_MP_SYSTEM
bug check has a value of 0x00000092. This bug check indicates that a
uniprocessor-only driver has been loaded on a multiprocessor system.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The base address of the driver |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
A driver that is compiled to
work only on uniprocessor machines has been loaded, but the Microsoft
Windows operating system is running on a multiprocessor system with
more than one active processor.
WinDbg
Output Example:
UP_DRIVER_ON_MP_SYSTEM (92)
This message occurs if a UNIPROCESSOR only driver is loaded on a
MultiProcessor
system with more than one active processor.
Arguments:
Arg1: 0000000000000000, The Base address of the driver.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000093:
INVALID_KERNEL_HANDLE (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819369.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559292(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x93
Knowledge
Base Articles:
KB 816600 "Fatal
System
Error: 0x00000093" Error Message When You Install Apache SNMP on IBM
WebSphere Application Server (Server 2003)
WinDbg
Help File Entry:
The INVALID_KERNEL_HANDLE
bug check has a value of 0x00000093. This bug check indicates that an
invalid or protected handle was passed to NtClose.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The handle that is passed to NtClose
|
| 2 |
0: The caller tried to close a
protected handle
1: The caller tried to close an invalid handle
|
| 3 |
Reserved |
| 4 |
Reserved |
Cause
The INVALID_KERNEL_HANDLE
bug check indicates that some kernel code (for example, a server,
redirector, or another driver) tried to close an invalid handle or a
protected handle.
WinDbg
Output Example:
INVALID_KERNEL_HANDLE (93)
This message occurs if kernel code (server, redirector, other driver,
etc.)
attempts to close a handle that is not a valid handle.
Arguments:
Arg1: 00016f40, The handle that NtClose was called with.
Arg2: 00000000, means a protected handle was closed.
Arg3: 00000000
Arg4: 00000000
STOP 0x00000094:
KERNEL_STACK_LOCKED_AT_EXIT (go
to top of page)
Usual causes:
Memory, Device driver
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819372.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559296(v=VS.85).aspx
Knowledge
Base Articles:
KB 158517 Stop
0x000000094 Running Windows NT 4.0
and NFS Maestro
WinDbg
Help File Entry:
The
KERNEL_STACK_LOCKED_AT_EXIT bug check has a value of 0x00000094. This
bug check indicates that a thread exited while its kernel stack was
marked as not swappable
Parameters
None
WinDbg
Output Example:
KERNEL_STACK_LOCKED_AT_EXIT
(94)
This message occurs when a thread exits while its kernel stack is
marked as not swapable
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819375.aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (95)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000096:
INVALID_WORK_QUEUE_ITEM (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819378.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559300(v=VS.85).aspx
Knowledge
Base Articles:
KB 884587
You may receive Stop
error code 0x00000096 in Windows 2000 Server
WinDbg
Help File Entry:
The INVALID_WORK_QUEUE_ITEM
bug check has a value of 0x00000096. This bug check indicates that a
queue entry was removed that contained a null pointer.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The address of the queue entry whose flink
or blink field is NULL. |
| 2 |
The address of the queue that is being referenced.
Typically, this queue is an ExWorkerQueue. |
| 3 |
The base address of the ExWorkerQueue
array. (This address helps you determine if the queue in question is
indeed an ExWorkerQueue. If the queue is an ExWorkerQueue,
the offset from this parameter will isolate the queue.) |
| 4 |
Assuming the queue is an ExWorkerQueue,
this value is the address of the worker routine that would have been
called if the work item had been valid. (You can use this address to
isolate the driver that is misusing the work queue.) |
Cause
The INVALID_WORK_QUEUE_ITEM
bug check occurs when KeRemoveQueue removes a queue
entry whose flink or blink
field is NULL.
Any queue misuse can cause
this error. But typically this error occurs because worker thread work
items are misused.
An entry on a queue can be
inserted on the list only one time. When an item is removed from a
queue, its flink field is set to NULL. Then, when
this item is removed the second time, this bug check occurs.
In most situations, the
queue that is being referenced is an ExWorkerQueue
(executive worker queue). To help identify the driver that caused the
error, Parameter 4 displays the address of the worker routine
that would have been called if this work item had been valid. However,
if the queue that is being referenced is not an ExWorkerQueue,
this parameter is not useful.
WinDbg
Output Example:
INVALID_WORK_QUEUE_ITEM
(96)
This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null. This is almost always called by code
misusing
worker thread work items, but any queue misuse can cause
this. The rule
is that an entry on a queue may only be inserted on the list once. When
an
item is removed from a queue, it's flink field is set to NULL. This
bugcheck
occurs when remove queue attempts to remove an entry, but the flink or
blink
field is NULL. In order to debug this problem, you need to know the
queue being
referenced.
In an attempt to help identify the guilty driver, this bugcheck assumes
the
queue is a worker queue (ExWorkerQueue) and prints the worker routine as
parameter 4 below.
Arguments:
Arg1: 0000000000000000, The address of the queue entry whose
flink/blink field is NULL
Arg2: 0000000000000000, The address of the queue being references.
Usually this is one
of the ExWorkerQueues.
Arg3: 0000000000000000, The base address of the ExWorkerQueue array.
This will help determine
if the queue in question is an
ExWorkerQueue and if so, the offset from
this parameter will isolate the queue.
Arg4: 0000000000000000, If this is an ExWorkerQueue (which it usually
is), this is the address
of the worker routine that would have
been called if the work item was
valid. This can be used to isolate the
driver that is misusing the work
queue.
STOP 0x00000097:
BOUND_IMAGE_UNSUPPORTED (go
to top of page)
Usual causes:
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819381.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559303(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The BOUND_IMAGE_UNSUPPORTED
bug check has a value of 0x00000097.
This bug check appears very
infrequently.
WinDbg
Output Example:
BOUND_IMAGE_UNSUPPORTED
(97)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000098:
END_OF_NT_EVALUATION_PERIOD (go
to top of page)
Usual causes:
Exactly what it says
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819384.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559306(v=VS.85).aspx
Knowledge
Base Articles:
KB 242407 Windows
2000
System Year May Change to 2019 on ASUS P2B, P2B-D, P2B-F Mainboards
KB 250920 Windows
2000
Evaluation Copy Expiration Behavior
KB 818025 Windows
2003 Server
evaluation copy expiration behavior
WinDbg
Help File Entry:
The
END_OF_NT_EVALUATION_PERIOD bug check has a value of 0x00000098. This
bug check indicates that the trial period for the Microsoft Windows
operating system has ended.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The low-order 32 bits of the product expiration date |
| 2 |
The high-order 32 bits of the product expiration date |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
Your installation of the
Windows operating system is an evaluation unit with an expiration date.
The trial period is over.
WinDbg
Output Example:
END_OF_NT_EVALUATION_PERIOD
(98)
Your Windows System is an evaluation unit with an expiration date. The
trial
period is over.
Arguments:
Arg1: 0000000000000000, The low order 32 bits of your product
expiration date
Arg2: 0000000000000000, The high order 32 bits of your product
expiration date
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000099:
INVALID_REGION_OR_SEGMENT (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819386.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559312(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
INVALID_REGION_OR_SEGMENT bug check has a value of 0x00000099. This bug
check indicates that ExInitializeRegion or ExInterlockedExtendRegion
was called with an invalid set of parameters.
Parameters
None
WinDbg
Output Example:
INVALID_REGION_OR_SEGMENT
(99)
ExInitializeRegion or ExInterlockedExtendRegion was called with an
invalid
set of parameters.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000009A:
SYSTEM_LICENSE_VIOLATION (go
to top of page)
Usual causes:
See parameters for description
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819392.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559317(v=VS.85).aspx
Knowledge
Base Articles:
KB 192821 STOP
0x0000009A During Restore of Registry (NT)
WinDbg
Help File Entry:
The SYSTEM_LICENSE_VIOLATION
bug check has a value of 0x0000009A. This bug check indicates that the
software license agreement has been violated.
Parameters
The following parameters
appear on the blue screen. Parameter 1 indicates the type of
violation. The meaning of the other parameters depends on the value of
Parameter 1.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause |
| 0x00 |
0: The product should be WinNT
1: The product should be LanmanNT or ServerNT
|
A partial serial number |
The first two characters of the product type from the
product options |
Offline product type changes have been attempted. |
| 0x01 |
The registered evaluation time from source 1 |
A partial serial number |
The registered evaluation time from an alternate source
|
Offline changes to the Microsoft Windows evaluation
unit time period have been attempted. |
| 0x02 |
The status code that is associated with the open failure |
0 |
0 |
The setup key could not be opened. |
| 0x03 |
The status code that is associated with the key lookup
failure |
0 |
0 |
The SetupType or SetupInProgress value from the setup
key is missing, so setup mode could not be detected. |
| 0x04 |
The status code that is associated with the key lookup
failure |
0 |
0 |
The SystemPrefix value from the
setup key is missing. |
| 0x05 |
(See the setup code) |
An invalid value was found in licensed processors |
The officially licensed number of processors |
Offline changes to the number of licensed processors
have been attempted. |
| 0x06 |
The status code that is associated with the open
failure |
0 |
0 |
The ProductOptions key could not be
opened. |
| 0x07 |
The status code that is associated with the read
failure |
0 |
0 |
The ProductType value could not be
read. |
| 0x08 |
The status code that is associated with the Change
Notify failure |
0 |
0 |
Change Notify on ProductOptions
failed. |
| 0x09 |
The status code that is associated with the Change
Notify failure |
0 |
0 |
Change Notify on SystemPrefix
failed. |
| 0x0A |
0 |
0 |
0 |
An NTW system was converted to an NTS system. |
| 0x0B |
The status code that is associated with the change
failure |
0 |
0 |
The reference of the setup key failed. |
| 0x0C |
The status code that is associated with the change
failure |
0 |
0 |
The reference of the product options key failed. |
| 0x0D |
The status code that is associated with the failure |
0 |
0 |
The attempt to open ProductOptions
in the worker thread failed. |
| 0x0F |
The status code that is associated with the failure |
0 |
0 |
The attempt to open the setup key failed. |
| 0x10 |
The status code that is associated with the failure |
0: set value failed
1: Change Notify failed
|
0 |
A failure occurred in the setup key worker thread. |
| 0x11 |
The status code that is associated with the failure |
0: set value failed
1: Change Notify failed
|
0 |
A failure occurred in the product options key worker
thread. |
| 0x12 |
The status code that is associated with the failure |
0 |
0 |
Unable to open the LicenseInfoSuites
key for the suite. |
| 0x13 |
The status code that is associated with the failure |
0 |
0 |
Unable to query the LicenseInfoSuites
key for the suite. |
| 0x14 |
The size of the memory allocation |
0 |
0 |
Unable to allocate memory. |
| 0x15 |
The status code that is associated with the failure |
Reserved |
0 |
Unable to reset the ConcurrentLimit
value for the suite key. |
| 0x16 |
The status code that is associated with the failure |
0 |
0 |
Unable to open the license key for a suite product. |
| 0x17 |
The status code that is associated with the failure |
0 |
0 |
Unable to reset the ConcurrentLimit
value for a suite product. |
| 0x18 |
The status code that is associated with the open
failure |
Reserved |
0 |
Unable to start the Change Notify for the LicenseInfoSuites. |
| 0x19 |
0 |
0 |
0 |
A suite is running on a system that must be PDC. |
| 0x1A |
The status code that is associated with the failure |
0 |
0 |
A failure occurred when enumerating the suites. |
| 0x1B |
0 |
0 |
0 |
Changes to the policy cache were attempted. |
Cause
The Microsoft Windows
operating system detects a violation of the software license agreement.
A user might have tried to
change the product type of an offline system or change the trial period
of an evaluation unit of Windows. For more information about the
specific violation, see the parameter list.
WinDbg
Output Example:
SYSTEM_LICENSE_VIOLATION
(9a)
A violation of the software license agreement has occurred. This can be
due to
either attempting to change the product type of an offline system, or
an attempt
to change the trial period of an evaluation unit of Windows.
Arguments:
Arg1: 0000000000000000, means that offline product type changes were
attempted
Arg2: 0000000000000000, if 1, product should be LanmanNT or ServerNT.
If 0, should be WinNT
Arg3: 0000000000000000, partial serial number
Arg4: 0000000000000000, first two characters of product type from
product options.
Usual causes:
Disk corruption, File system corruption, SCSI/IDE drivers, Memory,
Insufficient memory
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819394.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559318(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The UDFS_FILE_SYSTEM bug
check has a value of 0x0000009B. This bug check indicates that a
problem occurred in the UDF file system.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The source file and line number information. The high
16 bits (the first four hexadecimal digits after the "0x") identify the
source file by its identifier number. The low 16 bits identify the
source line in the file where the bug check occurred. |
| 2 |
If UdfExceptionFilter is on the
stack, this parameter specifies the address of the exception record. |
| 3 |
If UdfExceptionFilter is on the
stack, this parameter specifies the address of the context record. |
| 4 |
Reserved. |
Cause
The UDFS_FILE_SYSTEM bug
check might be caused disk corruption. Corruption in the file system or
bad blocks (sectors) on the disk can induce this error. Corrupted SCSI
and IDE drivers can also adversely affect the system's ability to read
and write to the disk and cause the error.
This bug check might also
occur if nonpaged pool memory is full. If the nonpaged pool memory is
full, this error can stop the system. However, during the indexing
process, if the amount of available nonpaged pool memory is very low,
another kernel-mode driver that requires nonpaged pool memory can also
trigger this error.
Resolving the Problem
To debug this
problem: Use the .cxr (Display
Context Record) command with Parameter 3,
and then use kb (Display
Stack Backtrace).
To resolve a disk
corruption problem: Check Event Viewer for error messages
from SCSI and FASTFAT (System Log) or Autochk (Application Log) that
might help identify the device or driver that is causing the error.
Disable any virus scanners, backup application, or disk defragmenter
tools that continually monitor the system. You should also run hardware
diagnostics that the system manufacturer supplies. For more information
about these procedures, see the owner's manual for your computer. Run Chkdsk /f /r
to detect and resolve any file system structural corruption. You must
restart the system before the disk scan begins on a system partition.
To resolve a
nonpaged pool memory depletion problem: Add new physical
memory to the computer. This memory increases the quantity of nonpaged
pool memory that is available to the kernel.
WinDbg
Output Example:
UDFS_FILE_SYSTEM (9b)
If you see UdfExceptionFilter on the
stack then the 2nd and 3rd
parameters are the exception record and
context record. Do a .cxr
on the 3rd parameter and then kb to
obtain a more helpful stack
trace.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000009C:
MACHINE_CHECK_EXCEPTION (go
to top of page)
Usual causes:
Hardware error (similar to STOP 0x124)
MSDN Listing
(Win2K ResKit):
http://msdn.microsoft.com/en-us/library/ms819396.aspx
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559323(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x9c
Knowledge
Base Articles:
KB 162363 Understanding
and troubleshooting the "Stop 0x0000009C" screen (NT, 2000, XP, Server 2003)
KB 329284 Stop
error
message in Windows XP
that you may receive: "0x0000009C (0x00000004, 0x00000000, 0xb2000000,
0x00020151)"
KB 840551
Intermittent errors in IA64 editions of Windows Server 2003: Stop error code 0x0000009C
(MACHINE_CHECK_EXCEPTION), Stop error code 0x00000024
(NTFS_FILE_SYSTEM), or Stop error code 0x0000000A
(IRQL_NOT_LESS_OR_EQUAL)
KB 910621 Error
message
when you run a Hardware Compatibility Test on a computer that is
running Windows Server
2003 for Itanium-based Systems: "Stop 0x0000009C"
KB 939315 Windows
2003 Server
evaluation copy expiration behavior
WinDbg
Help File Entry:
The MACHINE_CHECK_EXCEPTION
bug check has a value of 0x0000009C. This bug check indicates that a
fatal machine check exception has occurred.
Parameters
The four parameters that are
listed in the message have different meanings, depending on the
processor type.
If the processor is based on
an older x86-based architecture and has the Machine Check Exception
(MCE) feature but not the Machine Check Architecture (MCA) feature (for
example, the Intel Pentium processor), the parameters have the
following meaning.
| Parameter |
Description |
| 1 |
The low 32 bits of P5_MC_TYPE Machine Service Report
(MSR) |
| 2 |
The address of the MCA_EXCEPTION structure |
| 3 |
The high 32 bits of P5_MC_ADDR MSR |
| 4 |
The low 32 bits of P5_MC_ADDR MSR |
If the processor is based on
a newer x86-based architecture and has the MCA feature and the MCE
feature (for example, any Intel Processor of family 6 or higher, such
as Pentium Pro, Pentium IV, or Xeon), or if the processor is an
x64-based processor, the parameters have the following meaning.
| Parameter |
Description |
| 1 |
The bank number |
| 2 |
The address of the MCA_EXCEPTION structure |
| 3 |
The high 32 bits of MCi_STATUS MSR for the MCA bank
that had the error |
| 4 |
The low 32 bits of MCi_STATUS MSR for the MCA bank that
had the error |
On an Itanium-based
processor, the parameters have the following meaning.
Note Parameter 1
indicates the type of violation.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause |
| 0x1 |
The address of the log |
The size of the log |
0 |
|
| 0x2 |
The address of the log |
The size of the log |
The error code |
The system abstraction layer (SAL) returned an error
for SAL_GET_STATEINFO while processing MCA. |
| 0x3 |
The address of the log |
The size of the log |
The error code |
SAL returned an error for SAL_CLEAR_STATEINFO while it
processed MCA. |
| 0x4 |
The address of the log |
The size of the log |
0 |
Firmware (FW) reported a fatal MCA. |
| 0x5 |
The address of the log |
The size of the log |
0 |
There are two possible causes:
- SAL reported a recoverable MCA, but this recovery is
not currently supported.
- SAL generated an MCA but could not produce an error
record.
|
| 0xB |
The address of the log |
The size of the log |
0 |
|
| 0xC |
The address of the log |
The size of the log |
The error code |
SAL returned an error for SAL_GET_STATEINFO while
processing an INIT event. |
| 0xD |
The address of the log |
The size of the log |
The error code |
SAL returned an error for SAL_CLEAR_STATEINFO while it
processed an INIT event. |
| 0xE |
The address of the log |
The size of the log |
0 |
|
Comments
For more information about
Machine Check Architecture (MCA), see the Intel or AMD Web sites.
Note Starting
with Windows Vista, this bug check is no longer supported, and
has been replaced with bug
Check 0x124: WHEA_UNCORRECTABLE_ERROR.
WinDbg
Output Example:
MACHINE_CHECK_EXCEPTION
(9c)
A fatal Machine Check Exception has occurred.
KeBugCheckEx parameters;
x86 Processors
If the processor has ONLY MCE feature available (For example Intel
Pentium), the parameters are:
1 - Low 32 bits of P5_MC_TYPE MSR
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of P5_MC_ADDR MSR
4 - Low 32 bits of P5_MC_ADDR MSR
If the processor also has MCA feature available (For example Intel
Pentium Pro), the parameters are:
1 - Bank number
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had
the error
IA64 Processors
1 - Bugcheck Type
1 - MCA_ASSERT
2 - MCA_GET_STATEINFO
SAL returned an error for SAL_GET_STATEINFO while processing MCA.
3 - MCA_CLEAR_STATEINFO
SAL returned an error for SAL_CLEAR_STATEINFO while processing MCA.
4 - MCA_FATAL
FW reported a fatal MCA.
5 - MCA_NONFATAL
SAL reported a recoverable MCA and we don't support currently
support recovery or SAL generated an MCA and then couldn't
produce an error record.
0xB - INIT_ASSERT
0xC - INIT_GET_STATEINFO
SAL returned an error for SAL_GET_STATEINFO while processing INIT event.
0xD - INIT_CLEAR_STATEINFO
SAL returned an error for SAL_CLEAR_STATEINFO while processing INIT
event.
0xE - INIT_FATAL
Not used.
2 - Address of log
3 - Size of log
4 - Error code in the case of x_GET_STATEINFO or x_CLEAR_STATEINFO
AMD64 Processors
1 - Bank number
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had
the error
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (9d)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000009E:
USER_MODE_HEALTH_MONITOR (go
to top of page)
Usual causes:
Failure of critical user-mode component(s)
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559326(v=VS.85).aspx
Knowledge
Base Articles:
KB 960228
You receive a Stop
error when you click the arrow to scroll down an application pop-up
menu on a Windows
Server 2003 SP1 or SP2-based computer
KB 2135160 FIX: "0x0000009E" Stop
error when you host Hyper-V virtual machines in a Windows Server 2008 R2-based
failover cluster
KB 2520235 "0x0000009E" Stop error
when you add an extra storage disk to a failover cluster in Windows Server 2008 R2
KB 2814923
"0x0000009E" Stop error and disk volumes cannot be brought online on a Windows
Server 2008 R2-based failover cluster
KB 2863960
Stop error message on Windows Server 2012-based
computer: "DRIVER_IRQL_NOT_LESS_OR_EQUAL" or "USER_MODE_HEALTH_MONITOR"
WinDbg
Help File Entry:
The USER_MODE_HEALTH_MONITOR
bug check has a value of 0x0000009E. This bug check indicates that one
or more critical user-mode components failed to satisfy a health check.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The process that failed to satisfy a health check in
the configured time-out |
| 2 |
The health monitoring time-out, in seconds |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
Hardware mechanisms, such as
watchdog timers, can detect that basic kernel services are not
executing. However, resource starvation issues (including memory leaks,
lock contention, and scheduling priority misconfiguration) can block
critical user-mode components without blocking deferred procedure calls
(DPCs) or draining the non-paged pool.
Kernel components can extend
watchdog timer functionality to user mode by periodically monitoring
critical applications. This bug check indicates that a user-mode health
check failed in a way that prevents graceful shutdown. This bug check
restores critical services by restarting or enabling application
failover to other servers.
On the Microsoft Windows
Server 2003, Enterprise Edition, Windows Server 2003,
Datacenter Edition, and Windows 2000 with Service
Pack 4 (SP4) operating systems, a user-mode hang can also
cause this bug check. The bug check occurs in this situation only if
the user has set HangRecoveryAction to a value of 3.
WinDbg
Output Example:
USER_MODE_HEALTH_MONITOR
(9e)
One or more critical user mode components failed to satisfy a health
check.
Hardware mechanisms such as watchdog timers can detect that basic kernel
services are not executing. However, resource starvation issues,
including
memory leaks, lock contention, and scheduling priority misconfiguration,
may block critical user mode components without blocking DPCs or
draining the nonpaged pool.
Kernel components can extend watchdog timer functionality to user mode
by periodically monitoring critical applications. This bugcheck
indicates
that a user mode health check failed in a manner such that graceful
shutdown is unlikely to succeed. It restores critical services by
rebooting and/or allowing application failover to other servers.
Arguments:
Arg1: 0000000000000000, Process that failed to satisfy a health check
within the
configured timeout
Arg2: 0000000000000000, Health monitoring timeout (seconds)
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000009F:
DRIVER_POWER_STATE_FAILURE (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559329(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x9f
Knowledge
Base Articles:
Troubleshooting
specific Stop messages
KB 246243 Troubleshooting
STOP 0x9F Error Messages in Windows (2000)
KB 263560 Stop
0x0000009F During Shutdown, Standby, or Restart (2000)
KB 271838 "Stop
0x0000009F" in Autosave.sys When Shutting Down Windows 2000
KB 314101 Computer
Hangs During Shutdown or Displays a "Cannot Find Enough Free Resources"
Error Message (XP)
KB 315249 Troubleshooting
a Stop 0x9F Error in Windows XP
KB 832452 You
receive a
"STOP: 0x0000009F" error when you shut down or restart a Windows 2000-based
computer
KB 929762 You
receive a
Stop 0x9F error when you wake a Windows Vista-based
computer that is connected to an IEEE 1394-based device
KB 931671 Error
message
when you put a Windows Vista-based
computer to sleep while a PPP connection is active: "STOP 0x0000009F"
KB 932755
An updated Storport
storage driver is available for Windows Server
2003
KB 937322 Stop
error message when you run the "Common Scenario Stress with IO" test,
print to a shared printer on the network, or perform a power management
operation on a Windows Vista-based
computer: "Stop 0x0000009F"
KB 941858 You
receive a
Stop error message when you put a Windows Vista-based
computer to sleep or into hibernation, or when you resume the computer
from sleep or from hibernation: "0x0000009F DRIVER_POWER_STATE_FAILURE"
KB 946988 Stop
error
message when you try to put a Windows Vista-based
computer to sleep while a dial-up network connection is active: "STOP:
0x0000009F"
KB 954429 You
experience problems on a multiprocessor computer that is running
Windows Server
2003, Windows Vista,
or Windows Server
2008 when you
resume the computer from hibernation
KB 957126 Error
message
when you try to resume a computer that is running Windows Vista
or Windows Server
2008 from hibernation: "STOP 0x0000009F"
KB 960884
If you repeatedly
unplug and re-plug a 1394a hard disk on a Windows Vista-based or Windows Server 2008-based computer that has two
1394a hard disks, the other 1394a hard disk becomes inaccessible
KB 962201 Error
message
when you put a Windows Vista-based
or a Windows Server
2008-based computer to sleep, or you wake the computer up:
"STOP: 0x0000009F"
KB 972109 The shutdown
process does not finish, and you receive an error message on a computer
that is running Windows Vista
or Windows Server
2008: "Stop 0x0000009F"
KB 975599 Stop error when you put
a computer that is running Windows 7 or Windows Server 2008 R2 to
sleep or into hibernation, or when you restart the computer: "0x9F"
KB 977186 Error message when you
try to resume a Windows
7-based or a Windows Server 2008 R2-based
computer from hibernation: "Stop 0x0000009F"
KB 979148 "0x0000009F" or
"0x000000A0" Stop errors on a computer that is running Windows Vista or Windows Server 2008 when a USB
webcam is set as the default audio device
KB 981848 "0x0000009F" Stop error
message when a computer enters and resumes from hibernation in Windows 7 or Windows Server 2008 R2
KB /982091
"Stop 0x9F" or "Stop 0xFE" error on a Windows
7-based or Windows Vista-based
computer that uses certain AMD USB EHCI host controllers
KB 2315295 "0x0000009F" Stop error
when you resume a computer that is running Windows Server 2008 R2 or Windows 7 from sleep
KB 2459268 "0x0000009F"
Stop error in Windows 7
or in Windows Server
2008 R2 when the computer enters or resumes from the Soft Off
(S5) power state
KB 2482122 "0x0000009F" Stop error
when you restart a Windows 7-based or
Windows Server 2008 R2-based computer
that has certain Wi-Fi drivers installed
KB 2677930
0x0000009F Stop error in Windows 7
during sleep operation
KB 2690653
An update is available for Windows 8 Consumer
Preview
KB 2720599
"0x0000009F" Stop error when you resume a computer from hibernation in
Windows 7 or in Windows
Server 2008 R2
KB 2813621
"0x0000009F" Stop error when a website turns on a webcam in
Windows 8
KB 2911204
Stop error 0x9F in the mf.sys driver occurs in Windows (Windows
7/Windows 8.1/Server
2008 R2/Server 2012 R2)
More BSOD articles at this link:
http://search.microsoft.com/results.aspx?mkt=en-US&q=stop%3A%200x0000009f&qsc0=0&l=1&first=1&FORM=PEME
WinDbg
Help File Entry:
The
DRIVER_POWER_STATE_FAILURE bug check has a value of 0x0000009F. This
bug check indicates that the driver is in an inconsistent or invalid
power state.
Parameters
The following parameters
appear on the blue screen. Parameter 1 indicates the type of
violation.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause |
| 0x1 |
The device object |
Reserved |
Reserved |
The device object that is being freed still has an
outstanding power request that it has not completed. |
| 0x2 |
The target device's device object, if it is available |
The device object |
The driver object, if it is available |
The device object completed the I/O request packet
(IRP) for the system power state request, but it failed to call PoStartNextPowerIrp. |
| 0x3 (Windows 2000 only) |
A pointer to the target device object |
A pointer to the device object |
The IRP |
The device driver did not properly set the IRP as
"pending" or complete the IRP. |
| 0x3 (Windows XP and later) |
The physical device object (PDO) of the stack |
The functional device object (FDO) of the stack |
The blocked IRP |
A device object has been blocking an IRP for too long a
time. |
| 0x100 (Windows 2000 only) |
A pointer to the nonpaged device object |
A pointer to the target device object |
A pointer to the device object to notify |
The device objects in the devnode inconsistently used
DO_POWER_PAGABLE. |
| 0x101 (Windows 2000 only) |
The child device object (FDO) |
The child device object (PDO) |
The parent device object |
A parent device object has detected that a child device
has not set the DO_POWER_PAGABLE bit. |
| 0x500 (Windows XP and Windows
Server 2003 only) |
Reserved |
The target device's device object, if available |
Device object |
The device object completed the IRP for the system
power state request, but it failed to call PoStartNextPowerIrp.
|
Cause
For a description of the
possible causes, see the description of each code in the Parameters
section.
The errors that cause
Parameter 1 to be 0x3, 0x100, or 0x101 only exist in Microsoft
Windows 2000. In Windows XP and later versions of
Windows, these errors are superseded by Driver Verifier tests. For more
information about Driver Verifier, see the Driver Verifier section of
the Windows Driver Kit.
WinDbg
Output Example:
DRIVER_POWER_STATE_FAILURE
(9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 00000003, A device object has been blocking an Irp for too long a
time
Arg2: 8970a028, Physical Device Object of the stack
Arg3: 89709ac8, Functional Device Object of the stack
Arg4: 8aa33d50, The blocked IRP
Usual causes:
See parameters for details
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff559341(v=VS.85).aspx
Knowledge
Base Articles:
KB 314118 Device
Driver
Error Message Is Generated When the Computer Enters Standby or
Hibernate Mode (XP)
KB 320899 Windows
XP
Generates a "Stop 0xA0" Error Message During Hibernation
KB 942524 Stop
error
message when you put a Windows Vista-based
computer in hibernation: "STOP: 0x000000A0 (0x00000009, 0xc0000001,
0x00000001, 0x00000000) INTERNAL_POWER_ERROR (a0)"
KB 956871 The system
may crash when you put a Windows Vista-based
computer or a Windows Server
2008-based computer into hibernation
KB 969853 Stop
error
message when you try to put a Windows Vista-based
computer or a Windows Server
2008-based computer into hibernation: "STOP: 0x000000A0
(0x00000009, 0xc000009a, 0x00000000, 0x00000000) INTERNAL_POWER_ERROR
(a0)"
KB 974772 Error
when entering Hibernation on a Windows 7-based
computer: “STOP 0x000000A0 INTERNAL_POWER_ERROR (0x0000000B,
0x????????, 0x????????, 0x????????)”
KB 979148 "0x0000009F" or
"0x000000A0" Stop errors on a computer that is running Windows Vista or Windows Server 2008 when a USB
webcam is set as the default audio device
KB 2823506
"0x000000A0" Stop error when you resume Windows 8
or Windows Server 2012 from hibernate
More BSOD articles at this link:
http://search.microsoft.com/results.aspx?mkt=en-US&q=stop%3A%200x000000a0&qsc0=0&l=1&first=1&FORM=PEME
WinDbg
Help File Entry:
The INTERNAL_POWER_ERROR bug
check has a value of 0x000000A0. This bug check indicates that the
power policy manager experienced a fatal error.
Parameters
The following parameters
appear on the blue screen. Parameter 1 indicates the type of
violation. The meaning of the other parameters depends on the value of
Parameter 1.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause |
| 0x1 |
1: A device has overrun its maximum
number of reference counts.
2, 3, or 4: (Windows
Server 2003, Windows XP, and Windows 2000
only ) Too many inrush power IRPs have been queued.
5: (Windows Server 2003,
Windows XP, and Windows 2000 only) The
power IRP has been sent to a passive level device object.
|
Except when Parameter 2 is equal to 5, this
parameter indicates the maximum number of pending IRPs that are allowed.
If Parameter 2 is equal to 5, this parameter is reserved.
|
Reserved |
An error occurred during the handling of the power I/O
request packet (IRP). |
| 0x2 |
Reserved |
Reserved |
Reserved |
An internal failure has occurred while attempting to
process a power event. |
| 0x3 |
The expected checksum |
The actual checksum |
The line number of the failure |
The checksum for a hibernation context page does not
match its expected checksum. |
| 0x4 |
The expected checksum |
The actual checksum |
The line number of the failure |
The checksum for a page about to be written to the
hibernation file does not match its expected checksum. |
| 0x5 |
Reserved |
Reserved |
Reserved |
An unknown shutdown code has been sent to the system
shutdown handler. |
| 0x7 |
Reserved |
Reserved |
Reserved |
An unhandled exception has occurred. |
| 0x8 |
|
|
|
A fatal error occurred while processing a system power
event.
(See the following table for more details.)
|
0x9
(see link) |
|
|
|
Parameter 1 of 0x9 = A fatal error occured
while preparing the hibernate file
|
When Parameter 1
is0x8, a fatal error occurred while processing a system power event. In
this situation, Parameter 2 indicates the cause of the error.
The meaning of the other parameters depends on the value of
Parameter 2.
| Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause |
| 0x100 |
The device object |
The address of the POWER_CHANNEL_SUMMARY structure (a
record of device object states) |
An unknown device type is being processed. |
| 0x101 |
Exception pointer |
Reserved |
An unhandled exception occurred. |
| 0x102 |
The address of the DUMP_INITIALIZATION_CONTEXT
structure, which contains the information that is passed from the
system to the disk dump driver during the driver's initialization |
The address of the POP_HIBER_CONTEXT structure, which
contains information about the state of the computer before hibernation |
The hibernation working buffer size is not
page-aligned. |
| 0x103 |
The address of the POP_HIBER_CONTEXT structure |
Reserved |
Some working pages were not accounted for during the
hibernation process. |
| 0x104 |
The address of the POP_HIBER_CONTEXT structure |
Reserved |
An attempt was made to map internal hibernation memory
while the internal memory structures were locked. |
| 0x105 |
The address of the POP_HIBER_CONTEXT structure |
Reserved |
An attempt was made to map internal hibernation memory
with an unsupported memory type flag. |
| 0x106 |
The MDL |
Reserved |
A memory descriptor list (MDL) was created during the
hibernation process that describes memory that is not paged-aligned. |
| 0x107 |
The address of the POP_HIBER_CONTEXT structure |
The address of the PO_MEMORY_RANGE_ARRAY structure |
A data mismatch occurred in the internal hibernation
data structures. |
| 0x108 |
The address of the POP_HIBER_CONTEXT structure |
Reserved |
The disk subsystem failed to properly write part of the
hibernation file. |
| 0x109 |
The expected checksum |
The actual checksum |
The checksum for the processor state data does not
match its expected checksum. |
| 0x10A |
The address of the POP_HIBER_CONTEXT structure |
The NTSTATUS failure code |
The disk subsystem failed to properly write part of the
hibernation file. |
| 0x200 |
The device object |
The address of the DEVICE_OBJECT_POWER_EXTENSION
notification structure |
An unknown device type is being checked for an idle
state. |
| 0x300 |
The device object |
The IRP |
An unknown status was returned from a battery power
IRP. |
| 0x301 |
The device object |
The IRP |
The battery has entered an unknown state. |
| 0x400 |
The IRP stack location |
The device object |
A device has overrun its maximum number of reference
counts. |
0x401,
0x402,
or
0x403 |
The pending IRP list |
The device object |
(Windows Server 2003,
Windows XP, and Windows 2000 only) Too
many inrush power IRPs have been queued. |
| 0x404 |
The IRP stack location |
The device object |
(Windows Server 2003,
Windows XP, and Windows 2000 only) A power
IRP has been sent to a passive level device object. |
| 0x500 |
The IRP |
The device object |
An unknown status was returned from a thermal power
IRP. |
Cause
For more information about
the exact cause for the INTERNAL_POWER_ERROR bug check, see the tables
in the Parameters section above.
Resolving the Problem
The following procedures
will help you debug certain instances of this bug check.
Debugging bug
check 0xA0 when Parameter 1 equals 0x2
- Examine the stack. Look for the ntoskrnl!PopExceptionFilter
function. This function contains the following code as
its first argument.
(error_code << 16) | _LINE_
If the caller is PopExceptionFilter,
the first argument to this function is of type PEXCEPTION_POINTERS.
Note the value of this argument.
- Use the dt (Display
Type) command and specify the value that you found
in the previous step as argument.
dt nt!_EXCEPTION_POINTERS argument
. This command displays the structure. Note the address of
the context record.
- Use the .cxr (Display
Context Record) command and specify the context
record that you found in the previous step as record.
.cxr record
. This command sets the register
context to the proper value.
- Use a variety of commands to analyze the source of the
error. Start with kb (Display
Stack Backtrace) .
Debugging bug
check 0xA0 when Parameter 1 equals 0x7
- Examine the stack. Look for the ntoskrnl!PopExceptionFilter
function. The first argument to this function is of type
PEXCEPTION_POINTERS. Note the value of this argument.
- Use the dt (Display
Type) command and specify the value that you found
in the previous step as argument.
dt nt!_EXCEPTION_POINTERS argument
This command displays the structure. Note the address of
the context record.
- Use the .cxr (Display
Context Record) command and specify the context
record that you found in the previous step as record.
.cxr record
This command sets the register
context to the proper value.
- Use a variety of commands to analyze the source of the
error. Start with kb (Display
Stack Backtrace) .
Debugging bug
check 0xA0 when Parameter 1 equals 0x8 and
Parameter 2 equals 0x101
- Use the dt (Display
Type) command and specify the value of
Parameter 3 as argument.
dt nt!_EXCEPTION_POINTERS argument
This command displays the structure. Note the address of
the context record.
- Use the .cxr (Display
Context Record) command and specify the context
record that you found the previous step as record.
.cxr record
This command sets the register
context to the proper value.
- Use a variety of commands to analyze the source of the
error. Start with kb (Display
Stack Backtrace) .
WinDbg
Output Example:
INTERNAL_POWER_ERROR (a0)
The power policy manager experienced a fatal error.
Arguments:
Arg1: 0000000000000000,
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
From a recent dump file that I
ran into here: http://www.sevenforums.com/crashes-debugging/84490-bsod-hibernating-windows-7-a.html#post731741
INTERNAL_POWER_ERROR (a0)
The power policy manager experienced a fatal error.
Arguments:
Arg1: 0000000000000009, A fatal error occured while preparing the
hibernate file.
Arg2: ffffffffc0000185, Status code (Status code translates to :
STATUS_IO_DEVICE_ERROR)
Arg3: 0000000000000001, Mirroring phase
Arg4: 0000000000000000
STOP 0x000000A1:
PCI_BUS_DRIVER_INTERNAL (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560101(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The PCI_BUS_DRIVER_INTERNAL
bug check has a value of 0x000000A1. This bug check indicates that the
PCI Bus driver detected inconsistency problems in its internal
structures and could not continue.
Parameters
None
WinDbg
Output Example:
PCI_BUS_DRIVER_INTERNAL
(a1)
The PCI Bus driver detected inconsistency
problems in its internal structures and could not continue.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Memory, Pagefile corruption, Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560105(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The MEMORY_IMAGE_CORRUPT bug
check has a value of 0x000000A2. This bug check indicates that
corruption has been detected in the image of an executable file in
memory.
Parameters
The following parameters
appear on the blue screen. Parameter 1 indicates the type of
violation. The meaning of the other parameters depends on the value of
Parameter 1.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause |
| 0x02 |
If Parameter 3 is zero: The
page number in the table page that failed
If Parameter 3 is nonzero: The page
number with the failing page run index
|
Zero, or the index that failed to match the run |
0 |
A table page check failure occurred. |
| 0x03 |
The starting physical page number of the range |
The length (in pages) of the range |
The page number of the table page that contains this
run |
The checksum for the range of memory listed is
incorrect. |
Cause
A cyclic redundancy check
(CRC) check on the memory range has failed.
On a system wake operation,
various regions of memory might be checked to guard against memory
failures.
WinDbg
Output Example:
MEMORY_IMAGE_CORRUPT (a2)
On a system wake operation, various regions of memory may be CRCed to
guard against memory failures.
Arguments:
Arg1: 0000000000000000,
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560106(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The ACPI_DRIVER_INTERNAL bug
check has a value of 0x000000A3. This bug check indicates that the ACPI
driver detected an internal inconsistency.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
Reserved |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
An inconsistency in the ACPI
driver is so severe that continuing to run would cause serious
problems.
One possible source of this
problem is a BIOS error.
WinDbg
Output Example:
ACPI_DRIVER_INTERNAL (a3)
The ACPI Driver detected an internal inconsistency. The inconsistency is
so severe that continuing to run would cause serious problems.
The ACPI driver calls this when the state is so inconsistent that
proceeding
would actually be dangerous. The problem may or may not be a BIOS
issue, but
there is no way to tell.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000A4:
CNSS_FILE_SYSTEM_FILTER (go
to top of page)
Usual causes:
Memory, Indexing, Insufficient memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560110(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The CNSS_FILE_SYSTEM_FILTER
bug check has a value of 0x000000A4. This bug check indicates that a
problem occurred in the CNSS file system filter.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
Specifies source file and line number information. The
high 16 bits (the first four hexadecimal digits after the "0x")
identify the source file by its identifier number. The low 16 bits
identify the source line in the file where the bug check occurred. |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
The CNSS_FILE_SYSTEM_FILTER
bug check might occur because nonpaged pool memory is full. If the
nonpaged pool memory is completely full, this error can stop the
system. However, during the indexing process, if the amount of
available nonpaged pool memory is very low, another kernel-mode driver
that requires nonpaged pool memory can also trigger this error.
Resolving the Problem
To resolve a
nonpaged pool memory depletion problem: Add new physical
memory to the computer. This memory sincrease the quantity of nonpaged
pool memory available to the kernel.
WinDbg
Output Example:
CNSS_FILE_SYSTEM_FILTER
(a4)
See the comment for FAT_FILE_SYSTEM
(0x23)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
BIOS
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560114(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xa5
Knowledge
Base Articles:
KB 256841 "STOP
0x000000A5" When Installing Windows 2000
KB 314830 "Stop
0x000000A5" Error When You Are Installing Windows XP
KB 831691 "Stop
0x000000A5 the ACPI BIOS in the system is not fully compliant with the
ACPI specification" error message when the computer resumes from
hibernation (XP)
KB 935806 Troubleshooting
Stop error messages that may occur when you try to install Windows Vista
KB 969179 A Windows XP-based
computer becomes unresponsive or displays a "STOP 0x000000A5" error
message during system shutdown
WinDbg
Help File Entry:
The ACPI_BIOS_ERROR bug
check has a value of 0x000000A5. This bug check indicates that the
Advanced Configuration and Power Interface (ACPI) BIOS of the computer
is not fully compliant with the ACPI specification.
Parameters
Four bug check parameters
appear on the blue screen. Parameter 1 indicates the kind of
the incompatibility. The meaning of the other parameters depends on the
value of Parameter 1.
If the BIOS incompatibility
is related to Plug and Play (PnP) or power management, the following
parameters are used.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause |
| 0x01 |
ACPI's deviceExtension |
ACPI's ResourceList |
0: No resource list is found
1: No IRQ resource is found in list
|
ACPI cannot find the System Control Interrupt (SCI)
vector in the resources that are handed to it when ACPI is started. |
| 0x02 |
|
|
|
(See the table later on this page) |
| 0x03 |
The ACPI object that was being run |
The return value from the interpreter |
The name of the control method (in ULONG format) |
ACPI tried to run a control method while creating
device extensions to represent the ACPI namespace, but this control
method failed. |
| 0x04 |
The ACPI extension that _PRW belongs to |
A pointer to the method |
The DataType returned (see Amli.h)
|
ACPI evaluated a _PRW and expected to find an integer
as a package element. |
| 0x05 |
The ACPI extension that _PRW belongs to |
Aointer to the _PRW |
The number of elements in the _PRW |
ACPI evaluated a _PRW, and the package that came back
failed to contain at least two elements. The ACPI specification
requires that two elements always be present in a _PRW. |
| 0x06 |
The ACPI extension that _PRx belongs to |
A pointer to the _PRx |
A pointer to the name of the object to look for |
ACPI tried to find a named object, but it could not
find the object. |
| 0x07 |
The ACPI extension that the method belongs to |
A pointer to the method |
The DataType returned (see Amli.h)
|
ACPI evaluated a method and expected to receive a
buffer in return. However, the method returned some other data type. |
| 0x08 |
The ACPI extension that the method belongs to |
A pointer to the method |
The DataType returned (see Amli.h)
|
ACPI evaluated a method and expected to receive an
integer in return. However, the method returned some other data type. |
| 0x09 |
The ACPI extension that the method belongs to |
A pointer to the method |
The DataType returned (see Amli.h)
|
ACPI evaluated a method and expected to receive a
package in return. However, the method returned some other data type. |
| 0x0A |
The ACPI extension that the method belongs to |
A pointer to the method |
The DataType returned (see Amli.h)
|
ACPI evaluated a method and expected to receive a
string in return. However, the method returned some other data type. |
| 0x0B |
The ACPI extension that _EJD belongs to |
The status that the interpreter returns |
The name of the object that ACPI is trying to find |
ACPI cannot find the object that an _EJD string
references. |
| 0x0C |
The ACPI extension that ACPI found a dock device for |
A pointer to the _EJD method |
0: BIOS does not claim system is
dockage
1: Duplicate device extensions for dock device
|
ACPI provides faulty or insufficient information for
dock support. |
| 0x0D |
The ACPI extension that ACPI needs the object for |
The (ULONG) name of the method that ACPI looked for |
0: Base case
1: Conflict
|
ACPI could not find a required method or object in the
namespace This bug check code is used if there is no _HID or _ADR
present. |
| 0x0E |
The NS PowerResource that ACPI
needs the object for |
The (ULONG) name of the method that ACPI looked for |
0: Base case |
ACPI could not find a required method or object in the
namespace for a power resource (or entity other than a "device"). This
bug check code is used if there is no _ON, _OFF, or _STA present for a
power resource. |
| 0x0F |
The current buffer that ACPI was parsing |
The buffer's tag |
The specified length of the buffer |
ACPI could not parse the resource descriptor. |
| 0x10 |
|
|
|
(See the table later on this page) |
| 0x11 |
|
|
|
(See the table later on this page) |
| 0x14 |
The current buffer that ACPI was parsing |
The buffer's tag |
A pointer to a variable that contains the ULONGLONG
length of the buffer |
ACPI could not parse the resource descriptor. The
length exceeds MAXULONG. |
| 0x15 |
The ACPI Machine Language (AML) context |
1: Failed to load table
2: The Parameter Path String Object was not
found
3: Failed to insert Parameter Data into the
ParameterPath String Object
4: Out of system memory
|
The NT status code |
ACPI had a fatal error when attempting to load a table.
|
| 0x16 |
A pointer to the parent NSOBJ |
A pointer to the illegal child ACPI namespace object |
Reserved |
ACPI had a fatal error when processing an xSDT. An
object was declared as a child of a parent that cannot have children. |
If an interrupt routing
failure or incompatibility has occurred, the following parameters are
used.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause |
| 0x2001 |
InterruptModel (integer) |
The return value from the interpreter |
A pointer to the PIC control method |
ACPI tried to evaluate the PIC control method but
failed. |
| 0x10001 |
A pointer to the device object |
A pointer to the parent of the device object |
A pointer to the _PRT object
(See the following Comments section)
|
ACPI tried to do interrupt routing, but failed. |
| 0x10002 |
A pointer to the device object |
A pointer to the string name that ACPI was looking for
but could not find |
A pointer to the _PRT object
(See the following Comments section)
|
ACPI could not find the link node referenced in a _PRT.
|
| 0x10003 |
A pointer to the device object |
The device ID or function number.
This DWORD is encoded as follows: bits 5:0 are the PCI device number,
and bits 8:6 are the PCI function number
|
A pointer to the _PRT object
(See the following Comments section)
|
ACPI could not find a mapping in the _PRT package for a
device. |
| 0x10005 |
A pointer to the _PRT object
(See the following Comments section)
|
A pointer to the current _PRT element.
(This pointer is an index into the _PRT.)
|
The device ID or function number.
This DWORD is encoded as follows: bits 15:0 are the PCI function
number, and bits 31:16 are the PCI device number
|
ACPI found an entry in the _PRT that the function ID is
not all F's for.
(The generic format for a _PRT entry is that the device number is
specified, but the function number is not.)
|
| 0x10006 |
A pointer to the link node.
(This device is missing the _DIS method.)
|
0 |
0 |
ACPI found a link node, but it cannot disable the node.
(Link nodes must be disabled to allow for reprogramming.)
|
| 0x10007 |
The vector that could not be found |
0 |
0 |
The _PRT contained a reference to a vector that is not
described in the I/O APIC entry's MAPIC table. |
| 0x10008 |
The invalid interrupt level. |
0 |
0 |
The ACPI SCI interrupt level is invalid.
|
| 0x10009 |
0 |
0 |
0 |
The Fixed ACPI Description Table (FADT) could not be
located. |
| 0x1000A |
0 |
0 |
0 |
The Root System Description Pointer (RSDP) or Extended
System Description Table (XSDT) could not be located
|
| 0x1000B |
The ACPI table signature |
A pointer to the ACPI table |
0 |
The length of the ACPI table is not consistent with the
table revision. |
| 0x20000 |
The I/O port in the Fixed Table |
0 |
0 |
The PM_TMR_BLK entry in the Fixed ACPI Description
Table doesn't point to a working ACPI timer block. |
If a miscellaneous failure
or incompatibility has occurred, the following parameters are used.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause |
| 0x20000 |
The I/O port in the Fixed Table |
0 |
0 |
The PM_TMR_BLK entry in the Fixed ACPI Description
Table does not point to a working ACPI timer block. |
If Parameter 1
equals 0x02, the ACPI BIOS could not process the
resource list for the PCI root buses. In this case,
Parameter 3 specifies the exact problem, and the remaining
parameters have the following definitions.
| Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause |
| The ACPI extension for the PCI bus |
0x0 |
A pointer to the QUERY_RESOURCES IRP |
ACPI cannot convert the BIOS' resource list into the
proper format. This probably represents an error in the BIOS' list
encoding procedure. |
| The ACPI extension for the PCI bus |
0x1 |
A pointer to the QUERY_RESOURCE_REQUIREMENTS IRP |
ACPI cannot convert the BIOS' resource list into the
proper format. This probably represents an error in the BIOS' list
encoding procedure. |
| The ACPI extension for the PCI bus |
0x2 |
0 |
ACPI found an empty resource list. |
| The ACPI extension for the PCI bus |
0x3 |
A pointer to the PNP CRS descriptor |
ACPI could not find the current bus number in the CRS. |
| The ACPI extension for the PCI bus |
A pointer to the resource list for PCI |
A pointer to the E820 memory table |
The list of resources that PCI claims to decode
overlaps with the list of memory regions that the E820 BIOS interface
reports. (This kind of conflict is never permitted.) |
If Parameter 1
equals 0x10, the ACPI BIOS could not determine the
system-to-device-state mapping correctly. In this situation,
Parameter 3 specifies the exact problem, and the remaining
parameters have the following definitions.
| Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause |
| The ACPI extension whose mapping is needed |
0x0 |
The DEVICE_POWER_STATE (this is "x+1") |
_PRx was mapped back to a non-supported S-state. |
| The ACPI extension whose mapping is needed |
0x1 |
The SYSTEM_POWER_STATE that cannot be mapped |
ACPI cannot find a D-state to associate with the
S-state. |
| The ACPI extension whose mapping is needed |
0x2 |
The SYSTEM_POWER_STATE that cannot be mapped |
The device claims to be able to wake the system when
the system is in this S-state, but the system does not actually support
this S-state. |
If Parameter 1
equals 0x11, the system could not enter ACPI mode.
In this situation, Parameter 2 specifies the exact problem,
and the remaining parameters have the following definitions.
| Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause |
| 0x0 |
0 |
0 |
The system could not initialize the AML interpreter. |
| 0x1 |
0 |
0 |
The system could not find RSDT. |
| 0x2 |
0 |
0 |
The system could not allocate critical driver
structures. |
| 0x3 |
0 |
0 |
The system could not load RSDT. |
| 0x4 |
0 |
0 |
The system could not load DDBs. |
| 0x5 |
0 |
0 |
The system cannot connect the Interrupt vector. |
| 0x6 |
0 |
0 |
SCI_EN never becomes set in PM1 Control Register. |
| 0x7 |
A pointer to the table that had a bad checksum |
Creator revision |
The table checksum is incorrect. |
| 0x8 |
A pointer to the table that ACPI failed to load |
Creator revision |
ACPI failed to load DDB. |
| 0x9 |
FADT version |
0 |
Unsupported firmware version. |
| 0xA |
0 |
0 |
The system could not find MADT. |
| 0xB |
0 |
0 |
The system could not find any valid Local SAPIC
structures in the MADT. |
Cause
The value of
Parameter 1 indicates the error.
Resolving the Problem
If you are debugging this
error, use the !analyze
-v extension. This extension displays all the
relevant data (device extensions, nsobjects, or whatever is appropriate
to the specific error).
If you are not performing
debugging, this error indicates that you have to obtain a new BIOS.
Contact your vendor or visit the internet to get a new BIOS.
If you cannot obtain an
updated BIOS, or the latest BIOS is still not ACPI compliant, you can
turn off ACPI mode during text-mode setup. To turn off ACPI mode, press
the F7 key when you are prompted to install storage drivers. The system
does not notify you that the F7 key was pressed, but it silently
disables ACPI and enables you to continue your installation.
Comments
A PCI routing table (_PRT)
is the ACPI BIOS object that specifies how all the PCI devices are
connected to the interrupt controllers. A computer with multiple PCI
buses might have multiple _PRTs.
You can display a _PRT in
the debugger by using the !acpikd.nsobj extension
together with the address of the _PRT object as its argument.
WinDbg
Output Example:
ACPI_BIOS_ERROR (a5)
The ACPI Bios in the system is not fully compliant with the ACPI
specification.
The first value indicates where the incompatibility lies:
This bug check covers a great variety of ACPI problems. If a
kernel debugger
is attached, use "!analyze -v". This command will analyze the
precise problem,
and display whatever information is most useful for debugging the
specific
error.
Arguments:
Arg1: 0000000000000000,
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (a6)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Memory, Pagefile, Device driver
MSDN Listing
(WDK): http://msdn.microsoft.com/en-us/library/ff560117(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The BAD_EXHANDLE bug check
has a value of 0x000000A7. This bug check indicates that the
kernel-mode handle table detected an inconsistent handle table entry
state.
Parameters
None
WinDbg
Output Example:
BAD_EXHANDLE (a7)
The kernel mode handle table detected an inconsistent handle table
entry state.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000A8:
BOOTING_IN_SAFEMODE_MINIMAL (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (a8)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000A9:
BOOTING_IN_SAFEMODE_NETWORK (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (a9)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000AA:
BOOTING_IN_SAFEMODE_DSREPAIR (go
to top of page)
Usual causes:
Knowledge
Base Articles:
KB 2617115
"Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)" error when a client logs off
from a Remote Desktop Services session in Windows
Server 2008 R2
KB 2669129
"Stop 0x000000AB
(SESSION_HAS_VALID_POOL_ON_EXIT)" error when you log off a Remote Desktop
Services session in Windows Server 2008
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (aa)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000AB:
SESSION_HAS_VALID_POOL_ON_EXIT (go
to top of page)
Usual causes:
A bug in Win32k.sys, Atmfd.dll,
Rdpdd.dll, or a video driver.
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560119(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xab
Knowledge
Base Articles:
KB 901150 You
may receive a “Stop 0x000000ab” error message when you log off a
Terminal Services session on a Windows Server 2003
SP1-based Terminal
Server
KB 907242 You
receive a "Stop 0x000000ab" error message when you log off from a
Terminal Services session on a Windows Server 2003
SP1-based terminal
server
KB 918673
You receive a "Stop
0x000000ab" error message when a Terminal Services client computer logs
off from a Terminal Services session on a Windows Server 2003 SP1-based Terminal Services
computer
KB 925919
Stop error message
when a client computer logs off from a Terminal Services session on a
server that is running Windows Server 2003
with SP1 or with SP2: "Stop 0x000000AB
(SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 928942
Error message when you log off a Terminal Services session on Windows
Server 2003 Terminal Server with Service Pack 1 or
with Service Pack 2: "Stop 0x000000AB"
KB 931282
Stop error message when a
client computer logs off from a Terminal Services session on a server that is
running Windows Server 2003 with SP1 or with SP2:
"Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 944916
Stop error message
when a client logs off from a Terminal Services session on a server
that is running Windows Server 2003 with SP1
or Windows
Server 2003 with SP2: "Stop error code
0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 946068
Stop error message on
a terminal server that is running Windows Server
2003 Service Pack 1 or Windows Server
2003 Service Pack 2: "Stop error code 0x000000AB
(SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 951749
Stop error message on a terminal server that is running Windows
Server 2003 SP1 or Windows
Server 2003 SP2: "Stop error code
0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 959466
Stop error on a
Windows
Server 2003-based terminal server that
has a third-party Input Method Editor (IME) installed: "Stop 0x000000AB
(SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 982362
"Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)" error when a client
logs off from a terminal server session in Windows Server 2003 SP1 or in Windows Server 2003 SP2
KB 2585233
"Stop 0x000000AB
(SESSION_HAS_VALID_POOL_ON_EXIT)" error when a client logs off from a Windows
Server 2008 R2 Remote Desktop Services session
KB 2786447
"0x000000AB" Stop error when a Citrix client logs off from a RD Session Host
that is running Windows Server 2008 R2 SP1
KB 2863945
"0x000000AB" Stop error when you log off from a Windows
Server 2012-based RDS server
More BSOD articles at this link:
http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x000000ab&x=0&y=0&mkt=en-US&FORM=QBME1&l=1
WinDbg
Help File Entry:
The
SESSION_HAS_VALID_POOL_ON_EXIT bug check has a value of 0x000000AB.
This bug check indicates that a session unload occurred while a session
driver still held memory.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The session ID. |
| 2 |
The number of paged pool bytes that are leaking. |
| 3 |
The number of nonpaged pool bytes that are leaking. |
| 4 |
The total number of paged and nonpaged allocations that
are leaking. (The number of nonpaged allocations are in the upper half
of this word, and paged allocations are in the lower half of this
word.) |
Cause
The
SESSION_HAS_VALID_POOL_ON_EXIT bug check occurs because a session
driver does not free its pool allocations before a session unload. This
bug check indicates a bug in Win32k.sys, Atmfd.dll,
Rdpdd.dll, or a video driver.
WinDbg
Output Example:
SESSION_HAS_VALID_POOL_ON_EXIT
(ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload. This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000000000000, session ID
Arg2: 0000000000000000, number of paged pool bytes that are leaking
Arg3: 0000000000000000, number of nonpaged pool bytes that are leaking
Arg4: 0000000000000000, total number of paged and nonpaged allocations
that are leaking.
nonpaged allocations are in the upper
half of this word,
paged allocations are in the lower half
of this word.
STOP 0x000000AC:
HAL_MEMORY_ALLOCATION (go
to top of page)
Usual causes:
Memory, Corruption of loading of Windows
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560121(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The HAL_MEMORY_ALLOCATION
bug check has a value of 0x000000AC. This bug check indicates that the
hardware abstraction layer (HAL) could not obtain sufficient memory.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
The allocation size |
| 2 |
0 |
| 3 |
A pointer to a string that contains the file name |
| 4 |
Reserved |
Cause
The HAL could not obtain
non-paged memory pool for a system critical requirement.
These critical memory
allocations are made early in system initialization, and the
HAL_MEMORY_ALLOCATION bug check is not expected. This bug check
probably indicates some other critical error such as pool corruption or
massive consumption.
WinDbg
Output Example:
HAL_MEMORY_ALLOCATION (ac)
The HAL was unable to obtain memory for a system critical requirement.
These allocations are made early in system initialization and such a
failure is not expected. It probably indicates some other
critical error
such as pool corruption or massive consumption.
Arguments:
Arg1: 0000000000000000, Allocation size.
Arg2: 0000000000000000, 0
Arg3: 0000000000000000, Pointer to string containing file name.
Arg4: 0000000000000000, (reserved)
STOP 0x000000AD:
VIDEO_DRIVER_DEBUG_REPORT_REQUEST (go
to top of page)
Usual causes:
Video driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560125(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
VIDEO_DRIVER_DEBUG_REPORT_REQUEST bug check has a value of 0x000000AD.
This bug check indicates that the video port created a non-fatal
minidump on behalf of the video driver during run time.
Parameters
The following parameters
appear on the blue screen.
| Parameter |
Description |
| 1 |
Driver-specific |
| 2 |
Driver-specific |
| 3 |
Driver-specific |
| 4 |
The number of all reports that have been requested
since boot time |
Comments
The video port created a
non-fatal minidump on behalf of the video driver during run time
because the video driver requested a debug report.
The
VIDEO_DRIVER_DEBUG_REPORT_REQUEST bug check can be caused only by
minidump creation, not by the creation of a full dump or kernel dump.
WinDbg
Output Example:
Unknown bugcheck code (ad)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (ae)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (af)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (b0)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (b1)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (b2)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (b3)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000B4:
VIDEO_DRIVER_INIT_FAILURE (go
to top of page)
Usual causes:
Video driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560133(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xb4
Knowledge
Base Articles:
Troubleshooting
specific STOP messages
KB 240369 Err
Msg: Stop
0x000000B4 The Video Driver Failed to Initialize (2000)
KB 250271 "STOP
0x000000B4" or Black Screen During GUI-Mode Setup on Micron Powerdigm
XSU (2000)
KB 319120
Error message: "Stop error code 0x000000B4 The video driver failed to
initialize" (2000)
WinDbg
Help File Entry:
The
VIDEO_DRIVER_INIT_FAILURE bug check has a value of 0x000000B4. This
indicates that Windows was unable to enter graphics mode.
Parameters
None
Cause
The system was not able to
go into graphics mode because no display drivers were able to start.
This usually occurs when no
video miniport drivers are able to load successfully.
WinDbg
Output Example:
VIDEO_DRIVER_INIT_FAILURE
(b4)
The system was not able to go into graphics mode because no display
drivers
were able to start. This usually occurs if no video miniport
drivers load
successfully.
Arguments:
Arg1: 0000000000000000, Driver failure data.
Arg2: 0000000000000000, Graphics device list.
Arg3: 0000000000000000, Graphics device list data.
Arg4: 0000000000000000, Indicates generic failure.
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (b5)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (b6)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (b7)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000B8:
ATTEMPTED_SWITCH_FROM_DPC (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560140(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xb8
Knowledge
Base Articles:
KB 281428 "Stop
0xB8
ATTEMPTED_SWITCH_FROM_DPC" Error Message When You Use a Parallel Port
Zip Drive (2000)
KB 287582 "Stop
0x000000B8" Error Message Occurs After You Install Tivoli Storage
Manager (2000
Server)
KB 318988 Stop
0x000000B8 Error Occurs in a Windows 2000
Cluster
KB 319453 Problems
with
older version of Nwfs.sys file in Novell NetWare Client Version 4.81 (2000)
KB 824354 Your Server
Stops Responding or You Receive a Stop Error Message When You Set Up a
Windows Server
2003-Based Server Cluster
KB 888190 “Stop
0x000000B8” error message on a computer that has the Dell OpenManage
Server Administrator installed in Windows Server 2003
or in Windows
Small Business Server 2003
KB 936150 Error
message
when you wake Windows Vista
from sleep: "STOP: 0x000000B8"
KB 980663
Stop error in
Windows 7 and in Windows
Server 2008 R2 if a heavy load
situation exists or if connectivity issues exist: "Stop error code
0x000000B8 (ATTEMPTED_SWITCH_FROM_DPC)"
KB 2194018 "Stop 0xB8
ATTEMPTED_SWITCH_FROM_DPC" Error Message When Resuming SAN Booted Server 2008
KB 2490742 A "0x000000B8" Stop
error occurs when you try to shut down or hibernate a computer that is
running Windows 7
or Windows Server 2008
R2
KB 2640309
"STOP: 0x000000B8" error when you try to shut down or hibernate a
computer that is running Windows Vista,
Windows
Server 2008, Windows
7 or Windows Server 2008 R2
WinDbg
Help File Entry:
The
ATTEMPTED_SWITCH_FROM_DPC bug check has a value of 0x000000B8. This
indicates that an illegal operation was attempted by a delayed
procedure call (DPC) routine.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The original thread causing the failure |
| 2 |
The new thread |
| 3 |
The stack address of the original thread |
| 4 |
Reserved |
Cause
A wait operation, attach
process, or yield was attempted from a DPC routine. This is an illegal
operation.
Resolving the Problem
The stack trace will lead to
the code in the original DPC routine that caused the error.
WinDbg
Output Example:
ATTEMPTED_SWITCH_FROM_DPC
(b8)
A wait operation, attach process, or yield was attempted from a DPC
routine.
This is an illegal operation and the stack track will lead to the
offending
code and original DPC routine.
Arguments:
Arg1: 0000000000000000, Original thread which is the cause of the
failure
Arg2: 0000000000000000, New thread
Arg3: 0000000000000000, Stack address of the original thread
Arg4: 0000000000000000
STOP 0x000000B9:
CHIPSET_DETECTED_ERROR (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560144(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The CHIPSET_DETECTED_ERROR
bug check has a value of 0x000000B9.
This bug check appears very
infrequently.
WinDbg
Output Example:
CHIPSET_DETECTED_ERROR (b9)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000BA:
SESSION_HAS_VALID_VIEWS_ON_EXIT (go
to top of page)
Usual causes:
A bug in win32k.sys, atmfd.dll,
rdpdd.dll, or a video driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560151(v=VS.85).aspx
Knowledge
Base Articles:
KB 961974 Stop
error when you log off from a Terminal Services session on a terminal
server that is running Windows Server 2003 SP1 or Windows Server 2003
SP2: "Stop 0x000000ba"
WinDbg
Help File Entry:
The
SESSION_HAS_VALID_VIEWS_ON_EXIT bug check has a value of 0x000000BA.
This indicates that a session driver still had mapped views when the
session unloaded.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The session ID |
| 2 |
The number of mapped views that are leaking |
| 3 |
The address of this session's mapped views table |
| 4 |
The size of this session's mapped views table |
Cause
This error is caused by a
session driver not unmapping its mapped views prior to a session
unload. This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll, or a video driver.
WinDbg
Output Example:
SESSION_HAS_VALID_VIEWS_ON_EXIT
(ba)
Caused by a session driver not unmapping its mapped views prior to a
session unload. This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000000000000, session ID
Arg2: 0000000000000000, number of mapped views that are leaking
Arg3: 0000000000000000, address of this session's mapped views table
Arg4: 0000000000000000, size of this session's mapped views table.
STOP 0x000000BB:
NETWORK_BOOT_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
Hardware, Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560155(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
NETWORK_BOOT_INITIALIZATION_FAILED bug check has a value of 0x000000BB.
This indicates that Windows failed to successfully boot off a network.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The part of network initialization that failed.
Possible values are:
1: Failure while updating the registry.
2: Failure while starting the network stack.
Windows sends IOCTLs to the redirector and datagram receiver, then
waits for the redirector to be ready. If it is not ready within a
certain period of time, this error is issued.
3: Failure while sending the DHCP IOCTL to
TCP. This is how Windows informs the transport of its IP address.
|
| 2 |
The failure status |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
This error is caused when
Windows is booting off a network, and a critical function fails during
I/O initialization.
WinDbg
Output Example:
NETWORK_BOOT_INITIALIZATION_FAILED
(bb)
Caused if we are booting off the network, and a critical function fails
during
IO initialization. Currently the codes for the first value are:
1 - updating the registry.
2 - starting the network stack - Windows sends IOCTLs to the redirector
and
datagram receiver, then waits for the
redirector to be ready. If it is not
ready within a certain period of time,
initialization fails.
3 - failed sending the DHCP IOCTL to TCP - this is how Windows informs
the
transport of its IP adress.
Arguments:
Arg1: 0000000000000000, the part of network initialization that failed
Arg2: 0000000000000000, the failure status
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000BC:
NETWORK_BOOT_DUPLICATE_ADDRESS (go
to top of page)
Usual causes:
As it states, duplicate IP addresses have been assigned
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560159(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
NETWORK_BOOT_DUPLICATE_ADDRESS bug check has a value of 0x000000BC.
This indicates that a duplicate IP address was assigned to this machine
while booting off a network.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The IP address, shown as a DWORD. An address of the
form aa.bb.cc.dd will appear as 0xDDCCBBAA. |
| 2 |
The hardware address of the other machine. (For an
Ethernet connection, see the following note.) |
| 3 |
The hardware address of the other machine. (For an
Ethernet connection, see the following note.) |
| 4 |
The hardware address of the other machine. (For an
Ethernet connection, this will be zero.) |
Note When
Parameter 4 equals zero, this indicates an Ethernet
connection. In that case, the MAC address will be stored in
Parameter 2 and Parameter 3. An Ethernet MAC address
of the form aa-bb-cc-dd-ee-ff will cause
Parameter 2 to equal 0xAABBCCDD, and Parameter 3 to
equal 0xEEFF0000.
Cause
This error indicates that
when TCP/IP sent out an ARP for its IP address, it got a response from
another machine indicating a duplicate IP address.
When Windows is booting off
a network, this is a fatal error.
WinDbg
Output Example:
NETWORK_BOOT_DUPLICATE_ADDRESS
(bc)
This indicates that when TCP/IP sent out an ARP for its IP address, it
got
a response from another machine, indicating a duplicate IP address.
When we
are booting off the network this is a fatal error.
Arguments:
Arg1: 0000000000000000, the IP address, show as a hex DWORD. So an
address aa.bb.cc.dd will
appear as 0xddccbbaa.
Arg2: 0000000000000000, the hardware address of the other machine.
Arg3: 0000000000000000, the hardware address of the other machine.
Arg4: 0000000000000000, the hardware address of the other machine. For
Ethernet, a MAC address
of aa-bb-cc-dd-ee-ff will be indicated
by the second parameter
containing 0xaabbccdd, the third
parameter containing 0xeeff0000, and
the fourth parameter containing
0x00000000.
STOP 0x000000BD:
INVALID_HIBERNATED STATE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
INVALID_HIBERNATED_STATE
(bd)
The hibernated memory image does not match the current hardware
configuration.
This bugcheck occurs when a system resumes from hibernate and discovers
that the
hardware has been changed while the system was hibernated.
Note: This bug check no longer exists in any version of
Windows.
Arguments:
Arg1: 0000000000000000, hardware that was invalid
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000BE:
ATTEMPTED_WRITE_TO_READONLY_MEMORY (go
to top of page)
Usual causes:
Device driver, Memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560161(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xbe
Knowledge
Base Articles:
KB 227693 Installation
of SessionWall-3 May Cause Computer to Stop Responding (2000 Server)
KB 306205 The
Qwestdex
Dex Toolbar Is Not Totally Compatible with Windows XP
KB 956246 Stop
error
when Windows Server
2008 or Windows Vista
SP1 is running in a virtual machine, and the computer that is running
the virtual machine has multiple processors: "0x000000BE"
KB 959056 Stop
error
message when a Windows Server
2008-based
computer randomly restarts: "0x000000BE
ATTEMPTED_WRITE_TO_READONLY_MEMORY"
KB 983554 "0x000000BE" Stop error
message when you use the Storport.sys driver to manage some storage
devices in Windows Server
2008 or in Windows Vista
KB 2563727 "0x000000BE" Stop error
when you install Windows Vista
or Windows
Server 2008 if
more than two AMD Bulldozer-based 16-core processors are
installed
WinDbg
Help File Entry:
The
ATTEMPTED_WRITE_TO_READONLY_MEMORY bug check has a value of 0x000000BE.
This is issued if a driver attempts to write to a read-only memory
segment.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Virtual address of attempted write |
| 2 |
PTE contents |
| 3 |
Reserved |
| 4 |
Reserved |
If the driver responsible
for the error can be identified, its name is printed on the blue screen
and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
WinDbg
Output Example:
ATTEMPTED_WRITE_TO_READONLY_MEMORY
(be)
An attempt was made to write to readonly memory. The guilty
driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 81dd7000, Virtual address for the attempted write.
Arg2: 01dd7121, PTE contents.
Arg3: 9730b9f4, (reserved)
Arg4: 0000000b, (reserved)
Usual causes:
Device driver, ?Memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560167(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The MUTEX_ALREADY_OWNED bug
check has a value of 0x000000BF. This indicates that a thread attempted
to acquire ownership of a mutex it already owned.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The address of the mutex |
| 2 |
The thread that caused the error |
| 3 |
0 |
| 4 |
Reserved |
WinDbg
Output Example:
MUTEX_ALREADY_OWNED (bf)
This thread is attempting to acquire ownership of a mutex it already
owns.
Arguments:
Arg1: 0000000000000000, Address of Mutex
Arg2: 0000000000000000, Thread
Arg3: 0000000000000000, 0
Arg4: 0000000000000000, (reserved)
STOP 0x000000C0:
PCI_CONFIT_SPACE_ACCESS_FAILURE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (c0)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000C1:
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (go
to top of page)
Usual causes:
Device driver, ?Memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560183(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xc1
Knowledge
Base Articles:
KB 953026 You
receive a "STOP 0x0000010E" or "STOP 0x000000C1" error message on a
Windows Vista-based
computer or on a Windows Server
2008-based
computer
WinDbg
Help File Entry:
The
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION bug check has a value of
0x000000C1. This indicates that the driver wrote to an invalid section
of the special pool.
Parameters
The following parameters are
displayed on the blue screen. Parameter 4 indicates the type
of violation.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
| Address that the driver tried to free |
Reserved |
0 |
0x20 |
A driver attempted to free pool which was not allocated. |
| Address that the driver tried to free |
Bytes requested |
Bytes calculated (actually given to the caller) |
0x21,
0x22 |
A driver attempted to free a bad address. |
| Address that the driver tried to free |
Address where bits are corrupted |
Reserved |
0x23 |
A driver freed an address, but nearby bytes within the
same page have been corrupted. |
| Address that the driver tried to free |
Address where bits are corrupted |
Reserved |
0x24 |
A driver freed an address, but bytes occurring after
the end of the allocation have been overwritten. |
| Current IRQL |
Pool type |
Number of bytes |
0x30 |
A driver attempted to allocate pool at an incorrect
IRQL. |
| Current IRQL |
Pool type |
Address that the driver tried to free |
0x31 |
A driver attempted to free pool at an incorrect IRQL. |
| Address that the driver tried to free |
Address where one bit is corrupted |
Reserved |
0x32 |
A driver freed an address, but nearby bytes within the
same page have a single bit error. |
The _POOL_TYPE codes are
enumerated in ntddk.h. In particular, zero
indicates nonpaged pool and one indicates paged pool.
Cause
A driver has written to an
invalid section of the special pool.
Resolving the Problem
Obtain a backtrace of the
current thread. This backtrace will usually reveal the source of the
error.
For information about the
special pool, consult the Driver Verifier section of the Windows Driver
Kit.
WinDbg
Output Example:
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION
(c1)
Special pool has detected memory corruption. Typically the
current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: ba41ef78, address trying to free
Arg2: ba41eb04, address where one bit is corrupted
Arg3: 0083408c, (reserved)
Arg4: 00000032, caller is freeing an address where nearby bytes within
the same page have a single bit error
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the
current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000, subclass of driver violation.
Usual causes:
Device driver, ?Memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560185(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xc2
Knowledge
Base Articles:
KB 265879 How
to Debug
"Stop 0xC2" or "Stop 0x000000C2" Error Messages (2000)
KB 307151 Computer
with
ATI RAGE FURY MAXX Video Adapter Stops Responding After Upgrade to
Windows XP
KB 309155 "STOP
0x000000c2" Error Message Appears on a Blue Screen After You Install
IomegaWare (2000)
KB 310527 Stop
Error
When You Upgrade from Windows 2000:
Bad_Pool_Caller 0xC2
KB 321793 "STOP
0x000000C2 BAD_POOL_CALLER" Error Message on a Cluster Node (2000 Server)
KB 328776 A "Stop
0x000000C2" Error Occurs When You Try to Close a File on a Network
Share (2000
Server)
KB 816669 "STOP
0x000000C2" Error Message When Running Terminal Services (2000)
KB 818323
"Stop error code 0x000000C2" error message when the computer resumes
from hibernation (2000)
KB 820765 Computer
intermittently stops responding and a Stop 0x000000C2 error occurs (2000)
KB 824281
"Stop error code 0x000000C2 (BAD_POOL_CALLER)" error occurs when you
print in Windows 2000
KB 829788 "Stop
0xC2 (BAD_POOL_CALLER)" error may occur intermittently on a server that
is running Routing and Remote Access with NAT enabled under Windows 2000
KB 888431 "Stop
0x000000C2 BAD_POOL_CALLER" error message in Windows Server 2003
KB 890756 The
Windows 2000-based
or Windows Server
2003-based server restarts and you receive various error
messages
KB 892926 Your
computer
crashes with a "STOP: 0x000000C2" error when you dismount a SAN drive
in Windows Server
2003
KB 896674 You
receive a
"STOP 0x000000C2" error message on a Windows 2000-based
computer
KB 900623 You
may
receive a "STOP 0x000000C2 BAD_POOL_CALLER" error message when you use
ATM network services in Windows 2000
KB 932701
FIX: Stop error
message on a Windows Server 2003 R2-based
computer that has Subsystem for UNIX-based Applications installed:
"000000C2"
KB 935920 When the
Emulex
Elxsli2.sys driver is installed, you may receive a Stop error message
after you upgrade your computer to Windows Server 2003
Service Pack 1
KB 937455 You
may
receive various Stop error messages on a computer that is running
Windows Server
2003
KB 939868 You
receive an
error message when you access a Web-based program on a Windows XP-based
multiprocessor computer
KB 941004 Error
message
when a NetDDE application is running on a Windows Server 2003-based
computer: "Stop 0x000000C2"
KB 944904 Error
message
on a Windows XP-based
computer when you work with a network share: "STOP: 0x000000C2
BAD_POOL_CALLER"
KB 947390 You
receive a
"Stop 0x000000C2" error message on a Windows Server 2003
R2-based computer if a compressed folder resides on an NTFS volume that
has FSRM quota management enabled
KB 957509 Stop
error
when you use a Microsoft Device Specific Module in Windows Server 2008:
"0x000000C2"
KB 958165 Stop
error on
a Windows Server
2003-based or Windows Server 2008-based
computer that has Server for NFS enabled when an NFS client copies data
to the NFS server: "Stop 0x000000C2"
KB 967776 Stop
errors in
Windows Vista
or Windows Server
2008: “Stop: 0x00000018” or “STOP: 0x000000C2”
KB 973295 A
multiprocessor
computer that is running Windows Server 2003
SP2 stops responding under
a heavy load if you change a Windows Firewall setting
KB 2479442 Stop error during
startup in Windows Server 2008 or in
Windows
Vista
KB 2639793
"0x000000C2" Stop error occurs when you use IPsec on a computer that is
running Windows Server 2008 or
Windows
Vista in a network that uses IPsec
NAT-T security
KB 2641739
"0x000000C2" Stop error when you insert removable media or a removable
storage device into a computer that is running Windows 7 or Windows Server 2008 R2
KB 2654363
Computer crashes when you use Driver Verifier to monitor Storport.sys if you
disable the HBA in Windows 7 or Windows
Server 2008 R2
KB 2719347
Stop error when a
Windows 7-based or Windows
Server 2008 R2-based computer crashes randomly
KB 2807654
"0x000000C2" Stop error when you try to back up a data deduplication-enabled
volume in Windows 8 or Windows
Server 2012
KB 2831154 A
Stop Error 0x000000C2 in the Srv2.sys file may occur and SMB clients cannot
obtain data from the SMB 2 server in a Windows 7
or Windows Server 2008 R2 environment
KB
2850309
"0x000000C2" Stop error when you resume a computer from sleep mode or
hibernation on a Windows 8, Windows
Server 2012, or
Windows RT-based computer
WinDbg
Help File Entry:
The BAD_POOL_CALLER bug
check has a value of 0x000000C2. This indicates that the current thread
is making a bad pool request.
Parameters
The following parameters are
displayed on the blue screen. Parameter 1
indicates the type of violation.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
| 0x00 |
0 |
Pool type |
Pool tag |
The current thread requested a zero-byte pool
allocation. |
0x01,
0x02,
or
0x04 |
Pointer to pool header |
First part of pool header contents |
0 |
The pool header has been corrupted. |
| 0x06 |
Reserved |
Pointer to pool header |
Pool header contents |
The current thread attempted to free the pool, which
was already freed. |
| 0x07 |
Reserved |
Pool header contents |
Address of the block of pool being freed |
The current thread attempted to free the pool, which
was already freed. |
| 0x08 |
Current IRQL |
Pool type |
Size of allocation, in bytes |
The current thread attempted to allocate the pool at an
invalid IRQL. |
| 0x09 |
Current IRQL |
Pool type |
Address of pool |
The current thread attempted to free the pool at an
invalid IRQL. |
| 0x0A |
Address of pool |
Allocator's tag |
Tag being used in the attempted free |
The current thread attempted to free pool memory by
using the wrong tag.
(The memory might belong to another component.)
|
0x0B,
0x0C,
or
0x0D |
Address of pool |
Pool allocation's tag |
Bad quota process pointer |
The current thread attempted to release a quota on a
corrupted pool allocation. |
| 0x40 |
Starting address |
Start of system address space |
0 |
The current thread attempted to free the kernel pool at
a user-mode address. |
| 0x41 |
Starting address |
Physical page frame |
Highest physical page frame |
The current thread attempted to free a non-allocated
nonpaged pool address. |
0x42
or
0x43 |
Address being freed |
0 |
0 |
The current thread attempted to free a virtual address
that was never in any pool. |
| 0x44 |
Starting address |
Reserved |
0 |
The current thread attempted to free a non-allocated
nonpaged pool address. |
| 0x46 |
Starting address |
0 |
0 |
The current thread attempted to free an invalid pool
address. |
| 0x47 |
Starting address |
Physical page frame |
Highest physical page frame |
The current thread attempted to free a non-allocated
nonpaged pool address. |
| 0x48 |
Starting address |
Reserved |
Reserved |
The current thread attempted to free a non-allocated
paged pool address. |
| 0x50 |
Starting address |
Start offset, in pages, from beginning of paged pool |
Size of paged pool, in bytes |
The current thread attempted to free a non-allocated
paged pool address. |
| 0x60 |
Starting address |
0 |
0 |
The current thread attempted to free an invalid
contiguous memory address.
(The caller of MmFreeContiguousMemory is passing a
bad pointer.)
|
| 0x99 |
Address that is being freed |
0 |
0 |
The current thread attempted to free pool with an
invalid address.
(This code can also indicate corruption in the pool header.)
|
| 0x9A |
Pool type |
Number of bytes requested |
Pool tag |
The current thread marked an allocation request
MUST_SUCCEED.
(This pool type is no longer supported.)
|
| 0x9B |
Pool type |
Number of bytes requested |
Caller's address |
The current thread attempted to allocate a pool with a
tag of 0
(This would be untrackable, and possibly corrupt the existing tag
tables.)
|
| 0x9C |
Pool type |
Number of bytes requested |
Caller's address |
The current thread attempted to allocate a pool with a
tag of "BIG".
(This would be untrackable and could possibly corrupt the existing tag
tables.)
|
| 0x9D |
Incorrect pool tag used |
Pool type |
Caller's address |
The current thread attempted to allocate a pool with a
tag that does not contain any letters or digits. Using such tags makes
tracking pool issues difficult. |
| 0x41286 |
Reserved |
Reserved |
Start offset from the beginning of the paged pool, in
pages |
The current thread attempted to free a paged pool
address in the middle of an allocation. |
The _POOL_TYPE codes are
enumerated in Ntddk.h. In particular, 0 indicates
nonpaged pool and 1 indicates paged pool.
Cause
An invalid pool request has
been made by the current thread.
Resolving the Problem
Activate Driver Verifier to
obtain more information about these errors. For details, see the Driver
Verifier section of the Windows Driver Kit (WDK).
WinDbg
Output Example:
BAD_POOL_CALLER (c2)
The
current thread is making a bad pool request. Typically this
is at
a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000099, Attempt to free pool with invalid address (or
corruption in pool header)
Arg2: 86c30ca8, Address being freed
Arg3: 00000000, 0
Arg4: 00000000, 0
BAD_POOL_CALLER (c2)
The
current thread is making a bad pool request. Typically this
is at
a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000000, The caller is requesting a zero byte pool
allocation.
Arg2: 0000000000000000, zero.
Arg3: 0000000000000000, the pool type being allocated.
Arg4: 0000000000000000, the pool tag being used.
STOP 0x000000C3:
BUGCODE_PSS_MESSAGE_SIGNATURE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (c3)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000C4:
DRIVER_VERIFIER_DETECTED_VIOLATION (go
to top of page)
Usual causes:
Device driver - see parameters for more information
NOTE: May occur in Win7 and later w/o Driver Verifier
being enabled
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560187(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xc4
Knowledge
Base Articles:
KB 325672 Fatal
System Error: 0x000000C4 If Deadlock Detection in Driver Verifier Is
Turned on and Norton Antivirus Is Installed (XP, Server 2003)
KB 329703 "STOP"
Error
Messages in Qafilter.sys or Qsfilter.sys with Third-Party Quota
Management Tool (2000)
KB 810148 "Stop
0x000000C4" Error Message When You Disable CardBus Controllers in
Device Manager (2000)
KB 897574 You
may
receive a Stop error message after you insert media into a removable
disk device in Windows XP,
Windows Server
2003, or Windows 2000
KB 902390 You
may
receive a Stop error message when you use a scanner in Windows Server 2003
or in Windows XP
x64 Edition
KB 932755
An updated Storport
storage driver is available for Windows Server
2003
KB 946226 FIX:
You
receive a
"Stop 0x00000019" error message or a "Stop 0x000000c4" error message
when you access NFS resources by using User Name Mapping (MS Svcs for
Unix)
KB 949012 Stop
error
message after you enable the Disk Integrity Checking feature of Driver
Verifier in a Windows Server
2003 cluster environment: "Stop 0x000000C4"
KB 956469 Stop
error message during restart if you enable the Force IRQL Checking
setting in Driver Verifier on a computer that is running Windows Server 2003,
Datacenter x64 Edition with Service Pack 2: "0x000000C4"
KB 975246
Stop error message
when you connect and then disconnect a USB camera from a computer that
is running Windows
Vista or Windows
Server 2008: "Fatal System Error: 0x000000C4 (parameter1,
parameter2, parameter3, parameter4) DRIVER_VERIFIER_DETECTED_VI...
KB 2494666
Stop errors may occur
after you use the Driver Verifier manager to apply standard settings to
all drivers in
Windows 7 or in Windows
Server 2008 R2
KB 2524840 "0x000000C4" Stop error
occurs when you run the "Common Scenario Stress with IO" test on a Windows 7-based
computer on which Windows Virtual PC and Windows Logo Kit are installed
KB 2550576
STOP 0xC4 may occur in tcpipreg.sys following a reboot after Driver
Verifier is enabled on Windows 7 SP1
or Windows
Server 2008 R2 SP1
KB 2661796
"0x000000C4" Stop error when you enable Driver Verifier in
Windows 7 or in Windows
Server 2008 R2
KB 2724933
Stop error 0x000000C4 during resume from sleep on
Windows 7
KB 2801662
"0x000000C4" Stop error
when you run the WDF Fault Injection Logo Test in
Windows 7 and Windows Server 2008 R2
KB 2816159
"0x000000C4" Stop error after you restart a Windows 8-based
or Windows Server 2012-based computer that has
the Driver Verifier tool enabled
WinDbg
Help File Entry:
The
DRIVER_VERIFIER_DETECTED_VIOLATION bug check has a value of 0x000000C4.
This is the general bug check code for fatal errors found by Driver
Verifier.
Parameters
Four bug check parameters
are displayed on the blue screen. Parameter 1 identifies the
type of violation. The meaning of the remaining parameters varies with
the value of Parameter 1. The parameter values are described
in the following table.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
| 0x00 |
Current IRQL |
Pool type |
0 |
The driver requested a zero-byte pool allocation. |
| 0x01 |
Current IRQL |
Pool type |
Size of allocation, in bytes |
The driver attempted to allocate paged memory with IRQL
> APC_LEVEL. |
| 0x02 |
Current IRQL |
Pool type |
Size of allocation, in bytes |
The driver attempted to allocate nonpaged memory with
IRQL > DISPATCH_LEVEL. |
| 0x03 (Windows Vista and later operating
systems only) |
Reserved |
Reserved |
Reserved |
The driver attempted to allocate multiple pages of must
succeed pool, but at most one page can be allocated using this routine. |
| 0x10 |
Bad Address |
0 |
0 |
The driver attempted to free an address that was not
returned from an allocate call. |
| 0x11 |
Current IRQL |
Pool type |
Address of pool |
The driver attempted to free paged pool with IRQL
> APC_LEVEL. |
| 0x12 |
Current IRQL |
Pool type |
Address of pool |
The driver attempted to free nonpaged pool with IRQL
> DISPATCH_LEVEL. |
0x13
or
0x14 |
Reserved |
Pointer to pool header |
Pool header contents |
The driver attempted to free memory pool which was
already freed. |
| 0x15 |
Timer entry |
Pool type (-1 for special pool) |
Pool address being freed |
The driver attempted to free pool which contains an
active timer. |
| 0x16 |
Reserved |
Pool address |
0 |
The driver attempted to free pool at a bad address, or
the driver passed invalid parameters to a memory routine. |
| 0x17 |
Resource entry |
Pool type (-1 for special pool) |
Pool address being freed |
The driver attempted to free pool which contains an
active ERESOURCE. |
| 0x30 |
Current IRQL |
Requested IRQL |
0 |
The driver passed an invalid parameter to KeRaiseIrql.
(The parameter was either a value lower than the current IRQL, or a
value higher than HIGH_LEVEL. This may be the result of using an
uninitialized parameter.)
|
| 0x31 |
Current IRQL |
Requested IRQL |
0: New IRQL is bad
1: New IRQL is invalid inside a DPC routine
|
The driver passed an invalid parameter to KeLowerIrql.
(The parameter was either a value higher than the current IRQL, or a
value higher than HIGH_LEVEL. This may be the result of using an
uninitialized parameter.)
|
| 0x32 |
Current IRQL |
Spin lock address |
0 |
The driver called KeReleaseSpinLock
at an IRQL other than DISPATCH_LEVEL.
(This may be due to a double-release of a spin lock.)
|
| 0x33 |
Current IRQL |
Fast mutex address |
0 |
The driver attempted to acquire fast mutex with IRQL
> APC_LEVEL. |
| 0x34 |
Current IRQL |
Fast mutex address |
0 |
The driver attempted to release fast mutex at an IRQL
other than APC_LEVEL. |
| 0x35 |
Current IRQL |
Spin lock address |
Old IRQL |
The kernel released a spin lock with IRQL not equal to
DISPATCH_LEVEL. |
| 0x36 |
Current IRQL |
Spin lock number |
Old IRQL |
The kernel released a queued spin lock with IRQL not
equal to DISPATCH_LEVEL. |
| 0x37 |
Current IRQL |
Thread APC disable count |
Resource |
The driver tried to acquire a resource, but APCs are
not disabled. |
| 0x38 |
Current IRQL |
Thread APC disable count |
Resource |
The driver tried to release a resource, but APCs are
not disabled. |
| 0x39 |
Current IRQL |
Thread APC disable count |
Mutex |
The driver tried to acquire a mutex "unsafe" with IRQL
not equal to APC_LEVEL on entry. |
| 0x3A |
Current IRQL |
Thread APC disable count |
Mutex |
The driver tried to release a mutex "unsafe" with IRQL
not equal to APC_LEVEL on entry. |
| 0x3B |
Current IRQL |
Object to wait for |
Time-out parameter |
The driver called KeWaitXxx with
IRQL >= DISPATCH_LEVEL.
(This is permitted only if the driver already owns the DISPATCHER lock
and it passes a time-out value of zero to the routine.)
|
| 0x3C |
Handle passed to routine |
Object type |
0 |
The driver called ObReferenceObjectByHandle
with a bad handle. |
| 0x3D |
0 |
0 |
Address of the bad resource |
The driver passed a bad (unaligned) resource to ExAcquireResourceExclusive.
|
| 0x3E |
0 |
0 |
0 |
The driver called KeLeaveCriticalRegion
for a thread that is not currently in a critical region. |
| 0x3F |
Object address |
New object reference count.
-1: dereference case
1: reference case
|
0 |
The driver applied ObReferenceObject
to an object that has a reference count of zero, or the driver applied ObDereferenceObject
to an object that has a reference count of zero. |
| 0x40 |
Current IRQL |
Spin lock address |
0 |
The driver called KeAcquireSpinLockAtDpcLevel
with IRQL not equal to DISPATCH_LEVEL. |
| 0x41 |
Current IRQL |
Spin lock address |
0 |
The driver called KeReleaseSpinLockFromDpcLevel
with IRQL not equal to DISPATCH_LEVEL. |
| 0x42 |
Current IRQL |
Spin lock address |
0 |
The driver called KeAcquireSpinLock
with IRQL > DISPATCH_LEVEL. |
| 0x51 |
Base address of allocation |
Address of the reference beyond the allocation |
Number of charged bytes |
The driver attempted to free memory after having
written past the end of the allocation. A bug check with this parameter
occurs only when the Pool Tracking option of
Driver Verifier is active. |
| 0x52 |
Base address of allocation |
Reserved |
Number of charged bytes |
The driver attempted to free memory after having
written past the end of the allocation. A bug check with this parameter
occurs only when the Pool Tracking option of
Driver Verifier is active. |
0x53,
0x54,
or
0x59 |
Base address of allocation |
Reserved |
Reserved |
The driver attempted to free memory after having
written past the end of the allocation. A bug check with this parameter
occurs only when the Pool Tracking option of
Driver Verifier is active. |
| 0x60 |
Bytes allocated from paged pool |
Bytes allocated from nonpaged pool |
Total number of allocations that were not freed |
The driver is unloading without first freeing its pool
allocations. A bug check with this parameter occurs only when the Pool
Tracking option of Driver Verifier is active. |
| 0x61 |
Bytes allocated from paged pool |
Bytes allocated from nonpaged pool |
Total number of allocations that were not freed |
A driver thread is attempting to allocate pool memory
while the driver is unloading. A bug check with this parameter occurs
only when the Pool Tracking option of Driver
Verifier is active. |
| 0x62 |
Name of the driver |
Reserved |
Total number of allocations that were not freed,
including both paged and nonpaged pool |
The driver is unloading without first freeing its pool
allocations. A bug check with this parameter occurs only when the Pool
Tracking option of Driver Verifier is active. |
| 0x6F |
MDL address |
Physical page being locked |
Highest physical page in the system |
The driver passed a page to MmProbeAndLockPages
that was not in the PFN database.
(This often results from a driver that attempts to lock its own private
dualport RAM. Such behavior can corrupt memory on machines with
noncontiguous physical RAM.)
|
| 0x70 |
Current IRQL |
MDL address |
Access mode |
The driver called MmProbeAndLockPages
with IRQL > DISPATCH_LEVEL. |
| 0x71 |
Current IRQL |
MDL address |
Process address |
The driver called MmProbeAndLockProcessPages
with IRQL > DISPATCH_LEVEL. |
| 0x72 |
Current IRQL |
MDL address |
Process address |
The driver called MmProbeAndLockSelectedPages
with IRQL > DISPATCH_LEVEL. |
| 0x73 |
Current IRQL |
In 32-bit Windows: Low 32 bits of
the physical address
In 64-bit Windows: the 64-bit physical address
|
Number of bytes |
The driver called MmMapIoSpace with
IRQL > DISPATCH_LEVEL. |
| 0x74 |
Current IRQL |
MDL address |
Access mode |
The driver called MmMapLockedPages
in kernel mode with IRQL > DISPATCH_LEVEL. |
| 0x75 |
Current IRQL |
MDL address |
Access mode |
The driver called MmMapLockedPages
in user mode with IRQL > APC_LEVEL. |
| 0x76 |
Current IRQL |
MDL address |
Access mode |
The driver called MmMapLockedPagesSpecifyCache
in kernel mode with IRQL > DISPATCH_LEVEL. |
| 0x77 |
Current IRQL |
MDL address |
Access mode |
The driver called MmMapLockedPagesSpecifyCache
in user mode with IRQL > APC_LEVEL. |
| 0x78 |
Current IRQL |
MDL address |
0 |
The driver called MmUnlockPages
with IRQL > DISPATCH_LEVEL. |
| 0x79 |
Current IRQL |
Virtual address being unmapped |
MDL address |
The driver called MmUnmapLockedPages
in kernel mode with IRQL > DISPATCH_LEVEL. |
| 0x7A |
Current IRQL |
Virtual address being unmapped |
MDL address |
The driver called MmUnmapLockedPages
in user mode with IRQL > APC_LEVEL. |
| 0x7B |
Current IRQL |
Virtual address being unmapped |
Number of bytes |
The driver called MmUnmapIoSpace
with IRQL > APC_LEVEL. |
| 0x7C |
MDL address |
MDL flags |
0 |
The driver called MmUnlockPages,
and passed an MDL whose pages were never successfully locked. |
| 0x7D |
MDL address |
MDL flags |
0 |
The driver called MmUnlockPages,
and passed an MDL whose pages are from nonpaged pool.
(These should never be unlocked.)
|
| 0x80 |
Current IRQL |
Event address |
0 |
The driver called KeSetEvent with
IRQL > DISPATCH_LEVEL. |
| 0x81 |
MDL address |
MDL flags |
0 |
The driver called MmMapLockedPages.
(You should use MmMapLockedPagesSpecifyCache
instead, with the BugCheckOnFailure parameter set
to FALSE.)
|
| 0x82 |
MDL address |
MDL flags |
0 |
The driver called MmMapLockedPagesSpecifyCache
with the BugCheckOnFailure parameter equal to TRUE.
(This parameter should be set to FALSE.)
|
| 0x83 |
Start of physical address range to map |
Number of bytes to map |
First page frame number that isn't locked down |
The driver called MmMapIoSpace
without having locked down the MDL pages. The physical pages
represented by the physical address range being mapped must have been
locked down prior to making this call. |
| 0x84 |
Start of physical address range to map |
Number of bytes to map |
First page frame number that is on the free list |
The driver called MmMapIoSpace
without having locked down the MDL pages (or after freeing the MDL
pages). |
| 0x85 |
MDL address |
Number of pages to map |
First page frame number that isn't locked down |
The driver called MmMapLockedPages
without having locked down the MDL pages. |
| 0x86 |
MDL address |
Number of pages to map |
First page frame number that is on the free list |
The driver called MmMapLockedPages
without having locked down the MDL pages (or after freeing the MDL
pages). |
| 0x87 |
Base physical page of the existing mapping
(Shift left for physical address)
|
Number of pages already mapped in the existing mapping |
MEMORY_CACHING_TYPE of the existing mapping |
The driver called MmMapIoSpace, but
the caller's cache type conflicts with an existing mapping. |
| 0x88 |
Base physical page of the requested mapping
(Shift left for physical address)
|
Number of pages in the requested mapping |
MEMORY_CACHING_TYPE of the requested mapping |
The driver called MmMapIoSpace to
map a physical range as non-cached or write-combined, but the caller's
physical range already has an existing cached mapping. |
| 0x89 |
MDL address |
Pointer to the non-memory page in the MDL |
The non-memory page number in the MDL |
An MDL is not marked as "I/O", but it contains
non-memory page addresses. |
| 0x8A |
MDL address |
Base physical page of the requested mapping
(Shift left for physical address)
|
MEMORY_CACHING_TYPE of the requested mapping |
The driver called MmMapLockedPagesXxx
to map a physical range as non-cached or write-combined, but the
caller's physical range already has an existing cached mapping. |
| 0x90 (Windows 2000, Windows XP, and Windows
Server 2003 only) |
Reserved |
Reserved |
Reserved |
The driver switched stacks, and the current stack is
neither a thread stack nor a DPC stack.
(Typically, the driver doing this should be on the stack obtained by
using the kb
(Display Stack Backtrace) command.)
|
| 0x91 |
Reserved |
Reserved |
Reserved |
The driver switched stacks using a method that is not
supported by the operating system. The only supported way to extend a
kernel mode stack is by using KeExpandKernelStackAndCallout.
|
| 0xA0 (Windows Server 2003 and later
operating systems only) |
Pointer to the IRP making the read or write request |
Device object of the lower device |
Number of the sector in which the error was detected |
A cyclic redundancy check (CRC) error was detected on a
hard disk. A bug check with this parameter occurs only when the Disk
Integrity Checking option of Driver Verifier is active. |
| 0xA1 (Windows Server 2003 and later
operating systems only) |
Copy of the IRP making the read or write request. (The
actual IRP has been completed.) |
Device object of the lower device |
Number of the sector in which the error was detected |
A CRC error was detected on a sector (asynchronously).
A bug check with this parameter occurs only when the Disk
Integrity Checking option of Driver Verifier is active. |
| 0xA2 (Windows Server 2003 and later
operating systems only) |
IRP making the read or write request, or a copy of this
IRP |
Device object of the lower device |
Number of the sector in which the error was detected |
The CRCDISK checksum copies don't match. This could be
a paging error. A bug check with this parameter occurs only when the Disk
Integrity Checking option of Driver Verifier is active. |
| 0xB0 (Windows Vista and later operating
systems only) |
MDL address |
MDL flags |
Incorrect MDL flags |
The driver called MmProbeAndLockPages
for an MDL with incorrect flags. For example, the driver passed an MDL
created by MmBuildMdlForNonPagedPool to MmProbeAndLockPages. |
| 0xB1 (Windows Vista and later operating
systems only) |
MDL address |
MDL flags |
Incorrect MDL flags |
The driver called MmProbeAndLockProcessPages
for an MDL with incorrect flags. For example, the driver passed an MDL
created by MmBuildMdlForNonPagedPool to
MmProbeAndLockProcessPages. |
| 0xB2 (Windows Vista and later operating
systems only) |
MDL address |
MDL flags |
Incorrect MDL flags |
The driver called MmMapLockedPages
for an MDL with incorrect flags. For example, the driver passed an MDL
that is already mapped to a system address or that was not locked to MmMapLockedPages.
|
| 0xB3 (Windows Vista and later operating
systems only) |
MDL address |
MDL flags |
Missing MDL flags (at least one was expected) |
The driver called MmMapLockedPages
for an MDL with incorrect flags. For example, the driver passed an MDL
that is not locked to MmMapLockedPages. |
| 0xB4 (Windows Vista and later operating
systems only) |
MDL address |
MDL flags |
Unexpected partial MDL flag |
The driver called MmUnlockPages for
a partial MDL. A partial MDL is one that was created by IoBuildPartialMdl. |
| 0xB5 (Windows Vista and later operating
systems only) |
MDL address |
MDL flags |
Unexpected partial MDL flag |
The driver called MmUnmapLockedPages
for a partial MDL. A partial MDL is one that was created by IoBuildPartialMdl. |
| 0xB6 (Windows Vista and later operating
systems only) |
MDL address |
MDL flags |
Missing MDL flag |
The driver called MmUnmapLockedPages
for an MDL that is not mapped to a system address. |
| 0xB7 (Windows Vista and later operating
systems only) |
Number of corrupted physical pages |
Address of first corrupted physical page |
Address of last corrupted physical page |
The system BIOS has corrupted low physical memory
during a sleep transition. |
| 0xC0 (Windows Vista and later operating
systems only) |
Address of the IRP |
Reserved |
Reserved |
The driver called IoCallDriver with
interrupts disabled. |
| 0xC1 (Windows Vista and later operating
systems only) |
Address of the driver dispatch routine |
Reserved |
Reserved |
A driver dispatch routine was returned with interrupts
disabled. |
| 0xC2 (Windows Vista and later operating
systems only) |
Reserved |
Reserved |
Reserved |
The driver called a Fast I/O dispatch routine after
interrupts were disabled. |
| 0xC3 (Windows Vista and later operating
systems only) |
Address of the driver Fast I/O dispatch routine |
Reserved |
Reserved |
A driver Fast I/O dispatch routine was returned with
interrupts disabled. |
| 0xC5 (Windows Vista and later operating
systems only) |
Address of the driver dispatch routine |
Current thread APC disable count |
Thread APC disable count prior to calling the driver
dispatch routine |
A driver dispatch routine has changed the thread APC
disable count. The APC disable count is decremented each time a driver
calls KeEnterCriticalRegion, KeInitializeMutex,
or FsRtlEnterFileSystem. The APC disable count is
incremented each time a driver calls KeLeaveCriticalRegion,
KeReleaseMutex, or FsRtlExitFileSystem.
Because these calls should always be in pairs, this value should be
zero whenever a thread is exited. A negative value indicates that a
driver has disabled APC calls without re-enabling them. A positive
value indicates that the reverse is true. |
| 0xC6 (Windows Vista and later operating
systems only) |
Address of the driver Fast I/O dispatch routine |
Current thread APC disable count |
Thread APC disable count prior to calling the Fast I/O
driver dispatch routine |
A driver Fast I/O dispatch routine has changed the
thread APC disable count. The APC disable count is decremented each
time a driver calls KeEnterCriticalRegion, KeInitializeMutex,
or FsRtlEnterFileSystem. The APC disable count is
incremented each time a driver calls KeLeaveCriticalRegion,
KeReleaseMutex, or FsRtlExitFileSystem.
Because these calls should always be in pairs, this value should be
zero whenever a thread is exited. A negative value indicates that a
driver has disabled APC calls without re-enabling them. A positive
value indicates that the reverse is true. |
| 0xCA (Windows Vista and later operating
systems only) |
Address of the lookaside list |
Reserved |
Reserved |
The driver has attempted to re-initialize a lookaside
list. |
| 0xCB (Windows Vista and later operating
systems only) |
Address of the lookaside list |
Reserved |
Reserved |
The driver has attempted to delete an uninitialized
lookaside list. |
| 0xCC (Windows Vista and later operating
systems only) |
Address of the lookaside list |
Starting address of the pool allocation |
Size of the pool allocation |
The driver has attempted to free a pool allocation that
contains an active lookaside list. |
| 0xCD (Windows Vista and later operating
systems only) |
Address of the lookaside list |
Block size specified by the caller |
Minimum supported block size |
The driver has attempted to create a lookaside list
with an allocation block size that is too small. |
| 0xD0 (Windows Vista and later operating
systems only) |
Address of the ERESOURCE structure |
Reserved |
Reserved |
The driver has attempted to re-initialize an ERESOURCE
structure. |
| 0xD1 (Windows Vista and later operating
systems only) |
Address of the ERESOURCE structure |
Reserved |
Reserved |
The driver has attempted to delete an uninitialized
ERESOURCE structure. |
| 0xD2 (Windows Vista and later operating
systems only) |
Address of the ERESOURCE structure |
Starting address of the pool allocation |
Size of the pool allocation |
The driver has attempted to free a pool allocation that
contains an active ERESOURCE structure. |
| 0xD5 (Windows Vista and later operating
systems only) |
Address of the IO_REMOVE_LOCK structure created by the
checked build version of the driver |
Current IoReleaseRemoveLock tag |
Reserved |
The current IoReleaseRemoveLock tag
does not match the previous IoAcquireRemoveLock tag.
If the driver calling IoReleaseRemoveLock is not in
a checked build, Parameter 2 is the address of the shadow
IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the
driver. In this case, the address of the IO_REMOVE_LOCK structure used
by the driver is not used at all, because Driver Verifier is replacing
the lock address for all the remove lock APIs. A bug check with this
parameter occurs only when the I/O Verification option
of Driver Verifier is active. |
| 0xD6 (Windows Vista and later operating
systems only) |
Address of the IO_REMOVE_LOCK structure created by the
checked build version of the driver |
Tag that does not match previous IoAcquireRemoveLock
tag |
Previous IoAcquireRemoveLock tag |
The current IoReleaseRemoveLockAndWait
tag does not match the previous IoAcquireRemoveLock tag.
If the driver calling IoReleaseRemoveLock is not a
checked build, Parameter 2 is the address of the shadow
IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the
driver. In this case, the address of the IO_REMOVE_LOCK structure used
by the driver is not used at all, because Driver Verifier is replacing
the lock address for all the remove lock APIs. A bug check with this
parameter occurs only when the I/O Verification option
of Driver Verifier is active. |
| 0xDA (Windows Vista and later operating
systems only) |
Starting address of the driver |
WMI callback address inside the driver |
Reserved |
An attempt was made to unload a driver that has not
deregistered its WMI callback function. |
| 0xDB (Windows Vista and later operating
systems only) |
Address of the device object |
Reserved |
Reserved |
An attempt was made to delete a device object that was
not deregistered from WMI. |
| 0xDC (Windows Vista and later operating
systems only) |
Reserved |
Reserved |
Reserved |
An invalid RegHandle value was specified as a parameter
of the function EtwUnregister. |
| 0xDD (Windows Vista and later operating
systems only) |
Address of the call to EtwRegister |
Starting address of the unloading driver |
Reserved |
An attempt was made to unload a driver without calling EtwUnregister. |
| 0xE0 (Windows Vista and later operating
systems only) |
User-mode address used as a parameter |
Size ,in bytes, of the address range used as a parameter |
Reserved |
A call was made to an operating system Kernel function
that specified a user-mode address as a parameter. |
| 0xE1 (Windows Vista and later operating
systems only) |
Address of the synchronization object |
Reserved |
Reserved |
A synchronization object was found to have an address
that was either invalid or pageable. |
| 0xE2 (Windows Vista and later operating
systems only) |
Address of the IRP |
User-mode address present in the IRP |
Reserved |
An IRP with Irp->RequestorMode
set to KernelMode was found to have a user-mode
address as one of its members. |
| 0xE3 (Windows Vista and later operating
systems only) |
Address of the call to the API |
User-mode address used as a parameter in the API |
Reserved |
A driver has made a call to a kernel-mode ZwXxx
routine with a user-mode address as a parameter. |
| 0xE4 (Windows Vista and later operating
systems only) |
Address of the call to the API |
Address of the malformed UNICODE_STRING structure |
Reserved |
A driver has made a call to a kernel-mode ZwXxx
routine with a malformed UNICODE_STRING structure as a parameter. |
| 0xE5 (Windows Vista and later operating
systems only) |
Current IRQL |
Reserved |
Reserved |
A call was made to a Kernel API at the incorrect IRQL. |
| 0xEA (Windows Vista and later operating
systems only) |
Current IRQL |
Thread APC disable count |
Address of the pushlock |
A driver has attempted to acquire a pushlock while APCs
are enabled. |
| 0xEB (Windows Vista and later operating
systems only) |
Current IRQL |
Thread APC disable count |
Address of the pushlock |
A driver has attempted to release a pushlock while APCs
are enabled. |
| 0xF0 (Windows Vista and later operating
systems only) |
Address of the destination buffer |
Address of the source buffer |
Number of bytes to copy |
A driver called the memcpy function
with overlapping source and destination buffers. |
| 0xF5 (Windows Vista and later operating
systems only) |
Address of the NULL handle |
Object type |
Reserved |
A driver passed a NULL handle to ObReferenceObjectByHandle. |
| 0x1000 (Windows XP and later operating systems
only) |
Address of the resource |
Reserved |
Reserved |
Self-deadlock: The current thread
has tried to recursively acquire a resource. A bug check with this
parameter occurs only when the Deadlock Detection option
of Driver Verifier is active. |
| 0x1001 (Windows XP and later operating systems
only) |
Address of the resource that was the final cause of the
deadlock |
Reserved |
Reserved |
Deadlock: A lock hierarchy violation
has been found. A bug check with this parameter occurs only when the Deadlock
Detection option of Driver Verifier is active.
(Use the !deadlock
extension for further information.)
|
| 0x1002 (Windows XP and later operating systems
only) |
Address of the resource |
Reserved |
Reserved |
Uninitialized resource: A resource
has been acquired without having been initialized first. A bug check
with this parameter occurs only when the Deadlock Detection option
of Driver Verifier is active. |
| 0x1003 (Windows XP and later operating systems
only) |
Address of the resource that is being released
deadlocked |
Address of the resource which should have been released
first |
Reserved |
Unexpected release: A resource has
been released out of the proper order. A bug check with this parameter
occurs only when the Deadlock Detection option of
Driver Verifier is active. |
| 0x1004 (Windows XP and later operating systems
only) |
Address of the resource |
Address of the thread that acquired the resource |
Address of the current thread |
Unexpected thread: The wrong thread
is releasing a resource. A bug check with this parameter occurs only
when the Deadlock Detection option of Driver
Verifier is active. |
| 0x1005 (Windows XP and later operating systems
only) |
Address of the resource |
Reserved |
Reserved |
Multiple initialization: A resource
is being initialized more than once. A bug check with this parameter
occurs only when the Deadlock Detection option of
Driver Verifier is active. |
| 0x1006 (Windows XP and later operating systems
only) |
Address of the thread being deleted |
Address of the resource owned by the thread |
Reserved |
Thread holds resources: A thread is
being deleted without first releasing its resources. A bug check with
this parameter occurs only when the Deadlock Detection option
of Driver Verifier is active. |
| 0x1007 (Windows XP and later operating systems
only) |
Address of the resource |
Reserved |
Reserved |
Unacquired resource: A resource is
being released without having first been acquired. A bug check with
this parameter occurs only when the Deadlock Detection option
of Driver Verifier is active. |
Cause
See the description of each
code in the Parameters section for a description of the cause. Note
that values 0x1000 through 0x1020 for Parameter 1 are deadlock
verifier error codes. Further information can be obtained by using the !deadlock
extension.
Resolving the Problem
This bug check can only
occur when Driver Verifier has been instructed to monitor one or more
drivers. If you did not intend to use Driver Verifier, you should
deactivate it. You might consider removing the driver which caused this
problem as well.
If you are the driver
writer, use the information obtained through this bug check to fix the
bugs in your code.
After a Memory
Allocation Tracking bug check, use the following command in
the kernel debugger:
kd> dp ViBadDriver L1; dS @$p
This will return the name of
the driver causing the error.
Then use the the !verifier
extension:
kd> !verifier 3 drivername.sys
This will return information
about the leaked memory allocations.
For full details on Driver
Verifier, see the Driver Verifier section of the Windows Driver Kit
(WDK).
Comments
The value of
Parameter 1 is limited by the Driver Verifier options that are
activated.
- Parameter 1 values between 0x50 and 0x62 occur
only when the Pool Tracking option of Driver
Verifier is active.
- Parameter 1 values between 0xA0 and 0xA2 occur
only when the Disk Integrity Checking option of
Driver Verifier is active. The Disk Integrity Checking
option is supported only in Windows Server 2003 and later
versions of Windows.
- Parameter 1 values between 0x1000 and 0x1007 occur
only when the Deadlock Detection option of Driver
Verifier is active. The Deadlock Detection option
is supported only in Windows XP and later versions of Windows.
The _POOL_TYPE codes are
enumerated in Ntddk.h. In particular, 0
(zero) indicates nonpaged pool and 1 (one)
indicates paged pool.
WinDbg
Output Example:
DRIVER_VERIFIER_DETECTED_VIOLATION
(c4)
A device driver attempting to corrupt the system has been
caught. This is
because the driver was specified in the registry as being suspect (by
the
administrator) and the kernel has enabled substantial checking of this
driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and
0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000b2, MmMapLockedPages called on an MDL having
incorrect flags.
For example, calling MmMapLockedPages
for an MDL
that is already mapped to a system
address is incorrect.
Arg2: fffffa800ad9cf40, MDL address.
Arg3: 000000000000000c, MDL flags.
Arg4: 0000000000000004, Incorrect MDL flags.
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been
caught. This is
because the driver was specified in the registry as being suspect (by
the
administrator) and the kernel has enabled substantial checking of this
driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and
0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000000, caller is trying to allocate zero bytes
Arg2: 0000000000000000, current IRQL
Arg3: 0000000000000000, pool type
Arg4: 0000000000000000, number of bytes
STOP 0x000000C5:
DRIVER_CORRUPTED_EXPOOL (go
to top of page)
Usual causes:
Device driver, ?Memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560192(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xc5
Knowledge
Base Articles:
KB 302971 "Stop
0x1E" or
"Stop 0xc5" After You Install Service Pack 2 and You Use Logitech Mouse
Drivers (2000)
KB 324224
"Stop error code 0x000000C5" error message in Windows
2000
KB 961799 A Stop error occurs on a
Windows Server 2003-based server when
a user accesses shared files on the server by using an SMB connection
KB 967208 You
receive a Stop error message some time after you use a 32-bit installer
to install an NDIS intermediate driver on a computer that runs a 64-bit
version of Windows Server
2003
KB 969550 A
Stop error
occurs on an HP ProLiant server that has the firmware from an
E200/E200i HP Smart Array SAS/SATA controller installed on any Windows
Server platform (2000
Server, Server
2003, Server
2008)
WinDbg
Help File Entry:
The DRIVER_CORRUPTED_EXPOOL
bug check has a value of 0x000000C5. This indicates that the system
attempted to access invalid memory at a process IRQL that was too high.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory referenced |
| 2 |
IRQL at time of reference |
| 3 |
0: Read
1: Write
|
| 4 |
Address that referenced memory |
Cause
The kernel attempted to
access pageable memory (or perhaps completely invalid memory) when the
IRQL was too high. The ultimate cause of this problem is almost
certainly a driver that has corrupted the system pool.
In most cases, this bug
check results if a driver corrupts a small allocation (less than
PAGE_SIZE). Larger allocations result in bug
check 0xD0 (DRIVER_CORRUPTED_MMPOOL).
Resolving the Problem
If you have recently
installed any new software, check to see if it is properly installed.
Check for updated drivers on the manufacturer's website.
To debug this error, use the
special pool option of Driver Verifier. If this fails to reveal the
driver that caused the error, use the Global Flags utility to enable
the special pool by pool tag.
For information about the
special pool, consult the Driver Verifier section of the Windows Driver
Kit.
WinDbg
Output Example:
DRIVER_CORRUPTED_EXPOOL
(c5)
An attempt was made to access a pageable (or completely invalid)
address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run
the driver
verifier against any new (or suspect) drivers, and if that doesn't turn
up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 834f51c5, address which referenced memory
STOP 0x000000C6:
DRIVER_CAUGHT_MODIFYING_FREED_POOL (go
to top of page)
Usual causes:
Device driver, ?Memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560193(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xc6
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
DRIVER_CAUGHT_MODIFYING_FREED_POOL bug check has a value of 0x000000C6.
This indicates that the driver attempted to access a freed memory pool.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory referenced |
| 2 |
0: Read
1: Write
|
| 3 |
0: Kernel mode
1: User mode
|
| 4 |
Reserved |
Comments
The faulty component will be
displayed in the current kernel stack. This driver should be either
replaced or debugged.
WinDbg
Output Example:
DRIVER_CAUGHT_MODIFYING_FREED_POOL
(c6)
An attempt was made to access freed pool memory. The faulty
component is
displayed in the current kernel stack.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: 0000000000000000, previous mode.
Arg4: 0000000000000000, 4.
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560198(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xc7
Knowledge
Base Articles:
WinDbg
Help File Entry:
The TIMER_OR_DPC_INVALID bug
check has a value of 0x000000C7. This is issued if a kernel timer or
delayed procedure call (DPC) is found somewhere in memory where it is
not permitted.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
0: Timer object
1: DPC object
2: DPC routine
|
| 2 |
Address of object |
| 3 |
Beginning of memory range checked |
| 4 |
End of memory range checked |
Cause
This condition is usually
caused by a driver failing to cancel a timer or DPC before freeing the
memory where it resides. When Driver Verifier is active, it will catch
such errors and issue this bug check.
Resolving the Problem
If you are the driver
writer, use the information obtained through this bug check to fix the
bugs in your code.
If you are a system
administrator, you should unload the driver if the problem persists.
For full details on Driver
Verifier, see the Windows Driver Kit.
WinDbg
Output Example:
TIMER_OR_DPC_INVALID (c7)
Kernel timer or DPC used incorrectly.
Arguments:
Arg1: 0000000000000000, Timer object found in memory which must not
contain such items.
Arg2: 0000000000000000, Address of the timer object.
Arg3: 0000000000000000, Start of memory range being checked.
Arg4: 0000000000000000, End of memory range being checked.
STOP 0x000000C8:
IRQL_UNEXPECTED_VALUE (go
to top of page)
Usual causes:
Device driver, Lower-level program
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560202(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The IRQL_UNEXPECTED_VALUE
bug check has a value of 0x000000C8. This indicates that the
processor's IRQL is not what it should be at this time.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The value of the following bit computation:
(Current IRQL << 16) | (Expected IRQL << 8)
| UniqueValue
|
| 2 |
Zero, or APC->KernelRoutine |
| 3 |
Zero, or APC |
| 4 |
Zero, or APC->NormalRoutine |
You can determine
"UniqueValue" by computing (Parameter 1 AND 0xFF). If
"UniqueValue" is either zero or one, Parameter 2,
Parameter 3, and Parameter 4 will equal the indicated
APC pointers. Otherwise, these parameters will equal zero.
Cause
This error is usually caused
by a device driver or another lower-level program that changed the IRQL
for some period and did not restore the original IRQL at the end of
that period. For example, the routine may have acquired a spin lock and
failed to release it.
WinDbg
Output Example:
IRQL_UNEXPECTED_VALUE (c8)
The processor's IRQL is not what it should be at this time.
This is
usually caused by a lower level routine changing IRQL for some period
and not restoring IRQL at the end of that period (eg acquires spinlock
but doesn't release it).
if UniqueValue is 0 or 1
2 = APC->KernelRoutine
3 = APC
4 = APC->NormalRoutine
Arguments:
Arg1: 00000000, (Current IRQL << 16) | (Expected IRQL
<< 8) | UniqueValue
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
STOP 0x000000C9:
DRIVER_VERIFIER_IOMANAGER_VIOLATION (go
to top of page)
Usual causes:
Driver verifier
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560205(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xc9
Knowledge
Base Articles:
KB 931301 Error
message
when you attach a device that loads the Serscan.sys driver to a
computer that is running Windows Server 2003
Service Pack 2: "STOP: 0x000000c9 DRIVER_VERIFIER_IOMANAGER_VIOLATION"
KB 932132 Certain
Windows Server 2003 hotfixes have been repackaged to be compatible with
Windows Server
2003 Service Pack 2 (SP2)
KB 942088 Error
message when you perform a file operation on a Windows Server
2003-based computer that has IPv6 installed: "Stop
0x000000C9"
KB 950224 A
Scalable
Networking Pack (SNP) hotfix rollup package is available for Windows Server 2003
KB 2688203
"0x000000D1" and "0x000000C9" Stop errors when Message Queuing moves unsent
messages to a dead-letter queue in Windows 7 or
in Windows Server 2008 R2
WinDbg
Help File Entry:
The
DRIVER_VERIFIER_IOMANAGER_VIOLATION bug check has a value of
0x000000C9. This is the bug check code for all Driver Verifier I/O
Verification violations.
Parameters
When Driver Verifier is
active and I/O Verification is selected, various
I/O violations will cause this bug check to be issued. The following
parameters will be displayed on the blue screen. Parameter 1
identifies the type of violation.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
| 0x01 |
Address of IRP being freed |
0 |
0 |
The driver attempted to free an object whose type is
not IO_TYPE_IRP. |
| 0x02 |
Address of IRP being freed |
0 |
0 |
The driver attempted to free an IRP that is still
associated with a thread. |
| 0x03 |
Address of IRP being sent |
0 |
0 |
The driver passed IoCallDriver an
IRP Type not equal to IRP_TYPE. |
| 0x04 |
Address of device object |
0 |
0 |
The driver passed IoCallDriver an
invalid device object. |
| 0x05 |
Address of device object associated with offending
driver |
IRQL before IoCallDriver |
IRQL after IoCallDriver |
The IRQL changed during a call to the driver dispatch
routine. |
| 0x06 |
IRP status |
Address of IRP being completed |
0 |
The driver called IoCompleteRequest
with a status marked as pending (or equal to -1). |
| 0x07 |
Address of cancel routine |
Address of IRP being completed |
0 |
The driver called IoCompleteRequest
while its cancel routine was still set. |
| 0x08 |
Address of device object |
IRP major function code |
Exception status code |
The driver passed IoBuildAsynchronousFsdRequest
an invalid buffer. |
| 0x09 |
Address of device object |
I/O control code |
Exception status code |
The driver passed IoBuildDeviceIoControlRequest
an invalid buffer. |
| 0x0A |
Address of device object |
0 |
0 |
The driver passed IoInitializeTimer
a device object with an already-initialized timer. |
| 0x0C |
Address of I/O status block |
0 |
0 |
The driver passed an I/O status block to an IRP, but
this block is allocated on a stack which has already unwound past that
point. |
| 0x0D |
Address of user event object |
0 |
0 |
The driver passed a user event to an IRP, but this
event is allocated on a stack which has already unwound past that point. |
| 0x0E |
Current IRQL |
Address of IRP |
0 |
The driver called IoCompleteRequest
with IRQL > DISPATCH_LEVEL. |
| 0x0F |
Address of the device object to which the IRP is being
sent |
Pointer to the IRP |
Pointer to file object |
The driver sent a create request with a file object
that has been closed, or that had its open canceled. |
In addition to the errors
mentioned in the previous table, there are a number of I/O
Verification errors that will cause Driver Verifier to halt
the system, but which are not actually bug checks.
These errors cause messages
to be displayed on the blue screen, in a crash dump file, and in a
kernel debugger. These messages will appear differently in each of
these locations. When these errors occur, the hexadecimal bug check
code 0xC9 and the bug check string DRIVER_VERIFIER_IOMANAGER_VIOLATION
do not appear on the blue screen or in the
debugger, although they will appear in a crash dump file.
On the blue screen, the
following data will be displayed:
- The message IO SYSTEM VERIFICATION ERROR.
- The message WDM DRIVER ERROR XXX,
where XXX is a hexadecimal code representing the
specific error. (See the table below for a list of the I/O error codes
and their meanings.)
- The name of the driver which caused the error.
- The address in the driver's code where the error was
detected (Parameter 2).
- A pointer to the IRP (Parameter 3).
- A pointer to the device object (Parameter 4).
If a kernel-mode crash dump
has been enabled, the following information will appear in the crash
dump file:
- The message BugCheck 0xC9
(DRIVER_VERIFIER_IOMANAGER_VIOLATION).
- The hexadecimal I/O error code. (See the table below for a
list of the I/O error codes and their meanings.)
- The address in the driver's code where the error was
detected.
- A pointer to the IRP.
- A pointer to the device object.
If a kernel debugger is
attached to the system which has caused this violation, the following
information will be sent to the debugger:
- The message WDM DRIVER ERROR,
along with an assessment of the severity of the error.
- The name of the driver which caused the error.
- A descriptive string which explains the cause of this
error. Often additional information is passed along, such as a pointer
to the IRP. (See the table below for a list of these descriptive
strings and what additional information is specified.)
- A query for further action. Possible responses are b
(break), i (ignore), z (zap), r
(remove), or d (disable). Instructing the operating
system to continue allows you to see what would happen "down the line"
if this error had not occurred. Of course, this often will lead to
additional bug checks. The "zap" option will actually remove the
breakpoint that caused this error to be discovered.
Note No
other bug checks can be ignored in this manner. Only this kind of I/O
Verification errors can be ignored, and even these errors can
only be ignored if a kernel debugger is attached.
The following table lists
those I/O Verification errors that can appear. In
Windows 2000, these errors will only be displayed if I/O
Verification is set to Level 2.
| I/O Error Code |
Severity |
Cause of Error |
| 0x200 |
Unknown |
This code covers all unknown I/O
Verification errors. |
| 0x201 |
Fatal error |
A device is deleting itself while there is another
device beneath it in the driver stack. This may be because the caller
has forgotten to call IoDetachDevice first, or the
lower driver may have incorrectly deleted itself. |
| 0x202 |
Fatal error |
A driver has attempted to detach from a device object
that is not attached to anything. This may occur if detach was called
twice on the same device object. (Device object specified.) |
| 0x203 |
Fatal error |
A driver has called IoCallDriver
without setting the cancel routine in the IRP to NULL. (IRP
specified.) |
| 0x204 |
Fatal error |
The caller has passed in NULL as a device object. This
is fatal. (IRP specified.) |
| 0x205 |
Fatal error |
The caller is forwarding an IRP that is currently
queued beneath it. The code handling IRPs returning STATUS_PENDING in
this driver appears to be broken. (IRP specified.) |
| 0x206 |
Fatal error |
The caller has incorrectly forwarded an IRP (control
field not zeroed). The driver should use IoCopyCurrentIrpStackLocationToNext
or IoSkipCurrentIrpStackLocation. (IRP
specified.) |
| 0x207 |
Fatal error |
The caller has manually copied the stack and has
inadvertently copied the upper layer's completion routine. The driver
should use IoCopyCurrentIrpStackLocationToNext. (IRP
specified.) |
| 0x208 |
Fatal error |
This IRP is about to run out of stack locations.
Someone may have forwarded this IRP from another stack. (IRP
specified.) |
| 0x209 |
Fatal error |
The caller is completing an IRP that is currently
queued beneath it. The code handling IRPs returning STATUS_PENDING in
this driver appears to be broken. (IRP specified.) |
| 0x20A |
Fatal error |
The caller of IoFreeIrp is freeing
an IRP that is still in use. (Original IRP and IRP in use
specified.) |
| 0x20B |
Fatal error |
The caller of IoFreeIrp is freeing
an IRP that is still in use. (IRP specified.) |
| 0x20C |
Fatal error |
The caller of IoFreeIrp is freeing
an IRP that is still queued against a thread. (IRP specified.) |
| 0x20D |
Fatal error |
The caller of IoInitializeIrp has
passed an IRP that was allocated with IoAllocateIrp.
This is illegal and unnecessary, and has caused a quota leak. Check the
documentation for IoReuseIrp if this IRP is being
recycled. |
| 0x20E |
Non-fatal error |
A PNP IRP has an invalid status. (Any PNP IRP must have
its status initialized to STATUS_NOT_SUPPORTED.) (IRP
specified.) |
| 0x20F |
Non-fatal error |
A Power IRP has an invalid status. (Any Power IRP must
have its status initialized to STATUS_NOT_SUPPORTED.) (IRP
specified.) |
| 0x210 |
Non-fatal error |
A WMI IRP has an invalid status. (Any WMI IRP must have
its status initialized to STATUS_NOT_SUPPORTED.) (IRP
specified.) |
| 0x211 |
Non-fatal error |
The caller has forwarded an IRP while skipping a device
object in the stack. The caller is probably sending IRPs to the PDO
instead of to the device returned by IoAttachDeviceToDeviceStack.
(IRP specified.) |
| 0x212 |
Non-fatal error |
The caller has trashed or has not properly copied the
IRP's stack. (IRP specified.) |
| 0x213 |
Non-fatal error |
The caller has changed the status field of an IRP it
does not understand. (IRP specified.) |
| 0x214 |
Non-fatal error |
The caller has changed the information field of an IRP
it does not understand. (IRP specified.) |
| 0x215 |
Non-fatal error |
A non-successful non-STATUS_NOT_SUPPORTED IRP status
for IRP_MJ_PNP is being passed down stack. (IRP specified.)
Failed PNP IRPs must be completed. |
| 0x216 |
Non-fatal error |
The previously-set IRP_MJ_PNP status has been converted
to STATUS_NOT_SUPPORTED. (IRP specified.) |
| 0x217 |
Non-fatal error |
The driver has not handled a required IRP. The driver
must update the status of the IRP to indicate whether or not it has
been handled. (IRP specified.) |
| 0x218 |
Non-fatal error |
The driver has responded to an IRP that is reserved for
other device objects elsewhere in the stack. (IRP specified.) |
| 0x219 |
Non-fatal error |
A non-successful non-STATUS_NOT_SUPPORTED IRP status
for IRP_MJ_POWER is being passed down stack. (IRP specified.)
Failed POWER IRPs must be completed. |
| 0x21A |
Non-fatal error |
The previously-set IRP_MJ_POWER status has been
converted to STATUS_NOT_SUPPORTED. (IRP specified.) |
| 0x21B |
Non-fatal error |
A driver has returned a suspicious status. This is
probably due to an uninitialized variable bug in the driver. (IRP
specified.) |
| 0x21C |
Warning |
The caller has copied the IRP stack but not set a
completion routine. This is inefficient — use IoSkipCurrentIrpStackLocation
instead. (IRP specified.) |
| 0x21D |
Fatal error |
An IRP dispatch handler has not properly detached from
the stack below it upon receiving a remove IRP. (Device
object, dispatch routine, and IRP specified.) |
| 0x21E |
Fatal error |
An IRP dispatch handler has not properly deleted its
device object upon receiving a remove IRP. (Device object,
dispatch routine, and IRP specified.) |
| 0x21F |
Non-fatal error |
A driver has not filled out a dispatch routine for a
required IRP major function. (IRP specified.) |
| 0x220 |
Non-fatal error |
IRP_MJ_SYSTEM_CONTROL has been completed by someone
other than the ProviderId. This IRP should either have been completed
earlier or should have been passed down. (IRP specified, along
with the device object where it was targeted.) |
| 0x221 |
Fatal error |
An IRP dispatch handler for a PDO has deleted its
device object, but the hardware has not been reported as missing in a
bus relations query. (Device object, dispatch routine, and IRP
specified.) |
| 0x222 |
Fatal error |
A Bus Filter's IRP dispatch handler has detached upon
receiving a remove IRP when the PDO is still alive. Bus Filters must
clean up in FastIoDetach callbacks. (Device
object, dispatch routine, and IRP specified.) |
| 0x223 |
Fatal error |
An IRP dispatch handler for a bus filter has deleted
its device object, but the PDO is still present. Bus filters must clean
up in FastIoDetach callbacks. (Device
object, dispatch routine, and IRP specified.) |
| 0x224 |
Fatal error |
An IRP dispatch handler has returned a status that is
inconsistent with the IRP's IoStatus.Status field. (Dispatch
handler routine, IRP, IRP's IoStatus.Status, and returned Status
specified.) |
| 0x225 |
Non-fatal error |
An IRP dispatch handler has returned a status that is
illegal (0xFFFFFFFF). This is probably due to an uninitialized stack
variable. To debug this error, use the ln (List
Nearest Symbols) command with the specified
address. |
| 0x226 |
Fatal error |
An IRP dispatch handler has returned without passing
down or completing this IRP, or someone forgot to return
STATUS_PENDING. (IRP specified.) |
| 0x227 |
Fatal error |
An IRP completion routine is in pageable code. (This is
never permitted.) (Routine and IRP specified.) |
| 0x228 |
Non-fatal error |
A driver's completion routine has not marked the IRP
pending if the PendingReturned field was set in the
IRP passed to it. This may cause Windows to hang, especially if an
error is returned by the stack. (Routine and IRP specified.) |
| 0x229 |
Fatal error |
A cancel routine has been set for an IRP that is
currently being processed by drivers lower in the stack, possibly
stomping their cancel routine. (Routine and IRP specified.) |
| 0x22A |
Non-fatal error |
The physical device object (PDO) has not responded to a
required IRP. (IRP specified.) |
| 0x22B |
Non-fatal error |
The physical device object (PDO) has forgotten to fill
out the device relation list with the PDO for the TargetDeviceRelation
query. (IRP specified.) |
| 0x22C |
Fatal error |
The code implementing the TargetDeviceRelation
query has not called ObReferenceObject on the PDO. (IRP
specified.) |
| 0x22D |
Non-fatal error |
The caller has completed a IRP_MJ_PNP it didn't
understand instead of passing it down. (IRP specified.) |
| 0x22E |
Non-fatal error |
The caller has completed a successful IRP_MJ_PNP
instead of passing it down. (IRP specified.) |
| 0x22F |
Non-fatal error |
The caller has completed an untouched IRP_MJ_PNP
(instead of passing the IRP down), or non-PDO has failed the IRP using
illegal value of STATUS_NOT_SUPPORTED. (IRP specified.) |
| 0x230 |
Non-fatal error |
The caller has completed an IRP_MJ_POWER it didn't
understand instead of passing it down. (IRP specified.) |
| 0x231 |
Fatal error |
The caller has completed a successful IRP_MJ_POWER
instead of passing it down. (IRP specified.) |
| 0x232 |
Non-fatal error |
The caller has completed an untouched IRP_MJ_POWER
(instead of passing the IRP down), or non-PDO has failed the IRP using
illegal value of STATUS_NOT_SUPPORTED. (IRP specified.) |
| 0x233 |
Non-fatal error |
The version field of the query capabilities structure
in a query capabilities IRP was not properly initialized. (IRP
specified.) |
| 0x234 |
Non-fatal error |
The size field of the query capabilities structure in a
query capabilities IRP was not properly initialized. (IRP
specified.) |
| 0x235 |
Non-fatal error |
The address field of the query capabilities structure
in a query capabilities IRP was not properly initialized to -1. (IRP
specified.) |
| 0x236 |
Non-fatal error |
The UI Number field of the query capabilities structure
in a query capabilities IRP was not properly initialized to -1. (IRP
specified.) |
| 0x237 |
Fatal error |
A driver has sent an IRP that is restricted for system
use only. (IRP specified.) |
| 0x238 |
Warning |
The caller of IoInitializeIrp has
passed an IRP that was allocated with IoAllocateIrp.
This is illegal, unnecessary, and negatively impacts performance in
normal use. If this IRP is being recycled, see IoReuseIrp
in the Windows Driver Kit. |
| 0x239 |
Warning |
The caller of IoCompleteRequest is
completing an IRP that has never been forwarded via a call to IoCallDriver
or PoCallDriver. This may be a bug. (IRP
specified.) |
| 0x23A |
Fatal error |
A driver has forwarded an IRP at an IRQL that is
illegal for this major code. (IRP specified.) |
| 0x23B |
Non-fatal error |
The caller has changed the status field of an IRP it
does not understand. (IRP specified.) |
The following table lists
additional I/O Verification errors that can appear
in Windows XP and later. Some of these errors will only be
revealed if Enhanced I/O Verification is activated.
| I/O Error Code |
Severity |
Cause of Error |
| 0x23C |
Fatal error |
A driver has completed an IRP without setting the
cancel routine in the IRP to NULL. (IRP specified.) |
| 0x23D |
Non-fatal error |
A driver has returned STATUS_PENDING but did not mark
the IRP pending via a call to IoMarkIrpPending. (IRP
specified.) |
| 0x23E |
Non-fatal error |
A driver has marked an IRP pending but didn't return
STATUS_PENDING. (IRP specified.) |
| 0x23F |
Fatal error |
A driver has not inherited the DO_POWER_PAGABLE bit
from the stack it has attached to. (Device object specified.) |
| 0x240 |
Fatal error |
A driver is attempting to delete a device object that
has already been deleted via a prior call to IoDeleteDevice. |
| 0x241 |
Fatal error |
A driver has detached its device object during a
surprise remove IRP. (IRP and device object specified.) |
| 0x242 |
Fatal error |
A driver has deleted its device object during a
surprise remove IRP. (IRP and device object specified.) |
| 0x243 |
Fatal error |
A driver has failed to clear the DO_DEVICE_INITIALIZING
flag at the end of AddDevice. (Device
object specified.) |
| 0x244 |
Fatal error |
A driver has not copied either the DO_BUFFERED_IO or
the DO_DIRECT_IO flag from the device object it is attaching to. (Device
object specified.) |
| 0x245 |
Fatal error |
A driver has set both the DO_BUFFERED_IO and the
DO_DIRECT_IO flags. These flags are mutually exclusive. (Device
object specified.) |
| 0x246 |
Fatal error |
A driver has failed to copy the DeviceType
field from the device object it is attaching to. (Device
object specified.) |
| 0x247 |
Fatal error |
A driver has failed an IRP that cannot legally be
failed. (IRP specified.) |
| 0x248 |
Fatal error |
A driver has added a device object that is not a PDO to
a device relations query. (IRP and device object specified.) |
| 0x249 |
Non-fatal error |
A driver has enumerated two child PDOs that returned
identical Device IDs. (Both device objects specified.) |
| 0x24A |
Fatal error |
A driver has mistakenly called a file I/O function with
IRQL not equal to PASSIVE_LEVEL. |
| 0x24B |
Fatal error |
A driver has completed an IRP_MN_QUERY_DEVICE_RELATIONS
request of type TargetDeviceRelation as successful,
but did not properly fill out the request or forward the IRP to the
underlying hardware stack. (Device object specified.)
|
| 0x24C |
Non-fatal error |
A driver has returned STATUS_PENDING but did not mark
the IRP pending by a call to IoMarkIrpPending. (IRP
specified.) |
| 0x24D |
Fatal error |
A driver has passed an invalid device object to a
function that requires a PDO. (Device object specified.) |
Cause
See the description of each
code in the Parameters section for a description of the cause.
Resolving the Problem
This bug check can only
occur when Driver Verifier has been instructed to monitor one or more
drivers. If you did not intend to use Driver Verifier, you should
deactivate it. You might consider removing the driver which caused this
problem as well.
If you are the driver
writer, use the information obtained through this bug check to fix the
bugs in your code.
For full details on Driver
Verifier, see the Windows Driver Kit.
WinDbg
Output Example:
DRIVER_VERIFIER_IOMANAGER_VIOLATION
(c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 0000021f, A driver has not filled out a dispatch routine for a
required IRP major function.
Arg2: 8c12bb41, The address in the driver's code where the error was
detected.
Arg3: 8cf50f00, IRP address.
Arg4: 00000000
STOP 0x000000CA:
PNP_DETECTED_FATAL_ERROR (go
to top of page)
Usual causes:
PnP device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560209(v=VS.85).aspx
Knowledge
Base Articles:
KB 326457 Inserting
the
Same SmartMedia Adapters Causes a "Stop 0x000000CA" Error Message (XP)
KB 886800 A
disk
signature changes unexpectedly on a Windows Server 2003
clustered physical disk resource
KB 898446 You
receive a
"Stop 0x000000CA" error when you use two SCSI storage devices on a
Windows Server
2003-based computer
KB 938907 Error
message
on a Windows Server
2003-based computer: "STOP: 0x000000CA (parameter1,
parameter2, parameter3, parameter4) PNP_DETECTED_FATAL_ERROR
KB 957176 Stop error
when you plug two infrared (IR) receivers into a computer that is
running Windows Vista
or Windows Server 2008:
"STOP: 0x000000CA"
KB 980856 Stop error in Windows Server 2008 R2:
"0x000000CA PNP_DETECTED_FATAL_ERROR"
WinDbg
Help File Entry:
The PNP_DETECTED_FATAL_ERROR
bug check has a value of 0x000000CA. This indicates that the Plug and
Play Manager encountered a severe error, probably as a result of a
problematic Plug and Play driver
Parameters
The following parameters are
displayed on the blue screen. Parameter 1 identifies the type
of violation.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
| 0x1 |
Address of newly-reported PDO |
Address of older PDO which has been duplicated |
Reserved |
Duplicate PDO: A specific instance
of a driver has enumerated multiple PDOs with identical device ID and
unique IDs. |
| 0x2 |
Address of purported PDO |
Address of driver object |
Reserved |
Invalid PDO: An API which requires a
PDO has been called with random memory, or with an FDO, or with a PDO
which hasn't been initialized.
(An uninitialized PDO is one that has not been returned to Plug and
Play by QueryDeviceRelation or QueryBusRelations.)
|
| 0x3 |
Address of PDO whose IDs were queried |
Address of ID buffer |
1: DeviceID
2: UniqueID
3: HardwareIDs
4: CompatibleIDs
|
Invalid ID: An enumerator has
returned an ID which contains illegal characters or isn't properly
terminated. (IDs must contain only characters in the ranges 0x20 - 0x2B
and 0x2D - 0x7F.) |
| 0x4 |
Address of PDO with DOE_DELETE_PENDING set |
Reserved |
Reserved |
Invalid enumeration of deleted PDO:
An enumerator has returned a PDO which it had previously deleted using IoDeleteDevice. |
| 0x5 |
Address of PDO |
Reserved |
Reserved |
PDO freed while linked in devnode tree:
The object manager reference count on a PDO dropped to zero while the
devnode was still linked in the tree. (This usually indicates that the
driver is not adding a reference when returning the PDO in a query IRP.) |
| 0x8 |
Address of PDO whose stack returned the invalid bus
relation |
Total number of PDOs returned as bus relations |
The index (zero-based) at which the first NULL PDO was
found |
Null pointer returned as a bus relation: One
or more of the devices present on the bus is a NULL PDO. |
| 0x9 |
Connection type that was passed |
Reserved |
Reserved |
Invalid connection type passed to
IoDisconnectInterruptEx: A driver has passed an invalid
connection type to IoDisconnectInterruptEx. The
connection type passed to this routine must match the one returned by a
corresponding successful call to IoConnectInterruptEx. |
| 0xA |
Driver object |
IRQL after returning from driver callback |
Combined APC disable count after returning from driver
callback |
Incorrect notify callback behavior: A
driver failed to preserve IRQL or combined APC disable count across a
Plug 'n' Play notification. |
| 0xB |
Related PDO |
Removal relations |
Reserved |
Deleted PDO reported as relation: One
of the removal relations for the device being removed has already been
deleted. |
WinDbg
Output Example:
PNP_DETECTED_FATAL_ERROR
(ca)
PnP encountered a severe error, either as a result of a problem in a
driver or
a problem in PnP itself. The first argument describes the
nature of the
problem, the second argument is the address of the PDO. The
other arguments
vary depending on argument 1.
Arguments:
Arg1: 0000000000000000,
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000CB:
DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (go
to top of page)
Usual causes:
Device driver, Driver verifier
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560212(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xcb
Knowledge
Base Articles:
KB 254813 "Stop
0x000000cb" Uninstalling SMS 2.0 on Windows 2000
KB 825760 You
Receive
Stop Error 0x00000076 or 0x000000CB When You Quit Your Backup Software (2000, XP)
KB 825820 "0x00000076"
or "0x000000CB" Stop Error Occurs When Windows 2000 Server
Tries to Run a Process on a Remote Server
KB 951033 Stop
error
message
on a Windows Server
2003-based computer that has Citrix Presentation
Server 4.5 installed: "0x00000076" or "0x000000CB"
KB 979742 "0x000000CB" Stop error
or "0x00000076" Stop error in Windows Vista or in Windows Server 2008 when you
access shared network resources by using SMB version 1 protocol on the
computer
WinDbg
Help File Entry:
The
DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS bug check has a value of
0x000000CB. This indicates that a driver or the I/O manager failed to
release locked pages after an I/O operation.
Parameters
The four parameters listed
in the message can have two possible meanings.
If a driver locked these
pages, the parameters have the following meaning.
| Parameter |
Description |
| 1 |
Calling address in the driver that locked the pages |
| 2 |
Caller of the calling address in driver that locked the
pages |
| 3 |
Address of the MDL containing the locked pages |
| 4 |
Number of locked pages |
If the driver responsible
for the error can be identified, its name is printed on the blue screen
and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
If the I/O manager locked
these pages, the parameters have the following meaning.
| Parameter |
Description |
| 1 |
Address of the dispatch routine of the top driver on
the stack to which the IRP was sent |
| 2 |
Address of the device object of the top driver on the
stack to which the IRP was sent |
| 3 |
Address of the MDL containing the locked pages |
| 4 |
Number of locked pages |
Comments
This bug check is issued
only if the registry value \\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\TrackLockedPages
is equal to DWORD 1. If this value is not set, the system will issue
the less-informative bug
check 0x76 (PROCESS_HAS_LOCKED_PAGES).
Starting with
Windows Vista, this bug check can also be issued by Driver
Verifier when the Pool Tracking option is enabled.
WinDbg
Output Example:
DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS
(cb)
Caused by a driver not cleaning up completely after an I/O.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 0000000000000000, The calling address in the driver that locked
the pages or if the
IO manager locked the pages this points
to the dispatch routine of
the top driver on the stack to which the
IRP was sent.
Arg2: 0000000000000000, The caller of the calling address in the driver
that locked the
pages. If the IO manager locked the
pages this points to the device
object of the top driver on the stack to
which the IRP was sent.
Arg3: 0000000000000000, A pointer to the MDL containing the locked
pages.
Arg4: 0000000000000000, The number of locked pages.
STOP 0x000000CC:
PAGE_FAULT_IN_FREED_SPECIAL_POOL (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560216(v=VS.85).aspx
Knowledge
Base Articles:
KB 973295 A
multiprocessor computer that is running Windows Server 2003
SP2 stops responding under a heavy load if you change a Windows
Firewall setting
KB 977694 Stop error message when
you access shared files in Windows Server 2008 or in
Windows Vista:
0x00000044 or 0x000000CC
WinDbg
Help File Entry:
The
PAGE_FAULT_IN_FREED_SPECIAL_POOL bug check has a value of 0x000000CC.
This indicates that the system has referenced memory which was earlier
freed.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory address referenced |
| 2 |
0: Read
1: Write
|
| 3 |
Address that referenced memory (if known) |
| 4 |
Reserved |
If the driver responsible
for the error can be identified, its name is printed on the blue screen
and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
Cause
The system has accessed
memory in the special pool which was already freed by a driver. This
usually indicates a system-driver synchronization problem.
For information about the
special pool, consult the Driver Verifier section of the Windows Driver
Kit.
Comments
This cannot be protected by
a try - except handler — it can only be protected
by a probe.
WinDbg
Output Example:
PAGE_FAULT_IN_FREED_SPECIAL_POOL
(cc)
Memory was referenced after it was freed.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: b2632fdc, memory referenced
Arg2: 00000001, value 0 = read operation, 1 = write operation
Arg3: 81cf63b8, if non-zero, the address which referenced memory.
Arg4: 00000000, Mm internal code.
STOP 0x000000CD:
PAGE_FAULT_BEYOND_END_OF_ALLOCATION (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560219(v=VS.85).aspx
Knowledge
Base Articles:
KB 323256 Stop
0x50
Error Message When You Rename a Large Number of Files on Windows 2000
KB 829729 Special
Pool
Feature May Cause a 0x000000CD Stop Error (2000)
KB 836587 FIX:
You may receive a "PAGE_FAULT_BEYOND_END_OF_ALLOCATION" stop error when
you enable event logging in Server for NFS in Windows Services for UNIX
3.0 or 3.5
KB 2280732 You receive Stop error
message 0x000000CD or 0x00000019 on a computer that is running Windows Server 2003 when
corrupted registry hive files are loaded
KB 2870079
Windows 7 SP1 bluescreen happened during stress
tests
WinDbg
Help File Entry:
The
PAGE_FAULT_BEYOND_END_OF_ALLOCATION bug check has a value of
0x000000CD. This indicates that the system accessed memory beyond the
end of some driver's pool allocation.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory address referenced |
| 2 |
0: Read
1: Write
|
| 3 |
Address that referenced memory (if known) |
| 4 |
Reserved |
If the driver responsible
for the error can be identified, its name is printed on the blue screen
and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
Cause
The driver allocated n
bytes of memory from the special pool. Subsequently, the system
referenced more than n bytes from this pool. This
usually indicates a system-driver synchronization problem.
For information about the
special pool, consult the Driver Verifier section of the Windows Driver
Kit.
Comments
This cannot be protected by
a try - except handler — it can only be protected
by a probe.
WinDbg
Output Example:
PAGE_FAULT_BEYOND_END_OF_ALLOCATION
(cd)
N bytes of memory was allocated and more than N bytes are being
referenced.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff9800c6e7000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: fffff8000246cc5c, if non-zero, the address which referenced
memory.
Arg4: 0000000000000000, Mm internal code.
STOP 0x000000CE:
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS
(go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560226(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xce
Knowledge
Base Articles:
KB 290114 "Stop
0x000000CE" in Vga.dll When You Try to Change Display Settings (2000)
KB 293410 STOP
0x000000CE Error Message Occurs in Vga.sys (2000)
KB 296946 "STOP
0x000000CE" Error Message in Raspppoe.sys During Upgrade from Windows
NT 4.0 to Windows 2000
KB 301515 Error
Message
on a Blue Screen When You Stop SFU 2.0 NFS Client Service on Windows XP-Based
Computer
KB 310899 "STOP
0x000000CE in Dxapi.sys" Error on Computer Where Video Adapter Has TV
Tuner or Video Capture Feature (XP)
KB 327643 You
Receive a
"Stop 0x000000CE" Error Message During Shutdown (2000 Server)
KB 329710 "Stop
0x000000CE" Error Message During Startup (2000 Server)
KB 810022 Bugcheck
with
Stop Message "STOP 0x000000CE" and Svr.sys in Crashdump When Computer
Shuts Down (2000)
KB 810038 Stop
0x000000E3 error occurs when redirector thread tries to release a lock (2000)
KB 875430 You
receive a "Stop 0x000000CE" Stop error message when you change the
resources of a parallel port device in Device Manager on your Windows 2000-based
computer
KB 927547 Stop
error
message when you try to shut down Windows Server 2003:
"STOP 0x000000CE DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS"
KB 938512 Error
message
when you perform a surprise removal of a USB device on a Windows XP
Service Pack 2-based computer: "STOP 0x000000CE
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS"
KB 960882 Error
message when a Windows Server
2003-based
computer is shutting down: "Stop 0x000000CE" or "Stop 0x00000050"
KB 976488 You
receive a "Stop 0x000000CD" error on the restart after you run Windows
Update on a virtual machine that is running Windows Server 2000 SP4
KB 2004709 You may revieve an
system blue screen in usbvideo.sys when sleeping or resuming a system
running Microsoft Windows
7
WinDbg
Help File Entry:
The
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS bug check has a
value of 0x000000CE. This indicates that a driver failed to cancel
pending operations before unloading.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory address referenced |
| 2 |
0: Read
1: Write
|
| 3 |
Address that referenced memory (if known) |
| 4 |
Reserved |
If the driver responsible
for the error can be identified, its name is printed on the blue screen
and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
Cause
This driver failed to cancel
lookaside lists, DPCs, worker threads, or other such items before
unload.
WinDbg
Output Example:
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS
(ce)
A driver unloaded without cancelling timers, DPCs, worker threads, etc.
The broken driver's name is displayed on the screen.
Arguments:
Arg1: fffffa60044f4674, memory referenced
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation
Arg3: fffffa60044f4674, If non-zero, the instruction address which
referenced the bad memory
address.
Arg4: 0000000000000000, Mm internal code.
STOP 0x000000CF:
TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE
(go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560231(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE bug check has a
value of 0x000000CF. This indicates that a driver has been incorrectly
ported to the terminal server.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory address referenced |
| 2 |
0: Read
1: Write
|
| 3 |
Address that referenced memory (if known) |
| 4 |
Reserved |
If the driver responsible
for the error can be identified, its name is printed on the blue screen
and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
Cause
The driver is referencing
session space addresses from the system process context. This probably
results from the driver queuing an item to a system worker thread.
This driver needs to comply
with Terminal Server's memory management rules.
WinDbg
Output Example:
TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE
(cf)
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: 0000000000000000, If non-zero, the instruction address which
referenced the bad memory
address.
Arg4: 0000000000000000, Mm internal code.
A driver has been incorrectly ported to
Terminal Server. It is referencing
session space addresses from the system
process context. Probably from
queueing an item to a system worker
thread.
The broken driver's name is displayed on
the screen.
STOP 0x000000D0:
DRIVER_CORRUPTED_MMPOOL (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560239(v=VS.85).aspx
Knowledge
Base Articles:
KB 969550 A
Stop error
occurs on an HP ProLiant server that has the firmware from an
E200/E200i HP Smart Array SAS/SATA controller installed on any Windows
Server platform (2000
Server, Server
2003, Server
2008)
WinDbg
Help File Entry:
The DRIVER_CORRUPTED_MMPOOL
bug check has a value of 0x000000D0. This indicates that the system
attempted to access invalid memory at a process IRQL that was too high.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory referenced |
| 2 |
IRQL at time of reference |
| 3 |
0: Read
1: Write
|
| 4 |
Address that referenced memory |
Cause
The kernel attempted to
access pageable memory (or perhaps completely invalid memory) when the
IRQL was too high. The ultimate cause of this problem is almost
certainly a driver that has corrupted the system pool.
In most cases, this bug
check results if a driver corrupts a large allocation (PAGE_SIZE or
larger). Smaller allocations result in bug
check 0xC5 (DRIVER_CORRUPTED_EXPOOL).
Resolving the Problem
If you have recently
installed any new software, check to see if it is properly installed.
Check for updated drivers on the manufacturer's website.
To debug this error, use the
special pool option of Driver Verifier. If this fails to reveal the
driver that caused the error, use the Global Flags utility to enable
the special pool by pool tag.
For information about the
special pool, consult the Driver Verifier section of the Windows Driver
Kit.
An alternate method is to
open the \\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
registry key. In this key, create or edit the ProtectNonPagedPool
value, and set it equal to DWORD 1. Then reboot. Then the system will
unmap all freed nonpaged pool. This will prevent drivers from
corrupting the pool. (This does not protect the pool from DMA hardware,
however.)
WinDbg
Output Example:
DRIVER_CORRUPTED_MMPOOL
(d0)
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory
An attempt was made to access a pageable
(or completely invalid) address at an
interrupt request level (IRQL) that is
too high. This is
caused by drivers that have corrupted
the system pool. Run the driver
verifier against any new (or suspect)
drivers, and if that doesn't turn up
the culprit, then use gflags to enable
special pool. You can also set
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\ProtectNonPagedPool
to a DWORD 1 value and reboot.
Then the system will unmap freed nonpaged pool,
preventing drivers (although not
DMA-hardware) from corrupting the pool.
STOP 0x000000D1:
DRIVER_IRQL_NOT_LESS_OR_EQUAL (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560244(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xd1
Knowledge
Base Articles:
KB 247421 STOP
0x000000D1 in Ino_fltr.sys with Inoculan (2000)
KB 249442 "Stop
0x000000D1" Error in Atmlane.sys (2000)
KB 260956 "Stop
0x000000D1" Error Message in Tcpip.sys (2000)
KB 269279 The
BLACKDRV.SYS file Causes the Stop Error Message: 0X000000D1(0XBE70D600,
0X00000000,0X00000000,0XBE92F13C) (2000, XP)
KB 282271 "Stop
0X000000D1" Message in Atmlane.sys (2000)
KB 316208
"Stop error code 0x000000D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL)" error
message when you start your Windows XP-based
computer
KB 317326 Stop
0x000000D1 Error Message When You Turn Your Computer Off (XP)
KB 810980 "STOP
0x000000D1 IRQL_NOT_LESS_OR_EQUAL Kbdclass.sys" Error Message When You
Try to Shut Down the Computer (2000, XP)
KB 816036
Windows 2000 crashes with a "Stop
error code 0x000000D1" error message
KB 817367 Stop Error
0x000000D1 When You Use Host Integration Server to Connect to a
Mainframe Computer That Is Using the DLC Protocol (2000)
KB 817789
Computer stops responding with a "Stop error code 0x000000D1
(Driver_IRQL_Not_Less_Or_Equal)" error message (Server 2003)
KB 826502
The server stops
responding, and you receive a "Stop error code 0x000000D1" error
message (2000)
KB 834630
Stop error code
0x000000D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL) on your Windows Server 2003-based computer
KB 842464 You
receive a
"Stop: 0x000000D1" error message after you establish a VPN connection (2000, XP, Server 2003)
KB 842840
Stop error code
0x000000D1 when Windows Server 2003
is under a heavy network load
KB 843091
Stop error code
0x000000D1 when you shut down Windows XP
KB 867772
"Stop error code
0x000000D1" occurs after Windows Server 2003
stops unexpectedly
KB 873152 You
occasionally receive a "STOP: 0x000000D1" error message when your
Windows XP
Service Pack 2-based computer resumes from standby
KB 884590 You
receive a
"Stop 0x000000D1" Stop error message when you back up data to a tape
device on a computer that is running Windows Server 2003,
Windows XP,
or Windows 2000
KB 888399 You
receive a
"STOP 0x000000D1" error message on your Windows XP
Service Pack 2-based portable computer
KB 890554 You
receive a
"STOP 0x000000D1" error message on a blue screen in Windows Server 2003
KB 894070
The Afd.sys file
triggers a "Stop 0x000000D1" error on a Windows Server 2003-based computer
KB 897574 You
may
receive a
Stop error message after you insert media into a removable disk device
in Windows XP,
Windows Server
2003, or Windows 2000
KB 902973 You
occasionally receive a "STOP 0x000000D1" error message when you start
or shut down a Windows XP-based
computer or a Windows Server
2003-based computer
KB 906882 You
receive a
"STOP: 0x000000D1" error message on a computer that is running Windows XP
with Service Pack 1 or Windows XP with Service Pack 2
KB 916595 Stop
error
message on a Windows XP-based
computer: "STOP 0x000000D1"
KB 924941 You receive a stop error
message when you use a Bluetooth radio on a
Windows XP-based computer
KB 925922 The
computer
restarts unexpectedly, or you receive an error message in Windows XP:
"Stop: 0x000000D1"
KB 927015 Stop
error
message on a Windows XP
SP1-based computer: "STOP 0x000000D1"
KB 931322
Error message on a
Windows
Server 2003 SP1 or SP2-based computer
that is configured to use the Network Address Translation (NAT)
functionality: "STOP: 0x000000D1 (parameter1 , 0x00000002, 0x00000000,
0xf27b4e8e)"
KB 931365 Error
message
when you use an IPsec tunnel mode connection to communicate from a
Windows
Vista-based computer to another computer: "STOP 0x000000D1
DRIVER_IRQL_NOT_LESS_OR_EQUAL"
KB 932755
An updated Storport
storage driver is available for Windows Server
2003
KB 935696 You
receive a Stop 0x000000D1 error when you remove a USB storage device
from a computer that is running Windows Server 2003
Service Pack 1 (SP1)
KB 937367
Stop error message when you set the ConnectOnRequestedInterfaceOnly
registry entry to 1 on a computer that is running Microsoft Windows
XP: "STOP 0x000000D1
DRIVER_IRQL_NOT_LESS_OR_EQUAL"
KB 939010 You receive a
"STOP 0x000000D1" error after you create a network bridge on a computer
that is running Windows XP
KB 939780 Error
message
when a Windows XP
SP2-based or Windows Server
2003-based multiprocessor computer uses driver Battc.sys:
"STOP 0x000000D1 DRIVER_IRQL_NOT_LESS_OR_EQUAL"
KB 945119 Stop
error that is related to the Storport.sys driver on a Windows Server
2003-based computer: "0x000000D1 (parameter1, parameter2,
parameter3,
parameter4) DRIVER_IRQL_NOT_LESS_OR_EQUAL"
KB 946776
Stop error message on a Windows Vista-based
computer when you unplug the network cable: "STOP 0x000000D1
DRIVER_IRQL_NOT_LESS_OR_EQUAL"
KB 946939
"Stop error code
0x000000D1" occurs on computers with McAfee VirusScan Enterprise
installed (Server 2003)
KB 947382 Error
message
when you bring the computer out of the "Hibernate system" power state
in Windows Vista:
"Stop 0x000000D1"
KB 955734 Stop
error
message in Windows Server
2008, in Windows Vista,
or in Windows Vista SP1: "0x000000D1"
KB 959520 Stop
error
when you execute some common Plug and Play functions on a Windows Vista-based
or a Windows Server
2008-based computer: "STOP 0x000000D1" or "STOP 0x000000FE"
KB 961799 A Stop error occurs on a
Windows Server 2003-based server when
a user accesses shared files on the server by using an SMB connection
KB 967048 Error
message
on a Windows XP-based
computer that has a USB card reader: "Stop 0x000000D1"
KB 967849
Stop error message
when you install the Cisco VPN Client application and then you restart
a computer that is running Windows 7 Beta:
"Stop 0x000000D1"
KB 967891
Error message when you
use applications that are based on legacy Transport Driver Interface
(TDI) filter drivers on a computer that is running Windows 7 Beta or Windows Server 2008 R2: "STOP 0x000000D1
KB 969238 A
data
transfer is corrupted when you transfer data from or to a USB device on
a computer that is running Windows XP
KB 969550 A
Stop error
occurs on an HP ProLiant server that has the firmware from an
E200/E200i HP Smart Array SAS/SATA controller installed on any Windows
Server platform (2000
Server, Server
2003, Server
2008)
KB 973196 Stop error 0xD1 may
occur on a computer that is running Windows Vista or Windows Server 2008
KB 976748 Stop error code after
you install Microsoft Multipath I/O (MPIO) on a computer that is
running Windows Server
2008: "0x000000D1" or "0x00000050"
KB 977067 You receive a stop error
after you enable the RequireinClearout mode on an IPv6 network on
Windows Server 2008 R2
or in Windows 7
KB 978535 Stop error on a blue
screen when you remove an SD card from a Windows 7-based or
Windows Server 2008 R2-based
computer: "0x000000D1"
KB 978982 Stop error when you
resume a computer that is running Windows 7 or Windows Server 2008 R2 from
sleep or from hibernation: "STOP: 0x000000D1"
KB 982674 "Stop 0x000000D1" error
after you enable an iSCSI Initiator data digest setting that uses CRC
or that uses checksum in Windows Server 2008 R2 or in Windows 7
KB 983543
"STOP 0x000000D1" error message when you try to access a device that is not a
PCI device in Windows 7 or in Windows
Server 2008 R2
KB 2121148 A computer that
is running Windows 7 or Windows
Server 2008 R2 crashes when an
application sends an I/O request to a USB-connected CD drive
KB 2270406 "0x000000D1" Stop error
message when you try to refresh a webpage in Internet Explorer on a
computer that is running Windows XP SP3
KB 2277122
Stop error in Windows
Server 2003 if a computer has some
iSCSI disks and the computer is under a heavy stress situation:
"0x000000D1"
KB 2277440 Stop error message
“0x000000D1” occurs in MSDSM.sys on a computer that is running Windows Server 2008
KB 2320550 Stop error on a
computer that is running Windows Server 2008 R2,
Windows Server 2008
(SP2), Windows Vista
(SP2) or Windows
7 when the operating system uses a virtual storport miniport
driver to save a dump file or a hibernation file: "0x000000D1"
KB 2394911 Stop error "0x000000D1"
or "0x0000007E" in an SMB2 environment in Windows 7 or in
Windows Server 2008 R2
KB 2445815 "DRIVER_IRQL_NOT_LESS_OR_EQUAL
(d1)" Stop error and an ISA
Server 2006 crash may occur
KB 2479442 Stop error during
startup in Windows Server 2008 or in
Windows
Vista
KB 2495313
A "0x000000D1" Stop error occurs when you run a telephony application
that uses the RAS PPPoE driver in Windows 7
KB 2511962 "0x000000D1" Stop error
occurs in the Mpio.sys driver in Windows Server 2008 R2
KB 2519644
Stop code in the tcpip.sys driver on a computer that is running Windows
Server 2008 R2: 0x000000D1
KB 2549567 "0x000000D1" Stop error
message when you back up files to a storage device on a computer that
is running Windows Server 2008 R2
KB 2578466
FIX: Threat Management Gateway 2010 may crash with Stop error
"DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)" (Server
OS's)
KB 2615763 "0x000000D1" Stop
error when you connect a USB composite device to a computer that is
running
Windows 7 or Windows
Server 2008 (R2)
KB 2618032 Stop error 0x000000D1
when you install Windows Phone SDK 7.1 Release Candidate on Windows Developer Preview
(Win8)
KB 2633799
You randomly receive various Stop errors when you change the network
adapter teaming configuration in Windows Server
2008 or in Windows Vista
KB 2636573
FIX: The guest
operating system may crash when you perform a live migration of Hyper-V
virtual machines in a Windows Server 2008 R2
environment
KB 2688203
"0x000000D1" and "0x000000C9"
Stop errors when Message Queuing moves unsent messages to a dead-letter queue in
Windows 7 or in Windows
Server 2008 R2
KB 2712561
"0x000000D1" Stop error when
you run a Windows Logo Kit 1.6 common scenario test in
Windows 7 or in Windows Server 2008 R2
KB 2719347
Stop error when a
Windows 7-based or Windows
Server 2008 R2-based computer crashes randomly
KB 2732485
Microsoft Forefront Unified Access Gateway 2010
Direct Access machine crashes with stop code 0xD1
KB 2742222
Stop error when you try to deploy a Windows 7
or Windows Server 2008 R2 image to a computer
KB 2752370
"0x000000D1" Stop error when you perform a network-related operation on a
computer that is running Windows 7 or Windows
Server 2008 R2
KB 2752589
"0x000000D1" Stop error after you install hotfix 979612 or any later version of
the hotfix that contains the Tcpip.sys file on a computer that is running
Windows Vista or Windows
Server 2008
KB 2781571
"0x000000D1" Stop error after you install TDI drivers in Windows
Vista and Windows
Server 2008
KB 2787847
"0x000000D1" Stop error
when a storage array is attached to a network environment and running Windows
Server 2008 R2
KB 2789968
"0x000000D1" Stop error after you install the WDK WFP "inspect" sample in
Windows 7 or Windows
Server 2008 R2
KB 2820467
"0x000000D1" Stop error when you shut down a Windows
Server 2008 R2-based computer
KB 2821052
"0x000000D1" Stop error when
you open the MPIO snap-in on a computer that is running Windows
Server 2012
KB 2851149
"0x000000D1 DRIVER_IRQL_NOT_LESS_OR_EQUAL" Stop error on a
Windows 7 SP1 or Windows
Server 2008 R2 SP1-based computer
KB 2863960
Stop error message on Windows Server 2012-based
computer: "DRIVER_IRQL_NOT_LESS_OR_EQUAL" or "USER_MODE_HEALTH_MONITOR"
KB 2866029
"0x000000D1" Stop error when you perform a live migration of a virtual machine
on a Windows Server 2012-based cluster
KB 2895237
FIX: Stop error
0X000000D1 in rdbss!RxTimerDispatch occurs on a server that is running
Windows 7 Service Pack 1 or Windows
Server 2008 R2 Service Pack 1
Many more BSOD articles at this link:
http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x000000d1&x=8&y=9&mkt=en-US&FORM=QBME1&l=1
WinDbg
Help File Entry:
The
DRIVER_IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x000000D1. This
indicates that a kernel-mode driver attempted to access pageable memory
at a process IRQL that was too high.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory referenced |
| 2 |
IRQL at time of reference |
| 3 |
0: Read
1: Write
8: Execute
|
| 4 |
Address that referenced memory |
Cause
A driver tried to access an
address that is pageable (or that is completely invalid) while the IRQL
was too high.
This bug check is usually
caused by drivers that have used improper addresses.
If the first parameter has
the same value as the fourth parameter, and the third parameter
indicates an execute operation, this bug check was likely caused by a
driver that was trying to execute code when the code itself was paged
out. Possible causes for the page fault include the following:
- The function was marked as pageable and was running at an
elevated IRQL (which includes obtaining a lock).
- The function call was made to a function in another driver,
and that driver was unloaded.
- The function was called by using a function pointer that
was an invalid pointer.
Resolving the Problem
To begin debugging, use a
kernel debugger to get a stack trace.
If the problem is caused by
the driver that you are developing, make sure that the function that
was executing at the time of the bug check is not marked as pageable or
does not call any other inline functions that could be paged out.
WinDbg
Output Example:
DRIVER_IRQL_NOT_LESS_OR_EQUAL
(d1)
An attempt was made to access a pageable (or completely invalid)
address at an
interrupt request level (IRQL) that is too high. This is
usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 040501d6, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 833b2012, address which referenced memory
Usual causes:
NDIS Device driver, drivers acting on the NDIS driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560249(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The BUGCODE_ID_DRIVER bug
check has a value of 0x000000D2. This indicates that a problem occurred
with an NDIS driver.
Parameters
Before this bug check
occurs, a message is sent to the DbgPrint buffer. If a debugger is
connected, this message will be displayed.
This message indicates the
type of violation. The meanings of the bug check parameters depend on
this message.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Message and Cause |
| Address of the miniport block |
Number of bytes requested |
0 |
1 |
Allocating shared memory at raised IRQL.
A driver called NdisMAllocateSharedMemory with IRQL
>= DISPATCH_LEVEL. |
| Address of the miniport block |
The Status value submitted to NdisMResetComplete |
The AddressingReset value submitted
to NdisMResetComplete |
0 |
Completing reset when one is not pending.
A driver called NdisMResetComplete, but no reset
was pending. |
| Address of the miniport block |
Memory page containing address being freed |
Address of shared memory signature |
Virtual address being freed |
Freeing shared memory not allocated.
A driver called NdisMFreeSharedMemory or NdisMFreeSharedMemoryAsync
with an address that is not located in NDIS shared memory. |
| Address of the miniport block |
Address of the packet that is incorrectly included in
the packet array |
Address of the packet array |
Number of packets in the array |
Indicating packet not owned by it.
The miniport's packet array is corrupt. |
| Address of the MiniBlock |
Address of the driver object |
0 |
0 |
NdisAddDevice: AddDevice called
with a MiniBlock that is not on the NdisMiniDriverList.
|
| Address of the MiniBlock |
The MiniBlock's reference count |
0 |
0 |
NdisMUnload: MiniBlock is getting
unloaded but it is still on NdisMiniDriverList. |
| Address of the miniport block |
Memory page |
Wrapper context |
Address of shared memory signature |
Overwrote past allocated shared memory.
The address being written to is not located in NDIS shared memory. |
In the following instances
of this bug check, the meaning of the parameters depends on the message
and on the value of Parameter 4.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Message and Cause |
| Address of the miniport block |
Address of the miniport interrupt |
Address of the miniport timer queue |
1 |
Unloading without deregistering interrupt.
A miniport driver failed its initialization without deregistering its
interrupt. |
| Address of the miniport block |
Address of the miniport timer queue |
Address of the miniport interrupt |
2 |
Unloading without deregistering interrupt.
A miniport driver did not deregister its interrupt during the halt
process. |
| Address of the miniport block |
Address of the miniport interrupt |
Address of the miniport timer queue |
1 |
Unloading without deregistering timer.
A miniport driver failed its initialization without successfully
canceling all its timers. |
| Address of the miniport block |
Address of the miniport timer queue |
Address of the miniport interrupt |
2 |
Unloading without deregistering timer.
A miniport driver halted without successfully canceling all its timers. |
Comments
This bug check code only
occurs on Windows 2000 and Windows XP. In Windows
Server 2003 and later, the corresponding code is bug
check 0x7C (BUGCODE_NDIS_DRIVER).
On the checked build of
Windows, only the Allocating Shared Memory at Raised IRQL
and Completing Reset When One is Not Pending
instances of this bug check can occur. All the other instances of bug
check 0xD2 are replaced with ASSERTs. See Breaking
Into the Debugger for details.
WinDbg
Output Example:
Unknown bugcheck code (d2)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000D3:
DRIVER_PORTION_MUST_BE_NONPAGED (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560252(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
DRIVER_PORTION_MUST_BE_NONPAGED bug check has a value of 0x000000D3.
This indicates that the system attempted to access pageable memory at a
process IRQL that was too high.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory referenced |
| 2 |
IRQL at time of reference |
| 3 |
0: Read
1: Write
|
| 4 |
Address that referenced memory |
If the driver responsible
for the error can be identified, its name is printed on the blue screen
and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
Cause
This bug check is usually
caused by drivers that have incorrectly marked their own code or data
as pageable.
Resolving the Problem
To begin debugging, use a
kernel debugger to get a stack trace.
WinDbg
Output Example:
DRIVER_PORTION_MUST_BE_NONPAGED
(d3)
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
An attempt was made to access a pageable (or completely invalid)
address at an
interrupt request level (IRQL) that is too high. This is
usually
caused by drivers marking code or data as pageable when it should be
marked nonpaged.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff960002f7124, memory referenced
Arg2: 000000000000000c, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8000227215e, address which referenced memory
STOP 0x000000D4:
SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD
(go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560256(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD bug check has
a value of 0x000000D4. This indicates that a driver did not cancel
pending operations before unloading.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory referenced |
| 2 |
IRQL at time of reference |
| 3 |
0: Read
1: Write
|
| 4 |
Address that referenced memory |
If the driver responsible
for the error can be identified, its name is printed on the blue screen
and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
Cause
This driver failed to cancel
lookaside lists, DPCs, worker threads, or other such items before
unload. Subsequently, the system attempted to access the driver's
former location at a raised IRQL.
Resolving the Problem
To begin debugging, use a
kernel debugger to get a stack trace. If the driver that caused the
error has been identified, activate Driver Verifier and attempt to
replicate this bug.
For full details on Driver
Verifier, see the Windows Driver Kit.
WinDbg
Output Example:
SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD
(d4)
A driver unloaded without cancelling lookaside lists, DPCs, worker
threads, etc.
The broken driver's name is displayed on the screen.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
An attempt was made to access the driver at raised IRQL after it
unloaded.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory
STOP 0x000000D5:
DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560263(v=VS.85).aspx
Knowledge
Base Articles:
KB 289726 Stop
0x000000D5 Error While Adding IP Addresses to NIC by Using
AddIPAddress() Function (2000
Server)
KB 828146 You
receive a
"stop: 0x000000d5 (fatal system error)" error message when you try to
view private characters in Windows 2000
KB 870896 You
receive a "STOP: 0x000000D5" error message when you close an IP Phone
connection on a Windows XP
Service Pack 2-based Toshiba computer or on
a Windows XP
Tablet PC Edition 2005-based Tablet PC
KB 911028 When
you use a 32-bit program to print a document from a 64-bit version of
Microsoft Windows, you may receive a Stop error message, or objects on
the page are omitted (XP,
Server 2003)
KB 935198 The
computer
restarts automatically when you add a monitor to a Windows-XP
based computer
KB 954956 You may encounter a Stop
error on a Windows XP-based computer
when you heavily use the Server Message Block (SMB) redirector component
KB 958819 Error
message
when you press the power button to turn off a Windows XP-based
computer: "STOP: 0x000000D5"
KB 973295 A
multiprocessor
computer that is running Windows Server 2003
SP2 stops responding under
a heavy load if you change a Windows Firewall setting
KB 980226 "STOP: 0X000000D5" error
message on a computer that is running Windows Vista, Windows 7, Windows Server 2008, or
Windows Server 2008 R2
KB 2521624 "0x000000D5" Stop error
message when you run an automated test job in Windows 7 or in
Windows Server 2008 R2
KB 2606025
"0x000000D5" Stop error on a
failover cluster node that has special pool enabled and that is running Windows
Server 2008 R2
KB
2719704
"0x0000003B" or "0x000000D5" Stop error in Windows 7
or in Windows Server 2008 R2
KB 2902124
Stop error 0x50 occurs
in Ndis.sys on a Windows 8-based or Windows
Server 2012-based computer (0xD5 when running
Verifier)
WinDbg
Help File Entry:
The
DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL bug check has a value of
0x000000D5. This indicates that a driver has referenced memory which
was earlier freed.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory address referenced |
| 2 |
0: Read
1: Write
|
| 3 |
Address that referenced memory (if known) |
| 4 |
Reserved |
If the driver responsible
for the error can be identified, its name is printed on the blue screen
and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
Cause
The Driver Verifier Special
Pool option has caught the driver accessing memory which was
earlier freed.
For information about the
special pool, consult the Driver Verifier section of the Windows Driver
Kit.
Comments
This cannot be protected by
a try - except handler — it can only be protected
by a probe.
WinDbg
Output Example:
DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL
(d5)
Memory was referenced after it was freed.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: 0000000000000000, if non-zero, the address which referenced
memory.
Arg4: 0000000000000000, (reserved)
STOP 0x000000D6:
DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION
(go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560267(v=VS.85).aspx
Knowledge
Base Articles:
KB 228440 STOP
0x000000d6 with Xircom CEM56-100 (2000)
KB 285799 Pool Damage
from Ntfs.sys When Quotas Are Used on a Mounted Volume (2000 Server)
KB 326864 STOP:
0x000000D6 Error in Win32k.sys Occurs in Windows 2000
KB 826117 "Stop
0x000000D6" error in File and Print Services for NetWare (2000)
KB 912229 You
may
receive a Stop error when you scan for hardware changes after a
snapshot of a LUN is created in Windows Server 2003
KB 931479 The
print
server
experiences a Stop error when you use the Point and Print feature to
print to a shared printer in Windows Vista (XP, Server 2003)
KB 935198 The
computer
restarts automatically when you add a monitor to a Windows-XP
based computer
KB 935920 When the
Emulex
Elxsli2.sys driver is installed, you may receive a Stop error message
after you upgrade your computer to Windows Server 2003
Service Pack 1
KB 949764 A USB device
no longer works after you resume a Windows XP-based
computer from hibernation (S4)
WinDbg
Help File Entry:
The
DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION bug check has a value of
0x000000D6. This indicates the driver accessed memory beyond the end of
its pool allocation.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory address referenced |
| 2 |
0: Read
1: Write
|
| 3 |
Address that referenced memory (if known) |
| 4 |
Reserved |
If the driver responsible
for the error can be identified, its name is printed on the blue screen
and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
Cause
The driver allocated n
bytes of memory and then referenced more than n bytes.
The Driver Verifier Special Pool option detected
this violation.
For information about the
special pool, consult the Driver Verifier section of the Windows Driver
Kit.
Comments
This cannot be protected by
a try - except handler — it can only be protected
by a probe.
WinDbg
Output Example:
DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION
(d6)
N bytes of memory was allocated and more than N bytes are being
referenced.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: 0000000000000000, if non-zero, the address which referenced
memory.
Arg4: 0000000000000000, (reserved)
STOP 0x000000D7:
DRIVER_UNMAPPING_INVALID_VIEW (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560269(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
DRIVER_UNMAPPING_INVALID_VIEW bug check has a value of 0x000000D7. This
indicates a driver is trying to unmap an address that was not mapped.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Virtual address to unmap |
| 2 |
1: The view is being unmapped
2: The view is being committed
|
| 3 |
0 |
| 4 |
0 |
Comments
The driver that caused the
error can be determined from the stack trace.
WinDbg
Output Example:
DRIVER_UNMAPPING_INVALID_VIEW
(d7)
A driver (usually win32k.sys, but can be determined from the stack
trace for
certain) is trying to unmap an address that was not mapped.
Arguments:
Arg1: 0000000000000000, virtual address to unmap.
Arg2: 0000000000000000, 1 if the view is being unmapped, 2 if the view
is being committed.
Arg3: 0000000000000000, 0.
Arg4: 0000000000000000, 0
STOP 0x000000D8:
DRIVER_USED_EXCESSIVE_PTES (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560271(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xd8
Knowledge
Base Articles:
KB 256004 How
to
troubleshoot "STOP 0x0000003F" and "STOP 0x000000D8" error messages in
Windows Server
2003, Windows XP,
and Windows 2000
KB 294301 How
to
troubleshoot fatal system errors in Access 2002 running on Microsoft
Windows 2000
KB 311551 "STOP
0x000000D8 DRIVER_USED_EXCESSIVE_PTES" Error Message on Server with
Heavy I/O Load (2000
Server)
KB 955033 Stop
0x0000003F or STOP 0x000000D8 occurs on Windows Server 2003
computer with Veritas Backup installed
WinDbg
Help File Entry:
The
DRIVER_USED_EXCESSIVE_PTES bug check has a value of 0x000000D8. This
indicates that there are no more system page table entries (PTE)
remaining.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Pointer to the name of the driver that caused the error
(Unicode string), or zero |
| 2 |
Number of PTEs used by the driver that caused the error
(if Parameter 1 is nonzero) |
| 3 |
Total free system PTEs |
| 4 |
Total system PTEs |
If the driver responsible
for the error can be identified, its name is printed on the blue screen
and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
Cause
This is usually caused by a
driver not cleaning up its memory use properly. Parameter 1
shows the driver which has consumed the most PTEs. The call stack will
reveal which driver actually caused the bug check.
Resolving the Problem
Both drivers may need to be
fixed. The total number of system PTEs may also need to be increased.
WinDbg
Output Example:
DRIVER_USED_EXCESSIVE_PTES
(d8)
No System PTEs left. Usually caused by a driver not cleaning
up
properly. If non-null, Parameter 1 shows the name of the
driver
who is consuming the most PTEs. The calling stack also shows
the name of
the driver which bugchecked. Both drivers need to be fixed
and/or the number
of PTEs increased.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 0000000000000000, If non-null, the guilty driver's name (Unicode
string).
Arg2: 0000000000000000, If parameter 1 non-null, the number of PTEs
used by the guilty driver.
Arg3: 0000000000000000, Total free system PTEs
Arg4: 0000000000000000, Total system PTEs
STOP 0x000000D9:
LOCKED_PAGES_TRACKER_CORRUPTION (go
to top of page)
Usual causes:
Device driver, ?Memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560277(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
LOCKED_PAGES_TRACKER_CORRUPTION bug check has a value of 0x000000D9.
This indicates that the internal locked-page tracking structures have
been corrupted.
Parameters
The following parameters are
displayed on the blue screen. Parameter 1 indicates the type
of violation. The meaning of the other parameters depends on the value
of Parameter 1.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
| 0x01 |
The address of the internal lock tracking structure |
The address of the memory descriptor list |
The number of pages locked for the current process |
The MDL is being inserted twice on the same process
list. |
| 0x02 |
The address of the internal lock tracking structure |
The address of the memory descriptor list |
The number of pages locked for the current process |
The MDL is being inserted twice on the systemwide list.
|
| 0x03 |
The address of the first internal tracking structure
found |
The address of the internal lock tracking structure |
The address of the memory descriptor list |
The MDL was found twice in the process list when being
freed. |
| 0x04 |
The address of the internal lock tracking structure |
The address of the memory descriptor list |
0 |
The MDL was found in the systemwide list on free after
it was removed. |
Cause
The error is indicated by
the value of Parameter 1.
WinDbg
Output Example:
LOCKED_PAGES_TRACKER_CORRUPTION
(d9)
Arguments:
Arg1: 0000000000000000, Type of error.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560282(v=VS.85).aspx
Knowledge
Base Articles:
KB 819636 A
computer that has multiple SCSI controllers and a /3GB Boot.ini option
stops responding with a SYSTEM_PTE_MISUSE (0x000000DA) stop error (2000, XP)
KB 831899 You
receive a
"stop 0x000000DA" error message on a blue screen after you enable PTE
tracking on a Windows Server
2003-based node
KB 837339 "Stop 0x000000DA" error
occurs on a host computer after you start a virtual machine in Virtual PC
2004
WinDbg
Help File Entry:
The SYSTEM_PTE_MISUSE bug
check has a value of 0x000000DA. This indicates that a page table entry
(PTE) routine has been used in an improper way.
Parameters
The following parameters are
displayed on the blue screen. Parameter 1 indicates the type
of violation. The meaning of the other parameters depends on the value
of Parameter 1.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
| 0x01 |
The address of the internal lock tracking structure |
The address of the memory descriptor list |
The address of the duplicate internal lock tracking
structure |
The mapping being freed is a duplicate. |
| 0x02 |
The address of the internal lock tracking structure |
The number of mappings that the system expects to free |
The number of mappings that the driver is requesting to
free |
The number of mappings being freed is incorrect. |
| 0x03 |
The address of the first internal tracking structure
found |
The mapping address that the system expects to free |
The mapping address that the driver is requesting to
free |
The mapping address being freed is incorrect. |
| 0x04 |
The address of the internal lock tracking structure |
The page frame number that the system expects should be
first in the MDL |
The page frame number that is currently first in the
MDL |
The first page of the mapped MDL has changed since the
MDL was mapped. |
| 0x05 |
The address of the first internal tracking structure
found |
The virtual address that the system expects to free |
The virtual address that the driver is requesting to
free |
The start virtual address in the MDL being freed has
changed since the MDL was mapped. |
| 0x06 |
The MDL specified by the driver |
The virtual address specified by the driver |
The number of mappings to free (specified by the driver) |
The MDL being freed was never (or is currently not)
mapped. |
| 0x07 |
The initial mapping |
The number of mappings |
Reserved |
(Windows 2000 only) The
mapping range is being double-allocated. |
| 0x08 |
The initial mapping |
The number of mappings the caller is freeing |
The number of mappings the system thinks should be freed |
(Windows 2000 only) The
caller is asking to free an incorrect number of mappings. |
| 0x09 |
The initial mapping |
The number of mappings that the caller is freeing |
The mapping index that the system thinks is already free |
(Windows 2000 only) The
caller is asking to free several mappings, but at least one of them is
not allocated. |
| 0x0A |
1: The driver requested "bug check
on failure" in the MDL.
0: The driver did not request "bug check on
failure" in the MDL.
|
The number of mappings that the caller is allocating |
The type of mapping pool requested |
(Windows 2000 only) The
caller is asking to allocate zero mappings. |
| 0x0B |
The corrupt mapping |
The number of mappings that the caller is allocating |
The type of mapping pool requested |
(Windows 2000 only) The
mapping list was already corrupt at the time of this allocation. The
corrupt mapping is located below the lowest possible mapping address. |
| 0x0C |
The corrupt mapping |
The number of mappings that the caller is allocating |
The type of mapping pool requested |
(Windows 2000 only) The
mapping list was already corrupt at the time of this allocation. The
corrupt mapping is located above the lowest possible mapping address. |
| 0x0D |
The initial mapping |
The number of mappings that the caller is freeing |
The type of mapping pool |
(Windows 2000 only) The
caller is trying to free zero mappings. |
| 0x0E |
The initial mapping |
The number of mappings that the caller is freeing |
The type of mapping pool |
(Windows 2000 only) The
caller is trying to free mappings, but the guard mapping has been
overwritten. |
| 0x0F |
The non-existent mapping |
The number of mappings that the caller is trying to free |
The type of mapping pool being freed |
(Windows 2000 only) The
caller is trying to free a non-existent mapping. The non-existent
mapping is located below the lowest possible mapping address. |
| 0x10 |
The non-existent mapping |
The number of mappings the caller is trying to free |
The type of mapping pool being freed |
(Windows 2000 only) The
caller is trying to free a non-existent mapping. The non-existent
mapping is located above the highest possible mapping address. |
| 0x11 |
The non-existent mapping |
The number of mappings that the caller is trying to free |
The type of mapping pool being freed |
(Windows 2000 only) The
caller is trying to free a non-existent mapping. The non-existent
mapping is at the base of the mapping address space. |
| 0x100 |
The number of mappings being requested |
The caller's identifying tag |
The address of the routine that called the caller of
this routine |
(Windows XP and later only) The
caller requested 0 mappings. |
| 0x101 |
The first mapping address |
The caller's identifying tag |
The owner's identifying tag |
(Windows XP and later only) A
caller is trying to free a mapping address range that it does not own. |
| 0x102 |
The first mapping address |
The caller's identifying tag |
Reserved |
(Windows XP and later only) The
mapping address space that the caller is trying to free is apparently
empty. |
| 0x103 |
The address of the invalid mapping |
The caller's identifying tag |
The number of mappings in the mapping address space |
(Windows XP and later only) The
mapping address space that the caller is trying to free is still
reserved. MmUnmapReservedMapping
must be called before MmFreeMappingAddress.
|
| 0x104 |
The first mapping address |
The caller's identifying tag |
The owner's identifying tag |
(Windows XP and later only) The
caller is attempting to map an MDL to a mapping address space that it
does not own. |
| 0x105 |
The first mapping address |
The caller's identifying tag |
Reserved |
(Windows XP and later only) The
caller is attempting to map an MDL to an invalid mapping address space.
The caller has mostly likely specified an invalid address. |
| 0x107 |
The first mapping address |
The address of the non-empty mapping |
The last mapping address |
(Windows XP and later only) The
caller is attempting to map an MDL to a mapping address space that has
not been properly reserved. The caller should have called MmUnmapReservedMapping
prior to calling MmMapLockedPagesWithReservedMapping |
| 0x108 |
The first mapping address |
The caller's identifying tag |
The owner's identifying tag |
(Windows XP and later only) The
caller is attempting to unmap a locked mapping address space that it
does not own. |
| 0x109 |
The first mapping address |
The caller's identifying tag |
Reserved |
(Windows XP and later only) The
caller is attempting to unmap a locked virtual address space that is
apparently empty. |
| 0x10A |
The first mapping address |
The number of mappings in the locked mapping address
space |
The number of mappings to unmap |
(Windows XP and later only) The
caller is attempting to unmap more mappings than actually exist in the
locked mapping address space. |
| 0x10B |
The first mapping address |
The caller's identifying tag |
The number of mappings to unmap |
(Windows XP and later only) The
caller is attempting to unmap a portion of a locked virtual address
space that is not currently mapped. |
| 0x10C |
The first mapping address |
The caller's identifying tag |
The number of mappings to unmap |
(Windows XP and later only) The
caller is not unmapping the entirety of the locked mapping address
space. |
| 0x200 |
The first mapping address |
0 |
0 |
(Windows XP and later only) The
caller is attempting to reserve a mapping address space that contains
no mappings. |
0x201
0x202 |
The first mapping address to reserve |
The address of the mapping that has already been
reserved |
The number of mappings to reserve |
(Windows XP and later only) One
of the mappings that the caller is attempting to reserve has already
been reserved. |
| 0x300 |
The first mapping address to release |
0 |
0 |
(Windows XP and later only) The
caller is attempting to release a mapping address space that contains
no mappings. |
| 0x301 |
The address of the mapping |
0 |
0 |
(Windows XP and later only) The
caller is attempting to release a mapping that it is not permitted to
release. |
| 0x303 |
The first mapping address |
The number of mappings to release |
0 |
(Windows XP and later only) The
caller is attempting to release a mapping address range that was not
reserved. |
| 0x304 |
The first mapping address |
The number of mappings to release |
0 |
(Windows XP and later only) The
caller is attempting to release a mapping address range that begins in
the middle of a different allocation. |
| 0x305 |
The first mapping address |
The number of mappings that the caller is trying to
release |
The number of mappings that should be released |
(Windows XP and later only) The
caller is attempting to release the wrong number of mappings. |
| 0x306 |
The first mapping address |
The free mapping address |
The number of mappings to release |
(Windows XP and later only) One
of the mappings that the caller is attempting to release is already
free. |
| 0x400 |
The base address of the I/O space mapping |
The number of pages to be freed |
0 |
(Windows XP and later only)
The caller is trying to free an I/O space mapping that the system is
unaware of. |
Cause
The error is indicated by
the value of Parameter 1.
A stack trace will identify
the driver that caused the error.
WinDbg
Output Example:
SYSTEM_PTE_MISUSE (da)
The stack trace identifies the guilty driver.
Arguments:
Arg1: 0000000000000000, Type of error.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000DB:
DRIVER_CORRUPTED_SYSPTES (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560286(v=VS.85).aspx
Knowledge
Base Articles:
KB 907353 You
receive a
Stop error message when you use a hardware device on a computer that is
running Windows 2000
WinDbg
Help File Entry:
The DRIVER_CORRUPTED_SYSPTES
bug check has a value of 0x000000DB. This indicates that an attempt was
made to touch memory at an invalid IRQL, probably due to corruption of
system PTEs.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Memory referenced |
| 2 |
IRQL |
| 3 |
0: Read
1: Write
|
| 4 |
Address in code which referenced memory |
Cause
A driver tried to access
pageable (or completely invalid) memory at too high of an IRQL. This
bug check is almost always caused by drivers that have corrupted system
PTEs.
Resolving the Problem
If this bug check occurs,
the culprit can be detected by editing the registry. In the \\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
registry key, create or edit the TrackPtes value,
and set it equal to DWORD 3. Then reboot. The system will then save
stack traces, and if the driver commits the same error, the system will
issue bug
check 0xDA (SYSTEM_PTE_MISUSE). Then the stack trace will
identify the driver that caused the error.
WinDbg
Output Example:
DRIVER_CORRUPTED_SYSPTES
(db)
An attempt was made to access a pageable (or completely invalid)
address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted system PTEs. Set
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\TrackPtes
to a DWORD 3 value and reboot. Then the system will save
stack traces and
perform validity checks so the guilty driver can be identified.
There is no other way to find out which driver did this. When
you enable
this flag, if the driver commits the error again you will see a
different
bugcheck - SYSTEM_PTE_MISUSE - and the stack trace will identify the
offending
driver(s).
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory
STOP 0x000000DC:
DRIVER_INVALID_STACK_ACCESS (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560293(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
DRIVER_INVALID_STACK_ACCESS bug check has a value of 0x000000DC. This
indicates that a driver accessed a stack address that lies below the
stack pointer of the stack's thread.
Parameters
None
WinDbg
Output Example:
DRIVER_INVALID_STACK_ACCESS
(dc)
A driver accessed a stack address that lies below the stack pointer of
the
stack's thread.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000DD:
???BIOS IS NOT ACPI COMPLIANT??? (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (dd)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000DE:
POOL_CORRUPTION_IN_FILE_AREA (go
to top of page)
Usual causes:
Device driver, ?Memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560303(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
POOL_CORRUPTION_IN_FILE_AREA bug check has a value of 0x000000DE. This
indicates that a driver has corrupted pool memory that is used for
holding pages destined for disk.
Parameters
None
Cause
When the Memory Manager
dereferenced the file, it discovered this corruption in pool memory.
WinDbg
Output Example:
POOL_CORRUPTION_IN_FILE_AREA
(de)
A driver corrupted pool memory used for holding pages destined for disk.
This was discovered by the memory manager when dereferencing the file.
Arguments:
Arg1: 00000002
Arg2: 891669b8
Arg3: 9f27be68
Arg4: 7d1428c0
STOP 0x000000DF:
IMPERSONATING_WORKER_THREAD (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560308(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
IMPERSONATING_WORKER_THREAD bug check has a value of 0x000000DF. This
indicates that a workitem did not disable impersonation before it
completed.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The worker routine that caused this error |
| 2 |
The parameter passed to this worker routine |
| 3 |
A pointer to the work item |
| 4 |
Reserved |
Cause
A worker thread was
impersonating another process, and failed to disable impersonation
before it returned.
WinDbg
Output Example:
IMPERSONATING_WORKER_THREAD
(df)
A workitem forgot to disable impersonation before it completed.
Arguments:
Arg1: 0000000000000000, Worker Routine that caused this bugcheck.
Arg2: 0000000000000000, Parameter passed to this worker routine.
Arg3: 0000000000000000, Pointer to the Workitem.
Arg4: 0000000000000000
STOP 0x000000E0:
ACPI_BIOS_FATAL_ERROR (go
to top of page)
Usual causes:
BIOS, Faulty hardware
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560314(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The ACPI_BIOS_FATAL_ERROR
bug check has a value of 0x000000E0. This indicates that one of your
computer components is faulty.
Parameters
The parameters for this bug
check are issued by the BIOS, not by Windows. They can only be
interpreted by the hardware vendor.
Cause
Your computer's BIOS has
reported that a component in the system is so faulty that there is no
way for Windows to operate. The BIOS is indicating that there is no
alternative but to issue a bug check.
Resolving the Problem
You can determine which
component is faulty by running the diagnostic disk or tool that was
included with your computer.
If you do not have this
tool, you must contact the system vendor and report this error message
to them. They will be able to help you correct this hardware problem.
This enables Windows to operate.
Microsoft cannot address
this error. Only the hardware vendor is qualified to analyze it.
WinDbg
Output Example:
ACPI_BIOS_FATAL_ERROR (e0)
Your computer (BIOS) has reported that a component in your system is
too faulty
for Windows to be able to run.
You can determine which component is faulty by running the diagnostic
disk or
tool that came with your computer.
If you do not have this tool, you must contact your system vendor and
report
this error message to them. They will be able to assist you
in correcting this
hardware problem, thereby allowing Windows to operate.
Microsoft cannot assist
in the debugging of this problem -- only the hardware vendor can
interpret the
bug check parameters and debug this error.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000E1:
WORKER_THREAD_RETURNED_AT_BAD_IRQL (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560322(v=VS.85).aspx
Knowledge
Base Articles:
KB 953828 Windows
Server 2008
Hyper-V virtual machines generate a Stop error when NLB is configured
or when the NLB cluster does not converge as expected
WinDbg
Help File Entry:
The
WORKER_THREAD_RETURNED_AT_BAD_IRQL bug check has a value of 0x000000E1.
This indicates that a worker thread completed and returned with IRQL
>= DISPATCH_LEVEL.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Address of the worker routine |
| 2 |
IRQL that the worker thread returned at |
| 3 |
Work item parameter |
| 4 |
Work item address |
Cause
A worker thread completed
and returned with IRQL >= DISPATCH_LEVEL.
Resolving the Problem
To find the driver that
caused the error, use the ln (List
Nearest Symbols) debugger command:
kd> ln address
where address
is the worker routine address given in Parameter 1.
WinDbg
Output Example:
WORKER_THREAD_RETURNED_AT_BAD_IRQL
(e1)
Arguments:
Arg1: 0000000000000000, address of worker routine (do ln on this to
find guilty driver)
Arg2: 0000000000000000, IRQL returned at (should have been 0, but
isn't).
Arg3: 0000000000000000, workitem parameter
Arg4: 0000000000000000, workitem address
STOP 0x000000E2:
MANUALLY_INITIATED_CRASH (go
to top of page)
Usual causes:
User initiated crash dump
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560324(v=VS.85).aspx
Knowledge
Base Articles:
KB 244139
Windows feature lets
you generate a memory dump file by using the keyboard (Server 2003/Vista SP1/Server
2008)
KB 273636 "STOP
0x000000E2" Error Message Occurs on a Blue Screen (2000)
KB 971284 A hotfix is
available to enable CrashOnCtrlScroll support for a USB keyboard on a
computer that is running Windows Vista
SP1 or Windows Server
2008
WinDbg
Help File Entry:
The MANUALLY_INITIATED_CRASH
bug check has a value of 0x000000E2. This indicates that the user
deliberately initiated a crash dump from either the kernel debugger or
the keyboard.
Parameters
None
Comments
For more information about
manually-initiated crash dumps, see Forcing a System Crash.
WinDbg
Output Example:
MANUALLY_INITIATED_CRASH
(e2)
The user manually initiated this crash dump.
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560330(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xe3
Knowledge
Base Articles:
KB 329868 Error
Message:
Stop 0x000000E3 RESOURCE_NOT_OWNED (2000 Server)
KB 810038 Stop
0x000000E3 error occurs when redirector thread tries to release a lock (2000)
KB 899325 You
receive a
Stop error message during a heavy I/O load on a Windows Server 2003-based
computer
KB 900808 You
receive a "STOP: 0x000000E3" error message when you safely remove an
encrypted USB storage device from a computer that is running Windows XP
Service Pack 2
KB 951250 Error
message when Symantec Endpoint Protection MR2 quarantines a file in
Windows Vista
or in Windows Server
2008: "Stop 0x000000E3"
KB 951580 You
receive a "Stop 0x000000E3" error message when Symantec Endpoint
Protection MR2 quarantines a file in Windows Vista
or in Windows Server
2008
KB 977426 Error message on a blue
screen when encryption software is installed on a computer that is
running Windows Vista
or Windows Server 2008:
"STOP: 0x000000E3"
KB 2735209
"0x000000E3" Stop error occurs when you try to restart a
Windows 7-based or Windows
Server 2008 R2-based computer
WinDbg
Help File Entry:
The RESOURCE_NOT_OWNED bug
check has a value of 0x000000E3. This indicates that a thread tried to
release a resource it did not own.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Address of resource |
| 2 |
Address of thread |
| 3 |
Address of owner table (if it exists) |
| 4 |
Reserved |
WinDbg
Output Example:
RESOURCE_NOT_OWNED (e3)
A thread tried to release a resource it did not own.
Arguments:
Arg1: 92bf12c0, Address of resource
Arg2: 8f9d07f8, Address of thread
Arg3: 00000000, Address of owner table if there is one
Arg4: 00000002
Usual causes:
Device driver, ?Memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560336(v=VS.85).aspx
Knowledge
Base Articles:
KB 945577 Error
message when a portable Windows Vista-based
computer that has an
integrated or external USB camera device resumes from long-term suspend
mode: "0x000000E4" or "0x0000000A"
KB 954029 Stop
error when you resume a Windows Vista-based
computer that is connected
to a USB optical disc drive from standby "STOP: 0x000000E4" or "STOP:
0x0000000A"
WinDbg
Help File Entry:
The WORKER_INVALID bug check
has a value of 0x000000E4. This indicates that memory that should not
contain an executive worker item does contain such an item, or that a
currently active worker item was queued.
Parameters
The following parameters are
displayed on the blue screen. Parameter 1 indicates the code
position.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
| 0x0 |
Address of worker item |
Start of pool block |
End of pool block |
An active worker item was freed. |
| 0x1 |
Address of worker item |
Queue number |
0 |
An active worker item was queued. |
| 0x2 |
Address of worker item |
Address of I/O worker routine |
0 |
A queued I/O worker item was freed. |
| 0x3 |
Address of worker item |
Address of invalid object |
0 |
An attempt was made to initialize an I/O worker item
with an invalid object. |
Cause
This is usually caused by a
driver freeing memory which still contains an executive worker item.
WinDbg
Output Example:
WORKER_INVALID (e4)
A executive worker item was found in memory which must not contain such
items or a work item was queued that is currently active in the system.
Usually this is memory being freed. This is usually caused by
a device driver that has not cleaned up properly before freeing memory.
Arguments:
Arg1: 0000000000000000, Free of active worker item
Arg2: 0000000000000000, Address of worker item
Arg3: 0000000000000000, Start of pool block
Arg4: 0000000000000000, End of pool block
STOP 0x000000E5:
POWER_FAILURE_SIMULATE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (e5)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000E6:
DRIVER_VERIFIER_DMA_VIOLATION (go
to top of page)
Usual causes:
Driver verifier
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560341(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
DRIVER_VERIFIER_DMA_VIOLATION bug check has a value of 0x000000E6. This
is the bug check code for all Driver Verifier DMA Verification
violations.
Parameters
The following parameters are
displayed on the blue screen. Parameter 1 is the only
parameter of interest. This parameter identifies the exact violation.
If a debugger is attached, an informative message is displayed in the
debugger.
| Parameter 1 |
Cause of Error and Debugger Message |
| 0x00 |
This code can represent two kinds of errors:
1. The driver tried to flush too many bytes to the end of the map
register file. The number of bytes permitted and the number
of bytes attempted are displayed.
2. Windows has run out of contiguous map registers. The
number of map registers needed and the largest block of contiguous map
registers is displayed.
|
| 0x01 |
The performance counter has decreased. The
old and new values of the counter are displayed. |
| 0x02 |
The performance counter has increased too fast. The
counter value is displayed in the debugger. |
| 0x03 |
The driver freed too many DMA common buffers. Usually
this means it freed the same buffer two times. |
| 0x04 |
The driver freed too many DMA adapter channels. Usually
this means it freed the same adapter channel two times. |
| 0x05 |
The driver freed too many DMA map registers. Usually
this means it freed the same map register two times. The
number of active map registers is displayed. |
| 0x06 |
The driver freed too many DMA scatter/gather lists.
Usually this means it freed the same scatter/gather list two times. The
number of lists allocated and the number of lists freed is displayed. |
| 0x07 |
The driver tried to release the adapter without first
freeing all its common buffers. The adapter address and the
number of remaining buffers is displayed. |
| 0x08 |
The driver tried to release the adapter without first
freeing all adapter channels, common buffers, or scatter/gather lists. The
adapter address and the number of remaining items is displayed.
|
| 0x09 |
The driver tried to release the adapter without first
freeing all map registers. The adapter address and the number
of remaining map registers is displayed. |
| 0x0A |
The driver tried to release the adapter without first
freeing all its scatter/gather lists. The adapter address and
the number of remaining scatter/gather lists is displayed. |
| 0x0B |
HV_TOO_MANY_ADAPTER_CHANNELSThe driver has allocated
too many adapter channels at the same time. . (Only one adapter channel
is permitted per adapter.) |
| 0x0C |
The driver tried to allocate too many map registers at
the same time. The number requested and the number allowed
are displayed. |
| 0x0D |
The driver did not flush its adapter buffers. The
number of bytes that the driver tried to map and the maximum number of
bytes allowed are displayed. |
| 0x0E |
The driver tried a DMA transfer without locking the
buffer. The buffer in question was in paged memory. The
address of the MDL is displayed. |
| 0x0F |
The driver or the hardware wrote outside its allocated
DMA buffer. The nature of the error (overrun or underrun) is
displayed, as well as the relevant addresses. |
| 0x10 |
The driver tried to free its map registers while some
were still mapped. The number of map registers still mapped
is displayed. |
| 0x11 |
The driver has too many outstanding reference counts
for the adapter. The number of reference counts and the
adapter address are displayed. |
| 0x13 |
The driver called a DMA routine at an improper IRQL. The
required IRQL and the actual IRQL are displayed. |
| 0x14 |
The driver called a DMA routine at an improper IRQL. The
required IRQL and the actual IRQL are displayed. |
| 0x15 |
The driver tried to allocate too many map registers. The
number requested and the number allowed are displayed. |
| 0x16 |
The driver tried to flush a buffer that is not mapped. The
address of the buffer is displayed. |
| 0x18 |
The driver tried a DMA operation by using an adapter
that was already released and no longer exists. The adapter
address is displayed. |
| 0x19 |
The driver passed a null DMA_ADAPTER value to a HAL
routine. |
| 0x1B |
The driver passed an address and MDL to a HAL routine.
However, this address is not within the bounds of this MDL. The
address passed and the address of the MDL are displayed. |
| 0x1D |
The driver tried to map an address range that was
already mapped. The address range and the current mapping for
that range are displayed. |
| 0x1E |
The driver called HalGetAdapter.
This function is obsolete — you must use IoGetDmaAdapter
instead. |
| 0x1F |
HV_BAD_MDLThe driver referenced an invalid system
address — either before the first MDL, or after the end of the first
MDL, or by using a transfer length that is longer than the MDL buffer
and crosses a page boundary within the MDL. . Either the
invalid address and the first MDL address, or the MDL address and the
extra transfer length are displayed. |
| 0x20 |
The driver tried to flush a map register that hasn't
been mapped. The map register base, flushing address, and MDL
are displayed. |
| 0x21 |
The driver tried to map a zero-length buffer for
transfer. |
Cause
See the description of each
code in the Parameters section for a description of the cause.
Resolving the Problem
This bug check can only
occur when Driver Verifier has been instructed to monitor one or more
drivers. If you did not intend to use Driver Verifier, you should
deactivate it. You might also consider removing the driver that caused
this problem.
If you are the driver
writer, use the information obtained through this bug check to fix the
bugs in your code.
The Driver Verifier DMA
Verification option is only available in Windows XP
and later versions. For full details on Driver Verifier, see the
Windows Driver Kit.
WinDbg
Output Example:
DRIVER_VERIFIER_DMA_VIOLATION
(e6)
An illegal DMA operation was attempted by a driver being verified.
Arguments:
Arg1: 0000000f, Boundary overrun. Driver or DMA hardware has
written outside of its allocation.
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
STOP 0x000000E7:
INVALID_FLOATING_POINT_STATE (go
to top of page)
Usual causes:
Device driver, ?Memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560344(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
INVALID_FLOATING_POINT_STATE bug check has a value of 0x000000E7. This
indicates that a thread's saved floating-point state is invalid.
Parameters
The following parameters are
displayed on the blue screen. Parameter 1 indicates which
validity check failed. Parameter 4 is not used. The meaning of
the other parameters depends on the value of Parameter 1.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Cause of Error |
| 0x0 |
The flags field |
0 |
The saved context flags field is invalid. Either
FLOAT_SAVE_VALID is not set, or some reserved bits are nonzero. |
| 0x1 |
The saved IRQL |
The current IRQL |
The current processor's IRQL is not the same as when
the floating-point context was saved. |
| 0x2 |
The saved address of the thread that owns this
floating-point context |
The current thread |
The saved context does not belong to the current thread. |
Cause
While restoring the
previously-saved floating-point state for a thread, the state was found
to be invalid.
Parameter 1
indicates which validity check failed.
WinDbg
Output Example:
INVALID_FLOATING_POINT_STATE
(e7)
While restoring the previously saved floating point state for a thread,
the state was found to be invalid. The first argument
indicates which
validity check failed.
Arguments:
Arg1: 0000000000000000, Saved context flags field is invalid, either
FLOAT_SAVE_VALID
is not set or some of the reserved bits
are non-zero. Second
argument is the flags field.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000E8:
INVALID_CANCEL_OF_FILE_OPEN (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560347(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
INVALID_CANCEL_OF_FILE_OPEN bug check has a value of 0x000000E8. This
indicates that an invalid file object was passed to IoCancelFileOpen.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The file object passed to IoCancelFileOpen
|
| 2 |
The device object passed to IoCancelFileOpen
|
| 3 |
Reserved |
| 4 |
Reserved |
Cause
The file object passed to IoCancelFileOpen
is invalid. It should have reference of one. The driver that called IoCancelFileOpen
is at fault.
WinDbg
Output Example:
INVALID_CANCEL_OF_FILE_OPEN
(e8)
The fileobject passed to IoCancelFileOpen is invalid. It should have
reference
of 1. The driver that called IoCancelFileOpen is at fault.
Arguments:
Arg1: 0000000000000000, FileObject passed to IoCancelFileOpen
Arg2: 0000000000000000, DeviceObject passed to IoCancelFileOpen
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000E9:
ACTIVE_EX_WORKER_THREAD_TERMINATION (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560349(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
ACTIVE_EX_WORKER_THREAD_TERMINATION bug check has a value of
0x000000E9. This indicates that an active executive worker thread is
being terminated.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The exiting ETHREAD |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
An executive worker thread
is being terminated without having gone through the worker thread
rundown code. This is forbidden; work items queued to the ExWorkerQueue
must not terminate their threads.
A stack trace should
indicate the cause.
WinDbg
Output Example:
ACTIVE_EX_WORKER_THREAD_TERMINATION
(e9)
An executive worker thread is being terminated without having gone
through
the worker thread rundown code. A stack trace should indicate
the cause.
Arguments:
Arg1: 0000000000000000, The exiting ETHREAD.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000EA:
THREAD_STUCK_IN_DEVICE_DRIVER (go
to top of page)
Usual causes:
Device driver, Faulty hardware
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560350(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xea
Knowledge
Base Articles:
Troubleshooting
specific Stop messages
KB 293078 Error
message
in Windows XP:
"STOP 0x000000EA THREAD_STUCK_IN_DEVICE_DRIVER"
KB 314215 "Stop 0x000000EA" Error
Message When You Run Video-Intensive Programs (XP)
WinDbg
Help File Entry:
The
THREAD_STUCK_IN_DEVICE_DRIVER bug check has a value of 0x000000EA. This
indicates that a thread in a device driver is endlessly spinning.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
A pointer to the stuck thread object |
| 2 |
A pointer to the DEFERRED_WATCHDOG object |
| 3 |
A pointer to the offending driver name |
| 4 |
In the kernel debugger: The number
of times the "intercepted" bug check 0xEA was hit
On the blue screen: 1
|
Cause
A device driver is spinning
in an infinite loop, most likely waiting for hardware to become idle.
This usually indicates
problem with the hardware itself, or with the device driver programming
the hardware incorrectly. Frequently, this is the result of a bad video
card or a bad display driver.
Resolving the Problem
Use the .thread (Set
Register Context) command together with
Parameter 1. Then use kb (Display
Stack Backtrace) to find the location where the
thread is stuck.
If the kernel debugger is
already connected and running when Windows detects a time-out
condition. Then DbgBreakPoint will be called
instead of KeBugCheckEx. A detailed message will be
printed to the debugger. See Sending
Output to the Debuggefor more information.
This message will include
what would have been the bug check parameters. Because no actual bug
check was issued, the .bugcheck (Display
Bug Check Data) command will not be useful. The
four parameters can also be retrieved from Watchdog's global variables
by using dd watchdog!g_WdBugCheckData L5"
on a 32-bit system, or dq watchdog!g_WdBugCheckData L5"
on a 64-bit system.
Debugging this error in an
interactive manner such as this will enable you to find an offending
thread, set breakpoints in it, and then use g (Go)
to return to the spinning code to debug it further.
On multiprocessor machines
(OS build 3790 or earlier), you can hit a time out if the spinning
thread is interrupted by a hardware interrupt and an ISR or DPC routine
is running at the time of the bug check. This is because the time out's
work item can be delivered and handled on the second CPU and the same
time. If this occurs, you must look deeper at the offending thread's
stack to determine the spinning code which caused the time out to
occur. Use the dds (Display
Words and Symbols) command to do this.
WinDbg
Output Example:
THREAD_STUCK_IN_DEVICE_DRIVER
(ea)
The device driver is spinning in an infinite loop, most likely waiting
for
hardware to become idle. This usually indicates problem with the
hardware
itself or with the device driver programming the hardware incorrectly.
If the kernel debugger is connected and running when watchdog detects a
timeout condition then DbgBreakPoint() will be called instead of
KeBugCheckEx()
and detailed message including bugcheck arguments will be printed to the
debugger. This way we can identify an offending thread, set breakpoints
in it,
and hit go to return to the spinning code to debug it further. Because
KeBugCheckEx() is not called the .bugcheck directive will not return
bugcheck
information in this case. The arguments are already printed out to the
kernel
debugger. You can also retrieve them from a global variable via
"dd watchdog!g_WdBugCheckData l5" (use dq on NT64).
On MP machines (OS builds <= 3790) it is possible to hit a
timeout when the spinning thread is
interrupted by hardware interrupt and ISR or DPC routine is running at
the time
of the bugcheck (this is because the timeout's work item can be
delivered and
handled on the second CPU and the same time). If this is the case you
will have
to look deeper at the offending thread's stack (e.g. using dds) to
determine
spinning code which caused the timeout to occur.
Arguments:
Arg1: 0000000000000000, Pointer to a stuck thread object. Do
.thread then kb on it to find
the hung location.
Arg2: 0000000000000000, Pointer to a DEFERRED_WATCHDOG object.
Arg3: 0000000000000000, Pointer to offending driver name.
Arg4: 0000000000000000, Number of times this error occurred.
If a debugger is attached,
this error is not always fatal -- see
DESCRIPTION below. On the
blue screen, this will always equal 1.
STOP 0x000000EB:
DIRTY_MAPPED_PAGES_CONGESTION (go
to top of page)
Usual causes:
File system/filter driver, Memory,
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560353(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
DIRTY_MAPPED_PAGES_CONGESTION bug check has a value of 0x000000EB. This
indicates that no free pages are available to continue operations.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The total number of dirty pages |
| 2 |
The number of dirty pages destined for the page file |
| 3 |
Windows Server 2003 only:
The size of the nonpaged pool available at the time of the bug check
(in pages)
Windows Vista and later versions: Reserved
|
| 4 |
Windows Server 2003 only:
The number of transition pages that are currently stranded
Windows Vista and later versions: The most
recent modified write error status
|
Cause
The file system driver stack
has deadlocked and most of the modified pages are destined for the file
system. Because the file system is non-operational, the system has
crashed because none of the modified pages can be reused without losing
data. Any file system or filter driver in the stack may be at fault.
To see general memory
statistics, use the !vm 3
extension.
This bug check can occur for
any of the following reasons:
- A driver has blocked, deadlocking the modified or mapped
page writers. Examples of this include mutex deadlocks or accesses to
paged out memory in file system drivers or filter drivers. This
indicates a driver bug.
If Parameter 1 or Parameter 2 is large,
this is a possibility. Use !vm 3.
- A storage driver is not processing requests. Examples of
this are stranded queues and unresponsive drives. This indicates a
driver bug.
If Parameter 1 or Parameter 2 is large,
this is a possibility. Use !process 0 7.
- Windows Server 2003 only: Not
enough pool is available for the storage stack to write out modified
pages. This indicates a driver bug.
If Parameter 3 is small, this is a possibility.
Use !vm
and !poolused 2.
WinDbg
Output Example:
DIRTY_MAPPED_PAGES_CONGESTION
(eb)
No free pages available to continue operations.
If kernel debugger available, type "!vm 3".
This bugcheck usually occurs for the following reasons:
1. A driver has blocked, deadlocking the modified or mapped
page writers. Examples of this include mutex deadlocks or
accesses to paged out memory in filesystem drivers, filter
drivers, etc. This indicates a driver bug.
If parameter 1 or 2 is large, then this is a possibility. Type
"!vm 3" in the kernel debugger.
2. The storage driver(s) are not processing
requests. Examples
of this are stranded queues, non-responding drives, etc. This
indicates a driver bug.
If parameter 1 or 2 is large, then this is a possibility. Type
"!process 0 7" in the kernel debugger.
3. Not enough pool is available for the storage stack to
write out
modified pages. This indicates a driver bug.
If parameter 3 is small, then this is a possibility. Type
"!vm" and "!poolused 2" in the kernel debugger.
Arguments:
Arg1: 0000000000000000, Total number of dirty pages
Arg2: 0000000000000000, Number of dirty pages destined for the
pagefile(s).
Arg3: 0000000000000000, Internal flags.
Arg4: 0000000000000000, Most recent modified write error status.
STOP 0x000000EC:
SESSION_HAS_VALID_SPECIAL_POOL_ON_EXIT (go
to top of page)
Usual causes:
A bug in win32k.sys, atmfd.dll,
rdpdd.dll, or a video driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560354(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
SESSION_HAS_VALID_SPECIAL_POOL_ON_EXIT bug check has a value of
0x000000EC. This indicates that a session unload occurred while a
session driver still held memory.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The session ID |
| 2 |
The number of special pool pages that are leaking |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
This error is caused by a
session driver not freeing its special pool allocations prior to a
session unload. This indicates a bug in win32k.sys,
atmfd.dll, rdpdd.dll, or a video
driver.
WinDbg
Output Example:
SESSION_HAS_VALID_SPECIAL_POOL_ON_EXIT
(ec)
Caused by a session driver not freeing its pool allocations prior to a
session unload. This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000000000000, session ID
Arg2: 0000000000000000, number of special pool pages that are leaking
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000ED:
UNMOUNTABLE_BOOT_VOLUME (go
to top of page)
Usual causes:
Hard drive problem, File system problem, Improper boot parameters
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560355(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xed
Knowledge
Base Articles:
KB 297185 When
you
restart your computer or upgrade to Windows XP,
you receive the "STOP 0x000000ED UNMOUNTABLE_BOOT_VOLUME" error message
KB 315403 Stop
0x000000ED Error Message When Volume on IDE Drive with Caching Enabled
Is Mounted (XP)
KB 555302 Unmountable
Boot Volume (XP)
WinDbg
Help File Entry:
The UNMOUNTABLE_BOOT_VOLUME
bug check has a value of 0x000000ED. This indicates that the I/O
subsystem attempted to mount the boot volume and it failed.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The device object of the boot volume |
| 2 |
The status code from the file system that describes why
it failed to mount the volume |
| 3 |
Reserved |
| 4 |
Reserved |
WinDbg
Output Example:
UNMOUNTABLE_BOOT_VOLUME
(ed)
The IO subsystem attempted to mount the boot volume and it failed.
Arguments:
Arg1: 0000000000000000, Device object of the boot volume
Arg2: 0000000000000000, Status code from the filesystem on why it
failed to mount the volume
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (ee)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000EF:
CRITICAL_PROCESS_DIED (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560358(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The CRITICAL_PROCESS_DIED
bug check has a value of 0x000000EF. This indicates that a critical
system process died.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The process object |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
Reserved |
WinDbg
Output Example:
CRITICAL_PROCESS_DIED (ef)
A critical system process died
Arguments:
Arg1: 0000000000000000, Process object
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (f0)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000F1:
SCSI_VERIFIER_DETECTED_VIOLATION (go
to top of page)
Usual causes:
Driver verifier
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560365(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
SCSI_VERIFIER_DETECTED_VIOLATION bug check has a value of 0x000000F1.
This is the bug check code for all Driver Verifier SCSI
Verification violations.
Parameters
The four bug check
parameters are displayed on the blue screen. Parameter 1
identifies the type of violation.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
| 0x1000 |
First argument passed |
Second argument passed |
Reserved |
The miniport driver passed bad arguments to ScsiPortInitialize. |
| 0x1001 |
Delay, in microseconds |
Reserved |
Reserved |
The miniport driver called ScsiPortStallExecution
and specified a delay greater than 0.1 second, stalling the processor
too long. |
| 0x1002 |
Address of routine that took too long |
Address of miniport's HW_DEVICE_EXTENSION |
Duration of the routine, in microseconds |
A miniport routine called by the port driver took
longer than 0.5 second to execute.
(0.5 seconds is the limit for most routines. However, the HwInitialize
routine is allowed 5 seconds, and the FindAdapter
routine is exempt.)
|
| 0x1003 |
Address of miniport's HW_DEVICE_EXTENSION |
Address of the SRB |
Reserved |
The miniport driver completed a request more than once. |
| 0x1004 |
Address of the SRB |
Address of miniport's HW_DEVICE_EXTENSION |
Reserved |
The miniport driver completed a request with an invalid
SRB status. |
| 0x1005 |
Address of miniport's HW_DEVICE_EXTENSION |
Address of LOGICAL_UNIT_EXTENSION |
Reserved |
The miniport driver called ScsiPortNotification
to ask for NextLuRequest, but an untagged request
is still active. |
| 0x1006 |
Address of miniport's HW_DEVICE_EXTENSION |
Invalid virtual address |
Reserved |
The miniport driver passed an invalid virtual address
to ScsiPortGetPhysicalAddress.
(This usually means the address supplied doesn't map to the common
buffer area.)
|
| 0x1007 |
Address of ADAPTER_EXTENSION |
Address of miniport's HW_DEVICE_EXTENSION |
Reserved |
The reset hold period for the bus ended, but the
miniport driver still has outstanding requests. |
Cause
See the description of each
code in the Parameters section for an explanation of the cause.
Resolving the Problem
This bug check can only
occur when Driver Verifier has been instructed to monitor one or more
drivers. If you did not intend to use Driver Verifier, you should
deactivate it. You might consider removing the driver which caused this
problem as well.
If you are the driver
writer, use the information obtained through this bug check to fix the
bugs in your code.
The Driver Verifier SCSI
Verification option is only available in Windows XP
and later. For full details on Driver Verifier, see the Windows Driver
Kit.
WinDbg
Output Example:
SCSI_VERIFIER_DETECTED_VIOLATION
(f1)
The SCSI verifier has detected an error in a SCSI miniport driver being
verified.
Arguments:
Arg1: 0000000000000000, Error code:
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000F2:
HARDWARE_INTERRUPT_STORM (go
to top of page)
Usual causes:
AUMHA
Listing:
http://aumha.org/a/stop.php#0xf2
Knowledge
Base Articles:
KB 290101 Error
Message:
An Interrupt Storm Has Caused the System to Hang (XP, Adv Server)
WinDbg
Help File Entry:
WinDbg
Output Example:
HARDWARE_INTERRUPT_STORM
(f2)
Note: This bug check no longer exists in any version of
Windows.
This bugcheck will show up on the screen when the kernel
detects an interrupt "storm". An interrupt storm is defined
as a level
triggered interrupt signal staying in the asserted state.
This is fatal
to the system in the manner that the system will hard hang, or "bus
lock".
This can happen because of the following:
- A piece of hardware does not release its
interrupt signal after being told
to do so by the device driver
- A device driver does not instruct its hardware to
release the interrupt
signal because it does not believe the
interrupt was initiated from its
hardware
- A device driver claims the interrupt even though
the interrupt was not
initiated from its hardware.
Note that this can only occur when multiple
devices are sharing the same IRQ.
- The ELCR (edge level control register) is set
incorrectly.
- Edge and Level interrupt triggered devices share
an IRQ (e.g. COM port and
PCI SCSI controller).
All of these cases will instantly hard hang your system.
Instead of hard
hanging the system, this bugcheck is initiated since in many cases it
can
identify the culprit.
When the bugcheck occurs, the module containing the ISR (interrupt
service
routine) of the storming IRQ is displayed on the screen. This
is an
example of what you would see:
*** STOP: 0x000000F2 (0xFCA7C55C, 0x817B9B28, 0x817D2AA0, 0x00000002)
An interrupt storm has caused the system to hang.
*** Address FCA7C55C base at FCA72000, Datestamp 3A72BDEF - ACPI.sys
In the event the fourth parameter is a 0x00000001, the module pointed to
is very likely the culprit. Either the driver is broken, or
the hardware
is malfunctioning.
In the event the fourth parameter is a 0x00000002, the module pointed to
is the first ISR in the chain, and is never guaranteed to be the
culprit.
A user experiencing this bugcheck repeatedly should try to isolate the
problem by looking for devices that are on the same IRQ as the one for
which the module is a driver for (in this case, the same IRQ that ACPI
is using). In the future, we may be able to list all devices
on a
chained ISR.
Arguments:
Arg1: 0000000000000000, address of the ISR (or first ISR in the chain)
connected to the storming interrupt vector
Arg2: 0000000000000000, ISR context value
Arg3: 0000000000000000, address of the interrupt object for the
storming interrupt vector
Arg4: 0000000000000000, 0x1 if the ISR is not chained, 0x2 if the ISR
is chained
Usual causes:
Loaded applications/drivers that didn't unload before shutdown
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560368(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xf3
Knowledge
Base Articles:
WinDbg
Help File Entry:
The DISORDERLY_SHUTDOWN bug
check has a value of 0x000000F3. This indicates that Windows was unable
to shut down due to lack of memory.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The total number of dirty pages |
| 2 |
The number of dirty pages destined for the page file |
| 3 |
Windows Server 2003 only:
The size of the nonpaged pool available at the time of the bug check
(in pages)
Windows Vista and later: Reserved
|
| 4 |
Windows Server 2003 only:
The current shut down stage
Windows Vista and later: The most recent
modified write error status
|
Cause
Windows attempted to shut
down, but there were no free pages available to continue operations.
Because applications were
not terminated and drivers were not unloaded, they continued to access
pages even after the modified writer had terminated. This causes the
system to run out of pages, since the page files could be used.
WinDbg
Output Example:
DISORDERLY_SHUTDOWN (f3)
No free pages available to continue operations.
Because applications are not terminated and drivers are
not unloaded, they can continue to access pages even after
the modified writer has terminated. This can cause the
system to run out of pages since the pagefile(s) cannot be used.
Arguments:
Arg1: 0000000000000000, Total number of dirty pages
Arg2: 0000000000000000, Number of dirty pages destined for the
pagefile(s).
Arg3: 0000000000000000, Internal flags.
Arg4: 0000000000000000, Most recent modified write error status.
STOP 0x000000F4:
CRITICAL_OBJECT_TERMINATION (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560372(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xf4
Knowledge
Base Articles:
KB 330100 Connecting a
hard disk drive in slave only mode leads to system halt during resume
from standby (XP,
Server 2003)
KB 904779 A
Windows Server 2003-based
computer stops responding, and you receive a "Stop 0x000000F4" error
message
KB 916199 Windows
XP
stops responding when you click or resize a window, or in Windows Server 2003,
when you run many console applications, you receive a Stop error
message: "0x000000F4"
KB 923150 When
you
restart Windows Server
2003 after you use the Driver Verifier utility, you may
receive a Stop error: "STOP 0x00000050" or "STOP 0x000000F4"
KB 935192 Error message
when
you resume a Windows XP-based
computer from hibernation after you apply
hotfix 918005: "Stop 0x00000044" or “Stop 0x000000F4”
KB 948928 Stop
error
message when multiple console applications are opened and closed within
a short time frame on a Windows Server 2003-based
computer: "0x000000F4"
KB 977178 You receive various Stop
error messages in Windows
7 or in Windows Server 2008 R2 when you
resume a computer that has a large SATA hard disk
KB 981369 "Stop: 0x000000F4":
error message when a console application is exiting in Windows Vista or in Windows Server 2008
KB 2498326
Stop Error on Windows Server 2008 R2
During Upgrade of FCoE Adapter Driver
KB 2580450 "0x000000F4" Stop error
when you open a console application in Windows Server 2008 or in
Windows Vista
KB 2653132
Stop Code 0x000000F4
May Occur When Running VMware ESX 4.1
(w/Server 2003 client)
KB 2675806
"0x000000F4" Stop error when you try to start a ClickOnce application
in
Windows 7 or in Windows
Server 2008 R2
KB 2690750
"0x000000F4" Stop error when you stop a PowerShell script in
Windows 7 or in Windows
Server 2008 R2
KB 2722392
"0x000000F4" Stop error when you run the Device Fundamental tests in
Windows 7 or in Windows
Server 2008 R2
WinDbg
Help File Entry:
The
CRITICAL_OBJECT_TERMINATION bug check has a value of 0x000000F4. This
indicates that a process or thread crucial to system operation has
unexpectedly exited or been terminated.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The terminating object type:
0x3: Process
0x6: Thread
|
| 2 |
The terminating object |
| 3 |
The process image file name |
| 4 |
Pointer to an ASCII string containing an explanatory
message |
Cause
Several processes and
threads are necessary for the operation of the system. When they are
terminated for any reason, the system can no longer function.
WinDbg
Output Example:
CRITICAL_OBJECT_TERMINATION
(f4)
A process or thread crucial to system operation has unexpectedly exited
or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8007c13b30, Terminating object
Arg3: fffffa8007c13e10, Process image file name
Arg4: fffff800031d5670, Explanatory message (ascii)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560383(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The FLTMGR_FILE_SYSTEM bug
check has a value of 0x000000F5. This indicates that an unrecoverable
failure occurred in the Filter Manager.
Parameters
The following parameters are
displayed on the blue screen. Parameter 1 indicates the type
of violation. The meaning of the other parameters depends on the value
of Parameter 1.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of error |
| 0x66 |
Pointer to the callback data structure for the
operation. |
0 |
0 |
The minifilter returned FLT_PREOP_SUCCESS_WITH_CALLBACK
or FLT_PREOP_SYNCHRONIZE from a preoperation callback, but did not
register a corresponding postoperation callback. |
| 0x67 |
Pointer to the callback data structure for the
operation. |
0 |
Error NTSTATUS code for the operation |
An internal object ran out of space, and the system is
unable to allocate new space. |
| 0x68 |
Handle for the object. |
0 |
NTSTATUS code returned by ObReferenceObjectByHandle |
Unexpected failure referencing an object. |
| 0x6A |
File object pointer for the file. |
0 |
0 |
The file-open or file-create request could not be
canceled, because one or more handles have been created for the file. |
| 0x6B |
Frame ID |
0 |
Thread |
Invalid BACKPOCKET IRPCTRL state. |
| 0x6C |
Frame ID |
BackPocket List |
Thread |
Too many nested PageFaults for BACKPOCKETED IRPCTR. |
| 0x6D |
Address of the minifilter's context structure |
Address of the CONTEXT_NODE structure |
0 |
The context structure was dereferenced too many times.
This means that the reference count on the Filter Manager's
CONTEXT_NODE structure went to zero while it was still attached to its
associated object.
|
| 0x6E |
Address of the minifilter's context structure |
Address of the CONTEXT_NODE structure |
0 |
The context structure was referenced after being freed. |
Cause
The cause of the problem is
indicated by the value of Parameter 1. See the table in the
Parameters section.
Resolving the Problem
If Parameter 1
equals 0x66, you can debug this problem by
verifying that your minifilter driver has registered a post-operation
callback for this operation. The current operation can be found in the
callback data structure. (See Parameter 2.) Use the !fltkd.cbd
debugger extension.
If Parameter 1
equals 0x67, you should verify that you do not have
a nonpaged pool leak somewhere in the system.
If Parameter 1
equals 0x6A, make sure that your minifilter driver
does not reference this file object (see Parameter 2) to get a
handle at any point during your minifilter's processing of this
operation.
If Parameter 1
equals 0x6B or 0x6C, then a
non-recoverable internal state error has occurred which will cause the
operating system to bug check.
If Parameter 1
equals 0x6D, make sure that your minifilter driver
does not call FltReleaseContext too many times for
the given context (see Parameter 2).
If Parameter 1
equals 0x6E, make sure that your minifilter driver does not call FltReferenceContext
after the given context has been deleted (see Parameter 2).
WinDbg
Output Example:
FLTMGR_FILE_SYSTEM (f5)
An unrecoverable failure occured inside the filter manager.
Arguments:
Arg1: 0000000000000000, The reason for the failure
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000F6:
PCI_VERIFIER_DETECTED_VIOLATION (go
to top of page)
Usual causes:
BIOS, Driver verifier
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560386(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
PCI_VERIFIER_DETECTED_VIOLATION bug check has a value of 0x000000F6.
This indicates that an error occurred in the BIOS or another device
being verified by the PCI driver.
Parameters
The following parameters are
displayed on the blue screen. Parameter 1 is the only
parameter of interest; this identifies the nature of the failure
detected.
| Parameter 1 |
Cause of Error |
| 0x01 |
An active bridge was reprogrammed by the BIOS during a
docking event. |
| 0x02 |
The PMCSR register was not updated within the
spec-mandated time. |
| 0x03 |
A driver has written to Windows-controlled portions of
a PCI device's configuration space. |
Cause
The PCI driver detected an
error in a device or BIOS being verified.
WinDbg
Output Example:
PCI_VERIFIER_DETECTED_VIOLATION
(f6)
The PCI driver detected an error in a device or BIOS being verified.
Arguments:
Arg1: 0000000000000000, Failure detected
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000F7:
DRIVER_OVERRAN_STACK_BUFFER (go
to top of page)
Usual causes:
Device driver, Malware
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560389(v=VS.85).aspx
Knowledge
Base Articles:
KB 957991 Error message
on a Windows Server
2003 R2-based computer that has hardware support for
Intelligent Platform Management Interface: "Stop 0x000000F7"
WinDbg
Help File Entry:
The
DRIVER_OVERRAN_STACK_BUFFER bug check has a value of 0x000000F7. This
indicates that a driver has overrun a stack-based buffer.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The actual security check cookie from the stack |
| 2 |
The expected security check cookie |
| 3 |
The bit-complement of the expected security check
cookie |
| 4 |
0 |
Cause
A driver overran a
stack-based buffer (or local variable) in a way that would have
overwritten the function's return address and jumped back to an
arbitrary address when the function returned.
This is the classic "buffer
overrun" hacking attack. The system has been brought down to prevent a
malicious user from gaining complete control of it.
Resolving the Problem
Use the kb
(Display Stack Backtrace) command to get a stack
trace.
The last routine on the
stack before the buffer overrun handlers and bug check call is the one
that overran its local variable.
WinDbg
Output Example:
DRIVER_OVERRAN_STACK_BUFFER
(f7)
A driver has overrun a stack-based buffer. This overrun could
potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that
would
have overwritten the function's return address and jumped back to an
arbitrary
address when the function returned. This is the classic
"buffer overrun"
hacking attack and the system has been brought down to prevent a
malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack
before the
buffer overrun handlers and bugcheck call is the one that overran its
local
variable(s).
Arguments:
Arg1: 99e04ea2, Actual security check cookie from the stack
Arg2: cc9f53c0, Expected security check cookie
Arg3: 3360ac3f, Complement of the expected security check cookie
Arg4: 00000000, zero
STOP 0x000000F8:
RAMDISK_BOOT_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560392(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
RAMDISK_BOOT_INITIALIZATION_FAILED bug check has a value of 0x000000F8.
This indicates that an initialization failure occurred while attempting
to boot from the RAM disk.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Indicates the cause of the failure.
1: No LoaderXIPRom descriptor was found in the
loader memory list.
2: Unable to open the RAM disk driver (ramdisk.sys
or \Device\Ramdisk).
3: FSCTL_CREATE_RAM_DISK failed.
4: Unable to create GUID string from binary
GUID.
5: Unable to create symbolic link pointing to
the RAM disk device.
|
| 2 |
NTSTATUS code |
| 3 |
0 |
| 4 |
0 |
WinDbg
Output Example:
RAMDISK_BOOT_INITIALIZATION_FAILED
(f8)
An initialization failure occurred while attempting to boot from the
RAM disk.
Arguments:
Arg1: 0000000000000000, Action that failed
Arg2: 0000000000000000, NT status code
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000F9:
DRIVER_RETURNED_STATUS_REPARSE_FOR_VOLUME_OPEN
(go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560396(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
DRIVER_RETURNED_STATUS_REPARSE_FOR_VOLUME_OPEN bug check has a value of
0x000000F9. This indicates that a driver returned STATUS_REPARSE to an
IRP_MJ_CREATE request with no trailing names.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The device object that was opened |
| 2 |
The device object to which the IRP_MJ_CREATE request
was issued |
| 3 |
Address of the Unicode string containing the new name
of the file (to be reparsed) |
| 4 |
Information returned by the driver for the
IRP_MJ_CREATE request |
Comments
STATUS_REPARSE should be
returned only for IRP_MJ_CREATE requests with trailing names, as that
indicates the driver is supporting name spaces.
WinDbg
Output Example:
DRIVER_RETURNED_STATUS_REPARSE_FOR_VOLUME_OPEN
(f9)
A driver returned STATUS_REPARSE to a Create request with no trailing
names.
STATUS_REPARSE should be returned only for Create requests with
trailing names
as that indicates the driver is supporting name spaces.
Arguments:
Arg1: 0000000000000000, Device object that was opened.
Arg2: 0000000000000000, Device object to which the Create IRP was
issued.
Arg3: 0000000000000000, New name of the file (to be reparsed) (UNICODE
string)
Arg4: 0000000000000000, Information returned by the driver for the
Create IRP
STOP 0x000000FA:
HTTP_DRIVER_CORRUPTED (go
to top of page)
Usual causes:
HTTP.sys is corrupted
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560399(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The HTTP_DRIVER_CORRUPTED
bug check has a value of 0x000000FA. This indicates that the HTTP
kernel driver (Http.sys) has reached a corrupted
state and cannot recover.
Parameters
The four bug check
parameters are displayed on the blue screen. Parameter 1
identifies the exact state of the HTTP kernel driver.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
| 0x1 |
Address of work item |
Name of the file that contains the work item check |
Line number of the work item check within the file |
A work item is invalid. This will eventually result in
thread pool corruption and an access violation. |
WinDbg
Output Example:
HTTP_DRIVER_CORRUPTED (fa)
The HTTP kernel driver (http.sys) reached a corrupted state and can not
recover.
Arguments:
Arg1: 0000000000000000, State identifier
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000FB:
RECURSIVE_MACHINE_CHECK (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (fb)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x000000FC:
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560402(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xfc
Knowledge
Base Articles:
KB 878474 System
with the Mpegport.sys driver repeatedly restarts after you install
Windows XP Service Pack 2 or Windows XP Tablet PC Edition 2005
KB 886348 You
receive a
Stop error when a driver is not compatible with the Data Execution
Prevention (DEP) feature in Windows XP
Service Pack 2 or in Windows XP Tablet
PC Edition 2005
KB 953356 Error
message after you upgrade a computer that uses a processor other than
an Intel processor to Windows XP
Service Pack 2 or to Windows XP
Service Pack 3: "STOP: 0x0000007E"
KB 2840622
Stop Error 0x000000FC when you manage message queuing on a computer that is
running Windows 8 or Windows
Server 2012
WinDbg
Help File Entry:
The
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY bug check has a value of
0x000000FC. This indicates that an attempt was made to execute
non-executable memory.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The virtual address whose execution was attempted |
| 2 |
The contents of the page table entry (PTE) |
| 3 |
Reserved |
| 4 |
Reserved |
Resolving
the Problem
When possible, the Unicode
string of the driver name that attempted to execute non-executable
memory is printed on the bug check screen and is also saved in KiBugCheckDriver.
Otherwise, the driver in question can often be found by running a stack
trace and then reviewing the current instruction pointer.
WinDbg
Output Example:
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
(fc)
An attempt was made to execute non-executable memory. The
guilty driver
is on the stack trace (and is typically the current instruction
pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff8800ddd22b0, Virtual address for the attempted execute.
Arg2: 84c0000120103963, PTE contents.
Arg3: fffffa600948a7c0, (reserved)
Arg4: 0000000000000002, (reserved)
STOP 0x000000FD:
DIRTY_NOWRITE_PAGES_CONGESTION (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560404(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
DIRTY_NOWRITE_PAGES_CONGESTION bug check has a value of 0x000000FD.
This indicates that there are no free pages available to continue basic
system operations.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Total number of dirty pages |
| 2 |
Number of non-writeable dirty pages |
| 3 |
Reserved |
| 4 |
Most recently modified write-error status |
Cause
This bug check usually
occurs because the component that owns the modified non-writeable pages
failed to write out these pages after marking the relevant files as "do
not write" to memory management. This indicates a driver bug.
Resolving the Problem
For more information about
which driver is causing the problem, use the !vm 3
extension, followed by !memusage 1
.
WinDbg
Output Example:
DIRTY_NOWRITE_PAGES_CONGESTION
(fd)
No free pages available to continue operations.
If kernel debugger available, type "!vm 3 and !memusage 1".
This bugcheck usually occurs because the component owning the
modified nowrite pages failed to write out these pages after
marking the relevant files as dont-write to memory management.
This indicates a driver bug.
Arguments:
Arg1: 0000000000000000, Total number of dirty pages
Arg2: 0000000000000000, Number of nowrite dirty pages.
Arg3: 0000000000000000, Internal flags.
Arg4: 0000000000000000, Most recent modified write error status
Usual causes:
USB device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560407(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xfe
Knowledge
Base Articles:
KB 331988 Bugcheck
0x000000FE Under Stress with USB 2.0 Hard Disks (XP)
KB 835594 Stop
0x000000FE error occurs when you try to start a third-party IP
telephone program in Windows XP
KB 930568 Error message
when you try to put a Windows Vista-based
computer to sleep or into hibernation: "STOP 0x000000FE
BUGCODE_USB_DRIVER"
KB 934374 Error
message
when you connect a portable Windows Vista-based
computer to a docking station: "STOP: 0x000000fe"
KB 934796 Error message
on a Windows Vista-based
computer that is running a USB composite device: "STOP 0x000000FE"
KB 935368 A
USB-connected Portable Media Center device no longer works after you
resume a Windows Vista-based
computer from sleep
KB 940086 Stop
error
message if you use two USB streaming-video cameras at the same time on
a Windows XP
Service Pack 2-based computer: "STOP 0x000000FE"
KB 941822 Stop
error
when you resume a computer that is running Windows Vista
from standby: "STOP 0x000000FE (parameter1, parameter2, parameter3,
parameter4)"
KB 946723 Error
message
when you bring the computer out of the "Hibernate system" power state
in Windows Vista:
"Stop 0x000000FE"
KB 949201 Stop
error
message when a Windows Vista-based
computer that has a USB device attached resumes from standby or from
hibernation: "Stop 0x000000FE ( 00000008 , 00000006 , 00000001 ,
parameter4 )"
KB 956388 Stop
error
when a Windows Vista-based
or Windows Server
2008-based computer enters sleep mode: "Stop 0x000000FE
BUGCODE_USB_DRIVER"
KB 959520 Stop
error
when you execute some common Plug and Play functions on a Windows Vista-based
or a Windows Server
2008-based computer: "STOP 0x000000D1" or "STOP 0x000000FE"
KB 967102 Stop error message on a
Windows Vista-based or Windows Server 2008-based computer when you resume
the system from sleep: Stop 0x000000FE
KB 971171 A
computer that is running Windows Vista
or Windows Server
2008 restarts
automatically and generates a Stop error after you repeatedly plug and
hot-unplug a USB device: "0x000000FE"
KB 973208 Stop
error after you upgrade from Windows Vista
Service Pack 1 to Windows Vista Service Pack 2 or from Windows Server
2008 to Windows Server 2008 Service Pack 2: "Stop 0x000000FE
BUGCODE_USB_DRIVER"
KB 974303 Stop
0xFE
Resuming from Sleep or Hibernate with USB Streaming Device (Vista, 7)
KB 974410 "STOP 0x000000FE" error
in Windows 7 or in Windows Server 2008 R2 when the computer enters or
resumes from sleep (S3) or from hibernation (S4)
KB 982091
"Stop 0x9F" or "Stop 0xFE" error on a Windows
7-based or Windows Vista-based
computer that uses certain AMD USB EHCI host controllers
KB 2547549 "0x000000FE" Stop error
message when you try to resume a Windows Vista
SP2-based or Windows Server 2008 SP2-based
computer from sleep
WinDbg
Help File Entry:
The BUGCODE_USB_DRIVER bug
check has a value of 0x000000FE. This indicates that an error has
occurred in a Universal Serial Bus (USB) driver.
Parameters
The four bug check
parameters are displayed on the blue screen. Parameter 1
identifies the type of violation.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
| 0x1 |
Reserved |
Reserved |
Reserved |
An internal error has occurred in the USB stack. |
| 0x2 |
Address of the pending IRP |
Address of the IRP that was passed in |
Address of the USB request block (URB) that caused the
error |
The USB client driver has submitted a URB that is still
attached to another IRP that is pending in the bus driver. |
| 0x3 |
Reserved |
Reserved |
Reserved |
The USB miniport driver has generated a bug check. This
usually happens in response to a catastrophic hardware failure. |
| 0x4 |
Address of the IRP |
Address of the URB |
Reserved |
The caller has submitted an IRP that is already pending
in the USB bus driver. |
| 0x5 |
Device extension pointer of the host controller |
PCI vendor, product id for the controller |
Pointer to endpoint data structure |
A hardware failure has occurred due to a bad physical
address found in a hardware data structure. This is not due to a driver
bug. |
| Ox6 |
Object address |
Signature that was expected |
Reserved |
An Internal data structure (object) has been corrupted. |
| 0x7 |
Pointer to usbport.sys debug log |
Message string |
File name |
Please consult the provided message string for details. |
| 0x8 |
Reserved Type |
Reserved |
Reserved |
Reserved |
Cause
See the description of each
code in the Parameters section for an explanation of the cause.
WinDbg
Output Example:
BUGCODE_USB_DRIVER (fe)
USB Driver bugcheck, first parameter is USB bugcheck code.
Arguments:
Arg1: 00000008, USBBUGCODE_RESERVED_USBHUB
Arg2: 00000006, USBHUB_TRAP_FATAL_TIMEOUT
Arg3: 00000001, TimeoutCode: Timeout_SyncResumePort - Failed resuming a
suspended port
Arg4: 864b6988, TimeoutContext - PortData
STOP 0x000000FF:
RESERVE_QUEUE_OVERFLOW (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560409(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The RESERVE_QUEUE_OVERFLOW
bug check has a value of 0x000000FF. This indicates that an attempt was
made to insert a new item into a reserve queue, causing the queue to
overflow.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The address of the reserve queue |
| 2 |
The size of the reserve queue |
| 3 |
0 |
| 4 |
0 |
WinDbg
Output Example:
RESERVE_QUEUE_OVERFLOW (ff)
An attempt was made to insert a new item in a reserve queue which
caused the
queue to overflow.
Arguments:
Arg1: 0000000000000000, The address of the reserve queue.
Arg2: 0000000000000000, The size of the reserve queue.
Arg3: 0000000000000000, 0.
Arg4: 0000000000000000, 0.
Referenced in these articles:
Error
message when you switch the operating system from a dual monitor
setting to a single monitor setting on a Windows XP-based
computer or
on a Windows Server
2003-based computer that has the security update
954211 installed: "Stop 0x0000008E"
Easy
CD
Creator 5.0 does not function in Windows XP
STOP 0x00000100:
LOADER_BLOCK_MISMATCH (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557208(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The LOADER_BLOCK_MISMATCH
bug check has a value of 0x00000100. This indicates that either the
loader block is invalid, or it does not match the system that is being
loaded.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
3 |
| 2 |
The size of the loader black extension |
| 3 |
The major version of the loader block |
| 4 |
The minor version of the loader block |
WinDbg
Output Example:
LOADER_BLOCK_MISMATCH (100)
The loader block in not valid or mismatches the system that is being
loaded.
Arguments:
Arg1: 0000000000000000, The OS major version of the loader block.
Arg2: 0000000000000000, The OS minor version of the loader block.
Arg3: 0000000000000000, The size of the loader block.
Arg4: 0000000000000000, The size of the loader block extension.
STOP 0x00000101:
CLOCK_WATCHDOG_TIMEOUT (go
to top of page)
Usual causes:
Device driver, BIOS bug, hardware defect (see Significant Posts section
below)
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557211(v=VS.85).aspx
Knowledge
Base Articles:
KB 955076 Stop error
message on a Windows Vista or
Windows Server
2008-based computer that has multiple processors
installed: "STOP: 0x00000101 CLOCK_WATCHDOG_TIMEOUT"
KB 975530 Stop error message on a
Windows Server 2008 R2-based
computer that has the Hyper-V role installed and that uses one or more
Intel CPUs that are code-named Nehalem: "0x00000101 -
CLOCK_WATCHDOG_TIMEOUT"
KB 2648039
"0x00000101" Stop error occurs in Windows 7 or
in Windows Server 2008 R2 if a USB 2.0 debug
cable is attached
KB 2927725
"0x133", "0x101" Stop error or system stops responding when hot adding a CPU
core to a computer (Windows 8/Server
2012)
Significant Posts: http://www.sevenforums.com/crashes-debugging/35427-win-7-clock-interrupt-bsod-101-error.html#post356791
These types of error
messages are relatively simple, from a certain
viewpoint: as frequently happens during normal processing, one core
(processor) attempted to get the attention of another core, in order to
synchronise their activites with respect to an operation that requires
processor coordination. Described using "official" terminology:
"CLOCK_WATCHDOG_TIMEOUT (101)
An expected clock interrupt was not
received on a secondary processor in an
MP system within the allocated
interval. This indicates that the
specified
processor
is hung and not processing interrupts."
The trigger for the crash is the "sender/requestor" processor going
"wtf? why is there still no response after almost half a second?!?"
Those inter-processor interrupts (IPIs) are some of the most critical
activity imaginable, and an unrequited IPI is absolutely lethal - hence
the crash.
AMD procs had known issues which manifested themselves in this manner
under Vista and Windows 7. There were/are many possible problem
permutations, some solved through BIOS updates, and some necessitating
fiddling with the "Translation Lookaside Buffer" (TLB), as per
torrentg's suggestion to look up
0x101
and AMD and TLB.
Your real aim is to give yourself the best possible chance of
discovering a
software
cause for the target processor to go unresponsive, and thereby avoid
the most obvious conclusion - that the processor is periodically
unresponsive because of hardware-level defects
I can confidently tell you that the browsers, apps, and games cannot be
the root cause of this problem, even though I don't doubt your
observation that the operation of certain software seems to more easily
trigger the crash. What you're looking for will be in one of the
following categories:
a) BIOS bug
b) a driver whose activity is causing the target processor to lock up
c) a hardware defect (temperature, voltage, dust, RFI, outright
borkedness...)
-
H2SO4
WinDbg
Help File Entry:
The CLOCK_WATCHDOG_TIMEOUT
bug check has a value of 0x00000101. This indicates that an expected
clock interrupt on a secondary processor, in a multi-processor system,
was not received within the allocated interval.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Clock interrupt time-out interval, in nominal clock
ticks |
| 2 |
0 |
| 3 |
The address of the processor control block (PRCB) for
the unresponsive processor |
| 4 |
0 |
Cause
The specified processor is
not processing interrupts. Typically, this occurs when the processor is
nonresponsive or is deadlocked.
WinDbg
Output Example:
CLOCK_WATCHDOG_TIMEOUT
(101)
An expected clock interrupt was not received on a secondary processor
in an
MP system within the allocated interval. This indicates that the
specified
processor is hung and not processing interrupts.
Arguments:
Arg1: 0000000000000019, Clock interrupt time out interval in nominal
clock ticks.
Arg2: 0000000000000000, 0.
Arg3: fffff88002f64180, The PRCB address of the hung processor.
Arg4: 0000000000000002, 0.
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
DPC_WATCHDOG_TIMEOUT (102)
The DPC watchdog routine was not executed within the allocated time
interval.
This means that either an ISR is hung at an IRQL that is below clock
level and
above dispatch level, or a DPC routine is hung on the specified
processor.
Arguments:
Arg1: 0000000000000000, DPC watchdog time out interval in nominal clock
ticks.
Arg2: 0000000000000000, The PRCB address of the hung processor.
Arg3: 0000000000000000, 0.
Arg4: 0000000000000000, 0.
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557215(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
[This
is preliminary
documentation and subject to change.]
The MUP_FILE_SYSTEM bug
check has a value of 0x00000103. This bug check indicates that the
multiple UNC provider (MUP) has encountered invalid or unexpected data.
As a result, the MUP cannot channel a remote file system request to a
network redirector, the Universal Naming Convention (UNC) provider.
Parameters
These bug check parameters
are displayed on the blue screen. Parameter 1 identifies the
type of violation.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of error |
| 0x1 |
The address of the pending IRP. |
The address of the file object whose file context could
not be found. |
The address of the device object. |
The MUP could not locate the file context that
corresponds to a file object. This typically indicates that the MUP is
seeing an I/O request for a file object for which MUP did not see a
corresponding IRP_MJ_CREATE request. The likely cause of this bug check
is a filter driver error.
|
| 0x2 |
The address of the expected file context. |
The address that was actually retrieved from the file
object. |
Reserved |
A file context is known to exist for the file object,
but was not what was expected (for example, it might be NULL).
|
| 0x3 |
The address of the IRP context. |
The IRP completion status code. |
The driver object of the UNC provider that completed
the IRP (might be NULL). |
The IRP completion status was unexpected or invalid.
This bug check occurs only when you are using a Checked Build of
Windows and should only be caused by file system filter drivers that
are attached to legacy network redirectors. Legacy redirectors use FsRtlRegisterUncProvider
to register with MUP. This bug check detects filter drivers that return
an NTSTATUS that is not STATUS_SUCCESS in IRP_MJ_CLEANUP or
IRP_MJ_CLOSE requests.
|
| 0x4 |
Address of the IRP |
Address of the file object |
The file context for the file object |
An I/O operation was started on a file object before
the create request for the file object was completed.
|
Comments
The MUP maintains context
information on a per-file object basis for all file objects it handles.
WinDbg
Output Example:
MUP_FILE_SYSTEM (103)
MUP file system detected an error.
Arguments:
Arg1: 0000000000000000, Type of MUP error
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Video driver, BIOS
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557218(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The AGP_INVALID_ACCESS bug
check has a value of 0x00000104. This indicates that the GPU wrote to a
range of Accelerated Graphics Port (AGP) memory that had not previously
been committed.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Offset (in ULONG) within the AGP verifier page to the
first ULONG data that is corrupted |
| 2 |
0 |
| 3 |
0 |
| 4 |
0 |
Cause
Typically, this bug check is
caused by an unsigned or improperly tested video driver. It can also be
caused by an old BIOS.
Resolving the Problem
Check for display driver and
computer BIOS updates.
WinDbg
Output Example:
AGP_INVALID_ACCESS (104)
An invalid AGP memory accessa was detected.
This is most likely caused by an unsigned, or improperly tested video
driver,
or old BIOS. Check for updated display drivers and system
BIOS.
Arguments:
Arg1: 0000000000000000, Last AGP memory allocation type, 1=allocation,
0=free.
Arg2: 0000000000000000, Address of Memory Descriptor List (MDL) for
last allocation.
Arg3: 0000000000000000, Base Address Page Frame Number (PFN) of last
AGP allocation.
Arg4: 0000000000000000, 0.
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557220(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The AGP_GART_CORRUPTION bug
check has a value of 0x00000105. This indicates that the Graphics
Aperture Remapping Table (GART) is corrupt.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The base address (virtual) of the GART |
| 2 |
The offset into the GART where the corruption occurred |
| 3 |
The base address (virtual) of the GART cache (a copy of
the GART) |
| 4 |
0 |
Cause
This bug check is typically
caused by improper direct memory access (DMA) by a driver.
Resolving the Problem
Enable Driver Verifier for
any unsigned drivers. Remove them or disable them one by one until the
erring driver is identified.
WinDbg
Output Example:
AGP_GART_CORRUPTION (105)
The Graphics Aperture Redirection Table (Gart) is corrupt.
This is most likey caused by errant device Direct Memory Access (DMA).
Enable the driver verifier against unsigned drivers, and remove them
or disable them one at a time until the culprit is idnetified.
Arguments:
Arg1: 0000000000000000, Base address of the Graphics Aperture
Redirection Table (Gart).
Arg2: 0000000000000000, Offset into Gart where corruption occurred.
Arg3: 0000000000000000, Base address of the Gart-cache (copy of Gart).
Arg4: 0000000000000000, 0.
STOP 0x00000106:
AGP_ILLEGALLY_REPROGRAMMED (go
to top of page)
Usual causes:
Video driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557223(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
AGP_ILLEGALLY_REPROGRAMMED bug check has a value of 0x00000106. This
indicates that the Accelerated Graphics Port (AGP) hardware has been
reprogrammed by an unauthorized agent.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The originally programmed AGP command register value |
| 2 |
The current command register value |
| 3 |
0 |
| 4 |
0 |
Cause
This bug check is typically
caused by an unsigned, or improperly tested, video driver.
Resolving the Problem
Check the video
manufacturer's Web site for updated display drivers or use VGA mode.
WinDbg
Output Example:
AGP_ILLEGALLY_REPROGRAMMED
(106)
The AGP HW has been reprogrammed by an unauthorized agent.
This is most likely caused by an unsigned, or improperly tested video
driver.
Check video manufacturer's web site for updated display drivers, or use
VGA-mode.
Arguments:
Arg1: 0000000000000000, Originally programmed AGP Command Register
value.
Arg2: 0000000000000000, Current Command Register value.
Arg3: 0000000000000000, 0.
Arg4: 0000000000000000, 0.
STOP 0x00000107:
KERNEL_EXPAND_STACK_ACTIVE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (107)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000108:
THIRD_PARTY_FILE_SYSTEM_FAILURE (go
to top of page)
Usual causes:
Disk issues, Disk corruption, 3rd party file system corruption,
SCSI/IDE controller driver, Memory, Insufficient memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557225(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
THIRD_PARTY_FILE_SYSTEM_FAILURE bug check has a value of 0x00000108.
This indicates that an unrecoverable problem has occurred in a
third-party file system or file system filter.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Identifies the file system that failed. Possible values
include:
1: Polyserve (Psfs.sys)
|
| 2 |
The address of the exception record. |
| 3 |
The address of the context record. |
| 4 |
Reserved. |
Cause
One possible cause of this
bug check is disk corruption. Corruption in the third-party file system
or bad blocks (sectors) on the hard disk can induce this error.
Corrupted SCSI and IDE drivers can also adversely affect the Windows
operating system’s ability to read and write to disk, thus causing the
error.
Another possible cause is
depletion of nonpaged pool memory. If the nonpaged pool is completely
depleted, this error can stop the system.
Resolving the Problem
To debug this
problem: Use the .cxr (Display
Context Record) command with Parameter 3,
and then use kb (Display
Stack Backtrace).
To resolve a disk
corruption problem: Check Event Viewer for error messages
from SCSI, IDE, or other disk controllers in the system that might help
pinpoint the device or driver that is causing the error. Try disabling
any virus scanners, backup programs, or disk defragmenter tools that
continually monitor the system. You should also run hardware
diagnostics supplied by the file system or the file system filter
manufacturer.
To resolve a
nonpaged pool memory depletion problem: Add new physical
memory to the computer. This will increase the quantity of nonpaged
pool memory available to the kernel.
WinDbg
Output Example:
THIRD_PARTY_FILE_SYSTEM_FAILURE
(108)
DESCRIPTION
A 3rd party file system or file system filter has failed in an
unrecoverable way.
Arguments:
Arg1: 0000000000000000, Identifies the file system that failed
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000109:
CRITICAL_STRUCTURE_CORRUPTION (go
to top of page)
Usual causes:
Device driver, Breakpoint set with no debugger attached, Hardware
(Memory in particular)
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557228(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
CRITICAL_STRUCTURE_CORRUPTION bug check has a value of 0x00000109. This
indicates that the kernel has detected critical kernel code or data
corruption.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Reserved |
| 2 |
Reserved |
| 3 |
Reserved |
| 4 |
The type of the corrupted region. (See the
following table later on this page.) |
The value of
Parameter 4 indicates the type of corrupted region.
| Parameter 4 |
Type of Corrupted Region, Type of Corruption, or Type
of Action Taken That Caused the Corruption |
| 0x0 |
A generic data region |
| 0x1 |
A function modification or the Itanium-based function
location |
| 0x2 |
A processor interrupt dispatch table (IDT) |
| 0x3 |
A processor global descriptor table (GDT) |
| 0x4 |
A type-1 process list corruption |
| 0x5 |
A type-2 process list corruption |
| 0x6 |
A debug routine modification |
| 0x7 |
A critical MSR modification |
Cause
There are generally three
different causes for this bug check:
- A driver has inadvertently, or deliberately, modified
critical kernel code or data. Microsoft Windows Server 2003
with Service Pack 1 (SP1) and later versions of Windows for
x64-based computers do not allow the kernel to be patched except
through authorized Microsoft-originated hot patches. For more
information, see
Patching
Policy for x64-based Systems.
- A developer attempted to set a normal kernel breakpoint
using a kernel debugger that was not attached when the system was
started. Normal breakpoints (bp)
can only be set if the debugger is attached at start time. Processor
breakpoints (ba)
can be set at any time.
- A hardware corruption occurred. For example, the kernel
code or data could have been stored in memory that failed.
WinDbg
Output Example:
CRITICAL_STRUCTURE_CORRUPTION
(109)
This bugcheck is generated when the kernel detects that critical kernel
code or
data have been corrupted. There are generally three causes for a
corruption:
1) A driver has inadvertently or deliberately modified critical kernel
code
or data. See
http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a
kernel
debugger that was not attached when the system was booted.
Normal breakpoints,
"bp", can only be set if the debugger is attached at boot
time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code
or data.
Arguments:
Arg1: a3a039d89612353e, Reserved
Arg2: b3b7465ee890459c, Reserved
Arg3: fffff88000e90490, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification
STOP 0x0000010A:
APP_TAGGING_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557230(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
APP_TAGGING_INITIALIZATION_FAILED bug check has a value of 0x0000010A.
This bug check appears very
infrequently.
WinDbg
Output Example:
APP_TAGGING_INITIALIZATION_FAILED
(10a)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (10b)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000010C:
FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION (go
to top of page)
Usual causes:
Device driver, File system Run-time libarary (FsRtl)
corruption
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557232(v=VS.85).aspx
Knowledge
Base Articles:
KB 2847521
"0x0000010c" Stop error on a computer that is running
Windows 7 or Windows Server 2008 R2
WinDbg
Help File Entry:
The
FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION bug check has a value of
0x0000010C. This indicates that a violation was detected in the File
system Run-time library (FsRtl) Extra Create Parameter (ECP) package.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The type of violation. (See the following
table later on this page for more details). |
| 2 |
0 |
| 3 |
The address of the ECP. |
| 4 |
The starting address of the ECP list. |
The value of
Parameter 1 indicates the type of violation.
| Parameter 1 |
Type of Violation |
| 0x1 |
The ECP signature is invalid, due to either a bad
pointer or memory corruption. |
| 0x2 |
The ECP has undefined flags set. |
| 0x3 |
The ECP was not allocated by the FsRtl. |
| 0x4 |
The ECP has flags set that are illegal for a parameter
passed by a create caller. |
| 0x5 |
The ECP is corrupted; its size is smaller than the
header size. |
| 0x6 |
The ECP that is being freed has non-empty list
pointers; it might still be part of an ECP list. |
| 0x11 |
The ECP list signature is invalid, due to either a bad
pointer or memory corruption. |
| 0x12 |
The ECP list has undefined flags set. |
| 0x13 |
The ECP list was not allocated by the FsRtl. |
| 0x14 |
The ECP list has flags set that are illegal for a
parameter list passed by a create caller. |
| 0x15 |
The ECP list passed by the create caller is empty. |
WinDbg
Output Example:
FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION
(10c)
DESCRIPTION
A violation has been detected in the use of FsRtl
Extra Create Parameter package.
Arguments:
Arg1: 0000000000000000, Type of violation
Arg2: 0000000000000000, 0.
Arg3: 0000000000000000, Ecp.
Arg4: 0000000000000000, EcpList.
Usual causes:
Device driver, ?Memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557235(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The WDF_VIOLATION bug check
has a value of 0x0000010D. This indicates that Kernel-Mode Driver
Framework (KMDF) detected that Windows found an error in a
framework-based driver.
Parameters
The following parameters are
displayed on the blue screen. Parameter 1 indicates the
specific error code of the bug check. Parameter 4 is reserved.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Cause of Error |
| 0x1 |
Pointer to a WDF_POINTER_ROUTINE_TIMED_OUT_DATA
structure |
Reserved |
A framework-based driver has timed out during a power
operation. This typically means that the device stack did not set the
DO_POWER_PAGABLE bit and a driver attempted a pageable operation after
the paging device stack was powered down. |
| 0x2 |
Reserved |
Reserved |
An attempt is being made to acquire a lock that is
currently being held. |
| 0x3 |
WDFREQUEST handle |
The number of outstanding references that remain on
both buffers |
Windows Driver Framework Verifier has encountered a
fatal error. In particular, an I/O request was completed, but a
framework request object cannot be deleted because there are
outstanding references to the input buffer, the output buffer, or both. |
| 0x4 |
Reserved |
The caller's address |
A NULL parameter was passed to a function that required
a non-NULL value. |
| 0x5 |
The handle value passed in |
Reserved |
A framework object handle of the incorrect type was
passed to a framework object method. |
| 0x6 |
|
|
See table below. |
| 0x7 |
The handle of the framework object |
Reserved |
A driver attempted to delete a framework object
incorrectly by calling WdfObjectDereference to
delete a handle instead of calling WdfObjectDelete. |
| 0x8 |
The handle of the DMA transaction object |
Reserved |
An operation occurred on a DMA transaction object while
it was not in the correct state. |
| 0x9 |
|
|
Currently unused. |
| 0xA |
A pointer to a WDF_QUEUE_FATAL_ERROR_DATA structure |
Reserved |
A fatal error has occurred while processing a request
that is currently in the queue.
|
| 0xB |
|
|
See table below. |
If Parameter 1 is
equal to 0x6, then a fatal error was made in handling a WDF request. In
this case, Parameter 2 further specifies the type of fatal
error that has been made, as defined by the enumeration
WDF_REQUEST_FATAL_ERROR.
| Parameter 2 |
Parameter 3 |
Cause of Error |
| 0x1 |
The address of the IRP |
No more I/O stack locations are available to format the
underlying IRP. |
| 0x2 |
The WDF request handle value |
An attempt was made to format a framework request
object that did not contain an IRP. |
| 0x3 |
The WDF request handle value |
The driver attempted to send a framework request that
has already been sent to an I/O target. |
| 0x4 |
A pointer to a
WDR_REQUEST_FATAL_ERROR_INFORMATION_LENGTH_MISMATCH_DATA structure that
contains a pointer to the IRP, a WDF request handle value, an IRP major
function, and the number of bytes attempted to be written |
The driver has completed a framework request, but has
written more bytes to the output buffer than are specified in the IRP. |
If Parameter 1 is
equal to 0xB, then an attempt to acquire or release a lock was invalid.
In this case, Parameter 3 further specifies the error that has
been made.
| Parameter 2 |
Parameter 3 |
Cause of Error |
| The handle value |
0x0 |
A handle passed to WdfObjectAcquireLock or
WdfObjectReleaseLock represents an object that
does not support synchronization locks. |
| A WDF spin lock handle |
0x1 |
The spin lock is being released by a thread that did
not acquire it. |
Cause
See the description of each
code in the Parameters section for an explanation of the cause.
Resolving the Problem
Typically, the dump file
will yield further information on the driver that caused this bug check.
If Parameter 1 is
equal to 0x2, examine the caller’s stack to
determine the lock in question.
If Parameter 1 is
equal to 0x3, the driver's Kernel-Mode Driver
Framework error log will include details about the outstanding
references.
If Parameter 1 is
equal to 0x4, use the ln
debugger command with the value of Parameter 3
as its argument to determine which function requires a non-NULL
parameter.
If Parameter 1 is
equal to 0x7, use the !wdfkd.wdfhandle
Parameter 2 extension command to determine
the handle type.
If Parameter 1 is
equal to 0xA, then the WDF_QUEUE_FATAL_ERROR_DATA
structure will indicate either the problematic request or the queue
handle. It will also indicate the NTSTATUS, if not STATUS_SUCCESS, when
available.
WinDbg
Output Example:
WDF_VIOLATION (10d)
The Kernel-Mode Driver Framework was notified that Windows detected an
error
in a framework-based driver. In general, the dump file will yield
additional
information about the driver that caused this bug check.
Arguments:
Arg1: 0000000000000004, A NULL parameter was passed to a function that
required a non-
NULL value. Use the "ln" debugger
command with the value of
Parameter 3 as its argument to determine
the function which
requires a non-NULL parameter.
Arg2: fffffa600085a7cb, Reserved.
Arg3: 0000000000000000, The caller's address.
Arg4: fffffa8008b09ca0, Reserved.
STOP 0x0000010E:
VIDEO_MEMORY_MANAGEMENT_INTERNAL (go
to top of page)
Usual causes:
Video driver, ?Video memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557238(v=VS.85).aspx
Knowledge
Base Articles:
KB 953026
You
receive a "STOP 0x0000010E" or "STOP 0x000000C1" error message on a
Windows Vista-based
computer or on a Windows Server
2008-based
computer
KB 2551127 "0x0000010E" Stop error
occurs on a computer that uses hybrid graphics in a heterogeneous GPU
configuration and that is running Windows 7 or Windows Server 2008 R2
WinDbg
Help File Entry:
The
VIDEO_MEMORY_MANAGEMENT_INTERNAL bug check has a value of 0x0000010E.
This indicates that the video memory manager has encountered a
condition that it is unable to recover from.
Parameters
The following parameters are
displayed on the blue screen. Parameter 1 is the only
parameter of interest; this identifies the exact violation. Values for
Parameter 1 that do not appear in this table must be
individually examined.
| Parameter 1 |
Cause of Error |
| 0x1 |
An attempt was made to rotate a non-rotate range. |
| 0x2 |
An attempt was made to destroy a non-empty process
heap. |
| 0x3 |
An attempt to unmap from an aperture segment failed. |
| 0x4 |
A rotation in a must-succeed path failed. |
| 0x5 |
A deferred command failed. |
| 0x6 |
An attempt was made to reallocate resources for an
allocation that was having its eviction canceled. |
| 0x7 |
An invalid attempt was made to defer free usage. |
| 0x8 |
The split direct memory access (DMA) buffer contains an
invalid reference. |
| 0x9 |
An attempt to evict an allocation failed. |
| 0xA |
An invalid attempt to use a pinned allocation was made.
|
| 0xB |
A driver returned an invalid error code from BuildPagingBuffer.
|
| 0xC |
A resource leak was detected in a segment. |
| 0xD |
A segment is being used improperly. |
| 0xE |
An attempt to map an allocation into an aperture
segment failed. |
| 0xF |
A driver returned an invalid error code from AcquireSwizzlingRange.
|
| 0x10 |
A driver returned an invalid error code from ReleaseSwizzlingRange.
|
| 0x11 |
An invalid attempt to use an aperture segment was made.
|
| 0x12 |
A driver overflowed the provided DMA buffer. |
| 0x13 |
A driver overflowed the provided private data buffer. |
| 0x14 |
An attempt to purge all segments failed. |
| 0x15 |
An attempt was made to free a virtual address
descriptor (VAD) that was still in the rotated state |
| 0x16 |
A driver broke the guaranteed DMA buffer model
contract. |
| 0x17 |
An unexpected system command failure occurred. |
| 0x18 |
An attempt to release a pinned allocation's resource
failed. |
| 0x19 |
A driver failed to patch a DMA buffer. |
| 0x1A |
The owner of a shared allocation was freed. |
| 0x1B |
An attempt was made to release an aperture range that
is still in use. |
Cause
This bug check is usually
caused by a video driver behaving improperly.
Resolving the Problem
If the problem persists,
check Windows Update for an updated video driver.
WinDbg
Output Example:
VIDEO_MEMORY_MANAGEMENT_INTERNAL
(10e)
The video memory manager encountered a condition that it can't recover
from. By crashing,
the video memory manager is attempting to get enough information into
the minidump such that
somebody can pinpoint what lead to this condition.
Arguments:
Arg1: 000000000000001f, The subtype of the bugcheck:
Arg2: fffff8a0082e2b60
Arg3: 0000000000000000
Arg4: 0000000000ddc61f
STOP 0x0000010F:
RESOURCE_MANAGER_EXCEPTION_NOT_HANDLED (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557241(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
RESOURCE_MANAGER_EXCEPTION_NOT_HANDLED bug check has a value of
0x0000010F. This indicates that the kernel transaction manager detected
that a kernel-mode resource manager has raised an exception in response
to a direct call-back. The resource manager is in an unexpected and
unrecoverable state.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The address of the exception record |
| 2 |
The address of the context record |
| 3 |
The address of the exception code |
| 4 |
The address of the resource manager |
WinDbg
Output Example:
Unknown bugcheck code (10f)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000110:
DRIVER_INVALID_CRUNTIME_PARAMETER (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (110)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557246(v=VS.85).aspx
Knowledge
Base Articles:
KB 928786 You
may
receive a Stop error message on a computer that is running Windows Server 2003:
"STOP: 0x00000111"
WinDbg
Help File Entry:
[This
is preliminary
documentation and subject to change.]
The RECURSIVE_NMI bug check
has a value of 0x00000111. This bug check indicates that a
non-maskable-interrupt (NMI) occurred while a previous NMI was in
progress.
Comments
This bug check occurs when
there is an error in the system management interrupt (SMI) code, and an
SMI interrupts an NMI and enables interrupts. Execution then continues
with NMIs enabled, and another NMI interrupts the NMI in progress.
WinDbg
Output Example:
Unknown bugcheck code (111)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000112:
MSRPC_STATE_VIOLATION (go
to top of page)
Usual causes:
Msrpc.sys generated bug check
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557248(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The MSRPC_STATE_VIOLATION
bug check has a value of 0x00000112. This indicates that the Msrpc.sys
driver has initiated a bug check.
Parameters
The following parameters are
displayed on the blue screen. Parameters 1 and 2 are the only
parameters of interest. Parameter 1 indicates the state
violation type; the value for Parameter 2 is determined by the
value of Parameter 1.
| Parameter 1 |
Parameter 2 |
Cause of Error |
| 0x01 |
The exception code |
A non-continuable exception was continued by the
caller. |
| 0x02 |
The error |
The advanced local procedure call (ALPC) returned an
invalid error. |
| 0x03 |
The session to the server |
The caller unloaded the Microsoft remote procedure call
(MSRPC) driver while it was still in use. It is likely that open
binding handles remain. |
0x04
and
0x05 |
The session to the server |
An invalid close command was received from the ALPC. |
| 0x06 |
The binding handle |
An attempt was made to bind a remote procedure call
(RPC) handle a second time. |
| 0x07 |
The binding handle |
An attempt was made to perform an operation on a
binding handle that was not bound. |
| 0x08 |
The binding handle |
An attempt was made to set security information on a
binding handle that was already bound. |
| 0x09 |
The binding handle |
An attempt was made to set an option on a binding
handle that was already bound. |
0x0A
|
The call object |
An attempt was made to cancel an invalid asynchronous
remote procedure call. |
| 0x0B |
The call object |
An attempt was made to push on an asynchronous pipe
call when it was not expected. |
0x0C
and
0x0E |
The pipe object |
An attempt was made to push on an asynchronous pipe
without waiting for notification. |
| 0x0F |
The pipe object |
An attempt was made to synchronously terminate a pipe a
second time. |
| 0x15 |
The object closest to the error |
An RPC internal error occurred. |
| 0x16 |
Reserved |
Two causally ordered calls were issued in an order that
cannot be enforced by the RPC. |
| 0x17 |
The call object |
A server manager routine did not unsubscribe from
notifications prior to completing the call. |
| 0x18 |
The async handle |
An invalid operation on the asynchronous handle
occurred. |
Cause
The most common cause of
this bug check is that the caller of the Msrpc.sys
driver violated the state semantics for such a call.
WinDbg
Output Example:
MSRPC_STATE_VIOLATION (112)
This is a bugcheck initiated by MSRPC.SYS. The most common cause is that
the caller of MSRPC.SYS violated the state semantics for calling
MSRPC.SYS.
See the parameters for more information.
Arguments:
Arg1: 0000000000000000, State violation type:
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000113:
VIDEO_DXGKRNL_FATAL_ERROR (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557253(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
VIDEO_DXGKRNL_FATAL_ERROR bug check has a value of 0x00000113. This
indicates that the dxg kernel has detected a violation.
This bug check appears very
infrequently.
WinDbg
Output Example:
VIDEO_DXGKRNL_FATAL_ERROR
(113)
The dxgkrnl has detected that a violation has occurred. This resulted
in a condition that dxgkrnl can no longer progress. By
crashing, dxgkrnl
is attempting to get enough information into the minidump such that
somebody
can pinpoint the crash cause. Any other values after parameter 1 must be
individually examined according to the subtype.
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck:
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000114:
VIDEO_SHADOW_DRIVER_FATAL_ERROR (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557257(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
VIDEO_SHADOW_DRIVER_FATAL_ERROR bug check has a value of 0x00000114.
This indicates that the shadow driver has detected a violation.
This bug check appears very
infrequently.
WinDbg
Output Example:
VIDEO_SHADOW_DRIVER_FATAL_ERROR
(114)
The shadow driver has detected that a violation has occurred. This
resulted
in a condition that shadow driver can no longer progress. By
crashing, shadow driver
is attempting to get enough information into the minidump such that
somebody
can pinpoint the crash cause. Any other values after parameter 1 must be
individually examined according to the subtype.
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck:
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557259(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The AGP_INTERNAL bug check
has a value of 0x00000115. This indicates that the accelerated graphics
port (AGP) driver has detected a violation.
This bug check appears very
infrequently.
WinDbg
Output Example:
AGP_INTERNAL (115)
The AGP driver has detected that a violation has occurred. This resulted
in a condition that AGP driver can no longer progress. By
crashing, the AGP driver
is attempting to get enough information into the minidump such that
somebody
can pinpoint the crash cause. Any other values after parameter 1 must be
individually examined according to the subtype.
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck:
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Video driver, overheating, bad video card, ?BIOS, ?Power to card (see
Significant Posts section below)
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557263(v=VS.85).aspx
Knowledge
Base Articles:
KB 971572 Error
message
when you hot-plug a display to the secondary display port on a computer
that is running Windows Vista
or Windows Server
2008: ""Stop 0x00000116"
Significant posts:
http://www.sysnative.com/forums/showthread.php/35-Video-TDR-Timeout-0x116-0x117
"It's not a true crash, in
the sense that the bluescreen was initiated
only because the combination of video driver and video hardware was
being unresponsive, and not because of any synchronous processing
exception.
Since Vista, the "Timeout Detection and Recovery" (TDR) components of
the OS video subsystem have been capable of doing some truly impressive
things to try to recover from issues which would have caused earlier
OSs like XP to crash. As a last resort, the TDR subsystem sends the
video driver a "please restart yourself now!" command and waits a few
seconds. If there's no response, the OS concludes that the video
driver/hardware combo has truly collapsed in a heap, and it fires off
that stop 0x116 BSOD.
If playing with video driver versions hasn't helped, make sure the box
is not overheating. Try removing a side panel and aiming a big mains
fan straight at the motherboard and GPU. Run it like that for a few
hours or days - long enough to ascertain whether cooler temperatures
make a difference. If so, it might be as simple as dust buildup and
subsequently inadequate cooling." - H2SO4
WinDbg
Help File Entry:
The VIDEO_TDR_ ERROR bug
check has a value of 0x00000116. This indicates that an attempt to
reset the display driver and recover from a timeout failed.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The pointer to the internal TDR recovery context, if
available. |
| 2 |
A pointer into the responsible device driver module
(for example, the owner tag). |
| 3 |
The error code of the last failed operation, if
available. |
| 4 |
Reserved. |
WinDbg
Output Example:
VIDEO_TDR_FAILURE (116)
Attempt to reset the display driver and recover from timeout failed.
Arguments:
Arg1: fffffa80043984e0, Optional pointer to internal TDR recovery
context (TDR_RECOVERY_CONTEXT).
Arg2: fffff88004683d9c, The pointer into responsible device driver
module (e.g. owner tag).
Arg3: 0000000000000000, Optional error code (NTSTATUS) of the last
failed operation.
Arg4: 0000000000000002, Optional internal context dependent data.
STOP 0x00000117:
VIDEO_TDR_TIMEOUT_DETECTED (go
to top of page)
Usual causes:
Video driver/sub-system
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557271(v=VS.85).aspx
Knowledge
Base Articles:
KB 2665946
Display driver stopped responding and has recovered Error message in Windows
Vista or Windows 7
Significant posts:
http://www.sysnative.com/forums/showthread.php/35-Video-TDR-Timeout-0x116-0x117
"It's not a true crash, in
the sense that the bluescreen was initiated
only because the combination of video driver and video hardware was
being unresponsive, and not because of any synchronous processing
exception.
Since Vista, the "Timeout Detection and Recovery" (TDR) components of
the OS video subsystem have been capable of doing some truly impressive
things to try to recover from issues which would have caused earlier
OSs like XP to crash. As a last resort, the TDR subsystem sends the
video driver a "please restart yourself now!" command and waits a few
seconds. If there's no response, the OS concludes that the video
driver/hardware combo has truly collapsed in a heap, and it fires off
that stop 0x116 BSOD.
If playing with video driver versions hasn't helped, make sure the box
is not overheating. Try removing a side panel and aiming a big mains
fan straight at the motherboard and GPU. Run it like that for a few
hours or days - long enough to ascertain whether cooler temperatures
make a difference. If so, it might be as simple as dust buildup and
subsequently inadequate cooling." - H2SO4
WinDbg
Help File Entry:
The
VIDEO_TDR_TIMEOUT_DETECTED bug check has a value of 0x00000117. This
indicates that the display driver failed to respond in a timely
fashion.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The pointer to the internal TDR recovery context, if
available. |
| 2 |
A pointer into the responsible device driver module
(for example, the owner tag). |
| 3 |
The secondary driver-specific bucketing key. |
| 4 |
Reserved. |
WinDbg
Output Example:
VIDEO_TDR_TIMEOUT_DETECTED
(117)
The display driver failed to respond in timely fashion.
(This code can never be used for real bugcheck).
Arguments:
Arg1: fffffa8009651010, Optional pointer to internal TDR recovery
context (TDR_RECOVERY_CONTEXT).
Arg2: fffffa6003619574, The pointer into responsible device driver
module (e.g owner tag).
Arg3: 0000000000000000, The secondary driver specific bucketing key.
Arg4: 0000000000000000, Optional internal context dependent data.
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (118)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000119:
VIDEO_SCHEDULER_INTERNAL_ERROR (go
to top of page)
Usual causes:
Video driver/sub-system
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557275(v=VS.85).aspx
Knowledge
Base Articles:
Suggested post for troubleshooting:
http://www.sysnative.com/forums/showthread.php/35-Video-TDR-Timeout-0x116-0x117
WinDbg
Help File Entry:
The
VIDEO_SCHEDULER_INTERNAL_ERROR bug check has a value of 0x00000119.
This indicates that the video scheduler has detected a fatal violation.
Parameters
The following parameters are
displayed on the blue screen. Parameter 1 is the only
parameter of interest and identifies the exact violation.
| Parameter 1 |
Cause of Error |
| 0x1 |
The driver has reported an invalid fence ID. |
| 0x2 |
The driver failed upon the submission of a command. |
| 0x3 |
The driver failed upon patching the command buffer. |
| 0x4 |
The driver reported an invalid flip capability. |
WinDbg
Output Example:
VIDEO_SCHEDULER_INTERNAL_ERROR
(119)
The video scheduler has detected that fatal violation has occurred.
This resulted
in a condition that video scheduler can no longer progress. Any other
values after
parameter 1 must be individually examined according to the subtype.
Arguments:
Arg1: 0000000007000000, The subtype of the bugcheck:
Arg2: fffffa8005544010
Arg3: fffffa80065db100
Arg4: fffffa8004e3a0c0
STOP 0x0000011A:
EM_INITIALIZATION_FAILURE (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557279(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
EM_INITIALIZATION_FAILURE bug check has a value of 0x0000011A.
This bug check appears very
infrequently.
WinDbg
Output Example:
EM_INITIALIZATION_ERROR
(11a)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000011B:
DRIVER_RETURNED_HOLDING_CANCEL_LOCK (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557284(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
[This
is preliminary
documentation and subject to change.]
The
DRIVER_RETURNED_HOLDING_CANCEL_LOCK bug check has a value of
0x0000011B. This bug check indicates that a driver has returned from a cancel
routine that holds the global cancel lock. This causes all later
cancellation calls to fail, and results in either a deadlock or another
bug check.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
The address of the IRP that was canceled (might not be
valid). |
| 2 |
The address of the cancel routine. |
Comments
The cancel spin lock should
have been released by the cancel routine.
The driver calls the
IoCancelIrpIoCancelIrp function to cancel an individual I/O request
packet (IRP). This function acquires the cancel spin lock, sets the
cancel flag in the IRP, and then calls the cancel
routine specified by the appropriate field in the IRP, if a routine was
specified. The cancel routine is expected to
release the cancel spin lock. If there is no cancel
routine, the cancel spin lock is released.
WinDbg
Output Example:
A driver has returned from
a cancellation routine holding the global cancel
lock. This will result in any subsequent cancellation calls
to fail either
resulting in a deadlock or another bugcheck.
Arguments:
Arg1: 0000000000000000, The address of the IRP that was cancelled (may
not be valid).
Arg2: 0000000000000000, The address of the cancel routine.
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000011C:
ATTEMPTED_WRITE_TO_CM_PROTECTED_STORAGE (go
to top of page)
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557292(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
[This
is preliminary
documentation and subject to change.]
The
ATTEMPTED_WRITE_TO_CM_PROTECTED_STORAGE bug check has a value of
0x0000011C. This bug check indicates that an attempt was made to write
to the read-only protected storage of the configuration manager.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Virtual address for the attempted write |
| 2 |
PTE contents |
| 3 |
Reserved |
| 4 |
Reserved |
Comments
When it is possible, the
name of the driver that is attempting the write operation is printed as
a Unicode string on the bug check screen and then saved in
KiBugCheckDriver.
WinDbg
Output Example:
ATTEMPTED_WRITE_TO_CM_PROTECTED_STORAGE
(11c)
An attempt was made to write to the read-only protected storage of the
configuration manager.
An attempt was made to write to the read-only protected storage of the
configuration manager.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 0000000000000000, Virtual address for the attempted write.
Arg2: 0000000000000000, PTE contents.
Arg3: 0000000000000000, (reserved)
Arg4: 0000000000000000, (reserved)
STOP 0x0000011D:
EVENT_TRACING_FATAL_ERROR (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557296(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
[This
is preliminary
documentation and subject to change.]
The
EVENT_TRACING_FATAL_ERROR bug check has a value of 0x0000011D. This bug
check indicates that the Event Tracing subsystem has encountered an
unexpected fatal error.
WinDbg
Output Example:
EVENT_TRACING_FATAL_ERROR
(11d)
Event Tracing subsystem has encountered an unexpected fatal error.
First parameter indicates
the type of failure.
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000011E:
TOO_MANY_RECURSIVE_FAULTS (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
TOO_MANY_RECURSIVE_FAULTS
(11e)
DESCRIPTION
A file system has caused too many recursive faults under low resource
conditions to be handled.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000011F:
INVALID_DRIVER_HANDLE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
INVALID_DRIVER_HANDLE (11f)
Someone has closed the initial handle for a driver between inserting
the driver
object and referencing the handle.
Arguments:
Arg1: 0000000000000000, The handle value for the driver object.
Arg2: 0000000000000000, The status returned trying to reference the
object.
Arg3: 0000000000000000, The address of the PDRIVER_OBJECT.
Arg4: 0000000000000000
STOP 0x00000120:
BITLOCKER_FATAL_ERROR (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
BITLOCKER_FATAL_ERROR (120)
BitLocker Drive Encryption encountered a problem that it cannot recover
from.
Arguments:
Arg1: 0000000000000000, Type of problem
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557307(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
[This
is preliminary
documentation and subject to change.]
The DRIVER_VIOLATION bug
check has a value of 0x00000121. This bug check indicates that a driver
has caused a violation.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Describes the type of violation |
| 2 |
Reserved |
| 3 |
Reserved |
Comments
Use a kernel debugger and
view the call stack to determine the name of the driver that caused the
violation.
WinDbg
Output Example:
DRIVER_VIOLATION (121)
A driver has caused a violation. Parameter 1 describes the type of
violation.
Look at the call stack to determine the misbehaving driver.
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557313(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
[This
is preliminary
documentation and subject to change.]
The WHEA_INTERNAL_ERROR bug
check has a value of 0x00000122. This bug check indicates that an
internal error in the Windows Hardware Error Architecture (WHEA) has
occurred.
WinDbg
Output Example:
WHEA_INTERNAL_ERROR (122)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000123:
CRYPTO_SELF_TEST_FAILURE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
WHEA_INTERNAL_ERROR (122)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000124:
WHEA_UNCORRECTABLE_ERROR (go
to top of page)
Usual causes:
Hardware, Incompatibility, May be driver corruption
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557321(v=VS.85).aspx
Knowledge
Base Articles:
KB 952681 A
"0x00000124" Stop error message occurs when you use the "hot plugging"
feature to add or to remove a PCI Express device on a Windows Server
2008-based computer or on a Windows Vista-based
computer
KB 967915 STOP
0x124
miniport reset due to slow OID_PNP_SET_POWER (Server 2008)
KB 968992 Stop
error message when you use the Safely Remove Hardware option to remove
a PCI Express device that supports hot plugging on a computer that is
running Windows Server
2008 or Windows Vista:
"0x00000124"
WinDbg
Help File Entry:
[This
is preliminary
documentation and subject to change.]
The WHEA_UNCORRECTABLE_ERROR
bug check has a value of 0x00000124. This bug check indicates that a
fatal hardware error has occurred. This bug check uses the error data
that is provided by the Windows Hardware Error Architecture (WHEA).
Parameters
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of error |
| 0x0 |
Address of WHEA_ERROR_RECORD structure. |
High 32 bits of MCi_STATUS MSR for the MCA bank that
had the error. |
Low 32 bits of MCi_STATUS MSR for the MCA bank that had
the error. |
A machine check exception occurred.
These parameter descriptions apply if the processor is based on the x64
architecture, or the x86 architecture that has the MCA feature
available (for example, Intel Pentium Pro, Pentium IV, or Xeon).
|
| 0x1 |
Address of WHEA_ERROR_RECORD structure. |
Reserved. |
Reserved. |
A corrected machine check exception occurred. |
| 0x2 |
Address of WHEA_ERROR_RECORD structure. |
Reserved. |
Reserved. |
A corrected platform error occurred. |
| 0x3 |
Address of WHEA_ERROR_RECORD structure. |
Reserved. |
Reserved. |
A nonmaskable Interrupt (NMI) error occurred. |
| 0x4 |
Address of WHEA_ERROR_RECORD structure. |
Reserved |
Reserved. |
An uncorrectable PCI Express error occurred. |
| 0x5 |
Address of WHEA_ERROR_RECORD structure. |
Reserved. |
Reserved. |
A generic hardware error occurred. |
| 0x6 |
Address of WHEA_ERROR_RECORD structure |
Reserved. |
Reserved. |
An IA64 INIT error occurred. |
| 0x7 |
Address of WHEA_ERROR_RECORD structure. |
Reserved. |
Reserved. |
A BOOT error occurred. |
| 0x8 |
Address of WHEA_ERROR_RECORD structure |
Reserved. |
Reserved. |
A Scalable Coherent Interface (SCI) generic error
occurred. |
| 0x9 |
Address of WHEA_ERROR_RECORD structure. |
Length, in bytes, of the SAL log. |
Address of the SAL log. |
An uncorrectable IA-64 machine check abort error
occurred. |
| 0xA |
Address of WHEA_ERROR_RECORD structure |
Reserved. |
Reserved. |
A corrected IA-64 machine check error occurred. |
| 0xB |
Address of WHEA_ERROR_RECORD structure. |
Reserved. |
Reserved. |
A corrected IA-64 platform error occurred. |
Comments
Parameter 1 identifies the
type of error source that reported the error. Parameter 2 holds the
address of the WHEA_ERROR_RECORD structure that describes the error
condition.
For information about WHEA,
see Windows Hardware Error Architecture Design Guide within the WDK
documentation .
Note This
bug check is not supported in Windows versions prior to
Windows Vista. Instead, machine check exceptions are reported
through bug
check 0x9C.
WinDbg
Output Examples:
WHEA_UNCORRECTABLE_ERROR
(124)
A fatal hardware error has occurred. Parameter 1 identifies the type of
error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: fffffa800677f8f8, Address of the WHEA_ERROR_RECORD structure.
Arg3: 0000000000000000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000000000, Low order 32-bits of the MCi_STATUS value.
WHEA_UNCORRECTABLE_ERROR
(124)
A fatal hardware error has occurred. Parameter 1 identifies the type of
error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 00000004, PCI Express Error
Arg2: 84e39024, Address of the WHEA_ERROR_RECORD structure.
Arg3: 00000000
Arg4: 00000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
NMR_INVALID_STATE (125)
NMR (network module registrar) has detected an invalid state. Parameter
1 describes
the type of the state.
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000126:
NETIO_INVALID_POOL_CALLER (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
NETIO_INVALID_POOL_CALLER
(126)
An invalid pool request has been made to netio managed memory pool
(e.g. FSB and MDL).
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Hardware, Memory, Device driver
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557326(v=VS.85).aspx
Knowledge
Base Articles:
KB 925528 Stop
errors occur on a Windows-based computer that has 2GB or more of RAM
and is using an NVIDIA nForce USB controller (XP, Server 2003,
Vista)
KB 929734
You have problems
after you resume a Windows
Vista-based
computer from sleep or from hibernation
WinDbg
Help File Entry:
[This
is preliminary
documentation and subject to change.]
The PAGE_NOT_ZERO bug check
has a value of 0x00000127. This bug check indicates that a page that
should have been filled with zeros was not. This bug check might occur
because of a hardware error or because a privileged component of the
operating system modified a page after freeing it.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Virtual address that maps the corrupted page |
| 2 |
Physical page number |
| 3 |
Zero (Reserved) |
| 4 |
Zero (Reserved) |
WinDbg
Output Example:
PAGE_NOT_ZERO (127)
This bugcheck
indicates that a page that should have been filled with zero was
not. Typically this is due to a hardware error or some
privileged
component modified a page after freeing it.
Arguments:
Arg1: 0000000000000000, virtual address mapping the corrupted page
Arg2: 0000000000000000, physical page number
Arg3: 0000000000000000, zero
Arg4: 0000000000000000, zero
STOP 0x00000128:
WORKER_THREAD_RETURNED_WITH_BAD_IO_PRIORITY
(go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557329(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
WORKER_THREAD_RETURNED_WITH_BAD_IO_PRIORITY
(128)
A worker threads IOPriority was wrongly modified by the called worker
routine.
Arguments:
Arg1: 0000000000000000, address of worker routine (do ln on this to
find guilty driver)
Arg2: 0000000000000000, Current IoPrioirity value
Arg3: 0000000000000000, workitem parameter
Arg4: 0000000000000000, workitem address
STOP 0x00000129:
WORKER_THREAD_RETURNED_WITH_BAD_PAGING_IO_PRIORITY
(go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
WORKER_THREAD_RETURNED_WITH_BAD_PAGING_IO_PRIORITY
(129)
A worker threads Paging IOPriority was wrongly modified by the called
worker routine.
Arguments:
Arg1: 0000000000000000, address of worker routine (do ln on this to
find guilty driver)
Arg2: 0000000000000000, Current Paging IoPrioirity value
Arg3: 0000000000000000, workitem parameter
Arg4: 0000000000000000, workitem address
STOP 0x0000012A:
MUI_NO_VALID_SYSTEM_LANGUAGE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
MUI_NO_VALID_SYSTEM_LANGUAGE
(12a)
Windows did not find any installed, licensed language packs for the
system default UI language.
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000012B:
FAULTY_HARDWARE_CORRUPTED_PAGE (go
to top of page)
Usual causes:
Hardware memory error
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/windows/hardware/ff557329%28v=vs.85%29.aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
[This
is preliminary
documentation and subject to change.]
The
FAULTY_HARDWARE_CORRUPTED_PAGE bug check has a value of 0x00000128.
This bug check indicates that a single-bit error was found in this
page. This is a hardware memory error.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Virtual address maps to the corrupted page |
| 2 |
Physical page number |
| 3 |
Zero (Reserved) |
| 4 |
Zero (Reserved) |
WinDbg
Output Example:
FAULTY_HARDWARE_CORRUPTED_PAGE
(12b)
This bugcheck indicates that a single bit error was found in this
page. This is a hardware memory error.
Arguments:
Arg1: 0000000000000000, virtual address mapping the corrupted page
Arg2: 0000000000000000, physical page number
Arg3: 0000000000000000, zero
Arg4: 0000000000000000, zero
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557339(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
[This
is preliminary
documentation and subject to change.]
The EXFAT_FILE_SYSTEM bug
check has a value of 0x0000012C. This bug check indicates that a
problem occurred in the Extended File Allocation Table (exFAT) file
system.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
Specifies source file and line number information. The
high 16 bits (the first four hexadecimal digits after the "0x")
determine the source file by its identifier number. The low 16 bits
determine the source line in the file where the bug check occurred. |
| 2 |
If FppExceptionFilter is on the
stack, this parameter specifies the address of the exception record. |
| 3 |
If FppExceptionFilter is on the
stack, this parameter specifies the address of the context record. |
| 4 |
Reserved. |
Cause
This bug check is caused by
the file system as a last resort when its internal accounting is in an
unsupportable state and to continue poses a large risk of data loss.
The file system never causes this bug check when the on disk structures
are corrupted, the disk sectors go bad, or a memory allocation fails.
Bad sectors could lead to a bug check, for example, when a page fault
occurs in kernel code or data and the memory manager cannot read the
pages. However, for this bug check, the file system is not the cause.
Resolving the Problem
To debug this
problem: Use the .cxr (Display
Context Record) command together with
Parameter 3, and then use kb (Display
Stack Backtrace).
WinDbg
Output Example:
EXFAT_FILE_SYSTEM (12c)
If you see FppExceptionFilter on the
stack then the 2nd and 3rd
parameters are the exception record and
context record. Do a .cxr
on the 3rd parameter and then kb to
obtain a more informative stack
trace.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000012D:
VOLSNAP_OVERLAPPED_TABLE_ACCESS (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
VOLSNAP_OVERLAPPED_TABLE_ACCESS
(12d)
This bugcheck indicates that a volsnap tried to access a common table
from two different threads which may result in table corruption and
eventually corrupt the table.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
KB 2780444
"0x0000012E" Stop error occurs when an application sends a 12-byte SCSI opcode
to an iSCSI target in Windows Vista SP2,
Windows Server 2008 SP2,
Windows 7 SP1, and Windows
Server 2008 R2 SP1
WinDbg
Help File Entry:
WinDbg
Output Example:
INVALID_MDL_RANGE (12e)
A driver has called the IoBuildPartialMdl() function and passed it an
MDL
to map part of a source MDL, but the virtual address range specified is
outside the range in the source MDL. This is a driver
bug. The source
and target MDLs, as well as the address range length to be mapped are
the
arguments to the IoBuildPartialMdl() function, i.e.;
IoBuildPartialMdl(
IN PMDL SourceMdl,
IN OUT PMDL TargetMdl,
IN PVOID VirtualAddress,
IN ULONG Length
)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x0000012F:
VHD_BOOT_INITIALIZATION_FAILED (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
VHD_BOOT_INITIALIZATION_FAILED
(12f)
An initialization failure occurred while attempting to boot from a VHD.
Arguments:
Arg1: 0000000000000000, Action that failed
Arg2: 0000000000000000, NT status code
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000130:
DYNAMIC_ADD_PROCESSOR_MISMATCH (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
DYNAMIC_ADD_PROCESSOR_MISMATCH
(130)
This bugcheck indicates that a new processor added to the system is
incompatible with the current configuration.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000131:
INVALID_EXTENDED_PROCESSOR_STATE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
INVALID_EXTENDED_PROCESSOR_STATE
(131)
Invalid combination of parameters was detected while saving or
restoring
extended processor state.
Arguments:
Arg1: 0000000000000000, Invalid feature mask was passed or extended
processor state is
not enabled.
Arg2: 0000000000000000, Nonzero if extended state is enabled.
Arg3: 0000000000000000, The low 32 bits of the feature mask.
Arg4: 0000000000000000, The high 32 bits of the feature mask.
STOP 0x00000132:
RESOURCE_OWNER_POINTER_INVALID (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (132)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000133:
DPC_WATCHDOG_VIOLATION (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/windows/hardware/jj154556%28v=vs.85%29.aspx
Troubleshooting STOP 0x133's:
http://blogs.msdn.com/b/ntdebugging/archive/2012/12/07/determining-the-source-of-bug-check-0x133-dpc-watchdog-violation-errors-on-windows-server-2012.aspx
Knowledge
Base Articles:
KB 2789962
You receive a "DPC_WATCHDOG_VIOLATION (133)" Stop error message on a Windows
Server 2012-based computer
KB 2927725
"0x133", "0x101" Stop error or system stops responding when hot adding a CPU
core to a computer (Windows 8/Server
2012)
WinDbg
Help File Entry:
WinDbg
Output Example:
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of
DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time
allotment. The offending
component can usually be identified with a stack trace. (Arg1 of 1 usually
requires an ETW trace to find the faulting driver - see troubleshooting
article above)
Arg2: 0000000000000281, The DPC time count (in ticks).
Arg3: 0000000000000280, The DPC time allotment (in ticks).
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (134)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000135:
REGISTRY_FILTER_DRIVER_EXCEPTION (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
REGISTRY_FILTER_DRIVER_EXCEPTION (135)
This bugcheck is caused by an unhandled exception in a registry
filtering driver.
This bugcheck indicates that a registry filtering driver didn't handle
exception inside
its notification routine. One can identify the driver by the 3rd
parameter.
Arguments:
Arg1: ffffffffc000001d, ExceptionCode
Arg2: fffff88006e765f0, Address of the context record for the exception
that caused the bugcheck
Arg3: fffff88004d526e0, The driver's callback routine address
Arg4: fffff8a000be3a40, Internal
STOP 0x00000136:
VHD_BOOT_HOST_VOLUME_NOT_ENOUGH_SPACE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
KB 2020922
"Stop 0x00000136" error when you try to perform a native boot from a VHD (Windows
7/Server 2008 R2)
WinDbg
Help File Entry:
WinDbg
Output Example:
VHD_BOOT_HOST_VOLUME_NOT_ENOUGH_SPACE
(136)
An initialization failure occurred while attempting to boot from a VHD.
The volume that hosts the VHD does not have enough free space to expand
the VHD.
Arguments:
Arg1: 0000000000000000, Unable to expand VHD file to full size.
Arg2: ffffffffc000007f, NT status code
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x00000137:
WIN32K_HANDLE_MANAGER (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000138:
GPIO_CONTROLLER_DRIVER_ERROR (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/windows/hardware/jj191737%28v=vs.85%29.aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000139:
KERNEL_SECURITY_CHECK_FAILURE (go
to top of page)
Usual causes:
Found in this topic - waiting on dump files to be posted:
http://answers.microsoft.com/en-us/windows/forum/windows_8-hardware/i-am-getting-a-bugcheck-error-0x00000139-any-idea/ed686d86-06f0-4bae-9a8f-c02db923f1f5?tab=AllReplies#tabs
Article by Alex Ionescu (co-author of Windows Internals):
http://www.alex-ionescu.com/?p=69
Found in this topic with dump file:
http://answers.microsoft.com/en-us/windows/forum/windows_8-system/kernel-security-check-failure-bsod-crash/786b6cec-5cd7-4c32-9e52-dc1dd9883390
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/windows/hardware/jj569891%28v=vs.85%29.aspx
Knowledge
Base Articles:
KB 2883658 "0x00000139"
Stop error on a Windows Server 2012-based
computer that has many TCP connections
WinDbg
Help File Entry:
WinDbg
Output Example:
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel
component has corrupted a critical data structure. The corruption
could
potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e.
double remove).
Arg2: fffff8800e54f3b0, Address of the trap frame for the
exception that caused the bugcheck
Arg3: fffff8800e54f308, Address of the
exception record for the exception that caused the bugcheck
Arg4:
0000000000000000, Reserved
STOP 0x0000013A:
KERNEL_MODE_HEAP_CORRUPTION (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x0000013B:
PASSIVE_INTERRUPT_ERROR (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x0000013C:
INVALID_IO_BOOST_STATE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x0000013D:
CRITICAL_INITIALIZATION_FAILURE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Usual causes:
Not documented in in Win8 DP SDK v8.0
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Usual causes:
Not documented in in Win8 DP SDK v8.0
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000140:
STORAGE_DEVICE_ABNORMALITY_DETECTED (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000141:
VIDEO_ENGINE_TIMEOUT_DETECTED (go
to top of page)
Usual causes:
Knowledge
Base Articles:
Suggested post for troubleshooting:
http://www.sysnative.com/forums/showthread.php/35-Video-TDR-Timeout-0x116-0x117
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000142:
VIDEO_TDR_APPLICATION_BLOCKED (go
to top of page)
Usual causes:
Knowledge
Base Articles:
Suggested post for troubleshooting:
http://www.sysnative.com/forums/showthread.php/35-Video-TDR-Timeout-0x116-0x117
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000143:
PROCESSOR_DRIVER_INTERNAL (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Usual causes:
USB3 Drivers (No duh!)
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/windows/hardware/hh450914%28v=vs.85%29.aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
[This documentation is preliminary and is subject to
change.]
The BUGCODE_USB3_DRIVER bug check has a value of 0x00000144. This is the
code used for all USB 3 bug checks. Parameter 1 specifies the type of the USB 3
bug check, and the meanings of the other parameters are dependent on Parameter
1.
Parameters
The following parameters are displayed on the blue screen.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of error |
0x1
|
Optional. Pointer to the IRP used to resend the URB
|
Pointer to the URB
|
Pointer to the client driver's device object
|
A client driver used an URB that it had previously sent to the core
stack.
|
0x2
|
Pointer to the physical device object (PDO) for the boot device
|
Reserved
|
Reserved
|
A boot or paging device failed re-enumeration.
|
0x3
|
Optional. Pointer to the IRP used to send the URB
|
Pointer to the corrupted URB
|
Pointer to the client driver's device object
|
A client driver sent a corrupted URB to the core stack. This can
happen because the client driver did not allocate the URB using USBD_xxxUrbAllocate
or because the client driver did a buffer underrun for the URB.
|
0x800
|
IRQL at which the Open Static Streams request was sent
|
Pointer to the Open Static Streams IRP
|
Pointer to the client driver's device object
|
An Open Static Streams request was sent at IRQL > PASSIVE LEVEL.
|
0x801
|
Pointer to the Open Static Streams IRP
|
Pointer to the Open Static Streams URB
|
Pointer to the client driver's device object
|
A client driver attempted to open static streams before querying for
streams capability. A client driver cannot open a static stream until
after it successfully queries for the streams capability. For more
information, see Remarks.
|
0x802
|
Number of static streams that the client driver tried to open
|
Number of static streams that were granted to the client driver
|
Pointer to the client driver's device object
|
A Client driver tried to open an invalid number of static streams.
The number of streams cannot be 0 and cannot be greater than the value
returned to the client driver in the query USB capability call.
|
0x803
|
Pointer to the Open Static Streams IRP
|
Pointer to the Open Static Streams URB
|
Pointer to the client driver's device object
|
A client driver attempted to open static streams for an endpoint
that already had static streams open. Before opening static streams, the
client driver must close the previously opened static streams.
|
0x804
|
The leaked handle context. Run !usbanalyze -v to get
information about the leaked handle and URBs. You must enable Driver
Verifier for the client driver.
|
Device object passed to USBD_CreateHandle.
|
Reserved
|
A client driver forgot to close a handle it created earlier using
USBD_CreateHandle or forgot to free an URB it allocated.
|
0x805
|
WDFREQUEST handle for the Close Static Streams URB
|
Pointer to the Close Static Streams URB
|
Pointer to the client driver's device object
|
A client driver sent a Close Static Streams URB in an invalid state
(for example, after processing D0 Exit).
|
0x806
|
Pointer to the IRP
|
Pointer to the URB
|
Pointer to the client driver's device object
|
A client driver attempted to send a chained MDL before
querying for chained MDL capability. A client driver cannot send
a chained MDL until after it successfully queries for the chained
MDL capability. For more information, see Remarks.
|
0x807
|
Pointer to the chained MDL
|
Pointer to the URB
|
Pointer to the client driver's device object if available
|
A client driver sent an URB to the core stack with a transfer buffer
length longer than the byte count (returned by MmGetMdlByteCount)
of the MDL passed in. For more information, see Remarks.
|
Remarks
To query for a USB capability, the client driver must call
WdfUsbTargetDeviceQueryUsbCapability or USBD_QueryUsbCapability
To
send a chained MDL, the client driver must call
USBD_QueryUsbCapability and use
URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER_USING_CHAINED_MDL or
URB_FUNCTION_ISOCH_TRANSFER_USING_CHAINED_MDL.
WinDbg
Output Example:
STOP 0x00000145:
SECURE_BOOT_VIOLATION (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000146:
NDIS_NET_BUFFER_LIST_INFO_ILLEGALLY_TRANSFERRED (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000147:
ABNORMAL_RESET_DETECTED (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x0000014B:
SOC_SUBSYSTEM_FAILURE (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/windows/hardware/hh995020%28v=vs.85%29.aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The SOC_SUBSYSTEM_FAILURE bug check has a value of 0x0000014B. This
indicates that an unrecoverable error was encountered in a System on a Chip
(SoC) subsystem. Important Info If You Have Received a STOP Code If you received
a blue screen error, or stop code, the computer has shut down abruptly to
protect itself from data loss. A hardware device, its driver, or related
software might have caused this error. If your copy of Windows came with your
computer, call the manufacturer of your computer. If you purchased Windows
separately from your computer, Microsoft provides support. To find contact info
for Microsoft or your computer manufacturer,
Contact Support. If you have experience with computers and want to
try to recover from this error, follow the steps provided in the Microsoft
article
Resolving STOP (Blue Screen) Errors in Windows. These actions might
prevent an error like this from happening again: Download and install updates
and device drivers for your computer from Windows Update. Scan your computer for
computer viruses. Check your hard disk for errors.
Bug Check 0x14B
SOC_SUBSYSTEM_FAILURE
Parameters The following parameters are displayed on
the blue screen.
Parameter Description
1 Specifies the subsystem that
caused the failure. 0: Wireless modem 1: Audio DSP 2: Wireless connectivity 3:
Sensors
2 Reserved.
3 Reserved.
4 Reserved.
WinDbg
Output Example:
STOP 0x0000014C:
FATAL_ABNORMAL_RESET_ERROR (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x0000014D:
EXCEPTION_SCOPE_INVALID (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x0000014E:
SOC_CRITICAL_DEVICE_REMOVED (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000150:
TCPIP_AOAC_NIC_ACTIVE_REFERENCE_LEAK (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000151:
UNSUPPORTED_INSTRUCTION_MODE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000152:
INVALID_PUSH_LOCK_FLAGS (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000153:
KERNEL_LOCK_ENTRY_LEAKED_ON_THREAD_TERMINATION (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
KERNEL_LOCK_ENTRY_LEAKED_ON_THREAD_TERMINATION (153)
A thread was terminated
before it had freed all its AutoBoost lock entries.
This is typically caused
when a thread never released a lock it previously
acquired (e.g. by relying
on another thread to release it), or if the thread
did not supply a
consistent set of flags to lock package APIs.
Arguments:
Arg1: 8857a300,
The address of the thread
Arg2: 8857a5d8, The address of the entry that was
not freed
Arg3: 00000001, Lock pointer was not NULL
Arg4: 00000000,
Reserved
STOP 0x00000154:
UNEXPECTED_STORE_EXCEPTION (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000156:
WINSOCK_DETECTED_HUNG_CLOSESOCKET_LIVEDUMP (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000157:
KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000158:
ILLEGAL_IOMMU_PAGE_FAULT (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000159:
HAL_ILLEGAL_IOMMU_PAGE_FAULT (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x0000015B:
WORKER_THREAD_RETURNED_WITH_SYSTEM_PAGE_PRIORITY_ACTIVE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x0000015C:
PDC_WATCHDOG_TIMEOUT_LIVEDUMP (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x0000015D:
SOC_SUBSYSTEM_FAILURE_LIVEDUMP (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/windows/hardware/dn376329%28v=vs.85%29.aspx
(I have some doubt about the accuracy of the info at this link - as it
refers to Bug Check 0x14B SOC_SUBSYSTEM_FAILURE)
Knowledge
Base Articles:
WinDbg
Help File Entry:
No entry in the WinDbg Help File - despite the entry at MSDN
WinDbg
Output Example:
STOP 0x0000015E:
BUGCODE_NDIS_DRIVER_LIVE_DUMP (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/windows/hardware/dn308254%28v=vs.85%29.aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:The BUGCODE_NDIS_DRIVER_LIVE_DUMP bug code has a value
of 0x0000015E. This bug code indicates that NDIS has captured a live kernel
dump. NDIS does not generate a bug check in this situation.
Parameters
Parameter 1 is always equal to 0x01. This table gives the meanings of the
other parameters.
| Parameter 1 |
Parameter 2 |
Parameter 3 |
Parameter 4 |
Cause of Error |
|
0x01
|
Handle to the miniport adapter or filter module. Use
!ndiskd.miniport or
!ndiskd.filter.
|
Address of the physical device object (PDO) of the miniport
|
A code that indicates the reason for the error. See Cause for
possible values.
|
The miniport has experienced a fatal error and must be removed.
|
Cause
When Parameter 1 is 0x01, Parameter 4 indicates the cause of the error. Here
are the possible values:
- 70: Caused by user mode
- 71: Caused by NdisMRemoveMiniport
- 72: Caused by NdisIMInitializeDeviceInstanceEx failing
- 73: Caused by MiniportRestart failing
- 74: Caused by failing a OID_PNP_SET_POWER (D0) request
- 75: Caused by failing a OID_PNP_SET_POWER (Dx) request
Remarks
This bug code occurs only in Windows 8.1 Preview and later versions of
Windows.
WinDbg
Output Example:
STOP 0x0000015F:
CONNECTED_STANDBY_WATCHDOG_TIMEOUT_LIVEDUMP (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000160:
WIN32K_ATOMIC_CHECK_FAILURE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000162:
KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE (162)
A lock tracked by AutoBoost was
released by a thread that did not own the lock.
This is typically caused when
some thread releases a lock on behalf of another
thread (which is not legal
with AutoBoost tracking enabled) or when some thread
tries to release a lock
it no longer owns.
Arguments:
Arg1: ffffe0000427c080, The address of the
thread
Arg2: ffffe00000289400, The lock address
Arg3: 00000000ffffffff,
The session ID of the thread
Arg4: 0000000000000000, Reserved
STOP 0x00000333:
(go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (333)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000001
Arg2: 0000000000000002
Arg3: 0000000000000003
Arg4: 0000000000000004
STOP 0x00000360:
XBOX_360_SYSTEM_CRASH (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000420:
XBOX_360_SYSTEM_CRASH_RESERVED (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x00000BFE:
BC_BLUETOOTH_VERIFIER_FAULT (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
BC_BLUETOOTH_VERIFIER_FAULT
(bfe)
The Bluetooth profile driver verifier has caught a violation.
Look at the call stack to dertermine the misbehaving driver.
Arguments:
Arg1: 0000000000000000, The subtype of the Bluetooth verifier fault.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
KB 946084 Stop
error
message when you start a Windows Vista-based
computer: "0x0000C1F5"
KB 958069 Stop
error
when you start a Windows Vista-based
computer even though hotfix 946084 is installed on the computer:
"0x0000C1F5"
KB 970101 How
to work
around Stop Error 0x0000C1F5 on a Windows Vista-based
computer
A suggested method to fix it (I haven't
tried this): http://www.youtube.com/watch?v=SwSvIhyZRVc&feature=player_embedded
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code
(c1f5)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Usual causes:
Knowledge
Base Articles:
KB 2550569 "0x20001"
Stop error when you start a Linux VM in Windows Server 2008 R2 SP1
WinDbg
Help File Entry:
WinDbg
Output Example:
The hypervisor has
encountered a fatal error.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0x1000000A:
IRQL_NOT_LESS_OR_EQUAL (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid)
address at an
interrupt request level (IRQL) that is too high. This is
usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00200000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 =
write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only
on chips which support this level of status)
Arg4: 806e6a2a, address which referenced memory
STOP 0x10000050:
PAGE_FAULT_IN_NONPAGED_AREA_M (go
to top of page)
Usual causes:
Knowledge
Base Articles:
KB 939868 You
receive an
error message when you access a Web-based program on a Windows XP-based
multiprocessor computer
WinDbg
Help File Entry:
WinDbg
Output Example:
PAGE_FAULT_IN_NONPAGED_AREA
(50)
Invalid system memory was referenced. This cannot be
protected by try-except,
it must be protected by a Probe. Typically the address is
just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: 80f17aa5, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 81c299e7, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000002, (reserved)
STOP 0x1000007E:
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557196(v=VS.85).aspx
Knowledge
Base Articles:
KB 925528 Stop
errors occur on a Windows-based computer that has 2GB or more of RAM
and is using an NVIDIA nForce USB controller (XP, Server 2003,
Vista)
KB 929734 You
have
problems after you resume a Windows Vista-based
computer from sleep or from hibernation
KB 949483 Stop
error
when you resume a computer that is running Windows XP or
a 64-bit version of Windows Server 2003
from hibernation: "STOP 0x1000007E"
KB 959766 Windows
Server 2008
Hyper-V systems restart unexpectedly, and you receive a 0x1000007E Stop
error code when you mount a VHD file
WinDbg
Help File Entry:
The
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M bug check has a value of
0x1000007E. This indicates that a system thread generated an exception
which the error handler did not catch.
Bug check 0x1000007E has the
same meaning and parameters as bug
check 0x7E (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED).
WinDbg
Output Example:
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
(1000007e)
This is a very common bugcheck. Usually the exception address
pinpoints
the driver/function that caused the problem. Always note this
address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This
means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should
never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this
breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 993543c0, The address that the exception occurred at
Arg3: 807ee974, Exception Record Address
Arg4: 807ee550, Context Record Address
STOP 0x1000007F:
UNEXPECTED_KERNEL_MODE_TRAP_M (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557201(v=VS.85).aspx
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
UNEXPECTED_KERNEL_MODE_TRAP_M bug check has a value of 0x1000007F. This
indicates that a trap was generated by the Intel CPU and the kernel
failed to catch this trap.
Bug check 0x1000007F has the
same meaning and parameters as bug
check 0x7F (UNEXPECTED_KERNEL_MODE_TRAP).
WinDbg
Output Example:
UNEXPECTED_KERNEL_MODE_TRAP_M
(1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in
the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 803d3130
Arg3: 00000000
Arg4: 00000000
STOP 0x1000008E:
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (go
to top of page)
Usual causes: Insufficient disk space,
Device driver, Video card, BIOS, Breakpoint in startup without having a debugger
attached, Hardware incompatibility, Faulty system service, 3rd party remote
control, Memory
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557203(v=VS.85).aspx
Knowledge
Base Articles:
KB 310740 A
"STOP:
0x1000008E In Emupia2k.sys" Error Message Appears After You Upgrade
from Windows 2000
KB 893239 You
may
receive a Stop error message on a blue screen when you start a
Microsoft Windows Server
2003-based computer or a Microsoft Windows XP-based
computer
KB 963038 Error
message
when you establish a remote desktop connection to a remote computer
that is running Windows XP:
"STOP: 0x1000008E"
WinDbg
Help File Entry:
The
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M bug check has a value of
0x1000008E. This indicates that a kernel-mode program generated an
exception which the error handler did not catch.
Bug check 0x1000008E has the
same meaning and parameters as bug
check 0x8E (KERNEL_MODE_EXCEPTION_NOT_HANDLED).
WinDbg
Output Example:
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
(1000008e)
This is a very common bugcheck. Usually the exception address
pinpoints
the driver/function that caused the problem. Always note this
address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This
means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should
never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this
breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 807cbd5b, The address that the exception occurred at
Arg3: 883fda50, Trap Frame
Arg4: 00000000
STOP 0x100000B8:
ATTEMPTED_SWITCH_FROM_DPC (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
ATTEMPTED_SWITCH_FROM_DPC
(b8)
A wait operation, attach process, or yield was attempted from a DPC
routine.
This is an illegal operation and the stack track will lead to the
offending
code and original DPC routine.
Arguments:
Arg1: 85c39568, Original thread which is the cause of the failure
Arg2: 841a6a70, New thread
Arg3: 8a883fd0, Stack address of the original thread
Arg4: 00000000
STOP 0x100000CF:
TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE
(go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE
(cf)
Arguments:
Arg1: bf030d51, memory referenced
Arg2: 00000008, value 0 = read operation, 1 = write operation
Arg3: bf030d51, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000000, Mm internal code.
A driver has been incorrectly ported to
Terminal Server. It is referencing
session space addresses from the system
process context. Probably from
queueing an item to a system worker
thread.
The broken driver's name is displayed on
the screen.
STOP 0x100000D1:
DRIVER_IRQL_NOT_LESS_OR_EQUAL (go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
DRIVER_IRQL_NOT_LESS_OR_EQUAL
(d1)
An attempt was made to access a pageable (or completely invalid)
address at an
interrupt request level (IRQL) that is too high. This is
usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 85c00000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 85d21108, address which referenced memory
STOP 0x100000D6:
DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION_M
(go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION
(d6)
N bytes of memory was allocated and more than N bytes are being
referenced.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: 0000000000000000, if non-zero, the address which referenced
memory.
Arg4: 0000000000000000, (reserved)
STOP 0x100000EA:
THREAD_STUCK_IN_DEVICE_DRIVER_M (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff557206(v=VS.85).aspx
Knowledge
Base Articles:
KB 293078 Error
message
in Windows XP:
"STOP 0x000000EA THREAD_STUCK_IN_DEVICE_DRIVER"
KB 939868 You
receive an
error message when you access a Web-based program on a Windows XP-based
multiprocessor computer
WinDbg
Help File Entry:
The
THREAD_STUCK_IN_DEVICE_DRIVER_M bug check has a value of 0x100000EA.
This indicates that a thread in a device driver is endlessly spinning.
Bug check 0x100000EA has the
same meaning and parameters as bug
check 0xEA (THREAD_STUCK_IN_DEVICE_DRIVER).
WinDbg
Output Example:
THREAD_STUCK_IN_DEVICE_DRIVER_M
(100000ea)
The device driver is spinning in an infinite loop, most likely waiting
for
hardware to become idle. This usually indicates problem with the
hardware
itself or with the device driver programming the hardware incorrectly.
If the kernel debugger is connected and running when watchdog detects a
timeout condition then DbgBreakPoint() will be called instead of
KeBugCheckEx()
and detailed message including bugcheck arguments will be printed to the
debugger. This way we can identify an offending thread, set breakpoints
in it,
and hit go to return to the spinning code to debug it further. Because
KeBugCheckEx() is not called the .bugcheck directive will not return
bugcheck
information in this case. The arguments are already printed out to the
kernel
debugger. You can also retrieve them from a global variable via
"dd watchdog!g_WdBugCheckData l5" (use dq on NT64).
On MP machines it is possible to hit a timeout when the spinning thread
is
interrupted by hardware interrupt and ISR or DPC routine is running at
the time
of the bugcheck (this is because the timeout's work item can be
delivered and
handled on the second CPU and the same time). If this is the case you
will have
to look deeper at the offending thread's stack (e.g. using dds) to
determine
spinning code which caused the timeout to occur.
Arguments:
Arg1: fffffa80059bcb60, Pointer to a stuck thread object. Do
.thread then kb on it to find
the hung location.
Arg2: 0000000000000000, Pointer to a DEFERRED_WATCHDOG object.
Arg3: 0000000000000000, Pointer to offending driver name.
Arg4: 0000000000000000, Number of times "intercepted" bugcheck 0xEA was
hit (see notes).
STOP 0x40000087:
WINDOWS_NT_CSD_STRING (go
to top of page)
STOP 0x40000088:
WINDOWS_NT_INFO_STRING (go
to top of page)
STOP 0x4000008A:
THREAD_TERMINATE_HELD_MUTEX (go
to top of page)
STOP 0x4000008B:
BUGCODE_PSS_CRASH_INIT (go
to top of page)
STOP 0x4000008C:
BUGCODE_PSS_CRASH_PROGRESS (go
to top of page)
STOP 0x4000008D:
BUGCODE_PSS_CRASH_DONE (go
to top of page)
STOP 0x4000009D:
WINDOWS_NT_INFO_STRING_PLURAL (go
to top of page)
STOP 0x400000AD:
VIDEO_DRIVER_DEBUG_REPORT_REQUEST (go
to top of page)
STOP 0x70860002: (go
to top of page)
Usual causes:
Found associated with iaStor.sys on 14 Sep 2010 in a Toshiba laptop
Found associated with IaStor.sys
on 10 Jan 2011 in a Sony laptop: http://www.techsupportforum.com/forums/f217/bsod-kernel-dump-analysis-discussion-452622-9.html#post3073666
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (70860002)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000003
Arg2: 0000000000000002
Arg3: 0000000000000009
Arg4: 0000000000000000
STOP 0x80070246:
ERROR_ILLEGAL_CHARACTER (go
to top of page)
Usual causes:
Knowledge
Base Articles:
KB 942968 Stop error when you try
to download updates from Windows Update on a computer that is running
Windows Vista: "0x80070246"
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0x80080005:
CO_E_SERVER_EXEC_FAILURE (go
to top of page)
Usual causes:
Knowledge
Base Articles:
KB 825118
"Stop error code
0x80080005 (CO_E_SERVER_EXEC_FAILURE)" error message (XP)
WinDbg
Help File Entry:
WinDbg
Output Example:
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code
(8086)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
STOP 0x9087:
(go
to top of page)
Usual causes:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code
(9087)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
STOP 0x9088:
(go
to top of page)
Usual causes:
Found at this post: http://www.techsupportforum.com/microsoft-support/windows-vista-windows-7-support/507417-bsods-any-type-think-they-produce-dump-file-but-there-aint-any.html
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code
(9088)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
STOP 0xA0000001:
(go
to top of page)
Usual causes:
Appears to be a custom bugcheck coded into ATI drivers
Found at this post: http://www.techsupportforum.com/forums/f300/unknown-bugcheck-0xa0000001-0x5-593369.html
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code
(a0000001)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
STOP 0xBADB0D00:
(go
to top of page)
Usual causes: Unknown BugCheck code
Found at this this memory dump (083012-26863-01.dmp) in this topic:
http://answers.microsoft.com/en-us/windows/forum/windows_7-hardware/how-do-i-find-out-the-cause-of-bsod/0eeee33b-ace9-48d3-84f8-dbea92ae0c75?page=2#_self
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (badb0d00)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 807c0023
Arg3: 00000000
Arg4: 00000000
STOP 0xC0000005:
Usual causes:
Knowledge
Base Articles:
KB 2800789
0xC0000005 Stop error when the SVCHost.exe process that hosts Remote Desktop
Services crashes in Windows Server 2008 R2
KB 2920540
Stop error when computer is restarted by the Sysprep.exe process in
Windows 8.1 or Windows
Server 2012 R2 (0xc0000005 in athwnx.sys)
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0xC000000D:
Usual causes:
Knowledge
Base Articles:
KB 2901630
"Error code:0xc000000d"
when you upgrade a Surface RT (WinRT 8) device
to Windows RT 8.1
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0xC0000034:
While not technically a BSOD, this error occurs in situations that may
lead users to this web page.
As such, I'm including it here.
KB 2533552 An
update that prevents a "0xC0000034" error message when you try to
install Windows 7 SP1 or Windows Server 2008 R2 SP1 is available
STOP 0xC000009A:
STATUS_INSUFFICIENT_RESOURCES (go
to top of page)
Usual causes:
AUMHA
Listing:
http://aumha.org/a/stop.php#0xC9a
Knowledge
Base Articles:
KB 142719 Windows
Reports Out of Resources Error When Memory Is Available (NT, 2000)
KB 329075 Dmio
reports
Event ID 30 with status of 0xC000009 (2000)
KB 2534366 "0xC000009A"
error message when you try to install Windows 7 SP1 or
Windows Server 2008 R2
SP1
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0xC0000135:
UNABLE_TO_LOCATE_DLL (go
to top of page)
Usual causes:
AUMHA
Listing:
http://aumha.org/a/stop.php#0x135
Knowledge
Base Articles:
KB 173309 Blue Screen
STOP Message C0000135 Appears at Startup (NT)
KB 815011 Cannot Disable
the Registry Repair and Recovery Feature in Windows XP SP1
KB 885523 You receive a
"Stop: c0000135" and "winsrv was not found" error message after you
install Windows XP
Service Pack 2
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0xC0000142: DLL
Initialization Failure (go
to top of page)
Usual causes:
AUMHA
Listing:
http://aumha.org/a/stop.php#0x142
Knowledge
Base Articles:
KB 823659 Client,
service, and program incompatibilities that may occur when you modify
security settings and user rights assignments (95, 98, NT, 2000, XP, Server 2003,
Mac OS X)
KB 824572 "The
Application Failed to Initialize Properly (0xc0000142)" Error Message
When You Start Virtual
PC
KB 838857 You
receive a "The application failed to initialize properly (0xc0000142)"
error message when you start a computer that is running ISA Server 2000
KB 2701373
"0xC0000142" or "-1073741502" Stop error when many PowerShell scripts call the
Console.Write method or when you try to start many console applications on a
PowerShell console in Windows 7 or in Windows
Server 2008 R2
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0xC0000218:
STATUS_CANNOT_LOAD_REGISTRY_FILE (go
to top of page)
Usual causes:
File corrupt/missing, Device driver corrupting memory, Memory failure,
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560172(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x218
Knowledge
Base Articles:
Troubleshooting
specific Stop messages
Registry
troubleshooting steps for advanced users (XP, Server 2003)
KB 156640 How
to
Troubleshoot a Stop 0xC0000218 Error Message (NT, 2000)
KB 307545 How
to recover
from a corrupted registry that prevents Windows XP
from starting
KB 314874 How to
Troubleshoot a Stop 0xC0000218 Error (XP)
KB 815011 Cannot
Disable
the Registry Repair and Recovery Feature in Windows XP SP1
KB 822705 Registry troubleshooting
steps for advanced users
WinDbg
Help File Entry:
The
STATUS_CANNOT_LOAD_REGISTRY_FILE bug check has a value of 0xC0000218.
This indicates that a registry file could not be loaded.
Parameters
This bug check will display
a descriptive text message. The name of the damaged file is displayed
as part of the message.
Cause
This error occurs if a
necessary registry hive file cannot be loaded. Usually this means the
file is corrupt or is missing.
In rare instances, this
error can be caused by a driver that has corrupted the registry image
in memory, or by a memory error in this region.
Resolving the Problem
Try running the Emergency
Recovery Disk (ERD) and allow the system to repair any errors that it
detects. If the problem is a missing or corrupt registry file, this
will usually fix the problem.
WinDbg
Output Example:
Unknown bugcheck code
(c0000218)
Unknown bugcheck description
Arguments:
Arg1: 87ef03a0
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
STOP 0xC000021A:
STATUS_SYSTEM_PROCESS_TERMINATED (go
to top of page)
STOP 0xC000021A:
WINLOGON_FATAL_ERROR (Changed in Win8 DP SDK
v8.0)
Usual causes:
User-mode device driver, system service, or third-party application,
Mismatched system files
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560177(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x21a
Discussion link here: http://www.sevenforums.com/crashes-debugging/152386-cant-seem-find-answer.html#post1308276
Knowledge
Base Articles:
KB 156669 How
to
troubleshoot a "STOP 0xC000021A" error (XP, Server 2003)
KB 294728
Error message: "Stop error code 0x0000001E
(KMODE_EXCEPTION_NOT_HANDLED)" in Win32k.sys or a "Stop error code
0xC000021A" (2000/NT 4.0)
KB 295087 Error
Message
Cites STOP 0xc000021a Event and STATUS_SYSTEM_PROCESS_TERMINATED (2000)
KB 327020 Error
Message
Occurs When You Start Disk Management After Extending a Hardware Array (2000)
KB 330303 Error
message
in Windows 2000:
"STOP: c000021a (Fatal System Error)"
KB 889088 Your
computer
does not start and you receive a "Stop 0xC000021a" error message in
Windows
Server 2003
KB 922410 Error
message
when you restart a computer that is running Windows XP
Professional: "Stop 0xC000021A"
KB 950928 Error
message when you restart a computer that is running Windows Server 2003
or an x64-based version of Windows XP
Professional: "Stop 0xC000021A"
KB 977911 The
system language is changed or you receive a Stop error after you
restart a computer that is running a preinstalled version of Windows 7:
"0x00000021a"
KB 2746140
You receive "0x0000006B" and
"0XC000021A" Stop error message after uninstalling McAfee Agent 4.6.2 in Windows
Vista,
Windows 7, Windows
Server 2008 or Windows
Server 2008 R2
KB 2839011
You receive an Event ID 55 or a 0xc000021a Stop error in
Windows 7 after you install security update
2823324 (Server 2008 R2,
Server 2008 also)
More BSOD articles at this link:
http://search.microsoft.com/results.aspx?mkt=en-US&q=stop%3A%200xC000021A&qsc0=0&l=1&first=1&FORM=PEME
WinDbg
Help File Entry:
The
STATUS_SYSTEM_PROCESS_TERMINATED bug check has a value of 0xC000021A.
This means that an error has occurred in a crucial user-mode subsystem.
Parameters
The following parameters are
displayed on the blue screen.
| Parameter |
Description |
| 1 |
A string that identifies the problem |
| 2 |
The error code |
| 3 |
Reserved |
| 4 |
Reserved |
Cause
This error occurs when a
user-mode subsystem, such as WinLogon or the Client Server Run-Time
Subsystem (CSRSS), has been fatally compromised and security can no
longer be guaranteed. In response, the operating system switches to
kernel mode. Microsoft Windows cannot run without WinLogon or CSRSS.
Therefore, this is one of the few cases where the failure of a
user-mode service can shut down the system.
Mismatched system files can
also cause this error. This can occur if you have restored your hard
disk from a backup. Some backup programs might skip restoring system
files that they determine are in use.
Resolving the Problem
Running the kernel debugger
is not useful in this situation because the actual error occurred in a
user-mode process.
Resolving an error
in a user-mode device driver, system service, or third-party
application: Because bug check 0xC000021A occurs in a
user-mode process, the most common culprits are third-party
applications. If the error occurred after the installation of a new or
updated device driver, system service, or third-party application, the
new software should be removed or disabled. Contact the manufacturer of
the software about a possible update.
If the error occurs during
system startup, restart your computer, and press F8 at the
character-based menu that displays the operating system choices. At the
resulting Windows Advanced Options menu, choose the
Last Known Good Configuration option. This option is
most effective when only one driver or service is added at a time. If
this does not resolve the error, try manually removing the offending
software. If the system partition is formatted with file allocation
table (FAT), use an MS-DOS startup disk to gain access to the
computer's hard disk. If the system partition is formatted with NTFS
file system, you might be able to use Safe Mode to rename or delete the
faulty software. If the faulty software is used as part of the system
startup process in Safe Mode, you need to start the computer using the
Recovery Console in order to access the file. If a newly installed
piece if hardware is suspected, remove it to see if this resolves the
issue.
Try running the Emergency
Recovery Disk (ERD) and allow the system to repair any errors that it
detects.
Resolving a
mismatched system file problem: If you have recently restored
your hard disk from a backup, check if there is an updated version of
the Backup/Restore program available from the manufacturer. Make sure
the latest Windows Service Pack is installed.
WinDbg
Output Example:
WINLOGON_FATAL_ERROR
(c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: fffff88000acdcf0, String that identifies the problem.
Arg2: ffffffffc0000001, Error Code.
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0xC0000221:
STATUS_IMAGE_CHECKSUM_MISMATCH (go
to top of page)
Usual causes:
Device driver, System DLL corruption, Faulty hardware in I/O
path (a disk error, faulty RAM, or a corrupted page file), BIOS
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560180(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0x221
Knowledge
Base Articles:
Troubleshooting
specific Stop messages
KB 101096 Error
Message:
STOP: C0000221 Unknown Hard Error or STOP: C0000221
STATUS_IMAGE_CHECKSUM_MISMATCH (NT, 2000)
KB 142676 How
to correct
common User32.dll file errors (2000, XP, Server 2003,
Vista)
KB 160495 Err
Msg: STOP:
C000026C Unable to Load Device Driver... (NT, 2000)
KB 314474 "STOP:
C0000221 unknown hard error" or "STOP: C0000221
STATUS_IMAGE_CHECKSUM_MISMATCH" error message occurs (XP)
KB 315241 A
Stop:
0xc000026C or Stop: 0xc0000221 "Unable to Load Device Driver" Error
Occurs When You Start Windows XP
KB 326687 "Bad
Image
Checksum" Error When You Upgrade to Windows XP
KB 826353 "0xc0000221"
Stop Error Occurs When You Try to Run an LDAP Query (2000)
WinDbg
Help File Entry:
The
STATUS_IMAGE_CHECKSUM_MISMATCH bug check has a value of 0xC0000221.
This indicates that a driver or a system DLL has been corrupted.
Parameters
This bug check will display
a descriptive text message. The name of the damaged file is displayed
as part of the message.
Cause
This bug check results from
a serious error in a driver or other system file. The file header
checksum does not match the expected checksum.
This can also be caused by
faulty hardware in the I/O path to the file (a disk error, faulty RAM,
or a corrupted page file).
Resolving the Problem
To remedy this error, run
the Emergency Recovery Disk (ERD) and allow the system to repair or
replace the missing or damaged driver file on the system partition.
You can also run an in-place
upgrade over the existing copy of Windows. This preserves all registry
settings and configuration information, but replaces all system files.
If any Service Packs and/or hotfixes had previously been applied, you
need to reinstall them afterward in the appropriate order (latest
Service Pack, then any post-Service Pack hotfixes in the order in which
they were originally installed, if applicable).
If a specific file was
identified in the bug check message as being corrupted, you can try
replacing that individual file manually. If the system partition is
formatted with FAT, you can start from an MS-DOS startup disk and copy
the file from the original source onto the hard disk. If you have a
dual-boot machine, you can boot to your other operating system and
replace the file.
If you want to replace the
file on a single-boot system with an NTFS partition, you need to
restart the system, press F8 at the operating system Loader
menu, and choose Safe Mode with Command Prompt.
From there, copy a fresh version of the file from the original source
onto the hard disk. If the file is used as part of the system startup
process in Safe Mode, you need to start the computer using the Recovery
Console in order to access the file. If these methods fail, try
reinstalling Windows and then restoring the system from a backup.
Note If
the original file from the product CD has a filename extension ending
in an _ (underscore), the file needs to be
uncompressed before it can be used. The Recovery Console's Copy
command automatically detects compressed files and expands them as they
are copied to the target location. If you are using Safe Mode to access
a drive, use the Expand command to uncompress and
copy the file to the target folder. You can use the Expand
command in the command line environment of Safe Mode.
Resolving a disk
error problem: Disk errors can be a source of file
corruption. Run Chkdsk /f /r to
detect and resolve any file system structural corruption. You must
restart the system before the disk scan begins on a system partition.
Resolving a RAM
problem: If the error occurred immediately after RAM was
added to the system, the paging file might be corrupted or the new RAM
itself might be either faulty or incompatible.
To determine if
newly added RAM is causing a bug check
- Return the system to the original RAM configuration.
- Use the Recovery Console to access the partition containing
the paging file and delete the file pagefile.sys.
- While still in the Recovery Console, run Chkdsk /r
on the partition that contained the paging file.
- Restart the system.
- Set the paging file to an optimal level for the amount of
RAM added.
- Shutdown the system and add your RAM.
The new RAM must meet the system manufacturer's
specifications for speed, parity, and type (that is, fast page-mode
(FPM) versus extended data out (EDO) versus synchronous dynamic random
access memory (SDRAM)). Try to match the new RAM to the existing
installed RAM as closely as possible. RAM can come in many different
capacities, and more importantly, in different formats (single inline
memory modules — SIMM — or dual inline memory modules — DIMM). The
electrical contacts can be either gold or tin and it is not wise to mix
these contact types.
If you experience the same
error message after reinstalling the new RAM, run hardware diagnostics
supplied by the system manufacturer, especially the memory scanner. For
details on these procedures, see the owner's manual for your computer.
When you can log on to the
system again, check the System Log in Event Viewer for additional error
messages that might help pinpoint the device or driver that is causing
the error.
Disabling memory caching of
the BIOS might also resolve this error.
WinDbg
Output Example:
Unknown bugcheck code
(c0000221)
Unknown bugcheck description
Arguments:
Arg1: 8aafee30
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Usual causes:
AUMHA
Listing:
http://aumha.org/a/stop.php#0x244
Knowledge
Base Articles:
KB 232564 STOP
0xC0000244 when security log full (NT, 2000, XP, Server 2003)
KB 314358 Error
Message:
Stop 0xC0000244 Unable to Generate Security Events (XP)
KB 323475 A "Stop 0xc0000244"
Error Occurs When You Audit Policy Changes If CrashOnAuditFail Is
Turned On (XP)
KB 829082 You
receive a "Stop error 0xC0000244 {Audit Failed}" error message when the
crashonauditfail registry key is set to 1 on a Windows Server 2003-based
computer
KB 884889 You
receive a
"STOP: 0xC0000244 {Audit Failed}" error message if you shut down a
Windows 2000
Service Pack 3-based or Service Pack 4-based computer
KB 920983 Stop
error
message when you put a Windows XP Starter Edition-based
computer on standby: "0xC0000244"
KB 925112 Error
message
when you try to clear or to back up the Security log on a Windows XP-based
computer: "Stop 0xC0000244 (STATUS_AUDIT_FAILED)"
KB 2346270 You
receive a "Stop error 0xC0000244 {Audit Failed}" error message during
the shutdown process after you enable the CrashOnAuditFail setting on a
computer that is running Windows Server 2008 or Windows
Vista
KB 2546548
"0xC0000244" Stop
error when the Security log reaches its maximum size in Windows 7 or in Windows Server 2008 R2
KB 2673371
"0xC0000244" Stop error occurs when the Security log reaches its
maximum size in Windows Vista or in
Windows
Server 2008
More BSOD articles in this search:
http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0xC0000244&x=14&y=18&mkt=en-US&FORM=QBME1&l=1
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0xC000026C:
???FATAL SYSTEM ERROR??? (go
to top of page)
Usual causes:
AUMHA
Listing:
http://aumha.org/a/stop.php#0x26c
Knowledge
Base Articles:
KB 142676 How
to correct
common User32.dll file errors (2000, XP, Server 2003,
Vista)
KB 160495 Err
Msg: STOP:
C000026C Unable to Load Device Driver... (NT, 2000)
KB 315241 A
Stop:
0xc000026C or Stop: 0xc0000221 "Unable to Load Device Driver" Error
Occurs When You Start Windows XP
KB 830582 After
you
install the MS03-030 DirectX security update, your Windows 2000-based
computer stops responding
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0xC00002CB:
Security Accounts Manager initialization failed (go
to top of page)
Usual causes:
Knowledge
Base Articles:
KB 2642837
STOP:c00002cb Security Accounts Manager initialization failed (Server
2008 R2 in mixed environment w/Server 2003)
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0xC00002E2: Directory
Services could not start because of the following error: (go
to top of page)
Usual causes:
Knowledge
Base Articles:
KB 2737463
Domain controller does not start, c00002e2 error occurs, or "Choose an option"
is displayed (Server 2008/2008 R2/2012)
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0xC00002E3:
???STATUS_SAM_INIT_FAILURE??? (go
to top of page)
Usual causes:
I suspect encryption software or compatibility issues
Found in this topic:
http://www.sevenforums.com/crashes-debugging/240768-bsod-after-update-vga-driver.html
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:Unknown bugcheck code
(c00002e3)
Unknown bugcheck description
Arguments:
Arg1: 96286a60
Arg2: c0000189
Arg3: 00000000
Arg4: 00000000
Usual causes:
AUMHA
Listing:
Knowledge
Base Articles:
KB 829884
A "Stop error code
0xc0000415" occurs when you run Windows XP
WinDbg
Help File Entry:
WinDbg
Output Example:
STOP 0xDEADDEAD:
MANUALLY_INITIATED_CRASH1 (go
to top of page)
Usual causes:
MSDN Listing
(WDK):
http://msdn.microsoft.com/en-us/library/ff560300(v=VS.85).aspx
AUMHA
Listing:
http://aumha.org/a/stop.php#0xdead
Knowledge
Base Articles:
WinDbg
Help File Entry:
The
MANUALLY_INITIATED_CRASH1 bug check has a value of 0xDEADDEAD. This
indicates that the user deliberately initiated a crash dump from either
the kernel debugger or the keyboard.
Parameters
None
Comments
For details on
manually-initiated crash dumps, see Forcing
a System Crash.
WinDbg
Output Example:
MANUALLY_INITIATED_CRASH1
(deaddead)
The user manually initiated this crash dump.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
STOP 0xE0010002: (go
to top of page)
Usual causes:
nusb3xhc.sys (part of Renesas USB 3.0 driver) - most BSOD's point to
this driver, suspect that it's coded into the Renesas drivers
Found in this topic: http://www.sevenforums.com/crashes-debugging/169335-bsod-envy-15-2nd-gen-when-hibernating-resuming-hibernate.html
MSDN Listing
(WDK):
AUMHA
Listing:
Knowledge
Base Articles:
WinDbg
Help File Entry:
WinDbg
Output Example:
Unknown bugcheck code (e0010002)
Unknown bugcheck description
Arguments:
Arg1: fffffa8006841000
Arg2: 000000000000000c
Arg3: 0000000000000205
Arg4: 000000000000094e
STOP fvevol!FveFilterDeviceControl+1d0 :
(go
to top of page)
Usual causes:
Found in this topic (Win7):
http://www.sevenforums.com/crashes-debugging/166472-bsod-windows-7-a.html
MSDN Listing
(WDK):
AUMHA
Listing:
Knowledge
Base Articles:
KB 2632149
"fvevol!FveFilterDeviceControl+1d0"
Stop error when you create a VSS snapshot backup in Windows Server 2008 R2 SP1
KB 2708549
Stop error when you create a VSS
snapshot backup in Windows 7 SP1 or in Windows
Server 2008 R2 SP1:
"fvevol!FveFilterDeviceControl+1d0"
WinDbg
Help File Entry:
WinDbg
Output Example:
UNKNOWN STOP ERRORs:
(go
to top of page)
This section is for STOP error KB articles that don't identify a
particular STOP error
Knowledge
Base Articles:
KB 899419
You may receive a Stop
error message when you use the SCardControl function to transfer lots
of data to a USB smart card reader that is on a Windows Server 2003 Service Pack 1-based computer
The smart card reader is using the in-box USB Chip/Smart Card Interface
Devices (CCID) class driver (Usbccid.sys).
KB 933620
The operating system stops unexpectedly and you receive a Stop error
message after you start the Sony VAIO Camera Capture Utility on a Sony
VAIO UX Series Micro PC that is running Windows Vista
Error occurs in the USBCAMD_ProcessIsoIrps function.
KB 916157
When you receive a
Stop error message or a fatal system error message, a user-mode process
dump file is not created in Windows XP
KB 932755
An updated Storport
storage driver is available for Windows Server
2003
