RSS Feed Subscribe to the RSS feed
Originally Added to Website:  14 Sep 2009
Last Updated  (<— link shows ALL updates):

10 May 2018
- 14 new bugchecks for W10 - 16299:  0x17B; 0x18E; 0x1A3; 0x1A4; 0x1CC; 0x1CD; 0x1CE; 0x1CF; 0x1D0; 0x1D1; 0x1D2; 0x1D3; 0x1D4; 0x356
- 2 new bugchecks for W10 - 17134:  0x1A5; 0x1D5
I intend to add these to the table shortly - wich me luck! :0)

31 Aug 2017
Numbers changed when I reverified on 31 Aug 2018
- 4 new bugchecks for W10 - 10586:  0x13E; 0x18C; 0x195; 0x196
- 16 new bugchecks for W10 - 14393:  0x6F: 0x70; 0xF0, 0x173, 0x174, 0x17C, 0x17D, 0x197, 0x198, 0x199, 0x19A, 0x19B, 0x19C, 0x19D, 0x1C5, 0x357
- 13 new bugchecks for W10 - 15063:  0x179, 0x18D, 0x19E, 0x19F, 0x1A0, 0x1A1, 0x1A2, 0x1C6, 0x1C7, 0x1C8, 0x1C9, 0x1CA, 0x1CB

PAGE INFORMATION:
Initial document from the bugcodes.h file in the Windows 7 SDK v7.0;  Debugging Tools For Windows - dated 17 January 2009;  Additional information added as it became verifiable on the web.
-  Updated for Win8 on 09May2012 - added 20 bugchecks
-  Updated for Win8.1 on 01Oct2013 - added 23 bugchecks
-  Updated for Win10 (build 10240/TH1) on 22 Dec 2015 - added 70 bugchecks
-  Updated for Win10 (build 10586/TH2/1511) on 26 Dec 2015 - added 48ish bugchecks (numbers were changed from some of the Win10 (build 10240/TH1) bugchecks)
-  Updated for Win 10 (build 14393 and 15063) on 23 Aug 2017 - adding 27 new BSOD's and 3 changed BSOD's
Numbers changed when I reverified on 31 Aug 2018
- 4 new bugchecks for W10 - 10586:  0x13E; 0x18C; 0x195; 0x196
- 16 new bugchecks for W10 - 14393:  0x6F: 0x70; 0xF0, 0x173, 0x174, 0x17C, 0x17D, 0x197, 0x198, 0x199, 0x19A, 0x19B, 0x19C, 0x19D, 0x1C5, 0x357
- 13 new bugchecks for W10 - 15063:  0x179, 0x18D, 0x19E, 0x19F, 0x1A0, 0x1A1, 0x1A2, 0x1C6, 0x1C7, 0x1C8, 0x1C9, 0x1CA, 0x1CB

Some information on Windows NT/2000 links has been left out due to the enormous number of KB articles available.  
As of 02 April 2012, I have discontinued listing Windows 2000 articles.
As of 21 October 2014, Updates are now limited to adding new BSOD's. The sheer number of new BSOD KB articles is too daunting to keep up with..

At last count (23 August 2017) there were more than 554 different STOP error messages in this listing.  
Copyright
registered 15 Oct 2009

Take me straight to the BSOD listing (abbreviated to make looking it up easier)...
Take me to the long Table of Contents listing...

Take me to the General Information about BSOD's section...
Take me to the Specific STOP message troubleshooting section...
Take me to the General STOP message troubleshooting section...

Please notify me if you find anything wrong, missing, new, or just have a comment.
I post as usasma at Bleeping Computer (preferred method of contact)
If referring to a specific STOP error message, please attach/upload the Minidump files (from C:\Windows\Minidump) with your comments.


GENERAL INFORMATION ABOUT BSOD's:

Additional content below. Click on the Spoiler (Show/Hide) tag below to show it.



Specific STOP message troubleshooting:

Additional content below. Click on the Spoiler (Show/Hide) tag below to show it.



General STOP message troubleshooting:

Additional content below. Click on the Spoiler (Show/Hide) tag below to show it.



Misc Tools/Information:

Additional content below. Click on the Spoiler (Show/Hide) tag below to show it.



THE BSOD LISTING:
You can find your error message by searching the page for the STOP Error number ( 0x00000000: ) or the SYMBOLIC_NAME
Or, you can use the links below...
The Table of Contents Links will take you to the actual (long) Table of Contents.
The actual Table of Contents contains links to the entry for that particular error (approx 349 entries).


Table of Contents Links:    (go to top of page)
Example Entry

STOP -1073741502

STOP 0x00000001 - STOP 0x0000000F
STOP 0x00000010 - STOP 0x0000001F
STOP 0x00000020 - STOP 0x0000002F
STOP 0x00000030 - STOP 0x0000003F
STOP 0x00000040 - STOP 0x0000004F
STOP 0x00000050 - STOP 0x0000005F
STOP 0x00000060 - STOP 0x0000006F
STOP 0x00000070 - STOP 0x0000007F
STOP 0x00000080 - STOP 0x0000008F
STOP 0x00000090 - STOP 0x0000009F
STOP 0x000000A0 - STOP 0x000000AF
STOP 0x000000B0 - STOP 0x000000BF
STOP 0x000000C0 - STOP 0x000000CF
STOP 0x000000D0 - STOP 0x000000DF
STOP 0x000000E0 - STOP 0x000000EF
STOP 0x000000F0 - STOP 0x000000FF

STOP 0x000000MN

STOP 0x00000100 - STOP 0x0000010F
STOP 0x00000110 - STOP 0x0000011F
STOP 0x00000120 - STOP 0x0000012F
STOP 0x00000130 - STOP 0x0000013F
STOP 0x00000140 - STOP 0x0000014F
STOP 0x00000150 - STOP 0x0000015F
STOP 0x00000160 - STOP 0x0000016F
STOP 0x00000170 - STOP 0x0000017F
STOP 0x00000180 - STOP 0x0000018F
STOP 0x00000190 - STOP 0x0000019F

STOP 0x000001A0 - STOP 0x000001AF
STOP 0x000001C0 - STOP 0x000001CF

STOP 0x00000300 - STOP 0x000003FF
STOP 0x00000400 - STOP 0x000004FF
STOP 0x00000BFE - STOP 0x00000BFF

STOP 0x00008866

STOP 0x0000C1F5

STOP 0x0000F000 - STOP 0x0000F900

STOP 0x00020001

STOP 0x1000000a - STOP 0x100000EA

STOP 0x1000F000 - STOP 0x1000F900

STOP 0x4000007E - STOP 0x40010003

STOP 0x66888866

STOP 0x70860002

STOP 0x80000000 - STOP 0x80080005

STOP 0x8086

STOP 0x9087 - STOP 0x9088

STOP 0xA0000001

STOP 0xBADB0D00

STOP 0xC0000005 - STOP 0xC0000415

STOP 0xDEADDEAD

STOP 0xE0010002

STOP fvevol!FveFilterDeviceControl+1d0

Unknown STOP errors

Table Of Contents    (go to top of page)
  1. Example Entry:
  2. STOP -1073741502
  3. STOP 0x00000001: APC_INDEX_MISMATCH
  4. STOP 0x00000002: DEVICE_QUEUE_NOT_BUSY
  5. STOP 0x00000003: INVALID_AFFINITY_SET
  6. STOP 0x00000004: INVALID_DATA_ACCESS_TRAP
  7. STOP 0x00000005: INVALID_PROCESS_ATTACH_ATTEMPT
  8. STOP 0x00000006: INVALID_PROCESS_DETACH_ATTEMPT
  9. STOP 0x00000007: INVALID_SOFTWARE_INTERRUPT
  10. STOP 0x00000008: IRQL_NOT_DISPATCH_LEVEL
  11. STOP 0x00000009: IRQL_NOT_GREATER_OR_EQUAL
  12. STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL
  13. STOP 0x0000000B: NO_EXCEPTION_HANDLING_SUPPORT
  14. STOP 0x0000000C: MAXIMUM_WAIT_OBJECTS_EXCEEDED
  15. STOP 0x0000000D: MUTEX_LEVEL_NUMBER_VIOLATION
  16. STOP 0x0000000E: NO_USER_MODE_CONTEXT
  17. STOP 0x0000000F: SPIN_LOCK_ALREADY_OWNED
  18. STOP 0x00000010: SPIN_LOCK_NOT_OWNED
  19. STOP 0x00000011: THREAD_NOT_MUTEX_OWNER
  20. STOP 0x00000012: TRAP_CAUSE_UNKNOWN
  21. STOP 0x00000013: EMPTY_THREAD_REAPER_LIST
  22. STOP 0x00000014: CREATE_DELETE_LOCK_NOT_LOCKED
  23. STOP 0x00000015: LAST_CHANCE_CALLED_FROM_KMODE
  24. STOP 0x00000016: CID_HANDLE_CREATION
  25. STOP 0x00000017: CID_HANDLE_DELETION
  26. STOP 0x00000018: REFERENCE_BY_POINTER
  27. STOP 0x00000019: BAD_POOL_HEADER
  28. STOP 0x0000001A: MEMORY_MANAGEMENT
  29. STOP 0x0000001B: PFN_SHARE_COUNT
  30. STOP 0x0000001C: PFN_REFERENCE_COUNT
  31. STOP 0x0000001D: NO_SPIN_LOCK_AVAILABLE
  32. STOP 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED
  33. STOP 0x0000001F: SHARED_RESOURCE_CONV_ERROR
  34. STOP 0x00000020: KERNEL_APC_PENDING_DURING_EXIT
  35. STOP 0x00000021: QUOTA_UNDERFLOW
  36. STOP 0x00000022: FILE_SYSTEM
  37. STOP 0x00000023: FAT_FILE_SYSTEM
  38. STOP 0x00000024: NTFS_FILE_SYSTEM
  39. STOP 0x00000025: NPFS_FILE_SYSTEM
  40. STOP 0x00000026: CDFS_FILE_SYSTEM
  41. STOP 0x00000027: RDR_FILE_SYSTEM
  42. STOP 0x00000028: CORRUPT_ACCESS_TOKEN
  43. STOP 0x00000029: SECURITY_SYSTEM
  44. STOP 0x0000002A: INCONSISTENT_IRP
  45. STOP 0x0000002B: PANIC_STACK_SWITCH
  46. STOP 0x0000002C: PORT_DRIVER_INTERNAL
  47. STOP 0x0000002D: SCSI_DISK_DRIVER_INTERNAL
  48. STOP 0x0000002E: DATA_BUS_ERROR
  49. STOP 0x0000002F: INSTRUCTION_BUS_ERROR
  50. STOP 0x00000030: SET_OF_INVALID_CONTEXT
  51. STOP 0x00000031: PHASE0_INITIALIZATION_FAILED
  52. STOP 0x00000032: PHASE1_INITIALIZATION_FAILED
  53. STOP 0x00000033: UNEXPECTED_INITIALIZATION_CALL
  54. STOP 0x00000034: CACHE_MANAGER
  55. STOP 0x00000035: NO_MORE_IRP_STACK_LOCATIONS
  56. STOP 0x00000036: DEVICE_REFERENCE_COUNT_NOT_ZERO
  57. STOP 0x00000037: FLOPPY_INTERNAL_ERROR
  58. STOP 0x00000038: SERIAL_DRIVER_INTERNAL
  59. STOP 0x00000039: SYSTEM_EXIT_OWNED_MUTEX
  60. STOP 0x0000003A: SYSTEM_UNWIND_PREVIOUS_USER
  61. STOP 0x0000003B: SYSTEM_SERVICE_EXCEPTION
  62. STOP 0x0000003C: INTERRUPT_UNWIND_ATTEMPTED
  63. STOP 0x0000003D: INTERRUPT_EXCEPTION_NOT_HANDLED
  64. STOP 0x0000003E: MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED
  65. STOP 0x0000003F: NO_MORE_SYSTEM_PTES
  66. STOP 0x00000040: TARGET_MDL_TOO_SMALL
  67. STOP 0x00000041: MUST_SUCCEED_POOL_EMPTY
  68. STOP 0x00000042: ATDISK_DRIVER_INTERNAL
  69. STOP 0x00000043: NO_SUCH_PARTITION
  70. STOP 0x00000044: MULTIPLE_IRP_COMPLETE_REQUESTS
  71. STOP 0x00000045: INSUFFICIENT_SYSTEM_MAP_REGS
  72. STOP 0x00000046: DEREF_UNKNOWN_LOGON_SESSION
  73. STOP 0x00000047: REF_UNKNOWN_LOGON_SESSION
  74. STOP 0x00000048: CANCEL_STATE_IN_COMPLETED_IRP
  75. STOP 0x00000049: PAGE_FAULT_WITH_INTERRUPTS_OFF
  76. STOP 0x0000004A: IRQL_GT_ZERO_AT_SYSTEM_SERVICE
  77. STOP 0x0000004B: STREAMS_INTERNAL_ERROR
  78. STOP 0x0000004C: FATAL_UNHANDLED_HARD_ERROR
  79. STOP 0x0000004D: NO_PAGES_AVAILABLE
  80. STOP 0x0000004E: PFN_LIST_CORRUPT
  81. STOP 0x0000004F: NDIS_INTERNAL_ERROR
  82. STOP 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA
  83. STOP 0x00000051: REGISTRY_ERROR
  84. STOP 0x00000052: MAILSLOT_FILE_SYSTEM
  85. STOP 0x00000053: NO_BOOT_DEVICE
  86. STOP 0x00000054: LM_SERVER_INTERNAL_ERROR
  87. STOP 0x00000055: DATA_COHERENCY_EXCEPTION
  88. STOP 0x00000056: INSTRUCTION_COHERENCY_EXCEPTION
  89. STOP 0x00000057: XNS_INTERNAL_ERROR
  90. STOP 0x00000058: FTDISK_INTERNAL_ERROR
  91. STOP 0x00000059: PINBALL_FILE_SYSTEM
  92. STOP 0x0000005A: CRITICAL_SERVICE_FAILED
  93. STOP 0x0000005B: SET_ENV_VAR_FAILED
  94. STOP 0x0000005C: HAL_INITIALIZATION_FAILED
  95. STOP 0x0000005D: UNSUPPORTED_PROCESSOR
  96. STOP 0x0000005E: OBJECT_INITIALIZATION_FAILED
  97. STOP 0x0000005F: SECURITY_INITIALIZATION_FAILED
  98. STOP 0x00000060: PROCESS_INITIALIZATION_FAILED
  99. STOP 0x00000061: HAL1_INITIALIZATION_FAILED
  100. STOP 0x00000062: OBJECT1_INITIALIZATION_FAILED
  101. STOP 0x00000063: SECURITY1_INITIALIZATION_FAILED
  102. STOP 0x00000064: SYMBOLIC_INITIALIZATION_FAILED
  103. STOP 0x00000065: MEMORY1_INITIALIZATION_FAILED
  104. STOP 0x00000066: CACHE_INITIALIZATION_FAILED
  105. STOP 0x00000067: CONFIG_INITIALIZATION_FAILED
  106. STOP 0x00000068: FILE_INITIALIZATION_FAILED
  107. STOP 0x00000069: IO1_INITIALIZATION_FAILED
  108. STOP 0x0000006A: LPC_INITIALIZATION_FAILED
  109. STOP 0x0000006B: PROCESS1_INITIALIZATION_FAILED
  110. STOP 0x0000006C: REFMON_INITIALIZATION_FAILED
  111. STOP 0x0000006D: SESSION1_INITIALIZATION_FAILED
  112. STOP 0x0000006E: SESSION2_INITIALIZATION_FAILED
  113. STOP 0x0000006F: SESSION3_INITIALIZATION_FAILED/VSL_INITIALIZATION_FAILED (W10 - 14393)
  114. STOP 0x00000070: SESSION4_INITIALIZATION_FAILED/SOFT_RESTART_FATAL_ERROR (W10 - 14393)
  115. STOP 0x00000071: SESSION5_INITIALIZATION_FAILED
  116. STOP 0x00000072: ASSIGN_DRIVE_LETTERS_FAILED
  117. STOP 0x00000073: CONFIG_LIST_FAILED
  118. STOP 0x00000074: BAD_SYSTEM_CONFIG_INFO
  119. STOP 0x00000075: CANNOT_WRITE_CONFIGURATION
  120. STOP 0x00000076: PROCESS_HAS_LOCKED_PAGES
  121. STOP 0x00000077: KERNEL_STACK_INPAGE_ERROR
  122. STOP 0x00000078: PHASE0_EXCEPTION
  123. STOP 0x00000079: MISMATCHED_HAL
  124. STOP 0x0000007A: KERNEL_DATA_INPAGE_ERROR
  125. STOP 0x0000007B: INACCESSIBLE_BOOT_DEVICE
  126. STOP 0x0000007C: BUGCODE_NDIS_DRIVER
  127. STOP 0x0000007D: INSTALL_MORE_MEMORY
  128. STOP 0x0000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
  129. STOP 0x0000007F: UNEXPECTED_KERNEL_MODE_TRAP
  130. STOP 0x00000080: NMI_HARDWARE_FAILURE
  131. STOP 0x00000081: SPIN_LOCK_INIT_FAILURE
  132. STOP 0x00000082: DFS_FILE_SYSTEM
  133. STOP 0x00000083: OFS_FILE_SYSTEM
  134. STOP 0x00000084: RECOM_DRIVER
  135. STOP 0x00000085: SETUP_FAILURE
  136. STOP 0x00000086: AUDIT_FAILURE
  137. STOP 0x00000087:
  138. STOP 0x00000088:
  139. STOP 0x00000089:
  140. STOP 0x0000008A:
  141. STOP 0x0000008B: MBR_CHECKSUM_MISMATCH
  142. STOP 0x0000008C:
  143. STOP 0x0000008D:
  144. STOP 0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED
  145. STOP 0x0000008F: PP0_INITIALIZATION_FAILED
  146. STOP 0x00000090: PP1_INITIALIZATION_FAILED
  147. STOP 0x00000091: WIN32K_INIT_OR_RIT_FAILURE
  148. STOP 0x00000092: UP_DRIVER_ON_MP_SYSTEM
  149. STOP 0x00000093: INVALID_KERNEL_HANDLE
  150. STOP 0x00000094: KERNEL_STACK_LOCKED_AT_EXIT
  151. STOP 0x00000095: PNP_INTERNAL_ERROR
  152. STOP 0x00000096: INVALID_WORK_QUEUE_ITEM
  153. STOP 0x00000097: BOUND_IMAGE_UNSUPPORTED
  154. STOP 0x00000098: END_OF_NT_EVALUATION_PERIOD
  155. STOP 0x00000099: INVALID_REGION_OR_SEGMENT
  156. STOP 0x0000009A: SYSTEM_LICENSE_VIOLATION
  157. STOP 0x0000009B: UDFS_FILE_SYSTEM
  158. STOP 0x0000009C: MACHINE_CHECK_EXCEPTION
  159. STOP 0x0000009D:
  160. STOP 0x0000009E: USER_MODE_HEALTH_MONITOR
  161. STOP 0x0000009F: DRIVER_POWER_STATE_FAILURE
  162. STOP 0x000000A0: INTERNAL_POWER_ERROR
  163. STOP 0x000000A1: PCI_BUS_DRIVER_INTERNAL
  164. STOP 0x000000A2: MEMORY_IMAGE_CORRUPT
  165. STOP 0x000000A3: ACPI_DRIVER_INTERNAL
  166. STOP 0x000000A4: CNSS_FILE_SYSTEM_FILTER
  167. STOP 0x000000A5: ACPI_BIOS_ERROR
  168. STOP 0x000000A6: FP_EMULATION_ERROR
  169. STOP 0x000000A7: BAD_EXHANDLE
  170. STOP 0x000000A8: BOOTING_IN_SAFEMODE_MINIMAL
  171. STOP 0x000000A9" BOOTING_IN_SAFEMODE_NETWORK
  172. STOP 0x000000AA: BOOTING_IN_SAFEMODE_DSREPAIR
  173. STOP 0x000000AB: SESSION_HAS_VALID_POOL_ON_EXIT
  174. STOP 0x000000AC: HAL_MEMORY_ALLOCATION
  175. STOP 0x000000AD: VIDEO_DRIVER_DEBUG_REPORT_REQUEST
  176. STOP 0x000000AE:
  177. STOP 0x000000AF:
  178. STOP 0x000000B0:
  179. STOP 0x000000B1: BGI_DETECTED_VIOLATION
  180. STOP 0x000000B2:
  181. STOP 0x000000B3:
  182. STOP 0x000000B4: VIDEO_DRIVER_INIT_FAILURE
  183. STOP 0x000000B5: BOOTLOG_LOADED
  184. STOP 0x000000B6: BOOTLOG_NOT_LOADED
  185. STOP 0x000000B7: BOOTLOG_ENABLED
  186. STOP 0x000000B8: ATTEMPTED_SWITCH_FROM_DPC
  187. STOP 0x000000B9: CHIPSET_DETECTED_ERROR
  188. STOP 0x000000BA: SESSION_HAS_VALID_VIEWS_ON_EXIT
  189. STOP 0x000000BB: NETWORK_BOOT_INITIALIZATION_FAILED
  190. STOP 0x000000BC: NETWORK_BOOT_DUPLICATE_ADDRESS
  191. STOP 0x000000BD: INVALID_HIBERNATED STATE
  192. STOP 0x000000BE: ATTEMPTED_WRITE_TO_READONLY_MEMORY
  193. STOP 0x000000BF: MUTEX_ALREADY_OWNED
  194. STOP 0x000000C0: PCI_CONFIT_SPACE_ACCESS_FAILURE
  195. STOP 0x000000C1: SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION
  196. STOP 0x000000C2: BAD_POOL_CALLER
  197. STOP 0x000000C3: BUGCODE_PSS_MESSAGE_SIGNATURE
  198. STOP 0x000000C4: DRIVER_VERIFIER_DETECTED_VIOLATION
  199. STOP 0x000000C5: DRIVER_CORRUPTED_EXPOOL
  200. STOP 0x000000C6: DRIVER_CAUGHT_MODIFYING_FREED_POOL
  201. STOP 0x000000C7: TIMER_OR_DPC_INVALID
  202. STOP 0x000000C8: IRQL_UNEXPECTED_VALUE
  203. STOP 0x000000C9: DRIVER_VERIFIER_IOMANAGER_VIOLATION
  204. STOP 0x000000CA: PNP_DETECTED_FATAL_ERROR
  205. STOP 0x000000CB: DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS
  206. STOP 0x000000CC: PAGE_FAULT_IN_FREED_SPECIAL_POOL
  207. STOP 0x000000CD: PAGE_FAULT_BEYOND_END_OF_ALLOCATION
  208. STOP 0x000000CE: DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS
  209. STOP 0x000000CF: TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE
  210. STOP 0x000000D0: DRIVER_CORRUPTED_MMPOOL
  211. STOP 0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
  212. STOP 0x000000D2: BUGCODE_ID_DRIVER
  213. STOP 0x000000D3: DRIVER_PORTION_MUST_BE_NONPAGED
  214. STOP 0x000000D4: SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD
  215. STOP 0x000000D5: DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL
  216. STOP 0x000000D6: DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION
  217. STOP 0x000000D7: DRIVER_UNMAPPING_INVALID_VIEW
  218. STOP 0x000000D8: DRIVER_USED_EXCESSIVE_PTES
  219. STOP 0x000000D9: LOCKED_PAGES_TRACKER_CORRUPTION
  220. STOP 0x000000DA: SYSTEM_PTE_MISUSE
  221. STOP 0x000000DB: DRIVER_CORRUPTED_SYSPTES
  222. STOP 0x000000DC: DRIVER_INVALID_STACK_ACCESS
  223. STOP 0x000000DD: ???BIOS IS NOT ACPI COMPLIANT???
  224. STOP 0x000000DE: POOL_CORRUPTION_IN_FILE_AREA
  225. STOP 0x000000DF: IMPERSONATING_WORKER_THREAD
  226. STOP 0x000000E0: ACPI_BIOS_FATAL_ERROR
  227. STOP 0x000000E1: WORKER_THREAD_RETURNED_AT_BAD_IRQL
  228. STOP 0x000000E2: MANUALLY_INITIATED_CRASH
  229. STOP 0x000000E3: RESOURCE_NOT_OWNED
  230. STOP 0x000000E4: WORKER_INVALID
  231. STOP 0x000000E5: POWER_FAILURE_SIMULATE
  232. STOP 0x000000E6: DRIVER_VERIFIER_DMA_VIOLATION
  233. STOP 0x000000E7: INVALID_FLOATING_POINT_STATE
  234. STOP 0x000000E8: INVALID_CANCEL_OF_FILE_OPEN
  235. STOP 0x000000E9: ACTIVE_EX_WORKER_THREAD_TERMINATION
  236. STOP 0x000000EA: THREAD_STUCK_IN_DEVICE_DRIVER
  237. STOP 0x000000EB: DIRTY_MAPPED_PAGES_CONGESTION
  238. STOP 0x000000EC: SESSION_HAS_VALID_SPECIAL_POOL_ON_EXIT
  239. STOP 0x000000ED: UNMOUNTABLE_BOOT_VOLUME
  240. STOP 0x000000EE:
  241. STOP 0x000000EF: CRITICAL_PROCESS_DIED
  242. STOP 0x000000F0: STORAGE_MINIPORT_ERROR (W10 - 14393)
  243. STOP 0x000000F1: SCSI_VERIFIER_DETECTED_VIOLATION
  244. STOP 0x000000F2: HARDWARE_INTERRUPT_STORM
  245. STOP 0x000000F3: DISORDERLY_SHUTDOWN
  246. STOP 0x000000F4: CRITICAL_OBJECT_TERMINATION
  247. STOP 0x000000F5: FLTMGR_FILE_SYSTEM
  248. STOP 0x000000F6: PCI_VERIFIER_DETECTED_VIOLATION
  249. STOP 0x000000F7: DRIVER_OVERRAN_STACK_BUFFER
  250. STOP 0x000000F8: RAMDISK_BOOT_INITIALIZATION_FAILED
  251. STOP 0x000000F9: DRIVER_RETURNED_STATUS_REPARSE_FOR_VOLUME_OPEN
  252. STOP 0x000000FA: HTTP_DRIVER_CORRUPTED
  253. STOP 0x000000FB: RECURSIVE_MACHINE_CHECK
  254. STOP 0x000000FC: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
  255. STOP 0x000000FD: DIRTY_NOWRITE_PAGES_CONGESTION
  256. STOP 0x000000FE: BUGCODE_USB_DRIVER
  257. STOP 0x000000FF: RESERVE_QUEUE_OVERFLOW
  258. STOP 0x000000MN:
  259. STOP 0x00000100: LOADER_BLOCK_MISMATCH
  260. STOP 0x00000101: CLOCK_WATCHDOG_TIMEOUT
  261. STOP 0x00000102: DPC_WATCHDOG_TIMEOUT
  262. STOP 0x00000103: MUP_FILE_SYSTEM
  263. STOP 0x00000104: AGP_INVALID_ACCESS
  264. STOP 0x00000105: AGP_GART_CORRUPTION
  265. STOP 0x00000106: AGP_ILLEGALLY_REPROGRAMMED
  266. STOP 0x00000107: KERNEL_EXPAND_STACK_ACTIVE
  267. STOP 0x00000108: THIRD_PARTY_FILE_SYSTEM_FAILURE
  268. STOP 0x00000109: CRITICAL_STRUCTURE_CORRUPTION
  269. STOP 0x0000010A: APP_TAGGING_INITIALIZATION_FAILED
  270. STOP 0x0000010B: DFSC_FILE_SYSTEM
  271. STOP 0x0000010C: FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION
  272. STOP 0x0000010D: WDF_VIOLATION
  273. STOP 0x0000010E: VIDEO_MEMORY_MANAGEMENT_INTERNAL
  274. STOP 0x0000010F: RESOURCE_MANAGER_EXCEPTION_NOT_HANDLED
  275. STOP 0x00000110: DRIVER_INVALID_CRUNTIME_PARAMETER
  276. STOP 0x00000111: RECURSIVE_NMI
  277. STOP 0x00000112: MSRPC_STATE_VIOLATION
  278. STOP 0x00000113: VIDEO_DXGKRNL_FATAL_ERROR
  279. STOP 0x00000114: VIDEO_SHADOW_DRIVER_FATAL_ERROR
  280. STOP 0x00000115: AGP_INTERNAL
  281. STOP 0x00000116: VIDEO_TDR_ERROR
  282. STOP 0x00000117: VIDEO_TDR_TIMEOUT_DETECTED
  283. STOP 0x00000118: NTHV_GUEST_ERROR
  284. STOP 0x00000119: VIDEO_SCHEDULER_INTERNAL_ERROR
  285. STOP 0x0000011A: EM_INITIALIZATION_FAILURE
  286. STOP 0x0000011B: DRIVER_RETURNED_HOLDING_CANCEL_LOCK
  287. STOP 0x0000011C: ATTEMPTED_WRITE_TO_CM_PROTECTED_STORAGE
  288. STOP 0x0000011D: EVENT_TRACING_FATAL_ERROR
  289. STOP 0x0000011E: TOO_MANY_RECURSIVE_FAULTS
  290. STOP 0x0000011F: INVALID_DRIVER_HANDLE
  291. STOP 0x00000120: BITLOCKER_FATAL_ERROR
  292. STOP 0x00000121: DRIVER_VIOLATION
  293. STOP 0x00000122: WHEA_INTERNAL_ERROR
  294. STOP 0x00000123: CRYPTO_SELF_TEST_FAILURE
  295. STOP 0x00000124: WHEA_UNCORRECTABLE_ERROR
  296. STOP 0x00000125: NMR_INVALID_STATE
  297. STOP 0x00000126: NETIO_INVALID_POOL_CALLER
  298. STOP 0x00000127: PAGE_NOT_ZERO
  299. STOP 0x00000128: WORKER_THREAD_RETURNED_WITH_BAD_IO_PRIORITY
  300. STOP 0x00000129: WORKER_THREAD_RETURNED_WITH_BAD_PAGING_IO_PRIORITY
  301. STOP 0x0000012A: MUI_NO_VALID_SYSTEM_LANGUAGE
  302. STOP 0x0000012B: FAULTY_HARDWARE_CORRUPTED_PAGE
  303. STOP 0x0000012C: EXFAT_FILE_SYSTEM
  304. STOP 0x0000012D: VOLSNAP_OVERLAPPED_TABLE_ACCESS
  305. STOP 0x0000012E: INVALID_MDL_RANGE
  306. STOP 0x0000012F: VHD_BOOT_INITIALIZATION_FAILED
  307. STOP 0x00000130: DYNAMIC_ADD_PROCESSOR_MISMATCH
  308. STOP 0x00000131: INVALID_EXTENDED_PROCESSOR_STATE
  309. STOP 0x00000132: RESOURCE_OWNER_POINTER_INVALID
  310. STOP 0x00000133: DPC_WATCHDOG_VIOLATION
  311. STOP 0x00000134: DRIVE_EXTENDER
  312. STOP 0x00000135: REGISTRY_FILTER_DRIVER_EXCEPTION
  313. STOP 0x00000136: VHD_BOOT_HOST_VOLUME_NOT_ENOUGH_SPA
  314. STOP 0x00000137: WIN32K_HANDLE_MANAGER
  315. STOP 0x00000138: GPIO_CONTROLLER_DRIVER_ERROR
  316. STOP 0x00000139: KERNEL_SECURITY_CHECK_FAILURE
  317. STOP 0x0000013A: KERNEL_MODE_HEAP_CORRUPTION
  318. STOP 0x0000013B: PASSIVE_INTERRUPT_ERROR
  319. STOP 0x0000013C: INVALID_IO_BOOST_STATE
  320. STOP 0x0000013D: CRITICAL_INITIALIZATION_FAILURE
  321. STOP 0x0000013E: ERRATA_WORKAROUND_UNSUCCESSFUL (W10 - 10586)
  322. STOP 0x0000013F:
  323. STOP 0x00000140: STORAGE_DEVICE_ABNORMALITY_DETECTED
  324. STOP 0x00000141: VIDEO_ENGINE_TIMEOUT_DETECTED
  325. STOP 0x00000142: VIDEO_TDR_APPLICATION_BLOCKED
  326. STOP 0x00000143: PROCESSOR_DRIVER_INTERNAL
  327. STOP 0x00000144: BUGCODE_USB3_DRIVER
  328. STOP 0x00000145: SECURE_BOOT_VIOLATION
  329. STOP 0x00000146: NDIS_NET_BUFFER_LIST_INFO_ILLEGALLY_TRANSFERRED
  330. STOP 0x00000147: ABNORMAL_RESET_DETECTED
  331. STOP 0x00000148: IO_OBJECT_INVALID
  332. STOP 0x00000149: REFS_FILE_SYSTEM
  333. STOP 0x0000014A: KERNEL_WMI_INTERNAL
  334. STOP 0x0000014B: SOC_SUBSYSTEM_FAILURE
  335. STOP 0x0000014C: FATAL_ABNORMAL_RESET_ERROR
  336. STOP 0x0000014D: EXCEPTION_SCOPE_INVALID
  337. STOP 0x0000014E: SOC_CRITICAL_DEVICE_REMOVED
  338. STOP 0x0000014F: PDC_WATCHDOG_TIMEOUT
  339. STOP 0x00000150: TCPIP_AOAC_NIC_ACTIVE_REFERENCE_LEAK
  340. STOP 0x00000151: UNSUPPORTED_INSTRUCTION_MODE
  341. STOP 0x00000152: INVALID_PUSH_LOCK_FLAGS
  342. STOP 0x00000153: KERNEL_LOCK_ENTRY_LEAKED_ON_THREAD_TERMINATION
  343. STOP 0x00000154: UNEXPECTED_STORE_EXCEPTION
  344. STOP 0x00000155: OS_DATA_TAMPERING
  345. STOP 0x00000156: WINSOCK_DETECTED_HUNG_CLOSESOCKET_LIVEDUMP
  346. STOP 0x00000157: KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION
  347. STOP 0x00000158: ILLEGAL_IOMMU_PAGE_FAULT
  348. STOP 0x00000159: HAL_ILLEGAL_IOMMU_PAGE_FAULT
  349. STOP 0x0000015A: SDBUS_INTERNAL_ERROR
  350. STOP 0x0000015B: WORKER_THREAD_RETURNED_WITH_SYSTEM_PAGE_PRIORITY_ACTIVE
  351. STOP 0x0000015C: PDC_WATCHDOG_TIMEOUT_LIVEDUMP
  352. STOP 0x0000015D: SOC_SUBSYSTEM_FAILURE_LIVEDUMP
  353. STOP 0x0000015E: BUGCODE_NDIS_DRIVER_LIVE_DUMP
  354. STOP 0x0000015F: CONNECTED_STANDBY_WATCHDOG_TIMEOUT_LIVEDUMP
  355. STOP 0x00000160: WIN32K_ATOMIC_CHECK_FAILURE
  356. STOP 0x00000161: LIVE_SYSTEM_DUMP
  357. STOP 0x00000162: KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE
  358. STOP 0x00000163: WORKER_THREAD_TEST_CONDITION (W10 - 10240)
  359. STOP 0x00000164: WIN32K_CRITICAL_FAILURE (W10 - 10240)
  360. STOP 0x00000165: CLUSTER_CSV_STATUS_IO_TIMEOUT_LIVEDUMP (W10 - 10240)
  361. STOP 0x00000166: CLUSTER_RESOURCE_CALL_TIMEOUT_LIVEDUMP (W10 - 10240)
  362. STOP 0x00000167: CLUSTER_CSV_SNAPSHOT_DEVICE_INFO_TIMEOUT_LIVEDUMP (W10 - 10240)
  363. STOP 0x00000168: CLUSTER_CSV_STATE_TRANSITION_TIMEOUT_LIVEDUMP (W10 - 10240)
  364. STOP 0x00000169: CLUSTER_CSV_VOLUME_ARRIVAL_LIVEDUMP (W10 - 10240)
  365. STOP 0x0000016A: CLUSTER_CSV_VOLUME_REMOVAL_LIVEDUMP (W10 - 10240)
  366. STOP 0x0000016B: CLUSTER_CSV_CLUSTER_WATCHDOG_LIVEDUMP (W10 - 10240)
  367. STOP 0x0000016C: INVALID_RUNDOWN_PROTECTION_FLAGS (W10 - 10240)
  368. STOP 0x0000016D: INVALID_SLOT_ALLOCATOR_FLAGS (W10 - 10240)
  369. STOP 0x0000016E: ERESOURCE_INVALID_RELEASE (W10 - 10240)
  370. STOP 0x0000016F: CLUSTER_CSV_STATE_TRANSITION_INTERVAL_TIMEOUT_LIVEDUMP (W10 - 10240)
  371. STOP 0x00000170: CLUSTER_CSV_CLUSSVC_DISCONNECT_WATCHDOG (W10 - 10240)
  372. STOP 0x00000171: CRYPTO_LIBRARY_INTERNAL_ERROR (W10 - 10240)
  373. STOP 0x00000173: COREMSGCALL_INTERNAL_ERROR (W10 - 14393)
  374. STOP 0x00000174: COREMSG_INTERNAL_ERROR (W10 - 14393)
  375. STOP 0x00000175: PREVIOUS_FATAL_ABNORMAL_RESET_ERROR (W10 - 10240)
  376. STOP 0x00000178: ELAM_DRIVER_DETECTED_FATAL_ERROR (W10 - 10240)
  377. STOP 0x00000179: CLUSTER_CLUSPORT_STATUS_IO_TIMEOUT_LIVEDUMP (W10 - 15063)
  378. STOP 0x0000017C: PDC_LOCK_WATCHDOG_LIVEDUMP (W10 - 14393)
  379. STOP 0x0000017D: PDC_UNEXPECTED_REVOCATION_LIVEDUMP (W10 - 14393)
  380. STOP 0x00000180: WVR_LIVEDUMP_REPLICATION_IOCONTEXT_TIMEOUT (W10 - 10240)
  381. STOP 0x00000181: WVR_LIVEDUMP_STATE_TRANSITION_TIMEOUT (W10 - 10240)
  382. STOP 0x00000182: WVR_LIVEDUMP_RECOVERY_IOCONTEXT_TIMEOUT (W10 - 10240)
  383. STOP 0x00000183: WVR_LIVEDUMP_APP_IO_TIMEOUT (W10 - 10240)
  384. STOP 0x00000184: WVR_LIVEDUMP_MANUALLY_INITIATED (W10 - 10240)
  385. STOP 0x00000185: WVR_LIVEDUMP_STATE_FAILURE (W10 - 10240)
  386. STOP 0x00000186: WVR_LIVEDUMP_CRITICAL_ERROR (W10 - 10240)
  387. STOP 0x00000187: VIDEO_DWMINIT_TIMEOUT_FALLBACK_BDD (W10 - 10240)
  388. STOP 0x00000188: CLUSTER_CSVFS_LIVEDUMP (W10 - 10240)
  389. STOP 0x00000189: BAD_OBJECT_HEADER (W10 - 10240)
  390. STOP 0x0000018A: SILO_CORRUPT
  391. STOP 0x0000018B: SECURE_KERNEL_ERROR (W10 - 10240)
  392. STOP 0x0000018C: HYPERGUARD_VIOLATION (W10 - 10586)
  393. STOP 0x0000018D: SECURE_FAULT_UNHANDLED (W10 - 15063)
  394. STOP 0x00000190: WIN32K_CRITICAL_FAILURE_LIVEDUMP (W10 - 10240)
  395. STOP 0x00000191: PF_DETECTED_CORRUPTION (W10 - 10240)
  396. STOP 0x00000192: KERNEL_AUTO_BOOST_LOCK_ACQUISITION_WITH_RAISED_IRQL (W10 - 10240)
  397. STOP 0x00000193: VIDEO_DXGKRNL_LIVEDUMP (W10 - 10240)
  398. STOP 0x00000194: SAVER_NONRESPONSIVEPROCESS
  399. STOP 0x00000195: SMB_SERVER_LIVEDUMP (W10 - 10586)
  400. STOP 0x00000196: SAVER_MTBFCOMMANDTIMEOUT/LOADER_ROLLBACK_DETECTED (W10 - 10586)
  401. STOP 0x00000197: WIN32K_SECURITY_FAILURE (W10 - 14393)
  402. STOP 0x00000198: UFX_LIVEDUMP (W10 - 14393)
  403. STOP 0x00000199: KERNEL_STORAGE_SLOT_IN_USE (W10 - 14393)
  404. STOP 0x0000019A: WORKER_THREAD_RETURNED_WHILE_ATTACHED_TO_SILO (W10 - 14393)
  405. STOP 0x0000019B: TTM_FATAL_ERROR (W10 - 14393)
  406. STOP 0x0000019C: WIN32K_POWER_WATCHDOG_TIMEOUT (W10 - 14393)
  407. STOP 0x0000019D: CLUSTER_SVHDX_LIVEDUMP (W10 - 14393)
  408. STOP 0x0000019E: BUGCODE_NETADAPTER_DRIVER (W10 - 15063)
  409. STOP 0x0000019F: PDC_PRIVILEGE_CHECK_LIVEDUMP (W10 - 15063)
  410. STOP 0x000001A0: TTM_WATCHDOG_TIMEOUT (W10 - 15063)
  411. STOP 0x000001A1: WIN32K_CALLOUT_WATCHDOG_LIVEDUMP (W10 - 15063)
  412. STOP 0x000001A2: WIN32K_CALLOUT_WATCHDOG_BUGCHECK (W10 - 15063)
  413. STOP 0x000001C4: DRIVER_VERIFIER_DETECTED_VIOLATION_LIVEDUMP (W10 - 10240)
  414. STOP 0x000001C5: IO_THREADPOOL_DEADLOCK_LIVEDUMP (W10 - 14393)
  415. STOP 0x000001C6: FAST_ERESOURCE_PRECONDITION_VIOLATION (W10 - 15063)
  416. STOP 0x000001C7: STORE_DATA_STRUCTURE_CORRUPTION (W10 - 15063)
  417. STOP 0x000001C8: MANUALLY_INITIATED_POWER_BUTTON_HOLD (W10 - 15063)
  418. STOP 0x000001C9: USER_MODE_HEALTH_MONITOR_LIVEDUMP (W10 - 15063)
  419. STOP 0x000001CA: HYPERVISOR_WATCHDOG_TIMEOUT (W10 - 15063)
  420. STOP 0x000001CB: INVALID_SILO_DETACH (W10 - 15063)
  421. STOP 0x00000315: SAVER_MTBFCOMMANDTIMEOUT
  422. STOP 0x00000333:
  423. STOP 0x00000357: XBOX_CORRUPTED_IMAGE (W10 - 14393)
  424. STOP 0x00000358: XBOX_INVERTED_FUNCTION_TABLE_OVERFLOW
  425. STOP 0x00000359: XBOX_CORRUPTED_IMAGE_BASE
  426. STOP 0x00000360: XBOX_360_SYSTEM_CRASH
  427. STOP 0x00000420: XBOX_360_SYSTEM_CRASH_RESERVED
  428. STOP 0x00000BFE: BC_BLUETOOTH_VERIFIER_FAULT
  429. STOP 0x00000BFF: BC_BTHMINI_VERIFIER_FAULT (W10 - 10240)
  430. STOP 0x00008866: SAVER_SICKAPPLICATION
  431. STOP 0x0000C1F5:
  432. STOP 0x0000F000: SAVER_UNSPECIFIED
  433. STOP 0x0000F002: SAVER_BLANKSCREEN
  434. STOP 0x0000F003: SAVER_INPUT
  435. STOP 0x0000F004: SAVER_WATCHDOG
  436. STOP 0x0000F005: SAVER_STARTNOTVISIBLE
  437. STOP 0x0000F006: SAVER_NAVIGATIONMODEL
  438. STOP 0x0000F007: SAVER_OUTOFMEMORY
  439. STOP 0x0000F008: SAVER_GRAPHICS
  440. STOP 0x0000F009: SAVER_NAVSERVERTIMEOUT
  441. STOP 0x0000F00A: SAVER_CHROMEPROCESSCRASH
  442. STOP 0x0000F00B: SAVER_NOTIFICATIONDISMISSAL
  443. STOP 0x0000F00C: SAVER_SPEECHDISMISSAL
  444. STOP 0x0000F00D: SAVER_CALLDISMISSAL
  445. STOP 0x0000F00E: SAVER_APPBARDISMISSAL
  446. STOP 0x0000F00F: SAVER_RILADAPTATIONCRASH
  447. STOP 0x0000F010: SAVER_APPLISTUNREACHABLE
  448. STOP 0x0000F011: SAVER_REPORTNOTIFICATIONFAILURE
  449. STOP 0x0000F012: SAVER_UNEXPECTEDSHUTDOWN
  450. STOP 0x0000F013: SAVER_RPCFAILURE
  451. STOP 0x0000F014: SAVER_AUXILIARYFULLDUMP
  452. STOP 0x0000F015: SAVER_ACCOUNTPROVSVCINITFAILURE
  453. STOP 0x0000F101: SAVER_MTBFCOMMANDHANG
  454. STOP 0x0000F102: SAVER_MTBFPASSBUGCHECK
  455. STOP 0x0000F103: SAVER_MTBFIOERROR
  456. STOP 0x0000F200: SAVER_RENDERTHREADHANG
  457. STOP 0x0000F201: SAVER_RENDERMOBILEUIOOM
  458. STOP 0x0000F300: SAVER_DEVICEUPDATEUNSPECIFIED
  459. STOP 0x0000F400: SAVER_AUDIODRIVERHANG
  460. STOP 0x0000F500: SAVER_BATTERYPULLOUT
  461. STOP 0x0000F600: SAVER_MEDIACORETESTHANG
  462. STOP 0x0000F700: SAVER_RESOURCEMANAGEMENT
  463. STOP 0x0000F800: SAVER_CAPTURESERVICE
  464. STOP 0x0000F900: SAVER_WAITFORSHELLREADY
  465. STOP 0x00020001: HYPERVISOR_ERROR
  466. STOP 0x1000000A: IRQL_NOT_LESS_OR_EQUAL
  467. STOP 0x10000050: PAGE_FAULT_IN_NONPAGED_AREA_M
  468. STOP 0x1000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
  469. STOP 0x1000007F: UNEXPECTED_KERNEL_MODE_TRAP_M
  470. STOP 0x1000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
  471. STOP 0x100000B8: ATTEMPTED_SWITCH_FROM_DPC
  472. STOP 0x100000CF: TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE
  473. STOP 0x100000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
  474. STOP 0x100000D6: DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION_M
  475. STOP 0x100000EA: THREAD_STUCK_IN_DEVICE_DRIVER_M
  476. STOP 0x1000F000: SAVER_UNSPECIFIED (W10 - 10240)
  477. STOP 0x1000F002: SAVER_BLANKSCREEN (W10 - 10240)
  478. STOP 0x1000F003: SAVER_INPUT (W10 - 10240)
  479. STOP 0x1000F004: SAVER_WATCHDOG (W10 - 10240)
  480. STOP 0x1000F005: SAVER_STARTNOTVISIBLE (W10 - 10240)
  481. STOP 0x1000F006: SAVER_NAVIGATIONMODEL (W10 - 10240)
  482. STOP 0x1000F007: SAVER_OUTOFMEMORY (W10 - 10240)
  483. STOP 0x1000F008: SAVER_GRAPHICS (W10 - 10240)
  484. STOP 0x1000F009: SAVER_NAVSERVERTIMEOUT (W10 - 10240)
  485. STOP 0x1000F00A: SAVER_CHROMEPROCESSCRASH (W10 - 10240)
  486. STOP 0x1000F00B: SAVER_NOTIFICATIONDISMISSAL (W10 - 10240)
  487. STOP 0x1000F00C: SAVER_SPEECHDISMISSAL (W10 - 10240)
  488. STOP 0x1000F00D: SAVER_CALLDISMISSAL (W10 - 10240)
  489. STOP 0x1000F00E: SAVER_APPBARDISMISSAL (W10 - 10240)
  490. STOP 0x1000F00F: SAVER_RILADAPTATIONCRASH (W10 - 10240)
  491. STOP 0x1000F010: SAVER_APPLISTUNREACHABLE (W10 - 10240)
  492. STOP 0x1000F011: SAVER_REPORTNOTIFICATIONFAILURE (W10 - 10240)
  493. STOP 0x1000F012: SAVER_UNEXPECTEDSHUTDOWN (W10 - 10240)
  494. STOP 0x1000F013: SAVER_RPCFAILURE (W10 - 10240)
  495. STOP 0x1000F014: SAVER_AUXILIARYFULLDUMP (W10 - 10240)
  496. STOP 0x1000F015: SAVER_ACCOUNTPROVSVCINITFAILURE (W10 - 10240)
  497. STOP 0x1000F100: SAVER_MTBFCOMMANDTIMEOUT (W10 - 10240)
  498. STOP 0x1000F101: SAVER_MTBFCOMMANDHANG (W10 - 10240)
  499. STOP 0x1000F102: SAVER_MTBFPASSBUGCHECK (W10 - 10240)
  500. STOP 0x1000F103: SAVER_MTBFIOERROR (W10 - 10240)
  501. STOP 0x1000F200: SAVER_RENDERTHREADHANG (W10 - 10240)
  502. STOP 0x1000F201: SAVER_RENDERMOBILEUIOOM (W10 - 10240)
  503. STOP 0x1000F300: SAVER_DEVICEUPDATEUNSPECIFIED (W10 - 10240)
  504. STOP 0x1000F400: SAVER_AUDIODRIVERHANG (W10 - 10240)
  505. STOP 0x1000F500: SAVER_BATTERYPULLOUT (W10 - 10240)
  506. STOP 0x1000F600: SAVER_MEDIACORETESTHANG (W10 - 10240)
  507. STOP 0x1000F700: SAVER_RESOURCEMANAGEMENT (W10 - 10240)
  508. STOP 0x1000F800: SAVER_CAPTURESERVICE (W10 - 10240)
  509. STOP 0x1000F900: SAVER_WAITFORSHELLREADY (W10 - 10240)
  510. STOP 0x4000007E: WINDOWS_NT_BANNER
  511. STOP 0x40000082: BUGCODE_PSS_MESSAGE
  512. STOP 0x40000083: BUGCHECK_TECH_INFO
  513. STOP 0x40000087: WINDOWS_NT_CSD_STRING
  514. STOP 0x40000088: WINDOWS_NT_INFO_STRING
  515. STOP 0x40000089: WINDOWS_NT_MP_STRING
  516. STOP 0x4000008A: THREAD_TERMINATE_HELD_MUTEX
  517. STOP 0x4000008B: BUGCODE_PSS_CRASH_INIT
  518. STOP 0x4000008C: BUGCODE_PSS_CRASH_PROGRESS
  519. STOP 0x4000008D: BUGCODE_PSS_CRASH_DONE
  520. STOP 0x4000009D: WINDOWS_NT_INFO_STRING_PLURAL
  521. STOP 0x4000009E: WINDOWS_NT_RC_STRING
  522. STOP 0x400000AD: VIDEO_DRIVER_DEBUG_REPORT_REQUEST
  523. STOP 0x40010001: HARDWARE_PROFILE_UNDOCKED_STRING
  524. STOP 0x40010002: HARDWARE_PROFILE_DOCKED_STRING
  525. STOP 0x40010003: HARDWARE_PROFILE_UNKNOWN_STRING
  526. STOP 0x66888866: SAVER_SICKAPPLICATION (W10 - 10240)
  527. STOP 0x70860002:
  528. STOP 0x80000000: BUGCHECK_CONTEXT_MODIFIER
  529. STOP 0x80070246: ERROR_ILLEGAL_CHARACTER
  530. STOP 0x80080005: CO_E_SERVER_EXEC_FAILURE
  531. STOP 0x8086:
  532. STOP 0x9087:
  533. STOP 0x9088:
  534. STOP 0xA0000001:
  535. STOP 0xBADB0D00:
  536. STOP 0xC0000005:
  537. STOP 0xC000000D:
  538. STOP 0xC0000034:
  539. STOP 0xC000009A: STATUS_INSUFFICIENT_RESOURCES
  540. STOP 0xC0000135: UNABLE_TO_LOCATE_DLL
  541. STOP 0xC0000142: DLL Initialization Failure
  542. STOP 0xC0000194: SAVER_NONRESPONSIVEPROCESS (W10 - 10240)
  543. STOP 0xC0000218: STATUS_CANNOT_LOAD_REGISTRY_FILE
  544. STOP 0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED  Changed to WINLOGON_FATAL_ERROR in Win8 DP SDK v8.0
  545. STOP 0xC0000221: STATUS_IMAGE_CHECKSUM_MISMATCH
  546. STOP 0xC0000244: AUDIT_FAILED
  547. STOP 0xC000026C: ???FATAL SYSTEM ERROR???
  548. STOP 0xC00002CB: Security Accounts Manager initialization failed
  549. STOP 0xC00002E2:  Directory Services could not start because of the following error:
  550. STOP 0xC00002E3:  ???STATUS_SAM_INIT_FAILURE???
  551. STOP 0xC0000415:  Unknown Error
  552. STOP 0xDEADDEAD: MANUALLY_INITIATED_CRASH1
  553. STOP 0xE0010002:
  554. STOP fvevol!FveFilterDeviceControl+1d0
  555. Unknown STOP errors


Example Entry:

STOP 0x00000000: SYMBOLIC_NAME    (go to top of page)

Usual causes:  Text

    MSDN Listing (Win2K ResKit):  Link
    AUMHA Listing:  Link

    Knowledge Base Articles:
    Link(s)

    WinDbg Help File Entry:
Text

    WinDbg Output Example (I have example dump files):
Text 

STOP -1073741502    (go to top of page)

Usual causes:  Power Shell Console.Write method?

    Knowledge Base Articles:
KB 2701373    "0xC0000142" or "-1073741502" Stop error when many PowerShell scripts call the Console.Write method or when you try to start many console applications on a PowerShell console in Windows 7 or in Windows Server 2008 R2

    WinDbg Help File Entry:

    WinDbg Output Example:



STOP 0x00000001: APC_INDEX_MISMATCH    (go to top of page)

Usual causes:  Checked build kernel error.  I suspect that this can be caused by something else, as I've seen 2 of these over the past several months - and none appeared to be a checked build

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818748.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557419(v=VS.85).aspx
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/11/03/debugging-stop-0x1-apcs-and-guarded-regions/

    Knowledge Base Articles:
KB 935936     You receive a Stop error message on a Windows Vista-based computer: "Stop 0x00000001 (0x00000000, 0x7FFDC000, 0X0000FFFF, 0X00000000)" 
KB 942836    Stop error message when you try to print content that includes a bitmap on a Windows Vista-based computer: "Stop 0x00000001"
KB 2203330    "STOP: 0x00000001" error occurs in Windows Server 2008 R2 or in Windows 7
KB 2619041    "0x00000001" Stop error in Windows Server 2008 R2 or in Windows 7

    WinDbg Help File Entry:

The APC_INDEX_MISMATCH bug check has a value of 0x00000001. This indicates that there has been a mismatch in the APC state index.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the system function (system call)
2 The value of the following bit computation:

Thread->ApcStateIndex << 8 | Previous ApcStateIndex

3 The value of Thread->KernelApcDisable
4 The value of the previous KernelApcDisable

Cause

The most common cause of this bug check is when a file system has a mismatched sequence of KeEnterCriticalRegion calls and KeLeaveCriticalRegion calls.

Comments

This is a kernel internal error which can occur only on a checked build. This error occurs on exit from a system call.

    WinDbg Output Example:
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->KernelApcDisable field. A negative value indicates that a driver
has disabled APC calls without re-enabling them.  A positive value indicates
that the reverse is true. This check is made on exit from a system call.
Arguments:
Arg1: 8287872f, address of system function (system call)
Arg2: 00000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex
Arg3: 00010000, Thread->KernelApcDisable
Arg4: 00000000, Previous KernelApcDisable


STOP 0x00000002: DEVICE_QUEUE_NOT_BUSY    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818752.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557475(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DEVICE_QUEUE_NOT_BUSY bug check has a value of 0x00000002.

This bug check appears very infrequently.

    WinDbg Output Example:
DEVICE_QUEUE_NOT_BUSY (2)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000003: INVALID_AFFINITY_SET    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818756.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558969(v=VS.85).aspx

    Knowledge Base Articles:
KB 841005    You receive a "Stop 0x00000003" error message on your Windows XP-based computer

    WinDbg Help File Entry:

The INVALID_AFFINITY_SET bug check has a value of 0x00000003.

This bug check appears very infrequently.

    WinDbg Output Example:
INVALID_AFFINITY_SET (3)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000004: INVALID_DATA_ACCESS_TRAP    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818763.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559022(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INVALID_DATA_ACCESS_TRAP bug check has a value of 0x00000004.

This bug check appears very infrequently.

    WinDbg Output Example:
INVALID_DATA_ACCESS_TRAP (4)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000005: INVALID_PROCESS_ATTACH_ATTEMPT    (go to top of page)

Usual causes:  Specific known issue with XP SP2/Server 2003 and certain Antivirus or Firewall programs

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818767.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559087(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x05

    Knowledge Base Articles:
KB885958    Your Windows Server 2003-based terminal server that uses the UPHClean utility to unload user profiles when users log off may suddenly stop responding
KB887742    You receive the Stop error "Stop 0x05 (INVALID_PROCESS_ATTACH_ATTEMPT)" in Windows XP Service Pack 2 or Windows Server 2003
KB 908674    Stop error message on an Exchange Server 2003 server: "INVALID_PROCESS_ATTACH_ATTEMPT (5)"(STOP 0x5)

    WinDbg Help File Entry:

The INVALID_PROCESS_ATTACH_ATTEMPT bug check has a value of 0x00000005.

This bug check appears very infrequently.

    WinDbg Output Example:
INVALID_PROCESS_ATTACH_ATTEMPT (5)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000006: INVALID_PROCESS_DETACH_ATTEMPT    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818771.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559160(v=VS.85).aspx

    Knowledge Base Articles:
KB 833314    You randomly receive a "stop 0x00000006" error message (2000)

    WinDbg Help File Entry:

The INVALID_PROCESS_DETACH_ATTEMPT bug check has a value of 0x00000006.

This bug check appears very infrequently.

    WinDbg Output Example:
INVALID_PROCESS_DETACH_ATTEMPT (6)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000007: INVALID_SOFTWARE_INTERRUPT    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818775.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559247(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INVALID_SOFTWARE_INTERRUPT bug check has a value of 0x00000007.

This bug check appears very infrequently.

    WinDbg Output Example:
INVALID_SOFTWARE_INTERRUPT (7)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000008: IRQL_NOT_DISPATCH_LEVEL    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818780.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559278(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The IRQL_NOT_DISPATCH_LEVEL bug check has a value of 0x00000008.

This bug check appears very infrequently.

    WinDbg Output Example:
IRQL_NOT_DISPATCH_LEVEL (8)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000009: IRQL_NOT_GREATER_OR_EQUAL    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818783.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559337(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The IRQL_NOT_GREATER_OR_EQUAL bug check has a value of 0x00000009.

This bug check appears very infrequently.

    WinDbg Output Example:
IRQL_NOT_GREATER_OR_EQUAL (9)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL    (go to top of page)

Usual causes:  Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818787.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560129(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x0a
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/07/02/debugging-stop-0xa-irql_not_less_or_equal/
        http://mikemstech.blogspot.com/2011/11/how-to-troubleshoot-blue-screen-0xa.html

    Knowledge Base Articles:
KB 157936    SMC9232N Driver Causing Multiple STOP Messages (NT)
KB 183169    Possible Resolutions to STOP 0x0A, 0x01E, and 0x50 Errors (NT, 2000)
KB 193532    Stop 0x0000000A When Running Executable from Floppy Disk (NT)
KB 227301    STOP: 0x0000000A When You Dual Boot with Windows NT 4.0 on the Same Partition (NT, 2000)
KB 244617    How to Use Driver Verifier to Troubleshoot Windows Drivers (2000, XP, Server 2003)
KB 245538    "STOP 0x0000000A" Error Message While Using Rcmdsvc.exe (NT, 2000 Server)
KB 266196    Backup Exec 8.0 May Cause "Stop 0x0000000A" or Sporadic Reboots (2000)
KB 289205    STOP Errors 0x00000023 and 0x0000000A in Fastfat.sys When a Program Queries the File System (2000 Server)
KB 307129    "Fatal System Error" When You Try to Use a Hewlett-Packard 5100C ScanJet (XP)
KB 308605    Stop 0x00000048 or Stop 0x0000000A Caused By Named Pipe File System (Npfs.sys) (NT)
KB 310628    Easy CD Creator 5.0 does not function in Windows XP
KB 310918    "Stop 0x0000000A" Error Message When You Fast Switch Between Users (XP)
KB 311564    "Stop 0x0000000A Irql_Not_Less_or_Equal" Error Message During Windows XP Upgrade
KB 311806    Windows XP restarts when you try to shut down your computer
KB 313687    A "Stop 0x0000000A" Error Message Occurs If SetTcpInfo Is Required to Wait (2000)
KB 314063    You receive a "Stop 0x0000000A" error message in Windows XP
KB 315377    A "Stop: 0x0000000a" Error Occurs After You Install an HP ScanJet 5100c or 5200c Scanner (2000)
KB 316676    "STOP 0x0000000A" Error Message When You Change from AC Power to DC Power (XP)
KB 319810    A Computer May Hang During a Heavy Load with an Ericsson HIS Modem (2000, XP)
KB 321420    "Stop 0x0000000A" Error Message and Computer Stops Responding When You Use Dial-up RAS Connection (2000)
KB 321613    Stop 0x0a Error in nt!ExpBoostOwnerThread() on Windows 2000 Server
KB 326189    "Stop" Errors Occur in ObpDestroySecurityDescriptorHeader (NT Server)
KB 329175    Rdbss.sys May Cause STOP 0xA Error (2000)
KB 818501    How to debug a system after you receive "Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)" (XP)
KB 816054    "STOP 0x0000000a" Error Message During the Dynamics.exe Process in Great Plains 7.5 (2000)
KB 818326    STOP 0x0000001D or STOP 0x000000A Stop Error Occurs in Ndis.sys (XP)
KB 819895    STOP 0x0000000A Error When Computer Performs Intensive Operations on USB Drives (2000, XP, Server 2003)
KB 824025    You Receive a "STOP 0x0000000a" Error Message That Is Related to the Wdmaud.sys Driver (2000)
KB 824679    Stop Error "0x0000000A" Occurs During a Period of High Hard Disk Activity (2000)
KB 833763    You receive a "Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)" or a "Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)" on a Windows 2000-based computer
KB 836049    Windows Server 2003 stops responding with a Stop 0x0000000A error
KB 837384    "Stop: 0x0000000A (00000063, 0000001c, 00000000, parameter4)" error message on a Windows 2000-based computer
KB 840551    Intermittent errors in IA64 editions of Windows Server 2003: Stop error code 0x0000009C (MACHINE_CHECK_EXCEPTION), Stop error code 0x00000024 (NTFS_FILE_SYSTEM), or Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)
KB 841475    Stop error code 0x0000000A in srv.sys during Windows Server 2003 startup
KB 867778    You may receive a "Stop 0X0000000A" Stop error in Ntoskrnl.exe on a Windows 2000-based computer
KB 892000    You may receive a "Stop" error message on a computer that is running Windows Server 2003, Windows 2000, Windows Small Business Server 2003, Small Business Server 2000, or Windows XP
KB 897079    A diagnostic program may immediately close and you may receive a "STOP 0x00000050" or "STOP 0x0000000A" error message in Windows Server 2003, Windows 2000, or Windows XP
KB 897574    You may receive a Stop error message after you insert media into a removable disk device in Windows XP, Windows Server 2003, or Windows 2000
KB 902069    You may receive a "Stop 0x0000000A" error message when you shut down or restart a computer that is running Windows Server 2003
KB 907353    You receive a Stop error message when you use a hardware device on a computer that is running Windows 2000
KB 908265    You may receive a "STOP 0x0000000A" error message on a Windows 2000-based computer that is running Windows Services for UNIX
KB 908369    You may receive a "Stop 0x0000000A" error message when a processor on a Windows Server 2003-based computer resumes from a C1 idle state
KB 910835    Error message in Windows Server 2003: "Stop 0x0000000A (0x00000806, 0x00000002, 0x00000000, 0x804fd3aa) IRQL_NOT_LESS_OR_EQUAL"
KB 929338    Stop error message in Windows XP with Service Pack 2: "STOP 0x0000001a: MEMORY_MANAGEMENT" or "STOP 0x0000000a: IRQL_NOT_LESS_OR_EQUAL"
KB 929777    Error message when you try to install Windows Vista on a computer that uses more than 3 GB of RAM: "STOP 0x0000000A"
KB 930261    You randomly receive a "Stop 0x0000000A" error in Storport.sys when you start Windows Vista
KB 932755    An updated Storport storage driver is available for Windows Server 2003
KB 935806    Troubleshooting Stop error messages that may occur when you try to install Windows Vista
KB 935920    When the Emulex Elxsli2.sys driver is installed, you may receive a Stop error message after you upgrade your computer to Windows Server 2003 Service Pack 1   
KB 936192    Error message on a computer that is running Windows Server 2003: "Stop 0x0000000a"
KB 936456    Stop error message when you run a filter driver that calls the "CmRegisterCallback" routine to register a "RegistryCallback" routine on a Windows XP SP2-based computer: "STOP: 0x0000000A"
KB 937455    You may receive various Stop error messages on a computer that is running Windows Server 2003
KB 940984    Stop error message if you use two USB streaming-video cameras on a Windows XP SP2-based computer: "STOP 0x0000000A"
KB 941492    Stop error message when the computer resumes from hibernation in Windows Vista: "STOP 0x0000000A"
KB 941507    Stop error message when you start a portable Windows Vista-based computer that has the lid closed: "STOP: 0x0000000A"
KB 945577    Error message when a portable Windows Vista-based computer that has an integrated or external USB camera device resumes from long-term suspend mode: "0x000000E4" or "0x0000000A"
KB 949695    Stop error when you try to hibernate or to resume a Windows Server 2008-based computer or a Windows Vista-based computer after you run the "Common Scenario Stress with IO" test: "0x0000000A"
KB 951149    Stop error on a Windows Server 2008-based terminal server when the server is running under a heavy load: "0x0000000A"
KB 954029     Stop error when you resume a Windows Vista-based computer that is connected to a USB optical disc drive from standby "STOP: 0x000000E4" or "STOP: 0x0000000A"
KB 956029    Stop error when you resume a Windows Vista-based computer that is connected to a USB optical disc drive from standby "STOP: 0x000000E4" or "STOP: 0x0000000A"
KB 958867    You receive a "Stop 0x00000050" or "Stop 0x0000000A" error message when you hot-replace memory on a Windows Server 2008-based computer
KB 959660    Stop error message if you use two USB streaming-video cameras at the same time on a computer that is running Windows Vista or Windows Server 2008: "STOP 0x0000000A"
KB 961324    Stop error message when you run the Dynamic Partition Testing for a Hot Replace test that is included in the Windows Logo Kit in Windows Vista or Windows Server 2008: "Stop 0x0000000A"
KB 961799    A Stop error occurs on a Windows Server 2003-based server when a user accesses shared files on the server by using an SMB connection
KB 967352    Stop error message when you put a computer that is running Windows Vista or Windows Server 2008 into hibernation: "STOP 0x000000A0," "STOP 0x0000007a," or "STOP 0x00000077"
KB 969432    Stop code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL) when multiple legacy SMB clients manage shared files on a Windows Server 2003-based file server at the same time
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)
KB 970938    Stop error when you try to put a Windows Vista Service Pack 1-based or Windows Server 2008-based computer into hibernation: "Stop 0x0000000A"
KB 971280    Random Stop errors on a Windows Server 2003-based computer that performs input/output to file shares hosted on another computer or to a network-attached storage device
KB 973482    Stop error 0x0A, or Stop error 0x7E may occur on a computer that is running Windows Vista or Windows Server 2008
KB 975986    Stop error message on a computer that is running Windows Server 2003 SP2 and that has almost 4 GB or more of physical memory: "0x00000050" or "0x0000000A"
KB 976529    Stop error message after you install a WFP callout driver in Windows Vista SP2 or in Windows Server 2008 SP2: "STOP: 0x0000000A"
KB 976746    Error message when a Windows Server 2008 R2-based or a Windows 7-based computer enters hibernation: "STOP: 0x0000000A"
KB 977287    An error message unexpectedly appears after you create a mirrored volume on a computer that is running Windows Server 2008 or Windows Vista: "Stop 0x0000000a IRQL_NOT_LESS_OR_EQUAL"
KB 978571    Stop error message when you try to put the computer into hibernation (S4) in Windows 7 or in Windows Server 2008 R2: "Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)"
KB 979128    Stop error in Windows Server 2003 SP2: "0x0000000A IRQL_NOT_LESS_OR_EQUAL"
KB 979444    Error message on a blue screen on a computer that is running Windows 7 or Windows Server 2008 R2: "STOP: 0x0000000A"
KB 979551    "0x0000000A" error message when you use CHAP authentication to start a computer that is running Windows Vista or Windows Server 2008 from an iSCSI device
KB 979711    Stop error message on a computer that is running Windows 7 or Windows Server 2008 R2 and that has iSCSI storage: "0x0000000A"
KB 979903    "STOP 0x000000A" Stop error when there is a request to allocate a large amount of contiguous physical memory in Windows Server 2008 R2 or Windows 7
KB 982327    "STOP: 0x0000000A IRQL_NOT_LESS_OR_EQUAL" Stop error message when you try to put the computer into hibernation (S4) in Windows Vista or in Windows Server 2008
KB 982488    You receive an incorrect Stop error message when you send a WHEA handler NMI in Windows Vista and in Windows Server 2008
KB 2028982    "0x0000000A" Stop error message in Windows Vista or in Windows Server 2008 if iSCSI storage is installed
KB 2479442    Stop error during startup in Windows Server 2008 or in Windows Vista
KB 2517752    "0x0000000A" Stop error occurs during the shutdown process on a computer that is running Windows Server 2008 and that has more than 64 processors installed
KB 2536875    "0x0000000A" stop error occurs if one or more iSCSI disks are installed on a computer that is running Windows Server 2008 R2
KB 2547257    "0x0000007E" or "0x0000000A" Stop error occurs when you play and at the same time record TV content on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2549036   "0x0000000A" stop error occurs when several applications access the same network share file by using the MapViewOfFile() API on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2577968    "0x0000000a" Stop error occurs on a computer that has a mirrored volume and that is running Windows Server 2008 R2 or Windows 7
KB 2582260    "0x0000000A" Stop error when you perform ETW tracing on the Afd.sys driver in Windows 7 or in Windows Server 2008 R2
KB 2591837    FIX: Stop error on a server that is running Forefront Threat Management Gateway 2010: "IRQL_NOT_LESS_OR_EQUAL (a)" (Server OS's)
KB 2633799    You randomly receive various Stop errors when you change the network adapter teaming configuration in Windows Server 2008 or in Windows Vista
KB 2673977    "0x0000000A" Stop error when you disable a network adapter that is used for iSCSI in Windows 7 or in Windows Server 2008 R2
KB 2723222    "0x0000000A" Stop error in Windows Vista, Windows 7, Windows Server 2008 or Windows Server 2008 R2
KB 2732487    "0x0000000a" Stop error code when you resume a Windows 7-based computer from sleep or from hibernation
KB 2776366    "0x0000000A" Stop error on a Windows Server 2008 R2-based Hyper-V server that has many pass-through disks
KB 2807832    "0x0000000A" Stop error in Windows 7 or Windows Server 2008 R2
KB 2845653    "0x0000000A" Stop error when you perform a live migration of a virtual machine on a Windows Server 2012-based cluster
KB 2846833    "0x0000000A" Stop error when you try to resume a Windows 8-based computer from sleep mode

    Many more NT results in 20 pages of this search:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000000a&x=4&y=15&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry: 
The IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x0000000A. This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 IRQL at time of reference
3 0: Read

1: Write

4 Address which referenced memory

Cause

This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high.

The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.

If you encounter bug check 0xA while upgrading to a later version of Windows, this error might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version.

Resolving the Problem

If a kernel debugger is available, obtain a stack trace.

To resolve an error caused by a faulty device driver, system service, or BIOS
  1. Restart your computer.
  2. Press F8 at the character-based menu that displays the operating system choices.
  3. Select the Last Known Good Configuration option from the Windows Advanced Options menu. This option is most effective when only one driver or service is added at a time.
To resolve an error caused by an incompatible device driver, system service, virus scanner, or backup tool
  1. Check the System Log in Event Viewer for error messages that might identify the device or driver that caused the error.
  2. Try disabling memory caching of the BIOS.
  3. Run the hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the owner's manual for your computer.
  4. Make sure the latest Service Pack is installed.
  5. If your system has small computer system interface (SCSI) adapters, contact the adapter manufacturer to obtain updated Windows drivers. Try disabling sync negotiation in the SCSI BIOS, checking the cabling and the SCSI IDs of each device, and confirming proper termination.
  6. For integrated device electronics (IDE) devices, define the onboard IDE port as Primary only. Also, check each IDE device for the proper master/subordinate/stand-alone setting. Try removing all IDE devices except for hard disks.

If the message appears during an installation of Windows, make sure that the computer and all installed peripherals are listed in the Microsoft Windows Marketplace Tested Products List.

Here is a debugging example:

kd> .bugcheck       [Lists bug check data.]
Bugcheck code 0000000a
Arguments 00000000 0000001c 00000000 00000000

kd> kb       [Lists the stack trace.]
ChildEBP RetAddr  Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> kv       [Lists the trap frames.]
ChildEBP RetAddr  Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint (FPO: [0,0,0])
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256 (FPO: [0,0] TrapFrame @ 8013eee8)
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> .trap 8013eee8       [Gets the registers for the trap frame at the time of the fault.]
eax=dec80201 ebx=ffdff420 ecx=8013c71c edx=000003f8 esi=00000000 edi=87038e10
eip=00000000 esp=8013ef5c ebp=8013ef64 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
ErrCode = 00000000
00000000 ???????????????       [The current instruction pointer is NULL.]

kd> kb       [Gives the stack trace before the fault.]
ChildEBP RetAddr  Args to Child
8013ef68 fe551aa1 ff690268 00000002 fe5620d2 NT!_DbgBreakPoint
8013ef74 fe5620d2 fe5620da ff690268 80404690
NDIS!_EthFilterIndicateReceiveComplete+0x31
8013ef64 00000246 fe551aa1 ff690268 00000002 elnkii!_ElnkiiRcvInterruptDpc+0x1d0

Comments

Before upgrading to a new version of Windows, remove all third-party device drivers and system services, and disable any virus scanners. Contact the software manufacturers to obtain updates of these third-party tools.

    WinDbg Output Example:
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00720075, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81c1dfe9, address which referenced memory


STOP 0x0000000B: NO_EXCEPTION_HANDLING_SUPPORT    (go to top of page)

Usual causes

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818791.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560171(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The NO_EXCEPTION_HANDLING_SUPPORT bug check has a value of 0x0000000B.

This bug check appears very infrequently.

    WinDbg Output Example:
NO_EXCEPTION_HANDLING_SUPPORT (b)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000000C: MAXIMUM_WAIT_OBJECTS_EXCEEDED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818794.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560236(v=VS.85).aspx

    Knowledge Base Articles:
KB 2869679    "0x0000000C MAXIMUM_WAIT_OBJECTS_EXCEEDED" Stop error on a Windows Server-based computer with many IP addresses (Server 2008, Server 2008 R2; Server 2012)

    WinDbg Help File Entry:

The MAXIMUM_WAIT_OBJECTS_EXCEEDED bug check has a value of 0x0000000C. This indicates that the current thread exceeded the permitted number of wait objects.

Parameters

None

Cause

This bug check results from the improper use of KeWaitForMultipleObjects or FsRtlCancellableWaitForMultipleObjects.

The caller may pass a pointer to a buffer in this routine's WaitBlockArray parameter. The system will use this buffer to keep track of wait objects.

If a buffer is supplied, the Count parameter may not exceed MAXIMUM_WAIT_OBJECTS. If no buffer is supplied, the Count parameter may not exceed THREAD_WAIT_OBJECTS.

If the value of Count exceeds the allowable value, this bug check is issued.

    WinDbg Output Example:
MAXIMUM_WAIT_OBJECTS_EXCEEDED (c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000000D: MUTEX_LEVEL_NUMBER_VIOLATION    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818798.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560311(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The MUTEX_LEVEL_NUMBER_VIOLATION bug check has a value of 0x0000000D.

This bug check appears very infrequently.

    WinDbg Output Example:
MUTEX_LEVEL_NUMBER_VIOLATION (d)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000000E: NO_USER_MODE_CONTEXT    (go to top of page)

Usual causes

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818809.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560360(v=VS.85).aspx

    Knowledge Base Articles:
KB 104903    Stop Message Error 0x0000000E (NT)
KB 126462    Windows NT Setup Err Msg on NEC Express/II: STOP 0x0000000E
KB 303853    You receive a "Stop 0x0000000E" error message, or CPU usage increases to 100 percent when a computer disconnects from a remote access session on your Windows 2000-based computer

    WinDbg Help File Entry:

The NO_USER_MODE_CONTEXT bug check has a value of 0x0000000E.

This bug check appears very infrequently.

    WinDbg Output Example:
NO_USER_MODE_CONTEXT (e)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000000F: SPIN_LOCK_ALREADY_OWNED    (go to top of page)

Usual causes

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818815.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560412(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SPIN_LOCK_ALREADY_OWNED bug check has a value of 0x0000000F. This indicates that a request for a spin lock has been initiated when the spin lock was already owned.

Parameters

None

Cause

Typically, this error is caused by a recursive request for a spin lock. It can also occur if something similar to a recursive request for a spin lock has been initiated—for example, when a spin lock has been acquired by a thread, and then that same thread calls a function, which also tries to acquire a spin lock. The second attempt to acquire a spin lock is not blocked in this case because doing so would result in an unrecoverable deadlock. If the calls are made on more than one processor, then one processor will be blocked until the other processor releases the lock.

This error can also occur, without explicit recursion, when all threads and all spin locks are assigned an IRQL. Spin lock IRQLs are always greater than or equal to DPC level, but this is not true for threads. However, a thread that is holding a spin lock must maintain an IRQL greater than or equal to that of the spin lock. Decreasing the thread IRQL below the IRQL level of the spin lock that it is holding allows another thread to be scheduled on the processor. This new thread could then attempt to acquire the same spin lock.

Resolving the Problem

Ensure that you are not recursively acquiring the lock. And, for threads that hold a spin lock, ensure that you are not decreasing the thread IRQL to a level below the IRQL of the spin lock that it is holding.

    WinDbg Output Example:
SPIN_LOCK_ALREADY_OWNED (f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000010: SPIN_LOCK_NOT_OWNED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818821.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557243(v=VS.85).aspx

    Knowledge Base Articles:
KB 820841    A "Stop 0x00000010" Error Occurs in Scsiport.sys in Windows 2000
KB 822384    Some Windows 2000 Hotfixes May Cause a Conflict with Service Pack 4 for Windows 2000
   
    WinDbg Help File Entry:

The SPIN_LOCK_NOT_OWNED bug check has a value of 0x00000010.

This bug check appears very infrequently.

    WinDbg Output Example:
SPIN_LOCK_NOT_OWNED (10)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000011: THREAD_NOT_MUTEX_OWNER    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818825.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557303(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The THREAD_NOT_MUTEX_OWNER bug check has a value of 0x00000011.

This bug check appears very infrequently.

    WinDbg Output Example:
THREAD_NOT_MUTEX_OWNER (11)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000012: TRAP_CAUSE_UNKNOWN    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818830.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557348(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x12

   Knowledge Base Articles:
KB 297088    Problems When You Use Sound Blaster Live Driver with Your Windows 2000-Based Computer
   
    WinDbg Help File Entry:

The TRAP_CAUSE_UNKNOWN bug check has a value of 0x00000012. This indicates that an unknown exception has occurred.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The unexpected interrupt
2 The unknown floating-point exception
3 The enabled and asserted status bits. See the processor definition for details.
4 Reserved

    WinDbg Output Example:
TRAP_CAUSE_UNKNOWN (12)
Arguments:
Arg1: 0000000000000000, Unexpected interrupt.
Arg2: 0000000000000000, Unknown floating point exception.
Arg3: 0000000000000000, The enabled and asserted status bits (see processor definition).
Arg4: 0000000000000000


STOP 0x00000013: EMPTY_THREAD_REAPER_LIST    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818835.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557361(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The EMPTY_THREAD_REAPER_LIST bug check has a value of 0x00000013.

This bug check appears very infrequently.

    WinDbg Output Example:
EMPTY_THREAD_REAPER_LIST (13)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000014: CREATE_DELETE_LOCK_NOT_LOCKED    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557367(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CREATE_DELETE_LOCK_NOT_LOCKED bug check has a value of 0x00000014.

This bug check appears very infrequently.

    WinDbg Output Example:
CREATE_DELETE_LOCK_NOT_LOCKED (14)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000015: LAST_CHANCE_CALLED_FROM_KMODE    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818840.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557375(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The LAST_CHANCE_CALLED_FROM_KMODE bug check has a value of 0x00000015.

This bug check appears very infrequently.

    WinDbg Output Example:
LAST_CHANCE_CALLED_FROM_KMODE (15)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000016: CID_HANDLE_CREATION    (go to top of page)

Usual causes:  http://msdn.microsoft.com/en-us/library/ms818843.aspx

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818843(v=MSDN.10).aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557378(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CID_HANDLE_CREATION bug check has a value of 0x00000016.

This bug check appears very infrequently.

    WinDbg Output Example:
CID_HANDLE_CREATION (16)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000017: CID_HANDLE_DELETION    (go to top of page)

Usual causes:  http://msdn.microsoft.com/en-us/library/ms818848.aspx

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818848(v=MSDN.10).aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557381(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CID_HANDLE_DELETION bug check has a value of 0x00000017.

This bug check appears very infrequently.

    WinDbg Output Example:
CID_HANDLE_DELETION (17)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000018: REFERENCE_BY_POINTER    (go to top of page)

Usual causes:  Device driver, kernel, hardware

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818851.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557386(v=VS.85).aspx
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/08/24/debugging-stop-0x18-reference_by_pointer/

    Knowledge Base Articles:
KB 957463    Stop error on a Windows Vista Service Pack 1-based or Windows Server 2008-based computer that has an integrated graphics adapter and a discrete graphics adapter: "Stop 0x00000018"
KB 967776    Stop errors in Windows Vista or Windows Server 2008: “Stop: 0x00000018” or “STOP: 0x000000C2”
   
    WinDbg Help File Entry:

The REFERENCE_BY_POINTER bug check has a value of 0x00000018. This indicates that the reference count of an object is illegal for the current state of the object.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Object type of the object whose reference count is being lowered.
2 Object whose reference count is being lowered.
3 Reserved
4 Reserved

Cause

The reference count of an object is illegal for the current state of the object. Each time a driver uses a pointer to an object, the driver calls a kernel routine to increase the reference count of the object by one. When the driver is done with the pointer, the driver calls another kernel routine to decrease the reference count by one.

Drivers must match calls to the routines that increase (reference) and decrease (dereference) the reference count. This bug check is caused by an inconsistency in the object’s reference count. Typically, the inconsistency is caused by a driver that decreases the reference count of an object too many times, making extra calls that dereference the object. This bug check can occur because an object's reference count goes to zero while there are still open handles to the object. It might also occur when the object’s reference count drops below zero, whether or not there are open handles to the object.

Resolving the Problem

Make sure that the driver matches calls to the routines that increase and decrease the reference count of the object. Make sure that your driver does not make extra calls to routines that dereference the object (see Parameter 2).

You can use a debugger to help analyze this problem. To find the handle and pointer count on the object, use the !object debugger command.

kd> !object address

Where address is the address of the object given in Parameter 2.

    WinDbg Output Example:
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 88237ce0, Object type of the object whose reference count is being lowered
Arg2: 88235130, Object whose reference count is being lowered
Arg3: 00000012, Reserved
Arg4: 81d0a391, Reserved
    The reference count of an object is illegal for the current state of the object.
    Each time a driver uses a pointer to an object the driver calls a kernel routine
    to increment the reference count of the object. When the driver is done with the
    pointer the driver calls another kernel routine to decrement the reference count.
    Drivers must match calls to the increment and decrement routines. This bugcheck
    can occur because an object's reference count goes to zero while there are still
    open handles to the object, in which case the fourth parameter indicates the number
    of opened handles. It may also occur when the object?s reference count drops below zero
    whether or not there are open handles to the object, and in that case the fourth parameter
    contains the actual value of the pointer references count.


STOP 0x00000019: BAD_POOL_HEADER    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818860.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557389(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x19
    Other Articles:
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/5311-0x19-bad_pool_header-pool-party.html
        https://bsodtutorials.wordpress.com/2013/06/24/stop-0x19-some-theory-about-corrupt-pool-headers/
        https://bsodtutorials.wordpress.com/2013/06/13/debugging-0x19-bad_pool_header/
        https://bsodtutorials.wordpress.com/2013/08/07/stop-0x19-corrupt-pool-header-pool-poolval-dt-nt_pool_header/

Problem w/ESET and SandBoxie (thanks to RedScare!):  http://windows7forums.com/blue-screen-death-bsod/84555-bsods-shortly-after-startup.html#post272422

    Knowledge Base Articles:
KB 156731    Windows NT Err. Msg: Stop 0x00000019 in NTFS
KB 179129    STOP 0x0000000A or 0x00000019 Due to Modified Teardrop Attack (NT)
KB 295624    "Stop 0x00000050" or "Stop 0x00000019" While Printing Extended Characters to a PostScript Printer (NT)
KB 883516    You receive Stop error code 0x00000019 or Stop error code 0x00000050 in the Tcpip.sys file on a Windows 2000 Server-based computer
KB 884585    When you back up to EMC Clarion storage devices in a SAN environment, your Windows Server 2003-based computer may stop responding after you restart
KB 892260    You may receive a "STOP: 0x00000019" error message on a Windows Server 2003-based computer
KB 905795    When you try to control a Systems Management Server 2003 client from a remote location, you experience a Stop error on the Systems Management Server 2003 client
KB 925259    Error message when a Delayed Write Failure event is reported in Windows Server 2003: "Stop 0x00000019 - BAD_POOL_HEADER" or "Stop 0xCD PAGE_FAULT_BEYOND_END_OF_ALLOCATION"
KB 931479    The print server experiences a Stop error when you use the Point and Print feature to print to a shared printer in Windows Vista (XP, Server 2003)
KB 934177    FIX: Error message when you connect a scanner or a digital camera to a computer that is running Windows Vista or Windows XP Service Pack 2: "BAD_POOL_HEADER STOP"
KB 934326    FIX: Stop error message when you run the Client for NFS service in Microsoft Windows Services for UNIX 3.5: "Stop 0x00000019"
KB 935920    When the Emulex Elxsli2.sys driver is installed, you may receive a Stop error message after you upgrade your computer to Windows Server 2003 Service Pack 1
KB 946226    FIX: You receive a "Stop 0x00000019" error message or a "Stop 0x000000c4" error message when you access NFS resources by using User Name Mapping (MS Svcs for Unix)
KB 947979    FIX: Stop error message on a computer that has the Gateway for NFS component of Windows Services for UNIX 3.5 installed: "Stop 0x00000019"
KB 948289    Error message on a Windows Server 2003-based computer: "Stop error code 0x00000019"
KB 949531    Stop error message when you try to install Windows Server 2008 on a computer that is connected to an iSCSI target LUN by using an iSCSI bootable network adapter: "STOP 0x00000019"
KB 955015    Stop error message on a Windows Server 2008-based computer when the NFS feature is enabled: "Stop: 0x00000019"
KB 970693    Stop error message in Windows Server 2008 or Windows Vista after you uninstall or reinstall a wireless network adapter driver: "0x00000019 BAD_POOL_HEADER"
KB 971280    Random Stop errors on a Windows Server 2003-based computer that performs input/output to file shares hosted on another computer or to a network-attached storage device
KB 973026    Error message on a computer that is running Windows Vista or on Windows Server 2008 that has the IPMI driver installed: "Stop 0x00000019"
KB 973097    Stop error message when the Smb.sys driver is unloaded on a computer that is running Windows Server 2003: "Stop 0x00000019"
KB 974201    Stop error message when you retrieve WMI connection statistics for iSCSI after you change the iSCSI configurations on a computer that is running Windows Server 2008 or Windows Vista: "0x00000019 BAD_POOL_HEADER"
KB 976443    Stop error message when you retrieve WMI connection statistics for iSCSI after you change the iSCSI configurations on a computer that is running Windows Server 2008 R2 or Windows 7: "0x00000019 BAD_POOL_HEADER"
KB 2280732    You receive Stop error message 0x000000CD or 0x00000019 on a computer that is running Windows Server 2003 when corrupted registry hive files are loaded
KB 2669443    "0x00000019" Stop error when you use Internet Explorer 8 to browse webpages in Windows Vista or in Windows Server 2008
KB 2712746    "0x00000019" Stop error when you run an SNMP application on a computer that is running Windows Vista or Windows Server 2008
KB 2832829    "0x00000019" Stop error when you try to shut down a Windows 7 or Windows Server 2008 R2-based computer

    WinDbg Help File Entry:

The BAD_POOL_HEADER bug check has a value of 0x00000019. This indicates that a pool header is corrupt.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x2 The pool entry being checked The size of the pool block 0 The special pool pattern check failed.

(The owner has likely corrupted the pool block.)

0x3 The pool entry being checked The read-back flink freelist value The read-back blink freelist value The pool freelist is corrupt.

(In a healthy list, the values of Parameters 2, 3, and 4 should be identical.)

0x5 One of the pool entries Reserved The other pool entry A pair of adjacent pool entries have headers that contradict each other. At least one of them is corrupt.
0x6 One incorrectly-calculated entry Reserved The bad entry that caused the miscalculation The pool block header's previous size is too large.
0x7 0 Reserved The bad pool entry The pool block header size is corrupt.
0x8 0 Reserved The bad pool entry The pool block header size is zero.
0x9 One incorrectly-calculated entry Reserved The bad entry that caused the miscalculation The pool block header size is corrupted (it is too large).
0xA The pool entry that should have been found Reserved The virtual address of the page that should have contained the pool entry The pool block header size is corrupt.
0x20 The pool entry that should have been found The next pool entry Reserved The pool block header size is corrupt.

Cause

The pool is already corrupted at the time of the current request.

This may or may not be due to the caller.

Resolving the Problem

The internal pool links must be walked to figure out a possible cause of the problem.

Then you can use special pool for the suspect pool tags, or use Driver Verifier on the suspect driver. The !analyze extension may be of help in pinpointing the suspect driver, but this is frequently not the case with pool corrupters.

    WinDbg Output Example:
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 89d147d8, The pool entry we were looking for within the page.
Arg3: 89d14808, The next pool entry.
Arg4: 08060007, (reserved)


STOP 0x0000001A: MEMORY_MANAGEMENT    (go to top of page)

Usual causes:  Device driver, memory, kernel

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818864.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557391(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x1a
    Other Articles:
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/12198-stop-0x1a-working-set-list-entries.html
        https://bsodtutorials.wordpress.com/2013/07/08/debugging-stop-0x1a-memory_management/
        https://bsodtutorials.wordpress.com/2013/08/22/debugging-stop-0x1a-out-of-sync-pfns-and-page-tables/
        https://bsodtutorials.wordpress.com/2013/09/09/debugging-stop-0x1a-corrupt-image-relocation-table/
        https://bsodtutorials.wordpress.com/2013/11/15/debugging-stop-0x1a-working-set-free-list-corrupt/
        https://bsodtutorials.wordpress.com/2013/12/02/debugging-stop-0x1a-corrupt-pte-undocumented-parameters-revealed/
        http://bsoddebugging.blogspot.com/2014/06/0x1a-debugging.html

    Knowledge Base Articles:
KB 839037    You receive a "STOP 0x0000001a" error message on a Windows 2000-based multiprocessor computer
KB 885272    You receive a "Stop 0x0000001a" Stop error message on your Windows 2000 Server-based computer that has Physical Address Extensions (PAE) enabled
KB 929338    Stop error message in Windows XP with Service Pack 2: "STOP 0x0000001a: MEMORY_MANAGEMENT" or "STOP 0x0000000a: IRQL_NOT_LESS_OR_EQUAL"
KB 932094    Error message when you try to play a movie file that has an .mov extension by using QuickTime 7 in Windows Vista: "STOP 0x1A MEMORY_MANAGEMENT"
KB 957967    Stop error message on a Windows Server 2008-based computer that has the Hyper-V role installed: "STOP 0x0000001A"
KB 981791    "STOP: 0x0000001a" error message on a computer that has an Intel Westmere processor together with the Hyper-V role installed on Windows Server 2008 or on Windows Server 2008 R2
   
    More STOP errors in this search:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000001a&x=3&y=9&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The MEMORY_MANAGEMENT bug check has a value of 0x0000001A. This indicates that a severe memory management error occurred.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 is the only parameter of interest; this identifies the exact violation.

Parameter 1 Cause of Error
0x1 The fork clone block reference count is corrupt. (This only occurs on checked builds of Windows.)
0x777 The caller is unlocking a system cache address that is not currently locked. (This address was either never mapped or is being unlocked twice.)
0x778 The system is using the very last system cache view address, instead of preserving it.
0x780
0x781
The PTEs mapping the argument system cache view have been corrupted.
0x1000 A caller of MmGetSystemAddressForMdl* tried to map a fully-cached physical page as non-cached. This action would cause a conflicting hardware translation buffer entry, and so it was refused by the operating system. Since the caller specified "bug check on failure" in the requesting MDL, the system had no choice but to issue a bug check in this instance.
0x1010 The caller is unlocking a pageable section that is not currently locked. (This section was either never locked or is being unlocked twice.)
0x1234 The caller is trying lock a nonexistent pageable section.
0x1235 The caller is trying to protect an MDL with an invalid mapping.
0x3451 The PTEs of a kernel thread stack that has been swapped out are corrupted.
0x8888
0x8889
Internal memory management structures are corrupted.
0x41283 The working set index encoded in the PTE is corrupted.
0x41284 A PTE or the working set list is corrupted.
0x41286 The caller is trying to free an invalid pool address.
0x41785 The working set list is corrupted.
0x41287 Internal memory management structures are corrupted. To further investigate the cause, a kernel memory dump file is needed.
0x61940 A PDE has been unexpectedly invalidated.
0x03030303 The boot loader is broken. (This value applies only to Intel Itanium machines.)
Other An unknown memory management error occurred.

    WinDbg Output Example:
MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00005003, The subtype of the bugcheck.
Arg2: c0802000
Arg3: 000066e0
Arg4: 0a272d40


STOP 0x0000001B: PFN_SHARE_COUNT    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818868.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557399(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PFN_SHARE_COUNT bug check has a value of 0x0000001B.

This bug check appears very infrequently.

    WinDbg Output Example:
PFN_SHARE_COUNT (1b)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000001C: PFN_REFERENCE_COUNT    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818873.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557401(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PFN_REFERENCE_COUNT bug check has a value of 0x0000001C.

This bug check appears very infrequently.

    WinDbg Output Example:
PFN_REFERENCE_COUNT (1c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000001D: NO_SPIN_LOCK_AVAILABLE    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818877.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557404(v=VS.85).aspx

    Knowledge Base Articles:
KB 818326    STOP 0x0000001D or STOP 0x000000A Stop Error Occurs in Ndis.sys (XP)

    WinDbg Help File Entry:

The NO_SPIN_LOCK_AVAILABLE bug check has a value of 0x0000001D.

This bug check appears very infrequently.

    WinDbg Output Example:
NO_SPIN_LOCK_AVAILABLE (1d)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED    (go to top of page)

Usual causes:  Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818890.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557408(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x1e
    Other Articles:
        https://bsodtutorials.wordpress.com/2014/01/11/debugging-stop-0x1e-finding-the-exception-record-address-in-the-stack/

    Knowledge Base Articles:
KB 132470    STOP Msg: 0x0000000A or 0x0000001E When Using PING (NT)
KB 157936    SMC9232N Driver Causing Multiple STOP Messages (NT)
KB 161703    "Stop: 0x0000001E" Error Message During Setup (NT, 2000)
KB 195857    Open Handles Cause STOP 0x0000001E or STOP 0x00000024 (NT, 2000)
KB 264223    How to Troubleshoot "Stop 0x0000001E" with First Parameter of 0xC0000044 (NT, 2000)
KB 269593    "Stop 0x0000001e" in Win32k.sys When You Quit a Program (2000)
KB 278999    Stop 0x0000001E in Win32k.sys When Using Animated Mouse Pointers (2000)
KB 279640    "Stop 0x0000001e" on Windows 2000 Server
KB 284154    STOP 0X0000001E in Protcls.sys When You Undock a Toshiba Tecra 8100 (XP)
KB 294690    "Stop 0x0000001E" Error Message in Ntoskrnl.exe (2000)
KB 294728    Error message: "Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)" in Win32k.sys or a "Stop error code 0xC000021A" (2000/NT 4.0)
KB 302971    "Stop 0x1E" or "Stop 0xc5" After You Install Service Pack 2 and You Use Logitech Mouse Drivers (2000)
KB 306119    Stop 0x0000001E Loading Adobe Type Manager Font Driver (2000)
KB 307128    "STOP 0x0000001E KMODE_EXCEPTION_NOT_HANDLED" Error Message from Aspi32.sys (XP)
KB 314451    "STOP 0x0000001E" Error Message During Windows Setup (XP)
KB 317153    Stop 0x0000001e or Stop 0x00000050 Error in Navap.sys When You Use Norton AutoProtect Feature (NT Server, 2000 Server)
KB 811014    "Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED in NTOSKRNL.EXE)" error message after you install pcAnywhere (2000)
KB 815265    "STOP 0x00000051" or "STOP 0x0000001E" error message when you start Configuration Manager in Windows 2000 Server or in Windows XP
KB 816047    STOP 0x1E in Win32k.sys Error May Occur in Windows 2000 or Windows XP Professional
KB 824288    "Stop error code 0x0000001E" in Mup.sys after you apply Windows 2000 SP4
KB 828514    Intermittent "Stop error code 0x0000001E" error message (XP, Server 2000, Server 2003)
KB 833763    You receive a "Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)" or a "Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)" on a Windows 2000-based computer
KB 835312    You receive a Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED) on a Windows 2000-based computer
KB 839427    You receive a Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED) error on a Windows 2000-based computer
KB 840110    You may receive a Stop error code 0x0000001E (0xc0000005) message when the Rdpdd.dll function in Windows 2000 Terminal Services receives a null value
KB 904374    You receive a "Stop 0x0000001e" error message after you install Update Rollup 1 for Windows 2000 Service Pack 4

KB 911028    When you use a 32-bit program to print a document from a 64-bit version of Microsoft Windows, you may receive a Stop error message, or objects on the page are omitted (XP, Server 2003)
KB 961799    A Stop error occurs on a Windows Server 2003-based server when a user accesses shared files on the server by using an SMB connection
KB 2381191    0x0000001E Stop code error occurs on a computer that is running an IA-64-based version of Windows Server 2008 R2
KB 2479442    Stop error during startup in Windows Server 2008 or in Windows Vista
KB 2521220    "0x0000001E" Stop error when you perform disk I/O-intensive operations on dynamic disks in Windows Server 2008 or in Windows Server 2008 R2
KB 2554414    "0x0000001E" Stop error when you add some NFS shares to a DFS namespace or to a DFS Replication group in Windows Server 2008 R2
KB 2636573    FIX: The guest operating system may crash when you perform a live migration of Hyper-V virtual machines in a Windows Server 2008 R2 environment
KB 2655104    "0x0000001E" Stop error on a computer that is running an x64-based version of Windows Vista SP2 or of Windows Server 2008 SP2
KB 2719347    Stop error when a Windows 7-based or Windows Server 2008 R2-based computer crashes randomly
KB 2764302    "0x0000001E" Stop error occurs intermittently in Windows 7 SP1 and Windows Server 2008 R2 SP1
KB 2888929    "KMODE_EXCEPTION_NOT_HANDLED" Stop error when a driver tries to close static streams for USB 3.0 devices in Windows RT 8.1, Windows 8.1, or Windows Server 2012 R2

    More STOP message articles at this search:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000001e&x=10&y=10&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The KMODE_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000001E. This indicates that a kernel-mode program generated an exception which the error handler did not catch.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The exception code that was not handled
2 The address at which the exception occurred
3 Parameter 0 of the exception
4 Parameter 1 of the exception

Cause

This is a very common bug check. To interpret it, you must identify which exception was generated.

Common exception codes include:

For a complete list of exception codes, see the ntstatus.h file located in the inc directory of the Windows Driver Kit.

Resolving the Problem

If you are not equipped to debug this problem, you should use some basic troubleshooting techniques. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates. Try changing video adapters. Check with your hardware vendor for any BIOS updates. Disable BIOS memory options such as caching or shadowing.

If you plan to debug this problem, you may find it difficult to obtain a stack trace. Parameter 2 (the exception address) should pinpoint the driver or function that caused this problem.

If exception code 0x80000003 occurs, this indicates that a hard-coded breakpoint or assertion was hit, but the system was started with the /NODEBUG switch. This problem should rarely occur. If it occurs repeatedly, make sure a kernel debugger is connected and the system is started with the /DEBUG switch.

If exception code 0x80000002 occurs, the trap frame will supply additional information.

If the specific cause of the exception is unknown, the following should be considered:

Hardware incompatibility. First, make sure that any new hardware installed is listed in the Microsoft Windows Marketplace Tested Products List.

Faulty device driver or system service. In addition, a faulty device driver or system service might be responsible for this error. Hardware issues, such as BIOS incompatibilities, memory conflicts, and IRQ conflicts can also generate this error.

If a driver is listed by name within the bug check message, disable or remove that driver. Disable or remove any drivers or services that were recently added. If the error occurs during the startup sequence and the system partition is formatted with NTFS file system, you might be able to use Safe Mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in Safe Mode, you need to start the computer by using the Recovery Console to access the file.

If the problem is associated with Win32k.sys, the source of the error might be a third-party remote control program. If such software is installed, the service can be removed by starting the system using the Recovery Console and deleting the offending system service file.

Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing bug check 0x1E. Disabling memory caching of the BIOS might also resolve the error. You should also run hardware diagnostics, especially the memory scanner, supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer.

The error that generates this message can occur after the first restart during Windows Setup, or after Setup is finished. A possible cause of the error is a system BIOS incompatibility. BIOS problems can be resolved by upgrading the system BIOS version.

To get a stack trace if the normal stack tracing procedures fail
  1. Use the kb (Display Stack Backtrace) command to display parameters in the stack trace. Look for the call to NT!PspUnhandledExceptionInSystemThread. (If this function is not listed, see the note below.)
  2. The first parameter to NT!PspUnhandledExceptionInSystemThread is a pointer to a structure, which contains pointers to an except statement:typedef struct _EXCEPTION_POINTERS {
        PEXCEPTION_RECORD ExceptionRecord;
        PCONTEXT ContextRecord;
        } EXCEPTION_POINTERS, *PEXCEPTION_POINTERS;


    ULONG PspUnhandledExceptionInSystemThread(
        IN PEXCEPTION_POINTERS ExceptionPointers
        )

    Use the dd (Display Memory) command on that address to display the necessary data.

  3. The first retrieved value is an exception record and the second is a context record. Use the .exr (Display Exception Record) command and the .cxr (Display Context Record) command with these two values as their arguments, respectively.
  4. After the .cxr command executes, use the kb command to display a stack trace that is based on the context record information. This stack trace indicates the calling stack where the unhandled exception occurred.

Note  This procedure assumes that you can locate NT!PspUnhandledExceptionInSystemThread. However, in some cases (such as an access violation crash) you will not be able to do this. In that case, look for ntoskrnl!KiDispatchException. The third parameter passed to this function is a trap frame address. Use the .trap (Display Trap Frame) command with this address to set the Register Context to the proper value. You can then perform stack traces and issue other commands.

Here is an example of bug check 0x1E on an x86 processor:

kd> .bugcheck                 get the bug check data
Bugcheck code 0000001e
Arguments c0000005 8013cd0a 00000000 0362cffff

kd> kb                        start with a stack trace 
FramePtr  RetAddr   Param1   Param2   Param3   Function Name 
8013ed5c  801263ba  00000000 00000000 fe40cb00 NT!_DbgBreakPoint 
8013eecc  8013313c  0000001e c0000005 8013cd0a NT!_KeBugCheckEx+0x194
fe40cad0  8013318e  fe40caf8 801359ff fe40cb00 NT!PspUnhandledExceptionInSystemThread+0x18
fe40cad8  801359ff  fe40cb00 00000000 fe40cb00 NT!PspSystemThreadStartup+0x4a
fe40cf7c  8013cb8e  fe43a44c ff6ce388 00000000 NT!_except_handler3+0x47
00000000  00000000  00000000 00000000 00000000 NT!KiThreadStartup+0xe

kd> dd fe40caf8 L2            dump EXCEPTION_POINTERS structure
0xFE40CAF8  fe40cd88 fe40cbc4                   ..@...@.

kd> .exr fe40cd88             first DWORD is the exception record
Exception Record @ FE40CD88:
   ExceptionCode: c0000005
  ExceptionFlags: 00000000
  Chained Record: 00000000
ExceptionAddress: 8013cd0a
NumberParameters: 00000002
   Parameter[0]: 00000000
   Parameter[1]: 0362cfff

kd> .cxr fe40cbc4             second DWORD is the context record
CtxFlags: 00010017
eax=00087000 ebx=00000000 ecx=03ff0000 edx=ff63d000 esi=0362cfff edi=036b3fff
eip=8013cd0a esp=fe40ce50 ebp=fe40cef8 iopl=0         nv dn ei pl nz ac po cy
vip=0    vif=0
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010617
0x8013cd0a  f3a4             rep movsb

kd> kb                        kb gives stack for context record
ChildEBP RetAddr  Args to Child
fe40ce54 80402e09 ff6c4000 ff63d000 03ff0000 NT!_RtlMoveMemory@12+0x3e
fe40ce68 80403c18 ffbc0c28 ff6ce008 ff6c4000 HAL!_HalpCopyBufferMap@20+0x49
fe40ce9c fe43b1e4 ff6cef90 ffbc0c28 ff6ce009 HAL!_IoFlushAdapterBuffers@24+0x148
fe40ceb8 fe4385b4 ff6ce388 6cd00800 ffbc0c28 QIC117!_kdi_FlushDMABuffers@20+0x28
fe40cef8 fe439894 ff6cd008 ffb6c820 fe40cf4c QIC117!_cqd_CmdReadWrite@8+0x26e
fe40cf18 fe437d92 ff6cd008 ffb6c820 ff6e4e50 QIC117!_cqd_DispatchFRB@8+0x210
fe40cf30 fe43a4f5 ff6cd008 ffb6c820 00000000 QIC117!_cqd_ProcessFRB@8+0x134
fe40cf4c 80133184 ff6ce388 00000000 00000000 QIC117!_kdi_ThreadRun@4+0xa9
fe40cf7c 8013cb8e fe43a44c ff6ce388 00000000 NT!_PspSystemThreadStartup@8+0x40

    WinDbg Output Example:
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002508f6d, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception


STOP 0x0000001F: SHARED_RESOURCE_CONV_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818893.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557414(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SHARED_RESOURCE_CONV_ERROR bug check has a value of 0x0000001F.

This bug check appears very infrequently.

    WinDbg Output Example:
SHARED_RESOURCE_CONV_ERROR (1f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000020: KERNEL_APC_PENDING_DURING_EXIT    (go to top of page)

Usual causes:  Device driver, kernel

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818895.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557421(v=VS.85).aspx

    Knowledge Base Articles:
KB 905539    You may receive a "Stop 0x00000020" error message on a computer that is running Windows Small Business Server 2003 or Windows Server 2003
KB 920911    Stop error message on a Windows Server 2003-based computer: "Stop 0x00000020"
   
    WinDbg Help File Entry:

The KERNEL_APC_PENDING_DURING_EXIT bug check has a value of 0x00000020. This indicates that an asynchronous procedure call (APC) was still pending when a thread exited.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the APC found pending during exit
2 The thread's APC disable count
3 The current IRQL
4 Reserved

Cause

The key data item is the thread's APC disable count (Parameter 2). If this is non-zero, it will indicate the source of the problem.

The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, KeWaitForSingleObject, KeWaitForMultipleObjects, KeWaitForMutexObject, or FsRtlEnterFileSystem. The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem.

Since these calls should always be in pairs, this value should be zero when a thread exits. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.

If you ever see this error, be very suspicious of all drivers installed on the machine — especially unusual or non-standard drivers.

This current IRQL (Parameter 3) should be zero. If it is not, that a driver's cancellation routine may have caused this bug check by returning at an elevated IRQL. In this case, carefully note what was running (and what was closing) at the time of the crash, and note all of the installed drivers at the time of the crash. The cause in this case is usually a severe bug in a driver.

    WinDbg Output Example:
KERNEL_APC_PENDING_DURING_EXIT (20)
The key data item is the thread's APC disable count.
If this is non-zero, then this is the source of the problem.
The APC disable count is decremented each time a driver calls
KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a mutex.  The APC
disable count is incremented each time a driver calls KeLeaveCriticalRegion,
FsRtlExitFileSystem, or KeReleaseMutex.  Since these calls should always be in
pairs, this value should be zero when a thread exits.  A negative value
indicates that a driver has disabled APC calls without re-enabling them.  A
positive value indicates that the reverse is true.
If you ever see this error, be very suspicious of all drivers installed on the
machine -- especially unusual or non-standard drivers.  Third party file
system redirectors are especially suspicious since they do not generally
receive the heavy duty testing that NTFS, FAT, RDR, etc receive.
This current IRQL should also be 0.  If it is not, that a driver's
cancelation routine can cause this bugcheck by returning at an elevated
IRQL.  Always attempt to note what you were doing/closing at the
time of the crash, and note all of the installed drivers at the time of
the crash.  This symptom is usually a severe bug in a third party
driver.
Arguments:
Arg1: 0000000000000000, The address of the APC found pending during exit.
Arg2: 0000000000000000, The thread's APC disable count
Arg3: 0000000000000000, The current IRQL
Arg4: 0000000000000000


STOP 0x00000021: QUOTA_UNDERFLOW    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818898.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557424(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The QUOTA_UNDERFLOW bug check has a value of 0x00000021. This indicates that quota charges have been mishandled by returning more quota to a particular block than was previously charged.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The process that was initially charged, if available.
2 The quota type. For the list of all possible quota type values, see the header file Ps.h in the Windows Driver Kit (WDK).
3 The initial charged amount of quota to return.
4 The remaining amount of quota that was not returned.

    WinDbg Output Example:
QUOTA_UNDERFLOW (21)
This bugcheck occurs if a kernel component mishandles quota charges and
returns more quota than was previously charged to a particular quota block.
Arguments:
Arg1: 0000000000000000, The process (if any) that was initially charged.
Arg2: 0000000000000000, The quota type in question (paged pool, nonpaged pool, etc.)
Arg3: 0000000000000000, The initial charge amount to return.
Arg4: 0000000000000000, The remaining (unreturned) charge.


STOP 0x00000022: FILE_SYSTEM    (go to top of page)

Usual causes:  http://msdn.microsoft.com/en-us/library/ms818901.aspx

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818901(v=MSDN.10).aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557425(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The FILE_SYSTEM bug check has a value of 0x00000022.

This bug check appears very infrequently.

    WinDbg Output Example:
FILE_SYSTEM (22)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000023: FAT_FILE_SYSTEM    (go to top of page)

Usual causes:  Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818907.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557429(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x23

    Knowledge Base Articles:
KB 289205    STOP Errors 0x00000023 and 0x0000000A in Fastfat.sys When a Program Queries the File System (2000 Server)
KB 305358    A "Stop 0x23" Error Message Appears When You Use Removable Media with the Same Attributes (2000)
KB 899327    You may receive a "Stop 0x00000023" error message after you remove a USB floppy drive cable from a Windows Server 2003-based computer
KB 900626    Stop error message when you suddenly remove a storage device from a computer that is running Windows XP: "STOP 0x00000023 FAT_FILE_SYSTEM"
KB 913318    Stop error message when you insert and then remove a removable storage media on a Windows XP-based computer: "STOP 0x00000023"
   
    WinDbg Help File Entry:

The FAT_FILE_SYSTEM bug check has a value of 0x00000023. This indicates that a problem occurred in the FAT file system.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 If FatExceptionFilter is on the stack, this parameter specifies the address of the exception record.
3 If FatExceptionFilter is on the stack, this parameter specifies the address of the context record.
4 Reserved

Cause

One possible cause of this bug check is disk corruption. Corruption in the file system or bad blocks (sectors) on the disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to the disk, thus causing the error.

Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Resolving the Problem

To debug this problem: Use the .cxr (Display Context Record) command with Parameter 3, and then use kb (Display Stack Backtrace).

To resolve a disk corruption problem: Check Event Viewer for error messages from SCSI and FASTFAT (System Log) or Autochk (Application Log) that might help pinpoint the device or driver that is causing the error. Try disabling any virus scanners, backup programs, or disk defragmenter tools that continually monitor the system. You should also run hardware diagnostics supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer. Run Chkdsk /f /r to detect and resolve any file system structural corruption. You must restart the system before the disk scan begins on a system partition.

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This will increase the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
FAT_FILE_SYSTEM (23)
    If you see FatExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000024: NTFS_FILE_SYSTEM    (go to top of page)

Usual causes:  Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818912.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557433(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x24
    Other Articles:
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/11626-question-how-proceed-debugging-ntfs_file_system-24-bugcheck.html
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/6280-question-debugging-ntfs_file_system-dump.html
        https://bsodtutorials.wordpress.com/2013/10/07/debugging-stop-0x24-sptd-sys-and-filter-drivers/

    Knowledge Base Articles:
KB 142648    STOP 0x00000024 in Ntfs.sys (NT)
KB 195857    Open Handles Cause STOP 0x0000001E or STOP 0x00000024 (NT, 2000)
KB 228888    Error message in Windows 2000: "Stop 0x24" or "NTFS_FILE_SYSTEM"
KB 840551    Intermittent errors in IA64 editions of Windows Server 2003: Stop error code 0x0000009C (MACHINE_CHECK_EXCEPTION), Stop error code 0x00000024 (NTFS_FILE_SYSTEM), or Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)
KB 910311    Error message in Windows Server 2003: "STOP: 0x00000024 (0x0019033c, 0xf4d7d42c, 0xf4d7d128, 0xf7197421) "
KB 934454    FIX: Error message on a Windows Server 2003 R2-based computer that has the Server for NFS component installed: "STOP 0x0000008E" or "STOP 0x00000024"
KB 935806    Troubleshooting Stop error messages that may occur when you try to install Windows Vista
KB 937455    You may receive various Stop error messages on a computer that is running Windows Server 2003
KB 954495    Stop error 0x24 may occur on a computer that has file system filter drivers installed in Windows Server 2003 and in Windows XP Professional x64 Edition
KB 957535    Error message on a computer that is running Windows Vista Service Pack 1 or Windows Server 2008: "Stop 0x00000024"
KB 961799    A Stop error occurs on a Windows Server 2003-based server when a user accesses shared files on the server by using an SMB connection
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)
KB 975663    Stop error message on a computer that is running Windows Server 2008 SP2 or Windows Vista SP2: "0x00000024 NTFS_FILE_SYSTEM"
KB 2792165    "0x00000024" Stop error when a third-party application unmounts a corrupted storage volume on a Windows Server 2008 SP2-based storage server
KB 2824200    "0x00000024" or "0x00000050" Stop error on a computer that is running Windows Vista or Windows Server 2008

    WinDbg Help File Entry:

The NTFS_FILE_SYSTEM bug check has a value of 0x00000024. This indicates a problem occurred in ntfs.sys, the driver file that allows the system to read and write to NTFS drives.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 If NtfsExceptionFilter is on the stack, this parameter specifies the address of the exception record.
3 If NtfsExceptionFilter is on the stack, this parameter specifies the address of the context record.
4 Reserved

Cause

One possible cause of this bug check is disk corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error.

Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Resolving the Problem

To debug this problem: Use the .cxr (Display Context Record) command with Parameter 3, and then use kb (Display Stack Backtrace).

To resolve a disk corruption problem: Check Event Viewer for error messages from SCSI and FASTFAT (System Log) or Autochk (Application Log) that might help pinpoint the device or driver that is causing the error. Try disabling any virus scanners, backup programs, or disk defragmenter tools that continually monitor the system. You should also run hardware diagnostics supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer. Run Chkdsk /f /r to detect and resolve any file system structural corruption. You must restart the system before the disk scan begins on a system partition.

To resolve a nonpaged pool memory depletion problem: Either add new physical memory to the computer (thus increasing the quantity of nonpaged pool memory available to the kernel), or reduce the number of files on the Services for Macintosh (SFM) volume.

    WinDbg Output Example:
NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001904ab
Arg2: 8e854430
Arg3: 8e85412c
Arg4: 81b5d1c4


STOP 0x00000025: NPFS_FILE_SYSTEM    (go to top of page)

Usual causes:  Insufficient physical memory, Indexing, Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818917.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557436(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The NPFS_FILE_SYSTEM bug check has a value of 0x00000025. This indicates that a problem occurred in the NPFS file system.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 Reserved
3 Reserved
4 Reserved

Cause

One possible cause of this bug check is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Resolving the Problem

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This will increase the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
NPFS_FILE_SYSTEM (25)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000026: CDFS_FILE_SYSTEM    (go to top of page)

Usual causes:  Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818922.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557441(v=VS.85).aspx

    Knowledge Base Articles:
KB 124284    STOP 0x00000026 when Accessing a CD Using an Indirect Path (NT)

    WinDbg Help File Entry:

The CDFS_FILE_SYSTEM bug check has a value of 0x00000026. This indicates that a problem occurred in the CD file system.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 If CdExceptionFilter is on the stack, this parameter specifies the address of the exception record.
3 If CdExceptionFilter is on the stack, this parameter specifies the address of the context record.
4 Reserved

Cause

One possible cause of this bug check is disk corruption. Corruption in the file system or bad blocks (sectors) on the disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to the disk, thus causing the error.

Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Resolving the Problem

To debug this problem: Use the .cxr (Display Context Record) command with Parameter 3, and then use kb (Display Stack Backtrace).

To resolve a disk corruption problem: Check Event Viewer for error messages from SCSI and FASTFAT (System Log) or Autochk (Application Log) that might help pinpoint the device or driver that is causing the error. Try disabling any virus scanners, backup programs, or disk defragmenter tools that continually monitor the system. You should also run hardware diagnostics supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer. Run Chkdsk /f /r to detect and resolve any file system structural corruption. You must restart the system before the disk scan begins on a system partition.

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This will increase the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
CDFS_FILE_SYSTEM (26)
    If you see CdExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000027: RDR_FILE_SYSTEM    (go to top of page)

Usual causes:  Insufficient physical memory, Indexing, Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818927.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557446(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x27

    Knowledge Base Articles:
KB 261939    "Stop 0x00000027 RDR_FILE_SYSTEM" Error Message During Shutdown (2000 Server)
KB 310916    XADM: When the File System Accesses Items Created in Workflow-Enabled Folders, a Bugcheck May Occur (2000 Server)
KB 831128    "STOP 0x00000027 in mrxsmb.sys" error message when you try to copy files to a network-attached storage device (2000)
KB 892932    You receive a Stop error message when you use the Remote Installation Service to deploy a Windows Server 2003 Remote Installation Preparation image on a client computer
KB 919030    Error message that you receive when you open a protected document on a computer that is running a 64-bit version of Windows Server 2003: "STOP 0x00000027"
KB 937278    Error message when multiple processes access a file that is in an NFS shared folder on a Windows Server 2003 R2-based computer that has Client for NFS installed: "STOP 0x00000027"
KB 952185    A Windows Server 2003-based computer restarts unexpectedly, and a Stop error "0x00000027" occurs
KB 974759    Stop error message on a computer that is running Windows Server 2008 or Windows Vista: "0x00000027 RDR_FILE_SYSTEM"
KB 978972    Stop error message when you rename a file or folder by using a DFS shared path on a computer that is running Windows Server 2003: "Stop error code 0x00000027 (RDR_FILE_SYSTEM)"
KB 981109    "0x00000027" Stop error when you try to log on a client computer that is running Windows 7 or Windows Server 2008 R2
KB 2487035     "0x00000027" Stop error when you try to access earlier versions of shared files that are hosted on a remote file server in Windows Vista or in Windows Server 2008
KB 2494418    "0x00000027" Stop error occurs when you access shared network resources by using the SMB 2.0 protocol in Windows Server 2008 R2 or in Windows 7
KB 2500603    "0x00000027" Stop error occurs when you redirect some folders to network share in Windows Vista or in Windows Server 2008
KB 2584874    "0x00000027" Stop error when you try to access a shared network resource in Windows Server 2008 R2 or in Windows 7
KB 2624677    "0x00000027" Stop error when you access a shared network resource that is hosted on a computer that is running Windows Server 2008 R2 or Windows 7
KB 2639032    "0x0000003B," "0x00000027," and "0x0000007e" Stop errors when a connection to a CSV is lost on a Windows Server 2008 R2-based failover cluster
KB 2696083    "0x00000027" Stop error when you redirect folders to a network share in Windows Vista SP2 or in Windows Server 2008 SP2
KB 2780130    "0x00000027" Stop error when you try to use a redirected smart card to log on to a Windows 7 or Windows Server 2008 R2-based remote computer
KB 2839149    Stop Error 0x00000027 in Rdbss.sys on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2870965    "0x00000027" Stop error when you try to access some shared resources in Windows Vista SP2 or Windows Server 2008 SP2

    WinDbg Help File Entry:

The RDR_FILE_SYSTEM bug check has a value of 0x00000027. This indicates that a problem occurred in the SMB redirector file system.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The high 16 bits (the first four hexadecimal digits after the "0x") identify the type of problem. Possible values include:

0xCA550000 RDBSS_BUG_CHECK_CACHESUP

0xC1EE0000 RDBSS_BUG_CHECK_CLEANUP

0xC10E0000 RDBSS_BUG_CHECK_CLOSE

0xBAAD0000 RDBSS_BUG_CHECK_NTEXCEPT



2 If RxExceptionFilter is on the stack, this parameter specifies the address of the exception record.
3 If RxExceptionFilter is on the stack, this parameter specifies the address of the context record.
4 Reserved

Cause

One possible cause of this bug check is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Resolving the Problem

To debug this problem: Use the .cxr (Display Context Record) command with Parameter 3, and then use kb (Display Stack Backtrace).

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This will increase the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
RDR_FILE_SYSTEM (27)
    If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
    exception record and context record. Do a .cxr on the 3rd parameter and then kb to
    obtain a more informative stack trace.
    The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
    as follows:
     RDBSS_BUG_CHECK_CACHESUP  = 0xca550000,
     RDBSS_BUG_CHECK_CLEANUP   = 0xc1ee0000,
     RDBSS_BUG_CHECK_CLOSE     = 0xc10e0000,
     RDBSS_BUG_CHECK_NTEXCEPT  = 0xbaad0000,
Arguments:
Arg1: baad0075
Arg2: bde817c4
Arg3: bde814c0
Arg4: 90ae9b4d


STOP 0x00000028: CORRUPT_ACCESS_TOKEN    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818930.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557448(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CORRUPT_ACCESS_TOKEN bug check has a value of 0x00000028.

This bug check appears very infrequently.

    WinDbg Output Example:
CORRUPT_ACCESS_TOKEN (28)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000029: SECURITY_SYSTEM    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818934.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557452(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SECURITY_SYSTEM bug check has a value of 0x00000029.

This bug check appears very infrequently.

    WinDbg Output Example:
SECURITY_SYSTEM (29)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000002A: INCONSISTENT_IRP    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818938.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557457(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INCONSISTENT_IRP bug check has a value of 0x0000002A. This indicates that an IRP was found to contain inconsistent information.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the IRP that was found to be inconsistent
2 Reserved
3 Reserved
4 Reserved

Cause

An IRP was discovered to be in an inconsistent state. Usually this means some field of the IRP was inconsistent with the remaining state of the IRP. An example would be an IRP that was being completed, but was still marked as being queued to a driver's device queue.

Comments

This bug check code is not currently being used in the system, but exists for debugging purposes.

    WinDbg Output Example:
INCONSISTENT_IRP (2a)
An IRP was encountered that was in an inconsistent state; i.e., some field
or fields of the IRP were inconsistent w/the remaining state of the IRP.
An example would be an IRP that was being completed, but was still marked
as being queued to a driver's device queue.  This bugcheck code is not
currently being used in the system, but exists for debugging purposes.
Arguments:
Arg1: 0000000000000000, Address of the IRP that was found to be inconsistent
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000002B: PANIC_STACK_SWITCH    (go to top of page)

Usual causes:  Device driver, ?memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818941.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557460(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PANIC_STACK_SWITCH bug check has a value of 0x0000002B. This indicates that the kernel mode stack was overrun.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The trap frame
2 Reserved
3 Reserved
4 Reserved

Cause

This error normally appears when a kernel-mode driver uses too much stack space. It can also appear when serious data corruption occurs in the kernel.

    WinDbg Output Example:
PANIC_STACK_SWITCH (2b)
This error indicates that the kernel mode stack was overrun. This normally
occurs when a kernel-mode driver uses too much stack space.  It can also
occur when serious data corruption occurs in the kernel.
Arguments:
Arg1: 0000000000000000, Trap Frame
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000002C: PORT_DRIVER_INTERNAL    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818943.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557461(v=VS.85).aspx

    Knowledge Base Articles:
KB 301353    "Stop 0x2c" Error Message in Scsiport.sys When Returning from Hibernation (2000)
   
    WinDbg Help File Entry:

The PORT_DRIVER_INTERNAL bug check has a value of 0x0000002C.

This bug check appears very infrequently.

    WinDbg Output Example:
PORT_DRIVER_INTERNAL (2c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000002D: SCSI_DISK_DRIVER_INTERNAL    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818950.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557463(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SCSI_DISK_DRIVER_INTERNAL bug check has a value of 0x0000002D.

This bug check appears very infrequently.

    WinDbg Output Example:
SCSI_DISK_DRIVER_INTERNAL (2d)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000002E: DATA_BUS_ERROR    (go to top of page)

Usual causes:  Defective memory (not just RAM), Hard disk corruption, BIOS, SCSI controller, Network adapter, reseat adapter cards, Device driver, malware

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818953.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557468(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x2e

    Knowledge Base Articles:
KB 185787    STOP 0x0000002E on Alpha with ISA Sound Card (NT)
KB 218132    Troubleshooting "STOP 0x0000002E" or "DATA_BUS_ERROR" Error Message (2000)

    WinDbg Help File Entry:

The DATA_BUS_ERROR bug check has a value of 0x0000002E. This typically indicates that a parity error in system memory has been detected.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Virtual address that caused the fault
2 Physical address that caused the fault
3 Processor status register (PSR)
4 Faulting instruction register (FIR)

Cause

This error is almost always caused by a hardware problem — a configuration issue, defective hardware, or incompatible hardware.

The most common hardware problems that can cause this error are defective RAM, Level 2 (L2) RAM cache errors, or video RAM errors. Hard disk corruption can also cause this error.

This bug check can also be caused when a device driver attempts to access an address in the 0x8xxxxxxx range that does not exist (in other words, that does not have a physical address mapping).

Resolving the Problem

Resolving a hardware problem: If hardware has recently been added to the system, remove it to see if the error recurs.

If existing hardware has failed, remove or replace the faulty component. You should run hardware diagnostics supplied by the system manufacturer to determine which hardware component has failed. For details on these procedures, see the owner's manual for your computer. Check that all adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure that adapter card contacts are clean.

If the problem occurs on a newly installed system, check the availability of updates for the BIOS, the SCSI controller or network cards. Updates of this kind are typically available on the Web site or the bulletin board system (BBS) of the hardware manufacturer.

If the error occurs after installing a new or updated device driver, the driver should be removed or replaced. If, under this circumstance, the error occurs during startup and the system partition is formatted with NTFS, you might be able to use Safe Mode to rename or delete the faulty driver.

If the driver is used as part of the system startup process in Safe Mode, you need to start the computer using the Recovery Console in order to access the file.

For additional error messages that might help pinpoint the device or driver that is causing the error, check the System Log in Event Viewer. Disabling memory caching or shadowing in the BIOS might also resolve this error. In addition, check the system for viruses, using any up-to-date commercial virus scanning software that examines the Master Boot Record of the hard disk. All Windows file systems can be infected by viruses.

Resolving a hard disk corruption problem: Run Chkdsk /f /r on the system partition. You must restart the system before the disk scan begins. If you cannot start the system due to the error, use the Recovery Console and run Chkdsk /r.

Warning  If your system partition is formatted with the file allocation table (FAT) file system, the long filenames used by Windows can be damaged if Scandisk or another Microsoft MS-DOS-based hard disk tool is used to verify the integrity of your hard disk from MS-DOS. Always use the version of Chkdsk that matches your Windows version.

    WinDbg Output Example:
DATA_BUS_ERROR (2e)
This bugcheck is normally caused by a parity error in the system memory.
This error can also be caused by a driver accessing a bad virtual
address whose backing physical address does not exist.
Arguments:
Arg1: 0000000000000000, Virtual address that caused the fault
Arg2: 0000000000000000, Physical address that caused the fault.
Arg3: 0000000000000000, Processor status register (PSR)
Arg4: 0000000000000000, Faulting instruction register (FIR)


STOP 0x0000002F: INSTRUCTION_BUS_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818956.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557471(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INSTRUCTION_BUS_ERROR bug check has a value of 0x0000002F.

This bug check appears very infrequently.

    WinDbg Output Example:
INSTRUCTION_BUS_ERROR (2f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000030: SET_OF_INVALID_CONTEXT    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818959.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557478(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SET_OF_INVALID_CONTEXT bug check has a value of 0x00000030. This indicates that the stack pointer in a trap frame had an invalid value.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The new stack pointer
2 The old stack pointer
3 The trap frame address
4 0

Cause

This bug check occurs when some routine attempts to set the stack pointer in the trap frame to a lower value than the current stack pointer value.

If this error were not caught, it would cause the kernel to run with a stack pointer pointing to stack which is no longer valid.

    WinDbg Output Example:
SET_OF_INVALID_CONTEXT (30)
Attempt to set the stack pointer in the trap frame to a lower value than
the current stack pointer value.   This would cause the kernel run with a
stack pointer pointing to stack which is no longer valid.
Arguments:
Arg1: 0000000000000000, New stack pointer
Arg2: 0000000000000000, Old stack pointer
Arg3: 0000000000000000, TrapFrame address
Arg4: 0000000000000000, 0


STOP 0x00000031: PHASE0_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818963.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557479(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PHASE0_INITIALIZATION_FAILED bug check has a value of 0x00000031. This indicates that system initialization failed.

Parameters

None

Cause

System initialization failed at a very early stage.

Resolving the Problem

A debugger is required to analyze this.

    WinDbg Output Example:
PHASE0_INITIALIZATION_FAILED (31)
    System init failed early on.  A debugger is required to analyze this.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000032: PHASE1_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818967.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557483(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PHASE1_INITIALIZATION_FAILED bug check has a value of 0x00000032. This indicates that system initialization failed.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The NT status code that describes why the system initialization failed
2 Reserved
3 Reserved
4 Reserved

    WinDbg Output Example:
PHASE1_INITIALIZATION_FAILED (32)
Arguments:
Arg1: 0000000000000000, NT status code that describes why the system initialization failed.
Arg2: 0000000000000000, (reserved)
Arg3: 0000000000000000, (reserved)
Arg4: 0000000000000000


STOP 0x00000033: UNEXPECTED_INITIALIZATION_CALL    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818970.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557488(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The UNEXPECTED_INITIALIZATION_CALL bug check has a value of 0x00000033.

This bug check appears very infrequently.

    WinDbg Output Example:
UNEXPECTED_INITIALIZATION_CALL (33)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000034: CACHE_MANAGER    (go to top of page)

Usual causes:  Insufficient physical memory, Indexing, Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818973.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557491(v=VS.85).aspx

    Knowledge Base Articles:
KB 2800422    "0x00000034" Stop error and file corruption when you burn a Live File System formatted disc in Windows 7 or Windows Server 2008 R2

    WinDbg Help File Entry:

The CACHE_MANAGER bug check has a value of 0x00000034. This indicates that a problem occurred in the file system's cache manager.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 Reserved
3 Reserved
4 Reserved

Cause

One possible cause of this bug check is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Resolving the Problem

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This will increase the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
CACHE_MANAGER (34)
    See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000035: NO_MORE_IRP_STACK_LOCATIONS    (go to top of page)

Usual causes:  Device driver, ?memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818976.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557494(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x35
    OSROnline Listing:  http://www.osronline.com/article.cfm?article=337

    Knowledge Base Articles:
KB 906866    You may receive a "STOP 0x00000035 NO_MORE_IRP_STACK_LOCATIONS" error message when you try to log on to a domain (Server 2003, XP)

    WinDbg Help File Entry:

The NO_MORE_IRP_STACK_LOCATIONS bug check has a value of 0x00000035. This bug check occurs when the IoCallDriver packet has no more stack locations remaining.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Address of the IRP
2 Reserved
3 Reserved
4 Reserved

Cause

A higher-level driver has attempted to call a lower-level driver through the IoCallDriver interface, but there are no more stack locations in the packet. This will prevent the lower-level driver from accessing its parameters.

This is a disastrous situation, since the higher level driver is proceeding as if it has filled in the parameters for the lower level driver (as required). But since there is no stack location for the latter driver, the former has actually written off the end of the packet. This means that some other memory has been corrupted as well.

    WinDbg Output Example:
NO_MORE_IRP_STACK_LOCATIONS (35)
A higher level driver has attempted to call a lower level driver through
the IoCallDriver() interface, but there are no more stack locations in the
packet, hence, the lower level driver would not be able to access its
parameters, as there are no parameters for it.  This is a disasterous
situation, since the higher level driver "thinks" it has filled in the
parameters for the lower level driver (something it MUST do before it calls
it), but since there is no stack location for the latter driver, the former
has written off of the end of the packet.  This means that some other memory
has probably been trashed at this point.
Arguments:
Arg1: fffffa8011d42010, Address of the IRP
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000



STOP 0x00000036: DEVICE_REFERENCE_COUNT_NOT_ZERO    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818980.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557496(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DEVICE_REFERENCE_COUNT_NOT_ZERO bug check has a value of 0x00000036. This indicates that a driver attempted to delete a device object that still had a positive reference count.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the device object
2 Reserved
3 Reserved
4 Reserved

Cause

A device driver has attempted to delete one of its device objects from the system, but the reference count for that object was non-zero.

This means there are still outstanding references to the device. (The reference count indicates the number of reasons why this device object cannot be deleted.)

This is a bug in the calling device driver.

    WinDbg Output Example:
DEVICE_REFERENCE_COUNT_NOT_ZERO (36)
A device driver has attempted to delete one of its device objects from the
system but the reference count for that object was non-zero, meaning that
there are still outstanding references to the device.  (The reference count
indicates the number of reasons why this device object cannot be deleted.)
This is a bug in the calling device driver.
Arguments:
Arg1: 0000000000000000, Address of the device object
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000037: FLOPPY_INTERNAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818986.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557498(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The FLOPPY_INTERNAL_ERROR bug check has a value of 0x00000037.

This bug check appears very infrequently.

    WinDbg Output Example:
FLOPPY_INTERNAL_ERROR (37)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000038: SERIAL_DRIVER_INTERNAL    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818989.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558936(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SERIAL_DRIVER_INTERNAL bug check has a value of 0x00000038.

This bug check appears very infrequently.

    WinDbg Output Example:
SERIAL_DRIVER_INTERNAL (38)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000039: SYSTEM_EXIT_OWNED_MUTEX    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818992.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558941(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SYSTEM_EXIT_OWNED_MUTEX bug check has a value of 0x00000039. This indicates that the worker routine returned without releasing the mutex object that it owned.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the worker routine that caused the error.
2 The parameter passed to the worker routine.
3 The address of the work item.
4 Reserved.

Cause

The worker routine returned while it still owned a mutex object. The current worker thread will proceed to run other unrelated work items, and the mutex will never be released.

Resolving the Problem

A debugger is required to analyze this problem. To find the driver that caused the error, use the ln (List Nearest Symbols) debugger command:

kd> ln address

Where address is the worker routine given in Parameter 1.

    WinDbg Output Example:
SYSTEM_EXIT_OWNED_MUTEX (39)
Arguments:
Arg1: 8261f8fa
Arg2: 00000000
Arg3: 82746500
Arg4: 00000000


STOP 0x0000003A: SYSTEM_UNWIND_PREVIOUS_USER    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818995.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558945(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SYSTEM_UNWIND_PREVIOUS_USER bug check has a value of 0x0000003A.

This bug check appears very infrequently.

    WinDbg Output Example:
SYSTEM_UNWIND_PREVIOUS_USER (3a)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000003B: SYSTEM_SERVICE_EXCEPTION    (go to top of page)

Usual causes:  System service, Device driver, graphics driver, ?memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818997.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558949(v=VS.85).aspx

   Knowledge Base Articles:
KB 914215    Error message that is similar to the following when a volume is dismounted on a Windows Server 2003-based computer: "STOP 0x0000003B SYSTEM_SERVICE_EXCEPTION"
KB 918564    Error message after you install the Windows Server 2003 Scalable Networking Pack in Windows Server 2003: "STOP 0x0000008E" or "STOP: 0x0000003B"
KB 923187    Error message in x64-based versions of Windows Server 2003: "Stop 0x0000003B (c0000005, fffffadca82a63d4, fffffadca35fb4f0, 0)"
KB 941410    The computer crashes, and you receive a "Stop 0x0000003b" error message after you enable large image-based page files in Windows Server 2003
KB 951684    A computer that is running Windows Server 2008 for Itanium-Based Systems may restart unexpectedly when you hot-replace CPUs, and a Stop error message occurs: "0x0000003B"
KB 979762    Stop error in Windows Vista and in Windows Server 2008 when you try to print a document: "0x0000003B" or "0x0000007f"
KB 980932    "STOP 0x0000003B" Stop error on a computer that is running Windows 7 or Windows Server 2008 R2 when you use some IEEE 1394 devices
KB 2260182    "0x0000003B" Stop error may occur when you run an App-V application on a computer that has App-V RDS client installed and that is running Windows 7 or Windows Server 2008 R2
KB 2286188   Stop error when you try to wake the computer up from or try to enter hibernate (the S4 power state) or standby (the S3 power state) in Windows Vista or in Windows Server 2008: "Stop 0x0000003B SYSTEM_SERVICE_EXCEPTION"
KB 2359223    "0x0000003B" Stop error occurs in Windows Server 2008 R2 and in Windows 7 when an application or a service performs a GUI-related operation
KB 2487324    "0x0000003B" or "0x0000007f" Stop errors may occur when you try to print a document in Windows Server 2008 R2
KB 2518298   "0x0000003B" Stop error on a terminal server in Windows Server 2008
KB 2525246    "0x0000003B" Stop error when you remotely control a Remote Desktop session in Windows Server 2008 R2
KB 2584454    "0x0000003B" Stop error when you run certain applications in Windows 7 or in Windows Server 2008 R2
KB 2639032    "0x0000003B," "0x00000027," and "0x0000007e" Stop errors when a connection to a CSV is lost on a Windows Server 2008 R2-based failover cluster
KB 2666484    "0x0000003B" Stop error on Windows Server 2008 R2-based RD Session Host servers that use an RD Connection Broker
KB 2678763    When the Filestream feature is enabled in SQL Server 2008, you receive a Stop error, and the computer restarts unexpectedly
KB 2705742    "0x0000003B" Stop error when you use a Citrix XenApp application in Windows 7 or in Windows Server 2008 R2
KB 2719704    "0x0000003B" or "0x000000D5" Stop error in Windows 7 or in Windows Server 2008 R2
KB 2748302    Stop error when you use a Citrix XenApp application in Windows 7 or in Windows Server 2008 R2
KB 2780102    "0x0000003B" Stop error when a Remote Desktop Connection Broker and a Windows 7 SP1 or Windows Server 2008 R2 SP1-based computer are in an RDS farm
KB 2785338    "0x0000003b" Stop error when the memory usage of memory-mapped file is high in Windows 7 or Windows Server 2008 R2

    More STOP error messages at this search link:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000003b&x=7&y=14&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The SYSTEM_SERVICE_EXCEPTION bug check has a value of 0x0000003B. This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The exception that caused the bug check
2 The address of the exception record for the exception that caused the bug check
3 The address of the context record for the exception that caused the bug check
4 0

Cause

This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code.

    WinDbg Output Example:
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000124283, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88003f42ff0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.



STOP 0x0000003C: INTERRUPT_UNWIND_ATTEMPTED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819002.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558955(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INTERRUPT_UNWIND_ATTEMPTED bug check has a value of 0x0000003C.

This bug check appears very infrequently.

    WinDbg Output Example:
INTERRUPT_UNWIND_ATTEMPTED (3c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000003D: INTERRUPT_EXCEPTION_NOT_HANDLED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819004.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558963(v=VS.85).aspx

    Knowledge Base Articles:
KB 2494666    Stop errors may occur after you use the Driver Verifier manager to apply standard settings to all drivers in Windows 7 or in Windows Server 2008 R2

    WinDbg Help File Entry:

The INTERRUPT_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000003D.

This bug check appears very infrequently.

    WinDbg Output Example:
INTERRUPT_EXCEPTION_NOT_HANDLED (3d)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: fffffa6007024333



STOP 0x0000003E: MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED    (go to top of page)

Usual causes:  All processors aren't the same type and level

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819006.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558965(v=VS.85).aspx

    Knowledge Base Articles:
KB 973879    You receive a "Stop 0x0000003E" error message when you try to install Windows Vista Service Pack 2 or Windows Server 2008 Service Pack 2 on a computer that has certain multiple processors

    WinDbg Help File Entry:

The MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED bug check has a value of 0x0000003E. This indicates that the system has multiple processors, but they are asymmetric in relation to one another.

Parameters

None

Cause

In order to be symmetric, all processors must be of the same type and level. This system contains processors of different types (for example, a Pentium processor and an 80486 processor).

    WinDbg Output Example:
MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED (3e)
The system has multiple processors, but they are asymmetric in relation
to one another.  In order to be symmetric all processors must be of
the same type and level.  For example, trying to mix a Pentium level
processor with an 80486 would cause this bugcheck.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000003F: NO_MORE_SYSTEM_PTES    (go to top of page)

Usual causes:  Device driver, Video driver, backup utilities, disk-intensive applications

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819008.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558968(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x3f

    Knowledge Base Articles:
KB 145882    STOP 0x3f and events 1001 and 2021 appear on heavily used IIS (Server 2008)
KB 256004    How to troubleshoot "STOP 0x0000003F" and "STOP 0x000000D8" error messages in Windows Server 2003, Windows XP, and Windows 2000
KB 294301    How to troubleshoot fatal system errors in Access 2002 running on Microsoft Windows 2000
KB 304101    Backup program is unsuccessful when you back up a large system volume (NT Server, 2000 Server, Server 2003)
KB 955033    Stop 0x0000003F or STOP 0x000000D8 occurs on Windows Server 2003 computer with Veritas Backup installed
   
     WinDbg Help File Entry:

The NO_MORE_SYSTEM_PTES bug check has a value of 0x0000003F. This is the result of a system which has performed too many I/O actions. This has resulted in fragmented system page table entries (PTE).

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 0: system expansion PTE type

1: nonpaged pool expansion PTE type

2 Size of memory request
3 Total free system PTEs
4 Total system PTEs

Cause

In almost all cases, the system is not actually out of PTEs. Rather, a driver has requested a large block of memory, but there is no contiguous block of sufficient size to satisfy this request.

Often video drivers will allocate large amounts of kernel memory that must succeed. Some backup programs do the same.

Resolving the Problem

A possible work-around: Modify the registry to increase the total number of system PTEs. If this does not help, remove any recently-installed software, especially backup utilities or disk-intensive applications.

Debugging the problem: The following method can be used to debug bug check 0x3F.

First, get a stack trace, and use the !sysptes 3 extension command.

Then set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\TrackPtes equal to DWORD 1, and reboot. This will cause the system to save stack traces.

This allows you to display more detailed information about the PTE owners. For example:

0: kd> !sysptes 4

0x2c47 System PTEs allocated to mapping locked pages

VA       MDL     PageCount  Caller/CallersCaller
f0e5db48 eb6ceef0        1 ntkrpamp!MmMapLockedPages+0x15/ntkrpamp!IopfCallDriver+0x35
f0c3fe48 eb634bf0        1 netbt!NbtTdiAssociateConnection+0x1f/netbt!DelayedNbtProcessConnect+0x17c
f0db38e8 eb65b880        1 mrxsmb!SmbMmAllocateSessionEntry+0x89/mrxsmb!SmbCepInitializeExchange+0xda
f8312568 eb6df880        1 rdbss!RxCreateFromNetRoot+0x3d7/rdbss!RxCreateFromNetRoot+0x93
f8363908 eb685880        1 mrxsmb!SmbMmAllocateSessionEntry+0x89/mrxsmb!SmbCepInitializeExchange+0xda
f0c54248 eb640880        1 rdbss!RxCreateFromNetRoot+0x3d7/rdbss!RxCreateFromNetRoot+0x93
f0ddf448 eb5f3160        1 mrxsmb!MrxSmbUnalignedDirEntryCopyTail+0x387/mrxsmb!MRxSmbCoreInformation+0x36
f150bc08 eb6367b0        1 mrxsmb!MrxSmbUnalignedDirEntryCopyTail+0x387/mrxsmb!MRxSmbCoreInformation+0x36
f1392308 eb6fba70        1 netbt!NbtTdiOpenAddress+0x1fb/netbt!DelayedNbtProcessConnect+0x17c
eb1bee64 edac5000      200 VIDEOPRT!pVideoPortGetDeviceBase+0x118/VIDEOPRT!VideoPortMapMemory+0x45
f139b5a8 edd4b000       12 rdbss!FsRtlCopyWrite2+0x34/rdbss!RxDriverEntry+0x149
eb41f400 ede92000       20 VIDEOPRT!pVideoPortGetDeviceBase+0x139/VIDEOPRT!VideoPortGetDeviceBase+0x1b
eb41f198 edf2a000       20 NDIS!NdisReadNetworkAddress+0x3a/NDIS!NdisFreeSharedMemory+0x58
eb41f1e4 eb110000       10 VIDEOPRT!pVideoPortGetDeviceBase+0x139/VIDEOPRT!VideoPortGetDeviceBase+0x1b
......

If the system runs out of PTEs again after the TrackPtes registry value has been set, bug check 0xD8 (DRIVER_USED_EXCESSIVE_PTES) will be issued instead of 0x3F. The name of the driver causing this error will be displayed as well.

    WinDbg Output Example:
NO_MORE_SYSTEM_PTES (3f)
No System PTEs left.  Usually caused by a driver not cleaning up
properly.  If kernel debugger available get stack trace and
"!sysptes 3".
Set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\TrackPtes
to a DWORD 1 value and reboot.  Then the system will save stack traces
so the guilty driver can be identified.  There is no other way to find out
which driver is neglecting to clean up the I/Os.
A bugcheck DRIVER_USED_EXCESSIVE_PTES will then occur if the system runs out of
PTEs again and the offending driver's name will be printed.
Arguments:
Arg1: 0000000000000000, PTE Type (0 - system expansion, 1 nonpaged pool expansion)
Arg2: 0000000000000000, Requested size
Arg3: 0000000000000000, Total free system PTEs
Arg4: 0000000000000000, Total system PTEs


STOP 0x00000040: TARGET_MDL_TOO_SMALL    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819198.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558972(v=VS.85).aspx

    Knowledge Base Articles:
KB 187302    Stop 0x00000040 in NetBT Protocol (NT)
KB 967787    Stop error message when you have the TCP Chimney feature enabled and the TCP transfer buffer size is set to 32 MB in Windows Vista, Windows Server 2008, or Windows Server 2003: "Stop 0x00000040 TARGET_MDL_TOO_SMALL"
   
    WinDbg Help File Entry:

The TARGET_MDL_TOO_SMALL bug check has a value of 0x00000040. This indicates that a driver has improperly used IoBuildPartialMdl.

Parameters

None

Cause

This is a driver bug. A driver has called the IoBuildPartialMdl function and passed it an MDL to map part of a source MDL, but the target MDL is not large enough to map the entire range of addresses requested.

Resolving the Problem

The source and target MDLs, as well as the address range length to be mapped, are the first, second, and fourth arguments to the IoBuildPartialMdl function. Therefore, doing a stack trace on this particular function might help during the debugging process. Ensure that your code is correctly calculating the necessary size for the target MDL for the address range length that you are passing to this function.

    WinDbg Output Example:
TARGET_MDL_TOO_SMALL (40)
A driver has called the IoBuildPartialMdl() function and passed it an MDL
to map part of a source MDL, but the target MDL is not large enough to map
the entire range of addresses requested.  This is a driver bug.  The source
and target MDLs, as well as the address range length to be mapped are the
arguments to the IoBuildPartialMdl() function, i.e.;
    IoBuildPartialMdl(
        IN PMDL SourceMdl,
        IN OUT PMDL TargetMdl,
        IN PVOID VirtualAddress,
        IN ULONG Length
        )
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000041: MUST_SUCCEED_POOL_EMPTY    (go to top of page)

Usual causes:  Device driver, ?memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819202.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558974(v=VS.85).aspx

    Knowledge Base Articles:
KB 833213    You receive a "STOP 0x00000041" error message on a computer that is running Windows NT Server 4.0
KB 904375    You receive a "STOP 0x00000041 MUST_SUCCEED_POOL_EMPTY" error message on a Windows 2000 Service Pack 4-based computer
   
    WinDbg Help File Entry:

The MUST_SUCCEED_POOL_EMPTY bug check has a value of 0x00000041. This indicates that a kernel-mode thread has requested too much must-succeed pool.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The size of the request that could not be satisfied
2 The number of pages used from nonpaged pool
3 The number of requests from nonpaged pool larger than PAGE_SIZE
4 The number of pages available

Cause

In Microsoft Windows 2000, only a small amount of must-succeed pool is permitted. In Windows XP and later, no driver is permitted to request must-succeed pool.

If a must-succeed request cannot be filled, this bug check is issued.

Resolving the Problem

Replace or rewrite the driver which is making the request. A driver should not request must-succeed pool. Instead, it should ask for normal pool and gracefully handle the scenario where the pool is temporarily empty.

The kb (Display Stack Backtrace) command will show the driver that caused the error.

Additionally, it is possible that a second component has depleted the must-succeed pool. To determine if this is the case, first use the kb command. Then use !vm 1 to display total pool usage, !poolused 2 to display per-tag nonpaged pool usage, and !poolused 4 to display per-tag paged pool usage. The component associated with the tag using the most pool is probably the source of the problem.

    WinDbg Output Example:
MUST_SUCCEED_POOL_EMPTY (41)
No component should ever ask for must-succeed pool as if there is none left,
the system crashes.  Instead, components should ask for normal pool and
gracefully handle the scenario where the pool is temporarily empty.  This
bugcheck definitely reveals a bug in the caller (use kb to identify the caller).
In addition, the fact that the pool is empty may be either a transient condition
or possibly a leak in another component (distinguish between the 2 cases by
following the directions below).
Type kb to show the calling stack.
Type !vm 1 to display total pool usage.
Then type !poolused 2 to display per-tag nonpaged pool usage.
Then type !poolused 4 to display per-tag paged pool usage.
The crash should be looked at by the tag owner that is consuming the most pool.
Arguments:
Arg1: 0000000000000000, size of the request that could not be satisfied
Arg2: 0000000000000000, number of pages used of nonpaged pool
Arg3: 0000000000000000, number of > PAGE_SIZE requests from nonpaged pool
Arg4: 0000000000000000, number of pages available


STOP 0x00000042: ATDISK_DRIVER_INTERNAL    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819204.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558976(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The ATDISK_DRIVER_INTERNAL bug check has a value of 0x00000042.

This bug check appears very infrequently.

    WinDbg Output Example:
ATDISK_DRIVER_INTERNAL (42)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000043: NO_SUCH_PARTITION    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819206.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558978(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The NO_SUCH_PARTITION bug check has a value of 0x00000043.

This bug check appears very infrequently.

    WinDbg Output Example:
NO_SUCH_PARTITION (43)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000044: MULTIPLE_IRP_COMPLETE_REQUESTS    (go to top of page)

Usual causes:  Device driver(s)

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819207.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558982(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x44

    Knowledge Base Articles:
KB 294876    "Stop 0x00000044 Multiple_IRP_Complete_Requests" Error Message During a Shutdown or Standby Operation (2000)
KB 296734    STOP 0x00000044 Error Message Appears While You Are Using MSMQ (2000)
KB 832212    "Stop 0x00000044" error message when the HP Insight Management Agent is configured (2000, Server 2003)
KB 839619    You receive a "Stop 0x00000044 Multiple_IRP_Complete_Requests" error message on Windows XP Professional
KB 867774    "Stop 0x00000044" error message on a Windows 2000-based computer that uses a Gigabit network adapter
KB 930570    Error message in the Usbhub.sys process when you wake a Windows Vista-based computer from sleep or from hibernation: "STOP 0x00000044"
KB 935192    Error message when you resume a Windows XP-based computer from hibernation after you apply hotfix 918005: "Stop 0x00000044" or “Stop 0x000000F4”
KB 942528    You randomly receive a "STOP 0x00000044" error message after you install a third-party program on a Windows Server 2003-based computer
KB 973056    Stop 0x44 (MULTIPLE_IRP_COMPLETE_REQUESTS) Disabling Idle USB Device with KMDF-based Driver (Vista)
KB 977694    Stop error message when you access shared files in Windows Server 2008 or in Windows Vista: 0x00000044 or 0x000000CC
KB 980143    "0x00000044" Stop error message when you use MPIO DSM in Windows Server 2008 R2 to manage a storage device that is connected by Fibre Channel or by Fibre Channel over Ethernet
KB 2549724   "0x00000044" Stop error when you access shared files in Windows Server 2008 R2 or in Windows 7
KB 2552033    "0x00000044" Stop error on a computer that is running Windows 7 or Windows Server 2008 R2

    WinDbg Help File Entry:

The MULTIPLE_IRP_COMPLETE_REQUESTS bug check has a value of 0x00000044. This in2280732228073222807322280732dicates that a driver has tried to requested an IRP be completed that is already complete.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the IRP
2 Reserved
3 Reserved
4 Reserved

Cause

A driver has called IoCompleteRequest to ask that an IRP be completed, but the packet has already been completed.

Resolving the Problem

This is a tough bug to find because the simplest case — a driver that attempted to complete its own packet twice — is usually not the source of the problem. More likely, two separate drivers each believe that they own the packet, and each has attempted to complete it. The first request succeeds, and the second fails, resulting in this bug check.

Tracking down which drivers in the system caused the error is difficult, because the trail of the first driver has been covered by the second. However, the driver stack for the current request can be found by examining the device object fields in each of the stack locations.

    WinDbg Output Example:
MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed.  This is a tough bug to find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened.  Rather, two separate drivers each
believe that they own the packet, and each attempts to complete it.  The
first actually works, and the second fails.  Tracking down which drivers
in the system actually did this is difficult, generally because the trails
of the first driver have been covered by the second.  However, the driver
stack for the current request can be found by examining the DeviceObject
fields in each of the stack locations.
Arguments:
Arg1: 0000000000000000, Address of the IRP
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000045: INSUFFICIENT_SYSTEM_MAP_REGS    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819209.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558984(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INSUFFICIENT_SYSTEM_MAP_REGS bug check has a value of 0x00000045.

This bug check appears very infrequently.

    WinDbg Output Example:
INSUFFICIENT_SYSTEM_MAP_REGS (45)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000046: DEREF_UNKNOWN_LOGON_SESSION    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819211.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558987(v=VS.85).aspx

    Knowledge Base Articles:
KB 157936    SMC9232N Driver Causing Multiple STOP Messages (NT)

    WinDbg Help File Entry:

The DEREF_UNKNOWN_LOGON_SESSION bug check has a value of 0x00000046.

This bug check appears very infrequently.

    WinDbg Output Example:
DEREF_UNKNOWN_LOGON_SESSION (46)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000047: REF_UNKNOWN_LOGON_SESSION    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819213.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558991(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The REF_UNKNOWN_LOGON_SESSION bug check has a value of 0x00000047.

This bug check appears very infrequently.

    WinDbg Output Example:
REF_UNKNOWN_LOGON_SESSION (47)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000048: CANCEL_STATE_IN_COMPLETED_IRP    (go to top of page)

Usual causes:  Device driver(s)

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819214.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558993(v=VS.85).aspx

    Knowledge Base Articles:
KB 308605    Stop 0x00000048 or Stop 0x0000000A Caused By Named Pipe File System (Npfs.sys) (NT)
KB 331484    "Stop 0x00000048" occurs when you stop the Computer Browser service (2000)
KB 983169    "Stop error code 0x00000048 CANCEL_STATE_IN_COMPLETED_IRP" error message in Windows Server 2003 Service Pack 2

    WinDbg Help File Entry:

The CANCEL_STATE_IN_COMPLETED_IRP bug check has a value of 0x00000048. This indicates that an I/O request packet (IRP) was completed, and then was subsequently canceled.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 A pointer to the IRP
2 The cancel routine set by the driver
3 Reserved
4 Reserved

Cause

An IRP that had a Cancel routine set was completed normally, without cancellation. But after it was complete, a driver called the IRP's Cancel routine.

This could be caused by a driver that completed the IRP and then attempted to cancel it.

It could also be caused by two drivers each trying to access the same IRP in an improper way.

Resolving the Problem

The cancel routine parameter can be used to determine which driver or stack caused the bug check.

    WinDbg Output Example:
CANCEL_STATE_IN_COMPLETED_IRP (48)
This bugcheck indicates that an I/O Request Packet (IRP) that is to be
cancelled, has a cancel routine specified in it -- meaning that the packet
is in a state in which the packet can be cancelled -- however, the packet
no longer belongs to a driver, as it has entered I/O completion.  This is
either a driver bug, or more than one driver is accessing the same packet,
which is not likely and much more difficult to find. The cancel routine
parameter will provide a clue as to which driver or stack is the culprit.
Arguments:
Arg1: 0000000000000000, Pointer to the IRP
Arg2: 0000000000000000, Cancel routine set by the driver.
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000049: PAGE_FAULT_WITH_INTERRUPTS_OFF    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819216.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558996(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PAGE_FAULT_WITH_INTERRUPTS_OFF bug check has a value of 0x00000049.

This bug check appears very infrequently.

    WinDbg Output Example:
PAGE_FAULT_WITH_INTERRUPTS_OFF (49)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000004A: IRQL_GT_ZERO_AT_SYSTEM_SERVICE    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819218.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559001(v=VS.85).aspx
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/10/31/debugging-stop-0x4a-user-mode-and-irql-levels/
        https://bsodtutorials.wordpress.com/2013/11/28/debugging-stop-0x4a-updated-version/

    Knowledge Base Articles:
KB 969873    A Stop error occurs when you profile an application in Visual Studio 2008 SP1 on a computer that uses an AMD processor and has Hyper-V enabled


    WinDbg Help File Entry:

The IRQL_GT_ZERO_AT_SYSTEM_SERVICE bug check has a value of 0x0000004A. This indicates that a thread is returning to user mode from a system call when its IRQL is still above PASSIVE_LEVEL.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the system function (system call routine)
2 The current IRQL
3 0
4 0

    WinDbg Output Example:
IRQL_GT_ZERO_AT_SYSTEM_SERVICE (4a)
Returning to usermode from a system call at an IRQL > PASSIVE_LEVEL.
Arguments:
Arg1: 0000000077b90aca, Address of system function (system call routine)
Arg2: 000000000000000c, Current IRQL
Arg3: 0000000000000000, 0
Arg4: fffff98013565ca0, 0


STOP 0x0000004B: STREAMS_INTERNAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819221.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559007(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The STREAMS_INTERNAL_ERROR bug check has a value of 0x0000004B.

This bug check appears very infrequently.

    WinDbg Output Example:
STREAMS_INTERNAL_ERROR (4b)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000004C: FATAL_UNHANDLED_HARD_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819224.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559010(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The FATAL_UNHANDLED_HARD_ERROR bug check has a value of 0x0000004C.

This bug check appears very infrequently.

    WinDbg Output Example:
FATAL_UNHANDLED_HARD_ERROR (4c)
If a hard error occurs during system booting before windows is up, and
the hard error is a real error, the system will blue screen crash.
Some common cases are:
    x218 - This means a necessary registry hive file could not be
           loaded.  The obvious reason is if it is corrupt or missing.
           In this case, either the Emergency Repair Disk or a
           reinstall is required.
           Some less obvious reasons are that the driver has corrupted
           the registry data while loading into memory, or the memory
           where the registry file was loaded is not actually memory.
    x21a - This means that either winlogon, or csrss (windows) died
           unexpectedly.  The exit code tells more information.  Usually
           it is c0000005 meaning that an unhandled exception crashed
           either of these processes.
    x221 - This means that a driver is corrupt, or a system DLL was
           detected to be corrupt.
           Safeboot or boot an alternate OS (or reinstall)
           and then make sure the on disk file that is listed as bad
           matches the version on CD and replace if necessary.  In some
           cases, random corruption can mean that there is a hardware
           problem in the I/O path to the file.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000004D: NO_PAGES_AVAILABLE    (go to top of page)

Usual causes:  Device driver, memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms841500.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559012(v=VS.85).aspx

    Knowledge Base Articles:
KB 907419    A computer that is running Windows Powered Network-Attached Storage 2.01 may stop responding
KB 960772    The system may generate Stop error 0x4D when an application uses the VirtualLock function to lock pages in Windows Server 2003 or in Windows XP Professional x64 Edition

    WinDbg Help File Entry:

The NO_PAGES_AVAILABLE bug check has a value of 0x0000004D. This indicates that no free pages are available to continue operations.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The total number of dirty pages
2 The number of dirty pages destined for the page file
3 Windows XP and Windows 2000: The size of the nonpaged pool available at the time the bug check occurred

Windows Server 2003 and later: Reserved

4 Windows 2000: The number of transition pages that are currently stranded

Windows XP and later: The most recent modified write error status.


Cause

To see general memory statistics, use the !vm 3 extension.

This bug check can occur for any of the following reasons:

If the problem cannot be found, then try booting with a kernel debugger attached from the beginning, and monitor the situation.

    WinDbg Output Example:
NO_PAGES_AVAILABLE (4d)
No free pages available to continue operations.
If kernel debugger available "!vm 3".
        This bugcheck can occur for the following reasons:
        1.  A driver has blocked, deadlocking the modified or mapped
            page writers.  Examples of this include mutex deadlocks or
            accesses to paged out memory in filesystem drivers, filter
            drivers, etc.  This indicates a driver bug.
            If parameter 1 or 2 is large, then this is a possibility.  Type
            "!vm 3" in the kernel debugger.
        2.  The storage driver(s) are not processing requests.  Examples
            of this are stranded queues, non-responding drives, etc.  This
            indicates a driver bug.
            If parameter 1 or 2 is large, then this is a possibility.  Type
            "!process 0 7" in the kernel debugger.
        3.  Not enough pool is available for the storage stack to write out
            modified pages.  This indicates a driver bug.
            If parameter 3 is small, then this is a possibility.  Type
            "!vm" and "!poolused 2" in the kernel debugger.
        4.  A high priority realtime thread has starved the balance set
            manager from trimming pages and/or starved the modified writer
            from writing them out.  This indicates a bug in the component
            that created this thread.
            This one is hard to determine, try "!ready"
        5.  All the processes have been trimmed to their minimums and all
            modified pages written, but still no memory is available.  The
            freed memory must be stuck in transition pages with non-zero
            reference counts - thus they cannot be put on the freelist.
            A driver is neglecting to unlock the pages preventing the
            reference counts from going to zero which would free the pages.
            This may be due to transfers that never finish and the driver
            never aborts or other driver bugs.
            If parameter 4 is large, then this is a possibility.  But it
            is very hard to find the driver.  Try "!process 0 1" and look
            for any that have a lot of locked pages.
If the problem cannot be found, then try booting with /DEBUG and a kernel
debugger attached, so if it reproduces, a debug session can be initiated
to identify the cause.
Arguments:
Arg1: 0000000000000000, Total number of dirty pages
Arg2: 0000000000000000, Number of dirty pages destined for the pagefile(s).
Arg3: 0000000000000000, Internal flags.
Arg4: 0000000000000000, Most recent modified write error status.


STOP 0x0000004E: PFN_LIST_CORRUPT    (go to top of page)

Usual causes:  Device driver, ?memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms841511.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559014(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x4e
    OSROnline Listing:  http://www.osronline.com/article.cfm?article=334
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/09/30/debugging-stop-0x4e-bad-share-count/

    Knowledge Base Articles:
KB 139281    STOP Msg: 0x0000004E or 0x0000000A Under Heavy Computer Usage (NT)
KB 920872    Audio playback does not play the audio file from the correct position after you pause it, and you randomly receive a Stop error message when you try to play audio files in Windows XP Service Pack 2 (SP2)
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)
KB 2447725    "0x00000004E" Stop error occurs when some users try to access shared files in Windows Server 2008 or in Windows Vista
KB 2853579    "0x0000004E" Stop error when shadow copying fails on a computer that is running Windows Server 2012

    WinDbg Help File Entry:

The PFN_LIST_CORRUPT bug check has a value of 0x0000004E. This indicates that the page frame number (PFN) list is corrupted.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x01 The ListHead value that was corrupted The number of pages available 0 The list head was corrupt.
0x02 The entry in the list that is being removed The highest physical page number The reference count of the entry being removed A list entry was corrupt.
0x07 The page frame number The current share count 0 A driver has unlocked a certain page more times than it locked it.
0x8F New page number Old page number 0 The free or zeroed page listhead is corrupt.
0x99 Page frame number Current page state 0 A page table entry (PTE) or PFN is corrupt.
0x9A Page frame number Current page state The reference count of the entry that is being removed A driver attempted to free a page that is still locked for IO.

Cause

This error is typically caused by a driver passing a bad memory descriptor list. For example, the driver might have called MmUnlockPages twice with the same list.

If a kernel debugger is available, examine the stack trace.

    WinDbg Output Example:
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0008dd83, page frame number
Arg3: 00000002, current page state
Arg4: 0008de02, 0


STOP 0x0000004F: NDIS_INTERNAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms841523.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559017(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x4f

    Knowledge Base Articles:

    WinDbg Help File Entry:

The NDIS_INTERNAL_ERROR bug check has a value of 0x0000004F.

This bug check appears very infrequently.

    WinDbg Output Example:
NDIS_INTERNAL_ERROR (4f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA    (go to top of page)

Usual causes:  Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus,  Device driver, NTFS corruption, BIOS

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms841534.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559023(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x50
    OSROnline Listing:  http://www.osronline.com/article.cfm?article=335
    Other Articles:
        https://bsodtutorials.wordpress.com/2014/04/11/debugging-stop-0x50-a-few-little-clues/

    Knowledge Base Articles:
KB 171003    "Stop 0x50" Error Message While Installing Windows (NT, 2000)
KB 196389    STOP 0x0000000A or STOP 0x00000050 in NTOSKRNL.EXE (NT)
KB 250975    STOP Errors When Running MITAC 6133 Laptop on Battery Power (2000)
KB 252192    "Stop 0x00000050" in Ntfs.sys Under Stress Accessing Freed FCB (2000)
KB 286154    STOP 0X0000001E in Protcls.sys When You Undock a Toshiba Tecra 8100 (XP)
KB 310628    Easy CD Creator 5.0 does not function in Windows XP
KB 315335    "STOP 0x0000008e" error message during Windows XP setup
KB 317153    Stop 0x0000001e or Stop 0x00000050 Error in Navap.sys When You Use Norton AutoProtect Feature (NT Server, 2000 Server)
KB 323256    Stop 0x50 Error Message When You Rename a Large Number of Files on Windows 2000
KB 326189    "Stop" Errors Occur in ObpDestroySecurityDescriptorHeader (NT Server)
KB 329293    STOP: 0x00000050 Page_Fault_In_Non-Paged_Area Error After Installing Service Pack 1 (SP1) (XP)
KB 329772    "Stop error code 0x00000050" occurs when you start the computer for the first time (2000)
KB 810982    "Stop error code 0x00000050 (PAGE_FAULT_IN_NON_PAGED_AREA)" error message in Sentinel.sys when you start your computer (2000)
KB 811016    "Stop error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA)" when you use a PC card (2000)
KB 812343    Network activity causes your computer to stop responding, and you receive "Stop error code 0x00000050 (FAULT_IN_NONPAGED_AREA)" (2000)
KB 830848    Windows Server 2003 crashes intermittently, and you receive a "Stop error code 0x00000050" error message
KB 831239    "Stop error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA) in ppbint.dll" error message when you open a document (NT, 2000)
KB 883516    You receive Stop error code 0x00000019 or Stop error code 0x00000050 in the Tcpip.sys file on a Windows 2000 Server-based computer
KB 889681    You receive a "Stop error code 0x00000050" error message on your Windows 2000-based computer
KB 894278    The computer may automatically restart, or you may receive a "serious error" message or a Stop error message in Windows Server 2003, in Windows XP, or in Windows 2000
KB 903251    You may receive an error message on a Windows-based computer: "STOP 0x00000050" or "STOP 0x0000008e" (2000, XP, Server 2003)
KB 911028    When you use a 32-bit program to print a document from a 64-bit version of Microsoft Windows, you may receive a Stop error message, or objects on the page are omitted (XP, Server 2003)
KB 923150    When you restart Windows Server 2003 after you use the Driver Verifier utility, you may receive a Stop error: "STOP 0x00000050" or "STOP 0x000000F4"
KB 929637    Error message during Windows Vista startup if the Nero InCD program is installed and if the "Special pool" feature is enabled in the Driver Verifier utility: "Stop 00000050"
KB 950298    Error message on a Windows Server 2003-based file server: "Stop error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA)"
KB 951418    Stop error in Win7 and in Win2008 R2: "0x00000050 PAGE_FAULT_IN_NONPAGED_AREA"
KB 951880    Stop error when Windows Server 2003-based server restarts unexpectedly: "Stop 0x00000050"
KB 952844    You receive a "STOP: 0x00000050" error message when you start a Windows Server 2003-based computer by using the iSCSI Boot Initiator
KB 955066    Windows Server 2003 Terminal Server may crash during the terminal session logoff process, and you may receive a Stop error message: "Stop error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA)"
KB 955803    Stop error during the shutdown process on a Windows Server 2008 or Windows Vista SP1-based computer: "Stop 0x00000050"
KB 956182    Stop error message when you try to perform directory listing of a NFS share that is mounted on a Windows Server 2008-based NFS client: "STOP 0x00000050"
KB 957187    Stop error if you use some OpenType fonts on a computer that is running Windows Server 2003, Windows Vista, or Windows Server 2008: "Stop error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA)"
KB 957319    You receive a "Stop 0x00000050" or "Stop 0x0000008E" error message when you restart a Windows XP-based computer
KB 958282    Stop error message when an application calls the NtGdiRectInRegion function on a Windows XP-based computer: "Stop 0x00000050"
KB 958867    You receive a "Stop 0x00000050" or "Stop 0x0000000A" error message when you hot-replace memory on a Windows Server 2008-based computer
KB 959338    You receive a PAGE_FAULT_IN_NONPAGED_AREA Stop error when you print a document from a Windows Server 2003 server that is running as a terminal server
KB 959828   Stop error on a Windows Server 2003 SP2-based terminal server or a Windows Server 2008 SP2-based terminal server when users print documents in terminal sessions: "0x0000008E" or "0x00000050"
KB 960852    Stop error when an application calls the SystemParametersInfo function on a Windows Server 2003-based computer: "0x00000050"
KB 960882    Error message when a Windows Server 2003-based computer is shutting down: "Stop 0x000000CE" or "Stop 0x00000050"
KB 961799    A Stop error occurs on a Windows Server 2003-based server when a user accesses shared files on the server by using an SMB connection
KB 965497    You receive the Stop error 0x00000050 and then the computer restarts automatically if the OpenFileById function opens a folder and then the handle returned is used to rename files on a computer that is running Windows Server 2008 or Windows Vista
KB 966319    During user logon or logoff, you receive stop error code 0x00000050, and the system restarts automatically on a computer that is running Windows Server 2008 or Windows Vista SP1
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)
KB 970694 (not working)  "Stop 0x50" error - Enabling/disabling Bluetooth on Vista with Feature Pack for Wireless
KB 971075    Error message on a computer that runs Windows Server 2003 or Windows XP x64 Edition: "Stop 0x00000050"
KB 971251    Stop error code on a computer that is running Windows Server 2003 Service Pack 2: "0x00000050"
KB 973092    Stop error code occurs on a computer that is running Windows Server 2003 Service Pack 2: "0x00000050 PAGE_FAULT_IN_NONPAGED_AREA"
KB 973350 (Link Not Working)  "Stop 0x50" error - Enabling/disabling Bluetooth on Vista/Server 2008
KB 973618    Stop error when a surprise removal of a USB host controller occurs on a computer that is running Windows Server 2003: "Stop 0x00000050"
KB 974560    Error message during stress tests on a computer that is running Windows 7 if Driver Verifier is enabled: "Stop 0x00000050"
KB 975070    Error message after you apply update 973879: "Stop 0x0000007e" or "Stop 0x00000050" (Vista, Server 2008)
KB 975192    Error message after you enable or disable Microsoft Bluetooth Enumerator in Device Manager on a Windows Vista-based computer that has Windows Vista Feature Pack for Wireless installed: “Stop 0x00000050”
KB 975986    Stop error message on a computer that is running Windows Server 2003 SP2 and that has almost 4 GB or more of physical memory: "0x00000050" or "0x0000000A"
KB 976452    Error message on a blue screen when you perform an operation to a DFS server from a computer that is running Windows Vista or Windows Server 2008: "PAGE_FAULT_IN_NONPAGED_AREA"
KB 976748    Stop error code after you install Microsoft Multipath I/O (MPIO) on a computer that is running Windows Server 2008: "0x000000D1" or "0x00000050"
KB 979538    "Stop 0x0000007E" or "Stop 0x00000050" Stop error message in Windows 7 or Windows Server 2008 R2
KB 980135    Stop error message if under heavy load in Windows Server 2008 and in Windows Vista: "Stop 0x00000050"
KB 981471    Stop error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA) in Windows Server 2003 SP2
KB 987574    You may receive a Stop error message after you insert media into a removable disk device in Windows XP, Windows Server 2003, or Windows 2000
KB 2028815    "0x00000050" Stop error message occurs when you use multiple volume managers in Windows Server 2008
KB 2279561    "0x00000050" Stop error occurs on a terminal server that is running Windows Server 2003 if a user mode printer driver is used in a terminal server session
KB 2280072    "0x00000050" Stop error on a computer that is running Windows Vista or Windows Server 2008
KB 2460912    "0x0000007E" or "0x00000050" Stop error when you create snapshots of a volume in Windows Server 2008 R2 or in Windows 7
KB 2516405    "0x00000050" Stop error occurs when you run an application that uses the RegSetValueEx function on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2633799    You randomly receive various Stop errors when you change the network adapter teaming configuration in Windows Server 2008 or in Windows Vista
KB 2637924    "0x00000050" Stop error when you disconnect a HID during the system startup process in Windows 7 or in Windows Server 2008 R2
KB 2691226    Stop 0x50 on Windows Server 2008 R2 with RealVNC VNC Server 4.6 (Windows 7 also)
KB 2695584    "0x0000007E" or "0X00000050" Stop error when you run the Common Scenario Stress with IO test in Windows 7 or in Windows Server 2008 R2
KB 2709236    0x00000050 Stop error when Windows tries to back up registry hives on a computer that is running Windows Vista SP2 or Windows Server 2008 SP2
KB 2719594    "0x00000050" Stop error in Windows 7 or in Windows Server 2008 R2
KB 2727941    "0x00000050" Stop error when you create a volume snapshot in Windows Vista, in Windows Server 2008, in Windows 7 or in Windows Server 2008 R2
KB 2781406    "0x00000050" Stop error and an automatic restart on a Windows Server 2008 R2-based computer
KB 2787113    "0x00000050" Stop error when you create a snapshot by using the VSS in Windows Vista or in Windows Server 2008
KB 2788573    "0x00000050" Stop error when you run a WFP-based application to register a callout routine in Windows 7 or Windows Server 2008 R2
KB 2795491    "0x00000050" Stop error after a registry hive that contains many registry entries and subkeys is loaded in Windows Server 2008 SP2
KB 2824200    "0x00000024" or "0x00000050" Stop error on a computer that is running Windows Vista or Windows Server 2008
KB 2834026    "0x00000050" Stop error when you try to create a virtual machine or copy a VHD or VHDX file to a SMB share in Windows Server 2012
KB 2834140    "0x00000050" Stop error after you install update 2670838 on a computer that is running Windows 7 SP1 or Windows Server 2008 R2 SP1
KB 2902124    Stop error 0x50 occurs in Ndis.sys on a Windows 8-based or Windows Server 2012-based computer (0xD5 when running Verifier)
KB 2931772    "0x00000050" Stop error on the terminal server that is running Windows 7 SP1 or Windows Server 2008 R2 SP1 when a session is disconnected

    Many more STOP errors in this search:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x00000019&x=10&y=3&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The PAGE_FAULT_IN_NONPAGED_AREA bug check has a value of 0x00000050. This indicates that invalid system memory has been referenced.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read operation

1: Write operation

3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).

Another common cause is the installation of a faulty system service.

Antivirus software can also trigger this error, as can a corrupted NTFS volume.

Resolving the Problem

Resolving a faulty hardware problem: If hardware has been added to the system recently, remove it to see if the error recurs. If existing hardware has failed, remove or replace the faulty component. You should run hardware diagnostics supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer.

Resolving a faulty system service problem: Disable the service and confirm that this resolves the error. If so, contact the manufacturer of the system service about a possible update. If the error occurs during system startup, restart your computer, and press F8 at the character-mode menu that displays the operating system choices. At the resulting Windows Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time.

Resolving an antivirus software problem: Disable the program and confirm that this resolves the error. If it does, contact the manufacturer of the program about a possible update.

Resolving a corrupted NTFS volume problem: Run Chkdsk /f /r to detect and repair disk errors. You must restart the system before the disk scan begins on a system partition. If the hard disk is SCSI, check for problems between the SCSI controller and the disk.

Finally, check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. Disabling memory caching of the BIOS might also resolve it.

Comments

Typically, this address is in freed memory or is simply invalid.

This cannot be protected by a try - except handler — it can only be protected by a probe.

    WinDbg Output Example:
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffe0d408, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 9712ebd2, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 00000000, (reserved)


STOP 0x00000051: REGISTRY_ERROR    (go to top of page)

Usual causes:  Hardware failure, File system corruption, Security issues

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms841638.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559026(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x51

    Knowledge Base Articles:
KB 321771    You Receive a "Stop 0x51 (REGISTRY_ERROR)" Error Message (2000)
KB 810558    "Stop 0x00000051 REGISTRY_ERROR" Error Message When You Back Up the Registry Hive (2000)
KB 815265    "STOP 0x00000051" or "STOP 0x0000001E" error message when you start Configuration Manager in Windows 2000 Server or in Windows XP
KB 834728    You receive a "Stop 0x00000051" error message during registry restoration (2000)
KB 838213    List of base operating system fixes in Windows XP Service Pack 2 and Windows XP Tablet PC Edition 2005
KB 898792    A fix is available for a registry problem on Dell PowerEdge servers that have specific nonnative disk controllers and factory installed versions of Windows Server 2003
KB 907317    You receive a "Stop 0x00000051 REGISTRY_ERROR" message when a corrupted user profile is loaded on a computer that is running Windows Server 2003
KB 925844    Error message when a Windows Server 2003-based computer is running under high stress: "STOP 0x00000051 REGISTRY_ERROR"
KB 940795    Error message after you install Windows Server 2003 Service Pack 1 or Service Pack 2 on a Dell PowerEdge server: "Stop 0x00000051"

    WinDbg Help File Entry:

The REGISTRY_ERROR bug check has a value of 0x00000051. This indicates that a severe registry error has occurred.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Reserved
2 Reserved
3 The pointer to the hive (if available)
4 If the hive is corrupt, the return code of HvCheckHive (if available)

Cause

Something has gone wrong with the registry. If a kernel debugger is available, get a stack trace.

This error may indicate that the registry encountered an I/O error while trying to read one of its files. This can be caused by hardware problems or file system corruption.

It may also occur due to a failure in a refresh operation, which is used only in by the security system, and then only when resource limits are encountered.

    WinDbg Output Example:
REGISTRY_ERROR (51)
Something has gone badly wrong with the registry.  If a kernel debugger
is available, get a stack trace. It can also indicate that the registry got
an I/O error while trying to read one of its files, so it can be caused by
hardware problems or filesystem corruption.
It may occur due to a failure in a refresh operation, which is used only
in by the security system, and then only when resource limits are encountered.
Arguments:
Arg1: 0000000000000000, (reserved)
Arg2: 0000000000000000, (reserved)
Arg3: 0000000000000000, depends on where Windows bugchecked, may be pointer to hive
Arg4: 0000000000000000, depends on where Windows bugchecked, may be return code of
    HvCheckHive if the hive is corrupt.


STOP 0x00000052: MAILSLOT_FILE_SYSTEM    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms841797.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559031(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The MAILSLOT_FILE_SYSTEM bug check has a value of 0x00000052.

This bug check appears very infrequently.

    WinDbg Output Example:
MAILSLOT_FILE_SYSTEM (52)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000053: NO_BOOT_DEVICE    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms842023.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559035(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The NO_BOOT_DEVICE bug check has a value of 0x00000053.

This bug check appears very infrequently.

    WinDbg Output Example:
NO_BOOT_DEVICE (53)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000054: LM_SERVER_INTERNAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms842035.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559040(v=VS.85).aspx

    Knowledge Base Articles:
KB 313169    "Stop 0x00000054" Error Message in Windows 2000
KB 912947    Error message when you install a Volume Shadow Copy Service update on a Windows Server 2003 SP1-based computer: "STOP: 0x00000054 (0x00361595, 0xf12db001, 0x00000000, 0x00000000)"

    WinDbg Help File Entry:

The LM_SERVER_INTERNAL_ERROR bug check has a value of 0x00000054.

This bug check appears very infrequently.

    WinDbg Output Example:
LM_SERVER_INTERNAL_ERROR (54)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000055: DATA_COHERENCY_EXCEPTION    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms842046.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559044(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DATA_COHERENCY_EXCEPTION bug check has a value of 0x00000055.

This bug check appears very infrequently.

    WinDbg Output Example:
DATA_COHERENCY_EXCEPTION (55)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000056: INSTRUCTION_COHERENCY_EXCEPTION    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms842057.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559049(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INSTRUCTION_COHERENCY_EXCEPTION bug check has a value of 0x00000056.

This bug check appears very infrequently.

    WinDbg Output Example:
INSTRUCTION_COHERENCY_EXCEPTION (56)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000057: XNS_INTERNAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819226.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559054(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The XNS_INTERNAL_ERROR bug check has a value of 0x00000057.

This bug check appears very infrequently.

    WinDbg Output Example:
XNS_INTERNAL_ERROR (57)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000058: FTDISK_INTERNAL_ERROR    (go to top of page)

Usual causes:  Booting system from wrong copy of a mirrored volume

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819227.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559058(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x58

    Knowledge Base Articles:
KB 128630    How to Recover From a STOP 0x00000058 FTDISK_INTERNAL_ERROR (NT Server, 2000 Server)

    WinDbg Help File Entry:

The FTDISK_INTERNAL_ERROR bug check has a value of 0x00000058. This is issued if the system is booted from the wrong copy of a mirrored partition.

Parameters

None

Cause

The hives are indicating that the mirror is valid, but it is not. The hives should actually be pointing to the shadow partition.

This is almost always caused by the primary partition being revived.

Resolving the Problem

Reboot the system from the shadow partition.

    WinDbg Output Example:
VOLMGRX_INTERNAL_ERROR (58)
Windows cannot boot from a secondary plex of a mirrored volume when the mirror
is not up to date. Please boot from the primary plex of the mirrored volume.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000059: PINBALL_FILE_SYSTEM    (go to top of page)

Usual causes:  Indexing, Device driver, Insufficient memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819229.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559061(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PINBALL_FILE_SYSTEM bug check has a value of 0x00000059. This indicates that a problem occurred in the Pinball file system.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 Reserved
3 Reserved
4 Reserved

Cause

One possible cause of this bug check is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Resolving the Problem

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This will increase the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
PINBALL_FILE_SYSTEM (59)
    See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000005A: CRITICAL_SERVICE_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819231.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559064(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x5a

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CRITICAL_SERVICE_FAILED bug check has a value of 0x0000005A.

This bug check appears very infrequently.

    WinDbg Output Example:
CRITICAL_SERVICE_FAILED (5a)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000005B: SET_ENV_VAR_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819232.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559066(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SET_ENV_VAR_FAILED bug check has a value of 0x0000005B.

This bug check appears very infrequently.

    WinDbg Output Example:
SET_ENV_VAR_FAILED (5b)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000005C: HAL_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  System couldn't initialize the HAL - many causes.  Hardware, file system, boot corruption, etc

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819234.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559069(v=VS.85).aspx

    Knowledge Base Articles:
KB 965228    Windows Server 2008 IA-64 systems cannot start, and Stop error 0x0000005C is generated on a computer that has many of I/O SAPIC controllers installed
KB 2303458    A fix is available for three issues in the x2APIC mode in x64-based versions of Windows Server 2008 R2
KB 2508054    "0x0000005C" Stop error code or assertion failure in the startup process if you enable Driver Verifier in Windows Server 2008 R2

KB 2616137    Adding the Hyper-V role in Windows Server 2008 R2 may cause a Stop 0x5C on reboot if x2APIC is enabled


    WinDbg Help File Entry:

The HAL_INITIALIZATION_FAILED bug check has a value of 0x0000005C.

This indicates that the HAL initialization failed.

    WinDbg Output Example:
HAL_INITIALIZATION_FAILED (5c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000005D: UNSUPPORTED_PROCESSOR    (go to top of page)

Usual causes:  Unsupported processor

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819236.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559072(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The UNSUPPORTED_PROCESSOR bug check has a value of 0x0000005D. This indicates that the computer is attempting to run Windows on an unsupported processor.

Parameters

None

Cause

Windows requires a higher-grade processor than the one you are using.

    WinDbg Output Example:
UNSUPPORTED_PROCESSOR (5d)
    386 - System failed because the processor is only a 386 or
    compatible.  The system requires a Pentium (or higher) compatible processor.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000005E: OBJECT_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819238.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559078(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The OBJECT_INITIALIZATION_FAILED bug check has a value of 0x0000005E.

This bug check appears very infrequently.

    WinDbg Output Example:
OBJECT_INITIALIZATION_FAILED (5e)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000005F: SECURITY_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819244.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559085(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SECURITY_INITIALIZATION_FAILED bug check has a value of 0x0000005F.

This bug check appears very infrequently.

    WinDbg Output Example:
SECURITY_INITIALIZATION_FAILED (5f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000060: PROCESS_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819246.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559094(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PROCESS_INITIALIZATION_FAILED bug check has a value of 0x00000060.

This bug check appears very infrequently.

    WinDbg Output Example:
PROCESS_INITIALIZATION_FAILED (60)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000061: HAL1_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819248.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559097(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The HAL1_INITIALIZATION_FAILED bug check has a value of 0x00000061.

This bug check appears very infrequently.

    WinDbg Output Example:
HAL1_INITIALIZATION_FAILED (61)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000062: OBJECT1_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819250.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559104(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The OBJECT1_INITIALIZATION_FAILED bug check has a value of 0x00000062.

This bug check appears very infrequently.

    WinDbg Output Example:
OBJECT1_INITIALIZATION_FAILED (62)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 000000000000000


STOP 0x00000063: SECURITY1_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819251.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559108(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SECURITY1_INITIALIZATION_FAILED bug check has a value of 0x00000063.

This bug check appears very infrequently.

    WinDbg Output Example:
SECURITY1_INITIALIZATION_FAILED (63)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000064: SYMBOLIC_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819254.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559117(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SYMBOLIC_INITIALIZATION_FAILED bug check has a value of 0x00000064.

This bug check appears very infrequently.

    WinDbg Output Example:
SYMBOLIC_INITIALIZATION_FAILED (64)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000065: MEMORY1_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819258.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559120(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The MEMORY1_INITIALIZATION_FAILED bug check has a value of 0x00000065.

This bug check appears very infrequently.

    WinDbg Output Example:
MEMORY1_INITIALIZATION_FAILED (65)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000066: CACHE_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819262.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559123(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CACHE_INITIALIZATION_FAILED bug check has a value of 0x00000066.

This bug check appears very infrequently.

    WinDbg Output Example:
CACHE_INITIALIZATION_FAILED (66)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000067: CONFIG_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  Shouldn't happen :0) - Insufficient paged pool early in the boot sequence prevents registry from loading, could also be (IMO) a problem with the registry being too large for the system memory (but very unlikely)

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819267.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559126(v=VS.85).aspx

    Knowledge Base Articles:
KB 317053    "STOP 0x00000067" Error Message When You Attempt to Start Windows (NT, 2000)

    WinDbg Help File Entry:

The CONFIG_INITIALIZATION_FAILED bug check has a value of 0x00000067. This bug check indicates that the registry configuration failed.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 Reserved
2 The location selector
3 The NT status code
4 Reserved

Cause

The registry could not allocate the pool that it needed to contain the registry files. This situation should never occur, because the register allocates this pool early enough in system initialization so that plenty of paged pool should be available.

    WinDbg Output Example:
CONFIG_INITIALIZATION_FAILED (67)
This means the registry couldn't allocate the pool needed to contain the
registry files.  This should never happen, since it is early enough in
system initialization that there is always plenty of paged pool available.
Arguments:
Arg1: 0000000000000000, (reserved)
Arg2: 0000000000000000, location selector
Arg3: 0000000000000000, NT status code
Arg4: 0000000000000000


STOP 0x00000068: FILE_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819268.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559132(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The FILE_INITIALIZATION_FAILED bug check has a value of 0x00000068.

This bug check appears very infrequently.

    WinDbg Output Example:
FILE_INITIALIZATION_FAILED (68)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000069: IO1_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  Improper setup, Improper configuration after setup

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819274.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559133(v=VS.85).aspx

    Knowledge Base Articles:
KB 826727    Computer Stops Responding, and You Receive a "Stop 0x00000069" Error Message (2000 Server, Server 2003)

    WinDbg Help File Entry:

The IO1_INITIALIZATION_FAILED bug check has a value of 0x00000069. This bug check indicates that the initialization of the I/O system failed for some reason.

Parameters

None

Cause

There is very little information available to analyze this error.

Most likely, the setup routine has improperly installed the system, or a user has reconfigured the system.

    WinDbg Output Example:
IO1_INITIALIZATION_FAILED (69)
Initialization of the I/O system failed for some reason.  There is
very little information available.  In general, setup really made
some bad decisions about the installation of the system, or the user has
reconfigured the system.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000006A: LPC_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819277.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559137(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The LPC_INITIALIZATION_FAILED bug check has a value of 0x0000006A.

This bug check appears very infrequently.

    WinDbg Output Example:
LPC_INITIALIZATION_FAILED (6a)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000006B: PROCESS1_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  Hard drive, Cables, Missing boot files, Disabled driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819280.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559142(v=VS.85).aspx

    Knowledge Base Articles:
KB 307012    "Stop 0x0000006B" After Installing a Windows 2000 Service Pack
KB 311562    "An Unexpected Error (768) Occurred at Line 5118@ind:Xp\Client\Boot\Setup\Setup.c" Error Message During Windows XP Setup
KB 319026    Random Pool Corruption Is Caused by Rdbss.sys (2000)   
KB 327536    "Stop 0x0000006b" or Setup stops responding at "Setup is starting Windows" when you install a Windows XP SP1 client image from a Windows 2000-based RIS server
KB 330134    STOP: 0x0000006B "Process1_ Initialization_Failed" error message when you try to upgrade to Windows XP
KB 967551    Rollup update for the volsnap.sys driver in Windows Server 2003
KB 981833    "STOP: 0x0000006B" Stop error message during startup on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2746140    You receive "0x0000006B" and "0XC000021A" Stop error message after uninstalling McAfee Agent 4.6.2 in Windows Vista, Windows 7, Windows Server 2008 or Windows Server 2008 R2

    WinDbg Help File Entry:

The PROCESS1_INITIALIZATION_FAILED bug check has a value of 0x0000006B. This bug check indicates that the initialization of the Microsoft Windows operating system failed.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The NT status code that caused the failure
2 Reserved
3 Reserved
4 Reserved

Cause

Any part of the disk subsystem can cause the PROCESS1_INITIALIZATION_FAILED bug check, including bad disks, bad or incorrect cables, mixing different ATA-type devices on the same chain, or drives that are not available becuase of hardware regeneration.

This bug check can also be caused by a missing file from the boot partition or by a driver file that a user accidentally disabled in the Drivers tab.

    WinDbg Output Example:
PROCESS1_INITIALIZATION_FAILED (6b)
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that caused the failure.
Arg2: 0000000000000000, (reserved)
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000006C: REFMON_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819283.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559147(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The REFMON_INITIALIZATION_FAILED bug check has a value of 0x0000006C.

This bug check appears very infrequently.

    WinDbg Output Example:
REFMON_INITIALIZATION_FAILED (6c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000006D: SESSION1_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  See ntstatus.h in the SDK to look up the value of parameter 1 (ntstatus.h also located at this link:  ntstatus.html )

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819286.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559152(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SESSION1_INITIALIZATION_FAILED bug check has a value of 0x0000006D. This bug check indicates that the initialization of the Microsoft Windows operating system failed.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The NT status code that caused the initialization failure
2 0
3 0
4 0

    WinDbg Output Example:
SESSION1_INITIALIZATION_FAILED (6d)
    1 - Indicates the NT status code that caused the failure.
DESCRIPTION
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000006E: SESSION2_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  See ntstatus.h in the SDK to look up the value of parameter 1

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819287.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559154(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SESSION2_INITIALIZATION_FAILED bug check has a value of 0x0000006E. This bug check indicates that the initialization of the Microsoft Windows operating system failed.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The NT status code that caused the Windows operating system to conclude that initialization failed
2 0
3 0
4 0

    WinDbg Output Example:
SESSION2_INITIALIZATION_FAILED (6e)
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that tripped Windows into thinking
    that initialization failed.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000006F: SESSION3_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  See ntstatus.h in the SDK to look up the value of parameter 1

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819290.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559156(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x6f

    Knowledge Base Articles:
KB 153742    STOP 0x0000006F During System Initialization (NT, 2000)
KB 236086    System or Boot Disk Listed as Dynamic Unreadable in Disk Management (2000)
KB 939008    Error message when you start a Windows Vista-based computer on which Windows ReadyBoost is running: "STOP: 0x0000006F SESSION3 INITIALIZATION FAILED"

    WinDbg Help File Entry:

The SESSION3_INITIALIZATION_FAILED bug check has a value of 0x0000006F. This bug check indicates that the initialization of the Microsoft Windows operating system initialization.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The NT status code that caused the Windows operating system to conclude that initialization failed
2 0
3 0
4 0

    WinDbg Output Example:
SESSION3_INITIALIZATION_FAILED (6f)
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that tripped Windows into thinking
    that initialization failed.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000070: SESSION4_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  See ntstatus.h in the SDK to look up the value of parameter 1

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819291.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559167(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SESSION4_INITIALIZATION_FAILED bug check has a value of 0x00000070. This bug check indicates that the initialization of the Microsoft Windows operating system failed.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The NT status code that caused the Windows operating system to conclude that initialization failed
2 0
3 0
4 0

    WinDbg Output Example:
SESSION4_INITIALIZATION_FAILED (70)
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that tripped Windows into thinking
    that initialization failed.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000071: SESSION5_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  See ntstatus.h in the SDK to look up the value of parameter 1

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819294.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559171(v=VS.85).aspx

    Knowledge Base Articles:
KB 887359    You receive a "STOP 0x00000071" error message after you install the 811493 (MS03-013) security update on your Windows 2000 Professional-based computer

    WinDbg Help File Entry:

The SESSION5_INITIALIZATION_FAILED bug check has a value of 0x00000071. This bug check indicates that the initialization of the Microsoft Windows operating system failed.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The NT status code that caused the Windows operating system to conclude that initialization failed
2 0
3 0
4 0

    WinDbg Output Example:
SESSION5_INITIALIZATION_FAILED (71)
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that tripped Windows into thinking
    that initialization failed.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000072: ASSIGN_DRIVE_LETTERS_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819296.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559178(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The ASSIGN_DRIVE_LETTERS_FAILED bug check has a value of 0x00000072.

This bug check appears very infrequently.

    WinDbg Output Example:
ASSIGN_DRIVE_LETTERS_FAILED (72)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000073: CONFIG_LIST_FAILED    (go to top of page)

Usual causes:  Disk issues, File system issues, Low disk space, Low memory available for pool allocation

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819301.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559183(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CONFIG_LIST_FAILED bug check has a value of 0x00000073. This bug check indicates that one of the top-level registry keys, also known as core system hives, cannot be linked in the registry tree.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 1
2 The NT status code that led the Windows operating system to assume that it failed to load the hive
3 The index of the hive in the hive list
4 A pointer to a UNICODE_STRING structure that contains the file name of the hive

Cause

The registry hive that cannot be linked might be SAM, SECURITY, SOFTWARE, or DEFAULT. The hive is valid, because it was loaded successfully.

Examine Parameter 2 to see why the hive could not be linked in the registry tree. One common cause of this error is that the Windows operating system is out of disk space on the system drive. (In this situation, this parameter is 0xC000017D, STATUS_NO_LOG_SPACE.) Another common problem is that an attempt to allocate pool has failed. (In this situation, Parameter 2 is 0xC000009A, STATUS_INSUFFICIENT_RESOURCES.) You must investigate other status codes.

    WinDbg Output Example:
CONFIG_LIST_FAILED (73)
Indicates that one of the core system hives cannot be linked in the
registry tree. The hive is valid, it was loaded OK. Examine the 2nd
bugcheck argument to see why the hive could not be linked in the
registry tree.
This can be either SAM, SECURITY, SOFTWARE or DEFAULT. One common reason
for this to happen is if you are out of disk space on the system drive
(in which case param 2 is 0xC000017D - STATUS_NO_LOG_SPACE) or an attempt
to allocate pool has failed (in which case param 2 is 0xC000009A -
STATUS_INSUFFICIENT_RESOURCES). Other status codes must be individually
investigated.
Arguments:
Arg1: 0000000000000000, 1
Arg2: 0000000000000000, Indicates the NT status code that tripped Windows into
    thinking that it had failed to load the hive.
Arg3: 0000000000000000, Index of hive in hivelist
Arg4: 0000000000000000, Pointer to UNICODE_STRING containing filename of hive


STOP 0x00000074: BAD_SYSTEM_CONFIG_INFO    (go to top of page)

Usual causes:  System hive corruption, Missing registry keys/values, bad memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819304.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559188(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x74
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/09/12/debugging-stop-0x74/

    Knowledge Base Articles:
KB 283433    Cannot Start Windows XP After You Install Windows 2000
KB 326679    "STOP 0x00000074 BAD_SYSTEM_CONFIG_INFO" Error Message When You Start Your Computer (XP)

    WinDbg Help File Entry:

The BAD_SYSTEM_CONFIG_INFO bug check has a value of 0x00000074. This bug check indicates that there is an error in the registry.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 Reserved
2 Reserved
3 Reserved
4 The NT status code (if it is available)

Cause

The BAD_SYSTEM_CONFIG_INFO bug check occurs if the SYSTEM hive is corrupt. However, this corruption is unlikely, because the boot loader, known as NT Loader (NTLDR) in versions of Windows prior to Vista, checks a hive for corruption when it loads the hive.

This bug check can also occur if some critical registry keys and values are missing. These keys and values might be missing if a user manually edited the registry.

Resolving the Problem

Try restarting the computer by selecting "last known good configuration" in the boot options.

If the restart does not fix the problem, the registry damage is too extensive. You must reinstall the OS or use the Emergency Repair Disk (ERD) that you previously created by using the Windows Backup tool.

    WinDbg Output Example:
BAD_SYSTEM_CONFIG_INFO (74)
Can indicate that the SYSTEM hive loaded by the osloader/NTLDR
was corrupt.  This is unlikely, since the osloader will check
a hive to make sure it isn't corrupt after loading it.
It can also indicate that some critical registry keys and values
are not present.  (i.e. somebody used regedt32 to delete something
that they shouldn't have)  Booting from LastKnownGood may fix
the problem, but if someone is persistent enough in mucking with
the registry they will need to reinstall or use the Emergency
Repair Disk.
Arguments:
Arg1: 0000000000000000, (reserved)
Arg2: 0000000000000000, (reserved)
Arg3: 0000000000000000, (reserved)
Arg4: 0000000000000000, usually the NT status code.


STOP 0x00000075: CANNOT_WRITE_CONFIGURATION    (go to top of page)

Usual causes:  Shouldn't happen :0) - Insufficient paged pool early in the boot sequence prevents registry from loading, could also be (IMO) a problem with the registry being too large for the system memory (but very unlikely)

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819308.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559192(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CANNOT_WRITE_CONFIGURATION bug check has a value of 0x00000075. This bug check indicates that the SYSTEM registry hive file cannot be converted to a mapped file.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 1
2 The NT status code that led the Windows operating system to assume that it had failed to convert the hive
3 Reserved
4 Reserved

Cause

The CANNOT_WRITE_CONFIGURATION bug check typically occurs if the system is out of pool and the Windows operating system cannot reopen the hive.

This bug check should almost never occur, because the conversion of the hive file occurs early enough during system initialization so that enough pool should be available.

    WinDbg Output Example:
CANNOT_WRITE_CONFIGURATION (75)
This will result if the SYSTEM hive file cannot be converted to a
mapped file. This usually happens if the system is out of pool and
we cannot reopen the hive.
Normally you shouldn't see this as the conversion happens at early
during system initialization, so enough pool should be available.
Arguments:
Arg1: 0000000000000000, 1
Arg2: 0000000000000000, Indicates the NT status code that tripped Windows into
    thinking that it had failed to convert the hive.
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000076: PROCESS_HAS_LOCKED_PAGES    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819309.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559194(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x76

    Knowledge Base Articles:
KB 256010    "STOP 0x00000076 - PROCESS_HAS_LOCKED_PAGES" error message in Windows 2000, Windows XP Professional, and Windows Server 2003, Standard Edition
KB 825760    You Receive Stop Error 0x00000076 or 0x000000CB When You Quit Your Backup Software (2000, XP)
KB 825820    "0x00000076" or "0x000000CB" Stop Error Occurs When Windows 2000 Server Tries to Run a Process on a Remote Server
KB 895473    The computer restarts, you receive an error message, or an event is logged in the System log on a Windows Server 2003-based computer that is running in PAE mode and that has a Sybase database installed
KB 951033    Stop error message on a Windows Server 2003-based computer that has Citrix Presentation Server 4.5 installed: "0x00000076" or "0x000000CB"
KB 979742    "0x000000CB" Stop error or "0x00000076" Stop error in Windows Vista or in Windows Server 2008 when you access shared network resources by using SMB version 1 protocol on the computer

    WinDbg Help File Entry:

The PROCESS_HAS_LOCKED_PAGES bug check has a value of 0x00000076. This bug check indicates that a driver failed to release locked pages after an I/O operation.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 0
2 The process address.
3 The number of locked pages.
4 A pointer to driver stacks (if they are enabled). Otherwise, this parameter is 0.

Cause

A driver failed to release pages that it locked.

Resolving the Problem

First, use the !search extension on the current process pointer throughout all of physical memory. This extension might find at least one memory descriptor list (MDL) that points to the current process. Next, use !search on each MDL that you find to obtain the I/O request packet (IRP) that points to the current process. From this IRP, you can identify which driver is leaking the pages.

Otherwise, you can detect which driver caused the error by editing the registry:

  1. In the \\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management registry key, create or edit the TrackLockedPages value, and then set it equal to DWORD 1.
  2. Restart the computer.

The system then saves stack traces, so you can easily identify the driver that caused the problem. If the driver causes the same error again, bug check 0xCB (DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS) is issued, and the name of the driver that causes this error is displayed.

    WinDbg Output Example:
PROCESS_HAS_LOCKED_PAGES (76)
Caused by a driver not cleaning up correctly after an I/O.
Arguments:
Arg1: 0000000000000000, Locked memory pages found in process being terminated.
Arg2: 0000000000000000, Process address.
Arg3: 0000000000000000, Humber of locked pages.
Arg4: 0000000000000000, Pointer to driver stacks (if enabled) or 0 if not.
    Issue a !search over all of physical memory for the current process pointer.
    This will yield at least one MDL which points to it.  Then do another !search
    for each MDL found, this will yield the IRP(s) that point to it, revealing
    which driver is leaking the pages.
    Otherwise, set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
    Management\TrackLockedPages to a DWORD 1 value and reboot.  Then the system
    will save stack traces so the guilty driver can be easily identified.
    When you enable this flag, if the driver commits the error again you will
    see a different bugcheck - DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (0xCB) -
    which can identify the offending driver(s).


STOP 0x00000077: KERNEL_STACK_INPAGE_ERROR    (go to top of page)

Usual causes:  Memory, Corrupt paging file, File system errors, Disk errors, Bad cables, BIOS, Missing Service Pack, Bad motherboard, Virus infection (particulary in the MBR), Improperly seated cards

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819312.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559197(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x77

    Knowledge Base Articles:
KB 228753    Troubleshooting "Stop 0x00000077" or "KERNEL_STACK_INPAGE_ERROR" (NT, 2000)
KB 315266    You receive an error message on a Windows XP-based computer: "Stop 0x00000077" or "KERNEL_STACK_INPAGE_ERROR"
KB 950415    Error message on a computer that is running the Windows operating system: "Stop 0x00000077 KERNEL_STACK_INPAGE_ERROR" (2000, XP, Server 2003)
KB 954429    You experience problems on a multiprocessor computer that is running Windows Server 2003, Windows Vista, or Windows Server 2008 when you resume the computer from hibernation
KB 956871    The system may crash when you put a Windows Vista-based computer or a Windows Server 2008-based computer into hibernation
KB 967352    Stop error message when you put a computer that is running Windows Vista or Windows Server 2008 into hibernation: "STOP 0x000000A0," "STOP 0x0000007a," or "STOP 0x00000077"
KB 977178    You receive various Stop error messages in Windows 7 or in Windows Server 2008 R2 when you resume a computer that has a large SATA hard disk
KB 2498326    Stop Error on Windows Server 2008 R2 During Upgrade of FCoE Adapter Driver

    WinDbg Help File Entry:

The KERNEL_STACK_INPAGE_ERROR bug check has a value of 0x00000077. This bug check indicates that the requested page of kernel data from the paging file could not be read into memory.

Parameters

The four parameters that listed in the message have two possible meanings.

If the first parameter is 0, 1, or 2, the parameters have the following meaning.

Parameter Description
1 0: The page of kernel data was retrieved from page cache.

1: The page was retrieved from a disk.

2: The page was retrieved from a disk, the storage stack returned SUCCESS, but Status.Information is not equal to PAGE_SIZE.

2 The value that appears in the stack where the signature should be.
3 0
4 The address of the signature on the kernel stack

If the first parameter is any value other than 0, 1, or 2, the parameters have the following meaning.

Parameter Description
1 The status code
2 The I/O status code
3 The page file number
4 The offset into page file

Cause

If the first parameter is 0 or 1, the stack signature in the kernel stack was not found. This error is probably caused by defective hardware, such as a RAM error.

If the first parameter is 2, the driver stack returned an inconsistent status for the read of the page. For example, the driver stack returned a success status even though it did not read the whole page.

If the first parameter is any value other than 0, 1, or 2, the value of the first parameter is an NTSTATUS error code that the driver stack returns after it tries to retrieve the page of kernel data. You can determine the exact cause of this error from the I/O status code (the second parameter). Some common status codes include the following:

These status codes are the most common ones that have specific causes. For more information about other possible status codes that might be returned, see the Ntstatus.h file in the Microsoft Windows Driver Kit (WDK).

A virus infection can also cause this bug check.

Resolving the Problem

Resolving a bad block problem: If you can restart the computer after the error, Autochk runs automatically and attempts to map the bad sector to prevent it from being used anymore.

If Autochk does not scan the hard disk for errors, you can manually start the disk scanner. Run Chkdsk /f /r on the system partition. You must restart the computer before the disk scan begins. If you cannot start the system because the error, use the Recovery Console and run Chkdsk /r.

Warning  If your system partition is formatted with the FAT file system, the long file names that the Windows operating system uses might be damaged if you use Scandisk or another MS-DOS-based hard disk tool to verify the integrity of your hard disk drive from MS-DOS. Always use the version of Chkdsk that matches your version of the Windows operating system.

Resolving a defective hardware problem: If the I/O status is 0xC0000185 and the paging file is on an SCSI disk, check the disk cabling and SCSI termination for problems.

Resolving a failing RAM problem: Run the hardware diagnostics that the system manufacturer supplies, especially the memory scanner. For more information about these procedures, see the owner's manual for your computer.

Check that all the adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure adapter card contacts are clean.

Check the System Log in Event Viewer for additional error messages that might help identify the device that is causing the error. You can also disable memory caching of the BIOS to try to resolve this error.

Make sure that the latest Windows Service Pack is installed.

If the preceding steps fail to resolve the error, take the system motherboard to a repair facility for diagnostic testing. A crack, a scratched trace, or a defective component on the motherboard can cause this error.

Resolving a virus infection: Check your computer for viruses by using any up-to-date, commercial virus scanning software that examines the Master Boot Record of the hard disk. All Windows file systems can be infected by viruses.

See Also

Bug Check 0x7A (KERNEL_DATA_INPAGE_ERROR)

    WinDbg Output Example:
KERNEL_STACK_INPAGE_ERROR (77)
The requested page of kernel data could not be read in.  Caused by
bad block in paging file or disk controller error.
In the case when the first arguments is 0 or 1, the stack signature
in the kernel stack was not found.  Again, bad hardware.
An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or
C000016AL (STATUS_DISK_OPERATION_FAILED)  normally indicates
the data could not be read from the disk due to a bad
block.  Upon reboot autocheck will run and attempt to map out the bad
sector.  If the status is C0000185 (STATUS_IO_DEVICE_ERROR) and the paging
file is on a SCSI disk device, then the cabling and termination should be
checked.  See the knowledge base article on SCSI termination.
Arguments:
Arg1: c0000056, status code
Arg2: c0000056, i/o status code
Arg3: 00000000, page file number
Arg4: 126fb000, offset into page file


KERNEL_STACK_INPAGE_ERROR (77)
The requested page of kernel data could not be read in.  Caused by
bad block in paging file or disk controller error.
In the case when the first arguments is 0 or 1, the stack signature
in the kernel stack was not found.  Again, bad hardware.
An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or
C000016AL (STATUS_DISK_OPERATION_FAILED)  normally indicates
the data could not be read from the disk due to a bad
block.  Upon reboot autocheck will run and attempt to map out the bad
sector.  If the status is C0000185 (STATUS_IO_DEVICE_ERROR) and the paging
file is on a SCSI disk device, then the cabling and termination should be
checked.  See the knowledge base article on SCSI termination.
Arguments:
Arg1: 0000000000000000, (page was retrieved from page cache)
Arg2: 0000000000000000, value found in stack where signature should be
Arg3: 0000000000000000, 0
Arg4: 0000000000000000, address of signature on kernel stack


STOP 0x00000078: PHASE0_EXCEPTION    (go to top of page)

Usual causes:  Break set in boot sequence without a debugger being enabled

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819314.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559206(v=VS.85).aspx

    Knowledge Base Articles:
KB 184758    STOP 0x78 When NonPagedPoolSize > Seven-eighths of Physical Memory (NT)
KB 980358    Stop error when you startup Windows Preinstallation Environment (PE) on a computer that has the Pentium 233 MHz MMX process installed: "STOP 0x00000078"

    WinDbg Help File Entry:

The PHASE0_EXCEPTION bug check has a value of 0x00000078.

This bug check occurs when an unexpected break is encountered during HAL initialization. This break can occur if you have set the /break parameter in your boot settings but have not enabled kernel debugging.

    WinDbg Output Example:
PHASE0_EXCEPTION (78)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000079: MISMATCHED_HAL    (go to top of page)

Usual causes:  HAL doesn't match ntoskrnl.exe (or Ntkrnlmp.exe) and/or the system

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819317.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559209(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x79

    Knowledge Base Articles:
KB 329972    "STOP 0x00000079 mismatched_hal" error message occurs after you install Windows XP on a Windows Server 2003-based computer
KB 833143    You receive a "0x00000079 (0x00000004, 0x0000AC31, 0x00000000, 0x00000000)" stop error message when you start a Windows XP-based or a Windows 2000-based guest PC in Virtual PC 2004
KB 841384    STOP 0x00000079" error message appears on a Windows NT 4.0-based computer

    WinDbg Help File Entry:

The MISMATCHED_HAL bug check has a value of 0x00000079. This bug check indicates that the Hardware Abstraction Layer (HAL) revision level or configuration does not match that of the kernel or the computer.

Parameters

The following parameters appear on the blue screen. Parameter 1 indicates the type of mismatch.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause.
0x1 The major processor control block (PRCB) level of Ntoskrnl.exe. The major PRCB level of Hal.dll. Reserved The PRCB release levels are mismatched. (Something is out of date.)
0x2 The build type of Ntoskrnl.exe. The build type of Hal.dll. Reserved The build types are mismatched.
0x3 The size of the loader parameter extension. The major version of the loader parameter extension. The minor version of the loader parameter extension. The loader (ntldr) and HAL versions are mismatched.

When Parameter 1 equals 0x2, the following build type codes are used:

Cause

The MISMATCHED_HAL bug check often occurs when a user manually updates Ntoskrnl.exe or Hal.dll.

The error can also indicate that one of those two files is out of date. For example, the HAL might be designed for Microsoft Windows 2000 and the kernel is designed for Windows XP. Or the computer might erroneously have a multiprocessor HAL and a single-processor kernel installed, or vice versa.

The Ntoskrnl.exe kernel file is for single-processor systems and Ntkrnlmp.exe is for multiprocessor systems. However, these file names correspond to the files on the installation media.After you have installed the Windows operating system, the file is renamed to Ntoskrnl.exe, regardless of the source file that is used. The HAL file also uses the name Hal.dll after installation, but there are several possible HAL files on the installation media. For more information, see "Installing the Checked Build" in the Windows Driver Kit (WDK).

Resolving the Problem

Restart the computer by using the product CD or the Windows Setup disks. At the Welcome screen, press F10 to start the Recovery Console. Use the Copy command to copy the correct HAL or kernel file from the original CD into the appropriate folder on the hard disk. The Copy command detects whether the file that you are copying is in the Microsoft compressed file format. If so, it automatically expands the file that is copied on the target drive.

    WinDbg Output Example:
MISMATCHED_HAL (79)
The HAL revision level and HAL configuration type does not match that
of the kernel or the machine type.  This would probably happen if the
user has manually updated either ntoskrnl.exe or hal.dll and managed to
get a conflict.
You have an MP (multi-processor) Hal and a UP (uni-processor) Kernel,
or the reverse.
Arguments:
Arg1: 0000000000000000, type of mismatch
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000007A: KERNEL_DATA_INPAGE_ERROR    (go to top of page)

Usual causes:  Memory, Paging file corruption, File system, Hard drive, Cabling, Virus infection, Improperly seated cards, BIOS, Bad motherboard, Missing Service Pack

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819320.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559211(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x7a
    OSROnline Listing:  http://www.osronline.com/article.cfm?article=336
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/11/20/debugging-stop-0x7a-kernel_data_inpage_error/

    Knowledge Base Articles:
KB 250975    STOP Errors When Running MITAC 6133 Laptop on Battery Power (2000)
KB 275149    Error Message "Stop 0x0000007A" Occurs During Setup on an ATA66-based Computer (2000)
KB 293857    "Stop 0x0000007" Error Message Because of a Memory Leak in the Daprotim.sys File (2000)
KB 327020    Error Message Occurs When You Start Disk Management After Extending a Hardware Array (2000)
KB 330100    Connecting a hard disk drive in slave only mode leads to system halt during resume from standby (XP, Server 2003)
KB 913379    BIOS manufacturers should not clear the IDE Decode Enable bit in the _STM ACPI method (2000, XP, Server 2003, Vista)
KB 954429    You experience problems on a multiprocessor computer that is running Windows Server 2003, Windows Vista, or Windows Server 2008 when you resume the computer from hibernation
KB 956871    The system may crash when you put a Windows Vista-based computer or a Windows Server 2008-based computer into hibernation
KB 967352    Stop error message when you put a computer that is running Windows Vista or Windows Server 2008 into hibernation: "STOP 0x000000A0," "STOP 0x0000007a," or "STOP 0x00000077"
KB 977178    You receive various Stop error messages in Windows 7 or in Windows Server 2008 R2 when you resume a computer that has a large SATA hard disk
KB 2494016   Stop error 0x0000007a occurs on a virtual machine that is running on a Windows Server 2008 R2-based failover cluster with a cluster shared volume, and the state of the CSV is switched to redirected access
KB 2498326    Stop Error on Windows Server 2008 R2 During Upgrade of FCoE Adapter Driver
KB 2848061    0x0000007a Stop error when you resume a Windows 8-based computer from Hibernate mode

    WinDbg Help File Entry:

The KERNEL_DATA_INPAGE_ERROR bug check has a value of 0x0000007A. This bug check indicates that the requested page of kernel data from the paging file could not be read into memory.

Parameters

The four parameters that are listed in the message can have three possible meanings. If the first parameter is 1 or 2, or 3 and the third parameter is 0, the parameters have the following definitions.

Parameter Description
1 The lock type that was held (1, 2, or 3)
2 The error status (usually an I/O status code)
3 If Lock Type is 1: the current process

If Lock Type is 2 or 3: 0

4 The virtual address that could not be paged into memory

If the first parameter is 3 (and the third parameter is nonzero) or 4, the parameters have the following definitions.

Parameter Description
1 The lock type that was held (3 or 4)
2 The error status (typically an I/O status code)
3 The address of the InPageSupport structure
4 The faulting address

Otherwise, the parameters have the following definitions.

Parameter Description
1 The address of the page table entry (PTE)
2 The error status (usually an I/O status code)
3 The PTE contents
4 The faulting address

Cause

Frequently, you can determine the cause of the KERNEL_DATA_INPAGE_ERROR bug check from the error status (Parameter 2). Some common status codes include the following:

These status codes are the most common ones that have specific causes. For more information about other possible status codes that can be returned, see the Ntstatus.h file in the Microsoft Windows Driver Kit (WDK).

Another common cause of this error message is defective hardware or failing RAM.

A virus infection can also cause this bug check.

Resolving the Problem

Resolving a bad block problem: An I/O status code of 0xC000009C or 0xC000016A typically indicates that the data could not be read from the disk because of a bad block (sector). If you can restart the computer after the error, Autochk runs automatically and attempts to map the bad sector to prevent it from being used anymore.

If Autochk does not scan the hard disk for errors, you can manually start the disk scanner. Run Chkdsk /f /r on the system partition. You must restart the computer before the disk scan begins. If you cannot start the computer because of the error, use the Recovery Console and run Chkdsk /r.

Warning  If your system partition is formatted with the FAT file system, the long file names that the Windows operating system uses might be damaged if you use Scandisk or another MS-DOS-based hard disk tool to verify the integrity of your hard disk from MS-DOS. Always use the version of Chkdsk that matches your version of Windows.

Resolving a defective hardware problem: If the I/O status is C0000185 and the paging file is on an SCSI disk, check the disk cabling and SCSI termination for problems.

Resolving a failing RAM problem: Run the hardware diagnostics that the system manufacturer supplies, especially the memory scanner. For more information about these procedures, see the owner's manual for your computer.

Check that all the adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure adapter card contacts are clean.

Check the System Log in Event Viewer for additional error messages that might help identify the device that is causing the error. You can also disable memory caching of the BIOS to try to resolve this error.

Make sure that the latest Windows Service Pack is installed.

If the preceding steps do not resolve the error, take the system motherboard to a repair facility for diagnostic testing. A crack, a scratched trace, or a defective component on the motherboard can cause this error.

Resolving a virus infection: Check your computer for viruses by using any up-to-date, commercial virus scanning software that examines the Master Boot Record of the hard disk. All Windows file systems can be infected by viruses.

See Also

Bug Check 0x77 (KERNEL_STACK_INPAGE_ERROR)

    WinDbg Output Example:
KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: 8dd047f8, lock type that was held (value 1,2,3, or PTE address)
Arg2: c0000056, error status (normally i/o status code)
Arg3: 2d113864, current process (virtual address for lock type 3, or PTE)
Arg4: 902f90ba, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)


STOP 0x0000007B: INACCESSIBLE_BOOT_DEVICE    (go to top of page)

Usual causes:  Hard drive, File system, Boot sequence errors, Device driver, Virus infection (in particular check the MBR)

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819323.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559218(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x7b

    Knowledge Base Articles:
KB 303786    Missing [SysprepMassStorage] section causes a "Stop error code 0x0000007B (INACCESSABLE_BOOT_DEVICE)" error message on Windows XP Sysprep images
KB 311724    Error messages when you try to gain access to an NTFS volume (2000 Server)
KB 314082    You receive a Stop 0x0000007B error after you move the Windows XP system disk to another computer
KB 316401    "STOP 0x0000007B" error message when you restart your Windows XP-based computer
KB 324103    Advanced troubleshooting for "Stop 0x0000007B" errors in Windows XP
KB 822051    How to troubleshoot "Stop 0x0000007B" error messages that occur when you run Windows 2000 Setup
KB 822052    How to troubleshoot "Stop 0x0000007B" error messages in Windows 2000
KB 826901    "Stop 0x0000007B" error message after you remove Dell OpenManage software in Windows 2000 Server
KB 839210    "STOP 0x0000007B: INACCESSIBLE_BOOT_DEVICE" error message when you start your computer from a WinPE CD-ROM or from a Windows Server 2003 CD-ROM by using a USB CD-ROM device
KB 883114    "STOP 0x0000007B: INACCESSIBLE_BOOT_DEVICE" error message when you use a USB CD-ROM device to install Windows Server 2003 or Windows 2000
KB 922976    Error message when you start a Windows 7 or Windows Vista-based computer after you change the SATA mode of the boot drive: "STOP 0x0000007B INACCESSABLE_BOOT_DEVICE"
KB 935806    Troubleshooting Stop error messages that may occur when you try to install Windows Vista
KB 942813    Stop error when you try to restart a Windows PE 2.0 system that uses AMD Barcelona processor and that has the Operating System Capabilities (OSC) method enabled in the BIOS: "STOP: 0x0000007B (INACCESSIBLE_BOOT_DEVICE)" (Vista)
KB 957018    Stop error on a computer that is running an Itanium-based version of Windows Server 2008 and that has Qlogic 8-gigabyte Fibre Channel cards installed: "STOP 0x0000007B"
KB 975453    Error message when you start a Windows 7-based computer after you attach a RAID disk: "STOP 0x0000007B INACCESSABLE_BOOT_DEVICE"
KB 976042    Windows may fail to boot from an iSCSI drive if networking hardware is changed (Server 2008 R2)
KB 2134360    Stop error 0x7B and installation may fail when you try to upgrade to a Windows Server 2008-based or a Windows Server 2008 R2-based computer that has SAN drives that are managed by EMC's PowerPath Device Specific Module (DSM)
KB 2344941    "0x0000007B" Stop error when you replace an iSCSI or PCI Express network adapter or a motherboard with an identical device on a Windows Server 2008 R2-based or Windows 7-based computer
KB 2487376    FIX: Stop error when you replace an iSCSI network adapter or a motherboard by using an identical device on a Windows Server 2008-based or Windows Vista-based computer: "0x0000007B"
KB 2507616    "0x0000007B" Stop error after replacing or switching to an alternate iSCSI boot adapter on a Windows Server 2008 R2-based or Windows 7-based computer
KB 2550978    "0x0000007B" Stop error after you replace an identical iSCSI network adapter in Windows Server 2008 R2 SP1 or in Windows 7 SP1
KB 2673509    You receive error: Stop error code 0x0000007B (INACCESSIBLE_BOOT_DEVICE) after you install Windows Updates (Vista/Win7)
KB 2743013    STOP 0x0000007B error on reboot after Bitlocker drive encryption (Win7)
KB 2773300    "Stop 0x0000007B" error after you use a Group Policy setting to prevent the installation of devices in Windows 7 and Windows Server 2008 R2

    WinDbg Help File Entry:

The INACCESSIBLE_BOOT_DEVICE bug check has a value of 0x0000007B. This bug check indicates that the Microsoft Windows operating system has lost access to the system partition during startup.

Parameters

The following parameters appear in the message.

Parameter Description
1 The address of a UNICODE_STRING structure, or the address of the device object that could not be mounted
2 0
3 0
4 0

To determine the meaning of Parameter 1, look at the data that it points to. If the first word (USHORT) at this address is even, Parameter 1 is the beginning of a Unicode string. If the first word (USHORT) at this address is 0x3, Parameter 1 is the first field (Type) of a device object.

Cause

The INACCESSIBLE_BOOT_DEVICE bug check frequently occurs because of a boot device failure. During I/O system initialization, the boot device driver might have failed to initialize the boot device (typically a hard disk). File system initialization might have failed because it did not recognize the data on the boot device. Also, repartitioning the system partition or installing a new SCSI adapter or disk controller might induce this error.

This error can also occur because of incompatible disk hardware. If the error occurred at the initial setup of the system, the system might have been installed on an unsupported disk or SCSI controller. Some controllers are supported only by drivers that are in the Windows Driver Library (WDL). (These drivers require the user to do a custom installation.)

Resolving the Problem

This error always occurs while the system is starting. This error frequently occurs before the debugger connection is established, so debugging can be difficult or impossible.

Resolving a failed boot device problem: If a boot device is at fault, you must edit the boot options.For more information about changing these options, see Configuring Software on the Target Computer .

Resolving an incompatible disk hardware problem: If Setup autodetects the controller, you might have to skip detection and use a specific manufacturer's disk to load the driver. Also, check the availability of updates for the system BIOS and SCSI controller firmware. Updates of this kind are typically available on the Web site or BBS of the hardware manufacturer.

Remove any recently added hardware, especially hard disk drives or controllers, to see if the error is resolved. If the problematic hardware is a hard disk drive, the disk firmware version might be incompatible with your version of the Windows operating system. Contact the manufacturer for updates. If you removed another piece of hardware and the error is resolved, IRQ or I/O port conflicts likely exist. Reconfigure the new device according to the manufacturer's instructions.

Confirm that all hard disk drivers, hard disk controllers, and SCSI adapters are listed in the Microsoft Windows Marketplace Tested Products List.

If you recently added a driver, restart your computer, and press F8 at the character-based menu that displays the operating system choices. In the Advanced Options menu, select the Last Known Good Configuration option. This option is most effective when you add only one driver or service at a time.

In addition, check your computer for viruses by using any up-to-date, commercial virus scanning software that examines the Master Boot Record of the hard disk. All Windows file systems can be infected by viruses.

This error can also occur because of hard disk corruption. Run Chkdsk /f /r on the system partition. You must restart the computer before the disk scan begins. If you cannot start the computer because of the error, use the Recovery Console and run Chkdsk /r.

If you cannot start the system in the last known good configuration, you should try to start off the Windows CD. Then, you can run Chkdsk from the Repair Console.

Warning  If your system partition is formatted with the FAT file system, the long file names that the Windows operating system uses might be damaged if you use Scandisk or another MS-DOS-based hard disk tool to verify the integrity of your hard disk drive from MS-DOS. Always use the version of Chkdsk that matches your version of Windows.

If your system has SCSI adapters, contact the adapter manufacturer to obtain updated Windows drivers. Try disabling sync negotiation in the SCSI BIOS, checking the cabling and the SCSI IDs of each device, and confirming proper termination. For IDE devices, define the onboard IDE port as Primary only. Also check each IDE device for the proper master/subordinate/stand alone setting. Try removing all IDE devices except for hard disks. Finally, check the System Log in Event Viewer for additional error messages that might help identify the device or driver that is causing the error.

To analyze this error: Run an lm (List Loaded Modules) command in the debugger. Verify that the following drivers were loaded: disk, classpnp, ftdisk, partmgr, and FAT or NTFS.

kd> lm 

start    end        module name
80001000 80016000   hal          (deferred)
80016000 80018c40   bootvid      (deferred)
80019000 8001dfc0   pciidex      (deferred)
8001e000 8001ff60   dmload       (deferred)
80086000 80086980   pciide       (deferred)
802c1000 802cc000   pci          (deferred)
802cc000 802d39a0   isapnp       (deferred)
802d4000 802ed000   ftdisk       (deferred)
802ed000 802f3820   mountmgr     (deferred)
802f4000 802fad40   fdc          (deferred)
802fb000 802fdc20   partmgr      (deferred)
802fe000 802fef00   wmilib       (deferred)
8039b000 803b8000   dmio         (deferred)
803b8000 803cb000   atapi        (deferred)
803cb000 803d1560   disk         (deferred)
803d2000 803d8e80   classpnp     (deferred)
803d9000 803fa000   fastfat      (deferred)
80400000 80540000   nt           (pdb symbols)   \\localsymbols\symbols\exe\ntoskrnl.dbg
80540000 80546f20   ksecdd       (deferred)
80547000 80554620   cnss         (deferred)
80555000 80579000   ndis         (deferred)

You probably have pci or isapnp loaded. Also make sure your controller drivers are loaded. That is, make sure Atapi.sys is loaded with the channel drivers (pciide and pciidex or intelid) or scsiport.sys is loaded with the appropriate miniport driver.

It is helpful to know as much as possible about the boot device that Windows is installed on. For example, you can investigate the following items:

The !devnode extension gives you more information, if you know what your boot devices are.

Typically Plug and Play cannot assign resources to the boot device. You can verify this restriction by finding an entry for the service. If the status flags include DNF_INSUFFICIENT_RESOURCES or do not include DNF_STARTED or DNF_ENUMERATED, you have found the problem. Try !devnode 0 1 scsi or !devnode 0 1 atapi to save some time instead of dumping the whole device tree.

    WinDbg Output Example:
INACCESSIBLE_BOOT_DEVICE (7b)
During the initialization of the I/O system, it is possible that the driver
for the boot device failed to initialize the device that the system is
attempting to boot from, or it is possible for the file system that is
supposed to read that device to either fail its initialization or to simply
not recognize the data on the boot device as a file system structure that
it recognizes.  In the former case, the argument (#1) is the address of a
Unicode string data structure that is the ARC name of the device from which
the boot was being attempted.  In the latter case, the argument (#1) is the
address of the device object that could not be mounted.
If this is the initial setup of the system, then this error can occur if
the system was installed on an unsupported disk or SCSI controller.  Note
that some controllers are supported only by drivers which are in the Windows
Driver Library (WDL) which requires the user to do a custom install.  See
the Windows Driver Library for more information.
This error can also be caused by the installation of a new SCSI adapter or
disk controller or repartitioning the disk with the system partition.  If
this is the case, on x86 systems the boot.ini file must be edited or on ARC
systems setup must be run.  See the "Advanced Server System Administrator's
User Guide" for information on changing boot.ini.
If the argument is a pointer to an ARC name string, then the format of the
first two (and in this case only) longwords will be:
    USHORT Length;
    USHORT MaximumLength;
    PWSTR Buffer;
That is, the first longword will contain something like 00800020 where 20
is the actual length of the Unicode string, and the next longword will
contain the address of buffer.  This address will be in system space, so
the high order bit will be set.
If the argument is a pointer to a device object, then the format of the first
word will be:
    USHORT Type;
That is, the first word will contain a 0003, where the Type code will ALWAYS
be 0003.
Note that this makes it immediately obvious whether the argument is a pointer
to an ARC name string or a device object, since a Unicode string can never
have an odd number of bytes, and a device object will always have a Type
code of 3.
Arguments:
Arg1: 0000000000000000, Pointer to the device object or Unicode string of ARC name
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000007C: BUGCODE_NDIS_DRIVER    (go to top of page)

Usual causes:  Device driver, ?Network hardware

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559221(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The BUGCODE_NDIS_DRIVER bug check has a value of 0x0000007C. This bug check indicates that a problem occurred with an NDIS driver.

Parameters

The following parameters appear on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x01 The address of the miniport block The number of bytes that are requested The current IRQL A driver called NdisMAllocateSharedMemory at a raised IRQL.
0x02 The address of the miniport block The shared memory page that was corrupted The address of NDIS_WRAPPER_CONTEXT that keeps track of the driver's shared memory allocations During a call to NdisMAllocateSharedMemory, NDIS detected that a previously-allocated shared memory page had been corrupted.
0x03 The address of the miniport block The page that contains the shared memory The virtual address of the shared memory A driver called NdisMFreeSharedMemory[Async] with a shared memory pointer that had already been freed.
0x04 The address of NDIS_M_DRIVER_BLOCK The address of DRIVER_OBJECT 0 AddDevice was called with a driver that is not on the list of drivers that are registered with NDIS.

(Enabled only on special instrumented NDIS.)

0x05
0x06
The address of the miniport block The address of the packet descriptor that the driver uses The address of the packet array that contained this packet descriptor An Ethernet driver indicated that it received a packet by using a packet descriptor that the protocol stack is currently using.
0x07 The address of the miniport block The address of the packet descriptor that the driver uses The address of the packet array that contained this packet descriptor An FDDI driver indicated that it received a packet by using a packet descriptor that the protocol stack is currently using.
0x08 The address of the miniport block The address of NDIS_MINIPORT_INTERRUPT 0 A miniport driver did not deregister its interrupt during the halt process.
0x09 The address of the miniport block The address of the miniport driver's timer queue (NDIS_MINIPORT_TIMER) 0 A miniport driver stopped without successfully canceling all its timers.
0x0A The address of NDIS_M_DRIVER_BLOCK The address of DRIVER_OBJECT The reference count for the miniport driver A miniport driver is getting unloaded prematurely.
0x0B The address of the miniport block The address of NDIS_MINIPORT_INTERRUPT 0 A miniport driver failed its initialization without deregistering its interrupt.
0x0C The address of the miniport block The address of the miniport driver's timer queue (NDIS_MINIPORT_TIMER) 0 A miniport driver failed its initialization without successfully canceling all its timers.
0x0D The address of the miniport block The address of NDIS_MINIPORT_INTERRUPT 0 A miniport driver did not deregister its interrupt during the halt process. (The halt was called from the initialize routine after the miniport driver returned success from its initialize handler.)
0x0E The address of the miniport block The address of the miniport driver's timer queue (NDIS_MINIPORT_TIMER) 0 A miniport driver stopped without successfully canceling all its timers. (The halt was called from the initialize routine after the miniport driver returned success from its initialize handler.)
0x0F The address of the miniport block The reset status AddressingReset (BOOLEAN) A miniport driver called NdisMResetComplete without any pending reset request.
0x10 The address of the miniport block The address of NDIS_MINIPORT_INTERRUPT 0 After resuming from a low-power state, a miniport driver failed its initialization without deregistering its interrupt.
0x11 The address of the miniport block The address of the miniport driver's timer queue (NDIS_MINIPORT_TIMER) 0 After resuming from a low-power state, a miniport driver failed its initialization without successfully canceling all its timers.
0x12 The address of the miniport block The address of the packet descriptor that the driver uses The address of the packet array that contained this packet descriptor A miniport driver indicated that it received a packet by using a packet descriptor that the protocol stack is currently using.
0x13 The address of the miniport block The address of the packet descriptor that the driver uses The address of the packet array that contained this packet descriptor A Token-Ring miniport driver indicated that it received a packet by using a packet descriptor that the protocol stack currently uses.

Cause

Parameter 1 indicates the specific cause of the BUGCODE_NDIS_DRIVER bug check.

If one of the bug check parameters specifies the address of the miniport block, you can obtain more information by using !ndiskd.miniport together with this address.

If one of the bug check parameters specifies the address of the packet descriptor that the driver uses, you can obtain more information by using !ndiskd.pkt together with this address.

Comments

This bug check code occurs only on Microsoft Windows Server 2003 and later versions of Windows. In Windows 2000 and Windows XP, the corresponding code is bug check 0xD2 (BUGCODE_ID_DRIVER).

    WinDbg Output Example:
BUGCODE_NDIS_DRIVER (7c)
This is the NDIS Driver Bugcheck for Windows Server 2003 and later.
For Windows 2000 and Windows XP, see 0xD2, BUGCODE_ID_DRIVER.
Arguments:
Arg1: 0000000000000000, NDIS BugCheck Code
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000007D: INSTALL_MORE_MEMORY    (go to top of page)

Usual causes:  Self explanatory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819332.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559232(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INSTALL_MORE_MEMORY bug check has a value of 0x0000007D. This bug check indicates that there is not enough memory to start up the Microsoft Windows operating system.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The number of physical pages that are found
2 The lowest physical page
3 The highest physical page
4 0

Cause

The Windows operating system does not have sufficient memory to complete the startup process.

Resolving the Problem

Install more memory.

    WinDbg Output Example:
INSTALL_MORE_MEMORY (7d)
Not enough memory to boot Windows.
Arguments:
Arg1: 0000000000000000, Number of physical pages found
Arg2: 0000000000000000, Lowest physical page
Arg3: 0000000000000000, Highest physical page
Arg4: 0000000000000000, 0


STOP 0x0000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED    (go to top of page)

Usual causes:  Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control,

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559239(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x7e

    Knowledge Base Articles:
KB 310628    Easy CD Creator 5.0 does not function in Windows XP
KB 321637    When you use a Creative Labs SoundBlaster 16 Joystick with a game port in Windows XP, you receive a "serious error" or a "STOP: 0x0000007E" error message
KB 330182    How to troubleshoot a Stop 0x0000007E error in Windows XP
KB 818966    "STOP: 0x0000007E" Error Message When You Install Windows XP Disk Image from a Remote Installation Services Server
KB 820362    Error Message: STOP 0x0000007e (0xc0000005, 0xf72ddc76, 0xf791e920, 0xf791e570) (Server 2003)
KB 839641    You receive a stop error 0x7E in Pci.sys (2000, XP, Server 2003)
KB 884868    Stop error code 0x0000007E occurs after you disconnect your USB 2.0 flash storage device (XP)
KB 900485    Error message in Windows XP Service Pack 2: "Stop 0x7E"
KB 906099    Error message on a Windows Server 2003-based computer: "STOP 0x0000007E"
KB 924083    FIX: You receive stop error 0x7E on a Windows Server 2003 computer that is running the Server for NFS service and that has McAfee VirusScan Enterprise 8.0i installed
KB 929734    You have problems after you resume a Windows Vista-based computer from sleep or from hibernation
KB 930311    Occasional error message on a portable Windows Vista-based computer that wakes from sleep to perform network-related tasks: "STOP 0x0000007E"
KB 930979    You may receive a "Stop 0x0000007E" error message after you enable the BitLocker Drive Encryption feature in Windows Vista
KB 932755    An updated Storport storage driver is available for Windows Server 2003
KB 935806    Troubleshooting Stop error messages that may occur when you try to install Windows Vista
KB 939180    Stop error message when an application that uses Winsock is running on a Windows Server 2003-based computer: "Stop 0x0000007E"
KB 940322    Error message after you enable the ETW trace log on a computer that is running Windows XP: "0x0000007E (0xC0000005, parameter2, parameter3, parameter4 ) SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 941021    Error message when you repeatedly restart a Windows Vista-based computer: "Stop 0x0000007E"
KB 942237    Error message after you wake a Windows XP-based computer from standby or from hibernation: "Stop 0x0000007E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 950570    Error message when you start a multiprocessor computer that runs Windows Vista: "STOP: 0x0000007E"
KB 953356    Error message after you upgrade a computer that uses a processor other than an Intel processor to Windows XP Service Pack 2 or to Windows XP Service Pack 3: "STOP: 0x0000007E"
KB 953403    Stop error when you attach a Niveus Ice Vault Disc Changer to a Windows Vista SP1-based computer or to a Windows Server 2008-based computer: "STOP: 0x0000007E"
KB 953531    A "0x0000007E" Stop error occurs in Windows Server 2008 after you unmount and delete a persistent VSS snapshot
KB 953794    The error "Stop 0x0000007E" occurs when you try to shut down a Windows Server 2003 based computer with a Broadcom NIC installed but disabled
KB 954589    Stop error message when you plug a USB storage device into the USB port of a Windows Vista SP1-based or Windows Server 2008-based computer: "Stop 0x0000007E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 958092    After the Terminal Services mirror driver is disconnected from a Windows Server 2008-based or Windows Vista-based remote computer, you receive a Stop error on the remote computer: "Stop 0x0000007E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 960038    You receive a "0x0000007E" Stop error on Windows Server 2008-based computers that host Hyper-V virtual machines when you use the Hyper-V writer to back up virtual machines
KB 960652    Stop error when you copy a file from a redirected disk to a Windows Server 2003-based terminal server in a terminal server session: "0x0000007E"
KB 961799    A Stop error occurs on a Windows Server 2003-based server when a user accesses shared files on the server by using an SMB connection
KB 962943    FIX: You receive a Stop 0x0000007e error message on a blue screen when the AppPoolCredentials attribute is set to true and you use a domain account as the application pool identity in IIS 7.0 (Vista, Server 2008)
KB 965494    Stop error when a registry management problem occurs on a Windows Server 2008 or Windows Vista SP1-based computer: "0x0000007E"
KB 967544    Stop error message after you add a new device that supports MSI-X interrupts on a computer that is running Windows Vista or Windows Server 2008: "0x0000007E"
KB 967999    Stop error message when you start a Windows Server 2008-based computer from an iSCSI boot device that is connected over MPIO paths:"Stop 0x0000007E"

KB 968451    Stop error message when you enable File Server Resource Manager quota management on an NTFS volume on a Windows Server 2003 R2-based computer: "Stop 0x0000007E"
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)
KB 971280    Random Stop errors on a Windows Server 2003-based computer that performs input/output to file shares hosted on another computer or to a network-attached storage device
KB 973482    Stop error 0x0A, or Stop error 0x7E may occur on a computer that is running Windows Vista or Windows Server 2008
KB 974598    You receive a "Stop 0x0000007E" error on the first restart after you enable Hyper-V on a Windows Server 2008 R2-based computer
KB 975070    Error message after you apply update 973879: "Stop 0x0000007e" or "Stop 0x00000050" (Vista, Server 2008)
KB 977001    Stop error code when you enable shadow copies on a volume that is larger than 64 terabytes on a computer that is running Windows Server 2008 or Windows Vista: "0x0000007E"
KB 979538    "Stop 0x0000007E" or "Stop 0x00000050" Stop error message in Windows 7 or Windows Server 2008 R2
KB 979557    Stop error message on a terminal server that is running a 64-bit version of Windows Server 2008 when a user remotely controls another terminal server session: "Stop error code 0x0000007E (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED)"
KB 980082    Stop error in Win7 and in Win2008 R2 when you run a backup application: "0x0000007E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 981122    Stop error in Windows Server 2003 SP2: "0x0000007E"
KB 981751    "0x0000007E" Stop error in Windows Server 2008 or in Windows Vista
KB 983615    "Stop 0x0000007E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED" error when the GPU is under heavy load conditions in Windows 7 or Windows Server 2008 R2
KB 2299380    "0x0000007E" Stop error when you back up a Windows Server 2008 R2-based or Windows 7-based computer that is running virtual machines
KB 2394911    Stop error "0x000000D1" or "0x0000007E" in an SMB2 environment in Windows 7 or in Windows Server 2008 R2
KB 2431799    Stop error 0x0000007E occurs when multiple users establish Remote Desktop Services sessions to a Windows Server 2008 R2-based computer
KB 2460907   "0x0000007E" Stop error when you create snapshots in Windows Server 2008 or in Windows Vista
KB 2460912    "0x0000007E" or "0x00000050" Stop error when you create snapshots of a volume in Windows Server 2008 R2 or in Windows 7
KB 2479442    Stop error during startup in Windows Server 2008 or in Windows Vista
KB 2511500    "0x0000007E" Stop error after you perform a hot removal of a PCI device in Windows 7 or in Windows Server 2008 R2
KB 2528614   Operating system intermittently crashes with a "0x0000007E" Stop error message on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2547257    "0x0000007E" or "0x0000000A" Stop error occurs when you play and at the same time record TV content on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2548124    "0x0000007E" Stop error when you run a VSS-based backup application in Windows 7 or in Windows Server 2008 R2
KB 2579274    "0x0000007E" Stop error message when a connection is reset on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2591271    "0x0000007E" Stop error when you restart a computer that is running Windows Server 2008 R2 or Windows 7
KB 2614451    "STOP: 0x0000007E" error occurs when you write some data onto a CD or DVD in Windows Server 2008 R2 or in Windows 7
KB 2639032    "0x0000003B," "0x00000027," and "0x0000007e" Stop errors when a connection to a CSV is lost on a Windows Server 2008 R2-based failover cluster
KB 2695584    "0x0000007E" or "0X00000050" Stop error when you run the Common Scenario Stress with IO test in Windows 7 or in Windows Server 2008 R2
KB 2705368    "0x0000007E" Stop error when you use McAfee Device Control tool or a similar tool to restrict USB audio in Windows XP SP3
KB 2768523    "0x0000007E" Stop error after you configure a computer to host a web service in Windows Server 2008 R2
KB 2831184    "0x0000007E" Stop error when a file on a Windows 7 SP1-based or Windows Server 2008 R2 SP1-based computer is opened from multiple client computers
KB 2854942    "0x0000007E" Stop error when you remove a USB HID device from a Windows XP SP3-based computer
KB 2857407    "0x0000007E" Stop error when you try to shut down a Windows 8 or Windows Server 2012-based computer

    More STOP error messages at these search links:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x00000024&x=13&y=11&mkt=en-US&FORM=QBME1&l=1
 http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000007e&x=11&y=11&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The SYSTEM_THREAD_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000007E. This bug check indicates that a system thread generated an exception that the error handler did not catch.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The exception code that was not handled
2 The address where the exception occurred
3 The address of the exception record
4 The address of the context record

Cause

The SYSTEM_THREAD_EXCEPTION_NOT_HANDLED bug check is a very common bug check. To interpret it, you must identify which exception was generated.

Common exception codes include the follwoing:

For a complete list of exception codes, see the Ntstatus.h file that is located in the inc directory of the Microsoft Windows Driver Kit (WDK).

Resolving the Problem

If you are not equipped to debug this problem, you should use some basic troubleshooting techniques.

If you plan to debug this problem, you might find it difficult to obtain a stack trace. Parameter 2 (the exception address) should identify the driver or function that caused this problem.

If exception code 0x80000003 occurs, a hard-coded breakpoint or assertion was hit, but the system was started with the /NODEBUG switch. This problem should rarely occur. If it occurs repeatedly, make sure that a kernel debugger is connected and the system is started with the /DEBUG switch.

If exception code 0x80000002 occurs, the trap frame supplies additional information.

If you do not know the specific cause of the exception, consider the following issues:

If a driver is listed by name within the bug check message, disable or remove that driver. Disable or remove any drivers or services that were recently added. If the error occurs during the startup sequence and the system partition is formatted with NTFS file system, you might be able to use Safe Mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in Safe Mode, you must start the computer by using the Recovery Console to access the file.

If the problem is associated with Win32k.sys, the source of the error might be a third-party remote control program. If such software is installed, you can remove the service by starting the computer by using the Recovery Console and then deleting the offending system service file.

Check the System Log in Event Viewer for additional error messages that might help identify the device or driver that is causing bug check 0x7E.

You can also disable memory caching of the BIOS might to try to resolve the error. You should also run hardware diagnostics, especially the memory scanner, that the system manufacturer supplies. For more information about these procedures, see the owner's manual for your computer.

The error that generates this message can occur after the first restart during Windows Setup, or after Setup is finished. A possible cause of the error is lack of disk space for installation and system BIOS incompatibilities. For problems during Windows installation that are associated with lack of disk space, reduce the number of files on the target hard disk drive. Check for and delete any temporary files that you do not have to have, Internet cache files, application backup files, and .chk files that contain saved file fragments from disk scans. You can also use another hard disk drive with more free space for the installation. You can resolve BIOS problems by upgrading the system BIOS version.

    WinDbg Output Example:
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Exception Record Address
Arg4: 0000000000000000, Context Record Address


STOP 0x0000007F: UNEXPECTED_KERNEL_MODE_TRAP    (go to top of page)

Usual causes:  Memory corruption, Hardware (memory in particular), Overclocking failure, Installing a faulty or mismatched hardware (especially memory) or a failure after installing it, 3rd party firewall, Device drivers, SCSI/network/BIOS updates needed, Improperly seated cards, Incompatible storage devices, Overclocking, Virus scanner, Backup tool, Bad motherboard, Missing Service Pack

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819336.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559244(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x7f
    Other Articles:
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/10406-0x7f-memory-leak.html
        https://bsodtutorials.wordpress.com/2013/11/13/debugging-and-understanding-stack-overflows/
        http://bsoddebugging.blogspot.com/2014/07/0x7f-memory-leak.html

    Knowledge Base Articles:
KB 137539    General causes of "STOP 0x0000007F" errors (NT, 2000, XP)
KB 316526    Error Message: "STOP 0x0000007F" During Setup on Hewlett Packard Pavilion 7840 (XP)
KB 317214    Terminal Server unexpectedly restarts, or you receive "Stop error code 0x0000007F" (2000)
KB 822789    You receive a "Stop 0x0000007F" error message or your computer unexpectedly restarts (NT, 2000, XP, Server 2003)
KB 827188    You receive a "Stop error code 0x0000007F" in Windows 2000
KB 835281    You receive a "Stop error code 0x0000007F" (UNEXPECTED_KERNEL_MODE_TRAP) error message and your Windows 2000-based computer restarts
KB 838804    You receive a "0x0000007F" stop error on a Windows 2000-based computer
KB 839540    Stop error code 0x0000007f EXCEPTION_DOUBLE_FAULT occurs in Windows 2000 Server
KB 842465    Stop 7F, 0x00000008 (double-fault) error occurs because of a single-bit error in the ESP register (2000, XP, Server 2003)
KB 870908    Command AntiVirus version 4.62.4 causes an error message on a blue screen in Windows XP Service Pack 2
KB 907353    You receive a Stop error message when you use a hardware device on a computer that is running Windows 2000
KB 928006    You receive a "STOP: 0x0000007f" error message or the computer automatically restarts in Windows Server 2003
KB 935843    Error message when you try to print after you install the GDI security update 925902: "Stop 0x0000007F" (2000, XP)
KB 941020    You receive occasional Stop errors after you install a driver that manages on-board flash memory on a Windows Vista-based computer
KB 944824    Stop error message on a computer that has ISA Server 2006 installed: "Stop error code 0x0000007f (UNEXPECTED_KERNEL_MODE_TRAP)"
KB 947471    Stop error message on a Windows Server 2003-based computer that has Symantec AntiVirus software installed: "Stop error code 0x0000007f (UNEXPECTED_KERNEL_MODE_TRAP)"
KB 959523    Stop error after you install KB951376, you use the Add Bluetooth Device Wizard, you find many Bluetooth devices, and then you try to put a Windows Vista-based or Windows Server 2008-based computer to sleep: "STOP 0x0000007F"
KB 971128    Stop error when multiple third-party network drivers are installed on a computer that is running Windows Server 2008 or Windows Vista: "0x0000007F" or "0x0000008E"
KB 972907    Stop error message on a computer that is running Windows Vista or Windows Server 2008: "STOP: 0x0000007F"
KB 979762    Stop error in Windows Vista and in Windows Server 2008 when you try to print a document: "0x0000003B" or "0x0000007f"
KB 981180    Stop error message when you run an application that transfers data by using the UDP protocol in Windows Server 2008 R2 or in Windows 7: "STOP 0x0000007F"
KB 2254637   "0x0000007F" Stop error occurs when the connection to some shared files is lost on a computer that is running Windows Vista, Windows Server 2008, Windows 7 or Windows Server 2008 R2
KB 2487324    "0x0000003B" or "0x0000007f" Stop errors may occur when you try to print a document in Windows Server 2008 R2
KB 2498368    Error: 0x7F, Stop: 0x0000007F or Windows Live Mail fails to launch after installing Windows update KB2454826 (Windows 7/Server 2008 R2)
KB 2502285    "0x0000007F" Stop error after you install Windows 7 Service Pack 1 in Windows 7 (Windows 7 SP1)
KB 2519736    Stop error message in Windows Server 2008 R2 SP1 or in Windows 7 SP1: "STOP: 0x0000007F"
KB 2531771   "0x0000007F" Stop error when you try to wake the computer from Sleep (S3) mode if you use offline files in Windows Vista or in Windows Server 2008
KB 2592339    "0x0000007f" Stop error or system stops responding on a computer that is running Windows Server 2008 R2 or Windows 7 when you connect to it by using the RDP protocol


    More error messages at this link:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000007f&x=9&y=10&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The UNEXPECTED_KERNEL_MODE_TRAP bug check has a value of 0x0000007F. This bug check indicates that the Intel CPU generated a trap and the kernel failed to catch this trap.

This trap could be a bound trap (a trap the kernel is not permitted to catch) or a double fault (a fault that occurred while processing an earlier fault, which always results in a system failure).

Parameters

The first parameter that appears on the blue screen specifies the trap number.

The most common trap codes include the following:

The less-common trap codes include the following:

For other trap numbers, see an Intel architecture manual.

Cause

Bug check 0x7F typically occurs after you install a faulty or mismatched hardware (especially memory) or if installed hardware fails.

A double fault can occur when the kernel stack overflows. This overflow occurs if multiple drivers are attached to the same stack. For example, if two file system filter drivers are attached to the same stack and then the file system recurses back in, the stack overflows.

Resolving the Problem

Debugging: Always begin with the !analyze extension.

If this extension is not sufficient, use the kv (Display Stack Backtrace) debugger command.

After using one of these commands, use kv again to display the new stack.

Troubleshooting: If you recently added hardware to the computer, remove it to see if the error recurs. If existing hardware has failed, remove or replace the faulty component. Run hardware diagnostics that the system manufacturer supplies to determine which hardware component failed.

The memory scanner is especially important. Faulty or mismatched memory can cause this bug check. For more informaiton about these procedures, see the owner's manual for your computer. Check that all adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure adapter card contacts are clean.

If the error appears on a newly installed system, check the availability of updates for the BIOS, the SCSI controller, or network cards. These kind of updates are typically available on the Web site or BBS of the hardware manufacturer.

Confirm that all hard disk drives, hard disk controllers, and SCSI adapters are listed in the Microsoft Windows Marketplace Tested Products List.

If the error occurred after the installation of a new or updated device driver, you should remove or replace the driver. If, under this circumstance, the error occurs during the startup sequence and the system partition is formatted with NTFS, you might be able to use Safe Mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in Safe Mode, you have to start the computer by using the Recovery Console in order to access the file.

Also restart your computer, and then press F8 at the character-based menu that displays the operating system choices. At the Advanced Options menu, select the Last Known Good Configuration option. This option is most effective when you add only one driver or service at a time.

Overclocking (setting the CPU to run at speeds above the rated specification) can cause this error. If you have overclocked the computer that is experiencing the error, return the CPU to the default clock speed setting.

Check the System Log in Event Viewer for additional error messages that might help identify the device or driver that is causing the error. You can also disable memory caching of the BIOS to try to resolve the problem.

If you encountered this error while upgrading to a new version of the Windows operating system, the error might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version. If possible, remove all third-party device drivers and system services and disable any virus scanners before you upgrade. Contact the software manufacturer to obtain updates of these tools. Also make sure that you have installed the latest Windows Service Pack.

Finally, if all the above steps do not resolve the error, take the system motherboard to a repair facility for diagnostic testing. A crack, a scratched trace, or a defective component on the motherboard can also cause this error.

    WinDbg Output Example:
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff80002af243d


STOP 0x00000080: NMI_HARDWARE_FAILURE    (go to top of page)

Usual causes:  Hardware malfuntion

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559250(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x80

    Knowledge Base Articles:
KB 822720    The computer stops responding (hangs) on boot in Windows 2000 Server, or you receive a "Stop 0x00000080" error message when you add or remove a hot swap drive
KB 982488    You receive an incorrect Stop error message when you send a WHEA handler NMI in Windows Vista and in Windows Server 2008

    WinDbg Help File Entry:

The NMI_HARDWARE_FAILURE bug check has a value of 0x00000080. This bug check indicates that a hardware malfunction has occurred.

Parameters

None

Cause

A variety of hardware malfunctions can cause the NMI_HARDWARE_FAILURE bug check. The exact cause is difficult to determine.

Resolving the Problem

Remove any hardware or drivers that have been recently installed. Make sure that all memory modules are of the same type.

    WinDbg Output Example:
NMI_HARDWARE_FAILURE (80)
This is typically due to a hardware malfunction.  The hardware supplier should
be called.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000081: SPIN_LOCK_INIT_FAILURE    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819338.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559255(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SPIN_LOCK_INIT_FAILURE bug check has a value of 0x00000081.

This bug check appears very infrequently.

    WinDbg Output Example:
SPIN_LOCK_INIT_FAILURE (81)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000082: DFS_FILE_SYSTEM    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819341.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559261(v=VS.85).aspx

    Knowledge Base Articles:
KB 811814    XADM: "Stop 0x00000082" Error Message When You Mount Exchange IFS as the DFS Root (2000 Server)
KB 885443    You receive a "Stop 0x00000082" error after you install Windows XP Service Pack 2 or after you install security update 890859 in Windows 2000
KB 930184    Error message when a volume is dismounted on a Windows Server 2003 SP1-based computer: "STOP 0x00000082"

    WinDbg Help File Entry:

The DFS_FILE_SYSTEM bug check has a value of 0x00000082.

This bug check appears very infrequently.

    WinDbg Output Example:
DFS_FILE_SYSTEM (82)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000083: OFS_FILE_SYSTEM    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819344.aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (83)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000084: RECOM_DRIVER    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819347.aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (84)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000085: SETUP_FAILURE    (go to top of page)

Usual causes:  Assorted setup failures - see parameters below

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819348.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559264(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SETUP_FAILURE bug check has a value of 0x00000085. This bug check indicates that a fatal error occurred during setup.

Parameters

The following parameters appear on the blue screen. Parameter 1 indicates the type of violation. Parameter 4 is not used. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Cause
0x0 0 0 The OEM HAL font is not a valid .fon format file, so setup cannot display text.

This cause indicates that Vgaxxx.fon on the boot floppy or CD is damaged.

0x1 The precise video initialization failure:

0: NtCreateFile of \device\video0

1: IOCTL_VIDEO_QUERY_NUM_AVAIL_MODES

2: IOCTL_VIDEO_QUERY_AVAIL_MODES

3: The desired video mode is not supported. This value indicates an internal setup error.

4: IOCTL_VIDEO_SET_CURRENT_MODE (unable to set video mode)

5: IOCTL_VIDEO_MAP_VIDEO_MEMORY

6: IOCTL_VIDEO_LOAD_AND_SET_FONT

The status code from the NT API call, if appropriate Video initialization failed.

This failure might indicate that the disk that contains Vga.sys (or another video driver that is appropriate to the computer) is damaged or that the computer has video hardware that the Microsoft Windows operating system cannot communicate with.



0x2 0 0 Out of memory.



0x3 The precise keyboard initialization failure:

0: NtCreateFile of \device\KeyboardClass0 failed. (Setup did not find a keyboard connected to the computer.)

1: Unable to load keyboard layout DLL. (Setup could not load the keyboard layout file. This failure indicates that the CD or floppy disk is missing a file, such as Kbdus.dll for the U.S. release or another layout DLL for localized releases.)

0 Keyboard initialization failed.

This failure might indicate that the disk that contains the keyboard driver (I8042prt.sys or Kbdclass.sys) is damaged or that the computer has keyboard hardware that Windows cannot communicate with. This failure might also mean that the keyboard layout DLL could not be loaded.



0x4 0 0 Setup could not resolve the ARC device path name of the device that setup was started from.

This error is an internal setup error.

0x5 Reserved Reserved Partitioning sanity check failed.

This error indicates a bug in a disk driver.




    WinDbg Output Example:
SETUP_FAILURE (85)
(NOTE:  Textmode setup no longer uses bugchecks to bail out of serious
error conditions.  Therefore, you will never encounter a bugcheck 0x85.
All bugchecks have been replaced with friendlier and (where possible)
more descriptive error messages.  Some of the former bugchecks, however,
have simply been replaced by our own bugcheck screen, and the codes for
these error conditions are the same as before.  These are documented below.)
The first extended bugcheck field is a code indicating what the
problem is, and the other fields are used differently depending on
that value.
Arguments:
Arg1: 0000000000000000, The oem hal font is not a valid .fon format file, and so setup
    is unable to display text.
    This indicates that vgaxxx.fon on the boot floppy or CD-ROM
    is damaged.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000086: AUDIT_FAILURE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (86)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000087:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (87)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000088:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (88)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000089:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (89)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000008A:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (8a)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000008B: MBR_CHECKSUM_MISMATCH    (go to top of page)

Usual causes:  Virus infection, MBR corruption, File system issues, Hard drive issues

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559268(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The MBR_CHECKSUM_MISMATCH bug check has a value of 0x0000008B. This bug check indicates that a mismatch has occurred in the MBR checksum.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The disk signature from MBR
2 The MBR checksum that the OS Loader calculates
3 The MBR checksum that the system calculates
4 Reserved

Cause

The MBR_CHECKSUM_MISMATCH bug check occurs during the boot process when the MBR checksum that the Microsoft Windows operating system calculates does not match the checksum that the loader passes in.

This error typically indicates a virus.

Resolving the Problem

There are many forms of viruses and not all can be detected. Typically, the newer viruses usually can be detected only by a virus scanner that has recently been upgraded. You should boot with a write-protected disk that contains a virus scanner and try to clean out the infection.

    WinDbg Output Example:
MBR_CHECKSUM_MISMATCH (8b)
This message occurs during the boot process when the MBR checksum the system
calculates does not match the checksum passed in by the loader. This is usually
an indication of a virus. There are many forms of viruses and not all can be
detected. The newer ones usually can only be detected by a virus scanner that
has recently been upgraded. Boot a write-protected disk containing a virus
scanner and attempt to clean out the infection.
Arguments:
Arg1: 0000000000000000, Disk Signature from MBR.
Arg2: 0000000000000000, MBR checksum calculated by osloader.
Arg3: 0000000000000000, MBR checksum calculated by system.
Arg4: 0000000000000000


STOP 0x0000008C:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (8c)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000008D:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (8d)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED    (go to top of page)

Usual causes:  Insufficient disk space, Device driver, Video card, BIOS, Breakpoint in startup without having a debugger attached, Hardware incompatibility, Faulty system service, 3rd party remote control, Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559271(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x8e

    Knowledge Base Articles:
KB 315335    "STOP 0x0000008e" error message during Windows XP setup
KB 325154    A "STOP 0x0000008E" Error Message Occurs in Wdmaud.sys (XP)
KB 330187    A "STOP: 0x0000008E" error message occurs when you change the hardware acceleration setting (XP)
KB 813818    STOP 0x0000008E error message on a blue screen and your computer does not enter hibernation or standby after you remove an IEEE 1394 storage device (XP)
KB 817873    "Stop error code 0x0000008E" error message occurs when you upgrade to Windows Server 2003
KB 823303    “Failed To Install Product Catalog” Error Message When You Install Windows XP
KB 827663    You receive a random "0x0000008E" error message on a blue screen in Windows XP
KB 829422    A "Stop error code 0x0000008E (KERNEL_MODE_EXCEPTION_NOT_HANDLED)" error occurs when a Terminal Services client prints a document (Server 2003)
KB 834450    "Stop 0x0000008E" error message in Win32k.sys when you use the keyboard to access a program menu in Windows XP
KB 840216    Stop 0x0000008e error occurs on a server that is running Microsoft Windows Server 2003
KB 893239    You may receive a Stop error message on a blue screen when you start a Microsoft Windows Server 2003-based computer or a Microsoft Windows XP-based computer
KB 903251    You may receive an error message on a Windows-based computer: "STOP 0x00000050" or "STOP 0x0000008e" (2000, XP, Server 2003)
KB 905909    You occasionally receive a "Stop 0x0000008e" error message and the computer may occasionally stop responding in Windows Server 2003
KB 907966    A Windows Server 2003-based computer crashes and then generates the following error message: "STOP: 0x0000008E"

KB 918564    Error message after you install the Windows Server 2003 Scalable Networking Pack in Windows Server 2003: "STOP 0x0000008E" or "STOP: 0x0000003B"
KB 920192    Error message in the win32k!xxxMenuWindowProc+b4f process in Windows Server 2003 or Windows XP: "Stop 0x0000008e"
KB 929161    You receive a Stop error message on a Windows Server 2003 SP1 or Windows Server 2003 SP2-based computer when a device is suddenly disconnected from a host bus adapter

KB 930916    Error message when you try to open files on an NTFS file system volume on a Windows XP-based computer: "Stop 0x0000008E"
KB 932755    An updated Storport storage driver is available for Windows Server 2003
KB 934454    FIX: Error message on a Windows Server 2003 R2-based computer that has the Server for NFS component installed: "STOP 0x0000008E" or "STOP 0x00000024"
KB 935806    Troubleshooting Stop error messages that may occur when you try to install Windows Vista
KB 944056    Error message when you try to shut down or to restart a Windows Vista-based portable computer that has Bluetooth devices installed: “Stop: 0x0000008E”
KB 945658    General troubleshooting for an error message that you may receive randomly in Windows XP: "Stop 0x0000008E"
KB 947479    Error message on a Windows Server 2003-based computer: "Stop error code 0x0000008E"
KB 952679    Stop error message when an application calls the NtGdiBitBlt function on a Windows Server 2003 SP2-based computer: "0x0000008E"
KB 955044    Stop error when an application calls the NtGdiBitBlt function on a Windows Server 2008 or Windows Vista Service Pack 1-based computer: "0x0000008E"

KB 957319    You receive a "Stop 0x00000050" or "Stop 0x0000008E" error message when you restart a Windows XP-based computer
KB 957877    Stop error on a Windows Server 2003-based terminal server that has hotfix 951749 installed: "0x0000008E"
KB 959252    Error message when you switch the operating system from a dual monitor setting to a single monitor setting on a Windows XP-based computer or on a Windows Server 2003-based computer that has the security update 954211 installed: "Stop 0x0000008E"
KB 959828   Stop error on a Windows Server 2003 SP2-based terminal server or a Windows Server 2008 SP2-based terminal server when users print documents in terminal sessions: "0x0000008E" or "0x00000050"
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)
KB 971128    Stop error when multiple third-party network drivers are installed on a computer that is running Windows Server 2008 or Windows Vista: "0x0000007F" or "0x0000008E"
KB 977456   Stop error when you run an application that has a WS_CHILD styled message-only window in Windows Server 2003 SP2 or in Windows XP Professional x64 Edition SP2: "Stop 0x0000008E"
KB 2494629    A "0x0000008E" Stop error occurs when you set the message storage limit for a Message Queuing queue to be larger than 4 GB in a 32-bit version of Windows Server 2003
KB 2494666    Stop errors may occur after you use the Driver Verifier manager to apply standard settings to all drivers in Windows 7 or in Windows Server 2008 R2
KB 2581128    "0x0000008E" Stop error may occur when a user logs off a Windows Server 2003 Terminal Server session from a client computer
KB 2652034    "0x0000008E" Stop error when Windows 7 enters and then resumes from standby repeatedly if Windows XP Mode is running
KB 2724781    "0x0000008E" Stop error in Windows 7 or in Windows Server 2008 R2
KB 2791374    Stop error 0x8E occurs on Windows XP when you print with an XPS printer driver
KB 2801465    "0x0000008E" Stop error when you print a document that has a private character embedded in Windows Server 2008
KB 2805853    "0x0000008E" Stop error on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2846226    Stop Error 0x0000008E on a computer that is running Windows 7 SP1 or Windows Server 2008 R2 SP1
KB 2871206    STOP 0x8e error when printing a document on a printer shared by a Windows Server 2003 print server
KB 2916627    Stop Error 0x0000008E (KERNEL_MODE_EXCEPTION_NOT_HANDLED) when you try to access DFS in Windows 7 or Windows Server 2008 R2

    More BSOD's at this link:  http://search.microsoft.com/results.aspx?mkt=en-US&q=stop%3A%200x0000008e&qsc0=0&l=1&first=1&FORM=PEME

    WinDbg Help File Entry:

The KERNEL_MODE_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000008E. This bug check indicates that a kernel-mode application generated an exception that the error handler did not catch.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The exception code that was not handled
2 The address where the exception occurred
3 The trap frame
4 Reserved

Cause

The KERNEL_MODE_EXCEPTION_NOT_HANDLED bug check is a very common bug check. To interpret it, you must identify which exception was generated.

Common exception codes include the following:

For a complete list of exception codes, see the Ntstatus.h file that is located in the inc directory of the Microsoft Windows Driver Kit (WDK).

Resolving the Problem

If you are not equipped to debug this problem, you should use some basic troubleshooting techniques:

If you plan to debug this problem, you might find it difficult to obtain a stack trace. Parameter 2 (the exception address) should identify the driver or function that caused this problem.

If exception code 0x80000003 occurs, a hard-coded breakpoint or assertion was hit, but the computer was started with the /NODEBUG switch. This problem should rarely occur. If it occurs repeatedly, make sure that a kernel debugger is connected and that the computer is started with the /DEBUG switch.

If exception code 0x80000002 occurs, the trap frame supplies additional information.

If you do not know the specific cause of the exception, consider the following items:

If the bug check message lists a driver by name , disable or remove that driver. Also, disable or remove any drivers or services that were recently added. If the error occurs during the startup sequence and the system partition is formatted with NTFS file system, you might be able to use Safe Mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in Safe Mode, you have to start the computer by using the Recovery Console to access the file.

If the problem is associated with Win32k.sys, the source of the error might be a third-party remote control program. If such software is installed, you can remove the service by starting the system by using the Recovery Console and then deleting the offending system service file.

Check the System Log in Event Viewer for additional error messages that might help identify the device or driver that is causing bug check 0x1E. You can disable memory caching of the BIOS to try to resolve the error. You should also run hardware diagnostics, especially the memory scanner, that the system manufacturer supplies. For more information about these procedures, see the owner's manual for your computer.

The error that generates this message can occur after the first restart during Windows Setup, or after Setup is finished. A possible cause of the error is lack of disk space for installation and system BIOS incompatibilities. For problems during Windows installation that are associated with lack of disk space, reduce the number of files on the target hard disk drive. Check for and delete any temporary files that you do not have to have, Internet cache files, application backup files, and .chk files that contain saved file fragments from disk scans. You can also use another hard disk drive with more free space for the installation.

You can resolve BIOS problems by upgrading the system BIOS version.

    WinDbg Output Example:
KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 0000db6e, The address that the exception occurred at
Arg3: 00000000, Trap Frame
Arg4: 00000000


STOP 0x0000008F: PP0_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819356.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559274(v=VS.85).aspx

    Knowledge Base Articles:

     WinDbg Help File Entry:

The PP0_INITIALIZATION_FAILED bug check has a value of 0x0000008F. This bug check indicates that the Plug and Play (PnP) manager could not be initialized.

Parameters

None

Cause

An error occurred during Phase 0 initialization of the kernel-mode PnP manager.

    WinDbg Output Example:
PP0_INITIALIZATION_FAILED (8f)
This message occurs if phase 0 initialization of the kernel-mode Plug and
Play Manager failed.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000090: PP1_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819362.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559280(v=VS.85).aspx

    Knowledge Base Articles:

     WinDbg Help File Entry:

The PP1_INITIALIZATION_FAILED bug check has a value of 0x00000090. This bug check indicates that the Plug and Play (PnP) manager could not be initialized.

Parameters

None

Cause

An error occurred during Phase 1 initialization of the kernel-mode PnP manager.

Phase 1 is where most of the initialization is done, including setting up the registry files and other environment settings for drivers to call during the subsequent I/O initialization.

    WinDbg Output Example:
PP1_INITIALIZATION_FAILED (90)
This message occurs if phase 1 initialization of the kernel-mode Plug and
Play Manager failed.  This is where most of the initialization is done,
including setting up the environment (registry, etc.) for drivers to
subsequently call during I/O init.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000091: WIN32K_INIT_OR_RIT_FAILURE    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819363.aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (91)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000092: UP_DRIVER_ON_MP_SYSTEM    (go to top of page)

Usual causes:  Wrong device driver loaded

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819366.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559285(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The UP_DRIVER_ON_MP_SYSTEM bug check has a value of 0x00000092. This bug check indicates that a uniprocessor-only driver has been loaded on a multiprocessor system.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The base address of the driver
2 Reserved
3 Reserved
4 Reserved

Cause

A driver that is compiled to work only on uniprocessor machines has been loaded, but the Microsoft Windows operating system is running on a multiprocessor system with more than one active processor.

    WinDbg Output Example:
UP_DRIVER_ON_MP_SYSTEM (92)
This message occurs if a UNIPROCESSOR only driver is loaded on a MultiProcessor
system with more than one active processor.
Arguments:
Arg1: 0000000000000000, The Base address of the driver.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000093: INVALID_KERNEL_HANDLE    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819369.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559292(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x93

    Knowledge Base Articles:
KB 816600    "Fatal System Error: 0x00000093" Error Message When You Install Apache SNMP on IBM WebSphere Application Server (Server 2003)

    WinDbg Help File Entry:

The INVALID_KERNEL_HANDLE bug check has a value of 0x00000093. This bug check indicates that an invalid or protected handle was passed to NtClose.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The handle that is passed to NtClose
2 0: The caller tried to close a protected handle

1: The caller tried to close an invalid handle

3 Reserved
4 Reserved

Cause

The INVALID_KERNEL_HANDLE bug check indicates that some kernel code (for example, a server, redirector, or another driver) tried to close an invalid handle or a protected handle.

    WinDbg Output Example:
INVALID_KERNEL_HANDLE (93)
This message occurs if kernel code (server, redirector, other driver, etc.)
attempts to close a handle that is not a valid handle.
Arguments:
Arg1: 00016f40, The handle that NtClose was called with.
Arg2: 00000000, means a protected handle was closed.
Arg3: 00000000
Arg4: 00000000


STOP 0x00000094: KERNEL_STACK_LOCKED_AT_EXIT    (go to top of page)

Usual causes:  Memory, Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819372.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559296(v=VS.85).aspx

    Knowledge Base Articles:
KB 158517    Stop 0x000000094 Running Windows NT 4.0 and NFS Maestro

    WinDbg Help File Entry:

The KERNEL_STACK_LOCKED_AT_EXIT bug check has a value of 0x00000094. This bug check indicates that a thread exited while its kernel stack was marked as not swappable

Parameters

None

    WinDbg Output Example:
KERNEL_STACK_LOCKED_AT_EXIT (94)
This message occurs when a thread exits while its kernel stack is
marked as not swapable
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000095: PNP_INTERNAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819375.aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (95)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000096: INVALID_WORK_QUEUE_ITEM    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819378.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559300(v=VS.85).aspx

    Knowledge Base Articles:
KB 884587    You may receive Stop error code 0x00000096 in Windows 2000 Server

    WinDbg Help File Entry:

The INVALID_WORK_QUEUE_ITEM bug check has a value of 0x00000096. This bug check indicates that a queue entry was removed that contained a null pointer.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The address of the queue entry whose flink or blink field is NULL.
2 The address of the queue that is being referenced. Typically, this queue is an ExWorkerQueue.
3 The base address of the ExWorkerQueue array. (This address helps you determine if the queue in question is indeed an ExWorkerQueue. If the queue is an ExWorkerQueue, the offset from this parameter will isolate the queue.)
4 Assuming the queue is an ExWorkerQueue, this value is the address of the worker routine that would have been called if the work item had been valid. (You can use this address to isolate the driver that is misusing the work queue.)

Cause

The INVALID_WORK_QUEUE_ITEM bug check occurs when KeRemoveQueue removes a queue entry whose flink or blink field is NULL.

Any queue misuse can cause this error. But typically this error occurs because worker thread work items are misused.

An entry on a queue can be inserted on the list only one time. When an item is removed from a queue, its flink field is set to NULL. Then, when this item is removed the second time, this bug check occurs.

In most situations, the queue that is being referenced is an ExWorkerQueue (executive worker queue). To help identify the driver that caused the error, Parameter 4 displays the address of the worker routine that would have been called if this work item had been valid. However, if the queue that is being referenced is not an ExWorkerQueue, this parameter is not useful.

    WinDbg Output Example:
INVALID_WORK_QUEUE_ITEM (96)
This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null.  This is almost always called by code misusing
worker thread work items, but any queue misuse can cause this.  The rule
is that an entry on a queue may only be inserted on the list once. When an
item is removed from a queue, it's flink field is set to NULL. This bugcheck
occurs when remove queue attempts to remove an entry, but the flink or blink
field is NULL. In order to debug this problem, you need to know the queue being
referenced.
In an attempt to help identify the guilty driver, this bugcheck assumes the
queue is a worker queue (ExWorkerQueue) and prints the worker routine as
parameter 4 below.
Arguments:
Arg1: 0000000000000000, The address of the queue entry whose flink/blink field is NULL
Arg2: 0000000000000000, The address of the queue being references. Usually this is one
    of the ExWorkerQueues.
Arg3: 0000000000000000, The base address of the ExWorkerQueue array. This will help determine
    if the queue in question is an ExWorkerQueue and if so, the offset from
    this parameter will isolate the queue.
Arg4: 0000000000000000, If this is an ExWorkerQueue (which it usually is), this is the address
    of the worker routine that would have been called if the work item was
    valid. This can be used to isolate the driver that is misusing the work
    queue.


STOP 0x00000097: BOUND_IMAGE_UNSUPPORTED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819381.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559303(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The BOUND_IMAGE_UNSUPPORTED bug check has a value of 0x00000097.

This bug check appears very infrequently.

    WinDbg Output Example:
BOUND_IMAGE_UNSUPPORTED (97)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000098: END_OF_NT_EVALUATION_PERIOD    (go to top of page)

Usual causes:  Exactly what it says

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819384.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559306(v=VS.85).aspx

    Knowledge Base Articles:
KB 242407    Windows 2000 System Year May Change to 2019 on ASUS P2B, P2B-D, P2B-F Mainboards
KB 250920    Windows 2000 Evaluation Copy Expiration Behavior
KB 818025    Windows 2003 Server evaluation copy expiration behavior

    WinDbg Help File Entry:

The END_OF_NT_EVALUATION_PERIOD bug check has a value of 0x00000098. This bug check indicates that the trial period for the Microsoft Windows operating system has ended.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The low-order 32 bits of the product expiration date
2 The high-order 32 bits of the product expiration date
3 Reserved
4 Reserved

Cause

Your installation of the Windows operating system is an evaluation unit with an expiration date. The trial period is over.

    WinDbg Output Example:
END_OF_NT_EVALUATION_PERIOD (98)
Your Windows System is an evaluation unit with an expiration date. The trial
period is over.
Arguments:
Arg1: 0000000000000000, The low order 32 bits of your product expiration date
Arg2: 0000000000000000, The high order 32 bits of your product expiration date
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000099: INVALID_REGION_OR_SEGMENT    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819386.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559312(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INVALID_REGION_OR_SEGMENT bug check has a value of 0x00000099. This bug check indicates that ExInitializeRegion or ExInterlockedExtendRegion was called with an invalid set of parameters.

Parameters

None

    WinDbg Output Example:
INVALID_REGION_OR_SEGMENT (99)
ExInitializeRegion or ExInterlockedExtendRegion was called with an invalid
set of parameters.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000009A: SYSTEM_LICENSE_VIOLATION    (go to top of page)

Usual causes:  See parameters for description

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819392.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559317(v=VS.85).aspx

    Knowledge Base Articles:
KB 192821    STOP 0x0000009A During Restore of Registry (NT)

    WinDbg Help File Entry:

The SYSTEM_LICENSE_VIOLATION bug check has a value of 0x0000009A. This bug check indicates that the software license agreement has been violated.

Parameters

The following parameters appear on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x00 0: The product should be WinNT

1: The product should be LanmanNT or ServerNT

A partial serial number The first two characters of the product type from the product options Offline product type changes have been attempted.
0x01 The registered evaluation time from source 1 A partial serial number The registered evaluation time from an alternate source Offline changes to the Microsoft Windows evaluation unit time period have been attempted.
0x02 The status code that is associated with the open failure 0 0 The setup key could not be opened.
0x03 The status code that is associated with the key lookup failure 0 0 The SetupType or SetupInProgress value from the setup key is missing, so setup mode could not be detected.
0x04 The status code that is associated with the key lookup failure 0 0 The SystemPrefix value from the setup key is missing.
0x05 (See the setup code) An invalid value was found in licensed processors The officially licensed number of processors Offline changes to the number of licensed processors have been attempted.
0x06 The status code that is associated with the open failure 0 0 The ProductOptions key could not be opened.
0x07 The status code that is associated with the read failure 0 0 The ProductType value could not be read.
0x08 The status code that is associated with the Change Notify failure 0 0 Change Notify on ProductOptions failed.
0x09 The status code that is associated with the Change Notify failure 0 0 Change Notify on SystemPrefix failed.
0x0A 0 0 0 An NTW system was converted to an NTS system.
0x0B The status code that is associated with the change failure 0 0 The reference of the setup key failed.
0x0C The status code that is associated with the change failure 0 0 The reference of the product options key failed.
0x0D The status code that is associated with the failure 0 0 The attempt to open ProductOptions in the worker thread failed.
0x0F The status code that is associated with the failure 0 0 The attempt to open the setup key failed.
0x10 The status code that is associated with the failure 0: set value failed

1: Change Notify failed

0 A failure occurred in the setup key worker thread.
0x11 The status code that is associated with the failure 0: set value failed

1: Change Notify failed

0 A failure occurred in the product options key worker thread.
0x12 The status code that is associated with the failure 0 0 Unable to open the LicenseInfoSuites key for the suite.
0x13 The status code that is associated with the failure 0 0 Unable to query the LicenseInfoSuites key for the suite.
0x14 The size of the memory allocation 0 0 Unable to allocate memory.
0x15 The status code that is associated with the failure Reserved 0 Unable to reset the ConcurrentLimit value for the suite key.
0x16 The status code that is associated with the failure 0 0 Unable to open the license key for a suite product.
0x17 The status code that is associated with the failure 0 0 Unable to reset the ConcurrentLimit value for a suite product.
0x18 The status code that is associated with the open failure Reserved 0 Unable to start the Change Notify for the LicenseInfoSuites.
0x19 0 0 0 A suite is running on a system that must be PDC.
0x1A The status code that is associated with the failure 0 0 A failure occurred when enumerating the suites.
0x1B 0 0 0 Changes to the policy cache were attempted.

Cause

The Microsoft Windows operating system detects a violation of the software license agreement.

A user might have tried to change the product type of an offline system or change the trial period of an evaluation unit of Windows. For more information about the specific violation, see the parameter list.

    WinDbg Output Example:
SYSTEM_LICENSE_VIOLATION (9a)
A violation of the software license agreement has occurred. This can be due to
either attempting to change the product type of an offline system, or an attempt
to change the trial period of an evaluation unit of Windows.
Arguments:
Arg1: 0000000000000000, means that offline product type changes were attempted
Arg2: 0000000000000000, if 1, product should be LanmanNT or ServerNT. If 0, should be WinNT
Arg3: 0000000000000000, partial serial number
Arg4: 0000000000000000, first two characters of product type from product options.


STOP 0x0000009B: UDFS_FILE_SYSTEM    (go to top of page)

Usual causes:  Disk corruption, File system corruption, SCSI/IDE drivers, Memory, Insufficient memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819394.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559318(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The UDFS_FILE_SYSTEM bug check has a value of 0x0000009B. This bug check indicates that a problem occurred in the UDF file system.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 If UdfExceptionFilter is on the stack, this parameter specifies the address of the exception record.
3 If UdfExceptionFilter is on the stack, this parameter specifies the address of the context record.
4 Reserved.

Cause

The UDFS_FILE_SYSTEM bug check might be caused disk corruption. Corruption in the file system or bad blocks (sectors) on the disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to the disk and cause the error.

This bug check might also occur if nonpaged pool memory is full. If the nonpaged pool memory is full, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver that requires nonpaged pool memory can also trigger this error.

Resolving the Problem

To debug this problem: Use the .cxr (Display Context Record) command with Parameter 3, and then use kb (Display Stack Backtrace).

To resolve a disk corruption problem: Check Event Viewer for error messages from SCSI and FASTFAT (System Log) or Autochk (Application Log) that might help identify the device or driver that is causing the error. Disable any virus scanners, backup application, or disk defragmenter tools that continually monitor the system. You should also run hardware diagnostics that the system manufacturer supplies. For more information about these procedures, see the owner's manual for your computer. Run Chkdsk /f /r to detect and resolve any file system structural corruption. You must restart the system before the disk scan begins on a system partition.

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This memory increases the quantity of nonpaged pool memory that is available to the kernel.

    WinDbg Output Example:
UDFS_FILE_SYSTEM (9b)
    If you see UdfExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more helpful stack
    trace.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000009C: MACHINE_CHECK_EXCEPTION    (go to top of page)

Usual causes:  Hardware error (similar to STOP 0x124)

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819396.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559323(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x9c

    Knowledge Base Articles:
KB 162363    Understanding and troubleshooting the "Stop 0x0000009C" screen (NT, 2000, XP, Server 2003)
KB 329284    Stop error message in Windows XP that you may receive: "0x0000009C (0x00000004, 0x00000000, 0xb2000000, 0x00020151)"
KB 840551    Intermittent errors in IA64 editions of Windows Server 2003: Stop error code 0x0000009C (MACHINE_CHECK_EXCEPTION), Stop error code 0x00000024 (NTFS_FILE_SYSTEM), or Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)
KB 910621    Error message when you run a Hardware Compatibility Test on a computer that is running Windows Server 2003 for Itanium-based Systems: "Stop 0x0000009C"
KB 939315    Windows 2003 Server evaluation copy expiration behavior

    WinDbg Help File Entry:

The MACHINE_CHECK_EXCEPTION bug check has a value of 0x0000009C. This bug check indicates that a fatal machine check exception has occurred.

Parameters

The four parameters that are listed in the message have different meanings, depending on the processor type.

If the processor is based on an older x86-based architecture and has the Machine Check Exception (MCE) feature but not the Machine Check Architecture (MCA) feature (for example, the Intel Pentium processor), the parameters have the following meaning.

Parameter Description
1 The low 32 bits of P5_MC_TYPE Machine Service Report (MSR)
2 The address of the MCA_EXCEPTION structure
3 The high 32 bits of P5_MC_ADDR MSR
4 The low 32 bits of P5_MC_ADDR MSR

If the processor is based on a newer x86-based architecture and has the MCA feature and the MCE feature (for example, any Intel Processor of family 6 or higher, such as Pentium Pro, Pentium IV, or Xeon), or if the processor is an x64-based processor, the parameters have the following meaning.

Parameter Description
1 The bank number
2 The address of the MCA_EXCEPTION structure
3 The high 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 The low 32 bits of MCi_STATUS MSR for the MCA bank that had the error

On an Itanium-based processor, the parameters have the following meaning.

Note  Parameter 1 indicates the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x1 The address of the log The size of the log 0
0x2 The address of the log The size of the log The error code The system abstraction layer (SAL) returned an error for SAL_GET_STATEINFO while processing MCA.
0x3 The address of the log The size of the log The error code SAL returned an error for SAL_CLEAR_STATEINFO while it processed MCA.
0x4 The address of the log The size of the log 0 Firmware (FW) reported a fatal MCA.
0x5 The address of the log The size of the log 0 There are two possible causes:
  • SAL reported a recoverable MCA, but this recovery is not currently supported.
  • SAL generated an MCA but could not produce an error record.
0xB The address of the log The size of the log 0
0xC The address of the log The size of the log The error code SAL returned an error for SAL_GET_STATEINFO while processing an INIT event.
0xD The address of the log The size of the log The error code SAL returned an error for SAL_CLEAR_STATEINFO while it processed an INIT event.
0xE The address of the log The size of the log 0

Comments

For more information about Machine Check Architecture (MCA), see the Intel or AMD Web sites.

Note  Starting with Windows Vista, this bug check is no longer supported, and has been replaced with bug Check 0x124: WHEA_UNCORRECTABLE_ERROR.

    WinDbg Output Example:
MACHINE_CHECK_EXCEPTION (9c)
A fatal Machine Check Exception has occurred.
KeBugCheckEx parameters;
    x86 Processors
        If the processor has ONLY MCE feature available (For example Intel
        Pentium), the parameters are:
        1 - Low  32 bits of P5_MC_TYPE MSR
        2 - Address of MCA_EXCEPTION structure
        3 - High 32 bits of P5_MC_ADDR MSR
        4 - Low  32 bits of P5_MC_ADDR MSR
        If the processor also has MCA feature available (For example Intel
        Pentium Pro), the parameters are:
        1 - Bank number
        2 - Address of MCA_EXCEPTION structure
        3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
        4 - Low  32 bits of MCi_STATUS MSR for the MCA bank that had the error
    IA64 Processors
        1 - Bugcheck Type
            1 - MCA_ASSERT
            2 - MCA_GET_STATEINFO
                SAL returned an error for SAL_GET_STATEINFO while processing MCA.
            3 - MCA_CLEAR_STATEINFO
                SAL returned an error for SAL_CLEAR_STATEINFO while processing MCA.
            4 - MCA_FATAL
                FW reported a fatal MCA.
            5 - MCA_NONFATAL
                SAL reported a recoverable MCA and we don't support currently
                support recovery or SAL generated an MCA and then couldn't
                produce an error record.
            0xB - INIT_ASSERT
            0xC - INIT_GET_STATEINFO
                  SAL returned an error for SAL_GET_STATEINFO while processing INIT event.
            0xD - INIT_CLEAR_STATEINFO
                  SAL returned an error for SAL_CLEAR_STATEINFO while processing INIT event.
            0xE - INIT_FATAL
                  Not used.
        2 - Address of log
        3 - Size of log
        4 - Error code in the case of x_GET_STATEINFO or x_CLEAR_STATEINFO
    AMD64 Processors
        1 - Bank number
        2 - Address of MCA_EXCEPTION structure
        3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
        4 - Low  32 bits of MCi_STATUS MSR for the MCA bank that had the error
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000009D:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (9d)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000009E: USER_MODE_HEALTH_MONITOR    (go to top of page)

Usual causes:  Failure of critical user-mode component(s)

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559326(v=VS.85).aspx

    Knowledge Base Articles:
KB 960228    You receive a Stop error when you click the arrow to scroll down an application pop-up menu on a Windows Server 2003 SP1 or SP2-based computer
KB 2135160     FIX: "0x0000009E" Stop error when you host Hyper-V virtual machines in a Windows Server 2008 R2-based failover cluster
KB 2520235    "0x0000009E" Stop error when you add an extra storage disk to a failover cluster in Windows Server 2008 R2
KB 2814923    "0x0000009E" Stop error and disk volumes cannot be brought online on a Windows Server 2008 R2-based failover cluster
KB 2863960    Stop error message on Windows Server 2012-based computer: "DRIVER_IRQL_NOT_LESS_OR_EQUAL" or "USER_MODE_HEALTH_MONITOR"

    WinDbg Help File Entry:

The USER_MODE_HEALTH_MONITOR bug check has a value of 0x0000009E. This bug check indicates that one or more critical user-mode components failed to satisfy a health check.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The process that failed to satisfy a health check in the configured time-out
2 The health monitoring time-out, in seconds
3 Reserved
4 Reserved

Cause

Hardware mechanisms, such as watchdog timers, can detect that basic kernel services are not executing. However, resource starvation issues (including memory leaks, lock contention, and scheduling priority misconfiguration) can block critical user-mode components without blocking deferred procedure calls (DPCs) or draining the non-paged pool.

Kernel components can extend watchdog timer functionality to user mode by periodically monitoring critical applications. This bug check indicates that a user-mode health check failed in a way that prevents graceful shutdown. This bug check restores critical services by restarting or enabling application failover to other servers.

On the Microsoft Windows Server 2003, Enterprise Edition, Windows Server 2003, Datacenter Edition, and Windows 2000 with Service Pack 4 (SP4) operating systems, a user-mode hang can also cause this bug check. The bug check occurs in this situation only if the user has set HangRecoveryAction to a value of 3.

    WinDbg Output Example:
USER_MODE_HEALTH_MONITOR (9e)
One or more critical user mode components failed to satisfy a health check.
Hardware mechanisms such as watchdog timers can detect that basic kernel
services are not executing. However, resource starvation issues, including
memory leaks, lock contention, and scheduling priority misconfiguration,
may block critical user mode components without blocking DPCs or
draining the nonpaged pool.
Kernel components can extend watchdog timer functionality to user mode
by periodically monitoring critical applications. This bugcheck indicates
that a user mode health check failed in a manner such that graceful
shutdown is unlikely to succeed. It restores critical services by
rebooting and/or allowing application failover to other servers.
Arguments:
Arg1: 0000000000000000, Process that failed to satisfy a health check within the
    configured timeout
Arg2: 0000000000000000, Health monitoring timeout (seconds)
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000009F: DRIVER_POWER_STATE_FAILURE    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559329(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x9f
    Other Articles:
        http://www.codemachine.com/article_debugging0x9F.html
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/11910-complete-guide-debugging-stop-0x9f.html
        http://www.sysnative.com/forums/showthread.php?265-Stopped-up-IRPs-%280x9F%29
        http://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/9153-pnp-timeouts-0x9f.html
        http://bsodanalysis.blogspot.com/2012/07/0x9f-driverpowerstatefailure.html
        https://bsodtutorials.wordpress.com/2013/05/14/debugging-stop-0x9f-blocked-irps/
        https://bsodtutorials.wordpress.com/2013/07/18/debugging-a-stop-0x9f-even-further-using-drvobj/
        https://bsodtutorials.wordpress.com/2013/07/15/debugging-a-stop-0x9f-power-transistion-time-out/
        https://bsodtutorials.wordpress.com/2013/08/11/stop-0x9f-checking-devices-and-sleep-compatiblity/
        https://bsodtutorials.wordpress.com/2013/11/29/understanding-stop-0x9f-how-it-works/
        https://bsodtutorials.wordpress.com/2013/12/13/debugging-stop-0x9f-multiple-completion-status-fields/
        https://bsodtutorials.wordpress.com/2014/02/02/debugging-stop-0x9f-power-irps-and-pnp-manager/
        https://bsodtutorials.wordpress.com/2014/11/21/the-complete-guide-to-debugging-a-stop-0x9f/
        http://bsoddebugging.blogspot.com/2014/07/0x9f-driverpowerstatefailure.html

    Knowledge Base Articles:
                       Troubleshooting specific Stop messages
KB 246243    Troubleshooting STOP 0x9F Error Messages in Windows (2000)
KB 263560    Stop 0x0000009F During Shutdown, Standby, or Restart (2000)
KB 271838    "Stop 0x0000009F" in Autosave.sys When Shutting Down Windows 2000
KB 314101    Computer Hangs During Shutdown or Displays a "Cannot Find Enough Free Resources" Error Message (XP)
KB 315249    Troubleshooting a Stop 0x9F Error in Windows XP
KB 832452    You receive a "STOP: 0x0000009F" error when you shut down or restart a Windows 2000-based computer
KB 929762    You receive a Stop 0x9F error when you wake a Windows Vista-based computer that is connected to an IEEE 1394-based device
KB 931671    Error message when you put a Windows Vista-based computer to sleep while a PPP connection is active: "STOP 0x0000009F"
KB 932755    An updated Storport storage driver is available for Windows Server 2003
KB 937322    Stop error message when you run the "Common Scenario Stress with IO" test, print to a shared printer on the network, or perform a power management operation on a Windows Vista-based computer: "Stop 0x0000009F"
KB 941858    You receive a Stop error message when you put a Windows Vista-based computer to sleep or into hibernation, or when you resume the computer from sleep or from hibernation: "0x0000009F DRIVER_POWER_STATE_FAILURE"
KB 946988    Stop error message when you try to put a Windows Vista-based computer to sleep while a dial-up network connection is active: "STOP: 0x0000009F"
KB 954429    You experience problems on a multiprocessor computer that is running Windows Server 2003, Windows Vista, or Windows Server 2008 when you resume the computer from hibernation
KB 957126    Error message when you try to resume a computer that is running Windows Vista or Windows Server 2008 from hibernation: "STOP 0x0000009F"
KB 960884    If you repeatedly unplug and re-plug a 1394a hard disk on a Windows Vista-based or Windows Server 2008-based computer that has two 1394a hard disks, the other 1394a hard disk becomes inaccessible
KB 962201    Error message when you put a Windows Vista-based or a Windows Server 2008-based computer to sleep, or you wake the computer up: "STOP: 0x0000009F"
KB 972109    The shutdown process does not finish, and you receive an error message on a computer that is running Windows Vista or Windows Server 2008: "Stop 0x0000009F"
KB 975599    Stop error when you put a computer that is running Windows 7 or Windows Server 2008 R2 to sleep or into hibernation, or when you restart the computer: "0x9F"
KB 977186    Error message when you try to resume a Windows 7-based or a Windows Server 2008 R2-based computer from hibernation: "Stop 0x0000009F"
KB 979148    "0x0000009F" or "0x000000A0" Stop errors on a computer that is running Windows Vista or Windows Server 2008 when a USB webcam is set as the default audio device
KB 981848    "0x0000009F" Stop error message when a computer enters and resumes from hibernation in Windows 7 or Windows Server 2008 R2 
KB /982091    "Stop 0x9F" or "Stop 0xFE" error on a Windows 7-based or Windows Vista-based computer that uses certain AMD USB EHCI host controllers
KB 2315295   "0x0000009F" Stop error when you resume a computer that is running Windows Server 2008 R2 or Windows 7 from sleep
KB 2459268   "0x0000009F" Stop error in Windows 7 or in Windows Server 2008 R2 when the computer enters or resumes from the Soft Off (S5) power state
KB 2482122    "0x0000009F" Stop error when you restart a Windows 7-based or Windows Server 2008 R2-based computer that has certain Wi-Fi drivers installed
KB 2677930    0x0000009F Stop error in Windows 7 during sleep operation
KB 2690653    An update is available for Windows 8 Consumer Preview
KB 2720599    "0x0000009F" Stop error when you resume a computer from hibernation in Windows 7 or in Windows Server 2008 R2
KB 2813621    "0x0000009F" Stop error when a website turns on a webcam in Windows 8
KB 2911204    Stop error 0x9F in the mf.sys driver occurs in Windows (Windows 7/Windows 8.1/Server 2008 R2/Server 2012 R2)

    More BSOD articles at this link:  http://search.microsoft.com/results.aspx?mkt=en-US&q=stop%3A%200x0000009f&qsc0=0&l=1&first=1&FORM=PEME

    WinDbg Help File Entry:

The DRIVER_POWER_STATE_FAILURE bug check has a value of 0x0000009F. This bug check indicates that the driver is in an inconsistent or invalid power state.

Parameters

The following parameters appear on the blue screen. Parameter 1 indicates the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x1 The device object Reserved Reserved The device object that is being freed still has an outstanding power request that it has not completed.
0x2 The target device's device object, if it is available The device object The driver object, if it is available The device object completed the I/O request packet (IRP) for the system power state request, but it failed to call PoStartNextPowerIrp.
0x3 (Windows 2000 only) A pointer to the target device object A pointer to the device object The IRP The device driver did not properly set the IRP as "pending" or complete the IRP.
0x3 (Windows XP and later) The physical device object (PDO) of the stack The functional device object (FDO) of the stack The blocked IRP A device object has been blocking an IRP for too long a time.
0x100 (Windows 2000 only) A pointer to the nonpaged device object A pointer to the target device object A pointer to the device object to notify The device objects in the devnode inconsistently used DO_POWER_PAGABLE.
0x101 (Windows 2000 only) The child device object (FDO) The child device object (PDO) The parent device object A parent device object has detected that a child device has not set the DO_POWER_PAGABLE bit.
0x500 (Windows XP and Windows Server 2003 only) Reserved The target device's device object, if available Device object The device object completed the IRP for the system power state request, but it failed to call PoStartNextPowerIrp.

Cause

For a description of the possible causes, see the description of each code in the Parameters section.

The errors that cause Parameter 1 to be 0x3, 0x100, or 0x101 only exist in Microsoft Windows 2000. In Windows XP and later versions of Windows, these errors are superseded by Driver Verifier tests. For more information about Driver Verifier, see the Driver Verifier section of the Windows Driver Kit.

    WinDbg Output Example:
DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 00000003, A device object has been blocking an Irp for too long a time
Arg2: 8970a028, Physical Device Object of the stack
Arg3: 89709ac8, Functional Device Object of the stack
Arg4: 8aa33d50, The blocked IRP



STOP 0x000000A0: INTERNAL_POWER_ERROR    (go to top of page)

Usual causes:  See parameters for details

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559341(v=VS.85).aspx

    Knowledge Base Articles:
KB 314118    Device Driver Error Message Is Generated When the Computer Enters Standby or Hibernate Mode (XP)
KB 320899    Windows XP Generates a "Stop 0xA0" Error Message During Hibernation
KB 942524    Stop error message when you put a Windows Vista-based computer in hibernation: "STOP: 0x000000A0 (0x00000009, 0xc0000001, 0x00000001, 0x00000000) INTERNAL_POWER_ERROR (a0)"
KB 956871    The system may crash when you put a Windows Vista-based computer or a Windows Server 2008-based computer into hibernation
KB 969853    Stop error message when you try to put a Windows Vista-based computer or a Windows Server 2008-based computer into hibernation: "STOP: 0x000000A0 (0x00000009, 0xc000009a, 0x00000000, 0x00000000) INTERNAL_POWER_ERROR (a0)"
KB 974772    Error when entering Hibernation on a Windows 7-based computer: “STOP 0x000000A0 INTERNAL_POWER_ERROR (0x0000000B, 0x????????, 0x????????, 0x????????)”
KB 979148    "0x0000009F" or "0x000000A0" Stop errors on a computer that is running Windows Vista or Windows Server 2008 when a USB webcam is set as the default audio device
KB 2823506    "0x000000A0" Stop error when you resume Windows 8 or Windows Server 2012 from hibernate

    More BSOD articles at this link:  http://search.microsoft.com/results.aspx?mkt=en-US&q=stop%3A%200x000000a0&qsc0=0&l=1&first=1&FORM=PEME

    WinDbg Help File Entry:

The INTERNAL_POWER_ERROR bug check has a value of 0x000000A0. This bug check indicates that the power policy manager experienced a fatal error.

Parameters

The following parameters appear on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x1 1: A device has overrun its maximum number of reference counts.

2, 3, or 4: (Windows Server 2003, Windows XP, and Windows 2000 only ) Too many inrush power IRPs have been queued.

5: (Windows Server 2003, Windows XP, and Windows 2000 only) The power IRP has been sent to a passive level device object.

Except when Parameter 2 is equal to 5, this parameter indicates the maximum number of pending IRPs that are allowed.

If Parameter 2 is equal to 5, this parameter is reserved.

Reserved An error occurred during the handling of the power I/O request packet (IRP).
0x2 Reserved Reserved Reserved An internal failure has occurred while attempting to process a power event.
0x3 The expected checksum The actual checksum The line number of the failure The checksum for a hibernation context page does not match its expected checksum.
0x4 The expected checksum The actual checksum The line number of the failure The checksum for a page about to be written to the hibernation file does not match its expected checksum.
0x5 Reserved Reserved Reserved An unknown shutdown code has been sent to the system shutdown handler.
0x7 Reserved Reserved Reserved An unhandled exception has occurred.
0x8


A fatal error occurred while processing a system power event.

(See the following table for more details.)

0x9  
(see link)     
                                                                                                                                                                                                   Parameter 1 of 0x9 =  A fatal error occured  
while preparing the hibernate file  

When Parameter 1 is0x8, a fatal error occurred while processing a system power event. In this situation, Parameter 2 indicates the cause of the error. The meaning of the other parameters depends on the value of Parameter 2.

Parameter 2 Parameter 3 Parameter 4 Cause
0x100 The device object The address of the POWER_CHANNEL_SUMMARY structure (a record of device object states) An unknown device type is being processed.
0x101 Exception pointer Reserved An unhandled exception occurred.
0x102 The address of the DUMP_INITIALIZATION_CONTEXT structure, which contains the information that is passed from the system to the disk dump driver during the driver's initialization The address of the POP_HIBER_CONTEXT structure, which contains information about the state of the computer before hibernation The hibernation working buffer size is not page-aligned.
0x103 The address of the POP_HIBER_CONTEXT structure Reserved Some working pages were not accounted for during the hibernation process.
0x104 The address of the POP_HIBER_CONTEXT structure Reserved An attempt was made to map internal hibernation memory while the internal memory structures were locked.
0x105 The address of the POP_HIBER_CONTEXT structure Reserved An attempt was made to map internal hibernation memory with an unsupported memory type flag.
0x106 The MDL Reserved A memory descriptor list (MDL) was created during the hibernation process that describes memory that is not paged-aligned.
0x107 The address of the POP_HIBER_CONTEXT structure The address of the PO_MEMORY_RANGE_ARRAY structure A data mismatch occurred in the internal hibernation data structures.
0x108 The address of the POP_HIBER_CONTEXT structure Reserved The disk subsystem failed to properly write part of the hibernation file.
0x109 The expected checksum The actual checksum The checksum for the processor state data does not match its expected checksum.
0x10A The address of the POP_HIBER_CONTEXT structure The NTSTATUS failure code The disk subsystem failed to properly write part of the hibernation file.
0x200 The device object The address of the DEVICE_OBJECT_POWER_EXTENSION notification structure An unknown device type is being checked for an idle state.
0x300 The device object The IRP An unknown status was returned from a battery power IRP.
0x301 The device object The IRP The battery has entered an unknown state.
0x400 The IRP stack location The device object A device has overrun its maximum number of reference counts.
0x401,
0x402,
or
0x403
The pending IRP list The device object (Windows Server 2003, Windows XP, and Windows 2000 only) Too many inrush power IRPs have been queued.
0x404 The IRP stack location The device object (Windows Server 2003, Windows XP, and Windows 2000 only) A power IRP has been sent to a passive level device object.
0x500 The IRP The device object An unknown status was returned from a thermal power IRP.

Cause

For more information about the exact cause for the INTERNAL_POWER_ERROR bug check, see the tables in the Parameters section above.

Resolving the Problem

The following procedures will help you debug certain instances of this bug check.

Debugging bug check 0xA0 when Parameter 1 equals 0x2
  1. Examine the stack. Look for the ntoskrnl!PopExceptionFilter function. This function contains the following code as its first argument.

     (error_code << 16) | _LINE_

    If the caller is PopExceptionFilter, the first argument to this function is of type PEXCEPTION_POINTERS. Note the value of this argument.

  2. Use the dt (Display Type) command and specify the value that you found in the previous step as argument.

    dt nt!_EXCEPTION_POINTERS argument 

    . This command displays the structure. Note the address of the context record.

  3. Use the .cxr (Display Context Record) command and specify the context record that you found in the previous step as record.

    .cxr record 

    . This command sets the register context to the proper value.

  4. Use a variety of commands to analyze the source of the error. Start with kb (Display Stack Backtrace) .
Debugging bug check 0xA0 when Parameter 1 equals 0x7
  1. Examine the stack. Look for the ntoskrnl!PopExceptionFilter function. The first argument to this function is of type PEXCEPTION_POINTERS. Note the value of this argument.
  2. Use the dt (Display Type) command and specify the value that you found in the previous step as argument.

    dt nt!_EXCEPTION_POINTERS argument 

    This command displays the structure. Note the address of the context record.

  3. Use the .cxr (Display Context Record) command and specify the context record that you found in the previous step as record.

    .cxr record 

    This command sets the register context to the proper value.

  4. Use a variety of commands to analyze the source of the error. Start with kb (Display Stack Backtrace) .
Debugging bug check 0xA0 when Parameter 1 equals 0x8 and Parameter 2 equals 0x101
  1. Use the dt (Display Type) command and specify the value of Parameter 3 as argument.

    dt nt!_EXCEPTION_POINTERS argument 

    This command displays the structure. Note the address of the context record.

  2. Use the .cxr (Display Context Record) command and specify the context record that you found the previous step as record.

    .cxr record 

    This command sets the register context to the proper value.

  3. Use a variety of commands to analyze the source of the error. Start with kb (Display Stack Backtrace) .
    WinDbg Output Example:
INTERNAL_POWER_ERROR (a0)
The power policy manager experienced a fatal error.
Arguments:
Arg1: 0000000000000000,
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

    From a recent dump file that I ran into here:  http://www.sevenforums.com/crashes-debugging/84490-bsod-hibernating-windows-7-a.html#post731741
INTERNAL_POWER_ERROR (a0)
The power policy manager experienced a fatal error.
Arguments:
Arg1: 0000000000000009, A fatal error occured while preparing the hibernate file.
Arg2: ffffffffc0000185, Status code (Status code translates to : STATUS_IO_DEVICE_ERROR)
Arg3: 0000000000000001, Mirroring phase
Arg4: 0000000000000000



STOP 0x000000A1: PCI_BUS_DRIVER_INTERNAL    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560101(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PCI_BUS_DRIVER_INTERNAL bug check has a value of 0x000000A1. This bug check indicates that the PCI Bus driver detected inconsistency problems in its internal structures and could not continue.

Parameters

None

    WinDbg Output Example:
PCI_BUS_DRIVER_INTERNAL (a1)
The PCI Bus driver detected inconsistency
problems in its internal structures and could not continue.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A2: MEMORY_IMAGE_CORRUPT    (go to top of page)

Usual causes:  Memory, Pagefile corruption, Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560105(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The MEMORY_IMAGE_CORRUPT bug check has a value of 0x000000A2. This bug check indicates that corruption has been detected in the image of an executable file in memory.

Parameters

The following parameters appear on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x02 If Parameter 3 is zero: The page number in the table page that failed

If Parameter 3 is nonzero: The page number with the failing page run index

Zero, or the index that failed to match the run 0 A table page check failure occurred.
0x03 The starting physical page number of the range The length (in pages) of the range The page number of the table page that contains this run The checksum for the range of memory listed is incorrect.

Cause

A cyclic redundancy check (CRC) check on the memory range has failed.

On a system wake operation, various regions of memory might be checked to guard against memory failures.

    WinDbg Output Example:
MEMORY_IMAGE_CORRUPT (a2)
On a system wake operation, various regions of memory may be CRCed to
guard against memory failures.
Arguments:
Arg1: 0000000000000000,
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A3: ACPI_DRIVER_INTERNAL    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560106(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The ACPI_DRIVER_INTERNAL bug check has a value of 0x000000A3. This bug check indicates that the ACPI driver detected an internal inconsistency.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 Reserved
2 Reserved
3 Reserved
4 Reserved

Cause

An inconsistency in the ACPI driver is so severe that continuing to run would cause serious problems.

One possible source of this problem is a BIOS error.

    WinDbg Output Example:
ACPI_DRIVER_INTERNAL (a3)
The ACPI Driver detected an internal inconsistency. The inconsistency is
so severe that continuing to run would cause serious problems.
The ACPI driver calls this when the state is so inconsistent that proceeding
would actually be dangerous. The problem may or may not be a BIOS issue, but
there is no way to tell.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A4: CNSS_FILE_SYSTEM_FILTER    (go to top of page)

Usual causes:  Memory, Indexing, Insufficient memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560110(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CNSS_FILE_SYSTEM_FILTER bug check has a value of 0x000000A4. This bug check indicates that a problem occurred in the CNSS file system filter.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 Reserved
3 Reserved
4 Reserved

Cause

The CNSS_FILE_SYSTEM_FILTER bug check might occur because nonpaged pool memory is full. If the nonpaged pool memory is completely full, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver that requires nonpaged pool memory can also trigger this error.

Resolving the Problem

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This memory sincrease the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
CNSS_FILE_SYSTEM_FILTER (a4)
    See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A5: ACPI_BIOS_ERROR    (go to top of page)

Usual causes:  BIOS

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560114(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xa5
    Other Articles:
        https://bsodtutorials.wordpress.com/2014/01/10/debugging-stop-0xa5-acpi_bios_error/

    Knowledge Base Articles:
KB 256841    "STOP 0x000000A5" When Installing Windows 2000
KB 314830    "Stop 0x000000A5" Error When You Are Installing Windows XP
KB 831691    "Stop 0x000000A5 the ACPI BIOS in the system is not fully compliant with the ACPI specification" error message when the computer resumes from hibernation (XP)
KB 935806    Troubleshooting Stop error messages that may occur when you try to install Windows Vista
KB 969179    A Windows XP-based computer becomes unresponsive or displays a "STOP 0x000000A5" error message during system shutdown

    WinDbg Help File Entry:

The ACPI_BIOS_ERROR bug check has a value of 0x000000A5. This bug check indicates that the Advanced Configuration and Power Interface (ACPI) BIOS of the computer is not fully compliant with the ACPI specification.

Parameters

Four bug check parameters appear on the blue screen. Parameter 1 indicates the kind of the incompatibility. The meaning of the other parameters depends on the value of Parameter 1.

If the BIOS incompatibility is related to Plug and Play (PnP) or power management, the following parameters are used.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x01 ACPI's deviceExtension ACPI's ResourceList 0: No resource list is found

1: No IRQ resource is found in list

ACPI cannot find the System Control Interrupt (SCI) vector in the resources that are handed to it when ACPI is started.
0x02


(See the table later on this page)
0x03 The ACPI object that was being run The return value from the interpreter The name of the control method (in ULONG format) ACPI tried to run a control method while creating device extensions to represent the ACPI namespace, but this control method failed.
0x04 The ACPI extension that _PRW belongs to A pointer to the method The DataType returned (see Amli.h) ACPI evaluated a _PRW and expected to find an integer as a package element.
0x05 The ACPI extension that _PRW belongs to Aointer to the _PRW The number of elements in the _PRW ACPI evaluated a _PRW, and the package that came back failed to contain at least two elements. The ACPI specification requires that two elements always be present in a _PRW.
0x06 The ACPI extension that _PRx belongs to A pointer to the _PRx A pointer to the name of the object to look for ACPI tried to find a named object, but it could not find the object.
0x07 The ACPI extension that the method belongs to A pointer to the method The DataType returned (see Amli.h) ACPI evaluated a method and expected to receive a buffer in return. However, the method returned some other data type.
0x08 The ACPI extension that the method belongs to A pointer to the method The DataType returned (see Amli.h) ACPI evaluated a method and expected to receive an integer in return. However, the method returned some other data type.
0x09 The ACPI extension that the method belongs to A pointer to the method The DataType returned (see Amli.h) ACPI evaluated a method and expected to receive a package in return. However, the method returned some other data type.
0x0A The ACPI extension that the method belongs to A pointer to the method The DataType returned (see Amli.h) ACPI evaluated a method and expected to receive a string in return. However, the method returned some other data type.
0x0B The ACPI extension that _EJD belongs to The status that the interpreter returns The name of the object that ACPI is trying to find ACPI cannot find the object that an _EJD string references.
0x0C The ACPI extension that ACPI found a dock device for A pointer to the _EJD method 0: BIOS does not claim system is dockage

1: Duplicate device extensions for dock device

ACPI provides faulty or insufficient information for dock support.
0x0D The ACPI extension that ACPI needs the object for The (ULONG) name of the method that ACPI looked for 0: Base case

1: Conflict

ACPI could not find a required method or object in the namespace This bug check code is used if there is no _HID or _ADR present.
0x0E The NS PowerResource that ACPI needs the object for The (ULONG) name of the method that ACPI looked for 0: Base case ACPI could not find a required method or object in the namespace for a power resource (or entity other than a "device"). This bug check code is used if there is no _ON, _OFF, or _STA present for a power resource.
0x0F The current buffer that ACPI was parsing The buffer's tag The specified length of the buffer ACPI could not parse the resource descriptor.
0x10


(See the table later on this page)
0x11


(See the table later on this page)
0x14 The current buffer that ACPI was parsing The buffer's tag A pointer to a variable that contains the ULONGLONG length of the buffer ACPI could not parse the resource descriptor. The length exceeds MAXULONG.
0x15 The ACPI Machine Language (AML) context 1: Failed to load table

2: The Parameter Path String Object was not found

3: Failed to insert Parameter Data into the ParameterPath String Object

4: Out of system memory

The NT status code ACPI had a fatal error when attempting to load a table.
0x16 A pointer to the parent NSOBJ A pointer to the illegal child ACPI namespace object Reserved ACPI had a fatal error when processing an xSDT. An object was declared as a child of a parent that cannot have children.

If an interrupt routing failure or incompatibility has occurred, the following parameters are used.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x2001 InterruptModel (integer) The return value from the interpreter A pointer to the PIC control method ACPI tried to evaluate the PIC control method but failed.
0x10001 A pointer to the device object A pointer to the parent of the device object A pointer to the _PRT object

(See the following Comments section)

ACPI tried to do interrupt routing, but failed.
0x10002 A pointer to the device object A pointer to the string name that ACPI was looking for but could not find A pointer to the _PRT object

(See the following Comments section)

ACPI could not find the link node referenced in a _PRT.
0x10003 A pointer to the device object The device ID or function number.

This DWORD is encoded as follows: bits 5:0 are the PCI device number, and bits 8:6 are the PCI function number

A pointer to the _PRT object

(See the following Comments section)

ACPI could not find a mapping in the _PRT package for a device.
0x10005 A pointer to the _PRT object

(See the following Comments section)

A pointer to the current _PRT element.

(This pointer is an index into the _PRT.)

The device ID or function number.

This DWORD is encoded as follows: bits 15:0 are the PCI function number, and bits 31:16 are the PCI device number

ACPI found an entry in the _PRT that the function ID is not all F's for.

(The generic format for a _PRT entry is that the device number is specified, but the function number is not.)

0x10006 A pointer to the link node.

(This device is missing the _DIS method.)

0 0 ACPI found a link node, but it cannot disable the node.

(Link nodes must be disabled to allow for reprogramming.)

0x10007 The vector that could not be found 0 0 The _PRT contained a reference to a vector that is not described in the I/O APIC entry's MAPIC table.
0x10008 The invalid interrupt level. 0 0 The ACPI SCI interrupt level is invalid.



0x10009 0 0 0 The Fixed ACPI Description Table (FADT) could not be located.
0x1000A 0 0 0 The Root System Description Pointer (RSDP) or Extended System Description Table (XSDT) could not be located



0x1000B The ACPI table signature A pointer to the ACPI table 0 The length of the ACPI table is not consistent with the table revision.
0x20000 The I/O port in the Fixed Table 0 0 The PM_TMR_BLK entry in the Fixed ACPI Description Table doesn't point to a working ACPI timer block.

If a miscellaneous failure or incompatibility has occurred, the following parameters are used.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x20000 The I/O port in the Fixed Table 0 0 The PM_TMR_BLK entry in the Fixed ACPI Description Table does not point to a working ACPI timer block.

If Parameter 1 equals 0x02, the ACPI BIOS could not process the resource list for the PCI root buses. In this case, Parameter 3 specifies the exact problem, and the remaining parameters have the following definitions.

Parameter 2 Parameter 3 Parameter 4 Cause
The ACPI extension for the PCI bus 0x0 A pointer to the QUERY_RESOURCES IRP ACPI cannot convert the BIOS' resource list into the proper format. This probably represents an error in the BIOS' list encoding procedure.
The ACPI extension for the PCI bus 0x1 A pointer to the QUERY_RESOURCE_REQUIREMENTS IRP ACPI cannot convert the BIOS' resource list into the proper format. This probably represents an error in the BIOS' list encoding procedure.
The ACPI extension for the PCI bus 0x2 0 ACPI found an empty resource list.
The ACPI extension for the PCI bus 0x3 A pointer to the PNP CRS descriptor ACPI could not find the current bus number in the CRS.
The ACPI extension for the PCI bus A pointer to the resource list for PCI A pointer to the E820 memory table The list of resources that PCI claims to decode overlaps with the list of memory regions that the E820 BIOS interface reports. (This kind of conflict is never permitted.)

If Parameter 1 equals 0x10, the ACPI BIOS could not determine the system-to-device-state mapping correctly. In this situation, Parameter 3 specifies the exact problem, and the remaining parameters have the following definitions.

Parameter 2 Parameter 3 Parameter 4 Cause
The ACPI extension whose mapping is needed 0x0 The DEVICE_POWER_STATE (this is "x+1") _PRx was mapped back to a non-supported S-state.
The ACPI extension whose mapping is needed 0x1 The SYSTEM_POWER_STATE that cannot be mapped ACPI cannot find a D-state to associate with the S-state.
The ACPI extension whose mapping is needed 0x2 The SYSTEM_POWER_STATE that cannot be mapped The device claims to be able to wake the system when the system is in this S-state, but the system does not actually support this S-state.

If Parameter 1 equals 0x11, the system could not enter ACPI mode. In this situation, Parameter 2 specifies the exact problem, and the remaining parameters have the following definitions.

Parameter 2 Parameter 3 Parameter 4 Cause
0x0 0 0 The system could not initialize the AML interpreter.
0x1 0 0 The system could not find RSDT.
0x2 0 0 The system could not allocate critical driver structures.
0x3 0 0 The system could not load RSDT.
0x4 0 0 The system could not load DDBs.
0x5 0 0 The system cannot connect the Interrupt vector.
0x6 0 0 SCI_EN never becomes set in PM1 Control Register.
0x7 A pointer to the table that had a bad checksum Creator revision The table checksum is incorrect.
0x8 A pointer to the table that ACPI failed to load Creator revision ACPI failed to load DDB.
0x9 FADT version 0 Unsupported firmware version.
0xA 0 0 The system could not find MADT.
0xB 0 0 The system could not find any valid Local SAPIC structures in the MADT.

Cause

The value of Parameter 1 indicates the error.

Resolving the Problem

If you are debugging this error, use the !analyze -v extension. This extension displays all the relevant data (device extensions, nsobjects, or whatever is appropriate to the specific error).

If you are not performing debugging, this error indicates that you have to obtain a new BIOS. Contact your vendor or visit the internet to get a new BIOS.

If you cannot obtain an updated BIOS, or the latest BIOS is still not ACPI compliant, you can turn off ACPI mode during text-mode setup. To turn off ACPI mode, press the F7 key when you are prompted to install storage drivers. The system does not notify you that the F7 key was pressed, but it silently disables ACPI and enables you to continue your installation.

Comments

A PCI routing table (_PRT) is the ACPI BIOS object that specifies how all the PCI devices are connected to the interrupt controllers. A computer with multiple PCI buses might have multiple _PRTs.

You can display a _PRT in the debugger by using the !acpikd.nsobj extension together with the address of the _PRT object as its argument.

    WinDbg Output Example:
ACPI_BIOS_ERROR (a5)
The ACPI Bios in the system is not fully compliant with the ACPI specification.
The first value indicates where the incompatibility lies:
This bug check covers a great variety of ACPI problems.  If a kernel debugger
is attached, use "!analyze -v".  This command will analyze the precise problem,
and display whatever information is most useful for debugging the specific
error.
Arguments:
Arg1: 0000000000000000,
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A6: FP_EMULATION_ERROR    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (a6)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A7: BAD_EXHANDLE    (go to top of page)

Usual causes:  Memory, Pagefile, Device driver

    MSDN Listing (WDK):             http://msdn.microsoft.com/en-us/library/ff560117(v=VS.85).aspx 

    Knowledge Base Articles:

    WinDbg Help File Entry:

The BAD_EXHANDLE bug check has a value of 0x000000A7. This bug check indicates that the kernel-mode handle table detected an inconsistent handle table entry state.

Parameters

None

    WinDbg Output Example:
BAD_EXHANDLE (a7)
The kernel mode handle table detected an inconsistent handle table
entry state.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A8: BOOTING_IN_SAFEMODE_MINIMAL    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (a8)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A9: BOOTING_IN_SAFEMODE_NETWORK    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (a9)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000AA: BOOTING_IN_SAFEMODE_DSREPAIR    (go to top of page)

Usual causes: 

    Knowledge Base Articles:
KB 2617115    "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)" error when a client logs off from a Remote Desktop Services session in Windows Server 2008 R2
KB 2669129    "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)" error when you log off a Remote Desktop Services session in Windows Server 2008

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (aa)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000AB: SESSION_HAS_VALID_POOL_ON_EXIT    (go to top of page)

Usual causes:  A bug in Win32k.sys, Atmfd.dll, Rdpdd.dll, or a video driver.

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560119(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xab
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/09/12/debugging-stop-0xab/

    Knowledge Base Articles:
KB 901150    You may receive a “Stop 0x000000ab” error message when you log off a Terminal Services session on a Windows Server 2003 SP1-based Terminal Server
KB 907242    You receive a "Stop 0x000000ab" error message when you log off from a Terminal Services session on a Windows Server 2003 SP1-based terminal server
KB 918673    You receive a "Stop 0x000000ab" error message when a Terminal Services client computer logs off from a Terminal Services session on a Windows Server 2003 SP1-based Terminal Services computer
KB 925919    Stop error message when a client computer logs off from a Terminal Services session on a server that is running Windows Server 2003 with SP1 or with SP2: "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 928942    Error message when you log off a Terminal Services session on Windows Server 2003 Terminal Server with Service Pack 1 or with Service Pack 2: "Stop 0x000000AB"
KB 931282    Stop error message when a client computer logs off from a Terminal Services session on a server that is running Windows Server 2003 with SP1 or with SP2: "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 944916    Stop error message when a client logs off from a Terminal Services session on a server that is running Windows Server 2003 with SP1 or Windows Server 2003 with SP2: "Stop error code 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 946068    Stop error message on a terminal server that is running Windows Server 2003 Service Pack 1 or Windows Server 2003 Service Pack 2: "Stop error code 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 951749    Stop error message on a terminal server that is running Windows Server 2003 SP1 or Windows Server 2003 SP2: "Stop error code 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 959466    Stop error on a Windows Server 2003-based terminal server that has a third-party Input Method Editor (IME) installed: "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"

KB 982362    "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)" error when a client logs off from a terminal server session in Windows Server 2003 SP1 or in Windows Server 2003 SP2
KB 2585233    "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)" error when a client logs off from a Windows Server 2008 R2 Remote Desktop Services session
KB 2786447    "0x000000AB" Stop error when a Citrix client logs off from a RD Session Host that is running Windows Server 2008 R2 SP1
KB 2863945    "0x000000AB" Stop error when you log off from a Windows Server 2012-based RDS server

    More BSOD articles at this link:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x000000ab&x=0&y=0&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The SESSION_HAS_VALID_POOL_ON_EXIT bug check has a value of 0x000000AB. This bug check indicates that a session unload occurred while a session driver still held memory.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The session ID.
2 The number of paged pool bytes that are leaking.
3 The number of nonpaged pool bytes that are leaking.
4 The total number of paged and nonpaged allocations that are leaking. (The number of nonpaged allocations are in the upper half of this word, and paged allocations are in the lower half of this word.)

Cause

The SESSION_HAS_VALID_POOL_ON_EXIT bug check occurs because a session driver does not free its pool allocations before a session unload. This bug check indicates a bug in Win32k.sys, Atmfd.dll, Rdpdd.dll, or a video driver.

    WinDbg Output Example:
SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000000000000, session ID
Arg2: 0000000000000000, number of paged pool bytes that are leaking
Arg3: 0000000000000000, number of nonpaged pool bytes that are leaking
Arg4: 0000000000000000, total number of paged and nonpaged allocations that are leaking.
    nonpaged allocations are in the upper half of this word,
    paged allocations are in the lower half of this word.


STOP 0x000000AC: HAL_MEMORY_ALLOCATION    (go to top of page)

Usual causes:  Memory, Corruption of loading of Windows

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560121(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The HAL_MEMORY_ALLOCATION bug check has a value of 0x000000AC. This bug check indicates that the hardware abstraction layer (HAL) could not obtain sufficient memory.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The allocation size
2 0
3 A pointer to a string that contains the file name
4 Reserved

Cause

The HAL could not obtain non-paged memory pool for a system critical requirement.

These critical memory allocations are made early in system initialization, and the HAL_MEMORY_ALLOCATION bug check is not expected. This bug check probably indicates some other critical error such as pool corruption or massive consumption.

    WinDbg Output Example:
HAL_MEMORY_ALLOCATION (ac)
The HAL was unable to obtain memory for a system critical requirement.
These allocations are made early in system initialization and such a
failure is not expected.  It probably indicates some other critical error
such as pool corruption or massive consumption.
Arguments:
Arg1: 0000000000000000, Allocation size.
Arg2: 0000000000000000, 0
Arg3: 0000000000000000, Pointer to string containing file name.
Arg4: 0000000000000000, (reserved)


STOP 0x000000AD: VIDEO_DRIVER_DEBUG_REPORT_REQUEST    (go to top of page)

Usual causes:  Video driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560125(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The VIDEO_DRIVER_DEBUG_REPORT_REQUEST bug check has a value of 0x000000AD. This bug check indicates that the video port created a non-fatal minidump on behalf of the video driver during run time.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 Driver-specific
2 Driver-specific
3 Driver-specific
4 The number of all reports that have been requested since boot time

Comments

The video port created a non-fatal minidump on behalf of the video driver during run time because the video driver requested a debug report.

The VIDEO_DRIVER_DEBUG_REPORT_REQUEST bug check can be caused only by minidump creation, not by the creation of a full dump or kernel dump.

    WinDbg Output Example:
Unknown bugcheck code (ad)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000AE:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (ae)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000AF:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (af)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B0:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (b0)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B1:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (b1)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B2:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (b2)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B3:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (b3)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B4: VIDEO_DRIVER_INIT_FAILURE    (go to top of page)

Usual causes:  Video driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560133(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xb4

    Knowledge Base Articles:
                      Troubleshooting specific STOP messages
KB 240369    Err Msg: Stop 0x000000B4 The Video Driver Failed to Initialize (2000)
KB 250271    "STOP 0x000000B4" or Black Screen During GUI-Mode Setup on Micron Powerdigm XSU (2000)
KB 319120    Error message: "Stop error code 0x000000B4 The video driver failed to initialize" (2000)

    WinDbg Help File Entry:

The VIDEO_DRIVER_INIT_FAILURE bug check has a value of 0x000000B4. This indicates that Windows was unable to enter graphics mode.

Parameters

None

Cause

The system was not able to go into graphics mode because no display drivers were able to start.

This usually occurs when no video miniport drivers are able to load successfully.

    WinDbg Output Example:
VIDEO_DRIVER_INIT_FAILURE (b4)
The system was not able to go into graphics mode because no display drivers
were able to start.  This usually occurs if no video miniport drivers load
successfully.
Arguments:
Arg1: 0000000000000000, Driver failure data.
Arg2: 0000000000000000, Graphics device list.
Arg3: 0000000000000000, Graphics device list data.
Arg4: 0000000000000000, Indicates generic failure.


STOP 0x000000B5: BOOTLOG_LOADED    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (b5)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B6: BOOTLOG_NOT_LOADED    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (b6)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B7: BOOTLOG_ENABLED    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (b7)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B8: ATTEMPTED_SWITCH_FROM_DPC    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560140(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xb8

    Knowledge Base Articles:
KB 281428    "Stop 0xB8 ATTEMPTED_SWITCH_FROM_DPC" Error Message When You Use a Parallel Port Zip Drive (2000)
KB 287582    "Stop 0x000000B8" Error Message Occurs After You Install Tivoli Storage Manager (2000 Server)
KB 318988    Stop 0x000000B8 Error Occurs in a Windows 2000 Cluster
KB 319453    Problems with older version of Nwfs.sys file in Novell NetWare Client Version 4.81 (2000)
KB 824354    Your Server Stops Responding or You Receive a Stop Error Message When You Set Up a Windows Server 2003-Based Server Cluster
KB 888190    “Stop 0x000000B8” error message on a computer that has the Dell OpenManage Server Administrator installed in Windows Server 2003 or in Windows Small Business Server 2003
KB 936150    Error message when you wake Windows Vista from sleep: "STOP: 0x000000B8"
KB 980663    Stop error in Windows 7 and in Windows Server 2008 R2 if a heavy load situation exists or if connectivity issues exist: "Stop error code 0x000000B8 (ATTEMPTED_SWITCH_FROM_DPC)"
KB 2194018    "Stop 0xB8 ATTEMPTED_SWITCH_FROM_DPC" Error Message When Resuming SAN Booted Server 2008
KB 2490742    A "0x000000B8" Stop error occurs when you try to shut down or hibernate a computer that is running Windows 7 or Windows Server 2008 R2
KB 2640309    "STOP: 0x000000B8" error when you try to shut down or hibernate a computer that is running Windows Vista, Windows Server 2008, Windows 7 or Windows Server 2008 R2

    WinDbg Help File Entry:

The ATTEMPTED_SWITCH_FROM_DPC bug check has a value of 0x000000B8. This indicates that an illegal operation was attempted by a delayed procedure call (DPC) routine.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The original thread causing the failure
2 The new thread
3 The stack address of the original thread
4 Reserved

Cause

A wait operation, attach process, or yield was attempted from a DPC routine. This is an illegal operation.

Resolving the Problem

The stack trace will lead to the code in the original DPC routine that caused the error.

    WinDbg Output Example:
ATTEMPTED_SWITCH_FROM_DPC (b8)
A wait operation, attach process, or yield was attempted from a DPC routine.
This is an illegal operation and the stack track will lead to the offending
code and original DPC routine.
Arguments:
Arg1: 0000000000000000, Original thread which is the cause of the failure
Arg2: 0000000000000000, New thread
Arg3: 0000000000000000, Stack address of the original thread
Arg4: 0000000000000000


STOP 0x000000B9: CHIPSET_DETECTED_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560144(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CHIPSET_DETECTED_ERROR bug check has a value of 0x000000B9.

This bug check appears very infrequently.

    WinDbg Output Example:
CHIPSET_DETECTED_ERROR (b9)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000BA: SESSION_HAS_VALID_VIEWS_ON_EXIT    (go to top of page)

Usual causes:  A bug in win32k.sys, atmfd.dll, rdpdd.dll, or a video driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560151(v=VS.85).aspx

    Knowledge Base Articles:
KB 961974    Stop error when you log off from a Terminal Services session on a terminal server that is running Windows Server 2003 SP1 or Windows Server 2003 SP2: "Stop 0x000000ba"

    WinDbg Help File Entry:

The SESSION_HAS_VALID_VIEWS_ON_EXIT bug check has a value of 0x000000BA. This indicates that a session driver still had mapped views when the session unloaded.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The session ID
2 The number of mapped views that are leaking
3 The address of this session's mapped views table
4 The size of this session's mapped views table

Cause

This error is caused by a session driver not unmapping its mapped views prior to a session unload. This indicates a bug in win32k.sys, atmfd.dll, rdpdd.dll, or a video driver.

    WinDbg Output Example:
SESSION_HAS_VALID_VIEWS_ON_EXIT (ba)
Caused by a session driver not unmapping its mapped views prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000000000000, session ID
Arg2: 0000000000000000, number of mapped views that are leaking
Arg3: 0000000000000000, address of this session's mapped views table
Arg4: 0000000000000000, size of this session's mapped views table.


STOP 0x000000BB: NETWORK_BOOT_INITIALIZATION_FAILED    (go to top of page)

Usual causes: Hardware, Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560155(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The NETWORK_BOOT_INITIALIZATION_FAILED bug check has a value of 0x000000BB. This indicates that Windows failed to successfully boot off a network.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The part of network initialization that failed. Possible values are:

1: Failure while updating the registry.

2: Failure while starting the network stack. Windows sends IOCTLs to the redirector and datagram receiver, then waits for the redirector to be ready. If it is not ready within a certain period of time, this error is issued.

3: Failure while sending the DHCP IOCTL to TCP. This is how Windows informs the transport of its IP address.

2 The failure status
3 Reserved
4 Reserved

Cause

This error is caused when Windows is booting off a network, and a critical function fails during I/O initialization.

    WinDbg Output Example:
NETWORK_BOOT_INITIALIZATION_FAILED (bb)
Caused if we are booting off the network, and a critical function fails during
IO initialization. Currently the codes for the first value are:
1 - updating the registry.
2 - starting the network stack - Windows sends IOCTLs to the redirector and
    datagram receiver, then waits for the redirector to be ready. If it is not
    ready within a certain period of time, initialization fails.
3 - failed sending the DHCP IOCTL to TCP - this is how Windows informs the
    transport of its IP adress.
Arguments:
Arg1: 0000000000000000, the part of network initialization that failed
Arg2: 0000000000000000, the failure status
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000BC: NETWORK_BOOT_DUPLICATE_ADDRESS    (go to top of page)

Usual causes:  As it states, duplicate IP addresses have been assigned

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560159(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The NETWORK_BOOT_DUPLICATE_ADDRESS bug check has a value of 0x000000BC. This indicates that a duplicate IP address was assigned to this machine while booting off a network.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The IP address, shown as a DWORD. An address of the form aa.bb.cc.dd will appear as 0xDDCCBBAA.
2 The hardware address of the other machine. (For an Ethernet connection, see the following note.)
3 The hardware address of the other machine. (For an Ethernet connection, see the following note.)
4 The hardware address of the other machine. (For an Ethernet connection, this will be zero.)

Note  When Parameter 4 equals zero, this indicates an Ethernet connection. In that case, the MAC address will be stored in Parameter 2 and Parameter 3. An Ethernet MAC address of the form aa-bb-cc-dd-ee-ff will cause Parameter 2 to equal 0xAABBCCDD, and Parameter 3 to equal 0xEEFF0000.

Cause

This error indicates that when TCP/IP sent out an ARP for its IP address, it got a response from another machine indicating a duplicate IP address.

When Windows is booting off a network, this is a fatal error.

    WinDbg Output Example:
NETWORK_BOOT_DUPLICATE_ADDRESS (bc)
This indicates that when TCP/IP sent out an ARP for its IP address, it got
a response from another machine, indicating a duplicate IP address. When we
are booting off the network this is a fatal error.
Arguments:
Arg1: 0000000000000000, the IP address, show as a hex DWORD. So an address aa.bb.cc.dd will
    appear as 0xddccbbaa.
Arg2: 0000000000000000, the hardware address of the other machine.
Arg3: 0000000000000000, the hardware address of the other machine.
Arg4: 0000000000000000, the hardware address of the other machine. For Ethernet, a MAC address
    of aa-bb-cc-dd-ee-ff will be indicated by the second parameter
    containing 0xaabbccdd, the third parameter containing 0xeeff0000, and
    the fourth parameter containing 0x00000000.


STOP 0x000000BD: INVALID_HIBERNATED STATE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
INVALID_HIBERNATED_STATE (bd)
The hibernated memory image does not match the current hardware configuration.
This bugcheck occurs when a system resumes from hibernate and discovers that the
hardware has been changed while the system was hibernated.
Note:  This bug check no longer exists in any version of Windows.
Arguments:
Arg1: 0000000000000000, hardware that was invalid
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000BE: ATTEMPTED_WRITE_TO_READONLY_MEMORY    (go to top of page)

Usual causes:  Device driver, Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560161(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xbe
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/08/07/debugging-stop-0xbe-pte/

    Knowledge Base Articles:
KB 227693    Installation of SessionWall-3 May Cause Computer to Stop Responding (2000 Server)
KB 306205    The Qwestdex Dex Toolbar Is Not Totally Compatible with Windows XP
KB 956246    Stop error when Windows Server 2008 or Windows Vista SP1 is running in a virtual machine, and the computer that is running the virtual machine has multiple processors: "0x000000BE"
KB 959056    Stop error message when a Windows Server 2008-based computer randomly restarts: "0x000000BE ATTEMPTED_WRITE_TO_READONLY_MEMORY"
KB 983554    "0x000000BE" Stop error message when you use the Storport.sys driver to manage some storage devices in Windows Server 2008 or in Windows Vista
KB 2563727    "0x000000BE" Stop error when you install Windows Vista or Windows Server 2008 if more than two AMD Bulldozer-based 16-core processors are installed


    WinDbg Help File Entry:

The ATTEMPTED_WRITE_TO_READONLY_MEMORY bug check has a value of 0x000000BE. This is issued if a driver attempts to write to a read-only memory segment.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Virtual address of attempted write
2 PTE contents
3 Reserved
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

    WinDbg Output Example:
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory.  The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 81dd7000, Virtual address for the attempted write.
Arg2: 01dd7121, PTE contents.
Arg3: 9730b9f4, (reserved)
Arg4: 0000000b, (reserved)


STOP 0x000000BF: MUTEX_ALREADY_OWNED    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560167(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The MUTEX_ALREADY_OWNED bug check has a value of 0x000000BF. This indicates that a thread attempted to acquire ownership of a mutex it already owned.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the mutex
2 The thread that caused the error
3 0
4 Reserved

    WinDbg Output Example:
MUTEX_ALREADY_OWNED (bf)
This thread is attempting to acquire ownership of a mutex it already owns.
Arguments:
Arg1: 0000000000000000, Address of Mutex
Arg2: 0000000000000000, Thread
Arg3: 0000000000000000, 0
Arg4: 0000000000000000, (reserved)


STOP 0x000000C0: PCI_CONFIT_SPACE_ACCESS_FAILURE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (c0)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000C1: SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560183(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xc1
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/09/30/debugging-stop-0xc1-sloppy-bytes-and-special-pool/

    Knowledge Base Articles:
KB 953026    You receive a "STOP 0x0000010E" or "STOP 0x000000C1" error message on a Windows Vista-based computer or on a Windows Server 2008-based computer

    WinDbg Help File Entry:

The SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION bug check has a value of 0x000000C1. This indicates that the driver wrote to an invalid section of the special pool.

Parameters

The following parameters are displayed on the blue screen. Parameter 4 indicates the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
Address that the driver tried to free Reserved 0 0x20 A driver attempted to free pool which was not allocated.
Address that the driver tried to free Bytes requested Bytes calculated (actually given to the caller) 0x21,
0x22
A driver attempted to free a bad address.
Address that the driver tried to free Address where bits are corrupted Reserved 0x23 A driver freed an address, but nearby bytes within the same page have been corrupted.
Address that the driver tried to free Address where bits are corrupted Reserved 0x24 A driver freed an address, but bytes occurring after the end of the allocation have been overwritten.
Current IRQL Pool type Number of bytes 0x30 A driver attempted to allocate pool at an incorrect IRQL.
Current IRQL Pool type Address that the driver tried to free 0x31 A driver attempted to free pool at an incorrect IRQL.
Address that the driver tried to free Address where one bit is corrupted Reserved 0x32 A driver freed an address, but nearby bytes within the same page have a single bit error.

The _POOL_TYPE codes are enumerated in ntddk.h. In particular, zero indicates nonpaged pool and one indicates paged pool.

Cause

A driver has written to an invalid section of the special pool.

Resolving the Problem

Obtain a backtrace of the current thread. This backtrace will usually reveal the source of the error.

For information about the special pool, consult the Driver Verifier section of the Windows Driver Kit.

    WinDbg Output Example:
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption.  Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: ba41ef78, address trying to free
Arg2: ba41eb04, address where one bit is corrupted
Arg3: 0083408c, (reserved)
Arg4: 00000032, caller is freeing an address where nearby bytes within the same page have a single bit error


SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption.  Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000, subclass of driver violation.


STOP 0x000000C2: BAD_POOL_CALLER    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560185(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xc2
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/07/02/debugging-stop-0xc2-bad_pool_caller/

    Knowledge Base Articles:
KB 265879    How to Debug "Stop 0xC2" or "Stop 0x000000C2" Error Messages (2000)
KB 307151    Computer with ATI RAGE FURY MAXX Video Adapter Stops Responding After Upgrade to Windows XP
KB 309155    "STOP 0x000000c2" Error Message Appears on a Blue Screen After You Install IomegaWare (2000)
KB 310527    Stop Error When You Upgrade from Windows 2000: Bad_Pool_Caller 0xC2
KB 321793    "STOP 0x000000C2 BAD_POOL_CALLER" Error Message on a Cluster Node (2000 Server)
KB 328776    A "Stop 0x000000C2" Error Occurs When You Try to Close a File on a Network Share (2000 Server)
KB 816669    "STOP 0x000000C2" Error Message When Running Terminal Services (2000)
KB 818323    "Stop error code 0x000000C2" error message when the computer resumes from hibernation (2000)
KB 820765    Computer intermittently stops responding and a Stop 0x000000C2 error occurs (2000)
KB 824281    "Stop error code 0x000000C2 (BAD_POOL_CALLER)" error occurs when you print in Windows 2000
KB 829788    "Stop 0xC2 (BAD_POOL_CALLER)" error may occur intermittently on a server that is running Routing and Remote Access with NAT enabled under Windows 2000
KB 888431    "Stop 0x000000C2 BAD_POOL_CALLER" error message in Windows Server 2003
KB 890756    The Windows 2000-based or Windows Server 2003-based server restarts and you receive various error messages
KB 892926    Your computer crashes with a "STOP: 0x000000C2" error when you dismount a SAN drive in Windows Server 2003
KB 896674    You receive a "STOP 0x000000C2" error message on a Windows 2000-based computer
KB 900623    You may receive a "STOP 0x000000C2 BAD_POOL_CALLER" error message when you use ATM network services in Windows 2000
KB 932701    FIX: Stop error message on a Windows Server 2003 R2-based computer that has Subsystem for UNIX-based Applications installed: "000000C2"
KB 935920    When the Emulex Elxsli2.sys driver is installed, you may receive a Stop error message after you upgrade your computer to Windows Server 2003 Service Pack 1
KB 937455    You may receive various Stop error messages on a computer that is running Windows Server 2003
KB 939868    You receive an error message when you access a Web-based program on a Windows XP-based multiprocessor computer
KB 941004    Error message when a NetDDE application is running on a Windows Server 2003-based computer: "Stop 0x000000C2"
KB 944904    Error message on a Windows XP-based computer when you work with a network share: "STOP: 0x000000C2 BAD_POOL_CALLER"
KB 947390    You receive a "Stop 0x000000C2" error message on a Windows Server 2003 R2-based computer if a compressed folder resides on an NTFS volume that has FSRM quota management enabled
KB 957509    Stop error when you use a Microsoft Device Specific Module in Windows Server 2008: "0x000000C2"
KB 958165    Stop error on a Windows Server 2003-based or Windows Server 2008-based computer that has Server for NFS enabled when an NFS client copies data to the NFS server: "Stop 0x000000C2"
KB 967776    Stop errors in Windows Vista or Windows Server 2008: “Stop: 0x00000018” or “STOP: 0x000000C2”
KB 973295    A multiprocessor computer that is running Windows Server 2003 SP2 stops responding under a heavy load if you change a Windows Firewall setting
KB 2479442    Stop error during startup in Windows Server 2008 or in Windows Vista
KB 2639793    "0x000000C2" Stop error occurs when you use IPsec on a computer that is running Windows Server 2008 or Windows Vista in a network that uses IPsec NAT-T security
KB 2641739    "0x000000C2" Stop error when you insert removable media or a removable storage device into a computer that is running Windows 7 or Windows Server 2008 R2
KB 2654363    Computer crashes when you use Driver Verifier to monitor Storport.sys if you disable the HBA in Windows 7 or Windows Server 2008 R2
KB 2719347    Stop error when a Windows 7-based or Windows Server 2008 R2-based computer crashes randomly
KB 2807654    "0x000000C2" Stop error when you try to back up a data deduplication-enabled volume in Windows 8 or Windows Server 2012
KB 2831154    A Stop Error 0x000000C2 in the Srv2.sys file may occur and SMB clients cannot obtain data from the SMB 2 server in a Windows 7 or Windows Server 2008 R2 environment
KB 2850309    "0x000000C2" Stop error when you resume a computer from sleep mode or hibernation on a Windows 8, Windows Server 2012, or Windows RT-based computer

    WinDbg Help File Entry:

The BAD_POOL_CALLER bug check has a value of 0x000000C2. This indicates that the current thread is making a bad pool request.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 indicates the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x00 0 Pool type Pool tag The current thread requested a zero-byte pool allocation.
0x01,
0x02,
or
0x04
Pointer to pool header First part of pool header contents 0 The pool header has been corrupted.
0x06 Reserved Pointer to pool header Pool header contents The current thread attempted to free the pool, which was already freed.
0x07 Reserved Pool header contents Address of the block of pool being freed The current thread attempted to free the pool, which was already freed.
0x08 Current IRQL Pool type Size of allocation, in bytes The current thread attempted to allocate the pool at an invalid IRQL.
0x09 Current IRQL Pool type Address of pool The current thread attempted to free the pool at an invalid IRQL.
0x0A Address of pool Allocator's tag Tag being used in the attempted free The current thread attempted to free pool memory by using the wrong tag.

(The memory might belong to another component.)

0x0B,
0x0C,
or
0x0D
Address of pool Pool allocation's tag Bad quota process pointer The current thread attempted to release a quota on a corrupted pool allocation.
0x40 Starting address Start of system address space 0 The current thread attempted to free the kernel pool at a user-mode address.
0x41 Starting address Physical page frame Highest physical page frame The current thread attempted to free a non-allocated nonpaged pool address.
0x42
or
0x43
Address being freed 0 0 The current thread attempted to free a virtual address that was never in any pool.
0x44 Starting address Reserved 0 The current thread attempted to free a non-allocated nonpaged pool address.
0x46 Starting address 0 0 The current thread attempted to free an invalid pool address.
0x47 Starting address Physical page frame Highest physical page frame The current thread attempted to free a non-allocated nonpaged pool address.
0x48 Starting address Reserved Reserved The current thread attempted to free a non-allocated paged pool address.
0x50 Starting address Start offset, in pages, from beginning of paged pool Size of paged pool, in bytes The current thread attempted to free a non-allocated paged pool address.
0x60 Starting address 0 0 The current thread attempted to free an invalid contiguous memory address.

(The caller of MmFreeContiguousMemory is passing a bad pointer.)

0x99 Address that is being freed 0 0 The current thread attempted to free pool with an invalid address.

(This code can also indicate corruption in the pool header.)

0x9A Pool type Number of bytes requested Pool tag The current thread marked an allocation request MUST_SUCCEED.

(This pool type is no longer supported.)

0x9B Pool type Number of bytes requested Caller's address The current thread attempted to allocate a pool with a tag of 0

(This would be untrackable, and possibly corrupt the existing tag tables.)

0x9C Pool type Number of bytes requested Caller's address The current thread attempted to allocate a pool with a tag of "BIG".

(This would be untrackable and could possibly corrupt the existing tag tables.)

0x9D Incorrect pool tag used Pool type Caller's address The current thread attempted to allocate a pool with a tag that does not contain any letters or digits. Using such tags makes tracking pool issues difficult.
0x41286 Reserved Reserved Start offset from the beginning of the paged pool, in pages The current thread attempted to free a paged pool address in the middle of an allocation.

The _POOL_TYPE codes are enumerated in Ntddk.h. In particular, 0 indicates nonpaged pool and 1 indicates paged pool.

Cause

An invalid pool request has been made by the current thread.

Resolving the Problem

Activate Driver Verifier to obtain more information about these errors. For details, see the Driver Verifier section of the Windows Driver Kit (WDK).

    WinDbg Output Example:
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000099, Attempt to free pool with invalid address  (or corruption in pool header)
Arg2: 86c30ca8, Address being freed
Arg3: 00000000, 0
Arg4: 00000000, 0


BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000000, The caller is requesting a zero byte pool allocation.
Arg2: 0000000000000000, zero.
Arg3: 0000000000000000, the pool type being allocated.
Arg4: 0000000000000000, the pool tag being used.



STOP 0x000000C3: BUGCODE_PSS_MESSAGE_SIGNATURE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (c3)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000C4: DRIVER_VERIFIER_DETECTED_VIOLATION    (go to top of page)

Usual causes:  Device driver - see parameters for more information
NOTE:  May occur in Win7 and later w/o Driver Verifier being enabled

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560187(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xc4
    Other Articles:
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/6446-violation-bugcheck-c4-deadlock.html
        https://bsodtutorials.wordpress.com/2013/08/12/debugging-stop-0xc4-invalid-handle/
        https://bsodtutorials.wordpress.com/2013/12/01/debugging-stop-0xc4-invalid-handle-updated-version/
        https://bsodtutorials.wordpress.com/2014/01/13/debugging-stop-0xc4-ddi-compliance-rules/
0 0
    Knowledge Base Articles:
KB 325672    Fatal System Error: 0x000000C4 If Deadlock Detection in Driver Verifier Is Turned on and Norton Antivirus Is Installed (XP, Server 2003)
KB 329703    "STOP" Error Messages in Qafilter.sys or Qsfilter.sys with Third-Party Quota Management Tool (2000)
KB 810148    "Stop 0x000000C4" Error Message When You Disable CardBus Controllers in Device Manager (2000)
KB 897574    You may receive a Stop error message after you insert media into a removable disk device in Windows XP, Windows Server 2003, or Windows 2000
KB 902390    You may receive a Stop error message when you use a scanner in Windows Server 2003 or in Windows XP x64 Edition
KB 932755    An updated Storport storage driver is available for Windows Server 2003
KB 946226    FIX: You receive a "Stop 0x00000019" error message or a "Stop 0x000000c4" error message when you access NFS resources by using User Name Mapping (MS Svcs for Unix)
KB 949012    Stop error message after you enable the Disk Integrity Checking feature of Driver Verifier in a Windows Server 2003 cluster environment: "Stop 0x000000C4"
KB 956469    Stop error message during restart if you enable the Force IRQL Checking setting in Driver Verifier on a computer that is running Windows Server 2003, Datacenter x64 Edition with Service Pack 2: "0x000000C4"
KB 975246    Stop error message when you connect and then disconnect a USB camera from a computer that is running Windows Vista or Windows Server 2008: "Fatal System Error: 0x000000C4 (parameter1, parameter2, parameter3, parameter4) DRIVER_VERIFIER_DETECTED_VI...
KB 2494666    Stop errors may occur after you use the Driver Verifier manager to apply standard settings to all drivers in Windows 7 or in Windows Server 2008 R2

KB 2524840    "0x000000C4" Stop error occurs when you run the "Common Scenario Stress with IO" test on a Windows 7-based computer on which Windows Virtual PC and Windows Logo Kit are installed
KB 2550576    STOP 0xC4 may occur in tcpipreg.sys following a reboot after Driver Verifier is enabled on Windows 7 SP1 or Windows Server 2008 R2 SP1
KB 2661796    "0x000000C4" Stop error when you enable Driver Verifier in Windows 7 or in Windows Server 2008 R2
KB 2724933    Stop error 0x000000C4 during resume from sleep on Windows 7
KB 2801662    "0x000000C4" Stop error when you run the WDF Fault Injection Logo Test in Windows 7 and Windows Server 2008 R2
KB 2816159    "0x000000C4" Stop error after you restart a Windows 8-based or Windows Server 2012-based computer that has the Driver Verifier tool enabled

    WinDbg Help File Entry:

The DRIVER_VERIFIER_DETECTED_VIOLATION bug check has a value of 0x000000C4. This is the general bug check code for fatal errors found by Driver Verifier.

Parameters

Four bug check parameters are displayed on the blue screen. Parameter 1 identifies the type of violation. The meaning of the remaining parameters varies with the value of Parameter 1. The parameter values are described in the following table.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x00 Current IRQL Pool type 0 The driver requested a zero-byte pool allocation.
0x01 Current IRQL Pool type Size of allocation, in bytes The driver attempted to allocate paged memory with IRQL > APC_LEVEL.
0x02 Current IRQL Pool type Size of allocation, in bytes The driver attempted to allocate nonpaged memory with IRQL > DISPATCH_LEVEL.
0x03 (Windows Vista and later operating systems only) Reserved Reserved Reserved The driver attempted to allocate multiple pages of must succeed pool, but at most one page can be allocated using this routine.
0x10 Bad Address 0 0 The driver attempted to free an address that was not returned from an allocate call.
0x11 Current IRQL Pool type Address of pool The driver attempted to free paged pool with IRQL > APC_LEVEL.
0x12 Current IRQL Pool type Address of pool The driver attempted to free nonpaged pool with IRQL > DISPATCH_LEVEL.
0x13
or
0x14
Reserved Pointer to pool header Pool header contents The driver attempted to free memory pool which was already freed.
0x15 Timer entry Pool type (-1 for special pool) Pool address being freed The driver attempted to free pool which contains an active timer.
0x16 Reserved Pool address 0 The driver attempted to free pool at a bad address, or the driver passed invalid parameters to a memory routine.
0x17 Resource entry Pool type (-1 for special pool) Pool address being freed The driver attempted to free pool which contains an active ERESOURCE.
0x30 Current IRQL Requested IRQL 0 The driver passed an invalid parameter to KeRaiseIrql.

(The parameter was either a value lower than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized parameter.)

0x31 Current IRQL Requested IRQL 0: New IRQL is bad

1: New IRQL is invalid inside a DPC routine

The driver passed an invalid parameter to KeLowerIrql.

(The parameter was either a value higher than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized parameter.)

0x32 Current IRQL Spin lock address 0 The driver called KeReleaseSpinLock at an IRQL other than DISPATCH_LEVEL.

(This may be due to a double-release of a spin lock.)

0x33 Current IRQL Fast mutex address 0 The driver attempted to acquire fast mutex with IRQL > APC_LEVEL.
0x34 Current IRQL Fast mutex address 0 The driver attempted to release fast mutex at an IRQL other than APC_LEVEL.
0x35 Current IRQL Spin lock address Old IRQL The kernel released a spin lock with IRQL not equal to DISPATCH_LEVEL.
0x36 Current IRQL Spin lock number Old IRQL The kernel released a queued spin lock with IRQL not equal to DISPATCH_LEVEL.
0x37 Current IRQL Thread APC disable count Resource The driver tried to acquire a resource, but APCs are not disabled.
0x38 Current IRQL Thread APC disable count Resource The driver tried to release a resource, but APCs are not disabled.
0x39 Current IRQL Thread APC disable count Mutex The driver tried to acquire a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry.
0x3A Current IRQL Thread APC disable count Mutex The driver tried to release a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry.
0x3B Current IRQL Object to wait for Time-out parameter The driver called KeWaitXxx with IRQL >= DISPATCH_LEVEL.

(This is permitted only if the driver already owns the DISPATCHER lock and it passes a time-out value of zero to the routine.)

0x3C Handle passed to routine Object type 0 The driver called ObReferenceObjectByHandle with a bad handle.
0x3D 0 0 Address of the bad resource The driver passed a bad (unaligned) resource to ExAcquireResourceExclusive.
0x3E 0 0 0 The driver called KeLeaveCriticalRegion for a thread that is not currently in a critical region.
0x3F Object address New object reference count.

-1: dereference case

1: reference case

0 The driver applied ObReferenceObject to an object that has a reference count of zero, or the driver applied ObDereferenceObject to an object that has a reference count of zero.
0x40 Current IRQL Spin lock address 0 The driver called KeAcquireSpinLockAtDpcLevel with IRQL not equal to DISPATCH_LEVEL.
0x41 Current IRQL Spin lock address 0 The driver called KeReleaseSpinLockFromDpcLevel with IRQL not equal to DISPATCH_LEVEL.
0x42 Current IRQL Spin lock address 0 The driver called KeAcquireSpinLock with IRQL > DISPATCH_LEVEL.
0x51 Base address of allocation Address of the reference beyond the allocation Number of charged bytes The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x52 Base address of allocation Reserved Number of charged bytes The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x53,
0x54,
or
0x59
Base address of allocation Reserved Reserved The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x60 Bytes allocated from paged pool Bytes allocated from nonpaged pool Total number of allocations that were not freed The driver is unloading without first freeing its pool allocations. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x61 Bytes allocated from paged pool Bytes allocated from nonpaged pool Total number of allocations that were not freed A driver thread is attempting to allocate pool memory while the driver is unloading. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x62 Name of the driver Reserved Total number of allocations that were not freed, including both paged and nonpaged pool The driver is unloading without first freeing its pool allocations. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x6F MDL address Physical page being locked Highest physical page in the system The driver passed a page to MmProbeAndLockPages that was not in the PFN database.

(This often results from a driver that attempts to lock its own private dualport RAM. Such behavior can corrupt memory on machines with noncontiguous physical RAM.)

0x70 Current IRQL MDL address Access mode The driver called MmProbeAndLockPages with IRQL > DISPATCH_LEVEL.
0x71 Current IRQL MDL address Process address The driver called MmProbeAndLockProcessPages with IRQL > DISPATCH_LEVEL.
0x72 Current IRQL MDL address Process address The driver called MmProbeAndLockSelectedPages with IRQL > DISPATCH_LEVEL.
0x73 Current IRQL In 32-bit Windows: Low 32 bits of the physical address

In 64-bit Windows: the 64-bit physical address

Number of bytes The driver called MmMapIoSpace with IRQL > DISPATCH_LEVEL.
0x74 Current IRQL MDL address Access mode The driver called MmMapLockedPages in kernel mode with IRQL > DISPATCH_LEVEL.
0x75 Current IRQL MDL address Access mode The driver called MmMapLockedPages in user mode with IRQL > APC_LEVEL.
0x76 Current IRQL MDL address Access mode The driver called MmMapLockedPagesSpecifyCache in kernel mode with IRQL > DISPATCH_LEVEL.
0x77 Current IRQL MDL address Access mode The driver called MmMapLockedPagesSpecifyCache in user mode with IRQL > APC_LEVEL.
0x78 Current IRQL MDL address 0 The driver called MmUnlockPages with IRQL > DISPATCH_LEVEL.
0x79 Current IRQL Virtual address being unmapped MDL address The driver called MmUnmapLockedPages in kernel mode with IRQL > DISPATCH_LEVEL.
0x7A Current IRQL Virtual address being unmapped MDL address The driver called MmUnmapLockedPages in user mode with IRQL > APC_LEVEL.
0x7B Current IRQL Virtual address being unmapped Number of bytes The driver called MmUnmapIoSpace with IRQL > APC_LEVEL.
0x7C MDL address MDL flags 0 The driver called MmUnlockPages, and passed an MDL whose pages were never successfully locked.
0x7D MDL address MDL flags 0 The driver called MmUnlockPages, and passed an MDL whose pages are from nonpaged pool.

(These should never be unlocked.)

0x80 Current IRQL Event address 0 The driver called KeSetEvent with IRQL > DISPATCH_LEVEL.
0x81 MDL address MDL flags 0 The driver called MmMapLockedPages.

(You should use MmMapLockedPagesSpecifyCache instead, with the BugCheckOnFailure parameter set to FALSE.)

0x82 MDL address MDL flags 0 The driver called MmMapLockedPagesSpecifyCache with the BugCheckOnFailure parameter equal to TRUE.

(This parameter should be set to FALSE.)

0x83 Start of physical address range to map Number of bytes to map First page frame number that isn't locked down The driver called MmMapIoSpace without having locked down the MDL pages. The physical pages represented by the physical address range being mapped must have been locked down prior to making this call.
0x84 Start of physical address range to map Number of bytes to map First page frame number that is on the free list The driver called MmMapIoSpace without having locked down the MDL pages (or after freeing the MDL pages).
0x85 MDL address Number of pages to map First page frame number that isn't locked down The driver called MmMapLockedPages without having locked down the MDL pages.
0x86 MDL address Number of pages to map First page frame number that is on the free list The driver called MmMapLockedPages without having locked down the MDL pages (or after freeing the MDL pages).
0x87 Base physical page of the existing mapping

(Shift left for physical address)

Number of pages already mapped in the existing mapping MEMORY_CACHING_TYPE of the existing mapping The driver called MmMapIoSpace, but the caller's cache type conflicts with an existing mapping.
0x88 Base physical page of the requested mapping

(Shift left for physical address)

Number of pages in the requested mapping MEMORY_CACHING_TYPE of the requested mapping The driver called MmMapIoSpace to map a physical range as non-cached or write-combined, but the caller's physical range already has an existing cached mapping.
0x89 MDL address Pointer to the non-memory page in the MDL The non-memory page number in the MDL An MDL is not marked as "I/O", but it contains non-memory page addresses.
0x8A MDL address Base physical page of the requested mapping

(Shift left for physical address)

MEMORY_CACHING_TYPE of the requested mapping The driver called MmMapLockedPagesXxx to map a physical range as non-cached or write-combined, but the caller's physical range already has an existing cached mapping.
0x90 (Windows 2000, Windows XP, and Windows Server 2003 only) Reserved Reserved Reserved The driver switched stacks, and the current stack is neither a thread stack nor a DPC stack.

(Typically, the driver doing this should be on the stack obtained by using the kb (Display Stack Backtrace) command.)

0x91 Reserved Reserved Reserved The driver switched stacks using a method that is not supported by the operating system. The only supported way to extend a kernel mode stack is by using KeExpandKernelStackAndCallout.
0xA0 (Windows Server 2003 and later operating systems only) Pointer to the IRP making the read or write request Device object of the lower device Number of the sector in which the error was detected A cyclic redundancy check (CRC) error was detected on a hard disk. A bug check with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0xA1 (Windows Server 2003 and later operating systems only) Copy of the IRP making the read or write request. (The actual IRP has been completed.) Device object of the lower device Number of the sector in which the error was detected A CRC error was detected on a sector (asynchronously). A bug check with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0xA2 (Windows Server 2003 and later operating systems only) IRP making the read or write request, or a copy of this IRP Device object of the lower device Number of the sector in which the error was detected The CRCDISK checksum copies don't match. This could be a paging error. A bug check with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0xB0 (Windows Vista and later operating systems only) MDL address MDL flags Incorrect MDL flags The driver called MmProbeAndLockPages for an MDL with incorrect flags. For example, the driver passed an MDL created by MmBuildMdlForNonPagedPool to MmProbeAndLockPages.
0xB1 (Windows Vista and later operating systems only) MDL address MDL flags Incorrect MDL flags The driver called MmProbeAndLockProcessPages for an MDL with incorrect flags. For example, the driver passed an MDL created by MmBuildMdlForNonPagedPool to MmProbeAndLockProcessPages.
0xB2 (Windows Vista and later operating systems only) MDL address MDL flags Incorrect MDL flags The driver called MmMapLockedPages for an MDL with incorrect flags. For example, the driver passed an MDL that is already mapped to a system address or that was not locked to MmMapLockedPages.
0xB3 (Windows Vista and later operating systems only) MDL address MDL flags Missing MDL flags (at least one was expected) The driver called MmMapLockedPages for an MDL with incorrect flags. For example, the driver passed an MDL that is not locked to MmMapLockedPages.
0xB4 (Windows Vista and later operating systems only) MDL address MDL flags Unexpected partial MDL flag The driver called MmUnlockPages for a partial MDL. A partial MDL is one that was created by IoBuildPartialMdl.
0xB5 (Windows Vista and later operating systems only) MDL address MDL flags Unexpected partial MDL flag The driver called MmUnmapLockedPages for a partial MDL. A partial MDL is one that was created by IoBuildPartialMdl.
0xB6 (Windows Vista and later operating systems only) MDL address MDL flags Missing MDL flag The driver called MmUnmapLockedPages for an MDL that is not mapped to a system address.
0xB7 (Windows Vista and later operating systems only) Number of corrupted physical pages Address of first corrupted physical page Address of last corrupted physical page The system BIOS has corrupted low physical memory during a sleep transition.
0xC0 (Windows Vista and later operating systems only) Address of the IRP Reserved Reserved The driver called IoCallDriver with interrupts disabled.
0xC1 (Windows Vista and later operating systems only) Address of the driver dispatch routine Reserved Reserved A driver dispatch routine was returned with interrupts disabled.
0xC2 (Windows Vista and later operating systems only) Reserved Reserved Reserved The driver called a Fast I/O dispatch routine after interrupts were disabled.
0xC3 (Windows Vista and later operating systems only) Address of the driver Fast I/O dispatch routine Reserved Reserved A driver Fast I/O dispatch routine was returned with interrupts disabled.
0xC5 (Windows Vista and later operating systems only) Address of the driver dispatch routine Current thread APC disable count Thread APC disable count prior to calling the driver dispatch routine A driver dispatch routine has changed the thread APC disable count. The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, KeInitializeMutex, or FsRtlEnterFileSystem. The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem. Because these calls should always be in pairs, this value should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.
0xC6 (Windows Vista and later operating systems only) Address of the driver Fast I/O dispatch routine Current thread APC disable count Thread APC disable count prior to calling the Fast I/O driver dispatch routine A driver Fast I/O dispatch routine has changed the thread APC disable count. The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, KeInitializeMutex, or FsRtlEnterFileSystem. The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem. Because these calls should always be in pairs, this value should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.
0xCA (Windows Vista and later operating systems only) Address of the lookaside list Reserved Reserved The driver has attempted to re-initialize a lookaside list.
0xCB (Windows Vista and later operating systems only) Address of the lookaside list Reserved Reserved The driver has attempted to delete an uninitialized lookaside list.
0xCC (Windows Vista and later operating systems only) Address of the lookaside list Starting address of the pool allocation Size of the pool allocation The driver has attempted to free a pool allocation that contains an active lookaside list.
0xCD (Windows Vista and later operating systems only) Address of the lookaside list Block size specified by the caller Minimum supported block size The driver has attempted to create a lookaside list with an allocation block size that is too small.
0xD0 (Windows Vista and later operating systems only) Address of the ERESOURCE structure Reserved Reserved The driver has attempted to re-initialize an ERESOURCE structure.
0xD1 (Windows Vista and later operating systems only) Address of the ERESOURCE structure Reserved Reserved The driver has attempted to delete an uninitialized ERESOURCE structure.
0xD2 (Windows Vista and later operating systems only) Address of the ERESOURCE structure Starting address of the pool allocation Size of the pool allocation The driver has attempted to free a pool allocation that contains an active ERESOURCE structure.
0xD5 (Windows Vista and later operating systems only) Address of the IO_REMOVE_LOCK structure created by the checked build version of the driver Current IoReleaseRemoveLock tag Reserved The current IoReleaseRemoveLock tag does not match the previous IoAcquireRemoveLock tag. If the driver calling IoReleaseRemoveLock is not in a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A bug check with this parameter occurs only when the I/O Verification option of Driver Verifier is active.
0xD6 (Windows Vista and later operating systems only) Address of the IO_REMOVE_LOCK structure created by the checked build version of the driver Tag that does not match previous IoAcquireRemoveLock tag Previous IoAcquireRemoveLock tag The current IoReleaseRemoveLockAndWait tag does not match the previous IoAcquireRemoveLock tag. If the driver calling IoReleaseRemoveLock is not a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A bug check with this parameter occurs only when the I/O Verification option of Driver Verifier is active.
0xDA (Windows Vista and later operating systems only) Starting address of the driver WMI callback address inside the driver Reserved An attempt was made to unload a driver that has not deregistered its WMI callback function.
0xDB (Windows Vista and later operating systems only) Address of the device object Reserved Reserved An attempt was made to delete a device object that was not deregistered from WMI.
0xDC (Windows Vista and later operating systems only) Reserved Reserved Reserved An invalid RegHandle value was specified as a parameter of the function EtwUnregister.
0xDD (Windows Vista and later operating systems only) Address of the call to EtwRegister Starting address of the unloading driver Reserved An attempt was made to unload a driver without calling EtwUnregister.
0xE0 (Windows Vista and later operating systems only) User-mode address used as a parameter Size ,in bytes, of the address range used as a parameter Reserved A call was made to an operating system Kernel function that specified a user-mode address as a parameter.
0xE1 (Windows Vista and later operating systems only) Address of the synchronization object Reserved Reserved A synchronization object was found to have an address that was either invalid or pageable.
0xE2 (Windows Vista and later operating systems only) Address of the IRP User-mode address present in the IRP Reserved An IRP with Irp->RequestorMode set to KernelMode was found to have a user-mode address as one of its members.
0xE3 (Windows Vista and later operating systems only) Address of the call to the API User-mode address used as a parameter in the API Reserved A driver has made a call to a kernel-mode ZwXxx routine with a user-mode address as a parameter.
0xE4 (Windows Vista and later operating systems only) Address of the call to the API Address of the malformed UNICODE_STRING structure Reserved A driver has made a call to a kernel-mode ZwXxx routine with a malformed UNICODE_STRING structure as a parameter.
0xE5 (Windows Vista and later operating systems only) Current IRQL Reserved Reserved A call was made to a Kernel API at the incorrect IRQL.
0xEA (Windows Vista and later operating systems only) Current IRQL Thread APC disable count Address of the pushlock A driver has attempted to acquire a pushlock while APCs are enabled.
0xEB (Windows Vista and later operating systems only) Current IRQL Thread APC disable count Address of the pushlock A driver has attempted to release a pushlock while APCs are enabled.
0xF0 (Windows Vista and later operating systems only) Address of the destination buffer Address of the source buffer Number of bytes to copy A driver called the memcpy function with overlapping source and destination buffers.
0xF5 (Windows Vista and later operating systems only) Address of the NULL handle Object type Reserved A driver passed a NULL handle to ObReferenceObjectByHandle.
0x1000 (Windows XP and later operating systems only) Address of the resource Reserved Reserved Self-deadlock: The current thread has tried to recursively acquire a resource. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1001 (Windows XP and later operating systems only) Address of the resource that was the final cause of the deadlock Reserved Reserved Deadlock: A lock hierarchy violation has been found. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.

(Use the !deadlock extension for further information.)

0x1002 (Windows XP and later operating systems only) Address of the resource Reserved Reserved Uninitialized resource: A resource has been acquired without having been initialized first. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1003 (Windows XP and later operating systems only) Address of the resource that is being released deadlocked Address of the resource which should have been released first Reserved Unexpected release: A resource has been released out of the proper order. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1004 (Windows XP and later operating systems only) Address of the resource Address of the thread that acquired the resource Address of the current thread Unexpected thread: The wrong thread is releasing a resource. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1005 (Windows XP and later operating systems only) Address of the resource Reserved Reserved Multiple initialization: A resource is being initialized more than once. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1006 (Windows XP and later operating systems only) Address of the thread being deleted Address of the resource owned by the thread Reserved Thread holds resources: A thread is being deleted without first releasing its resources. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1007 (Windows XP and later operating systems only) Address of the resource Reserved Reserved Unacquired resource: A resource is being released without having first been acquired. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.

Cause

See the description of each code in the Parameters section for a description of the cause. Note that values 0x1000 through 0x1020 for Parameter 1 are deadlock verifier error codes. Further information can be obtained by using the !deadlock extension.

Resolving the Problem

This bug check can only occur when Driver Verifier has been instructed to monitor one or more drivers. If you did not intend to use Driver Verifier, you should deactivate it. You might consider removing the driver which caused this problem as well.

If you are the driver writer, use the information obtained through this bug check to fix the bugs in your code.

After a Memory Allocation Tracking bug check, use the following command in the kernel debugger:

kd> dp ViBadDriver L1; dS @$p

This will return the name of the driver causing the error.

Then use the the !verifier extension:

kd> !verifier 3 drivername.sys

This will return information about the leaked memory allocations.

For full details on Driver Verifier, see the Driver Verifier section of the Windows Driver Kit (WDK).

Comments

The value of Parameter 1 is limited by the Driver Verifier options that are activated.

The _POOL_TYPE codes are enumerated in Ntddk.h. In particular, 0 (zero) indicates nonpaged pool and 1 (one) indicates paged pool.

    WinDbg Output Example:
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000b2, MmMapLockedPages called on an MDL having incorrect flags.
    For example, calling MmMapLockedPages for an MDL
    that is already mapped to a system address is incorrect.
Arg2: fffffa800ad9cf40, MDL address.
Arg3: 000000000000000c, MDL flags.
Arg4: 0000000000000004, Incorrect MDL flags.


DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000000, caller is trying to allocate zero bytes
Arg2: 0000000000000000, current IRQL
Arg3: 0000000000000000, pool type
Arg4: 0000000000000000, number of bytes


STOP 0x000000C5: DRIVER_CORRUPTED_EXPOOL    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560192(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xc5

    Knowledge Base Articles:
KB 302971    "Stop 0x1E" or "Stop 0xc5" After You Install Service Pack 2 and You Use Logitech Mouse Drivers (2000)
KB 324224    "Stop error code 0x000000C5" error message in Windows 2000
KB 961799    A Stop error occurs on a Windows Server 2003-based server when a user accesses shared files on the server by using an SMB connection
KB 967208    You receive a Stop error message some time after you use a 32-bit installer to install an NDIS intermediate driver on a computer that runs a 64-bit version of Windows Server 2003
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)

    WinDbg Help File Entry:

The DRIVER_CORRUPTED_EXPOOL bug check has a value of 0x000000C5. This indicates that the system attempted to access invalid memory at a process IRQL that was too high.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 IRQL at time of reference
3 0: Read

1: Write

4 Address that referenced memory

Cause

The kernel attempted to access pageable memory (or perhaps completely invalid memory) when the IRQL was too high. The ultimate cause of this problem is almost certainly a driver that has corrupted the system pool.

In most cases, this bug check results if a driver corrupts a small allocation (less than PAGE_SIZE). Larger allocations result in bug check 0xD0 (DRIVER_CORRUPTED_MMPOOL).

Resolving the Problem

If you have recently installed any new software, check to see if it is properly installed. Check for updated drivers on the manufacturer's website.

To debug this error, use the special pool option of Driver Verifier. If this fails to reveal the driver that caused the error, use the Global Flags utility to enable the special pool by pool tag.

For information about the special pool, consult the Driver Verifier section of the Windows Driver Kit.

    WinDbg Output Example:
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 834f51c5, address which referenced memory




STOP 0x000000C6: DRIVER_CAUGHT_MODIFYING_FREED_POOL    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560193(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xc6

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DRIVER_CAUGHT_MODIFYING_FREED_POOL bug check has a value of 0x000000C6. This indicates that the driver attempted to access a freed memory pool.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 0: Read

1: Write

3 0: Kernel mode

1: User mode

4 Reserved

Comments

The faulty component will be displayed in the current kernel stack. This driver should be either replaced or debugged.

    WinDbg Output Example:
DRIVER_CAUGHT_MODIFYING_FREED_POOL (c6)
An attempt was made to access freed pool memory.  The faulty component is
displayed in the current kernel stack.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: 0000000000000000, previous mode.
Arg4: 0000000000000000, 4.


STOP 0x000000C7: TIMER_OR_DPC_INVALID    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560198(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xc7

    Knowledge Base Articles:

    WinDbg Help File Entry:

The TIMER_OR_DPC_INVALID bug check has a value of 0x000000C7. This is issued if a kernel timer or delayed procedure call (DPC) is found somewhere in memory where it is not permitted.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 0: Timer object

1: DPC object

2: DPC routine

2 Address of object
3 Beginning of memory range checked
4 End of memory range checked

Cause

This condition is usually caused by a driver failing to cancel a timer or DPC before freeing the memory where it resides. When Driver Verifier is active, it will catch such errors and issue this bug check.

Resolving the Problem

If you are the driver writer, use the information obtained through this bug check to fix the bugs in your code.

If you are a system administrator, you should unload the driver if the problem persists.

For full details on Driver Verifier, see the Windows Driver Kit.

    WinDbg Output Example:
TIMER_OR_DPC_INVALID (c7)
Kernel timer or DPC used incorrectly.
Arguments:
Arg1: 0000000000000000, Timer object found in memory which must not contain such items.
Arg2: 0000000000000000, Address of the timer object.
Arg3: 0000000000000000, Start of memory range being checked.
Arg4: 0000000000000000, End of memory range being checked.


STOP 0x000000C8: IRQL_UNEXPECTED_VALUE    (go to top of page)

Usual causes:  Device driver, Lower-level program

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560202(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The IRQL_UNEXPECTED_VALUE bug check has a value of 0x000000C8. This indicates that the processor's IRQL is not what it should be at this time.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The value of the following bit computation:

(Current IRQL << 16) | (Expected IRQL << 8) | UniqueValue

2 Zero, or APC->KernelRoutine
3 Zero, or APC
4 Zero, or APC->NormalRoutine

You can determine "UniqueValue" by computing (Parameter 1 AND 0xFF). If "UniqueValue" is either zero or one, Parameter 2, Parameter 3, and Parameter 4 will equal the indicated APC pointers. Otherwise, these parameters will equal zero.

Cause

This error is usually caused by a device driver or another lower-level program that changed the IRQL for some period and did not restore the original IRQL at the end of that period. For example, the routine may have acquired a spin lock and failed to release it.

    WinDbg Output Example:
IRQL_UNEXPECTED_VALUE (c8)
The processor's IRQL is not what it should be at this time.  This is
usually caused by a lower level routine changing IRQL for some period
and not restoring IRQL at the end of that period (eg acquires spinlock
but doesn't release it).
        if UniqueValue is 0 or 1
            2 = APC->KernelRoutine
            3 = APC
            4 = APC->NormalRoutine
Arguments:
Arg1: 00000000, (Current IRQL << 16) | (Expected IRQL << 8) | UniqueValue
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000


STOP 0x000000C9: DRIVER_VERIFIER_IOMANAGER_VIOLATION    (go to top of page)

Usual causes:  Driver verifier

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560205(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xc9

    Knowledge Base Articles:
KB 931301    Error message when you attach a device that loads the Serscan.sys driver to a computer that is running Windows Server 2003 Service Pack 2: "STOP: 0x000000c9 DRIVER_VERIFIER_IOMANAGER_VIOLATION"
KB 932132    Certain Windows Server 2003 hotfixes have been repackaged to be compatible with Windows Server 2003 Service Pack 2 (SP2)
KB 942088    Error message when you perform a file operation on a Windows Server 2003-based computer that has IPv6 installed: "Stop 0x000000C9"
KB 950224    A Scalable Networking Pack (SNP) hotfix rollup package is available for Windows Server 2003
KB 2688203    "0x000000D1" and "0x000000C9" Stop errors when Message Queuing moves unsent messages to a dead-letter queue in Windows 7 or in Windows Server 2008 R2

    WinDbg Help File Entry:

The DRIVER_VERIFIER_IOMANAGER_VIOLATION bug check has a value of 0x000000C9. This is the bug check code for all Driver Verifier I/O Verification violations.

Parameters

When Driver Verifier is active and I/O Verification is selected, various I/O violations will cause this bug check to be issued. The following parameters will be displayed on the blue screen. Parameter 1 identifies the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x01 Address of IRP being freed 0 0 The driver attempted to free an object whose type is not IO_TYPE_IRP.
0x02 Address of IRP being freed 0 0 The driver attempted to free an IRP that is still associated with a thread.
0x03 Address of IRP being sent 0 0 The driver passed IoCallDriver an IRP Type not equal to IRP_TYPE.
0x04 Address of device object 0 0 The driver passed IoCallDriver an invalid device object.
0x05 Address of device object associated with offending driver IRQL before IoCallDriver IRQL after IoCallDriver The IRQL changed during a call to the driver dispatch routine.
0x06 IRP status Address of IRP being completed 0 The driver called IoCompleteRequest with a status marked as pending (or equal to -1).
0x07 Address of cancel routine Address of IRP being completed 0 The driver called IoCompleteRequest while its cancel routine was still set.
0x08 Address of device object IRP major function code Exception status code The driver passed IoBuildAsynchronousFsdRequest an invalid buffer.
0x09 Address of device object I/O control code Exception status code The driver passed IoBuildDeviceIoControlRequest an invalid buffer.
0x0A Address of device object 0 0 The driver passed IoInitializeTimer a device object with an already-initialized timer.
0x0C Address of I/O status block 0 0 The driver passed an I/O status block to an IRP, but this block is allocated on a stack which has already unwound past that point.
0x0D Address of user event object 0 0 The driver passed a user event to an IRP, but this event is allocated on a stack which has already unwound past that point.
0x0E Current IRQL Address of IRP 0 The driver called IoCompleteRequest with IRQL > DISPATCH_LEVEL.
0x0F Address of the device object to which the IRP is being sent Pointer to the IRP Pointer to file object The driver sent a create request with a file object that has been closed, or that had its open canceled.

In addition to the errors mentioned in the previous table, there are a number of I/O Verification errors that will cause Driver Verifier to halt the system, but which are not actually bug checks.

These errors cause messages to be displayed on the blue screen, in a crash dump file, and in a kernel debugger. These messages will appear differently in each of these locations. When these errors occur, the hexadecimal bug check code 0xC9 and the bug check string DRIVER_VERIFIER_IOMANAGER_VIOLATION do not appear on the blue screen or in the debugger, although they will appear in a crash dump file.

On the blue screen, the following data will be displayed:

If a kernel-mode crash dump has been enabled, the following information will appear in the crash dump file:

If a kernel debugger is attached to the system which has caused this violation, the following information will be sent to the debugger:

Note  No other bug checks can be ignored in this manner. Only this kind of I/O Verification errors can be ignored, and even these errors can only be ignored if a kernel debugger is attached.

The following table lists those I/O Verification errors that can appear. In Windows 2000, these errors will only be displayed if I/O Verification is set to Level 2.

I/O Error Code Severity Cause of Error
0x200 Unknown This code covers all unknown I/O Verification errors.
0x201 Fatal error A device is deleting itself while there is another device beneath it in the driver stack. This may be because the caller has forgotten to call IoDetachDevice first, or the lower driver may have incorrectly deleted itself.
0x202 Fatal error A driver has attempted to detach from a device object that is not attached to anything. This may occur if detach was called twice on the same device object. (Device object specified.)
0x203 Fatal error A driver has called IoCallDriver without setting the cancel routine in the IRP to NULL. (IRP specified.)
0x204 Fatal error The caller has passed in NULL as a device object. This is fatal. (IRP specified.)
0x205 Fatal error The caller is forwarding an IRP that is currently queued beneath it. The code handling IRPs returning STATUS_PENDING in this driver appears to be broken. (IRP specified.)
0x206 Fatal error The caller has incorrectly forwarded an IRP (control field not zeroed). The driver should use IoCopyCurrentIrpStackLocationToNext or IoSkipCurrentIrpStackLocation. (IRP specified.)
0x207 Fatal error The caller has manually copied the stack and has inadvertently copied the upper layer's completion routine. The driver should use IoCopyCurrentIrpStackLocationToNext. (IRP specified.)
0x208 Fatal error This IRP is about to run out of stack locations. Someone may have forwarded this IRP from another stack. (IRP specified.)
0x209 Fatal error The caller is completing an IRP that is currently queued beneath it. The code handling IRPs returning STATUS_PENDING in this driver appears to be broken. (IRP specified.)
0x20A Fatal error The caller of IoFreeIrp is freeing an IRP that is still in use. (Original IRP and IRP in use specified.)
0x20B Fatal error The caller of IoFreeIrp is freeing an IRP that is still in use. (IRP specified.)
0x20C Fatal error The caller of IoFreeIrp is freeing an IRP that is still queued against a thread. (IRP specified.)
0x20D Fatal error The caller of IoInitializeIrp has passed an IRP that was allocated with IoAllocateIrp. This is illegal and unnecessary, and has caused a quota leak. Check the documentation for IoReuseIrp if this IRP is being recycled.
0x20E Non-fatal error A PNP IRP has an invalid status. (Any PNP IRP must have its status initialized to STATUS_NOT_SUPPORTED.) (IRP specified.)
0x20F Non-fatal error A Power IRP has an invalid status. (Any Power IRP must have its status initialized to STATUS_NOT_SUPPORTED.) (IRP specified.)
0x210 Non-fatal error A WMI IRP has an invalid status. (Any WMI IRP must have its status initialized to STATUS_NOT_SUPPORTED.) (IRP specified.)
0x211 Non-fatal error The caller has forwarded an IRP while skipping a device object in the stack. The caller is probably sending IRPs to the PDO instead of to the device returned by IoAttachDeviceToDeviceStack. (IRP specified.)
0x212 Non-fatal error The caller has trashed or has not properly copied the IRP's stack. (IRP specified.)
0x213 Non-fatal error The caller has changed the status field of an IRP it does not understand. (IRP specified.)
0x214 Non-fatal error The caller has changed the information field of an IRP it does not understand. (IRP specified.)
0x215 Non-fatal error A non-successful non-STATUS_NOT_SUPPORTED IRP status for IRP_MJ_PNP is being passed down stack. (IRP specified.) Failed PNP IRPs must be completed.
0x216 Non-fatal error The previously-set IRP_MJ_PNP status has been converted to STATUS_NOT_SUPPORTED. (IRP specified.)
0x217 Non-fatal error The driver has not handled a required IRP. The driver must update the status of the IRP to indicate whether or not it has been handled. (IRP specified.)
0x218 Non-fatal error The driver has responded to an IRP that is reserved for other device objects elsewhere in the stack. (IRP specified.)
0x219 Non-fatal error A non-successful non-STATUS_NOT_SUPPORTED IRP status for IRP_MJ_POWER is being passed down stack. (IRP specified.) Failed POWER IRPs must be completed.
0x21A Non-fatal error The previously-set IRP_MJ_POWER status has been converted to STATUS_NOT_SUPPORTED. (IRP specified.)
0x21B Non-fatal error A driver has returned a suspicious status. This is probably due to an uninitialized variable bug in the driver. (IRP specified.)
0x21C Warning The caller has copied the IRP stack but not set a completion routine. This is inefficient — use IoSkipCurrentIrpStackLocation instead. (IRP specified.)
0x21D Fatal error An IRP dispatch handler has not properly detached from the stack below it upon receiving a remove IRP. (Device object, dispatch routine, and IRP specified.)
0x21E Fatal error An IRP dispatch handler has not properly deleted its device object upon receiving a remove IRP. (Device object, dispatch routine, and IRP specified.)
0x21F Non-fatal error A driver has not filled out a dispatch routine for a required IRP major function. (IRP specified.)
0x220 Non-fatal error IRP_MJ_SYSTEM_CONTROL has been completed by someone other than the ProviderId. This IRP should either have been completed earlier or should have been passed down. (IRP specified, along with the device object where it was targeted.)
0x221 Fatal error An IRP dispatch handler for a PDO has deleted its device object, but the hardware has not been reported as missing in a bus relations query. (Device object, dispatch routine, and IRP specified.)
0x222 Fatal error A Bus Filter's IRP dispatch handler has detached upon receiving a remove IRP when the PDO is still alive. Bus Filters must clean up in FastIoDetach callbacks. (Device object, dispatch routine, and IRP specified.)
0x223 Fatal error An IRP dispatch handler for a bus filter has deleted its device object, but the PDO is still present. Bus filters must clean up in FastIoDetach callbacks. (Device object, dispatch routine, and IRP specified.)
0x224 Fatal error An IRP dispatch handler has returned a status that is inconsistent with the IRP's IoStatus.Status field. (Dispatch handler routine, IRP, IRP's IoStatus.Status, and returned Status specified.)
0x225 Non-fatal error An IRP dispatch handler has returned a status that is illegal (0xFFFFFFFF). This is probably due to an uninitialized stack variable. To debug this error, use the ln (List Nearest Symbols) command with the specified address.
0x226 Fatal error An IRP dispatch handler has returned without passing down or completing this IRP, or someone forgot to return STATUS_PENDING. (IRP specified.)
0x227 Fatal error An IRP completion routine is in pageable code. (This is never permitted.) (Routine and IRP specified.)
0x228 Non-fatal error A driver's completion routine has not marked the IRP pending if the PendingReturned field was set in the IRP passed to it. This may cause Windows to hang, especially if an error is returned by the stack. (Routine and IRP specified.)
0x229 Fatal error A cancel routine has been set for an IRP that is currently being processed by drivers lower in the stack, possibly stomping their cancel routine. (Routine and IRP specified.)
0x22A Non-fatal error The physical device object (PDO) has not responded to a required IRP. (IRP specified.)
0x22B Non-fatal error The physical device object (PDO) has forgotten to fill out the device relation list with the PDO for the TargetDeviceRelation query. (IRP specified.)
0x22C Fatal error The code implementing the TargetDeviceRelation query has not called ObReferenceObject on the PDO. (IRP specified.)
0x22D Non-fatal error The caller has completed a IRP_MJ_PNP it didn't understand instead of passing it down. (IRP specified.)
0x22E Non-fatal error The caller has completed a successful IRP_MJ_PNP instead of passing it down. (IRP specified.)
0x22F Non-fatal error The caller has completed an untouched IRP_MJ_PNP (instead of passing the IRP down), or non-PDO has failed the IRP using illegal value of STATUS_NOT_SUPPORTED. (IRP specified.)
0x230 Non-fatal error The caller has completed an IRP_MJ_POWER it didn't understand instead of passing it down. (IRP specified.)
0x231 Fatal error The caller has completed a successful IRP_MJ_POWER instead of passing it down. (IRP specified.)
0x232 Non-fatal error The caller has completed an untouched IRP_MJ_POWER (instead of passing the IRP down), or non-PDO has failed the IRP using illegal value of STATUS_NOT_SUPPORTED. (IRP specified.)
0x233 Non-fatal error The version field of the query capabilities structure in a query capabilities IRP was not properly initialized. (IRP specified.)
0x234 Non-fatal error The size field of the query capabilities structure in a query capabilities IRP was not properly initialized. (IRP specified.)
0x235 Non-fatal error The address field of the query capabilities structure in a query capabilities IRP was not properly initialized to -1. (IRP specified.)
0x236 Non-fatal error The UI Number field of the query capabilities structure in a query capabilities IRP was not properly initialized to -1. (IRP specified.)
0x237 Fatal error A driver has sent an IRP that is restricted for system use only. (IRP specified.)
0x238 Warning The caller of IoInitializeIrp has passed an IRP that was allocated with IoAllocateIrp. This is illegal, unnecessary, and negatively impacts performance in normal use. If this IRP is being recycled, see IoReuseIrp in the Windows Driver Kit.
0x239 Warning The caller of IoCompleteRequest is completing an IRP that has never been forwarded via a call to IoCallDriver or PoCallDriver. This may be a bug. (IRP specified.)
0x23A Fatal error A driver has forwarded an IRP at an IRQL that is illegal for this major code. (IRP specified.)
0x23B Non-fatal error The caller has changed the status field of an IRP it does not understand. (IRP specified.)

The following table lists additional I/O Verification errors that can appear in Windows XP and later. Some of these errors will only be revealed if Enhanced I/O Verification is activated.

I/O Error Code Severity Cause of Error
0x23C Fatal error A driver has completed an IRP without setting the cancel routine in the IRP to NULL. (IRP specified.)
0x23D Non-fatal error A driver has returned STATUS_PENDING but did not mark the IRP pending via a call to IoMarkIrpPending. (IRP specified.)
0x23E Non-fatal error A driver has marked an IRP pending but didn't return STATUS_PENDING. (IRP specified.)
0x23F Fatal error A driver has not inherited the DO_POWER_PAGABLE bit from the stack it has attached to. (Device object specified.)
0x240 Fatal error A driver is attempting to delete a device object that has already been deleted via a prior call to IoDeleteDevice.
0x241 Fatal error A driver has detached its device object during a surprise remove IRP. (IRP and device object specified.)
0x242 Fatal error A driver has deleted its device object during a surprise remove IRP. (IRP and device object specified.)
0x243 Fatal error A driver has failed to clear the DO_DEVICE_INITIALIZING flag at the end of AddDevice. (Device object specified.)
0x244 Fatal error A driver has not copied either the DO_BUFFERED_IO or the DO_DIRECT_IO flag from the device object it is attaching to. (Device object specified.)
0x245 Fatal error A driver has set both the DO_BUFFERED_IO and the DO_DIRECT_IO flags. These flags are mutually exclusive. (Device object specified.)
0x246 Fatal error A driver has failed to copy the DeviceType field from the device object it is attaching to. (Device object specified.)
0x247 Fatal error A driver has failed an IRP that cannot legally be failed. (IRP specified.)
0x248 Fatal error A driver has added a device object that is not a PDO to a device relations query. (IRP and device object specified.)
0x249 Non-fatal error A driver has enumerated two child PDOs that returned identical Device IDs. (Both device objects specified.)
0x24A Fatal error A driver has mistakenly called a file I/O function with IRQL not equal to PASSIVE_LEVEL.
0x24B Fatal error A driver has completed an IRP_MN_QUERY_DEVICE_RELATIONS request of type TargetDeviceRelation as successful, but did not properly fill out the request or forward the IRP to the underlying hardware stack. (Device object specified.)
0x24C Non-fatal error A driver has returned STATUS_PENDING but did not mark the IRP pending by a call to IoMarkIrpPending. (IRP specified.)
0x24D Fatal error A driver has passed an invalid device object to a function that requires a PDO. (Device object specified.)

Cause

See the description of each code in the Parameters section for a description of the cause.

Resolving the Problem

This bug check can only occur when Driver Verifier has been instructed to monitor one or more drivers. If you did not intend to use Driver Verifier, you should deactivate it. You might consider removing the driver which caused this problem as well.

If you are the driver writer, use the information obtained through this bug check to fix the bugs in your code.

For full details on Driver Verifier, see the Windows Driver Kit.

    WinDbg Output Example:
DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 0000021f, A driver has not filled out a dispatch routine for a required IRP major function.
Arg2: 8c12bb41, The address in the driver's code where the error was detected.
Arg3: 8cf50f00, IRP address.
Arg4: 00000000


STOP 0x000000CA: PNP_DETECTED_FATAL_ERROR    (go to top of page)

Usual causes:  PnP device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560209(v=VS.85).aspx
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/10/19/debugging-stop-0xca-pnp_detected_fatal_error/

    Knowledge Base Articles:
KB 326457    Inserting the Same SmartMedia Adapters Causes a "Stop 0x000000CA" Error Message (XP)
KB 886800    A disk signature changes unexpectedly on a Windows Server 2003 clustered physical disk resource
KB 898446    You receive a "Stop 0x000000CA" error when you use two SCSI storage devices on a Windows Server 2003-based computer
KB 938907    Error message on a Windows Server 2003-based computer: "STOP: 0x000000CA (parameter1, parameter2, parameter3, parameter4) PNP_DETECTED_FATAL_ERROR
KB 957176    Stop error when you plug two infrared (IR) receivers into a computer that is running Windows Vista or Windows Server 2008: "STOP: 0x000000CA"
KB 980856    Stop error in Windows Server 2008 R2: "0x000000CA PNP_DETECTED_FATAL_ERROR"

    WinDbg Help File Entry:

The PNP_DETECTED_FATAL_ERROR bug check has a value of 0x000000CA. This indicates that the Plug and Play Manager encountered a severe error, probably as a result of a problematic Plug and Play driver

Parameters

The following parameters are displayed on the blue screen. Parameter 1 identifies the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x1 Address of newly-reported PDO Address of older PDO which has been duplicated Reserved Duplicate PDO: A specific instance of a driver has enumerated multiple PDOs with identical device ID and unique IDs.
0x2 Address of purported PDO Address of driver object Reserved Invalid PDO: An API which requires a PDO has been called with random memory, or with an FDO, or with a PDO which hasn't been initialized.

(An uninitialized PDO is one that has not been returned to Plug and Play by QueryDeviceRelation or QueryBusRelations.)

0x3 Address of PDO whose IDs were queried Address of ID buffer 1: DeviceID

2: UniqueID

3: HardwareIDs

4: CompatibleIDs

Invalid ID: An enumerator has returned an ID which contains illegal characters or isn't properly terminated. (IDs must contain only characters in the ranges 0x20 - 0x2B and 0x2D - 0x7F.)
0x4 Address of PDO with DOE_DELETE_PENDING set Reserved Reserved Invalid enumeration of deleted PDO: An enumerator has returned a PDO which it had previously deleted using IoDeleteDevice.
0x5 Address of PDO Reserved Reserved PDO freed while linked in devnode tree: The object manager reference count on a PDO dropped to zero while the devnode was still linked in the tree. (This usually indicates that the driver is not adding a reference when returning the PDO in a query IRP.)
0x8 Address of PDO whose stack returned the invalid bus relation Total number of PDOs returned as bus relations The index (zero-based) at which the first NULL PDO was found Null pointer returned as a bus relation: One or more of the devices present on the bus is a NULL PDO.
0x9 Connection type that was passed Reserved Reserved Invalid connection type passed to IoDisconnectInterruptEx: A driver has passed an invalid connection type to IoDisconnectInterruptEx. The connection type passed to this routine must match the one returned by a corresponding successful call to IoConnectInterruptEx.
0xA Driver object IRQL after returning from driver callback Combined APC disable count after returning from driver callback Incorrect notify callback behavior: A driver failed to preserve IRQL or combined APC disable count across a Plug 'n' Play notification.
0xB Related PDO Removal relations Reserved Deleted PDO reported as relation: One of the removal relations for the device being removed has already been deleted.

    WinDbg Output Example:
PNP_DETECTED_FATAL_ERROR (ca)
PnP encountered a severe error, either as a result of a problem in a driver or
a problem in PnP itself.  The first argument describes the nature of the
problem, the second argument is the address of the PDO.  The other arguments
vary depending on argument 1.
Arguments:
Arg1: 0000000000000000,
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000CB: DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS    (go to top of page)

Usual causes:  Device driver, Driver verifier

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560212(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xcb

    Knowledge Base Articles:
KB 254813    "Stop 0x000000cb" Uninstalling SMS 2.0 on Windows 2000
KB 825760    You Receive Stop Error 0x00000076 or 0x000000CB When You Quit Your Backup Software (2000, XP)
KB 825820    "0x00000076" or "0x000000CB" Stop Error Occurs When Windows 2000 Server Tries to Run a Process on a Remote Server
KB 951033    Stop error message on a Windows Server 2003-based computer that has Citrix Presentation Server 4.5 installed: "0x00000076" or "0x000000CB"
KB 979742    "0x000000CB" Stop error or "0x00000076" Stop error in Windows Vista or in Windows Server 2008 when you access shared network resources by using SMB version 1 protocol on the computer

    WinDbg Help File Entry:

The DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS bug check has a value of 0x000000CB. This indicates that a driver or the I/O manager failed to release locked pages after an I/O operation.

Parameters

The four parameters listed in the message can have two possible meanings.

If a driver locked these pages, the parameters have the following meaning.

Parameter Description
1 Calling address in the driver that locked the pages
2 Caller of the calling address in driver that locked the pages
3 Address of the MDL containing the locked pages
4 Number of locked pages

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

If the I/O manager locked these pages, the parameters have the following meaning.

Parameter Description
1 Address of the dispatch routine of the top driver on the stack to which the IRP was sent
2 Address of the device object of the top driver on the stack to which the IRP was sent
3 Address of the MDL containing the locked pages
4 Number of locked pages

Comments

This bug check is issued only if the registry value \\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\TrackLockedPages is equal to DWORD 1. If this value is not set, the system will issue the less-informative bug check 0x76 (PROCESS_HAS_LOCKED_PAGES).

Starting with Windows Vista, this bug check can also be issued by Driver Verifier when the Pool Tracking option is enabled.

    WinDbg Output Example:
DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (cb)
Caused by a driver not cleaning up completely after an I/O.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 0000000000000000, The calling address in the driver that locked the pages or if the
    IO manager locked the pages this points to the dispatch routine of
    the top driver on the stack to which the IRP was sent.
Arg2: 0000000000000000, The caller of the calling address in the driver that locked the
    pages. If the IO manager locked the pages this points to the device
    object of the top driver on the stack to which the IRP was sent.
Arg3: 0000000000000000, A pointer to the MDL containing the locked pages.
Arg4: 0000000000000000, The number of locked pages.


STOP 0x000000CC: PAGE_FAULT_IN_FREED_SPECIAL_POOL    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560216(v=VS.85).aspx

    Knowledge Base Articles:
KB 973295    A multiprocessor computer that is running Windows Server 2003 SP2 stops responding under a heavy load if you change a Windows Firewall setting
KB 977694    Stop error message when you access shared files in Windows Server 2008 or in Windows Vista: 0x00000044 or 0x000000CC

    WinDbg Help File Entry:

The PAGE_FAULT_IN_FREED_SPECIAL_POOL bug check has a value of 0x000000CC. This indicates that the system has referenced memory which was earlier freed.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read

1: Write

3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

The system has accessed memory in the special pool which was already freed by a driver. This usually indicates a system-driver synchronization problem.

For information about the special pool, consult the Driver Verifier section of the Windows Driver Kit.

Comments

This cannot be protected by a try - except handler — it can only be protected by a probe.

    WinDbg Output Example:
PAGE_FAULT_IN_FREED_SPECIAL_POOL (cc)
Memory was referenced after it was freed.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: b2632fdc, memory referenced
Arg2: 00000001, value 0 = read operation, 1 = write operation
Arg3: 81cf63b8, if non-zero, the address which referenced memory.
Arg4: 00000000, Mm internal code.


STOP 0x000000CD: PAGE_FAULT_BEYOND_END_OF_ALLOCATION    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560219(v=VS.85).aspx

    Knowledge Base Articles:
KB 323256    Stop 0x50 Error Message When You Rename a Large Number of Files on Windows 2000
KB 829729    Special Pool Feature May Cause a 0x000000CD Stop Error (2000)
KB 836587    FIX: You may receive a "PAGE_FAULT_BEYOND_END_OF_ALLOCATION" stop error when you enable event logging in Server for NFS in Windows Services for UNIX 3.0 or 3.5
KB 2280732    You receive Stop error message 0x000000CD or 0x00000019 on a computer that is running Windows Server 2003 when corrupted registry hive files are loaded
KB 2870079    Windows 7 SP1 bluescreen happened during stress tests

    WinDbg Help File Entry:

The PAGE_FAULT_BEYOND_END_OF_ALLOCATION bug check has a value of 0x000000CD. This indicates that the system accessed memory beyond the end of some driver's pool allocation.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read

1: Write

3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

The driver allocated n bytes of memory from the special pool. Subsequently, the system referenced more than n bytes from this pool. This usually indicates a system-driver synchronization problem.

For information about the special pool, consult the Driver Verifier section of the Windows Driver Kit.

Comments

This cannot be protected by a try - except handler — it can only be protected by a probe.

    WinDbg Output Example:
PAGE_FAULT_BEYOND_END_OF_ALLOCATION (cd)
N bytes of memory was allocated and more than N bytes are being referenced.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff9800c6e7000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: fffff8000246cc5c, if non-zero, the address which referenced memory.
Arg4: 0000000000000000, Mm internal code.


STOP 0x000000CE: DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560226(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xce

    Knowledge Base Articles:
KB 290114    "Stop 0x000000CE" in Vga.dll When You Try to Change Display Settings (2000)
KB 293410    STOP 0x000000CE Error Message Occurs in Vga.sys (2000)
KB 296946    "STOP 0x000000CE" Error Message in Raspppoe.sys During Upgrade from Windows NT 4.0 to Windows 2000
KB 301515    Error Message on a Blue Screen When You Stop SFU 2.0 NFS Client Service on Windows XP-Based Computer
KB 310899    "STOP 0x000000CE in Dxapi.sys" Error on Computer Where Video Adapter Has TV Tuner or Video Capture Feature (XP)
KB 327643    You Receive a "Stop 0x000000CE" Error Message During Shutdown (2000 Server)
KB 329710    "Stop 0x000000CE" Error Message During Startup (2000 Server)
KB 810022    Bugcheck with Stop Message "STOP 0x000000CE" and Svr.sys in Crashdump When Computer Shuts Down (2000)
KB 810038    Stop 0x000000E3 error occurs when redirector thread tries to release a lock (2000)
KB 875430    You receive a "Stop 0x000000CE" Stop error message when you change the resources of a parallel port device in Device Manager on your Windows 2000-based computer
KB 927547    Stop error message when you try to shut down Windows Server 2003: "STOP 0x000000CE DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS"
KB 938512    Error message when you perform a surprise removal of a USB device on a Windows XP Service Pack 2-based computer: "STOP 0x000000CE DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS"
KB 960882    Error message when a Windows Server 2003-based computer is shutting down: "Stop 0x000000CE" or "Stop 0x00000050"
KB 976488    You receive a "Stop 0x000000CD" error on the restart after you run Windows Update on a virtual machine that is running Windows Server 2000 SP4
KB 2004709    You may revieve an system blue screen in usbvideo.sys when sleeping or resuming a system running Microsoft Windows 7

    WinDbg Help File Entry:

The DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS bug check has a value of 0x000000CE. This indicates that a driver failed to cancel pending operations before unloading.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read

1: Write

3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

This driver failed to cancel lookaside lists, DPCs, worker threads, or other such items before unload.

    WinDbg Output Example:
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce)
A driver unloaded without cancelling timers, DPCs, worker threads, etc.
The broken driver's name is displayed on the screen.
Arguments:
Arg1: fffffa60044f4674, memory referenced
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation
Arg3: fffffa60044f4674, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, Mm internal code.


STOP 0x000000CF: TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560231(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE bug check has a value of 0x000000CF. This indicates that a driver has been incorrectly ported to the terminal server.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read

1: Write

3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

The driver is referencing session space addresses from the system process context. This probably results from the driver queuing an item to a system worker thread.

This driver needs to comply with Terminal Server's memory management rules.

    WinDbg Output Example:
TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE (cf)
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: 0000000000000000, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, Mm internal code.
    A driver has been incorrectly ported to Terminal Server.  It is referencing
    session space addresses from the system process context.  Probably from
    queueing an item to a system worker thread.
    The broken driver's name is displayed on the screen.


STOP 0x000000D0: DRIVER_CORRUPTED_MMPOOL    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560239(v=VS.85).aspx

    Knowledge Base Articles:
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)

    WinDbg Help File Entry:

The DRIVER_CORRUPTED_MMPOOL bug check has a value of 0x000000D0. This indicates that the system attempted to access invalid memory at a process IRQL that was too high.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 IRQL at time of reference
3 0: Read

1: Write

4 Address that referenced memory

Cause

The kernel attempted to access pageable memory (or perhaps completely invalid memory) when the IRQL was too high. The ultimate cause of this problem is almost certainly a driver that has corrupted the system pool.

In most cases, this bug check results if a driver corrupts a large allocation (PAGE_SIZE or larger). Smaller allocations result in bug check 0xC5 (DRIVER_CORRUPTED_EXPOOL).

Resolving the Problem

If you have recently installed any new software, check to see if it is properly installed. Check for updated drivers on the manufacturer's website.

To debug this error, use the special pool option of Driver Verifier. If this fails to reveal the driver that caused the error, use the Global Flags utility to enable the special pool by pool tag.

For information about the special pool, consult the Driver Verifier section of the Windows Driver Kit.

An alternate method is to open the \\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management registry key. In this key, create or edit the ProtectNonPagedPool value, and set it equal to DWORD 1. Then reboot. Then the system will unmap all freed nonpaged pool. This will prevent drivers from corrupting the pool. (This does not protect the pool from DMA hardware, however.)

    WinDbg Output Example:
DRIVER_CORRUPTED_MMPOOL (d0)
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is
    caused by drivers that have corrupted the system pool.  Run the driver
    verifier against any new (or suspect) drivers, and if that doesn't turn up
    the culprit, then use gflags to enable special pool.  You can also set
    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\ProtectNonPagedPool
    to a DWORD 1 value and reboot.  Then the system will unmap freed nonpaged pool,
    preventing drivers (although not DMA-hardware) from corrupting the pool.


STOP 0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560244(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xd1
    Other Articles:
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/10401-0x000000d1-debugging-notmyfault-exploration-x64.html

    Knowledge Base Articles:
KB 247421    STOP 0x000000D1 in Ino_fltr.sys with Inoculan (2000)
KB 249442    "Stop 0x000000D1" Error in Atmlane.sys (2000)
KB 260956    "Stop 0x000000D1" Error Message in Tcpip.sys (2000)
KB 269279    The BLACKDRV.SYS file Causes the Stop Error Message: 0X000000D1(0XBE70D600, 0X00000000,0X00000000,0XBE92F13C) (2000, XP)
KB 282271    "Stop 0X000000D1" Message in Atmlane.sys (2000)
KB 316208    "Stop error code 0x000000D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL)" error message when you start your Windows XP-based computer
KB 317326    Stop 0x000000D1 Error Message When You Turn Your Computer Off (XP)
KB 810980    "STOP 0x000000D1 IRQL_NOT_LESS_OR_EQUAL Kbdclass.sys" Error Message When You Try to Shut Down the Computer (2000, XP)
KB 816036    Windows 2000 crashes with a "Stop error code 0x000000D1" error message
KB 817367    Stop Error 0x000000D1 When You Use Host Integration Server to Connect to a Mainframe Computer That Is Using the DLC Protocol (2000)
KB 817789    Computer stops responding with a "Stop error code 0x000000D1 (Driver_IRQL_Not_Less_Or_Equal)" error message (Server 2003)
KB 826502    The server stops responding, and you receive a "Stop error code 0x000000D1" error message (2000)
KB 834630    Stop error code 0x000000D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL) on your Windows Server 2003-based computer
KB 842464    You receive a "Stop: 0x000000D1" error message after you establish a VPN connection (2000, XP, Server 2003)
KB 842840    Stop error code 0x000000D1 when Windows Server 2003 is under a heavy network load
KB 843091    Stop error code 0x000000D1 when you shut down Windows XP
KB 867772    "Stop error code 0x000000D1" occurs after Windows Server 2003 stops unexpectedly

KB 873152    You occasionally receive a "STOP: 0x000000D1" error message when your Windows XP Service Pack 2-based computer resumes from standby
KB 884590    You receive a "Stop 0x000000D1" Stop error message when you back up data to a tape device on a computer that is running Windows Server 2003, Windows XP, or Windows 2000
KB 888399    You receive a "STOP 0x000000D1" error message on your Windows XP Service Pack 2-based portable computer
KB 890554    You receive a "STOP 0x000000D1" error message on a blue screen in Windows Server 2003
KB 894070    The Afd.sys file triggers a "Stop 0x000000D1" error on a Windows Server 2003-based computer
KB 897574    You may receive a Stop error message after you insert media into a removable disk device in Windows XP, Windows Server 2003, or Windows 2000
KB 902973    You occasionally receive a "STOP 0x000000D1" error message when you start or shut down a Windows XP-based computer or a Windows Server 2003-based computer
KB 906882    You receive a "STOP: 0x000000D1" error message on a computer that is running Windows XP with Service Pack 1 or Windows XP with Service Pack 2
KB 916595    Stop error message on a Windows XP-based computer: "STOP 0x000000D1"
KB 924941    You receive a stop error message when you use a Bluetooth radio on a Windows XP-based computer
KB 925922    The computer restarts unexpectedly, or you receive an error message in Windows XP: "Stop: 0x000000D1"
KB 927015    Stop error message on a Windows XP SP1-based computer: "STOP 0x000000D1"
KB 931322    Error message on a Windows Server 2003 SP1 or SP2-based computer that is configured to use the Network Address Translation (NAT) functionality: "STOP: 0x000000D1 (parameter1 , 0x00000002, 0x00000000, 0xf27b4e8e)"
KB 931365    Error message when you use an IPsec tunnel mode connection to communicate from a Windows Vista-based computer to another computer: "STOP 0x000000D1 DRIVER_IRQL_NOT_LESS_OR_EQUAL"
KB 932755    An updated Storport storage driver is available for Windows Server 2003
KB 935696    You receive a Stop 0x000000D1 error when you remove a USB storage device from a computer that is running Windows Server 2003 Service Pack 1 (SP1)
KB 937367    Stop error message when you set the ConnectOnRequestedInterfaceOnly registry entry to 1 on a computer that is running Microsoft Windows XP: "STOP 0x000000D1 DRIVER_IRQL_NOT_LESS_OR_EQUAL"
KB 939010    You receive a "STOP 0x000000D1" error after you create a network bridge on a computer that is running Windows XP
KB 939780    Error message when a Windows XP SP2-based or Windows Server 2003-based multiprocessor computer uses driver Battc.sys: "STOP 0x000000D1 DRIVER_IRQL_NOT_LESS_OR_EQUAL"
KB 945119    Stop error that is related to the Storport.sys driver on a Windows Server 2003-based computer: "0x000000D1 (parameter1, parameter2, parameter3, parameter4) DRIVER_IRQL_NOT_LESS_OR_EQUAL"
KB 946776    Stop error message on a Windows Vista-based computer when you unplug the network cable: "STOP 0x000000D1 DRIVER_IRQL_NOT_LESS_OR_EQUAL"
KB 946939    "Stop error code 0x000000D1" occurs on computers with McAfee VirusScan Enterprise installed (Server 2003)
KB 947382    Error message when you bring the computer out of the "Hibernate system" power state in Windows Vista: "Stop 0x000000D1"
KB 955734    Stop error message in Windows Server 2008, in Windows Vista, or in Windows Vista SP1: "0x000000D1"
KB 959520    Stop error when you execute some common Plug and Play functions on a Windows Vista-based or a Windows Server 2008-based computer: "STOP 0x000000D1" or "STOP 0x000000FE"
KB 961799    A Stop error occurs on a Windows Server 2003-based server when a user accesses shared files on the server by using an SMB connection
KB 967048    Error message on a Windows XP-based computer that has a USB card reader: "Stop 0x000000D1"
KB 967849    Stop error message when you install the Cisco VPN Client application and then you restart a computer that is running Windows 7 Beta: "Stop 0x000000D1"
KB 967891    Error message when you use applications that are based on legacy Transport Driver Interface (TDI) filter drivers on a computer that is running Windows 7 Beta or Windows Server 2008 R2: "STOP 0x000000D1
KB 969238    A data transfer is corrupted when you transfer data from or to a USB device on a computer that is running Windows XP
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)
KB 973196    Stop error 0xD1 may occur on a computer that is running Windows Vista or Windows Server 2008
KB 976748    Stop error code after you install Microsoft Multipath I/O (MPIO) on a computer that is running Windows Server 2008: "0x000000D1" or "0x00000050"
KB 977067    You receive a stop error after you enable the RequireinClearout mode on an IPv6 network on Windows Server 2008 R2 or in Windows 7
KB 978535    Stop error on a blue screen when you remove an SD card from a Windows 7-based or Windows Server 2008 R2-based computer: "0x000000D1"
KB 978982    Stop error when you resume a computer that is running Windows 7 or Windows Server 2008 R2 from sleep or from hibernation: "STOP: 0x000000D1"
KB 982674    "Stop 0x000000D1" error after you enable an iSCSI Initiator data digest setting that uses CRC or that uses checksum in Windows Server 2008 R2 or in Windows 7
KB 983543    "STOP 0x000000D1" error message when you try to access a device that is not a PCI device in Windows 7 or in Windows Server 2008 R2
KB 2121148     A computer that is running Windows 7 or Windows Server 2008 R2 crashes when an application sends an I/O request to a USB-connected CD drive
KB 2270406    "0x000000D1" Stop error message when you try to refresh a webpage in Internet Explorer on a computer that is running Windows XP SP3
KB 2277122    Stop error in Windows Server 2003 if a computer has some iSCSI disks and the computer is under a heavy stress situation: "0x000000D1"
KB 2277440    Stop error message “0x000000D1” occurs in MSDSM.sys on a computer that is running Windows Server 2008
KB 2320550   Stop error on a computer that is running Windows Server 2008 R2, Windows Server 2008 (SP2), Windows Vista (SP2) or Windows 7 when the operating system uses a virtual storport miniport driver to save a dump file or a hibernation file: "0x000000D1"
KB 2394911    Stop error "0x000000D1" or "0x0000007E" in an SMB2 environment in Windows 7 or in Windows Server 2008 R2
KB 2445815    "DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)" Stop error and an ISA Server 2006 crash may occur
KB 2479442    Stop error during startup in Windows Server 2008 or in Windows Vista
KB 2495313    A "0x000000D1" Stop error occurs when you run a telephony application that uses the RAS PPPoE driver in Windows 7
KB 2511962    "0x000000D1" Stop error occurs in the Mpio.sys driver in Windows Server 2008 R2
KB 2519644    Stop code in the tcpip.sys driver on a computer that is running Windows Server 2008 R2: 0x000000D1
KB 2549567    "0x000000D1" Stop error message when you back up files to a storage device on a computer that is running Windows Server 2008 R2
KB 2578466    FIX: Threat Management Gateway 2010 may crash with Stop error "DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)" (Server OS's)
KB 2615763    "0x000000D1" Stop error when you connect a USB composite device to a computer that is running Windows 7 or Windows Server 2008 (R2)
KB 2618032   Stop error 0x000000D1 when you install Windows Phone SDK 7.1 Release Candidate on Windows Developer Preview (Win8)
KB 2633799    You randomly receive various Stop errors when you change the network adapter teaming configuration in Windows Server 2008 or in Windows Vista
KB 2636573    FIX: The guest operating system may crash when you perform a live migration of Hyper-V virtual machines in a Windows Server 2008 R2 environment
KB 2688203    "0x000000D1" and "0x000000C9" Stop errors when Message Queuing moves unsent messages to a dead-letter queue in Windows 7 or in Windows Server 2008 R2
KB 2712561    "0x000000D1" Stop error when you run a Windows Logo Kit 1.6 common scenario test in Windows 7 or in Windows Server 2008 R2

KB 2719347    Stop error when a Windows 7-based or Windows Server 2008 R2-based computer crashes randomly
KB 2732485    Microsoft Forefront Unified Access Gateway 2010 Direct Access machine crashes with stop code 0xD1
KB 2742222    Stop error when you try to deploy a Windows 7 or Windows Server 2008 R2 image to a computer
KB 2752370    "0x000000D1" Stop error when you perform a network-related operation on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2752589    "0x000000D1" Stop error after you install hotfix 979612 or any later version of the hotfix that contains the Tcpip.sys file on a computer that is running Windows Vista or Windows Server 2008
KB 2781571    "0x000000D1" Stop error after you install TDI drivers in Windows Vista and Windows Server 2008
KB 2787847    "0x000000D1" Stop error when a storage array is attached to a network environment and running Windows Server 2008 R2
KB 2789968    "0x000000D1" Stop error after you install the WDK WFP "inspect" sample in Windows 7 or Windows Server 2008 R2
KB 2820467    "0x000000D1" Stop error when you shut down a Windows Server 2008 R2-based computer
KB 2821052    "0x000000D1" Stop error when you open the MPIO snap-in on a computer that is running Windows Server 2012
KB 2851149    "0x000000D1 DRIVER_IRQL_NOT_LESS_OR_EQUAL" Stop error on a Windows 7 SP1 or Windows Server 2008 R2 SP1-based computer
KB 2863960    Stop error message on Windows Server 2012-based computer: "DRIVER_IRQL_NOT_LESS_OR_EQUAL" or "USER_MODE_HEALTH_MONITOR"
KB 2866029    "0x000000D1" Stop error when you perform a live migration of a virtual machine on a Windows Server 2012-based cluster
KB 2895237    FIX: Stop error 0X000000D1 in rdbss!RxTimerDispatch occurs on a server that is running Windows 7 Service Pack 1 or Windows Server 2008 R2 Service Pack 1

    Many more BSOD articles at this link:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x000000d1&x=8&y=9&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The DRIVER_IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x000000D1. This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 IRQL at time of reference
3 0: Read

1: Write

8: Execute

4 Address that referenced memory

Cause

A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high.

This bug check is usually caused by drivers that have used improper addresses.

If the first parameter has the same value as the fourth parameter, and the third parameter indicates an execute operation, this bug check was likely caused by a driver that was trying to execute code when the code itself was paged out. Possible causes for the page fault include the following:

Resolving the Problem

To begin debugging, use a kernel debugger to get a stack trace.

If the problem is caused by the driver that you are developing, make sure that the function that was executing at the time of the bug check is not marked as pageable or does not call any other inline functions that could be paged out.

    WinDbg Output Example:
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 040501d6, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 833b2012, address which referenced memory


STOP 0x000000D2: BUGCODE_ID_DRIVER    (go to top of page)

Usual causes:  NDIS Device driver, drivers acting on the NDIS driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560249(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The BUGCODE_ID_DRIVER bug check has a value of 0x000000D2. This indicates that a problem occurred with an NDIS driver.

Parameters

Before this bug check occurs, a message is sent to the DbgPrint buffer. If a debugger is connected, this message will be displayed.

This message indicates the type of violation. The meanings of the bug check parameters depend on this message.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Message and Cause
Address of the miniport block Number of bytes requested 0 1 Allocating shared memory at raised IRQL. A driver called NdisMAllocateSharedMemory with IRQL >= DISPATCH_LEVEL.
Address of the miniport block The Status value submitted to NdisMResetComplete The AddressingReset value submitted to NdisMResetComplete 0 Completing reset when one is not pending. A driver called NdisMResetComplete, but no reset was pending.
Address of the miniport block Memory page containing address being freed Address of shared memory signature Virtual address being freed Freeing shared memory not allocated. A driver called NdisMFreeSharedMemory or NdisMFreeSharedMemoryAsync with an address that is not located in NDIS shared memory.
Address of the miniport block Address of the packet that is incorrectly included in the packet array Address of the packet array Number of packets in the array Indicating packet not owned by it. The miniport's packet array is corrupt.
Address of the MiniBlock Address of the driver object 0 0 NdisAddDevice: AddDevice called with a MiniBlock that is not on the NdisMiniDriverList.
Address of the MiniBlock The MiniBlock's reference count 0 0 NdisMUnload: MiniBlock is getting unloaded but it is still on NdisMiniDriverList.
Address of the miniport block Memory page Wrapper context Address of shared memory signature Overwrote past allocated shared memory. The address being written to is not located in NDIS shared memory.

In the following instances of this bug check, the meaning of the parameters depends on the message and on the value of Parameter 4.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Message and Cause
Address of the miniport block Address of the miniport interrupt Address of the miniport timer queue 1 Unloading without deregistering interrupt. A miniport driver failed its initialization without deregistering its interrupt.
Address of the miniport block Address of the miniport timer queue Address of the miniport interrupt 2 Unloading without deregistering interrupt. A miniport driver did not deregister its interrupt during the halt process.
Address of the miniport block Address of the miniport interrupt Address of the miniport timer queue 1 Unloading without deregistering timer. A miniport driver failed its initialization without successfully canceling all its timers.
Address of the miniport block Address of the miniport timer queue Address of the miniport interrupt 2 Unloading without deregistering timer. A miniport driver halted without successfully canceling all its timers.

Comments

This bug check code only occurs on Windows 2000 and Windows XP. In Windows Server 2003 and later, the corresponding code is bug check 0x7C (BUGCODE_NDIS_DRIVER).

On the checked build of Windows, only the Allocating Shared Memory at Raised IRQL and Completing Reset When One is Not Pending instances of this bug check can occur. All the other instances of bug check 0xD2 are replaced with ASSERTs. See Breaking Into the Debugger for details.

    WinDbg Output Example:
Unknown bugcheck code (d2)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000D3: DRIVER_PORTION_MUST_BE_NONPAGED    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560252(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DRIVER_PORTION_MUST_BE_NONPAGED bug check has a value of 0x000000D3. This indicates that the system attempted to access pageable memory at a process IRQL that was too high.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 IRQL at time of reference
3 0: Read

1: Write

4 Address that referenced memory

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

This bug check is usually caused by drivers that have incorrectly marked their own code or data as pageable.

Resolving the Problem

To begin debugging, use a kernel debugger to get a stack trace.

    WinDbg Output Example:
DRIVER_PORTION_MUST_BE_NONPAGED (d3)
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers marking code or data as pageable when it should be
marked nonpaged.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff960002f7124, memory referenced
Arg2: 000000000000000c, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8000227215e, address which referenced memory




STOP 0x000000D4: SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560256(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD bug check has a value of 0x000000D4. This indicates that a driver did not cancel pending operations before unloading.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 IRQL at time of reference
3 0: Read

1: Write

4 Address that referenced memory

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

This driver failed to cancel lookaside lists, DPCs, worker threads, or other such items before unload. Subsequently, the system attempted to access the driver's former location at a raised IRQL.

Resolving the Problem

To begin debugging, use a kernel debugger to get a stack trace. If the driver that caused the error has been identified, activate Driver Verifier and attempt to replicate this bug.

For full details on Driver Verifier, see the Windows Driver Kit.

    WinDbg Output Example:
SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD (d4)
A driver unloaded without cancelling lookaside lists, DPCs, worker threads, etc.
The broken driver's name is displayed on the screen.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
An attempt was made to access the driver at raised IRQL after it unloaded.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory


STOP 0x000000D5: DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560263(v=VS.85).aspx
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/08/26/debugging-stop-0xd5-driver_page_fault_in_freed_special_pool/

    Knowledge Base Articles:
KB 289726    Stop 0x000000D5 Error While Adding IP Addresses to NIC by Using AddIPAddress() Function (2000 Server)
KB 828146    You receive a "stop: 0x000000d5 (fatal system error)" error message when you try to view private characters in Windows 2000
KB 870896    You receive a "STOP: 0x000000D5" error message when you close an IP Phone connection on a Windows XP Service Pack 2-based Toshiba computer or on a Windows XP Tablet PC Edition 2005-based Tablet PC
KB 911028    When you use a 32-bit program to print a document from a 64-bit version of Microsoft Windows, you may receive a Stop error message, or objects on the page are omitted (XP, Server 2003)
KB 935198    The computer restarts automatically when you add a monitor to a Windows-XP based computer
KB 954956    You may encounter a Stop error on a Windows XP-based computer when you heavily use the Server Message Block (SMB) redirector component
KB 958819    Error message when you press the power button to turn off a Windows XP-based computer: "STOP: 0x000000D5"
KB 973295    A multiprocessor computer that is running Windows Server 2003 SP2 stops responding under a heavy load if you change a Windows Firewall setting
KB 980226    "STOP: 0X000000D5" error message on a computer that is running Windows Vista, Windows 7, Windows Server 2008, or Windows Server 2008 R2
KB 2521624    "0x000000D5" Stop error message when you run an automated test job in Windows 7 or in Windows Server 2008 R2
KB 2606025    "0x000000D5" Stop error on a failover cluster node that has special pool enabled and that is running Windows Server 2008 R2
KB 2719704    "0x0000003B" or "0x000000D5" Stop error in Windows 7 or in Windows Server 2008 R2
KB 2902124    Stop error 0x50 occurs in Ndis.sys on a Windows 8-based or Windows Server 2012-based computer (0xD5 when running Verifier)

    WinDbg Help File Entry:

The DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL bug check has a value of 0x000000D5. This indicates that a driver has referenced memory which was earlier freed.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read

1: Write

3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

The Driver Verifier Special Pool option has caught the driver accessing memory which was earlier freed.

For information about the special pool, consult the Driver Verifier section of the Windows Driver Kit.

Comments

This cannot be protected by a try - except handler — it can only be protected by a probe.

    WinDbg Output Example:
DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL (d5)
Memory was referenced after it was freed.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: 0000000000000000, if non-zero, the address which referenced memory.
Arg4: 0000000000000000, (reserved)


STOP 0x000000D6: DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560267(v=VS.85).aspx

    Knowledge Base Articles:
KB 228440    STOP 0x000000d6 with Xircom CEM56-100 (2000)
KB 285799    Pool Damage from Ntfs.sys When Quotas Are Used on a Mounted Volume (2000 Server)
KB 326864    STOP: 0x000000D6 Error in Win32k.sys Occurs in Windows 2000
KB 826117    "Stop 0x000000D6" error in File and Print Services for NetWare (2000)
KB 912229    You may receive a Stop error when you scan for hardware changes after a snapshot of a LUN is created in Windows Server 2003
KB 931479    The print server experiences a Stop error when you use the Point and Print feature to print to a shared printer in Windows Vista (XP, Server 2003)
KB 935198    The computer restarts automatically when you add a monitor to a Windows-XP based computer
KB 935920    When the Emulex Elxsli2.sys driver is installed, you may receive a Stop error message after you upgrade your computer to Windows Server 2003 Service Pack 1
KB 949764    A USB device no longer works after you resume a Windows XP-based computer from hibernation (S4)

    WinDbg Help File Entry:

The DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION bug check has a value of 0x000000D6. This indicates the driver accessed memory beyond the end of its pool allocation.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read

1: Write

3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

The driver allocated n bytes of memory and then referenced more than n bytes. The Driver Verifier Special Pool option detected this violation.

For information about the special pool, consult the Driver Verifier section of the Windows Driver Kit.

Comments

This cannot be protected by a try - except handler — it can only be protected by a probe.

    WinDbg Output Example:
DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION (d6)
N bytes of memory was allocated and more than N bytes are being referenced.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: 0000000000000000, if non-zero, the address which referenced memory.
Arg4: 0000000000000000, (reserved)


STOP 0x000000D7: DRIVER_UNMAPPING_INVALID_VIEW    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560269(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DRIVER_UNMAPPING_INVALID_VIEW bug check has a value of 0x000000D7. This indicates a driver is trying to unmap an address that was not mapped.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Virtual address to unmap
2 1: The view is being unmapped

2: The view is being committed

3 0
4 0

Comments

The driver that caused the error can be determined from the stack trace.

    WinDbg Output Example:
DRIVER_UNMAPPING_INVALID_VIEW (d7)
A driver (usually win32k.sys, but can be determined from the stack trace for
certain) is trying to unmap an address that was not mapped.
Arguments:
Arg1: 0000000000000000, virtual address to unmap.
Arg2: 0000000000000000, 1 if the view is being unmapped, 2 if the view is being committed.
Arg3: 0000000000000000, 0.
Arg4: 0000000000000000, 0


STOP 0x000000D8: DRIVER_USED_EXCESSIVE_PTES    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560271(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xd8

    Knowledge Base Articles:
KB 256004    How to troubleshoot "STOP 0x0000003F" and "STOP 0x000000D8" error messages in Windows Server 2003, Windows XP, and Windows 2000
KB 294301    How to troubleshoot fatal system errors in Access 2002 running on Microsoft Windows 2000
KB 311551    "STOP 0x000000D8 DRIVER_USED_EXCESSIVE_PTES" Error Message on Server with Heavy I/O Load (2000 Server)
KB 955033    Stop 0x0000003F or STOP 0x000000D8 occurs on Windows Server 2003 computer with Veritas Backup installed

    WinDbg Help File Entry:

The DRIVER_USED_EXCESSIVE_PTES bug check has a value of 0x000000D8. This indicates that there are no more system page table entries (PTE) remaining.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Pointer to the name of the driver that caused the error (Unicode string), or zero
2 Number of PTEs used by the driver that caused the error (if Parameter 1 is nonzero)
3 Total free system PTEs
4 Total system PTEs

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

This is usually caused by a driver not cleaning up its memory use properly. Parameter 1 shows the driver which has consumed the most PTEs. The call stack will reveal which driver actually caused the bug check.

Resolving the Problem

Both drivers may need to be fixed. The total number of system PTEs may also need to be increased.

    WinDbg Output Example:
DRIVER_USED_EXCESSIVE_PTES (d8)
No System PTEs left.  Usually caused by a driver not cleaning up
properly.  If non-null, Parameter 1 shows the name of the driver
who is consuming the most PTEs.  The calling stack also shows the name of
the driver which bugchecked.  Both drivers need to be fixed and/or the number
of PTEs increased.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 0000000000000000, If non-null, the guilty driver's name (Unicode string).
Arg2: 0000000000000000, If parameter 1 non-null, the number of PTEs used by the guilty driver.
Arg3: 0000000000000000, Total free system PTEs
Arg4: 0000000000000000, Total system PTEs


STOP 0x000000D9: LOCKED_PAGES_TRACKER_CORRUPTION    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560277(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The LOCKED_PAGES_TRACKER_CORRUPTION bug check has a value of 0x000000D9. This indicates that the internal locked-page tracking structures have been corrupted.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x01 The address of the internal lock tracking structure The address of the memory descriptor list The number of pages locked for the current process The MDL is being inserted twice on the same process list.
0x02 The address of the internal lock tracking structure The address of the memory descriptor list The number of pages locked for the current process The MDL is being inserted twice on the systemwide list.
0x03 The address of the first internal tracking structure found The address of the internal lock tracking structure The address of the memory descriptor list The MDL was found twice in the process list when being freed.
0x04 The address of the internal lock tracking structure The address of the memory descriptor list 0 The MDL was found in the systemwide list on free after it was removed.

Cause

The error is indicated by the value of Parameter 1.

    WinDbg Output Example:
LOCKED_PAGES_TRACKER_CORRUPTION (d9)
Arguments:
Arg1: 0000000000000000, Type of error.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000DA: SYSTEM_PTE_MISUSE    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560282(v=VS.85).aspx

    Knowledge Base Articles:
KB 819636    A computer that has multiple SCSI controllers and a /3GB Boot.ini option stops responding with a SYSTEM_PTE_MISUSE (0x000000DA) stop error (2000, XP)
KB 831899    You receive a "stop 0x000000DA" error message on a blue screen after you enable PTE tracking on a Windows Server 2003-based node
KB 837339    "Stop 0x000000DA" error occurs on a host computer after you start a virtual machine in Virtual PC 2004

    WinDbg Help File Entry:

The SYSTEM_PTE_MISUSE bug check has a value of 0x000000DA. This indicates that a page table entry (PTE) routine has been used in an improper way.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x01 The address of the internal lock tracking structure The address of the memory descriptor list The address of the duplicate internal lock tracking structure The mapping being freed is a duplicate.
0x02 The address of the internal lock tracking structure The number of mappings that the system expects to free The number of mappings that the driver is requesting to free The number of mappings being freed is incorrect.
0x03 The address of the first internal tracking structure found The mapping address that the system expects to free The mapping address that the driver is requesting to free The mapping address being freed is incorrect.
0x04 The address of the internal lock tracking structure The page frame number that the system expects should be first in the MDL The page frame number that is currently first in the MDL The first page of the mapped MDL has changed since the MDL was mapped.
0x05 The address of the first internal tracking structure found The virtual address that the system expects to free The virtual address that the driver is requesting to free The start virtual address in the MDL being freed has changed since the MDL was mapped.
0x06 The MDL specified by the driver The virtual address specified by the driver The number of mappings to free (specified by the driver) The MDL being freed was never (or is currently not) mapped.
0x07 The initial mapping The number of mappings Reserved (Windows 2000 only) The mapping range is being double-allocated.
0x08 The initial mapping The number of mappings the caller is freeing The number of mappings the system thinks should be freed (Windows 2000 only) The caller is asking to free an incorrect number of mappings.
0x09 The initial mapping The number of mappings that the caller is freeing The mapping index that the system thinks is already free (Windows 2000 only) The caller is asking to free several mappings, but at least one of them is not allocated.
0x0A 1: The driver requested "bug check on failure" in the MDL.

0: The driver did not request "bug check on failure" in the MDL.

The number of mappings that the caller is allocating The type of mapping pool requested (Windows 2000 only) The caller is asking to allocate zero mappings.
0x0B The corrupt mapping The number of mappings that the caller is allocating The type of mapping pool requested (Windows 2000 only) The mapping list was already corrupt at the time of this allocation. The corrupt mapping is located below the lowest possible mapping address.
0x0C The corrupt mapping The number of mappings that the caller is allocating The type of mapping pool requested (Windows 2000 only) The mapping list was already corrupt at the time of this allocation. The corrupt mapping is located above the lowest possible mapping address.
0x0D The initial mapping The number of mappings that the caller is freeing The type of mapping pool (Windows 2000 only) The caller is trying to free zero mappings.
0x0E The initial mapping The number of mappings that the caller is freeing The type of mapping pool (Windows 2000 only) The caller is trying to free mappings, but the guard mapping has been overwritten.
0x0F The non-existent mapping The number of mappings that the caller is trying to free The type of mapping pool being freed (Windows 2000 only) The caller is trying to free a non-existent mapping. The non-existent mapping is located below the lowest possible mapping address.
0x10 The non-existent mapping The number of mappings the caller is trying to free The type of mapping pool being freed (Windows 2000 only) The caller is trying to free a non-existent mapping. The non-existent mapping is located above the highest possible mapping address.
0x11 The non-existent mapping The number of mappings that the caller is trying to free The type of mapping pool being freed (Windows 2000 only) The caller is trying to free a non-existent mapping. The non-existent mapping is at the base of the mapping address space.
0x100 The number of mappings being requested The caller's identifying tag The address of the routine that called the caller of this routine (Windows XP and later only) The caller requested 0 mappings.
0x101 The first mapping address The caller's identifying tag The owner's identifying tag (Windows XP and later only) A caller is trying to free a mapping address range that it does not own.
0x102 The first mapping address The caller's identifying tag Reserved (Windows XP and later only) The mapping address space that the caller is trying to free is apparently empty.
0x103 The address of the invalid mapping The caller's identifying tag The number of mappings in the mapping address space (Windows XP and later only) The mapping address space that the caller is trying to free is still reserved. MmUnmapReservedMapping

must be called before MmFreeMappingAddress.

0x104 The first mapping address The caller's identifying tag The owner's identifying tag (Windows XP and later only) The caller is attempting to map an MDL to a mapping address space that it does not own.
0x105 The first mapping address The caller's identifying tag Reserved (Windows XP and later only) The caller is attempting to map an MDL to an invalid mapping address space. The caller has mostly likely specified an invalid address.
0x107 The first mapping address The address of the non-empty mapping The last mapping address (Windows XP and later only) The caller is attempting to map an MDL to a mapping address space that has not been properly reserved. The caller should have called MmUnmapReservedMapping prior to calling MmMapLockedPagesWithReservedMapping
0x108 The first mapping address The caller's identifying tag The owner's identifying tag (Windows XP and later only) The caller is attempting to unmap a locked mapping address space that it does not own.
0x109 The first mapping address The caller's identifying tag Reserved (Windows XP and later only) The caller is attempting to unmap a locked virtual address space that is apparently empty.
0x10A The first mapping address The number of mappings in the locked mapping address space The number of mappings to unmap (Windows XP and later only) The caller is attempting to unmap more mappings than actually exist in the locked mapping address space.
0x10B The first mapping address The caller's identifying tag The number of mappings to unmap (Windows XP and later only) The caller is attempting to unmap a portion of a locked virtual address space that is not currently mapped.
0x10C The first mapping address The caller's identifying tag The number of mappings to unmap (Windows XP and later only) The caller is not unmapping the entirety of the locked mapping address space.
0x200 The first mapping address 0 0 (Windows XP and later only) The caller is attempting to reserve a mapping address space that contains no mappings.
0x201
0x202
The first mapping address to reserve The address of the mapping that has already been reserved The number of mappings to reserve (Windows XP and later only) One of the mappings that the caller is attempting to reserve has already been reserved.
0x300 The first mapping address to release 0 0 (Windows XP and later only) The caller is attempting to release a mapping address space that contains no mappings.
0x301 The address of the mapping 0 0 (Windows XP and later only) The caller is attempting to release a mapping that it is not permitted to release.
0x303 The first mapping address The number of mappings to release 0 (Windows XP and later only) The caller is attempting to release a mapping address range that was not reserved.
0x304 The first mapping address The number of mappings to release 0 (Windows XP and later only) The caller is attempting to release a mapping address range that begins in the middle of a different allocation.
0x305 The first mapping address The number of mappings that the caller is trying to release The number of mappings that should be released (Windows XP and later only) The caller is attempting to release the wrong number of mappings.
0x306 The first mapping address The free mapping address The number of mappings to release (Windows XP and later only) One of the mappings that the caller is attempting to release is already free.
0x400 The base address of the I/O space mapping The number of pages to be freed 0 (Windows XP and later only) The caller is trying to free an I/O space mapping that the system is unaware of.

Cause

The error is indicated by the value of Parameter 1.

A stack trace will identify the driver that caused the error.

    WinDbg Output Example:
SYSTEM_PTE_MISUSE (da)
The stack trace identifies the guilty driver.
Arguments:
Arg1: 0000000000000000, Type of error.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000DB: DRIVER_CORRUPTED_SYSPTES    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560286(v=VS.85).aspx

    Knowledge Base Articles:
KB 907353    You receive a Stop error message when you use a hardware device on a computer that is running Windows 2000

    WinDbg Help File Entry:

The DRIVER_CORRUPTED_SYSPTES bug check has a value of 0x000000DB. This indicates that an attempt was made to touch memory at an invalid IRQL, probably due to corruption of system PTEs.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 IRQL
3 0: Read

1: Write

4 Address in code which referenced memory

Cause

A driver tried to access pageable (or completely invalid) memory at too high of an IRQL. This bug check is almost always caused by drivers that have corrupted system PTEs.

Resolving the Problem

If this bug check occurs, the culprit can be detected by editing the registry. In the \\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management registry key, create or edit the TrackPtes value, and set it equal to DWORD 3. Then reboot. The system will then save stack traces, and if the driver commits the same error, the system will issue bug check 0xDA (SYSTEM_PTE_MISUSE). Then the stack trace will identify the driver that caused the error.

    WinDbg Output Example:
DRIVER_CORRUPTED_SYSPTES (db)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted system PTEs.  Set
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\TrackPtes
to a DWORD 3 value and reboot.  Then the system will save stack traces and
perform validity checks so the guilty driver can be identified.
There is no other way to find out which driver did this.  When you enable
this flag, if the driver commits the error again you will see a different
bugcheck - SYSTEM_PTE_MISUSE - and the stack trace will identify the offending
driver(s).
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory


STOP 0x000000DC: DRIVER_INVALID_STACK_ACCESS    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560293(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DRIVER_INVALID_STACK_ACCESS bug check has a value of 0x000000DC. This indicates that a driver accessed a stack address that lies below the stack pointer of the stack's thread.

Parameters

None

    WinDbg Output Example:
DRIVER_INVALID_STACK_ACCESS (dc)
A driver accessed a stack address that lies below the stack pointer of the
stack's thread.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000DD:  ???BIOS IS NOT ACPI COMPLIANT???    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (dd)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000DE: POOL_CORRUPTION_IN_FILE_AREA    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560303(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The POOL_CORRUPTION_IN_FILE_AREA bug check has a value of 0x000000DE. This indicates that a driver has corrupted pool memory that is used for holding pages destined for disk.

Parameters

None

Cause

When the Memory Manager dereferenced the file, it discovered this corruption in pool memory.

    WinDbg Output Example:
POOL_CORRUPTION_IN_FILE_AREA (de)
A driver corrupted pool memory used for holding pages destined for disk.
This was discovered by the memory manager when dereferencing the file.
Arguments:
Arg1: 00000002
Arg2: 891669b8
Arg3: 9f27be68
Arg4: 7d1428c0


STOP 0x000000DF: IMPERSONATING_WORKER_THREAD    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560308(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The IMPERSONATING_WORKER_THREAD bug check has a value of 0x000000DF. This indicates that a workitem did not disable impersonation before it completed.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The worker routine that caused this error
2 The parameter passed to this worker routine
3 A pointer to the work item
4 Reserved

Cause

A worker thread was impersonating another process, and failed to disable impersonation before it returned.

    WinDbg Output Example:
IMPERSONATING_WORKER_THREAD (df)
A workitem forgot to disable impersonation before it completed.
Arguments:
Arg1: 0000000000000000, Worker Routine that caused this bugcheck.
Arg2: 0000000000000000, Parameter passed to this worker routine.
Arg3: 0000000000000000, Pointer to the Workitem.
Arg4: 0000000000000000


STOP 0x000000E0: ACPI_BIOS_FATAL_ERROR    (go to top of page)

Usual causes:  BIOS, Faulty hardware

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560314(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The ACPI_BIOS_FATAL_ERROR bug check has a value of 0x000000E0. This indicates that one of your computer components is faulty.

Parameters

The parameters for this bug check are issued by the BIOS, not by Windows. They can only be interpreted by the hardware vendor.

Cause

Your computer's BIOS has reported that a component in the system is so faulty that there is no way for Windows to operate. The BIOS is indicating that there is no alternative but to issue a bug check.

Resolving the Problem

You can determine which component is faulty by running the diagnostic disk or tool that was included with your computer.

If you do not have this tool, you must contact the system vendor and report this error message to them. They will be able to help you correct this hardware problem. This enables Windows to operate.

Microsoft cannot address this error. Only the hardware vendor is qualified to analyze it.

    WinDbg Output Example:
ACPI_BIOS_FATAL_ERROR (e0)
Your computer (BIOS) has reported that a component in your system is too faulty
for Windows to be able to run.
You can determine which component is faulty by running the diagnostic disk or
tool that came with your computer.
If you do not have this tool, you must contact your system vendor and report
this error message to them.  They will be able to assist you in correcting this
hardware problem, thereby allowing Windows to operate.  Microsoft cannot assist
in the debugging of this problem -- only the hardware vendor can interpret the
bug check parameters and debug this error.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000E1: WORKER_THREAD_RETURNED_AT_BAD_IRQL    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560322(v=VS.85).aspx

    Knowledge Base Articles:
KB 953828    Windows Server 2008 Hyper-V virtual machines generate a Stop error when NLB is configured or when the NLB cluster does not converge as expected

    WinDbg Help File Entry:

The WORKER_THREAD_RETURNED_AT_BAD_IRQL bug check has a value of 0x000000E1. This indicates that a worker thread completed and returned with IRQL >= DISPATCH_LEVEL.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Address of the worker routine
2 IRQL that the worker thread returned at
3 Work item parameter
4 Work item address

Cause

A worker thread completed and returned with IRQL >= DISPATCH_LEVEL.

Resolving the Problem

To find the driver that caused the error, use the ln (List Nearest Symbols) debugger command:

kd> ln address

where address is the worker routine address given in Parameter 1.

    WinDbg Output Example:
WORKER_THREAD_RETURNED_AT_BAD_IRQL (e1)
Arguments:
Arg1: 0000000000000000, address of worker routine (do ln on this to find guilty driver)
Arg2: 0000000000000000, IRQL returned at (should have been 0, but isn't).
Arg3: 0000000000000000, workitem parameter
Arg4: 0000000000000000, workitem address


STOP 0x000000E2: MANUALLY_INITIATED_CRASH    (go to top of page)

Usual causes:  User initiated crash dump

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560324(v=VS.85).aspx

    Knowledge Base Articles:
KB 244139    Windows feature lets you generate a memory dump file by using the keyboard (Server 2003/Vista SP1/Server 2008)
KB 273636    "STOP 0x000000E2" Error Message Occurs on a Blue Screen (2000)
KB 971284    A hotfix is available to enable CrashOnCtrlScroll support for a USB keyboard on a computer that is running Windows Vista SP1 or Windows Server 2008

    WinDbg Help File Entry:

The MANUALLY_INITIATED_CRASH bug check has a value of 0x000000E2. This indicates that the user deliberately initiated a crash dump from either the kernel debugger or the keyboard.

Parameters

None

Comments

For more information about manually-initiated crash dumps, see Forcing a System Crash.

    WinDbg Output Example:
MANUALLY_INITIATED_CRASH (e2)
The user manually initiated this crash dump.
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000


STOP 0x000000E3: RESOURCE_NOT_OWNED    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560330(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xe3
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/07/30/debugging-stop-0xe3-with-thread/

    Knowledge Base Articles:
KB 329868    Error Message: Stop 0x000000E3 RESOURCE_NOT_OWNED (2000 Server)
KB 810038    Stop 0x000000E3 error occurs when redirector thread tries to release a lock (2000)
KB 899325    You receive a Stop error message during a heavy I/O load on a Windows Server 2003-based computer
KB 900808    You receive a "STOP: 0x000000E3" error message when you safely remove an encrypted USB storage device from a computer that is running Windows XP Service Pack 2
KB 951250    Error message when Symantec Endpoint Protection MR2 quarantines a file in Windows Vista or in Windows Server 2008: "Stop 0x000000E3"
KB 951580    You receive a "Stop 0x000000E3" error message when Symantec Endpoint Protection MR2 quarantines a file in Windows Vista or in Windows Server 2008
KB 977426    Error message on a blue screen when encryption software is installed on a computer that is running Windows Vista or Windows Server 2008: "STOP: 0x000000E3"
KB 2735209    "0x000000E3" Stop error occurs when you try to restart a Windows 7-based or Windows Server 2008 R2-based computer

    WinDbg Help File Entry:

The RESOURCE_NOT_OWNED bug check has a value of 0x000000E3. This indicates that a thread tried to release a resource it did not own.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Address of resource
2 Address of thread
3 Address of owner table (if it exists)
4 Reserved

    WinDbg Output Example:
RESOURCE_NOT_OWNED (e3)
A thread tried to release a resource it did not own.
Arguments:
Arg1: 92bf12c0, Address of resource
Arg2: 8f9d07f8, Address of thread
Arg3: 00000000, Address of owner table if there is one
Arg4: 00000002



STOP 0x000000E4: WORKER_INVALID    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560336(v=VS.85).aspx

    Knowledge Base Articles:
KB 945577    Error message when a portable Windows Vista-based computer that has an integrated or external USB camera device resumes from long-term suspend mode: "0x000000E4" or "0x0000000A"
KB 954029    Stop error when you resume a Windows Vista-based computer that is connected to a USB optical disc drive from standby "STOP: 0x000000E4" or "STOP: 0x0000000A"

    WinDbg Help File Entry:

The WORKER_INVALID bug check has a value of 0x000000E4. This indicates that memory that should not contain an executive worker item does contain such an item, or that a currently active worker item was queued.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 indicates the code position.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x0 Address of worker item Start of pool block End of pool block An active worker item was freed.
0x1 Address of worker item Queue number 0 An active worker item was queued.
0x2 Address of worker item Address of I/O worker routine 0 A queued I/O worker item was freed.
0x3 Address of worker item Address of invalid object 0 An attempt was made to initialize an I/O worker item with an invalid object.

Cause

This is usually caused by a driver freeing memory which still contains an executive worker item.

    WinDbg Output Example:
WORKER_INVALID (e4)
A executive worker item was found in memory which must not contain such
items or a work item was queued that is currently active in the system.
Usually this is memory being freed.  This is usually caused by
a device driver that has not cleaned up properly before freeing memory.
Arguments:
Arg1: 0000000000000000, Free of active worker item
Arg2: 0000000000000000, Address of worker item
Arg3: 0000000000000000, Start of pool block
Arg4: 0000000000000000, End of pool block


STOP 0x000000E5: POWER_FAILURE_SIMULATE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (e5)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000E6: DRIVER_VERIFIER_DMA_VIOLATION    (go to top of page)

Usual causes:  Driver verifier

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560341(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DRIVER_VERIFIER_DMA_VIOLATION bug check has a value of 0x000000E6. This is the bug check code for all Driver Verifier DMA Verification violations.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 is the only parameter of interest. This parameter identifies the exact violation. If a debugger is attached, an informative message is displayed in the debugger.

Parameter 1 Cause of Error and Debugger Message
0x00 This code can represent two kinds of errors:

1. The driver tried to flush too many bytes to the end of the map register file. The number of bytes permitted and the number of bytes attempted are displayed.

2. Windows has run out of contiguous map registers. The number of map registers needed and the largest block of contiguous map registers is displayed.

0x01 The performance counter has decreased. The old and new values of the counter are displayed.
0x02 The performance counter has increased too fast. The counter value is displayed in the debugger.
0x03 The driver freed too many DMA common buffers. Usually this means it freed the same buffer two times.
0x04 The driver freed too many DMA adapter channels. Usually this means it freed the same adapter channel two times.
0x05 The driver freed too many DMA map registers. Usually this means it freed the same map register two times. The number of active map registers is displayed.
0x06 The driver freed too many DMA scatter/gather lists. Usually this means it freed the same scatter/gather list two times. The number of lists allocated and the number of lists freed is displayed.
0x07 The driver tried to release the adapter without first freeing all its common buffers. The adapter address and the number of remaining buffers is displayed.
0x08 The driver tried to release the adapter without first freeing all adapter channels, common buffers, or scatter/gather lists. The adapter address and the number of remaining items is displayed.
0x09 The driver tried to release the adapter without first freeing all map registers. The adapter address and the number of remaining map registers is displayed.
0x0A The driver tried to release the adapter without first freeing all its scatter/gather lists. The adapter address and the number of remaining scatter/gather lists is displayed.
0x0B HV_TOO_MANY_ADAPTER_CHANNELSThe driver has allocated too many adapter channels at the same time. . (Only one adapter channel is permitted per adapter.)
0x0C The driver tried to allocate too many map registers at the same time. The number requested and the number allowed are displayed.
0x0D The driver did not flush its adapter buffers. The number of bytes that the driver tried to map and the maximum number of bytes allowed are displayed.
0x0E The driver tried a DMA transfer without locking the buffer. The buffer in question was in paged memory. The address of the MDL is displayed.
0x0F The driver or the hardware wrote outside its allocated DMA buffer. The nature of the error (overrun or underrun) is displayed, as well as the relevant addresses.
0x10 The driver tried to free its map registers while some were still mapped. The number of map registers still mapped is displayed.
0x11 The driver has too many outstanding reference counts for the adapter. The number of reference counts and the adapter address are displayed.
0x13 The driver called a DMA routine at an improper IRQL. The required IRQL and the actual IRQL are displayed.
0x14 The driver called a DMA routine at an improper IRQL. The required IRQL and the actual IRQL are displayed.
0x15 The driver tried to allocate too many map registers. The number requested and the number allowed are displayed.
0x16 The driver tried to flush a buffer that is not mapped. The address of the buffer is displayed.
0x18 The driver tried a DMA operation by using an adapter that was already released and no longer exists. The adapter address is displayed.
0x19 The driver passed a null DMA_ADAPTER value to a HAL routine.
0x1B The driver passed an address and MDL to a HAL routine. However, this address is not within the bounds of this MDL. The address passed and the address of the MDL are displayed.
0x1D The driver tried to map an address range that was already mapped. The address range and the current mapping for that range are displayed.
0x1E The driver called HalGetAdapter. This function is obsolete — you must use IoGetDmaAdapter instead.
0x1F HV_BAD_MDLThe driver referenced an invalid system address — either before the first MDL, or after the end of the first MDL, or by using a transfer length that is longer than the MDL buffer and crosses a page boundary within the MDL. . Either the invalid address and the first MDL address, or the MDL address and the extra transfer length are displayed.
0x20 The driver tried to flush a map register that hasn't been mapped. The map register base, flushing address, and MDL are displayed.
0x21 The driver tried to map a zero-length buffer for transfer.

Cause

See the description of each code in the Parameters section for a description of the cause.

Resolving the Problem

This bug check can only occur when Driver Verifier has been instructed to monitor one or more drivers. If you did not intend to use Driver Verifier, you should deactivate it. You might also consider removing the driver that caused this problem.

If you are the driver writer, use the information obtained through this bug check to fix the bugs in your code.

The Driver Verifier DMA Verification option is only available in Windows XP and later versions. For full details on Driver Verifier, see the Windows Driver Kit.

    WinDbg Output Example:
DRIVER_VERIFIER_DMA_VIOLATION (e6)
An illegal DMA operation was attempted by a driver being verified.
Arguments:
Arg1: 0000000f, Boundary overrun. Driver or DMA hardware has
    written outside of its allocation.
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000


STOP 0x000000E7: INVALID_FLOATING_POINT_STATE    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560344(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INVALID_FLOATING_POINT_STATE bug check has a value of 0x000000E7. This indicates that a thread's saved floating-point state is invalid.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 indicates which validity check failed. Parameter 4 is not used. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Cause of Error
0x0 The flags field 0 The saved context flags field is invalid. Either FLOAT_SAVE_VALID is not set, or some reserved bits are nonzero.
0x1 The saved IRQL The current IRQL The current processor's IRQL is not the same as when the floating-point context was saved.
0x2 The saved address of the thread that owns this floating-point context The current thread The saved context does not belong to the current thread.

Cause

While restoring the previously-saved floating-point state for a thread, the state was found to be invalid.

Parameter 1 indicates which validity check failed.

    WinDbg Output Example:
INVALID_FLOATING_POINT_STATE (e7)
While restoring the previously saved floating point state for a thread,
the state was found to be invalid.  The first argument indicates which
validity check failed.
Arguments:
Arg1: 0000000000000000, Saved context flags field is invalid, either FLOAT_SAVE_VALID
    is not set or some of the reserved bits are non-zero.  Second
    argument is the flags field.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000E8: INVALID_CANCEL_OF_FILE_OPEN    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560347(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INVALID_CANCEL_OF_FILE_OPEN bug check has a value of 0x000000E8. This indicates that an invalid file object was passed to IoCancelFileOpen.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The file object passed to IoCancelFileOpen
2 The device object passed to IoCancelFileOpen
3 Reserved
4 Reserved

Cause

The file object passed to IoCancelFileOpen is invalid. It should have reference of one. The driver that called IoCancelFileOpen is at fault.

    WinDbg Output Example:
INVALID_CANCEL_OF_FILE_OPEN (e8)
The fileobject passed to IoCancelFileOpen is invalid. It should have reference
of 1. The driver that called IoCancelFileOpen is at fault.
Arguments:
Arg1: 0000000000000000, FileObject passed to IoCancelFileOpen
Arg2: 0000000000000000, DeviceObject passed to IoCancelFileOpen
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000E9: ACTIVE_EX_WORKER_THREAD_TERMINATION    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560349(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The ACTIVE_EX_WORKER_THREAD_TERMINATION bug check has a value of 0x000000E9. This indicates that an active executive worker thread is being terminated.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The exiting ETHREAD
2 Reserved
3 Reserved
4 Reserved

Cause

An executive worker thread is being terminated without having gone through the worker thread rundown code. This is forbidden; work items queued to the ExWorkerQueue must not terminate their threads.

A stack trace should indicate the cause.

    WinDbg Output Example:
ACTIVE_EX_WORKER_THREAD_TERMINATION (e9)
An executive worker thread is being terminated without having gone through
the worker thread rundown code.  A stack trace should indicate the cause.
Arguments:
Arg1: 0000000000000000, The exiting ETHREAD.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000EA: THREAD_STUCK_IN_DEVICE_DRIVER    (go to top of page)

Usual causes:  Device driver, Faulty hardware

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560350(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xea

    Knowledge Base Articles:
                       Troubleshooting specific Stop messages
KB 293078    Error message in Windows XP: "STOP 0x000000EA THREAD_STUCK_IN_DEVICE_DRIVER"
KB 314215    "Stop 0x000000EA" Error Message When You Run Video-Intensive Programs (XP)

    WinDbg Help File Entry:

The THREAD_STUCK_IN_DEVICE_DRIVER bug check has a value of 0x000000EA. This indicates that a thread in a device driver is endlessly spinning.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 A pointer to the stuck thread object
2 A pointer to the DEFERRED_WATCHDOG object
3 A pointer to the offending driver name
4 In the kernel debugger: The number of times the "intercepted" bug check 0xEA was hit

On the blue screen: 1


Cause

A device driver is spinning in an infinite loop, most likely waiting for hardware to become idle.

This usually indicates problem with the hardware itself, or with the device driver programming the hardware incorrectly. Frequently, this is the result of a bad video card or a bad display driver.

Resolving the Problem

Use the .thread (Set Register Context) command together with Parameter 1. Then use kb (Display Stack Backtrace) to find the location where the thread is stuck.

If the kernel debugger is already connected and running when Windows detects a time-out condition. Then DbgBreakPoint will be called instead of KeBugCheckEx. A detailed message will be printed to the debugger. See Sending Output to the Debuggefor more information.

This message will include what would have been the bug check parameters. Because no actual bug check was issued, the .bugcheck (Display Bug Check Data) command will not be useful. The four parameters can also be retrieved from Watchdog's global variables by using dd watchdog!g_WdBugCheckData L5" on a 32-bit system, or dq watchdog!g_WdBugCheckData L5" on a 64-bit system.

Debugging this error in an interactive manner such as this will enable you to find an offending thread, set breakpoints in it, and then use g (Go) to return to the spinning code to debug it further.

On multiprocessor machines (OS build 3790 or earlier), you can hit a time out if the spinning thread is interrupted by a hardware interrupt and an ISR or DPC routine is running at the time of the bug check. This is because the time out's work item can be delivered and handled on the second CPU and the same time. If this occurs, you must look deeper at the offending thread's stack to determine the spinning code which caused the time out to occur. Use the dds (Display Words and Symbols) command to do this.

    WinDbg Output Example:
THREAD_STUCK_IN_DEVICE_DRIVER (ea)
The device driver is spinning in an infinite loop, most likely waiting for
hardware to become idle. This usually indicates problem with the hardware
itself or with the device driver programming the hardware incorrectly.
If the kernel debugger is connected and running when watchdog detects a
timeout condition then DbgBreakPoint() will be called instead of KeBugCheckEx()
and detailed message including bugcheck arguments will be printed to the
debugger. This way we can identify an offending thread, set breakpoints in it,
and hit go to return to the spinning code to debug it further. Because
KeBugCheckEx() is not called the .bugcheck directive will not return bugcheck
information in this case. The arguments are already printed out to the kernel
debugger. You can also retrieve them from a global variable via
"dd watchdog!g_WdBugCheckData l5" (use dq on NT64).
On MP machines (OS builds <= 3790) it is possible to hit a timeout when the spinning thread is
interrupted by hardware interrupt and ISR or DPC routine is running at the time
of the bugcheck (this is because the timeout's work item can be delivered and
handled on the second CPU and the same time). If this is the case you will have
to look deeper at the offending thread's stack (e.g. using dds) to determine
spinning code which caused the timeout to occur.
Arguments:
Arg1: 0000000000000000, Pointer to a stuck thread object.  Do .thread then kb on it to find
    the hung location.
Arg2: 0000000000000000, Pointer to a DEFERRED_WATCHDOG object.
Arg3: 0000000000000000, Pointer to offending driver name.
Arg4: 0000000000000000, Number of times this error occurred.  If a debugger is attached,
    this error is not always fatal -- see DESCRIPTION below.  On the
    blue screen, this will always equal 1.


STOP 0x000000EB: DIRTY_MAPPED_PAGES_CONGESTION    (go to top of page)

Usual causes:  File system/filter driver, Memory,

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560353(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DIRTY_MAPPED_PAGES_CONGESTION bug check has a value of 0x000000EB. This indicates that no free pages are available to continue operations.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The total number of dirty pages
2 The number of dirty pages destined for the page file
3 Windows Server 2003 only: The size of the nonpaged pool available at the time of the bug check (in pages)

Windows Vista and later versions: Reserved

4 Windows Server 2003 only: The number of transition pages that are currently stranded

Windows Vista and later versions: The most recent modified write error status


Cause

The file system driver stack has deadlocked and most of the modified pages are destined for the file system. Because the file system is non-operational, the system has crashed because none of the modified pages can be reused without losing data. Any file system or filter driver in the stack may be at fault.

To see general memory statistics, use the !vm 3 extension.

This bug check can occur for any of the following reasons:

    WinDbg Output Example:
DIRTY_MAPPED_PAGES_CONGESTION (eb)
No free pages available to continue operations.
If kernel debugger available, type "!vm 3".
        This bugcheck usually occurs for the following reasons:
        1.  A driver has blocked, deadlocking the modified or mapped
            page writers.  Examples of this include mutex deadlocks or
            accesses to paged out memory in filesystem drivers, filter
            drivers, etc.  This indicates a driver bug.
            If parameter 1 or 2 is large, then this is a possibility.  Type
            "!vm 3" in the kernel debugger.
        2.  The storage driver(s) are not processing requests.  Examples
            of this are stranded queues, non-responding drives, etc.  This
            indicates a driver bug.
            If parameter 1 or 2 is large, then this is a possibility.  Type
            "!process 0 7" in the kernel debugger.
        3.  Not enough pool is available for the storage stack to write out
            modified pages.  This indicates a driver bug.
            If parameter 3 is small, then this is a possibility.  Type
            "!vm" and "!poolused 2" in the kernel debugger.
Arguments:
Arg1: 0000000000000000, Total number of dirty pages
Arg2: 0000000000000000, Number of dirty pages destined for the pagefile(s).
Arg3: 0000000000000000, Internal flags.
Arg4: 0000000000000000, Most recent modified write error status.


STOP 0x000000EC: SESSION_HAS_VALID_SPECIAL_POOL_ON_EXIT    (go to top of page)

Usual causes:  A bug in win32k.sys, atmfd.dll, rdpdd.dll, or a video driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560354(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SESSION_HAS_VALID_SPECIAL_POOL_ON_EXIT bug check has a value of 0x000000EC. This indicates that a session unload occurred while a session driver still held memory.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The session ID
2 The number of special pool pages that are leaking
3 Reserved
4 Reserved

Cause

This error is caused by a session driver not freeing its special pool allocations prior to a session unload. This indicates a bug in win32k.sys, atmfd.dll, rdpdd.dll, or a video driver.

    WinDbg Output Example:
SESSION_HAS_VALID_SPECIAL_POOL_ON_EXIT (ec)
Caused by a session driver not freeing its pool allocations prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000000000000, session ID
Arg2: 0000000000000000, number of special pool pages that are leaking
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000ED: UNMOUNTABLE_BOOT_VOLUME    (go to top of page)

Usual causes:  Hard drive problem, File system problem, Improper boot parameters

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560355(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xed

    Knowledge Base Articles:
KB 297185    When you restart your computer or upgrade to Windows XP, you receive the "STOP 0x000000ED UNMOUNTABLE_BOOT_VOLUME" error message
KB 315403    Stop 0x000000ED Error Message When Volume on IDE Drive with Caching Enabled Is Mounted (XP)
KB 555302    Unmountable Boot Volume (XP)

    WinDbg Help File Entry:

The UNMOUNTABLE_BOOT_VOLUME bug check has a value of 0x000000ED. This indicates that the I/O subsystem attempted to mount the boot volume and it failed.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The device object of the boot volume
2 The status code from the file system that describes why it failed to mount the volume
3 Reserved
4 Reserved

    WinDbg Output Example:
UNMOUNTABLE_BOOT_VOLUME (ed)
        The IO subsystem attempted to mount the boot volume and it failed.
Arguments:
Arg1: 0000000000000000, Device object of the boot volume
Arg2: 0000000000000000, Status code from the filesystem on why it failed to mount the volume
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000EE:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (ee)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000EF: CRITICAL_PROCESS_DIED    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560358(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CRITICAL_PROCESS_DIED bug check has a value of 0x000000EF. This indicates that a critical system process died.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The process object
2 Reserved
3 Reserved
4 Reserved

    WinDbg Output Example:
CRITICAL_PROCESS_DIED (ef)
        A critical system process died
Arguments:
Arg1: 0000000000000000, Process object
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000F0:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (f0)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000F1: SCSI_VERIFIER_DETECTED_VIOLATION    (go to top of page)

Usual causes:  Driver verifier

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560365(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SCSI_VERIFIER_DETECTED_VIOLATION bug check has a value of 0x000000F1. This is the bug check code for all Driver Verifier SCSI Verification violations.

Parameters

The four bug check parameters are displayed on the blue screen. Parameter 1 identifies the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x1000 First argument passed Second argument passed Reserved The miniport driver passed bad arguments to ScsiPortInitialize.
0x1001 Delay, in microseconds Reserved Reserved The miniport driver called ScsiPortStallExecution and specified a delay greater than 0.1 second, stalling the processor too long.
0x1002 Address of routine that took too long Address of miniport's HW_DEVICE_EXTENSION Duration of the routine, in microseconds A miniport routine called by the port driver took longer than 0.5 second to execute.

(0.5 seconds is the limit for most routines. However, the HwInitialize routine is allowed 5 seconds, and the FindAdapter routine is exempt.)

0x1003 Address of miniport's HW_DEVICE_EXTENSION Address of the SRB Reserved The miniport driver completed a request more than once.
0x1004 Address of the SRB Address of miniport's HW_DEVICE_EXTENSION Reserved The miniport driver completed a request with an invalid SRB status.
0x1005 Address of miniport's HW_DEVICE_EXTENSION Address of LOGICAL_UNIT_EXTENSION Reserved The miniport driver called ScsiPortNotification to ask for NextLuRequest, but an untagged request is still active.
0x1006 Address of miniport's HW_DEVICE_EXTENSION Invalid virtual address Reserved The miniport driver passed an invalid virtual address to ScsiPortGetPhysicalAddress.

(This usually means the address supplied doesn't map to the common buffer area.)

0x1007 Address of ADAPTER_EXTENSION Address of miniport's HW_DEVICE_EXTENSION Reserved The reset hold period for the bus ended, but the miniport driver still has outstanding requests.

Cause

See the description of each code in the Parameters section for an explanation of the cause.

Resolving the Problem

This bug check can only occur when Driver Verifier has been instructed to monitor one or more drivers. If you did not intend to use Driver Verifier, you should deactivate it. You might consider removing the driver which caused this problem as well.

If you are the driver writer, use the information obtained through this bug check to fix the bugs in your code.

The Driver Verifier SCSI Verification option is only available in Windows XP and later. For full details on Driver Verifier, see the Windows Driver Kit.


    WinDbg Output Example:
SCSI_VERIFIER_DETECTED_VIOLATION (f1)
The SCSI verifier has detected an error in a SCSI miniport driver being verified.
Arguments:
Arg1: 0000000000000000, Error code:
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000F2: HARDWARE_INTERRUPT_STORM    (go to top of page)

Usual causes: 

    AUMHA Listing:  http://aumha.org/a/stop.php#0xf2

    Knowledge Base Articles:
KB 290101    Error Message: An Interrupt Storm Has Caused the System to Hang (XP, Adv Server)

    WinDbg Help File Entry:

    WinDbg Output Example:
HARDWARE_INTERRUPT_STORM (f2)
Note:  This bug check no longer exists in any version of Windows.
This bugcheck will show up on the screen when the kernel
detects an interrupt "storm".  An interrupt storm is defined as a level
triggered interrupt signal staying in the asserted state.  This is fatal
to the system in the manner that the system will hard hang, or "bus lock".
This can happen because of the following:
 -  A piece of hardware does not release its interrupt signal after being told
    to do so by the device driver
 -  A device driver does not instruct its hardware to release the interrupt
    signal because it does not believe the interrupt was initiated from its
    hardware
 -  A device driver claims the interrupt even though the interrupt was not
    initiated from its hardware.  Note that this can only occur when multiple
    devices are sharing the same IRQ.
 -  The ELCR (edge level control register) is set incorrectly.
 -  Edge and Level interrupt triggered devices share an IRQ (e.g. COM port and
    PCI SCSI controller).
All of these cases will instantly hard hang your system.  Instead of hard
hanging the system, this bugcheck is initiated since in many cases it can
identify the culprit.
When the bugcheck occurs, the module containing the ISR (interrupt service
routine) of the storming IRQ is displayed on the screen.  This is an
example of what you would see:
*** STOP: 0x000000F2 (0xFCA7C55C, 0x817B9B28, 0x817D2AA0, 0x00000002)
An interrupt storm has caused the system to hang.
*** Address FCA7C55C base at FCA72000, Datestamp 3A72BDEF - ACPI.sys
In the event the fourth parameter is a 0x00000001, the module pointed to
is very likely the culprit.  Either the driver is broken, or the hardware
is malfunctioning.
In the event the fourth parameter is a 0x00000002, the module pointed to
is the first ISR in the chain, and is never guaranteed to be the culprit.
A user experiencing this bugcheck repeatedly should try to isolate the
problem by looking for devices that are on the same IRQ as the one for
which the module is a driver for (in this case, the same IRQ that ACPI
is using).  In the future, we may be able to list all devices on a
chained ISR.
Arguments:
Arg1: 0000000000000000, address of the ISR (or first ISR in the chain) connected to the storming interrupt vector
Arg2: 0000000000000000, ISR context value
Arg3: 0000000000000000, address of the interrupt object for the storming interrupt vector
Arg4: 0000000000000000, 0x1 if the ISR is not chained, 0x2 if the ISR is chained


STOP 0x000000F3: DISORDERLY_SHUTDOWN    (go to top of page)

Usual causes:  Loaded applications/drivers that didn't unload before shutdown

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560368(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xf3

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DISORDERLY_SHUTDOWN bug check has a value of 0x000000F3. This indicates that Windows was unable to shut down due to lack of memory.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The total number of dirty pages
2 The number of dirty pages destined for the page file
3 Windows Server 2003 only: The size of the nonpaged pool available at the time of the bug check (in pages)

Windows Vista and later: Reserved

4 Windows Server 2003 only: The current shut down stage

Windows Vista and later: The most recent modified write error status


Cause

Windows attempted to shut down, but there were no free pages available to continue operations.

Because applications were not terminated and drivers were not unloaded, they continued to access pages even after the modified writer had terminated. This causes the system to run out of pages, since the page files could be used.

    WinDbg Output Example:
DISORDERLY_SHUTDOWN (f3)
No free pages available to continue operations.
Because applications are not terminated and drivers are
not unloaded, they can continue to access pages even after
the modified writer has terminated.  This can cause the
system to run out of pages since the pagefile(s) cannot be used.
Arguments:
Arg1: 0000000000000000, Total number of dirty pages
Arg2: 0000000000000000, Number of dirty pages destined for the pagefile(s).
Arg3: 0000000000000000, Internal flags.
Arg4: 0000000000000000, Most recent modified write error status.


STOP 0x000000F4: CRITICAL_OBJECT_TERMINATION    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560372(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xf4
    Other Articles:
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/10365-0xf4-debugging.html
        http://bsodanalysis.blogspot.com/2012/07/recent-interesting-solve-f4.html
        http://bsoddebugging.blogspot.com/2014/07/0xf4-debugging.html

    Knowledge Base Articles:
KB 330100    Connecting a hard disk drive in slave only mode leads to system halt during resume from standby (XP, Server 2003)
KB 904779    A Windows Server 2003-based computer stops responding, and you receive a "Stop 0x000000F4" error message
KB 916199    Windows XP stops responding when you click or resize a window, or in Windows Server 2003, when you run many console applications, you receive a Stop error message: "0x000000F4"
KB 923150    When you restart Windows Server 2003 after you use the Driver Verifier utility, you may receive a Stop error: "STOP 0x00000050" or "STOP 0x000000F4"
KB 935192    Error message when you resume a Windows XP-based computer from hibernation after you apply hotfix 918005: "Stop 0x00000044" or “Stop 0x000000F4”
KB 948928    Stop error message when multiple console applications are opened and closed within a short time frame on a Windows Server 2003-based computer: "0x000000F4"
KB 977178    You receive various Stop error messages in Windows 7 or in Windows Server 2008 R2 when you resume a computer that has a large SATA hard disk
KB 981369    "Stop: 0x000000F4": error message when a console application is exiting in Windows Vista or in Windows Server 2008
KB 2498326    Stop Error on Windows Server 2008 R2 During Upgrade of FCoE Adapter Driver
KB 2580450    "0x000000F4" Stop error when you open a console application in Windows Server 2008 or in Windows Vista
KB 2653132    Stop Code 0x000000F4 May Occur When Running VMware ESX 4.1 (w/Server 2003 client)
KB 2675806    "0x000000F4" Stop error when you try to start a ClickOnce application in Windows 7 or in Windows Server 2008 R2
KB 2690750    "0x000000F4" Stop error when you stop a PowerShell script in Windows 7 or in Windows Server 2008 R2
KB 2722392    "0x000000F4" Stop error when you run the Device Fundamental tests in Windows 7 or in Windows Server 2008 R2

    WinDbg Help File Entry:

The CRITICAL_OBJECT_TERMINATION bug check has a value of 0x000000F4. This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The terminating object type:

0x3: Process

0x6: Thread

2 The terminating object
3 The process image file name
4 Pointer to an ASCII string containing an explanatory message

Cause

Several processes and threads are necessary for the operation of the system. When they are terminated for any reason, the system can no longer function.

    WinDbg Output Example:
CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8007c13b30, Terminating object
Arg3: fffffa8007c13e10, Process image file name
Arg4: fffff800031d5670, Explanatory message (ascii)


STOP 0x000000F5: FLTMGR_FILE_SYSTEM    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560383(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The FLTMGR_FILE_SYSTEM bug check has a value of 0x000000F5. This indicates that an unrecoverable failure occurred in the Filter Manager.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of error
0x66 Pointer to the callback data structure for the operation. 0 0 The minifilter returned FLT_PREOP_SUCCESS_WITH_CALLBACK or FLT_PREOP_SYNCHRONIZE from a preoperation callback, but did not register a corresponding postoperation callback.
0x67 Pointer to the callback data structure for the operation. 0 Error NTSTATUS code for the operation An internal object ran out of space, and the system is unable to allocate new space.
0x68 Handle for the object. 0 NTSTATUS code returned by ObReferenceObjectByHandle Unexpected failure referencing an object.
0x6A File object pointer for the file. 0 0 The file-open or file-create request could not be canceled, because one or more handles have been created for the file.
0x6B Frame ID 0 Thread Invalid BACKPOCKET IRPCTRL state.
0x6C Frame ID BackPocket List Thread Too many nested PageFaults for BACKPOCKETED IRPCTR.
0x6D Address of the minifilter's context structure Address of the CONTEXT_NODE structure 0 The context structure was dereferenced too many times. This means that the reference count on the Filter Manager's CONTEXT_NODE structure went to zero while it was still attached to its associated object.



0x6E Address of the minifilter's context structure Address of the CONTEXT_NODE structure 0 The context structure was referenced after being freed.

Cause

The cause of the problem is indicated by the value of Parameter 1. See the table in the Parameters section.

Resolving the Problem

If Parameter 1 equals 0x66, you can debug this problem by verifying that your minifilter driver has registered a post-operation callback for this operation. The current operation can be found in the callback data structure. (See Parameter 2.) Use the !fltkd.cbd debugger extension.

If Parameter 1 equals 0x67, you should verify that you do not have a nonpaged pool leak somewhere in the system.

If Parameter 1 equals 0x6A, make sure that your minifilter driver does not reference this file object (see Parameter 2) to get a handle at any point during your minifilter's processing of this operation.

If Parameter 1 equals 0x6B or 0x6C, then a non-recoverable internal state error has occurred which will cause the operating system to bug check.

If Parameter 1 equals 0x6D, make sure that your minifilter driver does not call FltReleaseContext too many times for the given context (see Parameter 2).

If Parameter 1 equals 0x6E, make sure that your minifilter driver does not call FltReferenceContext after the given context has been deleted (see Parameter 2).

    WinDbg Output Example:
FLTMGR_FILE_SYSTEM (f5)
An unrecoverable failure occured inside the filter manager.
Arguments:
Arg1: 0000000000000000, The reason for the failure
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000F6: PCI_VERIFIER_DETECTED_VIOLATION    (go to top of page)

Usual causes:  BIOS, Driver verifier

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560386(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PCI_VERIFIER_DETECTED_VIOLATION bug check has a value of 0x000000F6. This indicates that an error occurred in the BIOS or another device being verified by the PCI driver.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 is the only parameter of interest; this identifies the nature of the failure detected.

Parameter 1 Cause of Error
0x01 An active bridge was reprogrammed by the BIOS during a docking event.
0x02 The PMCSR register was not updated within the spec-mandated time.
0x03 A driver has written to Windows-controlled portions of a PCI device's configuration space.

Cause

The PCI driver detected an error in a device or BIOS being verified.

    WinDbg Output Example:
PCI_VERIFIER_DETECTED_VIOLATION (f6)
The PCI driver detected an error in a device or BIOS being verified.
Arguments:
Arg1: 0000000000000000, Failure detected
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000F7: DRIVER_OVERRAN_STACK_BUFFER    (go to top of page)

Usual causes:  Device driver, Malware

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560389(v=VS.85).aspx

    Knowledge Base Articles:
KB 957991    Error message on a Windows Server 2003 R2-based computer that has hardware support for Intelligent Platform Management Interface: "Stop 0x000000F7"

    WinDbg Help File Entry:

The DRIVER_OVERRAN_STACK_BUFFER bug check has a value of 0x000000F7. This indicates that a driver has overrun a stack-based buffer.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The actual security check cookie from the stack
2 The expected security check cookie
3 The bit-complement of the expected security check cookie
4 0

Cause

A driver overran a stack-based buffer (or local variable) in a way that would have overwritten the function's return address and jumped back to an arbitrary address when the function returned.

This is the classic "buffer overrun" hacking attack. The system has been brought down to prevent a malicious user from gaining complete control of it.

Resolving the Problem

Use the kb (Display Stack Backtrace) command to get a stack trace.

The last routine on the stack before the buffer overrun handlers and bug check call is the one that overran its local variable.

    WinDbg Output Example:
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.  This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned.  This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 99e04ea2, Actual security check cookie from the stack
Arg2: cc9f53c0, Expected security check cookie
Arg3: 3360ac3f, Complement of the expected security check cookie
Arg4: 00000000, zero


STOP 0x000000F8: RAMDISK_BOOT_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560392(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The RAMDISK_BOOT_INITIALIZATION_FAILED bug check has a value of 0x000000F8. This indicates that an initialization failure occurred while attempting to boot from the RAM disk.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Indicates the cause of the failure.

1: No LoaderXIPRom descriptor was found in the loader memory list.

2: Unable to open the RAM disk driver (ramdisk.sys or \Device\Ramdisk).

3: FSCTL_CREATE_RAM_DISK failed.

4: Unable to create GUID string from binary GUID.

5: Unable to create symbolic link pointing to the RAM disk device.

2 NTSTATUS code
3 0
4 0

    WinDbg Output Example:
RAMDISK_BOOT_INITIALIZATION_FAILED (f8)
An initialization failure occurred while attempting to boot from the RAM disk.
Arguments:
Arg1: 0000000000000000, Action that failed
Arg2: 0000000000000000, NT status code
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000F9: DRIVER_RETURNED_STATUS_REPARSE_FOR_VOLUME_OPEN    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560396(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DRIVER_RETURNED_STATUS_REPARSE_FOR_VOLUME_OPEN bug check has a value of 0x000000F9. This indicates that a driver returned STATUS_REPARSE to an IRP_MJ_CREATE request with no trailing names.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The device object that was opened
2 The device object to which the IRP_MJ_CREATE request was issued
3 Address of the Unicode string containing the new name of the file (to be reparsed)
4 Information returned by the driver for the IRP_MJ_CREATE request

Comments

STATUS_REPARSE should be returned only for IRP_MJ_CREATE requests with trailing names, as that indicates the driver is supporting name spaces.

    WinDbg Output Example:
DRIVER_RETURNED_STATUS_REPARSE_FOR_VOLUME_OPEN (f9)
A driver returned STATUS_REPARSE to a Create request with no trailing names.
STATUS_REPARSE should be returned only for Create requests with trailing names
as that indicates the driver is supporting name spaces.
Arguments:
Arg1: 0000000000000000, Device object that was opened.
Arg2: 0000000000000000, Device object to which the Create IRP was issued.
Arg3: 0000000000000000, New name of the file (to be reparsed) (UNICODE string)
Arg4: 0000000000000000, Information returned by the driver for the Create IRP


STOP 0x000000FA: HTTP_DRIVER_CORRUPTED    (go to top of page)

Usual causes:  HTTP.sys is corrupted

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560399(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The HTTP_DRIVER_CORRUPTED bug check has a value of 0x000000FA. This indicates that the HTTP kernel driver (Http.sys) has reached a corrupted state and cannot recover.

Parameters

The four bug check parameters are displayed on the blue screen. Parameter 1 identifies the exact state of the HTTP kernel driver.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x1 Address of work item Name of the file that contains the work item check Line number of the work item check within the file A work item is invalid. This will eventually result in thread pool corruption and an access violation.

    WinDbg Output Example:
HTTP_DRIVER_CORRUPTED (fa)
The HTTP kernel driver (http.sys) reached a corrupted state and can not
recover.
Arguments:
Arg1: 0000000000000000, State identifier
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000FB: RECURSIVE_MACHINE_CHECK    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (fb)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000FC: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560402(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xfc
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/08/12/debugging-stop-0xfc-attempted_execute_of_noexecute_memory/

    Knowledge Base Articles:
KB 878474    System with the Mpegport.sys driver repeatedly restarts after you install Windows XP Service Pack 2 or Windows XP Tablet PC Edition 2005
KB 886348    You receive a Stop error when a driver is not compatible with the Data Execution Prevention (DEP) feature in Windows XP Service Pack 2 or in Windows XP Tablet PC Edition 2005
KB 953356    Error message after you upgrade a computer that uses a processor other than an Intel processor to Windows XP Service Pack 2 or to Windows XP Service Pack 3: "STOP: 0x0000007E"
KB 2840622    Stop Error 0x000000FC when you manage message queuing on a computer that is running Windows 8 or Windows Server 2012

    WinDbg Help File Entry:

The ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY bug check has a value of 0x000000FC. This indicates that an attempt was made to execute non-executable memory.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The virtual address whose execution was attempted
2 The contents of the page table entry (PTE)
3 Reserved
4 Reserved

Resolving the Problem

When possible, the Unicode string of the driver name that attempted to execute non-executable memory is printed on the bug check screen and is also saved in KiBugCheckDriver. Otherwise, the driver in question can often be found by running a stack trace and then reviewing the current instruction pointer.

    WinDbg Output Example:
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory.  The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff8800ddd22b0, Virtual address for the attempted execute.
Arg2: 84c0000120103963, PTE contents.
Arg3: fffffa600948a7c0, (reserved)
Arg4: 0000000000000002, (reserved)


STOP 0x000000FD: DIRTY_NOWRITE_PAGES_CONGESTION    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560404(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DIRTY_NOWRITE_PAGES_CONGESTION bug check has a value of 0x000000FD. This indicates that there are no free pages available to continue basic system operations.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Total number of dirty pages
2 Number of non-writeable dirty pages
3 Reserved
4 Most recently modified write-error status

Cause

This bug check usually occurs because the component that owns the modified non-writeable pages failed to write out these pages after marking the relevant files as "do not write" to memory management. This indicates a driver bug.

Resolving the Problem

For more information about which driver is causing the problem, use the !vm 3 extension, followed by !memusage 1 .

    WinDbg Output Example:
DIRTY_NOWRITE_PAGES_CONGESTION (fd)
No free pages available to continue operations.
If kernel debugger available, type "!vm 3 and !memusage 1".
        This bugcheck usually occurs because the component owning the
        modified nowrite pages failed to write out these pages after
        marking the relevant files as dont-write to memory management.
        This indicates a driver bug.
Arguments:
Arg1: 0000000000000000, Total number of dirty pages
Arg2: 0000000000000000, Number of nowrite dirty pages.
Arg3: 0000000000000000, Internal flags.
Arg4: 0000000000000000, Most recent modified write error status


STOP 0x000000FE: BUGCODE_USB_DRIVER    (go to top of page)

Usual causes:  USB device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560407(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xfe
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/09/09/debugging-stop-0xfe/

    Knowledge Base Articles:
KB 331988    Bugcheck 0x000000FE Under Stress with USB 2.0 Hard Disks (XP)
KB 835594    Stop 0x000000FE error occurs when you try to start a third-party IP telephone program in Windows XP
KB 930568    Error message when you try to put a Windows Vista-based computer to sleep or into hibernation: "STOP 0x000000FE BUGCODE_USB_DRIVER"
KB 934374    Error message when you connect a portable Windows Vista-based computer to a docking station: "STOP: 0x000000fe"
KB 934796    Error message on a Windows Vista-based computer that is running a USB composite device: "STOP 0x000000FE"
KB 935368    A USB-connected Portable Media Center device no longer works after you resume a Windows Vista-based computer from sleep
KB 940086    Stop error message if you use two USB streaming-video cameras at the same time on a Windows XP Service Pack 2-based computer: "STOP 0x000000FE"
KB 941822    Stop error when you resume a computer that is running Windows Vista from standby: "STOP 0x000000FE (parameter1, parameter2, parameter3, parameter4)"
KB 946723    Error message when you bring the computer out of the "Hibernate system" power state in Windows Vista: "Stop 0x000000FE"
KB 949201    Stop error message when a Windows Vista-based computer that has a USB device attached resumes from standby or from hibernation: "Stop 0x000000FE ( 00000008 , 00000006 , 00000001 , parameter4 )"
KB 956388    Stop error when a Windows Vista-based or Windows Server 2008-based computer enters sleep mode: "Stop 0x000000FE BUGCODE_USB_DRIVER"
KB 959520    Stop error when you execute some common Plug and Play functions on a Windows Vista-based or a Windows Server 2008-based computer: "STOP 0x000000D1" or "STOP 0x000000FE"
KB 967102    Stop error message on a Windows Vista-based or Windows Server 2008-based computer when you resume the system from sleep: Stop 0x000000FE
KB 971171    A computer that is running Windows Vista or Windows Server 2008 restarts automatically and generates a Stop error after you repeatedly plug and hot-unplug a USB device: "0x000000FE"
KB 973208    Stop error after you upgrade from Windows Vista Service Pack 1 to Windows Vista Service Pack 2 or from Windows Server 2008 to Windows Server 2008 Service Pack 2: "Stop 0x000000FE BUGCODE_USB_DRIVER"
KB 974303    Stop 0xFE Resuming from Sleep or Hibernate with USB Streaming Device (Vista7)
KB 974410    "STOP 0x000000FE" error in Windows 7 or in Windows Server 2008 R2 when the computer enters or resumes from sleep (S3) or from hibernation (S4)
KB 982091    "Stop 0x9F" or "Stop 0xFE" error on a Windows 7-based or Windows Vista-based computer that uses certain AMD USB EHCI host controllers
KB 2547549     "0x000000FE" Stop error message when you try to resume a Windows Vista SP2-based or Windows Server 2008 SP2-based computer from sleep

    WinDbg Help File Entry:

The BUGCODE_USB_DRIVER bug check has a value of 0x000000FE. This indicates that an error has occurred in a Universal Serial Bus (USB) driver.

Parameters

The four bug check parameters are displayed on the blue screen. Parameter 1 identifies the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x1 Reserved Reserved Reserved An internal error has occurred in the USB stack.
0x2 Address of the pending IRP Address of the IRP that was passed in Address of the USB request block (URB) that caused the error The USB client driver has submitted a URB that is still attached to another IRP that is pending in the bus driver.
0x3 Reserved Reserved Reserved The USB miniport driver has generated a bug check. This usually happens in response to a catastrophic hardware failure.
0x4 Address of the IRP Address of the URB Reserved The caller has submitted an IRP that is already pending in the USB bus driver.
0x5 Device extension pointer of the host controller PCI vendor, product id for the controller Pointer to endpoint data structure A hardware failure has occurred due to a bad physical address found in a hardware data structure. This is not due to a driver bug.
Ox6 Object address Signature that was expected Reserved An Internal data structure (object) has been corrupted.
0x7 Pointer to usbport.sys debug log Message string File name Please consult the provided message string for details.
0x8 Reserved Type Reserved Reserved Reserved

Cause

See the description of each code in the Parameters section for an explanation of the cause.

    WinDbg Output Example:
BUGCODE_USB_DRIVER (fe)
USB Driver bugcheck, first parameter is USB bugcheck code.
Arguments:
Arg1: 00000008, USBBUGCODE_RESERVED_USBHUB
Arg2: 00000006, USBHUB_TRAP_FATAL_TIMEOUT
Arg3: 00000001, TimeoutCode: Timeout_SyncResumePort - Failed resuming a suspended port
Arg4: 864b6988, TimeoutContext - PortData


STOP 0x000000FF: RESERVE_QUEUE_OVERFLOW    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560409(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The RESERVE_QUEUE_OVERFLOW bug check has a value of 0x000000FF. This indicates that an attempt was made to insert a new item into a reserve queue, causing the queue to overflow.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the reserve queue
2 The size of the reserve queue
3 0
4 0

    WinDbg Output Example:
RESERVE_QUEUE_OVERFLOW (ff)
An attempt was made to insert a new item in a reserve queue which caused the
queue to overflow.
Arguments:
Arg1: 0000000000000000, The address of the reserve queue.
Arg2: 0000000000000000, The size of the reserve queue.
Arg3: 0000000000000000, 0.
Arg4: 0000000000000000, 0.


STOP 0x000000MN:      (go to top of page)

    Referenced in these articles:
    Error message when you switch the operating system from a dual monitor setting to a single monitor setting on a Windows XP-based computer or on a Windows Server 2003-based computer that has the security update 954211 installed: "Stop 0x0000008E"
    Easy CD Creator 5.0 does not function in Windows XP
   

STOP 0x00000100: LOADER_BLOCK_MISMATCH    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557208(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The LOADER_BLOCK_MISMATCH bug check has a value of 0x00000100. This indicates that either the loader block is invalid, or it does not match the system that is being loaded.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 3
2 The size of the loader black extension
3 The major version of the loader block
4 The minor version of the loader block

    WinDbg Output Example:
LOADER_BLOCK_MISMATCH (100)
The loader block in not valid or mismatches the system that is being loaded.
Arguments:
Arg1: 0000000000000000, The OS major version of the loader block.
Arg2: 0000000000000000, The OS minor version of the loader block.
Arg3: 0000000000000000, The size of the loader block.
Arg4: 0000000000000000, The size of the loader block extension.


STOP 0x00000101: CLOCK_WATCHDOG_TIMEOUT    (go to top of page)

Usual causes:  Device driver, BIOS bug, hardware defect (see Significant Posts section below)

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557211(v=VS.85).aspx
    Other Articles:
        http://www.sevenforums.com/crashes-debugging/35427-win-7-clock-interrupt-bsod-101-error.html#post356791
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/270-class-101-0x101-bugchecks.html
        https://bsodtutorials.wordpress.com/2013/05/20/debugging-stop-0x101/
        https://bsodtutorials.wordpress.com/2013/08/11/debugging-stop-0x101-solved-example/
        https://bsodtutorials.wordpress.com/2013/08/07/understanding-ipi-stop-0x101/
        https://bsodtutorials.wordpress.com/2013/11/28/debugging-stop-0x101-updated-version/
        https://bsodtutorials.wordpress.com/2014/04/26/process-directory-table-base-and-cr3-with-stop-0x101/
        http://bsoddebugging.blogspot.com/2014/06/today-well-take-look-at-0x101-bugcheck.html

    Knowledge Base Articles:
KB 955076    Stop error message on a Windows Vista or Windows Server 2008-based computer that has multiple processors installed: "STOP: 0x00000101 CLOCK_WATCHDOG_TIMEOUT"
KB 975530    Stop error message on a Windows Server 2008 R2-based computer that has the Hyper-V role installed and that uses one or more Intel CPUs that are code-named Nehalem: "0x00000101 - CLOCK_WATCHDOG_TIMEOUT"
KB 2648039    "0x00000101" Stop error occurs in Windows 7 or in Windows Server 2008 R2 if a USB 2.0 debug cable is attached
KB 2927725    "0x133", "0x101" Stop error or system stops responding when hot adding a CPU core to a computer (Windows 8/Server 2012)

    Significant Posts:  http://www.sevenforums.com/crashes-debugging/35427-win-7-clock-interrupt-bsod-101-error.html#post356791
These types of error messages are relatively simple, from a certain viewpoint: as frequently happens during normal processing, one core (processor) attempted to get the attention of another core, in order to synchronise their activites with respect to an operation that requires processor coordination. Described using "official" terminology:

"CLOCK_WATCHDOG_TIMEOUT (101)
An expected clock interrupt was not received on a secondary processor in an
MP system within the allocated interval. This indicates that the specified
processor is hung and not processing interrupts."

The trigger for the crash is the "sender/requestor" processor going "wtf? why is there still no response after almost half a second?!?" Those inter-processor interrupts (IPIs) are some of the most critical activity imaginable, and an unrequited IPI is absolutely lethal - hence the crash.

AMD procs had known issues which manifested themselves in this manner under Vista and Windows 7. There were/are many possible problem permutations, some solved through BIOS updates, and some necessitating fiddling with the "Translation Lookaside Buffer" (TLB), as per torrentg's suggestion to look up 0x101 and AMD and TLB.

Your real aim is to give yourself the best possible chance of discovering a software cause for the target processor to go unresponsive, and thereby avoid the most obvious conclusion - that the processor is periodically unresponsive because of hardware-level defects

I can confidently tell you that the browsers, apps, and games cannot be the root cause of this problem, even though I don't doubt your observation that the operation of certain software seems to more easily trigger the crash. What you're looking for will be in one of the following categories:

a) BIOS bug
b) a driver whose activity is causing the target processor to lock up
c) a hardware defect (temperature, voltage, dust, RFI, outright borkedness...)
- H2SO4

    WinDbg Help File Entry:

The CLOCK_WATCHDOG_TIMEOUT bug check has a value of 0x00000101. This indicates that an expected clock interrupt on a secondary processor, in a multi-processor system, was not received within the allocated interval.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Clock interrupt time-out interval, in nominal clock ticks
2 0
3 The address of the processor control block (PRCB) for the unresponsive processor
4 0

Cause

The specified processor is not processing interrupts. Typically, this occurs when the processor is nonresponsive or is deadlocked.

    WinDbg Output Example:
CLOCK_WATCHDOG_TIMEOUT (101)
An expected clock interrupt was not received on a secondary processor in an
MP system within the allocated interval. This indicates that the specified
processor is hung and not processing interrupts.
Arguments:
Arg1: 0000000000000019, Clock interrupt time out interval in nominal clock ticks.
Arg2: 0000000000000000, 0.
Arg3: fffff88002f64180, The PRCB address of the hung processor.
Arg4: 0000000000000002, 0.


STOP 0x00000102: DPC_WATCHDOG_TIMEOUT    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
DPC_WATCHDOG_TIMEOUT (102)
The DPC watchdog routine was not executed within the allocated time interval.
This means that either an ISR is hung at an IRQL that is below clock level and
above dispatch level, or a DPC routine is hung on the specified processor.
Arguments:
Arg1: 0000000000000000, DPC watchdog time out interval in nominal clock ticks.
Arg2: 0000000000000000, The PRCB address of the hung processor.
Arg3: 0000000000000000, 0.
Arg4: 0000000000000000, 0.


STOP 0x00000103: MUP_FILE_SYSTEM    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557215(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:
[This is preliminary documentation and subject to change.]

The MUP_FILE_SYSTEM bug check has a value of 0x00000103. This bug check indicates that the multiple UNC provider (MUP) has encountered invalid or unexpected data. As a result, the MUP cannot channel a remote file system request to a network redirector, the Universal Naming Convention (UNC) provider.

Parameters

These bug check parameters are displayed on the blue screen. Parameter 1 identifies the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of error
0x1 The address of the pending IRP. The address of the file object whose file context could not be found. The address of the device object. The MUP could not locate the file context that corresponds to a file object. This typically indicates that the MUP is seeing an I/O request for a file object for which MUP did not see a corresponding IRP_MJ_CREATE request. The likely cause of this bug check is a filter driver error.



0x2 The address of the expected file context. The address that was actually retrieved from the file object. Reserved A file context is known to exist for the file object, but was not what was expected (for example, it might be NULL).





0x3 The address of the IRP context. The IRP completion status code. The driver object of the UNC provider that completed the IRP (might be NULL). The IRP completion status was unexpected or invalid.
This bug check occurs only when you are using a Checked Build of Windows and should only be caused by file system filter drivers that are attached to legacy network redirectors. Legacy redirectors use FsRtlRegisterUncProvider to register with MUP. This bug check detects filter drivers that return an NTSTATUS that is not STATUS_SUCCESS in IRP_MJ_CLEANUP or IRP_MJ_CLOSE requests.





0x4 Address of the IRP Address of the file object The file context for the file object An I/O operation was started on a file object before the create request for the file object was completed.






Comments

The MUP maintains context information on a per-file object basis for all file objects it handles.

    WinDbg Output Example:
MUP_FILE_SYSTEM (103)
MUP file system detected an error.
Arguments:
Arg1: 0000000000000000, Type of MUP error
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000104: AGP_INVALID_ACCESS    (go to top of page)

Usual causes:  Video driver, BIOS

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557218(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The AGP_INVALID_ACCESS bug check has a value of 0x00000104. This indicates that the GPU wrote to a range of Accelerated Graphics Port (AGP) memory that had not previously been committed.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Offset (in ULONG) within the AGP verifier page to the first ULONG data that is corrupted
2 0
3 0
4 0

Cause

Typically, this bug check is caused by an unsigned or improperly tested video driver. It can also be caused by an old BIOS.

Resolving the Problem

Check for display driver and computer BIOS updates.

    WinDbg Output Example:
AGP_INVALID_ACCESS (104)
An invalid AGP memory accessa was detected.
This is most likely caused by an unsigned, or improperly tested video driver,
or old BIOS.  Check for updated display drivers and system BIOS.
Arguments:
Arg1: 0000000000000000, Last AGP memory allocation type, 1=allocation, 0=free.
Arg2: 0000000000000000, Address of Memory Descriptor List (MDL) for last allocation.
Arg3: 0000000000000000, Base Address Page Frame Number (PFN) of last AGP allocation.
Arg4: 0000000000000000, 0.


STOP 0x00000105: AGP_GART_CORRUPTION    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557220(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The AGP_GART_CORRUPTION bug check has a value of 0x00000105. This indicates that the Graphics Aperture Remapping Table (GART) is corrupt.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The base address (virtual) of the GART
2 The offset into the GART where the corruption occurred
3 The base address (virtual) of the GART cache (a copy of the GART)
4 0

Cause

This bug check is typically caused by improper direct memory access (DMA) by a driver.

Resolving the Problem

Enable Driver Verifier for any unsigned drivers. Remove them or disable them one by one until the erring driver is identified.

    WinDbg Output Example:
AGP_GART_CORRUPTION (105)
The Graphics Aperture Redirection Table (Gart) is corrupt.
This is most likey caused by errant device Direct Memory Access (DMA).
Enable the driver verifier against unsigned drivers, and remove them
or disable them one at a time until the culprit is idnetified.
Arguments:
Arg1: 0000000000000000, Base address of the Graphics Aperture Redirection Table (Gart).
Arg2: 0000000000000000, Offset into Gart where corruption occurred.
Arg3: 0000000000000000, Base address of the Gart-cache (copy of Gart).
Arg4: 0000000000000000, 0.


STOP 0x00000106: AGP_ILLEGALLY_REPROGRAMMED    (go to top of page)

Usual causes:  Video driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557223(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The AGP_ILLEGALLY_REPROGRAMMED bug check has a value of 0x00000106. This indicates that the Accelerated Graphics Port (AGP) hardware has been reprogrammed by an unauthorized agent.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The originally programmed AGP command register value
2 The current command register value
3 0
4 0

Cause

This bug check is typically caused by an unsigned, or improperly tested, video driver.

Resolving the Problem

Check the video manufacturer's Web site for updated display drivers or use VGA mode.

    WinDbg Output Example:
AGP_ILLEGALLY_REPROGRAMMED (106)
The AGP HW has been reprogrammed by an unauthorized agent.
This is most likely caused by an unsigned, or improperly tested video driver.
Check video manufacturer's web site for updated display drivers, or use
VGA-mode.
Arguments:
Arg1: 0000000000000000, Originally programmed AGP Command Register value.
Arg2: 0000000000000000, Current Command Register value.
Arg3: 0000000000000000, 0.
Arg4: 0000000000000000, 0.


STOP 0x00000107: KERNEL_EXPAND_STACK_ACTIVE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (107)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000108: THIRD_PARTY_FILE_SYSTEM_FAILURE    (go to top of page)

Usual causes:  Disk issues, Disk corruption, 3rd party file system corruption, SCSI/IDE controller driver, Memory, Insufficient memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557225(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The THIRD_PARTY_FILE_SYSTEM_FAILURE bug check has a value of 0x00000108. This indicates that an unrecoverable problem has occurred in a third-party file system or file system filter.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Identifies the file system that failed. Possible values include:

1: Polyserve (Psfs.sys)

2 The address of the exception record.
3 The address of the context record.
4 Reserved.

Cause

One possible cause of this bug check is disk corruption. Corruption in the third-party file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the Windows operating system’s ability to read and write to disk, thus causing the error.

Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool is completely depleted, this error can stop the system.

Resolving the Problem

To debug this problem: Use the .cxr (Display Context Record) command with Parameter 3, and then use kb (Display Stack Backtrace).

To resolve a disk corruption problem: Check Event Viewer for error messages from SCSI, IDE, or other disk controllers in the system that might help pinpoint the device or driver that is causing the error. Try disabling any virus scanners, backup programs, or disk defragmenter tools that continually monitor the system. You should also run hardware diagnostics supplied by the file system or the file system filter manufacturer.

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This will increase the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
THIRD_PARTY_FILE_SYSTEM_FAILURE (108)
DESCRIPTION
A 3rd party file system or file system filter has failed in an
unrecoverable way.
Arguments:
Arg1: 0000000000000000, Identifies the file system that failed
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000109: CRITICAL_STRUCTURE_CORRUPTION    (go to top of page)

Usual causes:  Device driver, Breakpoint set with no debugger attached, Hardware (Memory in particular)

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557228(v=VS.85).aspx
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/10/10/debugging-stop-0x109-kernel-patch-protection/
        http://omgdebugging.com/debugging-critical_structure_corruption-0x109/

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CRITICAL_STRUCTURE_CORRUPTION bug check has a value of 0x00000109. This indicates that the kernel has detected critical kernel code or data corruption.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Reserved
2 Reserved
3 Reserved
4 The type of the corrupted region. (See the following table later on this page.)

The value of Parameter 4 indicates the type of corrupted region.

Parameter 4 Type of Corrupted Region, Type of Corruption, or Type of Action Taken That Caused the Corruption
0x0 A generic data region
0x1 A function modification or the Itanium-based function location
0x2 A processor interrupt dispatch table (IDT)
0x3 A processor global descriptor table (GDT)
0x4 A type-1 process list corruption
0x5 A type-2 process list corruption
0x6 A debug routine modification
0x7 A critical MSR modification

Cause

There are generally three different causes for this bug check:

  1. A driver has inadvertently, or deliberately, modified critical kernel code or data. Microsoft Windows Server 2003 with Service Pack 1 (SP1) and later versions of Windows for x64-based computers do not allow the kernel to be patched except through authorized Microsoft-originated hot patches. For more information, see Patching Policy for x64-based Systems.
  2. A developer attempted to set a normal kernel breakpoint using a kernel debugger that was not attached when the system was started. Normal breakpoints (bp) can only be set if the debugger is attached at start time. Processor breakpoints (ba) can be set at any time.
  3. A hardware corruption occurred. For example, the kernel code or data could have been stored in memory that failed.
    WinDbg Output Example:
CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d89612353e, Reserved
Arg2: b3b7465ee890459c, Reserved
Arg3: fffff88000e90490, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
    0 : A generic data region
    1 : Modification of a function or .pdata
    2 : A processor IDT
    3 : A processor GDT
    4 : Type 1 process list corruption
    5 : Type 2 process list corruption
    6 : Debug routine modification
    7 : Critical MSR modification


STOP 0x0000010A: APP_TAGGING_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557230(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The APP_TAGGING_INITIALIZATION_FAILED bug check has a value of 0x0000010A.

This bug check appears very infrequently.

    WinDbg Output Example:
APP_TAGGING_INITIALIZATION_FAILED (10a)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000010B: DFSC_FILE_SYSTEM    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (10b)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000010C: FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION    (go to top of page)

Usual causes:  Device driver, File system Run-time libarary  (FsRtl) corruption

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557232(v=VS.85).aspx

    Knowledge Base Articles:
KB 2847521    "0x0000010c" Stop error on a computer that is running Windows 7 or Windows Server 2008 R2

    WinDbg Help File Entry:

The FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION bug check has a value of 0x0000010C. This indicates that a violation was detected in the File system Run-time library (FsRtl) Extra Create Parameter (ECP) package.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The type of violation. (See the following table later on this page for more details).
2 0
3 The address of the ECP.
4 The starting address of the ECP list.

The value of Parameter 1 indicates the type of violation.

Parameter 1 Type of Violation
0x1 The ECP signature is invalid, due to either a bad pointer or memory corruption.
0x2 The ECP has undefined flags set.
0x3 The ECP was not allocated by the FsRtl.
0x4 The ECP has flags set that are illegal for a parameter passed by a create caller.
0x5 The ECP is corrupted; its size is smaller than the header size.
0x6 The ECP that is being freed has non-empty list pointers; it might still be part of an ECP list.
0x11 The ECP list signature is invalid, due to either a bad pointer or memory corruption.
0x12 The ECP list has undefined flags set.
0x13 The ECP list was not allocated by the FsRtl.
0x14 The ECP list has flags set that are illegal for a parameter list passed by a create caller.
0x15 The ECP list passed by the create caller is empty.

    WinDbg Output Example:
FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION (10c)
DESCRIPTION
A violation has been detected in the use of FsRtl
Extra Create Parameter package.
Arguments:
Arg1: 0000000000000000, Type of violation
Arg2: 0000000000000000, 0.
Arg3: 0000000000000000, Ecp.
Arg4: 0000000000000000, EcpList.


STOP 0x0000010D: WDF_VIOLATION    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557235(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The WDF_VIOLATION bug check has a value of 0x0000010D. This indicates that Kernel-Mode Driver Framework (KMDF) detected that Windows found an error in a framework-based driver.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 indicates the specific error code of the bug check. Parameter 4 is reserved.

Parameter 1 Parameter 2 Parameter 3 Cause of Error
0x1 Pointer to a WDF_POINTER_ROUTINE_TIMED_OUT_DATA structure Reserved A framework-based driver has timed out during a power operation. This typically means that the device stack did not set the DO_POWER_PAGABLE bit and a driver attempted a pageable operation after the paging device stack was powered down.
0x2 Reserved Reserved An attempt is being made to acquire a lock that is currently being held.
0x3 WDFREQUEST handle The number of outstanding references that remain on both buffers Windows Driver Framework Verifier has encountered a fatal error. In particular, an I/O request was completed, but a framework request object cannot be deleted because there are outstanding references to the input buffer, the output buffer, or both.
0x4 Reserved The caller's address A NULL parameter was passed to a function that required a non-NULL value.
0x5 The handle value passed in Reserved A framework object handle of the incorrect type was passed to a framework object method.
0x6

See table below.
0x7 The handle of the framework object Reserved A driver attempted to delete a framework object incorrectly by calling WdfObjectDereference to delete a handle instead of calling WdfObjectDelete.
0x8 The handle of the DMA transaction object Reserved An operation occurred on a DMA transaction object while it was not in the correct state.
0x9

Currently unused.
0xA A pointer to a WDF_QUEUE_FATAL_ERROR_DATA structure Reserved A fatal error has occurred while processing a request that is currently in the queue.



0xB

See table below.

If Parameter 1 is equal to 0x6, then a fatal error was made in handling a WDF request. In this case, Parameter 2 further specifies the type of fatal error that has been made, as defined by the enumeration WDF_REQUEST_FATAL_ERROR.

Parameter 2 Parameter 3 Cause of Error
0x1 The address of the IRP No more I/O stack locations are available to format the underlying IRP.
0x2 The WDF request handle value An attempt was made to format a framework request object that did not contain an IRP.
0x3 The WDF request handle value The driver attempted to send a framework request that has already been sent to an I/O target.
0x4 A pointer to a WDR_REQUEST_FATAL_ERROR_INFORMATION_LENGTH_MISMATCH_DATA structure that contains a pointer to the IRP, a WDF request handle value, an IRP major function, and the number of bytes attempted to be written The driver has completed a framework request, but has written more bytes to the output buffer than are specified in the IRP.

If Parameter 1 is equal to 0xB, then an attempt to acquire or release a lock was invalid. In this case, Parameter 3 further specifies the error that has been made.

Parameter 2 Parameter 3 Cause of Error
The handle value 0x0 A handle passed to WdfObjectAcquireLock or WdfObjectReleaseLock represents an object that does not support synchronization locks.
A WDF spin lock handle 0x1 The spin lock is being released by a thread that did not acquire it.

Cause

See the description of each code in the Parameters section for an explanation of the cause.

Resolving the Problem

Typically, the dump file will yield further information on the driver that caused this bug check.

If Parameter 1 is equal to 0x2, examine the caller’s stack to determine the lock in question.

If Parameter 1 is equal to 0x3, the driver's Kernel-Mode Driver Framework error log will include details about the outstanding references.

If Parameter 1 is equal to 0x4, use the ln debugger command with the value of Parameter 3 as its argument to determine which function requires a non-NULL parameter.

If Parameter 1 is equal to 0x7, use the !wdfkd.wdfhandle Parameter 2 extension command to determine the handle type.

If Parameter 1 is equal to 0xA, then the WDF_QUEUE_FATAL_ERROR_DATA structure will indicate either the problematic request or the queue handle. It will also indicate the NTSTATUS, if not STATUS_SUCCESS, when available.

    WinDbg Output Example:
WDF_VIOLATION (10d)
The Kernel-Mode Driver Framework was notified that Windows detected an error
in a framework-based driver. In general, the dump file will yield additional
information about the driver that caused this bug check.
Arguments:
Arg1: 0000000000000004, A NULL parameter was passed to a function that required a non-
    NULL value. Use the "ln" debugger command with the value of
    Parameter 3 as its argument to determine the function which
    requires a non-NULL parameter.
Arg2: fffffa600085a7cb, Reserved.
Arg3: 0000000000000000, The caller's address.
Arg4: fffffa8008b09ca0, Reserved.


STOP 0x0000010E: VIDEO_MEMORY_MANAGEMENT_INTERNAL    (go to top of page)

Usual causes:  Video driver, ?Video memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557238(v=VS.85).aspx

    Knowledge Base Articles:
KB 953026     You receive a "STOP 0x0000010E" or "STOP 0x000000C1" error message on a Windows Vista-based computer or on a Windows Server 2008-based computer
KB 2551127    "0x0000010E" Stop error occurs on a computer that uses hybrid graphics in a heterogeneous GPU configuration and that is running Windows 7 or Windows Server 2008 R2

    WinDbg Help File Entry:

The VIDEO_MEMORY_MANAGEMENT_INTERNAL bug check has a value of 0x0000010E. This indicates that the video memory manager has encountered a condition that it is unable to recover from.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 is the only parameter of interest; this identifies the exact violation. Values for Parameter 1 that do not appear in this table must be individually examined.

Parameter 1 Cause of Error
0x1 An attempt was made to rotate a non-rotate range.
0x2 An attempt was made to destroy a non-empty process heap.
0x3 An attempt to unmap from an aperture segment failed.
0x4 A rotation in a must-succeed path failed.
0x5 A deferred command failed.
0x6 An attempt was made to reallocate resources for an allocation that was having its eviction canceled.
0x7 An invalid attempt was made to defer free usage.
0x8 The split direct memory access (DMA) buffer contains an invalid reference.
0x9 An attempt to evict an allocation failed.
0xA An invalid attempt to use a pinned allocation was made.
0xB A driver returned an invalid error code from BuildPagingBuffer.
0xC A resource leak was detected in a segment.
0xD A segment is being used improperly.
0xE An attempt to map an allocation into an aperture segment failed.
0xF A driver returned an invalid error code from AcquireSwizzlingRange.
0x10 A driver returned an invalid error code from ReleaseSwizzlingRange.
0x11 An invalid attempt to use an aperture segment was made.
0x12 A driver overflowed the provided DMA buffer.
0x13 A driver overflowed the provided private data buffer.
0x14 An attempt to purge all segments failed.
0x15 An attempt was made to free a virtual address descriptor (VAD) that was still in the rotated state
0x16 A driver broke the guaranteed DMA buffer model contract.
0x17 An unexpected system command failure occurred.
0x18 An attempt to release a pinned allocation's resource failed.
0x19 A driver failed to patch a DMA buffer.
0x1A The owner of a shared allocation was freed.
0x1B An attempt was made to release an aperture range that is still in use.

Cause

This bug check is usually caused by a video driver behaving improperly.

Resolving the Problem

If the problem persists, check Windows Update for an updated video driver.

    WinDbg Output Example:
VIDEO_MEMORY_MANAGEMENT_INTERNAL (10e)
The video memory manager encountered a condition that it can't recover from. By crashing,
the video memory manager is attempting to get enough information into the minidump such that
somebody can pinpoint what lead to this condition.
Arguments:
Arg1: 000000000000001f, The subtype of the bugcheck:
Arg2: fffff8a0082e2b60
Arg3: 0000000000000000
Arg4: 0000000000ddc61f


STOP 0x0000010F: RESOURCE_MANAGER_EXCEPTION_NOT_HANDLED    (go to top of page)

Usual causes:  

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557241(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The RESOURCE_MANAGER_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000010F. This indicates that the kernel transaction manager detected that a kernel-mode resource manager has raised an exception in response to a direct call-back. The resource manager is in an unexpected and unrecoverable state.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the exception record
2 The address of the context record
3 The address of the exception code
4 The address of the resource manager

    WinDbg Output Example:
Unknown bugcheck code (10f)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000110: DRIVER_INVALID_CRUNTIME_PARAMETER    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (110)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000111: RECURSIVE_NMI    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557246(v=VS.85).aspx

    Knowledge Base Articles:
KB 928786    You may receive a Stop error message on a computer that is running Windows Server 2003: "STOP: 0x00000111"

    WinDbg Help File Entry:
[This is preliminary documentation and subject to change.]

The RECURSIVE_NMI bug check has a value of 0x00000111. This bug check indicates that a non-maskable-interrupt (NMI) occurred while a previous NMI was in progress.

Comments

This bug check occurs when there is an error in the system management interrupt (SMI) code, and an SMI interrupts an NMI and enables interrupts. Execution then continues with NMIs enabled, and another NMI interrupts the NMI in progress.

    WinDbg Output Example:
Unknown bugcheck code (111)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000112: MSRPC_STATE_VIOLATION    (go to top of page)

Usual causes:  Msrpc.sys generated bug check

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557248(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The MSRPC_STATE_VIOLATION bug check has a value of 0x00000112. This indicates that the Msrpc.sys driver has initiated a bug check.

Parameters

The following parameters are displayed on the blue screen. Parameters 1 and 2 are the only parameters of interest. Parameter 1 indicates the state violation type; the value for Parameter 2 is determined by the value of Parameter 1.

Parameter 1 Parameter 2 Cause of Error
0x01 The exception code A non-continuable exception was continued by the caller.
0x02 The error The advanced local procedure call (ALPC) returned an invalid error.
0x03 The session to the server The caller unloaded the Microsoft remote procedure call (MSRPC) driver while it was still in use. It is likely that open binding handles remain.
0x04
and
0x05
The session to the server An invalid close command was received from the ALPC.
0x06 The binding handle An attempt was made to bind a remote procedure call (RPC) handle a second time.
0x07 The binding handle An attempt was made to perform an operation on a binding handle that was not bound.
0x08 The binding handle An attempt was made to set security information on a binding handle that was already bound.
0x09 The binding handle An attempt was made to set an option on a binding handle that was already bound.
0x0A
The call object An attempt was made to cancel an invalid asynchronous remote procedure call.
0x0B The call object An attempt was made to push on an asynchronous pipe call when it was not expected.
0x0C
and
0x0E
The pipe object An attempt was made to push on an asynchronous pipe without waiting for notification.
0x0F The pipe object An attempt was made to synchronously terminate a pipe a second time.
0x15 The object closest to the error An RPC internal error occurred.
0x16 Reserved Two causally ordered calls were issued in an order that cannot be enforced by the RPC.
0x17 The call object A server manager routine did not unsubscribe from notifications prior to completing the call.
0x18 The async handle An invalid operation on the asynchronous handle occurred.

Cause

The most common cause of this bug check is that the caller of the Msrpc.sys driver violated the state semantics for such a call.

    WinDbg Output Example:
MSRPC_STATE_VIOLATION (112)
This is a bugcheck initiated by MSRPC.SYS. The most common cause is that
the caller of MSRPC.SYS violated the state semantics for calling MSRPC.SYS.
See the parameters for more information.
Arguments:
Arg1: 0000000000000000, State violation type:
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000113: VIDEO_DXGKRNL_FATAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557253(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The VIDEO_DXGKRNL_FATAL_ERROR bug check has a value of 0x00000113. This indicates that the dxg kernel has detected a violation.

This bug check appears very infrequently.

    WinDbg Output Example:
VIDEO_DXGKRNL_FATAL_ERROR (113)
The dxgkrnl has detected that a violation has occurred. This resulted
in a condition that dxgkrnl can no longer progress.  By crashing, dxgkrnl
is attempting to get enough information into the minidump such that somebody
can pinpoint the crash cause. Any other values after parameter 1 must be
individually examined according to the subtype.
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck:
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000114: VIDEO_SHADOW_DRIVER_FATAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557257(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The VIDEO_SHADOW_DRIVER_FATAL_ERROR bug check has a value of 0x00000114. This indicates that the shadow driver has detected a violation.

This bug check appears very infrequently.

    WinDbg Output Example:
VIDEO_SHADOW_DRIVER_FATAL_ERROR (114)
The shadow driver has detected that a violation has occurred. This resulted
in a condition that shadow driver can no longer progress.  By crashing, shadow driver
is attempting to get enough information into the minidump such that somebody
can pinpoint the crash cause. Any other values after parameter 1 must be
individually examined according to the subtype.
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck:
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000115: AGP_INTERNAL    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557259(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The AGP_INTERNAL bug check has a value of 0x00000115. This indicates that the accelerated graphics port (AGP) driver has detected a violation.

This bug check appears very infrequently.

    WinDbg Output Example:
AGP_INTERNAL (115)
The AGP driver has detected that a violation has occurred. This resulted
in a condition that AGP driver can no longer progress.  By crashing, the AGP driver
is attempting to get enough information into the minidump such that somebody
can pinpoint the crash cause. Any other values after parameter 1 must be
individually examined according to the subtype.
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck:
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000116: VIDEO_TDR_ERROR    (go to top of page)

Usual causes:  Video driver, overheating, bad video card, ?BIOS, ?Power to card (see Significant Posts section below)

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557263(v=VS.85).aspx
    Other Articles:
http://www.carrona.org/VideoTDR.html
http://www.sevenforums.com/crashes-debugging/25912-bsod.html#post280172
http://forums.amd.com/game/messageview.cfm?catid=260&threadid=104677&enterthread=y
http://bsodanalysis.blogspot.com/2012/07/0x116-videotdrerror.html
https://bsodtutorials.wordpress.com/2013/06/14/debugging-stop-0x116stop-0x117/
https://bsodtutorials.wordpress.com/2013/12/29/timeout-detection-and-recovery-stop-0x116-internals/
       
    Knowledge Base Articles:
KB 971572    Error message when you hot-plug a display to the secondary display port on a computer that is running Windows Vista or Windows Server 2008: ""Stop 0x00000116"

    Significant posts:  
          http://www.carrona.org/VideoTDR.html

http://www.sevenforums.com/crashes-debugging/25912-bsod.html#post280172
"It's not a true crash, in the sense that the bluescreen was initiated only because the combination of video driver and video hardware was being unresponsive, and not because of any synchronous processing exception.

Since Vista, the "Timeout Detection and Recovery" (TDR) components of the OS video subsystem have been capable of doing some truly impressive things to try to recover from issues which would have caused earlier OSs like XP to crash. As a last resort, the TDR subsystem sends the video driver a "please restart yourself now!" command and waits a few seconds. If there's no response, the OS concludes that the video driver/hardware combo has truly collapsed in a heap, and it fires off that stop 0x116 BSOD.

If playing with video driver versions hasn't helped, make sure the box is not overheating. Try removing a side panel and aiming a big mains fan straight at the motherboard and GPU. Run it like that for a few hours or days - long enough to ascertain whether cooler temperatures make a difference. If so, it might be as simple as dust buildup and subsequently inadequate cooling." - H2SO4

http://forums.amd.com/game/messageview.cfm?catid=260&threadid=104677&enterthread=y

    WinDbg Help File Entry:

The VIDEO_TDR_ ERROR bug check has a value of 0x00000116. This indicates that an attempt to reset the display driver and recover from a timeout failed.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The pointer to the internal TDR recovery context, if available.
2 A pointer into the responsible device driver module (for example, the owner tag).
3 The error code of the last failed operation, if available.
4 Reserved.

    WinDbg Output Example:
VIDEO_TDR_FAILURE (116)
Attempt to reset the display driver and recover from timeout failed.
Arguments:
Arg1: fffffa80043984e0, Optional pointer to internal TDR recovery context (TDR_RECOVERY_CONTEXT).
Arg2: fffff88004683d9c, The pointer into responsible device driver module (e.g. owner tag).
Arg3: 0000000000000000, Optional error code (NTSTATUS) of the last failed operation.
Arg4: 0000000000000002, Optional internal context dependent data.



STOP 0x00000117: VIDEO_TDR_TIMEOUT_DETECTED    (go to top of page)

Usual causes:  Video driver/sub-system

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557271(v=VS.85).aspx
    Other Articles:
http://www.carrona.org/VideoTDR.html
http://www.sevenforums.com/crashes-debugging/25912-bsod.html#post280172
http://forums.amd.com/game/messageview.cfm?catid=260&threadid=104677&enterthread=y
https://bsodtutorials.wordpress.com/2013/06/14/debugging-stop-0x116stop-0x117/
https://bsodtutorials.wordpress.com/2013/12/29/timeout-detection-and-recovery-stop-0x116-internals/
       
    Knowledge Base Articles:
KB 2665946    Display driver stopped responding and has recovered Error message in Windows Vista or Windows 7

    Significant posts: 
http://www.carrona.org/VideoTDR.html
http://www.sevenforums.com/crashes-debugging/25912-bsod.html#post280172
"It's not a true crash, in the sense that the bluescreen was initiated only because the combination of video driver and video hardware was being unresponsive, and not because of any synchronous processing exception.

Since Vista, the "Timeout Detection and Recovery" (TDR) components of the OS video subsystem have been capable of doing some truly impressive things to try to recover from issues which would have caused earlier OSs like XP to crash. As a last resort, the TDR subsystem sends the video driver a "please restart yourself now!" command and waits a few seconds. If there's no response, the OS concludes that the video driver/hardware combo has truly collapsed in a heap, and it fires off that stop 0x116 BSOD.

If playing with video driver versions hasn't helped, make sure the box is not overheating. Try removing a side panel and aiming a big mains fan straight at the motherboard and GPU. Run it like that for a few hours or days - long enough to ascertain whether cooler temperatures make a difference. If so, it might be as simple as dust buildup and subsequently inadequate cooling." - H2SO4

http://forums.amd.com/game/messageview.cfm?catid=260&threadid=104677&enterthread=y


    WinDbg Help File Entry:

The VIDEO_TDR_TIMEOUT_DETECTED bug check has a value of 0x00000117. This indicates that the display driver failed to respond in a timely fashion.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The pointer to the internal TDR recovery context, if available.
2 A pointer into the responsible device driver module (for example, the owner tag).
3 The secondary driver-specific bucketing key.
4 Reserved.

    WinDbg Output Example:
VIDEO_TDR_TIMEOUT_DETECTED (117)
The display driver failed to respond in timely fashion.
(This code can never be used for real bugcheck).
Arguments:
Arg1: fffffa8009651010, Optional pointer to internal TDR recovery context (TDR_RECOVERY_CONTEXT).
Arg2: fffffa6003619574, The pointer into responsible device driver module (e.g owner tag).
Arg3: 0000000000000000, The secondary driver specific bucketing key.
Arg4: 0000000000000000, Optional internal context dependent data.



STOP 0x00000118: NTHV_GUEST_ERROR    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (118)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000119: VIDEO_SCHEDULER_INTERNAL_ERROR    (go to top of page)

Usual causes:  Video driver/sub-system

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557275(v=VS.85).aspx
    Other Articles:
http://www.carrona.org/VideoTDR.html - OK to use with STOP 0x119 errors
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/273-0x119-video_scheduler_internal_error-fence-ids.html
        https://bsodtutorials.wordpress.com/2013/06/14/debugging-stop-0x119/
        https://bsodtutorials.wordpress.com/2014/01/04/debugging-stop-0x119-invalid-fence-ids/

    Knowledge Base Articles:

    Suggested post for troubleshooting:  
http://www.carrona.org/VideoTDR.html - OK to use with STOP 0x119 errors

    WinDbg Help File Entry:

The VIDEO_SCHEDULER_INTERNAL_ERROR bug check has a value of 0x00000119. This indicates that the video scheduler has detected a fatal violation.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 is the only parameter of interest and identifies the exact violation.

Parameter 1 Cause of Error
0x1 The driver has reported an invalid fence ID.
0x2 The driver failed upon the submission of a command.
0x3 The driver failed upon patching the command buffer.
0x4 The driver reported an invalid flip capability.

    WinDbg Output Example:
VIDEO_SCHEDULER_INTERNAL_ERROR (119)
The video scheduler has detected that fatal violation has occurred. This resulted
in a condition that video scheduler can no longer progress. Any other values after
parameter 1 must be individually examined according to the subtype.
Arguments:
Arg1: 0000000007000000, The subtype of the bugcheck:
Arg2: fffffa8005544010
Arg3: fffffa80065db100
Arg4: fffffa8004e3a0c0


STOP 0x0000011A: EM_INITIALIZATION_FAILURE    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557279(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The EM_INITIALIZATION_FAILURE bug check has a value of 0x0000011A.

This bug check appears very infrequently.

    WinDbg Output Example:
EM_INITIALIZATION_ERROR (11a)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000011B: DRIVER_RETURNED_HOLDING_CANCEL_LOCK    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557284(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:
[This is preliminary documentation and subject to change.]

The DRIVER_RETURNED_HOLDING_CANCEL_LOCK bug check has a value of 0x0000011B. This bug check indicates that a driver has returned from a cancel routine that holds the global cancel lock. This causes all later cancellation calls to fail, and results in either a deadlock or another bug check.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the IRP that was canceled (might not be valid).
2 The address of the cancel routine.

Comments

The cancel spin lock should have been released by the cancel routine.

The driver calls the IoCancelIrpIoCancelIrp function to cancel an individual I/O request packet (IRP). This function acquires the cancel spin lock, sets the cancel flag in the IRP, and then calls the cancel routine specified by the appropriate field in the IRP, if a routine was specified. The cancel routine is expected to release the cancel spin lock. If there is no cancel routine, the cancel spin lock is released.

    WinDbg Output Example:
A driver has returned from a cancellation routine holding the global cancel
lock.  This will result in any subsequent cancellation calls to fail either
resulting in a deadlock or another bugcheck.
Arguments:
Arg1: 0000000000000000, The address of the IRP that was cancelled (may not be valid).
Arg2: 0000000000000000, The address of the cancel routine.
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000011C: ATTEMPTED_WRITE_TO_CM_PROTECTED_STORAGE    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557292(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:
[This is preliminary documentation and subject to change.]

The ATTEMPTED_WRITE_TO_CM_PROTECTED_STORAGE bug check has a value of 0x0000011C. This bug check indicates that an attempt was made to write to the read-only protected storage of the configuration manager.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Virtual address for the attempted write
2 PTE contents
3 Reserved
4 Reserved

Comments

When it is possible, the name of the driver that is attempting the write operation is printed as a Unicode string on the bug check screen and then saved in KiBugCheckDriver.

    WinDbg Output Example:
ATTEMPTED_WRITE_TO_CM_PROTECTED_STORAGE (11c)
An attempt was made to write to the read-only protected storage of the
configuration manager.
An attempt was made to write to the read-only protected storage of the
configuration manager.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 0000000000000000, Virtual address for the attempted write.
Arg2: 0000000000000000, PTE contents.
Arg3: 0000000000000000, (reserved)
Arg4: 0000000000000000, (reserved)


STOP 0x0000011D: EVENT_TRACING_FATAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557296(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:
[This is preliminary documentation and subject to change.]

The EVENT_TRACING_FATAL_ERROR bug check has a value of 0x0000011D. This bug check indicates that the Event Tracing subsystem has encountered an unexpected fatal error.

    WinDbg Output Example:
EVENT_TRACING_FATAL_ERROR (11d)
Event Tracing subsystem has encountered an unexpected fatal error. First parameter indicates
the type of failure.
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000011E: TOO_MANY_RECURSIVE_FAULTS    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
TOO_MANY_RECURSIVE_FAULTS (11e)
DESCRIPTION
A file system has caused too many recursive faults under low resource
conditions to be handled.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000011F: INVALID_DRIVER_HANDLE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
INVALID_DRIVER_HANDLE (11f)
Someone has closed the initial handle for a driver between inserting the driver
object and referencing the handle.
Arguments:
Arg1: 0000000000000000, The handle value for the driver object.
Arg2: 0000000000000000, The status returned trying to reference the object.
Arg3: 0000000000000000, The address of the PDRIVER_OBJECT.
Arg4: 0000000000000000


STOP 0x00000120: BITLOCKER_FATAL_ERROR    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
BITLOCKER_FATAL_ERROR (120)
BitLocker Drive Encryption encountered a problem that it cannot recover from.
Arguments:
Arg1: 0000000000000000, Type of problem
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000121: DRIVER_VIOLATION    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557307(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:
[This is preliminary documentation and subject to change.]

The DRIVER_VIOLATION bug check has a value of 0x00000121. This bug check indicates that a driver has caused a violation.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Describes the type of violation
2 Reserved
3 Reserved

Comments

Use a kernel debugger and view the call stack to determine the name of the driver that caused the violation.

    WinDbg Output Example:
DRIVER_VIOLATION (121)
A driver has caused a violation. Parameter 1 describes the type of violation.
Look at the call stack to determine the misbehaving driver.
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000122: WHEA_INTERNAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557313(v=VS.85).aspx
    Other Articles:
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/13977-debugging-stop-0x122-whea_internal_error.html

    Knowledge Base Articles:

    WinDbg Help File Entry:
[This is preliminary documentation and subject to change.]

The WHEA_INTERNAL_ERROR bug check has a value of 0x00000122. This bug check indicates that an internal error in the Windows Hardware Error Architecture (WHEA) has occurred.

    WinDbg Output Example:
WHEA_INTERNAL_ERROR (122)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000123: CRYPTO_SELF_TEST_FAILURE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
WHEA_INTERNAL_ERROR (122)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000124: WHEA_UNCORRECTABLE_ERROR    (go to top of page)

Usual causes:  Hardware, Incompatibility, May be driver corruption

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557321(v=VS.85).aspx
    Other Articles:
        http://www.sevenforums.com/crash-lockup-debug-how/35349-2-int-stop-0x124-what-means-what-try.html
        https://bsodtutorials.wordpress.com/2015/07/24/the-complete-debugging-guide-to-stop-0x124-part-1/
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/16691-complete-guide-debugging-stop-0x124.html
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/327-pci-e-whea-errors-0x124.html
        https://bsodtutorials.wordpress.com/2013/05/29/debugging-stop-0x124/
        https://bsodtutorials.wordpress.com/2013/10/23/debugging-stop-0x124-calculating-clockspeed-without-sysinfo-cpuspeed/
        https://bsodtutorials.wordpress.com/2013/10/01/debugging-stop-0x124-cpu-mnemonics/
        https://bsodtutorials.wordpress.com/2013/11/26/debugging-stop-0x124-sysinfo-cpuinfo-whea-and-errpkt/
        https://bsodtutorials.wordpress.com/2013/11/16/debugging-stop-0x124-pcie-errors-part-1/
        https://bsodtutorials.wordpress.com/2013/11/17/debugging-stop-0x124-pcie-errors-part-2/
        https://bsodtutorials.wordpress.com/2013/11/17/debugging-stop-0x124-pcie-errors-part-3/
        https://bsodtutorials.wordpress.com/2013/12/02/debugging-stop-0x124-using-whea/
        https://bsodtutorials.wordpress.com/2015/07/24/the-complete-debugging-guide-to-stop-0x124-part-1/
        https://bsodtutorials.wordpress.com/2015/08/03/the-complete-debugging-guide-to-stop-0x124-part-2/
        https://bsodtutorials.wordpress.com/2015/08/07/the-complete-debugging-guide-to-stop-0x124-part-3/
        http://bsoddebugging.blogspot.com/2014/06/debugging-0x124.html

    Knowledge Base Articles:
KB 952681    A "0x00000124" Stop error message occurs when you use the "hot plugging" feature to add or to remove a PCI Express device on a Windows Server 2008-based computer or on a Windows Vista-based computer
KB 967915    STOP 0x124 miniport reset due to slow OID_PNP_SET_POWER (Server 2008)
KB 968992    Stop error message when you use the Safely Remove Hardware option to remove a PCI Express device that supports hot plugging on a computer that is running Windows Server 2008 or Windows Vista: "0x00000124"

Significant posts:  
            http://www.sevenforums.com/crash-lockup-debug-how/35349-2-int-stop-0x124-what-means-what-try.html

    WinDbg Help File Entry:
[This is preliminary documentation and subject to change.]

The WHEA_UNCORRECTABLE_ERROR bug check has a value of 0x00000124. This bug check indicates that a fatal hardware error has occurred. This bug check uses the error data that is provided by the Windows Hardware Error Architecture (WHEA).

Parameters
Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of error
0x0 Address of WHEA_ERROR_RECORD structure. High 32 bits of MCi_STATUS MSR for the MCA bank that had the error. Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error. A machine check exception occurred.

These parameter descriptions apply if the processor is based on the x64 architecture, or the x86 architecture that has the MCA feature available (for example, Intel Pentium Pro, Pentium IV, or Xeon).

0x1 Address of WHEA_ERROR_RECORD structure. Reserved. Reserved. A corrected machine check exception occurred.
0x2 Address of WHEA_ERROR_RECORD structure. Reserved. Reserved. A corrected platform error occurred.
0x3 Address of WHEA_ERROR_RECORD structure. Reserved. Reserved. A nonmaskable Interrupt (NMI) error occurred.
0x4 Address of WHEA_ERROR_RECORD structure. Reserved Reserved. An uncorrectable PCI Express error occurred.
0x5 Address of WHEA_ERROR_RECORD structure. Reserved. Reserved. A generic hardware error occurred.
0x6 Address of WHEA_ERROR_RECORD structure Reserved. Reserved. An IA64 INIT error occurred.
0x7 Address of WHEA_ERROR_RECORD structure. Reserved. Reserved. A BOOT error occurred.
0x8 Address of WHEA_ERROR_RECORD structure Reserved. Reserved. A Scalable Coherent Interface (SCI) generic error occurred.
0x9 Address of WHEA_ERROR_RECORD structure. Length, in bytes, of the SAL log. Address of the SAL log. An uncorrectable IA-64 machine check abort error occurred.
0xA Address of WHEA_ERROR_RECORD structure Reserved. Reserved. A corrected IA-64 machine check error occurred.
0xB Address of WHEA_ERROR_RECORD structure. Reserved. Reserved. A corrected IA-64 platform error occurred.

Comments

Parameter 1 identifies the type of error source that reported the error. Parameter 2 holds the address of the WHEA_ERROR_RECORD structure that describes the error condition.

For information about WHEA, see Windows Hardware Error Architecture Design Guide within the WDK documentation .

Note  This bug check is not supported in Windows versions prior to Windows Vista. Instead, machine check exceptions are reported through bug check 0x9C.

    WinDbg Output Examples:
WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: fffffa800677f8f8, Address of the WHEA_ERROR_RECORD structure.
Arg3: 0000000000000000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000000000, Low order 32-bits of the MCi_STATUS value.

WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 00000004, PCI Express Error
Arg2: 84e39024, Address of the WHEA_ERROR_RECORD structure.
Arg3: 00000000
Arg4: 00000000



STOP 0x00000125: NMR_INVALID_STATE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
NMR_INVALID_STATE (125)
NMR (network module registrar) has detected an invalid state. Parameter 1 describes
the type of the state.
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000126: NETIO_INVALID_POOL_CALLER    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
NETIO_INVALID_POOL_CALLER (126)
An invalid pool request has been made to netio managed memory pool (e.g. FSB and MDL).
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000127: PAGE_NOT_ZERO    (go to top of page)

Usual causes:  Hardware, Memory, Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557326(v=VS.85).aspx

    Knowledge Base Articles:
KB 925528    Stop errors occur on a Windows-based computer that has 2GB or more of RAM and is using an NVIDIA nForce USB controller (XP, Server 2003, Vista)
KB 929734    You have problems after you resume a Windows Vista-based computer from sleep or from hibernation


    WinDbg Help File Entry:
[This is preliminary documentation and subject to change.]

The PAGE_NOT_ZERO bug check has a value of 0x00000127. This bug check indicates that a page that should have been filled with zeros was not. This bug check might occur because of a hardware error or because a privileged component of the operating system modified a page after freeing it.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Virtual address that maps the corrupted page
2 Physical page number
3 Zero (Reserved)
4 Zero (Reserved)

    WinDbg Output Example:
PAGE_NOT_ZERO (127)
This bugcheck indicates that a page that should have been filled with zero was not.  Typically this is due to a hardware error or some privileged component modified a page after freeing it.
Arguments:
Arg1: 0000000000000000, virtual address mapping the corrupted page
Arg2: 0000000000000000, physical page number
Arg3: 0000000000000000, zero
Arg4: 0000000000000000, zero


STOP 0x00000128: WORKER_THREAD_RETURNED_WITH_BAD_IO_PRIORITY    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557329(v=VS.85).aspx
    Other Articles:
        https://bsodtutorials.wordpress.com/2013/12/04/debugging-stop-0x128-worker-routines-and-io-priorities/

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
WORKER_THREAD_RETURNED_WITH_BAD_IO_PRIORITY (128)
A worker threads IOPriority was wrongly modified by the called worker routine.
Arguments:
Arg1: 0000000000000000, address of worker routine (do ln on this to find guilty driver)
Arg2: 0000000000000000, Current IoPrioirity value
Arg3: 0000000000000000, workitem parameter
Arg4: 0000000000000000, workitem address


STOP 0x00000129: WORKER_THREAD_RETURNED_WITH_BAD_PAGING_IO_PRIORITY    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
WORKER_THREAD_RETURNED_WITH_BAD_PAGING_IO_PRIORITY (129)
A worker threads Paging IOPriority was wrongly modified by the called worker routine.
Arguments:
Arg1: 0000000000000000, address of worker routine (do ln on this to find guilty driver)
Arg2: 0000000000000000, Current Paging IoPrioirity value
Arg3: 0000000000000000, workitem parameter
Arg4: 0000000000000000, workitem address


STOP 0x0000012A: MUI_NO_VALID_SYSTEM_LANGUAGE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
MUI_NO_VALID_SYSTEM_LANGUAGE (12a)
Windows did not find any installed, licensed language packs for the system default UI language.
Arguments:
Arg1: 0000000000000000, The subtype of the bugcheck.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000012B: FAULTY_HARDWARE_CORRUPTED_PAGE    (go to top of page)

Usual causes:  Hardware memory error

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/windows/hardware/ff557329%28v=vs.85%29.aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:
[This is preliminary documentation and subject to change.]

The FAULTY_HARDWARE_CORRUPTED_PAGE bug check has a value of 0x00000128. This bug check indicates that a single-bit error was found in this page. This is a hardware memory error.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Virtual address maps to the corrupted page
2 Physical page number
3 Zero (Reserved)
4 Zero (Reserved)

    WinDbg Output Example:
FAULTY_HARDWARE_CORRUPTED_PAGE (12b)
This bugcheck indicates that a single bit error was found in this page.  This is a hardware memory error.
Arguments:
Arg1: 0000000000000000, virtual address mapping the corrupted page
Arg2: 0000000000000000, physical page number
Arg3: 0000000000000000, zero
Arg4: 0000000000000000, zero


STOP 0x0000012C: EXFAT_FILE_SYSTEM    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557339(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:
[This is preliminary documentation and subject to change.]

The EXFAT_FILE_SYSTEM bug check has a value of 0x0000012C. This bug check indicates that a problem occurred in the Extended File Allocation Table (exFAT) file system.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") determine the source file by its identifier number. The low 16 bits determine the source line in the file where the bug check occurred.
2 If FppExceptionFilter is on the stack, this parameter specifies the address of the exception record.
3 If FppExceptionFilter is on the stack, this parameter specifies the address of the context record.
4 Reserved.

Cause

This bug check is caused by the file system as a last resort when its internal accounting is in an unsupportable state and to continue poses a large risk of data loss. The file system never causes this bug check when the on disk structures are corrupted, the disk sectors go bad, or a memory allocation fails. Bad sectors could lead to a bug check, for example, when a page fault occurs in kernel code or data and the memory manager cannot read the pages. However, for this bug check, the file system is not the cause.

Resolving the Problem

To debug this problem: Use the .cxr (Display Context Record) command together with Parameter 3, and then use kb (Display Stack Backtrace).

    WinDbg Output Example:
EXFAT_FILE_SYSTEM (12c)
    If you see FppExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000012D: VOLSNAP_OVERLAPPED_TABLE_ACCESS    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
VOLSNAP_OVERLAPPED_TABLE_ACCESS (12d)
This bugcheck indicates that a volsnap tried to access a common table
from two different threads which may result in table corruption and
eventually corrupt the table.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000012E: INVALID_MDL_RANGE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:
KB 2780444    "0x0000012E" Stop error occurs when an application sends a 12-byte SCSI opcode to an iSCSI target in Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows Server 2008 R2 SP1

    WinDbg Help File Entry:

    WinDbg Output Example:
INVALID_MDL_RANGE (12e)
A driver has called the IoBuildPartialMdl() function and passed it an MDL
to map part of a source MDL, but the virtual address range specified is
outside the range in the source MDL.  This is a driver bug.  The source
and target MDLs, as well as the address range length to be mapped are the
arguments to the IoBuildPartialMdl() function, i.e.;
    IoBuildPartialMdl(
        IN PMDL SourceMdl,
        IN OUT PMDL TargetMdl,
        IN PVOID VirtualAddress,
        IN ULONG Length
        )
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000012F: VHD_BOOT_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
VHD_BOOT_INITIALIZATION_FAILED (12f)
An initialization failure occurred while attempting to boot from a VHD.
Arguments:
Arg1: 0000000000000000, Action that failed
Arg2: 0000000000000000, NT status code
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000130: DYNAMIC_ADD_PROCESSOR_MISMATCH    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
DYNAMIC_ADD_PROCESSOR_MISMATCH (130)
This bugcheck indicates that a new processor added to the system is
incompatible with the current configuration.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000131: INVALID_EXTENDED_PROCESSOR_STATE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
INVALID_EXTENDED_PROCESSOR_STATE (131)
Invalid combination of parameters was detected while saving or restoring
extended processor state.
Arguments:
Arg1: 0000000000000000, Invalid feature mask was passed or extended processor state is
    not enabled.
Arg2: 0000000000000000, Nonzero if extended state is enabled.
Arg3: 0000000000000000, The low 32 bits of the feature mask.
Arg4: 0000000000000000, The high 32 bits of the feature mask.


STOP 0x00000132: RESOURCE_OWNER_POINTER_INVALID    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (132)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000133: DPC_WATCHDOG_VIOLATION    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/windows/hardware/jj154556%28v=vs.85%29.aspx
    Troubleshooting STOP 0x133's:  http://blogs.msdn.com/b/ntdebugging/archive/2012/12/07/determining-the-source-of-bug-check-0x133-dpc-watchdog-violation-errors-on-windows-server-2012.aspx
    Other Articles:
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/11184-dpc_watchdog_timeout-debugging.html
        https://www.sysnative.com/forums/bsod-kernel-dump-analysis-debugging-information/9310-dpc_watchdog_violation-0x133.html
        https://blogs.msdn.microsoft.com/ntdebugging/2012/12/07/determining-the-source-of-bug-check-0x133-dpc_watchdog_violation-errors-on-windows-server-2012/
        https://bsodtutorials.wordpress.com/2014/02/12/debugging-stop-0x133-and-dpc-internals/
        http://bsoddebugging.blogspot.com/2014/09/0x133-dpcwatchdogviolation.html

    Knowledge Base Articles:
KB 2789962    You receive a "DPC_WATCHDOG_VIOLATION (133)" Stop error message on a Windows Server 2012-based computer
KB 2927725    "0x133", "0x101" Stop error or system stops responding when hot adding a CPU core to a computer (Windows 8/Server 2012)

    WinDbg Help File Entry:

    WinDbg Output Example:
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
component can usually be identified with a stack trace. (Arg1 of 1 usually requires an ETW trace to find the faulting driver - see troubleshooting article above)
Arg2: 0000000000000281, The DPC time count (in ticks).
Arg3: 0000000000000280, The DPC time allotment (in ticks).
Arg4: 0000000000000000


STOP 0x00000134: DRIVE_EXTENDER    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (134)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000135: REGISTRY_FILTER_DRIVER_EXCEPTION    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
REGISTRY_FILTER_DRIVER_EXCEPTION (135)
This bugcheck is caused by an unhandled exception in a registry filtering driver.
This bugcheck indicates that a registry filtering driver didn't handle exception inside
its notification routine. One can identify the driver by the 3rd parameter.
Arguments:
Arg1: ffffffffc000001d, ExceptionCode
Arg2: fffff88006e765f0, Address of the context record for the exception that caused the bugcheck
Arg3: fffff88004d526e0, The driver's callback routine address
Arg4: fffff8a000be3a40, Internal


STOP 0x00000136: VHD_BOOT_HOST_VOLUME_NOT_ENOUGH_SPACE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:
KB 2020922    "Stop 0x00000136" error when you try to perform a native boot from a VHD (Windows 7/Server 2008 R2)

    WinDbg Help File Entry:

    WinDbg Output Example:
VHD_BOOT_HOST_VOLUME_NOT_ENOUGH_SPACE (136)
An initialization failure occurred while attempting to boot from a VHD.
The volume that hosts the VHD does not have enough free space to expand the VHD.
Arguments:
Arg1: 0000000000000000, Unable to expand VHD file to full size.
Arg2: ffffffffc000007f, NT status code
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000137: WIN32K_HANDLE_MANAGER    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000138: GPIO_CONTROLLER_DRIVER_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/windows/hardware/jj191737%28v=vs.85%29.aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000139: KERNEL_SECURITY_CHECK_FAILURE    (go to top of page)

Usual causes: 

Found in this topic - waiting on dump files to be posted:  http://answers.microsoft.com/en-us/windows/forum/windows_8-hardware/i-am-getting-a-bugcheck-error-0x00000139-any-idea/ed686d86-06f0-4bae-9a8f-c02db923f1f5?tab=AllReplies#tabs
Article by Alex Ionescu (co-author of Windows Internals):  http://www.alex-ionescu.com/?p=69
Found in this topic with dump file:    http://answers.microsoft.com/en-us/windows/forum/windows_8-system/kernel-security-check-failure-bsod-crash/786b6cec-5cd7-4c32-9e52-dc1dd9883390

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/windows/hardware/jj569891%28v=vs.85%29.aspx

    Knowledge Base Articles:
KB 2883658    "0x00000139" Stop error on a Windows Server 2012-based computer that has many TCP connections

    WinDbg Help File Entry:

    WinDbg Output Example:
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff8800e54f3b0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff8800e54f308, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved


STOP 0x0000013A: KERNEL_MODE_HEAP_CORRUPTION    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000013B: PASSIVE_INTERRUPT_ERROR    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000013C: INVALID_IO_BOOST_STATE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000013D: CRITICAL_INITIALIZATION_FAILURE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000013E: xx    (go to top of page)

Usual causes:  Not documented in in Win8 DP SDK v8.0

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000013F: xx    (go to top of page)

Usual causes:  Not documented in in Win8 DP SDK v8.0

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000140: STORAGE_DEVICE_ABNORMALITY_DETECTED    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000141: VIDEO_ENGINE_TIMEOUT_DETECTED    (go to top of page)

Usual causes: 
    Other Articles:
http://www.carrona.org/VideoTDR.html - OK to use with STOP 0x119 errors

    Knowledge Base Articles:

    Suggested post for troubleshooting: 
http://www.carrona.org/VideoTDR.html - OK to use with STOP 0x119 errors

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000142: VIDEO_TDR_APPLICATION_BLOCKED    (go to top of page)

Usual causes: 
    Other Articles:
http://www.carrona.org/VideoTDR.html - OK to use with STOP 0x119 errors

    Knowledge Base Articles:

    Suggested post for troubleshooting: 
http://www.carrona.org/VideoTDR.html - OK to use with STOP 0x119 errors

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000143: PROCESSOR_DRIVER_INTERNAL    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000144: BUGCODE_USB3_DRIVER    (go to top of page)

Usual causes:  USB3 Drivers (No duh!)

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/windows/hardware/hh450914%28v=vs.85%29.aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

[This documentation is preliminary and is subject to change.]

The BUGCODE_USB3_DRIVER bug check has a value of 0x00000144. This is the code used for all USB 3 bug checks. Parameter 1 specifies the type of the USB 3 bug check, and the meanings of the other parameters are dependent on Parameter 1.

Parameters

The following parameters are displayed on the blue screen.
Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of error
0x1
Optional. Pointer to the IRP used to resend the URB
Pointer to the URB
Pointer to the client driver's device object
A client driver used an URB that it had previously sent to the core stack.
0x2
Pointer to the physical device object (PDO) for the boot device
Reserved
Reserved
A boot or paging device failed re-enumeration.
0x3
Optional. Pointer to the IRP used to send the URB
Pointer to the corrupted URB
Pointer to the client driver's device object
A client driver sent a corrupted URB to the core stack. This can happen because the client driver did not allocate the URB using USBD_xxxUrbAllocate or because the client driver did a buffer underrun for the URB.
0x800
IRQL at which the Open Static Streams request was sent
Pointer to the Open Static Streams IRP
Pointer to the client driver's device object
An Open Static Streams request was sent at IRQL > PASSIVE LEVEL.
0x801
Pointer to the Open Static Streams IRP
Pointer to the Open Static Streams URB
Pointer to the client driver's device object
A client driver attempted to open static streams before querying for streams capability. A client driver cannot open a static stream until after it successfully queries for the streams capability. For more information, see Remarks.
0x802
Number of static streams that the client driver tried to open
Number of static streams that were granted to the client driver
Pointer to the client driver's device object
A Client driver tried to open an invalid number of static streams. The number of streams cannot be 0 and cannot be greater than the value returned to the client driver in the query USB capability call.
0x803
Pointer to the Open Static Streams IRP
Pointer to the Open Static Streams URB
Pointer to the client driver's device object
A client driver attempted to open static streams for an endpoint that already had static streams open. Before opening static streams, the client driver must close the previously opened static streams.
0x804
The leaked handle context. Run !usbanalyze -v to get information about the leaked handle and URBs. You must enable Driver Verifier for the client driver.
Device object passed to USBD_CreateHandle.
Reserved
A client driver forgot to close a handle it created earlier using USBD_CreateHandle or forgot to free an URB it allocated.
0x805
WDFREQUEST handle for the Close Static Streams URB
Pointer to the Close Static Streams URB
Pointer to the client driver's device object
A client driver sent a Close Static Streams URB in an invalid state (for example, after processing D0 Exit).
0x806
Pointer to the IRP
Pointer to the URB
Pointer to the client driver's device object
A client driver attempted to send a chained MDL before querying for chained MDL capability. A client driver cannot send a chained MDL until after it successfully queries for the chained MDL capability. For more information, see Remarks.
0x807
Pointer to the chained MDL
Pointer to the URB
Pointer to the client driver's device object if available
A client driver sent an URB to the core stack with a transfer buffer length longer than the byte count (returned by MmGetMdlByteCount) of the MDL passed in. For more information, see Remarks.

Remarks

To query for a USB capability, the client driver must call WdfUsbTargetDeviceQueryUsbCapability or USBD_QueryUsbCapability
To send a chained MDL, the client driver must call USBD_QueryUsbCapability and use URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER_USING_CHAINED_MDL or URB_FUNCTION_ISOCH_TRANSFER_USING_CHAINED_MDL.


    WinDbg Output Example:


STOP 0x00000145: SECURE_BOOT_VIOLATION    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000146: NDIS_NET_BUFFER_LIST_INFO_ILLEGALLY_TRANSFERRED    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000147: ABNORMAL_RESET_DETECTED    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000148: IO_OBJECT_INVALID    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000149: REFS_FILE_SYSTEM    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000014A: KERNEL_WMI_INTERNAL    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:



STOP 0x0000014B: SOC_SUBSYSTEM_FAILURE    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/windows/hardware/hh995020%28v=vs.85%29.aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:
The SOC_SUBSYSTEM_FAILURE bug check has a value of 0x0000014B. This indicates that an unrecoverable error was encountered in a System on a Chip (SoC) subsystem. Important Info If You Have Received a STOP Code If you received a blue screen error, or stop code, the computer has shut down abruptly to protect itself from data loss. A hardware device, its driver, or related software might have caused this error. If your copy of Windows came with your computer, call the manufacturer of your computer. If you purchased Windows separately from your computer, Microsoft provides support. To find contact info for Microsoft or your computer manufacturer, Contact Support. If you have experience with computers and want to try to recover from this error, follow the steps provided in the Microsoft article Resolving STOP (Blue Screen) Errors in Windows. These actions might prevent an error like this from happening again: Download and install updates and device drivers for your computer from Windows Update. Scan your computer for computer viruses. Check your hard disk for errors.

Bug Check 0x14B SOC_SUBSYSTEM_FAILURE
Parameters The following parameters are displayed on the blue screen.
Parameter Description
1 Specifies the subsystem that caused the failure. 0: Wireless modem 1: Audio DSP 2: Wireless connectivity 3: Sensors
2 Reserved.
3 Reserved.
4 Reserved.  

    WinDbg Output Example:


STOP 0x0000014C:  FATAL_ABNORMAL_RESET_ERROR    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000014D:  EXCEPTION_SCOPE_INVALID    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000014E:  SOC_CRITICAL_DEVICE_REMOVED    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000014F:  PDC_WATCHDOG_TIMEOUT    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000150:  TCPIP_AOAC_NIC_ACTIVE_REFERENCE_LEAK    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000151:  UNSUPPORTED_INSTRUCTION_MODE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000152:  INVALID_PUSH_LOCK_FLAGS    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000153:  KERNEL_LOCK_ENTRY_LEAKED_ON_THREAD_TERMINATION    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
KERNEL_LOCK_ENTRY_LEAKED_ON_THREAD_TERMINATION (153)
A thread was terminated before it had freed all its AutoBoost lock entries.
This is typically caused when a thread never released a lock it previously
acquired (e.g. by relying on another thread to release it), or if the thread
did not supply a consistent set of flags to lock package APIs.
Arguments:
Arg1: 8857a300, The address of the thread
Arg2: 8857a5d8, The address of the entry that was not freed
Arg3: 00000001, Lock pointer was not NULL
Arg4: 00000000, Reserved




STOP 0x00000154:  UNEXPECTED_STORE_EXCEPTION    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000155:  OS_DATA_TAMPERING    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000156:  WINSOCK_DETECTED_HUNG_CLOSESOCKET_LIVEDUMP    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000157:  KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:



STOP 0x00000158:  ILLEGAL_IOMMU_PAGE_FAULT    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000159:  HAL_ILLEGAL_IOMMU_PAGE_FAULT    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000015A:  SDBUS_INTERNAL_ERROR    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000015B:  WORKER_THREAD_RETURNED_WITH_SYSTEM_PAGE_PRIORITY_ACTIVE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000015C:  PDC_WATCHDOG_TIMEOUT_LIVEDUMP    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000015D:  SOC_SUBSYSTEM_FAILURE_LIVEDUMP    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/windows/hardware/dn376329%28v=vs.85%29.aspx
                              (I have some doubt about the accuracy of the info at this link - as it refers to Bug Check 0x14B SOC_SUBSYSTEM_FAILURE)

    Knowledge Base Articles:

    WinDbg Help File Entry:

No entry in the WinDbg Help File - despite the entry at MSDN

    WinDbg Output Example:


STOP 0x0000015E:  BUGCODE_NDIS_DRIVER_LIVE_DUMP    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/windows/hardware/dn308254%28v=vs.85%29.aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The BUGCODE_NDIS_DRIVER_LIVE_DUMP bug code has a value of 0x0000015E. This bug code indicates that NDIS has captured a live kernel dump. NDIS does not generate a bug check in this situation.

Parameters

Parameter 1 is always equal to 0x01. This table gives the meanings of the other parameters.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error

0x01

Handle to the miniport adapter or filter module. Use !ndiskd.miniport or !ndiskd.filter.

Address of the physical device object (PDO) of the miniport

A code that indicates the reason for the error. See Cause for possible values.

The miniport has experienced a fatal error and must be removed.

Cause

When Parameter 1 is 0x01, Parameter 4 indicates the cause of the error. Here are the possible values:

Remarks

This bug code occurs only in Windows 8.1 Preview and later versions of Windows.

    WinDbg Output Example:


STOP 0x0000015F:  CONNECTED_STANDBY_WATCHDOG_TIMEOUT_LIVEDUMP    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000160:  WIN32K_ATOMIC_CHECK_FAILURE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000161: LIVE_SYSTEM_DUMP    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000162:  KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE (162)
A lock tracked by AutoBoost was released by a thread that did not own the lock.
This is typically caused when some thread releases a lock on behalf of another
thread (which is not legal with AutoBoost tracking enabled) or when some thread
tries to release a lock it no longer owns.
Arguments:
Arg1: ffffe0000427c080, The address of the thread
Arg2: ffffe00000289400, The lock address
Arg3: 00000000ffffffff, The session ID of the thread
Arg4: 0000000000000000, Reserved


STOP 0x00000163: WORKER_THREAD_TEST_CONDITION    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000163: WORKER_THREAD_TEST_CONDITION
A test for kernel worker threads raised a failure.

PARAMETERS
1 - Active test flags.
2 - Flag corresponding to the test that triggered the failure.
3 - Reserved.
4 - Reserved.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000164: WIN32K_CRITICAL_FAILURE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000164: WIN32K_CRITICAL_FAILURE     
Win32k has encountered a critical failure.

PARAMETERS
1 - Type of the failure.
VALUES:
0x1 : REGION_VALIDATION_FAILURE
Region is out of surface bounds.
2 - Pointer to DC
3 - Pointer to SURFACE
4 - Pointer to REGION
0x2 : OPERATOR_NEW_USED
Operator "new" is used to allocate memory.
2 - 0
3 - 0
4 - 0
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000165: CLUSTER_CSV_STATUS_IO_TIMEOUT_LIVEDUMP    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000165: CLUSTER_CSV_STATUS_IO_TIMEOUT_LIVEDUMP   
SMB client on the non-coordinating node complains that an IO on coordinating node is taking too long and fails all IOs with STATUS_IO_TIMEOUT.
In response to that cluster service captures live dump on the coordinating node so we can analyze what IO is taking time.

PARAMETERS
1 - Optional cluster service PID.
2 - Cluster Node Id for the node that observed STATUS_IO_TIMEOUT.
3 - Reserved.
4 - Reserved.

DESCRIPTION
SMB client on the non-coordinating node complains that an IO on coordinating node is taking too long and fails all IOs with STATUS_IO_TIMEOUT.
In response to that cluster service captures live dump on the coordinating node so we can analyze what IO is taking time.
Additional information is available in the dump's secondary data streams.
(This code can never be used for a real bugcheck; it is used to identify live dumps including Cluster Shared Volume telemetry.)
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000166: CLUSTER_RESOURCE_CALL_TIMEOUT_LIVEDUMP    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000166: CLUSTER_RESOURCE_CALL_TIMEOUT_LIVEDUMP   
A Cluster Resource call took longer than configured timeout.

PARAMETERS
1 - Resource Host Monitor PID.
2 - TID of the thread that handles resource call.
3 - Resource call type.
1 OPEN
2 CLOSE
3 ONLINE
4 OFFLINE
5 TERMINATE
6 ARBITRATE
7 RELEASE
8 RESOURCE CONTROL
9 RESOURCE TYPE CONTROL
10 LOOKS ALIVE
11 IS ALIVE
12 FAILURE NOTIFICATION
13 SHUTDOWN PROCESS
14 CANCEL
4 - Subcode.
When parameter 3 equals 8 then this parameter contains cluster resource control code.
When parameter 3 equals 9 then this parameter contains cluster resource type control code.

DESCRIPTION
A Cluster Resource call took longer than configured timeout. The system generated a live dump for analysis of the delay.
(This code can never be used for a real bugcheck.)
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000167: CLUSTER_CSV_SNAPSHOT_DEVICE_INFO_TIMEOUT_LIVEDUMP    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000167: CLUSTER_CSV_SNAPSHOT_DEVICE_INFO_TIMEOUT_LIVEDUMP   
A Cluster Service call to the volsnap to query snapshot information took too long.

PARAMETERS
1 - Cluster Service PID.
2 - TID of the thread that handles volsnap query.
3 - 1 if we timeout out while CSV volume is active and 2 if we timeout out even after taking CSV volume down.
4 - Reserved.

DESCRIPTION:
A Cluster Service call to the volsnap to query snapshot information took too long.
(This code can never be used for a real bugcheck.)
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000168: CLUSTER_CSV_STATE_TRANSITION_TIMEOUT_LIVEDUMP    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000168: CLUSTER_CSV_STATE_TRANSITION_TIMEOUT_LIVEDUMP   
A Cluster Shared Volume state transition took too long.

PARAMETERS
1 - Cluster Service PID.
2 - CSV target state Id.
0 Waiting for volume to transition to the Init state.
1 Waiting for volume to transition to the Paused state.
2 Waiting for volume to transition to the Draining state.
3 Waiting for volume to transition to the Set-Down-Level state.
4 Waiting for volume to transition to the Active state.
3 - Reserved.
4 - Reserved.

DESCRIPTION:
A Cluster Shared Volume state transition took too long. The system generated a live dump for analysis of the delay.
(This code can never be used for a real bugcheck.)
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000169: CLUSTER_CSV_VOLUME_ARRIVAL_LIVEDUMP    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000169: CLUSTER_CSV_VOLUME_ARRIVAL_LIVEDUMP   
The Cluster Shared Volume Manager was asked to create a new volume device object, and volume has not arrived in time.

PARAMETERS
1 - Cluster Service PID.
2 - Reserved.
3 - Reserved.
4 - Reserved.

DESCRIPTION
The Cluster Shared Volume Manager was asked to create a new volume device object, and volume has not arrived in time.
The system generated a live dump for analysis of the delay.
(This code can never be used for a real bugcheck.)
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x0000016A: CLUSTER_CSV_VOLUME_REMOVAL_LIVEDUMP    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x0000016a: CLUSTER_CSV_VOLUME_REMOVAL_LIVEDUMP   
A Cluster Shared Volume Manager volume removal request has timed out.

PARAMETERS
1 - Cluster Service PID.
2 - Reserved.
3 - Reserved.
4 - Reserved.

DESCRIPTION
A Cluster Shared Volume Manager volume removal request has timed out.
The system generated a live dump for analysis of the delay.
(This code can never be used for a real bugcheck.)
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x0000016B: CLUSTER_CSV_CLUSTER_WATCHDOG_LIVEDUMP    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x0000016b: CLUSTER_CSV_CLUSTER_WATCHDOG_LIVEDUMP   
The Cluster service user mode watchdog detected that a thread is not making forward progress for a long time.

PARAMETERS
1 - Cluster Service PID.
2 - Id of the thread that is stuck.
3 - Reserved.
4 - Reserved.

DESCRIPTION
The Cluster service user mode watchdog detected that a thread is not making forward progress for a long time.
(This code can never be used for a real bugcheck.)
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x0000016C: INVALID_RUNDOWN_PROTECTION_FLAGS    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x0000016c: INVALID_RUNDOWN_PROTECTION_FLAGS    
The flags supplied to one of the rundown protection APIs were invalid.

PARAMETERS
1 - The invalid flags supplied by the caller.
2 - The address of the rundown ref.
3 - Reserved.
4 - Reserved.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x0000016D: INVALID_SLOT_ALLOCATOR_FLAGS    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x0000016d: INVALID_SLOT_ALLOCATOR_FLAGS        
The flags supplied to one of the slot allocator APIs were invalid.

PARAMETERS
1 - The invalid flags supplied by the caller.
2 - Reserved.
3 - Reserved.
4 - Reserved.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x0000016E: ERESOURCE_INVALID_RELEASE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x0000016e: ERESOURCE_INVALID_RELEASE        
The target thread pointer supplied to ExReleaseResourceForThreadLite was invalid.
This bugcheck will hit if a call to ExSetOwnerPointerEx was skipped by the API
client (if a cross-thread release was intended) OR if the caller accidentally
passed in a value other that supplied by ExGetCurrentResourceThread.

PARAMETERS
1 - The resource being released.
2 - The current thread.
3 - The incorrect target thread that was passed in.
4 - Reserved.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x0000016F: CLUSTER_CSV_STATE_TRANSITION_INTERVAL_TIMEOUT_LIVEDUMP    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x0000016f: CLUSTER_CSV_STATE_TRANSITION_INTERVAL_TIMEOUT_LIVEDUMP   
A Cluster Shared Volume next state transition request has not arrived.

PARAMETERS
1 - Cluster Service PID.
2 - CSV target state Id.
0 Waiting for volume to transition to the Init state.
1 Waiting for volume to transition to the Paused state.
2 Waiting for volume to transition to the Draining state.
3 Waiting for volume to transition to the Set-Down-Level state.
4 Waiting for volume to transition to the Active state.
3 - Reserved.
4 - Reserved.

DESCRIPTION
A Cluster Shared Volume next state transition request has not arrived.
(This code can never be used for a real bugcheck.)
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000170: CRYPTO_LIBRARY_INTERNAL_ERROR    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000170: CRYPTO_LIBRARY_INTERNAL_ERROR       
An internal error in the crypto libraries.
This bugcheck will hit if the crypto libraries detect an anomaly
that should never occur but which might be the symptom of an
active attack, and the library has no safe method of signaling
the error to the caller.

PARAMETERS
1 - ID of failure.
2 - Reserved.
3 - Reserved.
4 - Reserved.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000171: CLUSTER_CSV_CLUSSVC_DISCONNECT_WATCHDOG    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000171: CLUSTER_CSV_CLUSSVC_DISCONNECT_WATCHDOG       
Cluster disconnect is not making forward progress.

PARAMETERS
1 - Id of the thread that is handling cluster disconnect.
2 - Timeout in milliseconds.
3 - Reserved.
4 - Reserved.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000173: COREMSGCALL_INTERNAL_TIMEOUT_LIEVEDUMP    (go to top of page)

Usual causes:
 
OS's found in: W10 - 14393

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000174: COREMSGCALL_INTERNAL_ERROR    (go to top of page)

Usual causes:
 
OS's found in: W10 - 14393

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000175: PREVIOUS_FATAL_ABNORMAL_RESET_ERROR    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000175: PREVIOUS_FATAL_ABNORMAL_RESET_ERROR 
An unrecoverable system error occurred or the system has abnormally reset on Windows phone devices.
The system generated a live dump to collect device crash data from the previous error.

DESCRIPTION
The system on Windows Phone devices encountered an unexpected error and
restarted. Issues that may cause this error include: hardware watchdog timer in
application or auxiliary processors indicating a system hang, user-initiated key
sequence because of a hang, etc.
(This code can never be used for a real bugcheck.)
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000178: LAM_DRIVER_DETECTED_FATAL_ERROR    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000178: ELAM_DRIVER_DETECTED_FATAL_ERROR           
ELAM driver detected a fatal error.

PARAMETERS
1 - Type of the failure.
VALUES:
0x0 : TPM attestation could not be revoked.
2 - Pointer to the BDCB_IMAGE_INFORMATION structure for the driver being inspected.
3 - TBS_RESULT failure code.

0x10000 : ELAM-vendor defined failure.
2 - (Optional) ELAM vendor supplied value.
3 - (Optional) ELAM vendor supplied value.

END_VALUES

2 - Reserved.
3 - Reserved.
4 - (Optional) ELAM vendor supplied general purpose data block.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000179: CLUSTER_CLUSPORT_STATUS_IO_TIMEOUT_LIVEDUMP    (go to top of page)

Usual causes: 
OS's found in: W10 - 15063

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000017C: PDC_LOCK_WATCHDOG_LIVEDUMP    (go to top of page)

Usual causes:
 
OS's found in: W10 - 14393

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000017D: PDC_UNEXPECTED_REVOCATION_LIEVDUMP    (go to top of page)

Usual causes:
 
OS's found in: W10 - 14393

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000180: WVR_LIVEDUMP_REPLICATION_IOCONTEXT_TIMEOUT    (go to top of page) Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000180: WVR_LIVEDUMP_REPLICATION_IOCONTEXT_TIMEOUT      
A SR replication I/O context has not completed for a long time

PARAMETERS
1 - The address of SR replica member.
2 - The address of the I/O context.
3 - Reserved.
4 - The system time when the bugcheck is captured, it is used for correlating live dumps on remote replication partners if available.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000181: WVR_LIVEDUMP_STATE_TRANSITION_TIMEOUT    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000181: WVR_LIVEDUMP_STATE_TRANSITION_TIMEOUT           
A SR state transition event has not completed for a long time

PARAMETERS
1 - The address of SR replica member.
2 - The address of state transition event.
3 - Reserved.
4 - The system time when the bugcheck is captured, it is used for correlating live dumps on remote replication partners if available.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000182: WVR_LIVEDUMP_RECOVERY_IOCONTEXT_TIMEOUT    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000182: WVR_LIVEDUMP_RECOVERY_IOCONTEXT_TIMEOUT         
A SR recovery I/O context has not been completed for a long time

PARAMETERS
1 - The address of SR replica member.
2 - The address of the I/O context.
3 - Reserved.
4 - The system time when the bugcheck is captured, it is used for correlating live dumps on remote replication partners if available.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000183: WVR_LIVEDUMP_APP_IO_TIMEOUT    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000183: WVR_LIVEDUMP_APP_IO_TIMEOUT                     
An applicaton's Write Irp being replicated has not been completed for a long time

PARAMETERS
1 - The address of SR partition manager that the application's write Irp is queued to.
2 - The address of the application's write Irp.
3 - Reserved.
4 - The system time when the bugcheck is captured, it is used for correlating live dumps on remote replication partners if available.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000184: WVR_LIVEDUMP_MANUALLY_INITIATED    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000184: WVR_LIVEDUMP_MANUALLY_INITIATED                 
The bugcheck is requested by user manually via SR IOCTL

PARAMETERS
1 - Reserved.
2 - Reserved.
3 - Reserved.
4 - The system time when the bugcheck is initiated, it is used for correlating live dumps on remote replication partners if available.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000185: WVR_LIVEDUMP_STATE_FAILURE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000185: WVR_LIVEDUMP_STATE_FAILURE                      
The SR state machine is entering failure state due to fatal error

PARAMETERS
1 - The address of SR replica member.
2 - The NT status code for the error that caused failure state.
3 - The thread that encountered the error.
4 - Reserved.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000186: WVR_LIVEDUMP_CRITICAL_ERROR    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000186: WVR_LIVEDUMP_CRITICAL_ERROR                     
SR has encountered a critical error

PARAMETERS
1 - The address of SR replica member if available.
2 - The NT status code for the critical error.
3 - Reserved.
4 - Reserved.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000187: VIDEO_DWMINIT_TIMEOUT_FALLBACK_BDD    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000187: VIDEO_DWMINIT_TIMEOUT_FALLBACK_BDD              
PARAMETERS
1 - Reason Code.
1 DWM failed to initialize after retries, stopping display adapters and falling back to BDD.
2 - Reserved.
3 - Reserved.
4 - Reserved.

DESCRIPTION
Video fell back to BDD rather than using the IHV driver. This always generates a live dump.
(This code can never be used for a real bugcheck.)
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000188: CLUSTER_CSVFS_LIVEDUMP    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000188: CLUSTER_CSVFS_LIVEDUMP   
CSVFS initiated this livedump to help debuggign an inconsistent state. First parameter contains the reason code

PARAMETERS
1 - Reason Code.
1 Cache purge on oplock downgrade to none has failed.
2 Cache purge on oplock upgrade from none has failed.
3 Cache purge on set purge failure mode.
2 - Patameter1.
For Reason Code 1 this parameter contains an address of CSVFS!_SCB.
For Reason Code 2 this parameter contains an address of CSVFS!_SCB.
For Reason Code 3 this parameter contains an address of CSVFS!_SCB.
3 - Reserved.
4 - Reserved.

DESCRIPTION
When CSVFS detects that current state might cause data coruption or other sort of inconsistency it would
generate live dump with this status code. Parameter1 has code pointing to what scenario this live dump
is created for. Other parameters should be interpreted in context of the reason code.
(This code can never be used for a real bugcheck.)
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000189: BAD_OBJECT_HEADER    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000189: BAD_OBJECT_HEADER                     
The OBJECT_HEADER has been corrupted

PARAMETERS
1 - Pointer to bad OBJECT_HEADER
2 - Pointer to the resulting OBJECT_TYPE based on the TypeIndex in the OBJECT_HEADER
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x0000018A: SILO_CORRUPT    (go to top of page)

Usual causes:
 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000018B: SECURE_KERNEL_ERROR    (go to top of page) Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x0000018b: SECURE_KERNEL_ERROR                   
The secure kernel has encountered a fatal error.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x0000018C: HYPERGUARD_VIOLATION    (go to top of page)

Usual causes:
 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:



STOP 0x0000018D: SECURE_FAULT_UNHANDLED    (go to top of page)

Usual causes:
 
OS's found in: W10 - 15063

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000190: WIN32K_CRITICAL_FAILURE_LIVEDUMP    (go to top of page) Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000190: WIN32K_CRITICAL_FAILURE_LIVEDUMP                
Win32k has encountered a critical failure.
Live dump is captured to collect the debug information.

PARAMETERS
1 - Type of the failure.
VALUES:
0x1 : REGION_VALIDATION_FAILURE
Region is out of surface bounds.
2 - Pointer to DC
3 - Pointer to SURFACE
4 - Pointer to REGION
0x2 : OPERATOR_NEW_USED
Operator "new" is used to allocate memory.
2 - 0
3 - 0
4 - 0
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000191: PF_DETECTED_CORRUPTION    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000191: PF_DETECTED_CORRUPTION                  
PARAMETERS
1 - (reserved)
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000192: KERNEL_AUTO_BOOST_LOCK_ACQUISITION_WITH_RAISED_IRQL    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000192: KERNEL_AUTO_BOOST_LOCK_ACQUISITION_WITH_RAISED_IRQL     
A lock tracked by AutoBoost was acquired while executing at DISPATCH_LEVEL or
above.

PARAMETERS
1 - The address of the thread.
2 - The lock address.
3 - The IRQL at which the lock was acquired.
4 - Reserved.
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000193: VIDEO_DXGKRNL_LIVEDUMP    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x00000193: VIDEO_DXGKRNL_LIVEDUMP                  
PARAMETERS
1 - Reason Code.
100 Internal
2 - Reserved.
3 - Reserved.
4 - Reserved.

DESCRIPTION
Livedumps triggered by dxgkrnl
    WinDbg Help File Entry:


    WinDbg Output Example:



STOP 0x00000194: SAVER_NONRESPONSIVEPROCESS    (go to top of page)

Usual causes:
 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000195: SMB_SERVER_LIVEDUMP    (go to top of page)

Usual causes:
 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000195: SMB_SERVER_LIVEDUMP    (go to top of page)

Usual causes:
 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000196: SAVER_MTBFCOMMANDTIMEOUT/LOADER_ROLLBACK_DETECTED    (go to top of page)

Usual causes:
 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000197: WIN32K_SECURITY_FAILURE    (go to top of page)

Usual causes:
 
OS's found in: W10 - 14393

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000198: UFX_LIVEDUMP    (go to top of page)

Usual causes:
 
OS's found in: W10 - 14393

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000199: KERNEL_STORAGE_SLOT_IN_USE    (go to top of page)

Usual causes:
 
OS's found in: W10 - 14393

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000019A: WORKER_THREAD_RETURNED_WHILE_ATTACHED_TO_SILO    (go to top of page)

Usual causes:
 
OS's found in: W10 - 14393

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000019B: TIM_FATAL_ERROR    (go to top of page)

Usual causes:
 
OS's found in: W10 - 14393

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000019C: WIN32K_POWER_WATCHDOG_TIMEOUT    (go to top of page)

Usual causes:
 
OS's found in: W10 - 14393

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000019D: CLUSTER_SVHDX_LIVEDUMP    (go to top of page)

Usual causes:
 
OS's found in: W10 - 14393

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000019E: BUGCODE_NETADAPTER_DRIVER    (go to top of page)

Usual causes:
 
OS's found in: W10 - 15063

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000019F: PDC_PRIVILEGE_CHECK_LIVEDUMP    (go to top of page)

Usual causes:
 
OS's found in: W10 - 15063

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x000001A0: TIM_WATCHDOG_TIMEOUT    (go to top of page)

Usual causes:
 
OS's found in: W10 - 15063

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x000001A1: WIN32K_CALLOUT_WATCHDOG_LIVEDUMP    (go to top of page)

Usual causes:
 
OS's found in: W10 - 15063

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x000001A2: WIN32K_CALLOUT_WATCHDOG_BUGCHECK    (go to top of page)

Usual causes:
 
OS's found in: W10 - 15063

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x000001C4: DRIVER_VERIFIER_DETECTED_VIOLATION_LIVEDUMP    (go to top of page) Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:
0x000001C4: DRIVER_VERIFIER_DETECTED_VIOLATION_LIVEDUMP         
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
(This code can never be used for a real bugcheck;
it is used to identify live dumps including device/driver telemetry.)

PARAMETERS
1 - subclass of driver violation.
VALUES

0x00081001: ID of the 'KsDeviceMutex' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00081002: ID of the 'KsStreamPointerClone' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00081003: ID of the 'KsStreamPointerLock' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00081004: ID of the 'KsStreamPointerUnlock' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00081005: ID of the 'KsCallbackReturn' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00081006: ID of the 'KsIrqlDeviceCallbacks' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00081007: ID of the 'KsIrqlFilterCallbacks' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00081008: ID of the 'KsIrqlPinCallbacks' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00081009: ID of the 'KsIrqlDDIs' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0008100A: ID of the 'KsFilterMutex' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0008100B: ID of the 'KsProcessingMutex' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00082001: ID of the 'KsTimedPinSetDeviceState' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00082002: ID of the 'KsTimedDeviceCallbacks' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00082003: ID of the 'KsTimedFilterCallbacks' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00082004: ID of the 'KsTimedPinCallbacks' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00082005: ID of the 'KsTimedProcessingMutex' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00071001: ID of the 'PcIrqlDDIs' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00071003: ID of the 'PcIrqlIport' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00071004: ID of the 'PcUnmapAllocatedPages' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00071005: ID of the 'PcAllocatedPages' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00071006: ID of the 'PcRegisterAdapterPower' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00071007: ID of the 'PcAddAdapterDevice' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00071008: ID of the 'PcPropertyRequest' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00071009: ID of the 'PcAllocateAndMapPages' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0007100A: ID of the 'PcPoRequestPowerIrp' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00072001: ID of the 'PcTimedWaveRtStreamSetState' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00020002: ID of the 'IrqlApcLte' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020003: ID of the 'IrqlDispatch' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020004: ID of the 'IrqlExAllocatePool' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020005: ID of the 'IrqlExApcLte1' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020006: ID of the 'IrqlExApcLte2' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020007: ID of the 'IrqlExApcLte3' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020008: ID of the 'IrqlExPassive' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020009: ID of the 'IrqlIoApcLte' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002000A: ID of the 'IrqlIoPassive1' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002000B: ID of the 'IrqlIoPassive2' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002000C: ID of the 'IrqlIoPassive3' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002000D: ID of the 'IrqlIoPassive4' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002000E: ID of the 'IrqlIoPassive5' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002000F: ID of the 'IrqlKeApcLte1' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020010: ID of the 'IrqlKeApcLte2' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020011: ID of the 'IrqlKeDispatchLte' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020015: ID of the 'IrqlKeReleaseSpinLock' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020016: ID of the 'IrqlKeSetEvent' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020019: ID of the 'IrqlMmApcLte' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002001A: ID of the 'IrqlMmDispatch' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002001B: ID of the 'IrqlObPassive' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002001C: ID of the 'IrqlPsPassive' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002001D: ID of the 'IrqlReturn' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0002001E: ID of the 'IrqlRtlPassive' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002001F: ID of the 'IrqlZwPassive' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020022: ID of the 'IrqlIoDispatch' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00040003: ID of the 'CriticalRegions' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00040006: ID of the 'QueuedSpinLock' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00040007: ID of the 'QueuedSpinLockRelease' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00040009: ID of the 'SpinLock' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0004000A: ID of the 'SpinlockRelease' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0004000E: ID of the 'GuardedRegions' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0004100B: ID of the 'RequestedPowerIrp' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0004100F: ID of the 'IoSetCompletionExCompleteIrp' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00043006: ID of the 'PnpRemove' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00091001: ID of the 'NdisOidComplete' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00091002: ID of the 'NdisOidDoubleComplete' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0009100E: ID of the 'NdisOidDoubleRequest' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00092003: ID of the 'NdisTimedOidComplete' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0009200D: ID of the 'NdisTimedDataSend' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0009200F: ID of the 'NdisTimedDataHang' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00092010: ID of the 'NdisFilterTimedPauseComplete' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00092011: ID of the 'NdisFilterTimedDataSend' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00092012: ID of the 'NdisFilterTimedDataReceive' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00093004: ID of the 'WlanAssociation' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00093005: ID of the 'WlanConnectionRoaming' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00093006: ID of the 'WlanDisassociation' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00093101: ID of the 'WlanAssert' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00094007: ID of the 'WlanTimedAssociation' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00094008: ID of the 'WlanTimedConnectionRoaming' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00094009: ID of the 'WlanTimedConnectRequest' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0009400B: ID of the 'WlanTimedLinkQuality' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0009400C: ID of the 'WlanTimedScan' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x000001C5: IO_THREADPOOL_DEADLOCK_LIVEDUMP    (go to top of page)

Usual causes:
 
OS's found in: W10 - 14393

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x000001C6: FAST_ERESOURCE_PRECONDITION_VIOLATION    (go to top of page)

Usual causes:
 
OS's found in: W10 - 15063

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x000001C7: STORE_DATA_STRUCTURE_CORRUPTION    (go to top of page)

Usual causes:
 
OS's found in: W10 - 15063

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x000001C8: MANUALLY_INITIATED_POWER_BUTTON_HOLD    (go to top of page)

Usual causes:
 
OS's found in: W10 - 15063

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x000001C9: USER_MODE_HEALTH_MONITOR_LIVEDUMP    (go to top of page)

Usual causes:
 
OS's found in: W10 - 15063

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x000001CA: HYPERVISOR_WATCHDOG_TIMEOUT    (go to top of page)

Usual causes:
 
OS's found in: W10 - 15063

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x000001CB: INVALID_SILO_DETACH    (go to top of page)

Usual causes:
 
OS's found in: W10 - 15063

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000315: SAVER_MTBFCOMMANDTIMEOUT    (go to top of page)

Usual causes:
 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000333:                                                                        (go to top of page)

Usual causes:
 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (333)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000001
Arg2: 0000000000000002
Arg3: 0000000000000003
Arg4: 0000000000000004


STOP 0x00000357: XBOX_CORRUPTED_IMAGE   (go to top of page)

Usual causes:
 
OS's found in: W10 - 14393

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000358: XBOX_INVERTED_FUNCTION_TABLE_OVERFLOW    (go to top of page)

Usual causes:
 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000359: XBOX_CORRUPTED_IMAGE_BASE    (go to top of page)

Usual causes:
 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000360: XBOX_360_SYSTEM_CRASH    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000420: XBOX_360_SYSTEM_CRASH_RESERVED    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00000BFE: BC_BLUETOOTH_VERIFIER_FAULT    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
BC_BLUETOOTH_VERIFIER_FAULT (bfe)
The Bluetooth profile driver verifier has caught a violation.
Look at the call stack to dertermine the misbehaving driver.
Arguments:
Arg1: 0000000000000000, The subtype of the Bluetooth verifier fault.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

STOP 0x00000BFF: BC_BTHMINI_VERIFIER_FAULT    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00008866: SAVER_SICKAPPLICATION    (go to top of page)

Usual causes:
 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000C1F5:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:
KB 946084    Stop error message when you start a Windows Vista-based computer: "0x0000C1F5"
KB 958069    Stop error when you start a Windows Vista-based computer even though hotfix 946084 is installed on the computer: "0x0000C1F5"
KB 970101    How to work around Stop Error 0x0000C1F5 on a Windows Vista-based computer

    A suggested method to fix it (I haven't tried this):  http://www.youtube.com/watch?v=SwSvIhyZRVc&feature=player_embedded

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (c1f5)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000F000: SAVER_UNSPECIFIED    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F002: SAVER_BLANKSCREEN    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F003: SAVER_BLANKSCREEN    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F004: SAVER_WATCHDOG    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F005: SAVER_STARTNOTVISIBLE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F006: SAVER_NAVIGATIONMODEL    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F007: SAVER_OUTOFMEMORY    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F008: SAVER_GRAPHICS    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F009: SAVER_NAVSERVERTIMEOUT    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F00A: SAVER_CHROMEPROCESSCRASH    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F00B: SAVER_NOTIFICATIONDISMISSAL    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F00C: SAVER_SPEECHDISMISSAL    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F00D: SAVER_CALLDISMISSAL    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F00E: SAVER_APPBARDISMISSAL    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F00F: SAVER_RILADAPTATIONCRASH    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F010: SAVER_APPLISTUNREACHABLE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F011: SAVER_REPORTNOTIFICATIONFAILURE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F012: SAVER_UNEXPECTEDSHUTDOWN    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F013: SAVER_RPCFAILURE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F014: SAVER_AUXILIARYFULLDUMP    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F015: SAVER_ACCOUNTPROVSVCINITFAILURE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F101: SAVER_MTBFCOMMANDHANG    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F102: SAVER_MTBFPASSBUGCHECK    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F103: SAVER_MTBFIOERROR    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F200: SAVER_RENDERTHREADHANG    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F201: SAVER_RENDERMOBILEUIOOM    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F300: SAVER_DEVICEUPDATEUNSPECIFIED    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F400: SAVER_AUDIODRIVERHANG    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F500: SAVER_BATTERYPULLOUT    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F600: SAVER_MEDIACORETESTHANG    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F700: SAVER_RESOURCEMANAGEMENT    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F800: SAVER_CAPTURESERVICE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x0000F900: SAVER_WAITFORSHELLREADY    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x00020001: HYPERVISOR_ERROR    (go to top of page) Usual causes: 

    Knowledge Base Articles:
KB 2550569   "0x20001" Stop error when you start a Linux VM in Windows Server 2008 R2 SP1

    WinDbg Help File Entry:

    WinDbg Output Example:
The hypervisor has encountered a fatal error.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x1000000A: IRQL_NOT_LESS_OR_EQUAL    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00200000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 806e6a2a, address which referenced memory


STOP 0x10000050: PAGE_FAULT_IN_NONPAGED_AREA_M    (go to top of page)

Usual causes: 

    Knowledge Base Articles:
KB 939868    You receive an error message when you access a Web-based program on a Windows XP-based multiprocessor computer

    WinDbg Help File Entry:

    WinDbg Output Example:
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: 80f17aa5, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 81c299e7, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 00000002, (reserved)


STOP 0x1000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557196(v=VS.85).aspx

    Knowledge Base Articles:
KB 925528    Stop errors occur on a Windows-based computer that has 2GB or more of RAM and is using an NVIDIA nForce USB controller (XP, Server 2003, Vista)
KB 929734    You have problems after you resume a Windows Vista-based computer from sleep or from hibernation
KB 949483    Stop error when you resume a computer that is running Windows XP or a 64-bit version of Windows Server 2003 from hibernation: "STOP 0x1000007E"
KB 959766    Windows Server 2008 Hyper-V systems restart unexpectedly, and you receive a 0x1000007E Stop error code when you mount a VHD file

    WinDbg Help File Entry:

The SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M bug check has a value of 0x1000007E. This indicates that a system thread generated an exception which the error handler did not catch.

Bug check 0x1000007E has the same meaning and parameters as bug check 0x7E (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED).

    WinDbg Output Example:
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 993543c0, The address that the exception occurred at
Arg3: 807ee974, Exception Record Address
Arg4: 807ee550, Context Record Address


STOP 0x1000007F: UNEXPECTED_KERNEL_MODE_TRAP_M    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557201(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The UNEXPECTED_KERNEL_MODE_TRAP_M bug check has a value of 0x1000007F. This indicates that a trap was generated by the Intel CPU and the kernel failed to catch this trap.

Bug check 0x1000007F has the same meaning and parameters as bug check 0x7F (UNEXPECTED_KERNEL_MODE_TRAP).

    WinDbg Output Example:
UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 803d3130
Arg3: 00000000
Arg4: 00000000



STOP 0x1000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M    (go to top of page)

Usual causes:  Insufficient disk space, Device driver, Video card, BIOS, Breakpoint in startup without having a debugger attached, Hardware incompatibility, Faulty system service, 3rd party remote control, Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557203(v=VS.85).aspx

    Knowledge Base Articles:
KB 310740    A "STOP: 0x1000008E In Emupia2k.sys" Error Message Appears After You Upgrade from Windows 2000
KB 893239    You may receive a Stop error message on a blue screen when you start a Microsoft Windows Server 2003-based computer or a Microsoft Windows XP-based computer
KB 963038    Error message when you establish a remote desktop connection to a remote computer that is running Windows XP: "STOP: 0x1000008E"

    WinDbg Help File Entry:

The KERNEL_MODE_EXCEPTION_NOT_HANDLED_M bug check has a value of 0x1000008E. This indicates that a kernel-mode program generated an exception which the error handler did not catch.

Bug check 0x1000008E has the same meaning and parameters as bug check 0x8E (KERNEL_MODE_EXCEPTION_NOT_HANDLED).

    WinDbg Output Example:
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 807cbd5b, The address that the exception occurred at
Arg3: 883fda50, Trap Frame
Arg4: 00000000


STOP 0x100000B8: ATTEMPTED_SWITCH_FROM_DPC    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
ATTEMPTED_SWITCH_FROM_DPC (b8)
A wait operation, attach process, or yield was attempted from a DPC routine.
This is an illegal operation and the stack track will lead to the offending
code and original DPC routine.
Arguments:
Arg1: 85c39568, Original thread which is the cause of the failure
Arg2: 841a6a70, New thread
Arg3: 8a883fd0, Stack address of the original thread
Arg4: 00000000


STOP 0x100000CF: TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE    (go to top of page)

Usual causes:
 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE (cf)
Arguments:
Arg1: bf030d51, memory referenced
Arg2: 00000008, value 0 = read operation, 1 = write operation
Arg3: bf030d51, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 00000000, Mm internal code.
    A driver has been incorrectly ported to Terminal Server.  It is referencing
    session space addresses from the system process context.  Probably from
    queueing an item to a system worker thread.
    The broken driver's name is displayed on the screen.


STOP 0x100000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 85c00000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 85d21108, address which referenced memory


STOP 0x100000D6: DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION_M    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION (d6)
N bytes of memory was allocated and more than N bytes are being referenced.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: 0000000000000000, if non-zero, the address which referenced memory.
Arg4: 0000000000000000, (reserved)


STOP 0x100000EA: THREAD_STUCK_IN_DEVICE_DRIVER_M    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557206(v=VS.85).aspx

    Knowledge Base Articles:
KB 293078    Error message in Windows XP: "STOP 0x000000EA THREAD_STUCK_IN_DEVICE_DRIVER"
KB 939868    You receive an error message when you access a Web-based program on a Windows XP-based multiprocessor computer

    WinDbg Help File Entry:

The THREAD_STUCK_IN_DEVICE_DRIVER_M bug check has a value of 0x100000EA. This indicates that a thread in a device driver is endlessly spinning.

Bug check 0x100000EA has the same meaning and parameters as bug check 0xEA (THREAD_STUCK_IN_DEVICE_DRIVER).

    WinDbg Output Example:
THREAD_STUCK_IN_DEVICE_DRIVER_M (100000ea)
The device driver is spinning in an infinite loop, most likely waiting for
hardware to become idle. This usually indicates problem with the hardware
itself or with the device driver programming the hardware incorrectly.
If the kernel debugger is connected and running when watchdog detects a
timeout condition then DbgBreakPoint() will be called instead of KeBugCheckEx()
and detailed message including bugcheck arguments will be printed to the
debugger. This way we can identify an offending thread, set breakpoints in it,
and hit go to return to the spinning code to debug it further. Because
KeBugCheckEx() is not called the .bugcheck directive will not return bugcheck
information in this case. The arguments are already printed out to the kernel
debugger. You can also retrieve them from a global variable via
"dd watchdog!g_WdBugCheckData l5" (use dq on NT64).
On MP machines it is possible to hit a timeout when the spinning thread is
interrupted by hardware interrupt and ISR or DPC routine is running at the time
of the bugcheck (this is because the timeout's work item can be delivered and
handled on the second CPU and the same time). If this is the case you will have
to look deeper at the offending thread's stack (e.g. using dds) to determine
spinning code which caused the timeout to occur.
Arguments:
Arg1: fffffa80059bcb60, Pointer to a stuck thread object.  Do .thread then kb on it to find
    the hung location.
Arg2: 0000000000000000, Pointer to a DEFERRED_WATCHDOG object.
Arg3: 0000000000000000, Pointer to offending driver name.
Arg4: 0000000000000000, Number of times "intercepted" bugcheck 0xEA was hit (see notes).


STOP 0x1000F000: SAVER_UNSPECIFIED    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F002: SAVER_BLANKSCREEN    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F003: SAVER_INPUT    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F004: SAVER_WATCHDOG    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F005: SAVER_STARTNOTVISIBLE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F006: SAVER_NAVIGATIONMODEL    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F007: SAVER_OUTOFMEMORY    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F008: SAVER_GRAPHICS    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F009: SAVER_NAVSERVERTIMEOUT    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F00A: SAVER_CHROMEPROCESSCRASH    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F00B: SAVER_NOTIFICATIONDISMISSAL    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F00C: SAVER_SPEECHDISMISSAL    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F00D: SAVER_CALLDISMISSAL    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F00E: SAVER_APPBARDISMISSAL    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F00F: SAVER_RILADAPTATIONCRASH    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F010: SAVER_APPLISTUNREACHABLE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F011: SAVER_REPORTNOTIFICATIONFAILURE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F012: SAVER_UNEXPECTEDSHUTDOWN    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F013: SAVER_RPCFAILURE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F014: SAVER_AUXILIARYFULLDUMP    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F015: SAVER_ACCOUNTPROVSVCINITFAILURE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F100: SAVER_MTBFCOMMANDTIMEOUTD    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F101: SAVER_MTBFCOMMANDHANG    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F102: SAVER_MTBFPASSBUGCHECK    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F103: SAVER_MTBFIOERROR    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F200: SAVER_RENDERTHREADHANG    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F201: SAVER_RENDERMOBILEUIOOM    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F300: SAVER_DEVICEUPDATEUNSPECIFIED    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F400: SAVER_AUDIODRIVERHANG    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F500: SAVER_BATTERYPULLOUT    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F600: SAVER_MEDIACORETESTHANG    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F700: SAVER_RESOURCEMANAGEMENT    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F800: SAVER_CAPTURESERVICE    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:


    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x1000F900: SAVER_WAITFORSHELLREADY    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:


    bugcodes.txt Entry:



    WinDbg Help File Entry:


    WinDbg Output Example:




STOP 0x4000007E: WINDOWS_NT_BANNER    (go to top of page)

Usual causes: 
OS's found in: W10

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:
    WinDbg Output Example:


STOP 0x40000082: BUGCODE_PSS_MESSAGE    (go to top of page)

STOP 0x40000083: BUGCHECK_TECH_INFO    (go to top of page)

STOP 0x40000087: WINDOWS_NT_CSD_STRING    (go to top of page)

STOP 0x40000088: WINDOWS_NT_INFO_STRING    (go to top of page)

STOP 0x40000089: WINDOWS_NT_MP_STRING    (go to top of page)

STOP 0x4000008A: THREAD_TERMINATE_HELD_MUTEX    (go to top of page)

STOP 0x4000008B: BUGCODE_PSS_CRASH_INIT    (go to top of page)

STOP 0x4000008C: BUGCODE_PSS_CRASH_PROGRESS    (go to top of page)

STOP 0x4000008D: BUGCODE_PSS_CRASH_DONE    (go to top of page)

STOP 0x4000009D: WINDOWS_NT_INFO_STRING_PLURAL    (go to top of page)

STOP 0x4000009E: WINDOWS_NT_RC_STRING    (go to top of page)

STOP 0x400000AD: VIDEO_DRIVER_DEBUG_REPORT_REQUEST    (go o top of page)


STOP 0x40010001: HARDWARE_PROFILE_UNDOCKED_STRING    (go to top of page)

Usual causes: 
OS's found in:

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x40010002: HARDWARE_PROFILE_DOCKED_STRING    (go to top of page)

Usual causes: 
OS's found in:

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x40010003: HARDWARE_PROFILE_UNKOWN_STRING    (go to top of page)

Usual causes: 
OS's found in:

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x66888866: SAVER_SICKAPPLICATION    (go to top of page)


STOP 0x70860002:     (go to top of page)

Usual causes:
  Found associated with iaStor.sys on 14 Sep 2010 in a Toshiba laptop
                         Found associated with IaStor.sys on 10 Jan 2011 in a Sony laptop:  http://www.techsupportforum.com/forums/f217/bsod-kernel-dump-analysis-discussion-452622-9.html#post3073666

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (70860002)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000003
Arg2: 0000000000000002
Arg3: 0000000000000009
Arg4: 0000000000000000


STOP 0x80000000: BUGCHECK_CONTEXT_MODIFIER    (go to top of page)

Usual causes: 
OS's found in:

    Knowledge Base Articles:
    bugcodes.txt Entry:

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0x80070246:  ERROR_ILLEGAL_CHARACTER     (go to top of page)

Usual causes:
 

    Knowledge Base Articles:
KB 942968    Stop error when you try to download updates from Windows Update on a computer that is running Windows Vista: "0x80070246"

    WinDbg Help File Entry:

    WinDbg Output Example:



STOP 0x80080005:  CO_E_SERVER_EXEC_FAILURE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:
KB 825118    "Stop error code 0x80080005 (CO_E_SERVER_EXEC_FAILURE)" error message (XP)

    WinDbg Help File Entry:

    WinDbg Output Example:



STOP 0x8086:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (8086)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000


STOP 0x9087:      (go to top of page)
Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (9087)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000


STOP 0x9088:      (go to top of page)
Usual causes: 

Found at this post:  http://www.techsupportforum.com/microsoft-support/windows-vista-windows-7-support/507417-bsods-any-type-think-they-produce-dump-file-but-there-aint-any.html

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (9088)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000


STOP 0xA0000001:      (go to top of page)
Usual causes:  Appears to be a custom bugcheck coded into ATI drivers

Found at this post:  http://www.techsupportforum.com/forums/f300/unknown-bugcheck-0xa0000001-0x5-593369.html

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (a0000001)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

STOP 0xBADB0D00:      (go to top of page)
Usual causes:  Unknown BugCheck code

Found at this this memory dump (083012-26863-01.dmp) in this topic:  http://answers.microsoft.com/en-us/windows/forum/windows_7-hardware/how-do-i-find-out-the-cause-of-bsod/0eeee33b-ace9-48d3-84f8-dbea92ae0c75?page=2#_self

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (badb0d00)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 807c0023
Arg3: 00000000
Arg4: 00000000


STOP 0xC0000005:
Usual causes: 

    Knowledge Base Articles:
KB 2800789    0xC0000005 Stop error when the SVCHost.exe process that hosts Remote Desktop Services crashes in Windows Server 2008 R2
KB 2920540    Stop error when computer is restarted by the Sysprep.exe process in Windows 8.1 or Windows Server 2012 R2 (0xc0000005 in athwnx.sys)

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0xC000000D:
Usual causes: 

    Knowledge Base Articles:
KB 2901630    "Error code:0xc000000d" when you upgrade a Surface RT (WinRT 8) device to Windows RT 8.1

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0xC0000034:
While not technically a BSOD, this error occurs in situations that may lead users to this web page. 
As such, I'm including it here.
KB 2533552    An update that prevents a "0xC0000034" error message when you try to install Windows 7 SP1 or Windows Server 2008 R2 SP1 is available



STOP 0xC000009A: STATUS_INSUFFICIENT_RESOURCES    (go to top of page) Usual causes: 

    AUMHA Listing:  http://aumha.org/a/stop.php#0xC9a

    Knowledge Base Articles:
KB 142719    Windows Reports Out of Resources Error When Memory Is Available (NT, 2000)
KB 329075    Dmio reports Event ID 30 with status of 0xC000009 (2000)
KB 2534366    "0xC000009A" error message when you try to install Windows 7 SP1 or Windows Server 2008 R2 SP1

    WinDbg Help File Entry:

    WinDbg Output Example:



STOP 0xC0000135: UNABLE_TO_LOCATE_DLL    (go to top of page) Usual causes: 

    AUMHA Listing:  http://aumha.org/a/stop.php#0x135

    Knowledge Base Articles:
KB 173309    Blue Screen STOP Message C0000135 Appears at Startup (NT)
KB 815011    Cannot Disable the Registry Repair and Recovery Feature in Windows XP SP1
KB 885523    You receive a "Stop: c0000135" and "winsrv was not found" error message after you install Windows XP Service Pack 2

    WinDbg Help File Entry:

    WinDbg Output Example:



STOP 0xC0000142: DLL Initialization Failure    (go to top of page)

Usual causes: 

    AUMHA Listing:  http://aumha.org/a/stop.php#0x142

    Knowledge Base Articles:
KB 823659    Client, service, and program incompatibilities that may occur when you modify security settings and user rights assignments (95, 98, NT, 2000, XP, Server 2003, Mac OS X)
KB 824572    "The Application Failed to Initialize Properly (0xc0000142)" Error Message When You Start Virtual PC
KB 838857    You receive a "The application failed to initialize properly (0xc0000142)" error message when you start a computer that is running ISA Server 2000
KB 2701373    "0xC0000142" or "-1073741502" Stop error when many PowerShell scripts call the Console.Write method or when you try to start many console applications on a PowerShell console in Windows 7 or in Windows Server 2008 R2

    WinDbg Help File Entry:

    WinDbg Output Example:



STOP 0xC0000194: SAVER_NONRESPONSIVEPROCESS    (go to top of page)


STOP 0xC0000218: STATUS_CANNOT_LOAD_REGISTRY_FILE    (go to top of page)

Usual causes:  File corrupt/missing, Device driver corrupting memory, Memory failure,

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560172(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x218

    Knowledge Base Articles:
                      Troubleshooting specific Stop messages
                      Registry troubleshooting steps for advanced users (XP, Server 2003)
KB 156640    How to Troubleshoot a Stop 0xC0000218 Error Message (NT, 2000)
KB 307545    How to recover from a corrupted registry that prevents Windows XP from starting
KB 314874    How to Troubleshoot a Stop 0xC0000218 Error (XP)
KB 815011    Cannot Disable the Registry Repair and Recovery Feature in Windows XP SP1
KB 822705    Registry troubleshooting steps for advanced users

    WinDbg Help File Entry:

The STATUS_CANNOT_LOAD_REGISTRY_FILE bug check has a value of 0xC0000218. This indicates that a registry file could not be loaded.

Parameters

This bug check will display a descriptive text message. The name of the damaged file is displayed as part of the message.

Cause

This error occurs if a necessary registry hive file cannot be loaded. Usually this means the file is corrupt or is missing.

In rare instances, this error can be caused by a driver that has corrupted the registry image in memory, or by a memory error in this region.

Resolving the Problem

Try running the Emergency Recovery Disk (ERD) and allow the system to repair any errors that it detects. If the problem is a missing or corrupt registry file, this will usually fix the problem.

    WinDbg Output Example:
Unknown bugcheck code (c0000218)
Unknown bugcheck description
Arguments:
Arg1: 87ef03a0
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000


STOP 0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED    (go to top of page)
STOP 0xC000021A: WINLOGON_FATAL_ERROR (Changed in Win8 DP SDK v8.0)

Usual causes:  User-mode device driver, system service, or third-party application, Mismatched system files

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560177(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x21a

Discussion link here:  http://www.sevenforums.com/crashes-debugging/152386-cant-seem-find-answer.html#post1308276

    Knowledge Base Articles:
KB 156669    How to troubleshoot a "STOP 0xC000021A" error (XP, Server 2003)
KB 294728    Error message: "Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)" in Win32k.sys or a "Stop error code 0xC000021A" (2000/NT 4.0)
KB 295087    Error Message Cites STOP 0xc000021a Event and STATUS_SYSTEM_PROCESS_TERMINATED (2000)
KB 327020    Error Message Occurs When You Start Disk Management After Extending a Hardware Array (2000)
KB 330303    Error message in Windows 2000: "STOP: c000021a (Fatal System Error)"
KB 889088    Your computer does not start and you receive a "Stop 0xC000021a" error message in Windows Server 2003
KB 922410    Error message when you restart a computer that is running Windows XP Professional: "Stop 0xC000021A"
KB 950928    Error message when you restart a computer that is running Windows Server 2003 or an x64-based version of Windows XP Professional: "Stop 0xC000021A"
KB 977911    The system language is changed or you receive a Stop error after you restart a computer that is running a preinstalled version of Windows 7: "0x00000021a"
KB 2746140    You receive "0x0000006B" and "0XC000021A" Stop error message after uninstalling McAfee Agent 4.6.2 in Windows Vista, Windows 7, Windows Server 2008 or Windows Server 2008 R2
KB 2839011    You receive an Event ID 55 or a 0xc000021a Stop error in Windows 7 after you install security update 2823324 (Server 2008 R2, Server 2008 also)

    More BSOD articles at this link:  http://search.microsoft.com/results.aspx?mkt=en-US&q=stop%3A%200xC000021A&qsc0=0&l=1&first=1&FORM=PEME

    WinDbg Help File Entry:

The STATUS_SYSTEM_PROCESS_TERMINATED bug check has a value of 0xC000021A. This means that an error has occurred in a crucial user-mode subsystem.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 A string that identifies the problem
2 The error code
3 Reserved
4 Reserved

Cause

This error occurs when a user-mode subsystem, such as WinLogon or the Client Server Run-Time Subsystem (CSRSS), has been fatally compromised and security can no longer be guaranteed. In response, the operating system switches to kernel mode. Microsoft Windows cannot run without WinLogon or CSRSS. Therefore, this is one of the few cases where the failure of a user-mode service can shut down the system.

Mismatched system files can also cause this error. This can occur if you have restored your hard disk from a backup. Some backup programs might skip restoring system files that they determine are in use.

Resolving the Problem

Running the kernel debugger is not useful in this situation because the actual error occurred in a user-mode process.

Resolving an error in a user-mode device driver, system service, or third-party application: Because bug check 0xC000021A occurs in a user-mode process, the most common culprits are third-party applications. If the error occurred after the installation of a new or updated device driver, system service, or third-party application, the new software should be removed or disabled. Contact the manufacturer of the software about a possible update.

If the error occurs during system startup, restart your computer, and press F8 at the character-based menu that displays the operating system choices. At the resulting Windows Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time. If this does not resolve the error, try manually removing the offending software. If the system partition is formatted with file allocation table (FAT), use an MS-DOS startup disk to gain access to the computer's hard disk. If the system partition is formatted with NTFS file system, you might be able to use Safe Mode to rename or delete the faulty software. If the faulty software is used as part of the system startup process in Safe Mode, you need to start the computer using the Recovery Console in order to access the file. If a newly installed piece if hardware is suspected, remove it to see if this resolves the issue.

Try running the Emergency Recovery Disk (ERD) and allow the system to repair any errors that it detects.

Resolving a mismatched system file problem: If you have recently restored your hard disk from a backup, check if there is an updated version of the Backup/Restore program available from the manufacturer. Make sure the latest Windows Service Pack is installed.

    WinDbg Output Example:
WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: fffff88000acdcf0, String that identifies the problem.
Arg2: ffffffffc0000001, Error Code.
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0xC0000221: STATUS_IMAGE_CHECKSUM_MISMATCH    (go to top of page)

Usual causes:  Device driver, System DLL corruption, Faulty hardware in I/O path (a disk error, faulty RAM, or a corrupted page file), BIOS

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560180(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x221

    Knowledge Base Articles:
                      Troubleshooting specific Stop messages
KB 101096    Error Message: STOP: C0000221 Unknown Hard Error or STOP: C0000221 STATUS_IMAGE_CHECKSUM_MISMATCH (NT, 2000)
KB 142676    How to correct common User32.dll file errors (2000, XP, Server 2003, Vista)
KB 160495    Err Msg: STOP: C000026C Unable to Load Device Driver... (NT, 2000)
KB 314474    "STOP: C0000221 unknown hard error" or "STOP: C0000221 STATUS_IMAGE_CHECKSUM_MISMATCH" error message occurs (XP)
KB 315241    A Stop: 0xc000026C or Stop: 0xc0000221 "Unable to Load Device Driver" Error Occurs When You Start Windows XP
KB 326687    "Bad Image Checksum" Error When You Upgrade to Windows XP
KB 826353    "0xc0000221" Stop Error Occurs When You Try to Run an LDAP Query (2000)

    WinDbg Help File Entry:

The STATUS_IMAGE_CHECKSUM_MISMATCH bug check has a value of 0xC0000221. This indicates that a driver or a system DLL has been corrupted.

Parameters

This bug check will display a descriptive text message. The name of the damaged file is displayed as part of the message.

Cause

This bug check results from a serious error in a driver or other system file. The file header checksum does not match the expected checksum.

This can also be caused by faulty hardware in the I/O path to the file (a disk error, faulty RAM, or a corrupted page file).

Resolving the Problem

To remedy this error, run the Emergency Recovery Disk (ERD) and allow the system to repair or replace the missing or damaged driver file on the system partition.

You can also run an in-place upgrade over the existing copy of Windows. This preserves all registry settings and configuration information, but replaces all system files. If any Service Packs and/or hotfixes had previously been applied, you need to reinstall them afterward in the appropriate order (latest Service Pack, then any post-Service Pack hotfixes in the order in which they were originally installed, if applicable).

If a specific file was identified in the bug check message as being corrupted, you can try replacing that individual file manually. If the system partition is formatted with FAT, you can start from an MS-DOS startup disk and copy the file from the original source onto the hard disk. If you have a dual-boot machine, you can boot to your other operating system and replace the file.

If you want to replace the file on a single-boot system with an NTFS partition, you need to restart the system, press F8 at the operating system Loader menu, and choose Safe Mode with Command Prompt. From there, copy a fresh version of the file from the original source onto the hard disk. If the file is used as part of the system startup process in Safe Mode, you need to start the computer using the Recovery Console in order to access the file. If these methods fail, try reinstalling Windows and then restoring the system from a backup.

Note  If the original file from the product CD has a filename extension ending in an _ (underscore), the file needs to be uncompressed before it can be used. The Recovery Console's Copy command automatically detects compressed files and expands them as they are copied to the target location. If you are using Safe Mode to access a drive, use the Expand command to uncompress and copy the file to the target folder. You can use the Expand command in the command line environment of Safe Mode.

Resolving a disk error problem: Disk errors can be a source of file corruption. Run Chkdsk /f /r to detect and resolve any file system structural corruption. You must restart the system before the disk scan begins on a system partition.

Resolving a RAM problem: If the error occurred immediately after RAM was added to the system, the paging file might be corrupted or the new RAM itself might be either faulty or incompatible.

To determine if newly added RAM is causing a bug check
  1. Return the system to the original RAM configuration.
  2. Use the Recovery Console to access the partition containing the paging file and delete the file pagefile.sys.
  3. While still in the Recovery Console, run Chkdsk /r on the partition that contained the paging file.
  4. Restart the system.
  5. Set the paging file to an optimal level for the amount of RAM added.
  6. Shutdown the system and add your RAM.

    The new RAM must meet the system manufacturer's specifications for speed, parity, and type (that is, fast page-mode (FPM) versus extended data out (EDO) versus synchronous dynamic random access memory (SDRAM)). Try to match the new RAM to the existing installed RAM as closely as possible. RAM can come in many different capacities, and more importantly, in different formats (single inline memory modules — SIMM — or dual inline memory modules — DIMM). The electrical contacts can be either gold or tin and it is not wise to mix these contact types.

If you experience the same error message after reinstalling the new RAM, run hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the owner's manual for your computer.

When you can log on to the system again, check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error.

Disabling memory caching of the BIOS might also resolve this error.

    WinDbg Output Example:
Unknown bugcheck code (c0000221)
Unknown bugcheck description
Arguments:
Arg1: 8aafee30
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000


STOP 0xC0000244:  AUDIT_FAILED    (go to top of page)

Usual causes: 

    AUMHA Listing:  http://aumha.org/a/stop.php#0x244

    Knowledge Base Articles:
KB 232564    STOP 0xC0000244 when security log full (NT, 2000, XP, Server 2003)
KB 314358    Error Message: Stop 0xC0000244 Unable to Generate Security Events (XP)
KB 323475    A "Stop 0xc0000244" Error Occurs When You Audit Policy Changes If CrashOnAuditFail Is Turned On (XP)
KB 829082    You receive a "Stop error 0xC0000244 {Audit Failed}" error message when the crashonauditfail registry key is set to 1 on a Windows Server 2003-based computer
KB 884889    You receive a "STOP: 0xC0000244 {Audit Failed}" error message if you shut down a Windows 2000 Service Pack 3-based or Service Pack 4-based computer
KB 920983    Stop error message when you put a Windows XP Starter Edition-based computer on standby: "0xC0000244"
KB 925112    Error message when you try to clear or to back up the Security log on a Windows XP-based computer: "Stop 0xC0000244 (STATUS_AUDIT_FAILED)"
KB 2346270    You receive a "Stop error 0xC0000244 {Audit Failed}" error message during the shutdown process after you enable the CrashOnAuditFail setting on a computer that is running Windows Server 2008 or Windows Vista
KB 2546548    "0xC0000244" Stop error when the Security log reaches its maximum size in Windows 7 or in Windows Server 2008 R2
KB 2673371    "0xC0000244" Stop error occurs when the Security log reaches its maximum size in Windows Vista or in Windows Server 2008


    More BSOD articles in this search:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0xC0000244&x=14&y=18&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

    WinDbg Output Example:



STOP 0xC000026C: ???FATAL SYSTEM ERROR???    (go to top of page)

Usual causes: 

    AUMHA Listing:  http://aumha.org/a/stop.php#0x26c

    Knowledge Base Articles:
KB 142676    How to correct common User32.dll file errors (2000, XP, Server 2003, Vista)
KB 160495    Err Msg: STOP: C000026C Unable to Load Device Driver... (NT, 2000)
KB 315241    A Stop: 0xc000026C or Stop: 0xc0000221 "Unable to Load Device Driver" Error Occurs When You Start Windows XP
KB 830582    After you install the MS03-030 DirectX security update, your Windows 2000-based computer stops responding

    WinDbg Help File Entry:

    WinDbg Output Example:

STOP 0xC00002CB: Security Accounts Manager initialization failed    (go to top of page)

Usual causes: 

    Knowledge Base Articles:
KB 2642837    STOP:c00002cb Security Accounts Manager initialization failed (Server 2008 R2 in mixed environment w/Server 2003)

    WinDbg Help File Entry:

    WinDbg Output Example:

STOP 0xC00002E2:  Directory Services could not start because of the following error:    (go to top of page)

Usual causes: 

    Knowledge Base Articles:
KB 2737463    Domain controller does not start, c00002e2 error occurs, or "Choose an option" is displayed (Server 2008/2008 R2/2012)

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0xC00002E3: ???STATUS_SAM_INIT_FAILURE???    (go to top of page)
Usual causes:
  I suspect encryption software or compatibility issues
Found in this topic:  http://www.sevenforums.com/crashes-debugging/240768-bsod-after-update-vga-driver.html

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (c00002e3)
Unknown bugcheck description
Arguments:
Arg1: 96286a60
Arg2: c0000189
Arg3: 00000000
Arg4: 00000000



STOP 0xC0000415: Unknown Error    (go to top of page)

Usual causes: 

    AUMHA Listing:

    Knowledge Base Articles:
KB 829884    A "Stop error code 0xc0000415" occurs when you run Windows XP

    WinDbg Help File Entry:

    WinDbg Output Example:


STOP 0xDEADDEAD: MANUALLY_INITIATED_CRASH1    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560300(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xdead

    Knowledge Base Articles:

    WinDbg Help File Entry:

The MANUALLY_INITIATED_CRASH1 bug check has a value of 0xDEADDEAD. This indicates that the user deliberately initiated a crash dump from either the kernel debugger or the keyboard.

Parameters

None

Comments

For details on manually-initiated crash dumps, see Forcing a System Crash.


    WinDbg Output Example:
MANUALLY_INITIATED_CRASH1 (deaddead)
The user manually initiated this crash dump.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0xE0010002:    (go to top of page)

Usual causes:
  nusb3xhc.sys (part of Renesas USB 3.0 driver) - most BSOD's point to this driver, suspect that it's coded into the Renesas drivers
    Found in this topic:  http://www.sevenforums.com/crashes-debugging/169335-bsod-envy-15-2nd-gen-when-hibernating-resuming-hibernate.html

    MSDN Listing (WDK):
    AUMHA Listing:

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (e0010002)
Unknown bugcheck description
Arguments:
Arg1: fffffa8006841000
Arg2: 000000000000000c
Arg3: 0000000000000205
Arg4: 000000000000094e

STOP fvevol!FveFilterDeviceControl+1d0 :    (go to top of page)

Usual causes: 
    Found in this topic (Win7):  http://www.sevenforums.com/crashes-debugging/166472-bsod-windows-7-a.html

    MSDN Listing (WDK):
    AUMHA Listing:

    Knowledge Base Articles:
KB 2632149     "fvevol!FveFilterDeviceControl+1d0" Stop error when you create a VSS snapshot backup in Windows Server 2008 R2 SP1
KB 2708549    Stop error when you create a VSS snapshot backup in Windows 7 SP1 or in Windows Server 2008 R2 SP1: "fvevol!FveFilterDeviceControl+1d0"

    WinDbg Help File Entry:

    WinDbg Output Example:


UNKNOWN STOP ERRORs:    (go to top of page)
This section is for STOP error KB articles that don't identify a particular STOP error

    Knowledge Base Articles:
KB 899419    You may receive a Stop error message when you use the SCardControl function to transfer lots of data to a USB smart card reader that is on a Windows Server 2003 Service Pack 1-based computer
The smart card reader is using the in-box USB Chip/Smart Card Interface Devices (CCID) class driver (Usbccid.sys).

KB 933620    The operating system stops unexpectedly and you receive a Stop error message after you start the Sony VAIO Camera Capture Utility on a Sony VAIO UX Series Micro PC that is running Windows Vista

Error occurs in the USBCAMD_ProcessIsoIrps function.

KB  916157    When you receive a Stop error message or a fatal system error message, a user-mode process dump file is not created in Windows XP

KB 932755    An updated Storport storage driver is available for Windows Server 2003