http://www.carrona.org
MVP Logo John Carrona
Windows Expert - Consumer
Most Popular Pages:
BSOD Index                         Driver Reference Table (DRT)

Hard Drive Diagnostics        Memory Diagnostics
Quick Links to the different sections:
Family                BSOD                Registry                Diagnostics 

Boot                   Memory             Windows              Misc
RSS Feed Subscribe to the RSS feed
Originally Added to Website:  14 Sep 2009
Last Updated  (<— link shows ALL updates):
 My apologies for not having updated this page in a very long while :0)

23 Jul 2014
Added WinDbg Output Example for STOP 0x153
21 Mar 2014

Added Usual Cause: memory to STOP 0x74
KB 2931772 - STOP 0x50 - Win7 SP1/Server 2008 R2 SP1
KB 2920540 - STOP 0xc0000005 - Win8.1/Server 2012 R2
KB 2916627 - STOP 0x8E - Win7/Server 2008 R2
KB 2927725 - STOP 0x101/0x133 - Win8/Server 2012
KB 2911204 - STOP 0x9F - Win7/Win8.1/Server 2008 R2/Server 2012 R2


PAGE INFORMATION:
Initial document from the bugcodes.h file in the Windows 7 SDK v7.0;  Debugging Tools For Windows - dated 17 January 2009;  Additional information added as it became verifiable on the web.
-  Updated for Win8 on 09May2012 - added 20 bugchecks
-  Updated for Win8.1 on 01Oct2013 - added 23 bugchecks
Some information on Windows NT/2000 links has been left out due to the enormous number of KB articles available.  
As of 02 Apr 2012, I have discontinued listing Windows 2000 articles.
This page will continue to list articles for XP and later OS's for the foreseeable future.
At last count (20 Nov 2013) there were more than 406 different STOP error messages in this listing.  
Copyright
registered 15 Oct 2009

Take me straight to the BSOD listing (abbreviated to make looking it up easier)...
Take me to the long Table of Contents listing...

Take me to the General Information about BSOD's section...

Take me to the Specific STOP message troubleshooting section...
Take me to the General STOP message troubleshooting section...

Please notify me if you find anything wrong, missing, new, or just have a comment.
I post as usasma on these forums:
- Sysnative Forums (preferred method of contact)
- Microsoft Answers
- Eight Forums

If referring to a specific STOP error message, please attach/upload the Minidump files (from C:\Windows\Minidump) with your comments.


GENERAL INFORMATION ABOUT BSOD's:
A BSOD is also known by many other names:
- Blue Screen of Death (hence the BSOD acronym)
- STOP error
- Crash dump
- Memory dump
- Bug Check
- BCCode

A BSOD is an error that causes Windows to STOP (hence the name "STOP error").  This is done because the potential exists for damage to your system - and Windows is designed to "fail fast" in order to protect your hardware.  

STOP error numbers can either be the full number (0x0000007B for example), or in "shorthand" (0x7B is shorthand for 0x0000007B).  Capitalization doesn't usually matter.

It's been my experience that most STOP errors are caused by 3rd party drivers - either device drivers, or drivers that are a part of a software installation.  The next most common reason (again, IME) is hardware troubles - either broken hardware or compatibility problems.  Finally, there's Windows corruptions - this is rarer than the other 2 but it does happen.

To make this easy on you, just follow through the pages here.  If you don't understand something, ask on the forums.  Due to the great variety of STOP errors it's not essential that you understand everything that is said here - but progressing through each of the steps/links will help you with resolving a BSOD issue.


Specific STOP message troubleshooting:
    Troubleshooting specific STOP messages (2000, but steps do apply to other OS's also)
    Contains steps for troubleshooting STOP 0xA, 0x1E, 0x23, 0x24, 0x2E, 0x3F, 0x58, 0x7B, 0x7F, 0xB4, and 0xBE

    Troubleshooting Common Stop Messages (2000, but steps do apply to other OS's also)
    Contains steps for troubleshooting STOP 0xA, 0x1E, 0x24, 0x2E, 0x50, 0x77, 0x79, 0x7A, 0x7B, 0x7F, 0xC0000021A, and 0xC0000221

    Troubleshooting specific Stop messages (Server 2003, but steps do apply to other OS's also)
    Contains links for:  STOP 0x1E - How to troubleshoot a "Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)" error message

STOP 0x117 (BSOD not always visible) - Display driver stopped responding and has recovered Error message in Windows Vista or Windows 7

General STOP message troubleshooting:
First, ensure that you have disabled auto-restart & enabled mini-dumps - Instructions here:  setmini.html

-  Blue Screen Preparation Before Contacting Microsoft (2000 - but steps do apply to other OS's also)
    Submit the information to Microsoft if the system wants to.  Quite often you won't get any response back - but if you do, it'll be worth the trouble.
 
Troubleshooting Stop messages: general strategies (Server 2003 - but steps do apply to other OS's also)

How to fix BlueScreen (STOP) errors that cause Windows Vista to shut down or restart unexpectedly

How to read the small memory dump files that Windows creates for debugging

- BSOD preliminaries -
 prelim.html  
- WinDbg Analysis Report generation - dbgrpt.html 
- What I do when analyzing a BSOD (dated 6/14/2009) - http://www.sevenforums.com/general-discussion/13020-bsod-tcpip-sys-crash.html#post129991
This is an actual analysis of a BSOD, so the context of the entire topic is important to the procedures that are followed there.

More info on BSOD stuff:  http://www.carrona.org/bsod.html

Misc Tools/Information:
Windows does not create a memory dump file when a Stop error occurs in Windows 8 or Windows Server 2012

Using Driver Verifier to identify issues with Windows drivers for advanced users

Description of Windows Kernel event ID 41 error in Windows 7 or in Windows Server 2008 R2: "The system has rebooted without cleanly shutting down first"

Secondary dump data is limited to 256 MB in Windows 7 and Windows Server 2008 R2

A hotfix is available that enables a Windows 7-based or Windows Server 2008 R2-based computer to create a memory dump file without a page file

Overview of memory dump file options for Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2

Unable to install updates in Windows Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2

Troubleshoot problems installing and uninstalling programs on Windows-based computers

Description of Microsoft Internet Information Services (IIS) 5.0 and 6.0 status codes

Description of Code 10-related errors that Device Manager generates in Windows-based computers

How to use the Debug Diagnostics tool to troubleshoot a process that has stopped responding in IIS

How to disable IP version 6 (IPv6) or its specific components in Windows 7, in Windows Vista, in Windows Server 2008 R2, and in Windows Server 2008

Troubleshoot network connection problems in Windows

How to use the Debug Diagnostics tool to troubleshoot an IIS process that stops unexpectedly


THE BSOD LISTING:
You can find your error message by searching the page for the STOP Error number ( 0x00000000: ) or the SYMBOLIC_NAME
Or, you can use the links below...
The Table of Contents Links will take you to the actual (long) Table of Contents.
The actual Table of Contents contains links to the entry for that particular error (approx 349 entries).


Table of Contents Links:    (go to top of page)
Example Entry

STOP -1073741502

STOP 0x00000001 - STOP 0x0000000F
STOP 0x00000010 - STOP 0x0000001F
STOP 0x00000020 - STOP 0x0000002F
STOP 0x00000030 - STOP 0x0000003F
STOP 0x00000040 - STOP 0x0000004F
STOP 0x00000050 - STOP 0x0000005F
STOP 0x00000060 - STOP 0x0000006F
STOP 0x00000070 - STOP 0x0000007F
STOP 0x00000080 - STOP 0x0000008F
STOP 0x00000090 - STOP 0x0000009F
STOP 0x000000A0 - STOP 0x000000AF
STOP 0x000000B0 - STOP 0x000000BF
STOP 0x000000C0 - STOP 0x000000CF
STOP 0x000000D0 - STOP 0x000000DF
STOP 0x000000E0 - STOP 0x000000EF
STOP 0x000000F0 - STOP 0x000000FF

STOP 0x000000MN

STOP 0x00000100 - STOP 0x0000010F
STOP 0x00000110 - STOP 0x0000011F
STOP 0x00000120 - STOP 0x0000012F
STOP 0x00000130 - STOP 0x0000013F
STOP 0x00000140 - STOP 0x0000014F
STOP 0x00000150 - STOP 0x0000015F
STOP 0x00000160 - STOP 0x00000162


STOP 0x00000333
STOP 0x00000360/420
STOP 0x00000BFE
STOP 0x0000C1F5
STOP 0x00020001

STOP 0x1000000a - STOP 0x100000ea

STOP 0x40000082 - STOP 0x400000ad

STOP 0x70860002

STOP 0x80070246

STOP 0x80080005

STOP 0x8086

STOP 0x9087

STOP 0xA0000001

STOP 0xBADB0D00

STOP 0xC0000005 - STOP 0xC0000415

STOP 0xDEADDEAD


STOP 0xE0010002

Table Of Contents    (go to top of page)
  1. Example Entry:
  2. STOP -1073741502
  3. STOP 0x00000001: APC_INDEX_MISMATCH
  4. STOP 0x00000002: DEVICE_QUEUE_NOT_BUSY
  5. STOP 0x00000003: INVALID_AFFINITY_SET
  6. STOP 0x00000004: INVALID_DATA_ACCESS_TRAP
  7. STOP 0x00000005: INVALID_PROCESS_ATTACH_ATTEMPT
  8. STOP 0x00000006: INVALID_PROCESS_DETACH_ATTEMPT
  9. STOP 0x00000007: INVALID_SOFTWARE_INTERRUPT
  10. STOP 0x00000008: IRQL_NOT_DISPATCH_LEVEL
  11. STOP 0x00000009: IRQL_NOT_GREATER_OR_EQUAL
  12. STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL
  13. STOP 0x0000000B: NO_EXCEPTION_HANDLING_SUPPORT
  14. STOP 0x0000000C: MAXIMUM_WAIT_OBJECTS_EXCEEDED
  15. STOP 0x0000000D: MUTEX_LEVEL_NUMBER_VIOLATION
  16. STOP 0x0000000E: NO_USER_MODE_CONTEXT
  17. STOP 0x0000000F: SPIN_LOCK_ALREADY_OWNED
  18. STOP 0x00000010: SPIN_LOCK_NOT_OWNED
  19. STOP 0x00000011: THREAD_NOT_MUTEX_OWNER
  20. STOP 0x00000012: TRAP_CAUSE_UNKNOWN
  21. STOP 0x00000013: EMPTY_THREAD_REAPER_LIST
  22. STOP 0x00000014: CREATE_DELETE_LOCK_NOT_LOCKED
  23. STOP 0x00000015: LAST_CHANCE_CALLED_FROM_KMODE
  24. STOP 0x00000016: CID_HANDLE_CREATION
  25. STOP 0x00000017: CID_HANDLE_DELETION
  26. STOP 0x00000018: REFERENCE_BY_POINTER
  27. STOP 0x00000019: BAD_POOL_HEADER
  28. STOP 0x0000001A: MEMORY_MANAGEMENT
  29. STOP 0x0000001B: PFN_SHARE_COUNT
  30. STOP 0x0000001C: PFN_REFERENCE_COUNT
  31. STOP 0x0000001D: NO_SPIN_LOCK_AVAILABLE
  32. STOP 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED
  33. STOP 0x0000001F: SHARED_RESOURCE_CONV_ERROR
  34. STOP 0x00000020: KERNEL_APC_PENDING_DURING_EXIT
  35. STOP 0x00000021: QUOTA_UNDERFLOW
  36. STOP 0x00000022: FILE_SYSTEM
  37. STOP 0x00000023: FAT_FILE_SYSTEM
  38. STOP 0x00000024: NTFS_FILE_SYSTEM
  39. STOP 0x00000025: NPFS_FILE_SYSTEM
  40. STOP 0x00000026: CDFS_FILE_SYSTEM
  41. STOP 0x00000027: RDR_FILE_SYSTEM
  42. STOP 0x00000028: CORRUPT_ACCESS_TOKEN
  43. STOP 0x00000029: SECURITY_SYSTEM
  44. STOP 0x0000002A: INCONSISTENT_IRP
  45. STOP 0x0000002B: PANIC_STACK_SWITCH
  46. STOP 0x0000002C: PORT_DRIVER_INTERNAL
  47. STOP 0x0000002D: SCSI_DISK_DRIVER_INTERNAL
  48. STOP 0x0000002E: DATA_BUS_ERROR
  49. STOP 0x0000002F: INSTRUCTION_BUS_ERROR
  50. STOP 0x00000030: SET_OF_INVALID_CONTEXT
  51. STOP 0x00000031: PHASE0_INITIALIZATION_FAILED
  52. STOP 0x00000032: PHASE1_INITIALIZATION_FAILED
  53. STOP 0x00000033: UNEXPECTED_INITIALIZATION_CALL
  54. STOP 0x00000034: CACHE_MANAGER
  55. STOP 0x00000035: NO_MORE_IRP_STACK_LOCATIONS
  56. STOP 0x00000036: DEVICE_REFERENCE_COUNT_NOT_ZERO
  57. STOP 0x00000037: FLOPPY_INTERNAL_ERROR
  58. STOP 0x00000038: SERIAL_DRIVER_INTERNAL
  59. STOP 0x00000039: SYSTEM_EXIT_OWNED_MUTEX
  60. STOP 0x0000003A: SYSTEM_UNWIND_PREVIOUS_USER
  61. STOP 0x0000003B: SYSTEM_SERVICE_EXCEPTION
  62. STOP 0x0000003C: INTERRUPT_UNWIND_ATTEMPTED
  63. STOP 0x0000003D: INTERRUPT_EXCEPTION_NOT_HANDLED
  64. STOP 0x0000003E: MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED
  65. STOP 0x0000003F: NO_MORE_SYSTEM_PTES
  66. STOP 0x00000040: TARGET_MDL_TOO_SMALL
  67. STOP 0x00000041: MUST_SUCCEED_POOL_EMPTY
  68. STOP 0x00000042: ATDISK_DRIVER_INTERNAL
  69. STOP 0x00000043: NO_SUCH_PARTITION
  70. STOP 0x00000044: MULTIPLE_IRP_COMPLETE_REQUESTS
  71. STOP 0x00000045: INSUFFICIENT_SYSTEM_MAP_REGS
  72. STOP 0x00000046: DEREF_UNKNOWN_LOGON_SESSION
  73. STOP 0x00000047: REF_UNKNOWN_LOGON_SESSION
  74. STOP 0x00000048: CANCEL_STATE_IN_COMPLETED_IRP
  75. STOP 0x00000049: PAGE_FAULT_WITH_INTERRUPTS_OFF
  76. STOP 0x0000004A: IRQL_GT_ZERO_AT_SYSTEM_SERVICE
  77. STOP 0x0000004B: STREAMS_INTERNAL_ERROR
  78. STOP 0x0000004C: FATAL_UNHANDLED_HARD_ERROR
  79. STOP 0x0000004D: NO_PAGES_AVAILABLE
  80. STOP 0x0000004E: PFN_LIST_CORRUPT
  81. STOP 0x0000004F: NDIS_INTERNAL_ERROR
  82. STOP 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA
  83. STOP 0x00000051: REGISTRY_ERROR
  84. STOP 0x00000052: MAILSLOT_FILE_SYSTEM
  85. STOP 0x00000053: NO_BOOT_DEVICE
  86. STOP 0x00000054: LM_SERVER_INTERNAL_ERROR
  87. STOP 0x00000055: DATA_COHERENCY_EXCEPTION
  88. STOP 0x00000056: INSTRUCTION_COHERENCY_EXCEPTION
  89. STOP 0x00000057: XNS_INTERNAL_ERROR
  90. STOP 0x00000058: FTDISK_INTERNAL_ERROR
  91. STOP 0x00000059: PINBALL_FILE_SYSTEM
  92. STOP 0x0000005A: CRITICAL_SERVICE_FAILED
  93. STOP 0x0000005B: SET_ENV_VAR_FAILED
  94. STOP 0x0000005C: HAL_INITIALIZATION_FAILED
  95. STOP 0x0000005D: UNSUPPORTED_PROCESSOR
  96. STOP 0x0000005E: OBJECT_INITIALIZATION_FAILED
  97. STOP 0x0000005F: SECURITY_INITIALIZATION_FAILED
  98. STOP 0x00000060: PROCESS_INITIALIZATION_FAILED
  99. STOP 0x00000061: HAL1_INITIALIZATION_FAILED
  100. STOP 0x00000062: OBJECT1_INITIALIZATION_FAILED
  101. STOP 0x00000063: SECURITY1_INITIALIZATION_FAILED
  102. STOP 0x00000064: SYMBOLIC_INITIALIZATION_FAILED
  103. STOP 0x00000065: MEMORY1_INITIALIZATION_FAILED
  104. STOP 0x00000066: CACHE_INITIALIZATION_FAILED
  105. STOP 0x00000067: CONFIG_INITIALIZATION_FAILED
  106. STOP 0x00000068: FILE_INITIALIZATION_FAILED
  107. STOP 0x00000069: IO1_INITIALIZATION_FAILED
  108. STOP 0x0000006A: LPC_INITIALIZATION_FAILED
  109. STOP 0x0000006B: PROCESS1_INITIALIZATION_FAILED
  110. STOP 0x0000006C: REFMON_INITIALIZATION_FAILED
  111. STOP 0x0000006D: SESSION1_INITIALIZATION_FAILED
  112. STOP 0x0000006E: SESSION2_INITIALIZATION_FAILED
  113. STOP 0x0000006F: SESSION3_INITIALIZATION_FAILED
  114. STOP 0x00000070: SESSION4_INITIALIZATION_FAILED
  115. STOP 0x00000071: SESSION5_INITIALIZATION_FAILED
  116. STOP 0x00000072: ASSIGN_DRIVE_LETTERS_FAILED
  117. STOP 0x00000073: CONFIG_LIST_FAILED
  118. STOP 0x00000074: BAD_SYSTEM_CONFIG_INFO
  119. STOP 0x00000075: CANNOT_WRITE_CONFIGURATION
  120. STOP 0x00000076: PROCESS_HAS_LOCKED_PAGES
  121. STOP 0x00000077: KERNEL_STACK_INPAGE_ERROR
  122. STOP 0x00000078: PHASE0_EXCEPTION
  123. STOP 0x00000079: MISMATCHED_HAL
  124. STOP 0x0000007A: KERNEL_DATA_INPAGE_ERROR
  125. STOP 0x0000007B: INACCESSIBLE_BOOT_DEVICE
  126. STOP 0x0000007C: BUGCODE_NDIS_DRIVER
  127. STOP 0x0000007D: INSTALL_MORE_MEMORY
  128. STOP 0x0000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
  129. STOP 0x0000007F: UNEXPECTED_KERNEL_MODE_TRAP
  130. STOP 0x00000080: NMI_HARDWARE_FAILURE
  131. STOP 0x00000081: SPIN_LOCK_INIT_FAILURE
  132. STOP 0x00000082: DFS_FILE_SYSTEM
  133. STOP 0x00000083: OFS_FILE_SYSTEM
  134. STOP 0x00000084: RECOM_DRIVER
  135. STOP 0x00000085: SETUP_FAILURE
  136. STOP 0x00000086: AUDIT_FAILURE
  137. STOP 0x00000087:
  138. STOP 0x00000088:
  139. STOP 0x00000089:
  140. STOP 0x0000008A:
  141. STOP 0x0000008B: MBR_CHECKSUM_MISMATCH
  142. STOP 0x0000008C:
  143. STOP 0x0000008D:
  144. STOP 0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED
  145. STOP 0x0000008F: PP0_INITIALIZATION_FAILED
  146. STOP 0x00000090: PP1_INITIALIZATION_FAILED
  147. STOP 0x00000091: WIN32K_INIT_OR_RIT_FAILURE
  148. STOP 0x00000092: UP_DRIVER_ON_MP_SYSTEM
  149. STOP 0x00000093: INVALID_KERNEL_HANDLE
  150. STOP 0x00000094: KERNEL_STACK_LOCKED_AT_EXIT
  151. STOP 0x00000095: PNP_INTERNAL_ERROR
  152. STOP 0x00000096: INVALID_WORK_QUEUE_ITEM
  153. STOP 0x00000097: BOUND_IMAGE_UNSUPPORTED
  154. STOP 0x00000098: END_OF_NT_EVALUATION_PERIOD
  155. STOP 0x00000099: INVALID_REGION_OR_SEGMENT
  156. STOP 0x0000009A: SYSTEM_LICENSE_VIOLATION
  157. STOP 0x0000009B: UDFS_FILE_SYSTEM
  158. STOP 0x0000009C: MACHINE_CHECK_EXCEPTION
  159. STOP 0x0000009D:
  160. STOP 0x0000009E: USER_MODE_HEALTH_MONITOR
  161. STOP 0x0000009F: DRIVER_POWER_STATE_FAILURE
  162. STOP 0x000000A0: INTERNAL_POWER_ERROR
  163. STOP 0x000000A1: PCI_BUS_DRIVER_INTERNAL
  164. STOP 0x000000A2: MEMORY_IMAGE_CORRUPT
  165. STOP 0x000000A3: ACPI_DRIVER_INTERNAL
  166. STOP 0x000000A4: CNSS_FILE_SYSTEM_FILTER
  167. STOP 0x000000A5: ACPI_BIOS_ERROR
  168. STOP 0x000000A6: FP_EMULATION_ERROR
  169. STOP 0x000000A7: BAD_EXHANDLE
  170. STOP 0x000000A8: BOOTING_IN_SAFEMODE_MINIMAL
  171. STOP 0x000000A9: BOOTING_IN_SAFEMODE_NETWORK
  172. STOP 0x000000AA: BOOTING_IN_SAFEMODE_DSREPAIR
  173. STOP 0x000000AB: SESSION_HAS_VALID_POOL_ON_EXIT
  174. STOP 0x000000AC: HAL_MEMORY_ALLOCATION
  175. STOP 0x000000AD: VIDEO_DRIVER_DEBUG_REPORT_REQUEST
  176. STOP 0x000000AE:
  177. STOP 0x000000AF:
  178. STOP 0x000000B0:
  179. STOP 0x000000B1:
  180. STOP 0x000000B2:
  181. STOP 0x000000B3:
  182. STOP 0x000000B4: VIDEO_DRIVER_INIT_FAILURE
  183. STOP 0x000000B5: BOOTLOG_LOADED
  184. STOP 0x000000B6: BOOTLOG_NOT_LOADED
  185. STOP 0x000000B7: BOOTLOG_ENABLED
  186. STOP 0x000000B8: ATTEMPTED_SWITCH_FROM_DPC
  187. STOP 0x000000B9: CHIPSET_DETECTED_ERROR
  188. STOP 0x000000BA: SESSION_HAS_VALID_VIEWS_ON_EXIT
  189. STOP 0x000000BB: NETWORK_BOOT_INITIALIZATION_FAILED
  190. STOP 0x000000BC: NETWORK_BOOT_DUPLICATE_ADDRESS
  191. STOP 0x000000BD: INVALID_HIBERNATED STATE
  192. STOP 0x000000BE: ATTEMPTED_WRITE_TO_READONLY_MEMORY
  193. STOP 0x000000BF: MUTEX_ALREADY_OWNED
  194. STOP 0x000000C0: PCI_CONFIT_SPACE_ACCESS_FAILURE
  195. STOP 0x000000C1: SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION
  196. STOP 0x000000C2: BAD_POOL_CALLER
  197. STOP 0x000000C3: BUGCODE_PSS_MESSAGE_SIGNATURE
  198. STOP 0x000000C4: DRIVER_VERIFIER_DETECTED_VIOLATION
  199. STOP 0x000000C5: DRIVER_CORRUPTED_EXPOOL
  200. STOP 0x000000C6: DRIVER_CAUGHT_MODIFYING_FREED_POOL
  201. STOP 0x000000C7: TIMER_OR_DPC_INVALID
  202. STOP 0x000000C8: IRQL_UNEXPECTED_VALUE
  203. STOP 0x000000C9: DRIVER_VERIFIER_IOMANAGER_VIOLATION
  204. STOP 0x000000CA: PNP_DETECTED_FATAL_ERROR
  205. STOP 0x000000CB: DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS
  206. STOP 0x000000CC: PAGE_FAULT_IN_FREED_SPECIAL_POOL
  207. STOP 0x000000CD: PAGE_FAULT_BEYOND_END_OF_ALLOCATION
  208. STOP 0x000000CE: DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS
  209. STOP 0x000000CF: TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE
  210. STOP 0x000000D0: DRIVER_CORRUPTED_MMPOOL
  211. STOP 0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
  212. STOP 0x000000D2: BUGCODE_ID_DRIVER
  213. STOP 0x000000D3: DRIVER_PORTION_MUST_BE_NONPAGED
  214. STOP 0x000000D4: SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD
  215. STOP 0x000000D5: DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL
  216. STOP 0x000000D6: DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION
  217. STOP 0x000000D7: DRIVER_UNMAPPING_INVALID_VIEW
  218. STOP 0x000000D8: DRIVER_USED_EXCESSIVE_PTES
  219. STOP 0x000000D9: LOCKED_PAGES_TRACKER_CORRUPTION
  220. STOP 0x000000DA: SYSTEM_PTE_MISUSE
  221. STOP 0x000000DB: DRIVER_CORRUPTED_SYSPTES
  222. STOP 0x000000DC: DRIVER_INVALID_STACK_ACCESS
  223. STOP 0x000000DD:  ???BIOS IS NOT ACPI COMPLIANT???
  224. STOP 0x000000DE: POOL_CORRUPTION_IN_FILE_AREA
  225. STOP 0x000000DF: IMPERSONATING_WORKER_THREAD
  226. STOP 0x000000E0: ACPI_BIOS_FATAL_ERROR
  227. STOP 0x000000E1: WORKER_THREAD_RETURNED_AT_BAD_IRQL
  228. STOP 0x000000E2: MANUALLY_INITIATED_CRASH
  229. STOP 0x000000E3: RESOURCE_NOT_OWNED
  230. STOP 0x000000E4: WORKER_INVALID
  231. STOP 0x000000E5: POWER_FAILURE_SIMULATE
  232. STOP 0x000000E6: DRIVER_VERIFIER_DMA_VIOLATION
  233. STOP 0x000000E7: INVALID_FLOATING_POINT_STATE
  234. STOP 0x000000E8: INVALID_CANCEL_OF_FILE_OPEN
  235. STOP 0x000000E9: ACTIVE_EX_WORKER_THREAD_TERMINATION
  236. STOP 0x000000EA: THREAD_STUCK_IN_DEVICE_DRIVER
  237. STOP 0x000000EB: DIRTY_MAPPED_PAGES_CONGESTION
  238. STOP 0x000000EC: SESSION_HAS_VALID_SPECIAL_POOL_ON_EXIT
  239. STOP 0x000000ED: UNMOUNTABLE_BOOT_VOLUME
  240. STOP 0x000000EE:
  241. STOP 0x000000EF: CRITICAL_PROCESS_DIED
  242. STOP 0x000000F0:
  243. STOP 0x000000F1: SCSI_VERIFIER_DETECTED_VIOLATION
  244. STOP 0x000000F2: HARDWARE_INTERRUPT_STORM
  245. STOP 0x000000F3: DISORDERLY_SHUTDOWN
  246. STOP 0x000000F4: CRITICAL_OBJECT_TERMINATION
  247. STOP 0x000000F5: FLTMGR_FILE_SYSTEM
  248. STOP 0x000000F6: PCI_VERIFIER_DETECTED_VIOLATION
  249. STOP 0x000000F7: DRIVER_OVERRAN_STACK_BUFFER
  250. STOP 0x000000F8: RAMDISK_BOOT_INITIALIZATION_FAILED
  251. STOP 0x000000F9: DRIVER_RETURNED_STATUS_REPARSE_FOR_VOLUME_OPEN
  252. STOP 0x000000FA: HTTP_DRIVER_CORRUPTED
  253. STOP 0x000000FB: RECURSIVE_MACHINE_CHECK
  254. STOP 0x000000FC: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
  255. STOP 0x000000FD: DIRTY_NOWRITE_PAGES_CONGESTION
  256. STOP 0x000000FE: BUGCODE_USB_DRIVER
  257. STOP 0x000000FF: RESERVE_QUEUE_OVERFLOW
  258. STOP 0x000000MN:
  259. STOP 0x00000100: LOADER_BLOCK_MISMATCH
  260. STOP 0x00000101: CLOCK_WATCHDOG_TIMEOUT
  261. STOP 0x00000102: DPC_WATCHDOG_TIMEOUT
  262. STOP 0x00000103: MUP_FILE_SYSTEM
  263. STOP 0x00000104: AGP_INVALID_ACCESS
  264. STOP 0x00000105: AGP_GART_CORRUPTION
  265. STOP 0x00000106: AGP_ILLEGALLY_REPROGRAMMED
  266. STOP 0x00000107: KERNEL_EXPAND_STACK_ACTIVE
  267. STOP 0x00000108: THIRD_PARTY_FILE_SYSTEM_FAILURE
  268. STOP 0x00000109: CRITICAL_STRUCTURE_CORRUPTION
  269. STOP 0x0000010A: APP_TAGGING_INITIALIZATION_FAILED
  270. STOP 0x0000010B: DFSC_FILE_SYSTEM
  271. STOP 0x0000010C: FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION
  272. STOP 0x0000010D: WDF_VIOLATION
  273. STOP 0x0000010E: VIDEO_MEMORY_MANAGEMENT_INTERNAL
  274. STOP 0x0000010F: RESOURCE_MANAGER_EXCEPTION_NOT_HANDLED
  275. STOP 0x00000110: DRIVER_INVALID_CRUNTIME_PARAMETER
  276. STOP 0x00000111: RECURSIVE_NMI
  277. STOP 0x00000112: MSRPC_STATE_VIOLATION
  278. STOP 0x00000113: VIDEO_DXGKRNL_FATAL_ERROR
  279. STOP 0x00000114: VIDEO_SHADOW_DRIVER_FATAL_ERROR
  280. STOP 0x00000115: AGP_INTERNAL
  281. STOP 0x00000116: VIDEO_TDR_ERROR
  282. STOP 0x00000117: VIDEO_TDR_TIMEOUT_DETECTED
  283. STOP 0x00000118: NTHV_GUEST_ERROR
  284. STOP 0x00000119: VIDEO_SCHEDULER_INTERNAL_ERROR
  285. STOP 0x0000011A: EM_INITIALIZATION_FAILURE
  286. STOP 0x0000011B: DRIVER_RETURNED_HOLDING_CANCEL_LOCK
  287. STOP 0x0000011C: ATTEMPTED_WRITE_TO_CM_PROTECTED_STORAGE
  288. STOP 0x0000011D: EVENT_TRACING_FATAL_ERROR
  289. STOP 0x0000011E: TOO_MANY_RECURSIVE_FAULTS
  290. STOP 0x0000011F: INVALID_DRIVER_HANDLE
  291. STOP 0x00000120: BITLOCKER_FATAL_ERROR
  292. STOP 0x00000121: DRIVER_VIOLATION
  293. STOP 0x00000122: WHEA_INTERNAL_ERROR
  294. STOP 0x00000123: CRYPTO_SELF_TEST_FAILURE
  295. STOP 0x00000124: WHEA_UNCORRECTABLE_ERROR
  296. STOP 0x00000125: NMR_INVALID_STATE
  297. STOP 0x00000126: NETIO_INVALID_POOL_CALLER
  298. STOP 0x00000127: PAGE_NOT_ZERO
  299. STOP 0x00000128: WORKER_THREAD_RETURNED_WITH_BAD_IO_PRIORITY
  300. STOP 0x00000129: WORKER_THREAD_RETURNED_WITH_BAD_PAGING_IO_PRIORITY
  301. STOP 0x0000012A: MUI_NO_VALID_SYSTEM_LANGUAGE
  302. STOP 0x0000012B: FAULTY_HARDWARE_CORRUPTED_PAGE
  303. STOP 0x0000012C: EXFAT_FILE_SYSTEM
  304. STOP 0x0000012D: VOLSNAP_OVERLAPPED_TABLE_ACCESS
  305. STOP 0x0000012E: INVALID_MDL_RANGE
  306. STOP 0x0000012F: VHD_BOOT_INITIALIZATION_FAILED
  307. STOP 0x00000130: DYNAMIC_ADD_PROCESSOR_MISMATCH
  308. STOP 0x00000131: INVALID_EXTENDED_PROCESSOR_STATE
  309. STOP 0x00000132: RESOURCE_OWNER_POINTER_INVALID
  310. STOP 0x00000133: DPC_WATCHDOG_VIOLATION
  311. STOP 0x00000134: DRIVE_EXTENDER
  312. STOP 0x00000135: REGISTRY_FILTER_DRIVER_EXCEPTION
  313. STOP 0x00000136: VHD_BOOT_HOST_VOLUME_NOT_ENOUGH_SPA
  314. STOP 0x00000137: WIN32K_HANDLE_MANAGER
  315. STOP 0x00000138: GPIO_CONTROLLER_DRIVER_ERROR
  316. STOP 0x00000139: KERNEL_SECURITY_CHECK_FAILURE
  317. STOP 0x0000013A: KERNEL_MODE_HEAP_CORRUPTION
  318. STOP 0x0000013B: PASSIVE_INTERRUPT_ERROR
  319. STOP 0x0000013C: INVALID_IO_BOOST_STATE
  320. STOP 0x0000013D: CRITICAL_INITIALIZATION_FAILURE
  321. STOP 0x0000013E: Not documented in the Win8 DP SDK v8.0
  322. STOP 0x0000013F: Not documented in the Win8 DP SDK v8.0
  323. STOP 0x00000140: STORAGE_DEVICE_ABNORMALITY_DETECTED
  324. STOP 0x00000141: VIDEO_ENGINE_TIMEOUT_DETECTED
  325. STOP 0x00000142: VIDEO_TDR_APPLICATION_BLOCKED
  326. STOP 0x00000143: PROCESSOR_DRIVER_INTERNAL
  327. STOP 0x00000144: BUGCODE_USB3_DRIVER
  328. STOP 0x00000145: SECURE_BOOT_VIOLATION
  329. STOP 0x00000146: NDIS_NET_BUFFER_LIST_INFO_ILLEGALLY_TRANSFERRED
  330. STOP 0x00000147: ABNORMAL_RESET_DETECTED
  331. STOP 0x00000148: IO_OBJECT_INVALID
  332. STOP 0x00000149: REFS_FILE_SYSTEM
  333. STOP 0x0000014A: KERNEL_WMI_INTERNAL
  334. STOP 0x0000014B:  SOC_SUBSYSTEM_FAILURE
  335. STOP 0x0000014C:  FATAL_ABNORMAL_RESET_ERROR
  336. STOP 0x0000014D:  EXCEPTION_SCOPE_INVALID
  337. STOP 0x0000014E:  SOC_CRITICAL_DEVICE_REMOVED
  338. STOP 0x0000014F:  PDC_WATCHDOG_TIMEOUT
  339. STOP 0x00000150:  TCPIP_AOAC_NIC_ACTIVE_REFERENCE_LEAK
  340. STOP 0x00000151:  UNSUPPORTED_INSTRUCTION_MODE
  341. STOP 0x00000152:  INVALID_PUSH_LOCK_FLAGS
  342. STOP 0x00000153:  KERNEL_LOCK_ENTRY_LEAKED_ON_THREAD_TERMINATION
  343. STOP 0x00000154:  UNEXPECTED_STORE_EXCEPTION
  344. STOP 0x00000155:  OS_DATA_TAMPERING
  345. STOP 0x00000156:  WINSOCK_DETECTED_HUNG_CLOSESOCKET_LIVEDUMP
  346. STOP 0x00000157:  KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION
  347. STOP 0x00000158:  ILLEGAL_IOMMU_PAGE_FAULT
  348. STOP 0x00000159:  HAL_ILLEGAL_IOMMU_PAGE_FAULT
  349. STOP 0x0000015A:  SDBUS_INTERNAL_ERROR
  350. STOP 0x0000015B:  WORKER_THREAD_RETURNED_WITH_SYSTEM_PAGE_PRIORITY_ACTIVE
  351. STOP 0x0000015C:  PDC_WATCHDOG_TIMEOUT_LIVEDUMP
  352. STOP 0x0000015D:  SOC_SUBSYSTEM_FAILURE_LIVEDUMP
  353. STOP 0x0000015E:  BUGCODE_NDIS_DRIVER_LIVE_DUMP
  354. STOP 0x0000015F:  CONNECTED_STANDBY_WATCHDOG_TIMEOUT_LIVEDUMP
  355. STOP 0x00000160:  WIN32K_ATOMIC_CHECK_FAILURE
  356. STOP 0x00000161:  LIVE_SYSTEM_DUMP
  357. STOP 0x00000162:  KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE
  358. STOP 0x00000333:
  359. STOP 0x00000360: XBOX_360_SYSTEM_CRASH
  360. STOP 0x00000420: XBOX_360_SYSTEM_CRASH_RESERVED
  361. STOP 0x00000BFE: BC_BLUETOOTH_VERIFIER_FAULT
  362. STOP 0x0000C1F5:
  363. STOP 0x00020001: HYPERVISOR_ERROR
  364. STOP 0x1000000A: IRQL_NOT_LESS_OR_EQUAL
  365. STOP 0x10000050: PAGE_FAULT_IN_NONPAGED_AREA_M
  366. STOP 0x1000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
  367. STOP 0x1000007F: UNEXPECTED_KERNEL_MODE_TRAP_M
  368. STOP 0x1000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
  369. STOP 0x100000B8: ATTEMPTED_SWITCH_FROM_DPC
  370. STOP 0x100000CF: TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE
  371. STOP 0x100000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
  372. STOP 0x100000D6: DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION_M
  373. STOP 0x100000EA: THREAD_STUCK_IN_DEVICE_DRIVER_M
  374. STOP 0x40000082: BUGCODE_PSS_MESSAGE
  375. STOP 0x40000083: BUGCHECK_TECH_INFO
  376. STOP 0x40000087: WINDOWS_NT_CSD_STRING
  377. STOP 0x40000088: WINDOWS_NT_INFO_STRING
  378. STOP 0x40000089: WINDOWS_NT_MP_STRING
  379. STOP 0x4000008A: THREAD_TERMINATE_HELD_MUTEX
  380. STOP 0x4000008B: BUGCODE_PSS_CRASH_INIT
  381. STOP 0x4000008C: BUGCODE_PSS_CRASH_PROGRESS
  382. STOP 0x4000008D: BUGCODE_PSS_CRASH_DONE
  383. STOP 0x4000009D: WINDOWS_NT_INFO_STRING_PLURAL
  384. STOP 0x4000009E: WINDOWS_NT_RC_STRING
  385. STOP 0x400000AD: VIDEO_DRIVER_DEBUG_REPORT_REQUEST
  386. STOP 0x70860002:
  387. STOP 0x80080005: CO_E_SERVER_EXEC_FAILURE
  388. STOP 0x8086:
  389. STOP 0x9087:
  390. STOP 0x9088:
  391. STOP 0xA0000001
  392. STOP 0xBADB0D00
  393. STOP 0xC0000005:
  394. STOP 0xC000000D:
  395. STOP 0xC0000034:
  396. STOP 0xC000009A: STATUS_INSUFFICIENT_RESOURCES
  397. STOP 0xC0000135: UNABLE_TO_LOCATE_DLL
  398. STOP 0xC0000142: DLL Initialization Failure
  399. STOP 0xC0000218: STATUS_CANNOT_LOAD_REGISTRY_FILE
  400. STOP 0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED  Changed to WINLOGON_FATAL_ERROR in Win8 DP SDK v8.0
  401. STOP 0xC0000221: STATUS_IMAGE_CHECKSUM_MISMATCH
  402. STOP 0xC0000244:  AUDIT_FAILED
  403. STOP 0xC000026C:  ???FATAL SYSTEM ERROR???
  404. STOP 0xC00002CB: Security Accounts Manager initialization failed
  405. STOP 0xC00002E2:  Directory Services could not start because of the following error:
  406. STOP 0xC00002E3:  ???STATUS_SAM_INIT_FAILURE???
  407. STOP 0xC0000415:  Unknown Error
  408. STOP 0xDEADDEAD: MANUALLY_INITIATED_CRASH1
  409. STOP 0xE0010002


Example Entry:

STOP 0x00000000: SYMBOLIC_NAME    (go to top of page)

Usual causes:  Text

    MSDN Listing (Win2K ResKit):  Link
    AUMHA Listing:  Link

    Knowledge Base Articles:
    Link(s)

    WinDbg Help File Entry:
Text

    WinDbg Output Example (I have example dump files):
Text 

STOP -1073741502    (go to top of page)

Usual causes:  Power Shell Console.Write method?

    Knowledge Base Articles:
KB 2701373    "0xC0000142" or "-1073741502" Stop error when many PowerShell scripts call the Console.Write method or when you try to start many console applications on a PowerShell console in Windows 7 or in Windows Server 2008 R2

    WinDbg Help File Entry:

    WinDbg Output Example:



STOP 0x00000001: APC_INDEX_MISMATCH    (go to top of page)

Usual causes:  Checked build kernel error.  I suspect that this can be caused by something else, as I've seen 2 of these over the past several months - and none appeared to be a checked build

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818748.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557419(v=VS.85).aspx

    Knowledge Base Articles:
KB 935936     You receive a Stop error message on a Windows Vista-based computer: "Stop 0x00000001 (0x00000000, 0x7FFDC000, 0X0000FFFF, 0X00000000)" 
KB 942836    Stop error message when you try to print content that includes a bitmap on a Windows Vista-based computer: "Stop 0x00000001"
KB 2203330    "STOP: 0x00000001" error occurs in Windows Server 2008 R2 or in Windows 7
KB 2619041    "0x00000001" Stop error in Windows Server 2008 R2 or in Windows 7

    WinDbg Help File Entry:

The APC_INDEX_MISMATCH bug check has a value of 0x00000001. This indicates that there has been a mismatch in the APC state index.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the system function (system call)
2 The value of the following bit computation:

Thread->ApcStateIndex << 8 | Previous ApcStateIndex

3 The value of Thread->KernelApcDisable
4 The value of the previous KernelApcDisable

Cause

The most common cause of this bug check is when a file system has a mismatched sequence of KeEnterCriticalRegion calls and KeLeaveCriticalRegion calls.

Comments

This is a kernel internal error which can occur only on a checked build. This error occurs on exit from a system call.

    WinDbg Output Example:
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->KernelApcDisable field. A negative value indicates that a driver
has disabled APC calls without re-enabling them.  A positive value indicates
that the reverse is true. This check is made on exit from a system call.
Arguments:
Arg1: 8287872f, address of system function (system call)
Arg2: 00000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex
Arg3: 00010000, Thread->KernelApcDisable
Arg4: 00000000, Previous KernelApcDisable


STOP 0x00000002: DEVICE_QUEUE_NOT_BUSY    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818752.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557475(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DEVICE_QUEUE_NOT_BUSY bug check has a value of 0x00000002.

This bug check appears very infrequently.

    WinDbg Output Example:
DEVICE_QUEUE_NOT_BUSY (2)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000003: INVALID_AFFINITY_SET    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818756.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558969(v=VS.85).aspx

    Knowledge Base Articles:
KB 841005    You receive a "Stop 0x00000003" error message on your Windows XP-based computer

    WinDbg Help File Entry:

The INVALID_AFFINITY_SET bug check has a value of 0x00000003.

This bug check appears very infrequently.

    WinDbg Output Example:
INVALID_AFFINITY_SET (3)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000004: INVALID_DATA_ACCESS_TRAP    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818763.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559022(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INVALID_DATA_ACCESS_TRAP bug check has a value of 0x00000004.

This bug check appears very infrequently.

    WinDbg Output Example:
INVALID_DATA_ACCESS_TRAP (4)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000005: INVALID_PROCESS_ATTACH_ATTEMPT    (go to top of page)

Usual causes:  Specific known issue with XP SP2/Server 2003 and certain Antivirus or Firewall programs

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818767.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559087(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x05

    Knowledge Base Articles:
KB885958    Your Windows Server 2003-based terminal server that uses the UPHClean utility to unload user profiles when users log off may suddenly stop responding
KB887742    You receive the Stop error "Stop 0x05 (INVALID_PROCESS_ATTACH_ATTEMPT)" in Windows XP Service Pack 2 or Windows Server 2003
KB 908674    Stop error message on an Exchange Server 2003 server: "INVALID_PROCESS_ATTACH_ATTEMPT (5)"(STOP 0x5)

    WinDbg Help File Entry:

The INVALID_PROCESS_ATTACH_ATTEMPT bug check has a value of 0x00000005.

This bug check appears very infrequently.

    WinDbg Output Example:
INVALID_PROCESS_ATTACH_ATTEMPT (5)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000006: INVALID_PROCESS_DETACH_ATTEMPT    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818771.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559160(v=VS.85).aspx

    Knowledge Base Articles:
KB 833314    You randomly receive a "stop 0x00000006" error message (2000)

    WinDbg Help File Entry:

The INVALID_PROCESS_DETACH_ATTEMPT bug check has a value of 0x00000006.

This bug check appears very infrequently.

    WinDbg Output Example:
INVALID_PROCESS_DETACH_ATTEMPT (6)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000007: INVALID_SOFTWARE_INTERRUPT    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818775.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559247(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INVALID_SOFTWARE_INTERRUPT bug check has a value of 0x00000007.

This bug check appears very infrequently.

    WinDbg Output Example:
INVALID_SOFTWARE_INTERRUPT (7)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000008: IRQL_NOT_DISPATCH_LEVEL    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818780.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559278(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The IRQL_NOT_DISPATCH_LEVEL bug check has a value of 0x00000008.

This bug check appears very infrequently.

    WinDbg Output Example:
IRQL_NOT_DISPATCH_LEVEL (8)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000009: IRQL_NOT_GREATER_OR_EQUAL    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818783.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559337(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The IRQL_NOT_GREATER_OR_EQUAL bug check has a value of 0x00000009.

This bug check appears very infrequently.

    WinDbg Output Example:
IRQL_NOT_GREATER_OR_EQUAL (9)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL    (go to top of page)

Usual causes:  Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818787.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560129(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x0a

    Knowledge Base Articles:
KB 157936    SMC9232N Driver Causing Multiple STOP Messages (NT)
KB 183169    Possible Resolutions to STOP 0x0A, 0x01E, and 0x50 Errors (NT, 2000)
KB 193532    Stop 0x0000000A When Running Executable from Floppy Disk (NT)
KB 227301    STOP: 0x0000000A When You Dual Boot with Windows NT 4.0 on the Same Partition (NT, 2000)
KB 244617    How to Use Driver Verifier to Troubleshoot Windows Drivers (2000, XP, Server 2003)
KB 245538    "STOP 0x0000000A" Error Message While Using Rcmdsvc.exe (NT, 2000 Server)
KB 266196    Backup Exec 8.0 May Cause "Stop 0x0000000A" or Sporadic Reboots (2000)
KB 289205    STOP Errors 0x00000023 and 0x0000000A in Fastfat.sys When a Program Queries the File System (2000 Server)
KB 307129    "Fatal System Error" When You Try to Use a Hewlett-Packard 5100C ScanJet (XP)
KB 308605    Stop 0x00000048 or Stop 0x0000000A Caused By Named Pipe File System (Npfs.sys) (NT)
KB 310628    Easy CD Creator 5.0 does not function in Windows XP
KB 310918    "Stop 0x0000000A" Error Message When You Fast Switch Between Users (XP)
KB 311564    "Stop 0x0000000A Irql_Not_Less_or_Equal" Error Message During Windows XP Upgrade
KB 311806    Windows XP restarts when you try to shut down your computer
KB 313687    A "Stop 0x0000000A" Error Message Occurs If SetTcpInfo Is Required to Wait (2000)
KB 314063    You receive a "Stop 0x0000000A" error message in Windows XP
KB 315377    A "Stop: 0x0000000a" Error Occurs After You Install an HP ScanJet 5100c or 5200c Scanner (2000)
KB 316676    "STOP 0x0000000A" Error Message When You Change from AC Power to DC Power (XP)
KB 319810    A Computer May Hang During a Heavy Load with an Ericsson HIS Modem (2000, XP)
KB 321420    "Stop 0x0000000A" Error Message and Computer Stops Responding When You Use Dial-up RAS Connection (2000)
KB 321613    Stop 0x0a Error in nt!ExpBoostOwnerThread() on Windows 2000 Server
KB 326189    "Stop" Errors Occur in ObpDestroySecurityDescriptorHeader (NT Server)
KB 329175    Rdbss.sys May Cause STOP 0xA Error (2000)
KB 818501    How to debug a system after you receive "Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)" (XP)
KB 816054    "STOP 0x0000000a" Error Message During the Dynamics.exe Process in Great Plains 7.5 (2000)
KB 818326    STOP 0x0000001D or STOP 0x000000A Stop Error Occurs in Ndis.sys (XP)
KB 819895    STOP 0x0000000A Error When Computer Performs Intensive Operations on USB Drives (2000, XP, Server 2003)
KB 824025    You Receive a "STOP 0x0000000a" Error Message That Is Related to the Wdmaud.sys Driver (2000)
KB 824679    Stop Error "0x0000000A" Occurs During a Period of High Hard Disk Activity (2000)
KB 833763    You receive a "Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)" or a "Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)" on a Windows 2000-based computer
KB 836049    Windows Server 2003 stops responding with a Stop 0x0000000A error
KB 837384    "Stop: 0x0000000A (00000063, 0000001c, 00000000, parameter4)" error message on a Windows 2000-based computer
KB 840551    Intermittent errors in IA64 editions of Windows Server 2003: Stop error code 0x0000009C (MACHINE_CHECK_EXCEPTION), Stop error code 0x00000024 (NTFS_FILE_SYSTEM), or Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)
KB 841475    Stop error code 0x0000000A in srv.sys during Windows Server 2003 startup
KB 867778    You may receive a "Stop 0X0000000A" Stop error in Ntoskrnl.exe on a Windows 2000-based computer
KB 892000    You may receive a "Stop" error message on a computer that is running Windows Server 2003, Windows 2000, Windows Small Business Server 2003, Small Business Server 2000, or Windows XP
KB 897079    A diagnostic program may immediately close and you may receive a "STOP 0x00000050" or "STOP 0x0000000A" error message in Windows Server 2003, Windows 2000, or Windows XP
KB 897574    You may receive a Stop error message after you insert media into a removable disk device in Windows XP, Windows Server 2003, or Windows 2000
KB 902069    You may receive a "Stop 0x0000000A" error message when you shut down or restart a computer that is running Windows Server 2003
KB 907353    You receive a Stop error message when you use a hardware device on a computer that is running Windows 2000
KB 908265    You may receive a "STOP 0x0000000A" error message on a Windows 2000-based computer that is running Windows Services for UNIX
KB 908369    You may receive a "Stop 0x0000000A" error message when a processor on a Windows Server 2003-based computer resumes from a C1 idle state
KB 910835    Error message in Windows Server 2003: "Stop 0x0000000A (0x00000806, 0x00000002, 0x00000000, 0x804fd3aa) IRQL_NOT_LESS_OR_EQUAL"
KB 929338    Stop error message in Windows XP with Service Pack 2: "STOP 0x0000001a: MEMORY_MANAGEMENT" or "STOP 0x0000000a: IRQL_NOT_LESS_OR_EQUAL"
KB 929777    Error message when you try to install Windows Vista on a computer that uses more than 3 GB of RAM: "STOP 0x0000000A"
KB 930261    You randomly receive a "Stop 0x0000000A" error in Storport.sys when you start Windows Vista
KB 932755    An updated Storport storage driver is available for Windows Server 2003
KB 935806    Troubleshooting Stop error messages that may occur when you try to install Windows Vista
KB 935920    When the Emulex Elxsli2.sys driver is installed, you may receive a Stop error message after you upgrade your computer to Windows Server 2003 Service Pack 1   
KB 936192    Error message on a computer that is running Windows Server 2003: "Stop 0x0000000a"
KB 936456    Stop error message when you run a filter driver that calls the "CmRegisterCallback" routine to register a "RegistryCallback" routine on a Windows XP SP2-based computer: "STOP: 0x0000000A"
KB 937455    You may receive various Stop error messages on a computer that is running Windows Server 2003
KB 940984    Stop error message if you use two USB streaming-video cameras on a Windows XP SP2-based computer: "STOP 0x0000000A"
KB 941492    Stop error message when the computer resumes from hibernation in Windows Vista: "STOP 0x0000000A"
KB 941507    Stop error message when you start a portable Windows Vista-based computer that has the lid closed: "STOP: 0x0000000A"
KB 945577    Error message when a portable Windows Vista-based computer that has an integrated or external USB camera device resumes from long-term suspend mode: "0x000000E4" or "0x0000000A"
KB 949695    Stop error when you try to hibernate or to resume a Windows Server 2008-based computer or a Windows Vista-based computer after you run the "Common Scenario Stress with IO" test: "0x0000000A"
KB 951149    Stop error on a Windows Server 2008-based terminal server when the server is running under a heavy load: "0x0000000A"
KB 954029     Stop error when you resume a Windows Vista-based computer that is connected to a USB optical disc drive from standby "STOP: 0x000000E4" or "STOP: 0x0000000A"
KB 956029    Stop error when you resume a Windows Vista-based computer that is connected to a USB optical disc drive from standby "STOP: 0x000000E4" or "STOP: 0x0000000A"
KB 958867    You receive a "Stop 0x00000050" or "Stop 0x0000000A" error message when you hot-replace memory on a Windows Server 2008-based computer
KB 959660    Stop error message if you use two USB streaming-video cameras at the same time on a computer that is running Windows Vista or Windows Server 2008: "STOP 0x0000000A"
KB 961324    Stop error message when you run the Dynamic Partition Testing for a Hot Replace test that is included in the Windows Logo Kit in Windows Vista or Windows Server 2008: "Stop 0x0000000A"
KB 961799    A Stop error occurs on a Windows Server 2003-based server when a user accesses shared files on the server by using an SMB connection
KB 967352    Stop error message when you put a computer that is running Windows Vista or Windows Server 2008 into hibernation: "STOP 0x000000A0," "STOP 0x0000007a," or "STOP 0x00000077"
KB 969432    Stop code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL) when multiple legacy SMB clients manage shared files on a Windows Server 2003-based file server at the same time
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)
KB 970938    Stop error when you try to put a Windows Vista Service Pack 1-based or Windows Server 2008-based computer into hibernation: "Stop 0x0000000A"
KB 971280    Random Stop errors on a Windows Server 2003-based computer that performs input/output to file shares hosted on another computer or to a network-attached storage device
KB 973482    Stop error 0x0A, or Stop error 0x7E may occur on a computer that is running Windows Vista or Windows Server 2008
KB 975986    Stop error message on a computer that is running Windows Server 2003 SP2 and that has almost 4 GB or more of physical memory: "0x00000050" or "0x0000000A"
KB 976529    Stop error message after you install a WFP callout driver in Windows Vista SP2 or in Windows Server 2008 SP2: "STOP: 0x0000000A"
KB 976746    Error message when a Windows Server 2008 R2-based or a Windows 7-based computer enters hibernation: "STOP: 0x0000000A"
KB 977287    An error message unexpectedly appears after you create a mirrored volume on a computer that is running Windows Server 2008 or Windows Vista: "Stop 0x0000000a IRQL_NOT_LESS_OR_EQUAL"
KB 978571    Stop error message when you try to put the computer into hibernation (S4) in Windows 7 or in Windows Server 2008 R2: "Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)"
KB 979128    Stop error in Windows Server 2003 SP2: "0x0000000A IRQL_NOT_LESS_OR_EQUAL"
KB 979444    Error message on a blue screen on a computer that is running Windows 7 or Windows Server 2008 R2: "STOP: 0x0000000A"
KB 979551    "0x0000000A" error message when you use CHAP authentication to start a computer that is running Windows Vista or Windows Server 2008 from an iSCSI device
KB 979711    Stop error message on a computer that is running Windows 7 or Windows Server 2008 R2 and that has iSCSI storage: "0x0000000A"
KB 979903    "STOP 0x000000A" Stop error when there is a request to allocate a large amount of contiguous physical memory in Windows Server 2008 R2 or Windows 7
KB 982327    "STOP: 0x0000000A IRQL_NOT_LESS_OR_EQUAL" Stop error message when you try to put the computer into hibernation (S4) in Windows Vista or in Windows Server 2008
KB 982488    You receive an incorrect Stop error message when you send a WHEA handler NMI in Windows Vista and in Windows Server 2008
KB 2028982    "0x0000000A" Stop error message in Windows Vista or in Windows Server 2008 if iSCSI storage is installed
KB 2479442    Stop error during startup in Windows Server 2008 or in Windows Vista
KB 2517752    "0x0000000A" Stop error occurs during the shutdown process on a computer that is running Windows Server 2008 and that has more than 64 processors installed
KB 2536875    "0x0000000A" stop error occurs if one or more iSCSI disks are installed on a computer that is running Windows Server 2008 R2
KB 2547257    "0x0000007E" or "0x0000000A" Stop error occurs when you play and at the same time record TV content on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2549036   "0x0000000A" stop error occurs when several applications access the same network share file by using the MapViewOfFile() API on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2577968    "0x0000000a" Stop error occurs on a computer that has a mirrored volume and that is running Windows Server 2008 R2 or Windows 7
KB 2582260    "0x0000000A" Stop error when you perform ETW tracing on the Afd.sys driver in Windows 7 or in Windows Server 2008 R2
KB 2591837    FIX: Stop error on a server that is running Forefront Threat Management Gateway 2010: "IRQL_NOT_LESS_OR_EQUAL (a)" (Server OS's)
KB 2633799    You randomly receive various Stop errors when you change the network adapter teaming configuration in Windows Server 2008 or in Windows Vista
KB 2673977    "0x0000000A" Stop error when you disable a network adapter that is used for iSCSI in Windows 7 or in Windows Server 2008 R2
KB 2723222    "0x0000000A" Stop error in Windows Vista, Windows 7, Windows Server 2008 or Windows Server 2008 R2
KB 2732487    "0x0000000a" Stop error code when you resume a Windows 7-based computer from sleep or from hibernation
KB 2776366    "0x0000000A" Stop error on a Windows Server 2008 R2-based Hyper-V server that has many pass-through disks
KB 2807832    "0x0000000A" Stop error in Windows 7 or Windows Server 2008 R2
KB 2845653    "0x0000000A" Stop error when you perform a live migration of a virtual machine on a Windows Server 2012-based cluster
KB 2846833    "0x0000000A" Stop error when you try to resume a Windows 8-based computer from sleep mode

    Many more NT results in 20 pages of this search:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000000a&x=4&y=15&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry: 
The IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x0000000A. This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 IRQL at time of reference
3 0: Read

1: Write

4 Address which referenced memory

Cause

This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high.

The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.

If you encounter bug check 0xA while upgrading to a later version of Windows, this error might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version.

Resolving the Problem

If a kernel debugger is available, obtain a stack trace.

To resolve an error caused by a faulty device driver, system service, or BIOS
  1. Restart your computer.
  2. Press F8 at the character-based menu that displays the operating system choices.
  3. Select the Last Known Good Configuration option from the Windows Advanced Options menu. This option is most effective when only one driver or service is added at a time.
To resolve an error caused by an incompatible device driver, system service, virus scanner, or backup tool
  1. Check the System Log in Event Viewer for error messages that might identify the device or driver that caused the error.
  2. Try disabling memory caching of the BIOS.
  3. Run the hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the owner's manual for your computer.
  4. Make sure the latest Service Pack is installed.
  5. If your system has small computer system interface (SCSI) adapters, contact the adapter manufacturer to obtain updated Windows drivers. Try disabling sync negotiation in the SCSI BIOS, checking the cabling and the SCSI IDs of each device, and confirming proper termination.
  6. For integrated device electronics (IDE) devices, define the onboard IDE port as Primary only. Also, check each IDE device for the proper master/subordinate/stand-alone setting. Try removing all IDE devices except for hard disks.

If the message appears during an installation of Windows, make sure that the computer and all installed peripherals are listed in the Microsoft Windows Marketplace Tested Products List.

Here is a debugging example:

kd> .bugcheck       [Lists bug check data.]
Bugcheck code 0000000a
Arguments 00000000 0000001c 00000000 00000000

kd> kb       [Lists the stack trace.]
ChildEBP RetAddr  Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> kv       [Lists the trap frames.]
ChildEBP RetAddr  Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint (FPO: [0,0,0])
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256 (FPO: [0,0] TrapFrame @ 8013eee8)
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> .trap 8013eee8       [Gets the registers for the trap frame at the time of the fault.]
eax=dec80201 ebx=ffdff420 ecx=8013c71c edx=000003f8 esi=00000000 edi=87038e10
eip=00000000 esp=8013ef5c ebp=8013ef64 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
ErrCode = 00000000
00000000 ???????????????       [The current instruction pointer is NULL.]

kd> kb       [Gives the stack trace before the fault.]
ChildEBP RetAddr  Args to Child
8013ef68 fe551aa1 ff690268 00000002 fe5620d2 NT!_DbgBreakPoint
8013ef74 fe5620d2 fe5620da ff690268 80404690
NDIS!_EthFilterIndicateReceiveComplete+0x31
8013ef64 00000246 fe551aa1 ff690268 00000002 elnkii!_ElnkiiRcvInterruptDpc+0x1d0

Comments

Before upgrading to a new version of Windows, remove all third-party device drivers and system services, and disable any virus scanners. Contact the software manufacturers to obtain updates of these third-party tools.

    WinDbg Output Example:
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00720075, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81c1dfe9, address which referenced memory


STOP 0x0000000B: NO_EXCEPTION_HANDLING_SUPPORT    (go to top of page)

Usual causes

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818791.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560171(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The NO_EXCEPTION_HANDLING_SUPPORT bug check has a value of 0x0000000B.

This bug check appears very infrequently.

    WinDbg Output Example:
NO_EXCEPTION_HANDLING_SUPPORT (b)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000000C: MAXIMUM_WAIT_OBJECTS_EXCEEDED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818794.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560236(v=VS.85).aspx

    Knowledge Base Articles:
KB 2869679    "0x0000000C MAXIMUM_WAIT_OBJECTS_EXCEEDED" Stop error on a Windows Server-based computer with many IP addresses (Server 2008, Server 2008 R2; Server 2012)

    WinDbg Help File Entry:

The MAXIMUM_WAIT_OBJECTS_EXCEEDED bug check has a value of 0x0000000C. This indicates that the current thread exceeded the permitted number of wait objects.

Parameters

None

Cause

This bug check results from the improper use of KeWaitForMultipleObjects or FsRtlCancellableWaitForMultipleObjects.

The caller may pass a pointer to a buffer in this routine's WaitBlockArray parameter. The system will use this buffer to keep track of wait objects.

If a buffer is supplied, the Count parameter may not exceed MAXIMUM_WAIT_OBJECTS. If no buffer is supplied, the Count parameter may not exceed THREAD_WAIT_OBJECTS.

If the value of Count exceeds the allowable value, this bug check is issued.

    WinDbg Output Example:
MAXIMUM_WAIT_OBJECTS_EXCEEDED (c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000000D: MUTEX_LEVEL_NUMBER_VIOLATION    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818798.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560311(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The MUTEX_LEVEL_NUMBER_VIOLATION bug check has a value of 0x0000000D.

This bug check appears very infrequently.

    WinDbg Output Example:
MUTEX_LEVEL_NUMBER_VIOLATION (d)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000000E: NO_USER_MODE_CONTEXT    (go to top of page)

Usual causes

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818809.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560360(v=VS.85).aspx

    Knowledge Base Articles:
KB 104903    Stop Message Error 0x0000000E (NT)
KB 126462    Windows NT Setup Err Msg on NEC Express/II: STOP 0x0000000E
KB 303853    You receive a "Stop 0x0000000E" error message, or CPU usage increases to 100 percent when a computer disconnects from a remote access session on your Windows 2000-based computer

    WinDbg Help File Entry:

The NO_USER_MODE_CONTEXT bug check has a value of 0x0000000E.

This bug check appears very infrequently.

    WinDbg Output Example:
NO_USER_MODE_CONTEXT (e)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000000F: SPIN_LOCK_ALREADY_OWNED    (go to top of page)

Usual causes

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818815.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560412(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SPIN_LOCK_ALREADY_OWNED bug check has a value of 0x0000000F. This indicates that a request for a spin lock has been initiated when the spin lock was already owned.

Parameters

None

Cause

Typically, this error is caused by a recursive request for a spin lock. It can also occur if something similar to a recursive request for a spin lock has been initiated—for example, when a spin lock has been acquired by a thread, and then that same thread calls a function, which also tries to acquire a spin lock. The second attempt to acquire a spin lock is not blocked in this case because doing so would result in an unrecoverable deadlock. If the calls are made on more than one processor, then one processor will be blocked until the other processor releases the lock.

This error can also occur, without explicit recursion, when all threads and all spin locks are assigned an IRQL. Spin lock IRQLs are always greater than or equal to DPC level, but this is not true for threads. However, a thread that is holding a spin lock must maintain an IRQL greater than or equal to that of the spin lock. Decreasing the thread IRQL below the IRQL level of the spin lock that it is holding allows another thread to be scheduled on the processor. This new thread could then attempt to acquire the same spin lock.

Resolving the Problem

Ensure that you are not recursively acquiring the lock. And, for threads that hold a spin lock, ensure that you are not decreasing the thread IRQL to a level below the IRQL of the spin lock that it is holding.

    WinDbg Output Example:
SPIN_LOCK_ALREADY_OWNED (f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000010: SPIN_LOCK_NOT_OWNED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818821.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557243(v=VS.85).aspx

    Knowledge Base Articles:
KB 820841    A "Stop 0x00000010" Error Occurs in Scsiport.sys in Windows 2000
KB 822384    Some Windows 2000 Hotfixes May Cause a Conflict with Service Pack 4 for Windows 2000
   
    WinDbg Help File Entry:

The SPIN_LOCK_NOT_OWNED bug check has a value of 0x00000010.

This bug check appears very infrequently.

    WinDbg Output Example:
SPIN_LOCK_NOT_OWNED (10)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000011: THREAD_NOT_MUTEX_OWNER    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818825.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557303(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The THREAD_NOT_MUTEX_OWNER bug check has a value of 0x00000011.

This bug check appears very infrequently.

    WinDbg Output Example:
THREAD_NOT_MUTEX_OWNER (11)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000012: TRAP_CAUSE_UNKNOWN    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818830.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557348(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x12

   Knowledge Base Articles:
KB 297088    Problems When You Use Sound Blaster Live Driver with Your Windows 2000-Based Computer
   
    WinDbg Help File Entry:

The TRAP_CAUSE_UNKNOWN bug check has a value of 0x00000012. This indicates that an unknown exception has occurred.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The unexpected interrupt
2 The unknown floating-point exception
3 The enabled and asserted status bits. See the processor definition for details.
4 Reserved

    WinDbg Output Example:
TRAP_CAUSE_UNKNOWN (12)
Arguments:
Arg1: 0000000000000000, Unexpected interrupt.
Arg2: 0000000000000000, Unknown floating point exception.
Arg3: 0000000000000000, The enabled and asserted status bits (see processor definition).
Arg4: 0000000000000000


STOP 0x00000013: EMPTY_THREAD_REAPER_LIST    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818835.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557361(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The EMPTY_THREAD_REAPER_LIST bug check has a value of 0x00000013.

This bug check appears very infrequently.

    WinDbg Output Example:
EMPTY_THREAD_REAPER_LIST (13)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000014: CREATE_DELETE_LOCK_NOT_LOCKED    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557367(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CREATE_DELETE_LOCK_NOT_LOCKED bug check has a value of 0x00000014.

This bug check appears very infrequently.

    WinDbg Output Example:
CREATE_DELETE_LOCK_NOT_LOCKED (14)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000015: LAST_CHANCE_CALLED_FROM_KMODE    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818840.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557375(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The LAST_CHANCE_CALLED_FROM_KMODE bug check has a value of 0x00000015.

This bug check appears very infrequently.

    WinDbg Output Example:
LAST_CHANCE_CALLED_FROM_KMODE (15)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000016: CID_HANDLE_CREATION    (go to top of page)

Usual causes:  http://msdn.microsoft.com/en-us/library/ms818843.aspx

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818843(v=MSDN.10).aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557378(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CID_HANDLE_CREATION bug check has a value of 0x00000016.

This bug check appears very infrequently.

    WinDbg Output Example:
CID_HANDLE_CREATION (16)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000017: CID_HANDLE_DELETION    (go to top of page)

Usual causes:  http://msdn.microsoft.com/en-us/library/ms818848.aspx

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818848(v=MSDN.10).aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557381(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CID_HANDLE_DELETION bug check has a value of 0x00000017.

This bug check appears very infrequently.

    WinDbg Output Example:
CID_HANDLE_DELETION (17)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000018: REFERENCE_BY_POINTER    (go to top of page)

Usual causes:  Device driver, kernel, hardware

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818851.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557386(v=VS.85).aspx

    Knowledge Base Articles:
KB 957463    Stop error on a Windows Vista Service Pack 1-based or Windows Server 2008-based computer that has an integrated graphics adapter and a discrete graphics adapter: "Stop 0x00000018"
KB 967776    Stop errors in Windows Vista or Windows Server 2008: “Stop: 0x00000018” or “STOP: 0x000000C2”
   
    WinDbg Help File Entry:

The REFERENCE_BY_POINTER bug check has a value of 0x00000018. This indicates that the reference count of an object is illegal for the current state of the object.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Object type of the object whose reference count is being lowered.
2 Object whose reference count is being lowered.
3 Reserved
4 Reserved

Cause

The reference count of an object is illegal for the current state of the object. Each time a driver uses a pointer to an object, the driver calls a kernel routine to increase the reference count of the object by one. When the driver is done with the pointer, the driver calls another kernel routine to decrease the reference count by one.

Drivers must match calls to the routines that increase (reference) and decrease (dereference) the reference count. This bug check is caused by an inconsistency in the object’s reference count. Typically, the inconsistency is caused by a driver that decreases the reference count of an object too many times, making extra calls that dereference the object. This bug check can occur because an object's reference count goes to zero while there are still open handles to the object. It might also occur when the object’s reference count drops below zero, whether or not there are open handles to the object.

Resolving the Problem

Make sure that the driver matches calls to the routines that increase and decrease the reference count of the object. Make sure that your driver does not make extra calls to routines that dereference the object (see Parameter 2).

You can use a debugger to help analyze this problem. To find the handle and pointer count on the object, use the !object debugger command.

kd> !object address

Where address is the address of the object given in Parameter 2.

    WinDbg Output Example:
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 88237ce0, Object type of the object whose reference count is being lowered
Arg2: 88235130, Object whose reference count is being lowered
Arg3: 00000012, Reserved
Arg4: 81d0a391, Reserved
    The reference count of an object is illegal for the current state of the object.
    Each time a driver uses a pointer to an object the driver calls a kernel routine
    to increment the reference count of the object. When the driver is done with the
    pointer the driver calls another kernel routine to decrement the reference count.
    Drivers must match calls to the increment and decrement routines. This bugcheck
    can occur because an object's reference count goes to zero while there are still
    open handles to the object, in which case the fourth parameter indicates the number
    of opened handles. It may also occur when the object?s reference count drops below zero
    whether or not there are open handles to the object, and in that case the fourth parameter
    contains the actual value of the pointer references count.


STOP 0x00000019: BAD_POOL_HEADER    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818860.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557389(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x19

Problem w/ESET and SandBoxie (thanks to RedScare!):  http://windows7forums.com/blue-screen-death-bsod/84555-bsods-shortly-after-startup.html#post272422

    Knowledge Base Articles:
KB 156731    Windows NT Err. Msg: Stop 0x00000019 in NTFS
KB 179129    STOP 0x0000000A or 0x00000019 Due to Modified Teardrop Attack (NT)
KB 295624    "Stop 0x00000050" or "Stop 0x00000019" While Printing Extended Characters to a PostScript Printer (NT)
KB 883516    You receive Stop error code 0x00000019 or Stop error code 0x00000050 in the Tcpip.sys file on a Windows 2000 Server-based computer
KB 884585    When you back up to EMC Clarion storage devices in a SAN environment, your Windows Server 2003-based computer may stop responding after you restart
KB 892260    You may receive a "STOP: 0x00000019" error message on a Windows Server 2003-based computer
KB 905795    When you try to control a Systems Management Server 2003 client from a remote location, you experience a Stop error on the Systems Management Server 2003 client
KB 925259    Error message when a Delayed Write Failure event is reported in Windows Server 2003: "Stop 0x00000019 - BAD_POOL_HEADER" or "Stop 0xCD PAGE_FAULT_BEYOND_END_OF_ALLOCATION"
KB 931479    The print server experiences a Stop error when you use the Point and Print feature to print to a shared printer in Windows Vista (XP, Server 2003)
KB 934177    FIX: Error message when you connect a scanner or a digital camera to a computer that is running Windows Vista or Windows XP Service Pack 2: "BAD_POOL_HEADER STOP"
KB 934326    FIX: Stop error message when you run the Client for NFS service in Microsoft Windows Services for UNIX 3.5: "Stop 0x00000019"
KB 935920    When the Emulex Elxsli2.sys driver is installed, you may receive a Stop error message after you upgrade your computer to Windows Server 2003 Service Pack 1
KB 946226    FIX: You receive a "Stop 0x00000019" error message or a "Stop 0x000000c4" error message when you access NFS resources by using User Name Mapping (MS Svcs for Unix)
KB 947979    FIX: Stop error message on a computer that has the Gateway for NFS component of Windows Services for UNIX 3.5 installed: "Stop 0x00000019"
KB 948289    Error message on a Windows Server 2003-based computer: "Stop error code 0x00000019"
KB 949531    Stop error message when you try to install Windows Server 2008 on a computer that is connected to an iSCSI target LUN by using an iSCSI bootable network adapter: "STOP 0x00000019"
KB 955015    Stop error message on a Windows Server 2008-based computer when the NFS feature is enabled: "Stop: 0x00000019"
KB 970693    Stop error message in Windows Server 2008 or Windows Vista after you uninstall or reinstall a wireless network adapter driver: "0x00000019 BAD_POOL_HEADER"
KB 971280    Random Stop errors on a Windows Server 2003-based computer that performs input/output to file shares hosted on another computer or to a network-attached storage device
KB 973026    Error message on a computer that is running Windows Vista or on Windows Server 2008 that has the IPMI driver installed: "Stop 0x00000019"
KB 973097    Stop error message when the Smb.sys driver is unloaded on a computer that is running Windows Server 2003: "Stop 0x00000019"
KB 974201    Stop error message when you retrieve WMI connection statistics for iSCSI after you change the iSCSI configurations on a computer that is running Windows Server 2008 or Windows Vista: "0x00000019 BAD_POOL_HEADER"
KB 976443    Stop error message when you retrieve WMI connection statistics for iSCSI after you change the iSCSI configurations on a computer that is running Windows Server 2008 R2 or Windows 7: "0x00000019 BAD_POOL_HEADER"
KB 2280732    You receive Stop error message 0x000000CD or 0x00000019 on a computer that is running Windows Server 2003 when corrupted registry hive files are loaded
KB 2669443    "0x00000019" Stop error when you use Internet Explorer 8 to browse webpages in Windows Vista or in Windows Server 2008
KB 2712746    "0x00000019" Stop error when you run an SNMP application on a computer that is running Windows Vista or Windows Server 2008
KB 2832829    "0x00000019" Stop error when you try to shut down a Windows 7 or Windows Server 2008 R2-based computer

    WinDbg Help File Entry:

The BAD_POOL_HEADER bug check has a value of 0x00000019. This indicates that a pool header is corrupt.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x2 The pool entry being checked The size of the pool block 0 The special pool pattern check failed.

(The owner has likely corrupted the pool block.)

0x3 The pool entry being checked The read-back flink freelist value The read-back blink freelist value The pool freelist is corrupt.

(In a healthy list, the values of Parameters 2, 3, and 4 should be identical.)

0x5 One of the pool entries Reserved The other pool entry A pair of adjacent pool entries have headers that contradict each other. At least one of them is corrupt.
0x6 One incorrectly-calculated entry Reserved The bad entry that caused the miscalculation The pool block header's previous size is too large.
0x7 0 Reserved The bad pool entry The pool block header size is corrupt.
0x8 0 Reserved The bad pool entry The pool block header size is zero.
0x9 One incorrectly-calculated entry Reserved The bad entry that caused the miscalculation The pool block header size is corrupted (it is too large).
0xA The pool entry that should have been found Reserved The virtual address of the page that should have contained the pool entry The pool block header size is corrupt.
0x20 The pool entry that should have been found The next pool entry Reserved The pool block header size is corrupt.

Cause

The pool is already corrupted at the time of the current request.

This may or may not be due to the caller.

Resolving the Problem

The internal pool links must be walked to figure out a possible cause of the problem.

Then you can use special pool for the suspect pool tags, or use Driver Verifier on the suspect driver. The !analyze extension may be of help in pinpointing the suspect driver, but this is frequently not the case with pool corrupters.

    WinDbg Output Example:
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 89d147d8, The pool entry we were looking for within the page.
Arg3: 89d14808, The next pool entry.
Arg4: 08060007, (reserved)


STOP 0x0000001A: MEMORY_MANAGEMENT    (go to top of page)

Usual causes:  Device driver, memory, kernel

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818864.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557391(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x1a

    Knowledge Base Articles:
KB 839037    You receive a "STOP 0x0000001a" error message on a Windows 2000-based multiprocessor computer
KB 885272    You receive a "Stop 0x0000001a" Stop error message on your Windows 2000 Server-based computer that has Physical Address Extensions (PAE) enabled
KB 929338    Stop error message in Windows XP with Service Pack 2: "STOP 0x0000001a: MEMORY_MANAGEMENT" or "STOP 0x0000000a: IRQL_NOT_LESS_OR_EQUAL"
KB 932094    Error message when you try to play a movie file that has an .mov extension by using QuickTime 7 in Windows Vista: "STOP 0x1A MEMORY_MANAGEMENT"
KB 957967    Stop error message on a Windows Server 2008-based computer that has the Hyper-V role installed: "STOP 0x0000001A"
KB 981791    "STOP: 0x0000001a" error message on a computer that has an Intel Westmere processor together with the Hyper-V role installed on Windows Server 2008 or on Windows Server 2008 R2
   
    More STOP errors in this search:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000001a&x=3&y=9&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The MEMORY_MANAGEMENT bug check has a value of 0x0000001A. This indicates that a severe memory management error occurred.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 is the only parameter of interest; this identifies the exact violation.

Parameter 1 Cause of Error
0x1 The fork clone block reference count is corrupt. (This only occurs on checked builds of Windows.)
0x777 The caller is unlocking a system cache address that is not currently locked. (This address was either never mapped or is being unlocked twice.)
0x778 The system is using the very last system cache view address, instead of preserving it.
0x780
0x781
The PTEs mapping the argument system cache view have been corrupted.
0x1000 A caller of MmGetSystemAddressForMdl* tried to map a fully-cached physical page as non-cached. This action would cause a conflicting hardware translation buffer entry, and so it was refused by the operating system. Since the caller specified "bug check on failure" in the requesting MDL, the system had no choice but to issue a bug check in this instance.
0x1010 The caller is unlocking a pageable section that is not currently locked. (This section was either never locked or is being unlocked twice.)
0x1234 The caller is trying lock a nonexistent pageable section.
0x1235 The caller is trying to protect an MDL with an invalid mapping.
0x3451 The PTEs of a kernel thread stack that has been swapped out are corrupted.
0x8888
0x8889
Internal memory management structures are corrupted.
0x41283 The working set index encoded in the PTE is corrupted.
0x41284 A PTE or the working set list is corrupted.
0x41286 The caller is trying to free an invalid pool address.
0x41785 The working set list is corrupted.
0x41287 Internal memory management structures are corrupted. To further investigate the cause, a kernel memory dump file is needed.
0x61940 A PDE has been unexpectedly invalidated.
0x03030303 The boot loader is broken. (This value applies only to Intel Itanium machines.)
Other An unknown memory management error occurred.

    WinDbg Output Example:
MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00005003, The subtype of the bugcheck.
Arg2: c0802000
Arg3: 000066e0
Arg4: 0a272d40


STOP 0x0000001B: PFN_SHARE_COUNT    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818868.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557399(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PFN_SHARE_COUNT bug check has a value of 0x0000001B.

This bug check appears very infrequently.

    WinDbg Output Example:
PFN_SHARE_COUNT (1b)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000001C: PFN_REFERENCE_COUNT    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818873.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557401(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PFN_REFERENCE_COUNT bug check has a value of 0x0000001C.

This bug check appears very infrequently.

    WinDbg Output Example:
PFN_REFERENCE_COUNT (1c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000001D: NO_SPIN_LOCK_AVAILABLE    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818877.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557404(v=VS.85).aspx

    Knowledge Base Articles:
KB 818326    STOP 0x0000001D or STOP 0x000000A Stop Error Occurs in Ndis.sys (XP)

    WinDbg Help File Entry:

The NO_SPIN_LOCK_AVAILABLE bug check has a value of 0x0000001D.

This bug check appears very infrequently.

    WinDbg Output Example:
NO_SPIN_LOCK_AVAILABLE (1d)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED    (go to top of page)

Usual causes:  Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818890.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557408(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x1e

    Knowledge Base Articles:
KB 132470    STOP Msg: 0x0000000A or 0x0000001E When Using PING (NT)
KB 157936    SMC9232N Driver Causing Multiple STOP Messages (NT)
KB 161703    "Stop: 0x0000001E" Error Message During Setup (NT, 2000)
KB 195857    Open Handles Cause STOP 0x0000001E or STOP 0x00000024 (NT, 2000)
KB 264223    How to Troubleshoot "Stop 0x0000001E" with First Parameter of 0xC0000044 (NT, 2000)
KB 269593    "Stop 0x0000001e" in Win32k.sys When You Quit a Program (2000)
KB 278999    Stop 0x0000001E in Win32k.sys When Using Animated Mouse Pointers (2000)
KB 279640    "Stop 0x0000001e" on Windows 2000 Server
KB 284154    STOP 0X0000001E in Protcls.sys When You Undock a Toshiba Tecra 8100 (XP)
KB 294690    "Stop 0x0000001E" Error Message in Ntoskrnl.exe (2000)
KB 294728    Error message: "Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)" in Win32k.sys or a "Stop error code 0xC000021A" (2000/NT 4.0)
KB 302971    "Stop 0x1E" or "Stop 0xc5" After You Install Service Pack 2 and You Use Logitech Mouse Drivers (2000)
KB 306119    Stop 0x0000001E Loading Adobe Type Manager Font Driver (2000)
KB 307128    "STOP 0x0000001E KMODE_EXCEPTION_NOT_HANDLED" Error Message from Aspi32.sys (XP)
KB 314451    "STOP 0x0000001E" Error Message During Windows Setup (XP)
KB 317153    Stop 0x0000001e or Stop 0x00000050 Error in Navap.sys When You Use Norton AutoProtect Feature (NT Server, 2000 Server)
KB 811014    "Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED in NTOSKRNL.EXE)" error message after you install pcAnywhere (2000)
KB 815265    "STOP 0x00000051" or "STOP 0x0000001E" error message when you start Configuration Manager in Windows 2000 Server or in Windows XP
KB 816047    STOP 0x1E in Win32k.sys Error May Occur in Windows 2000 or Windows XP Professional
KB 824288    "Stop error code 0x0000001E" in Mup.sys after you apply Windows 2000 SP4
KB 828514    Intermittent "Stop error code 0x0000001E" error message (XP, Server 2000, Server 2003)
KB 833763    You receive a "Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)" or a "Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)" on a Windows 2000-based computer
KB 835312    You receive a Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED) on a Windows 2000-based computer
KB 839427    You receive a Stop error code 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED) error on a Windows 2000-based computer
KB 840110    You may receive a Stop error code 0x0000001E (0xc0000005) message when the Rdpdd.dll function in Windows 2000 Terminal Services receives a null value
KB 904374    You receive a "Stop 0x0000001e" error message after you install Update Rollup 1 for Windows 2000 Service Pack 4

KB 911028    When you use a 32-bit program to print a document from a 64-bit version of Microsoft Windows, you may receive a Stop error message, or objects on the page are omitted (XP, Server 2003)
KB 961799    A Stop error occurs on a Windows Server 2003-based server when a user accesses shared files on the server by using an SMB connection
KB 2381191    0x0000001E Stop code error occurs on a computer that is running an IA-64-based version of Windows Server 2008 R2
KB 2479442    Stop error during startup in Windows Server 2008 or in Windows Vista
KB 2521220    "0x0000001E" Stop error when you perform disk I/O-intensive operations on dynamic disks in Windows Server 2008 or in Windows Server 2008 R2
KB 2554414    "0x0000001E" Stop error when you add some NFS shares to a DFS namespace or to a DFS Replication group in Windows Server 2008 R2
KB 2636573    FIX: The guest operating system may crash when you perform a live migration of Hyper-V virtual machines in a Windows Server 2008 R2 environment
KB 2655104    "0x0000001E" Stop error on a computer that is running an x64-based version of Windows Vista SP2 or of Windows Server 2008 SP2
KB 2719347    Stop error when a Windows 7-based or Windows Server 2008 R2-based computer crashes randomly
KB 2764302    "0x0000001E" Stop error occurs intermittently in Windows 7 SP1 and Windows Server 2008 R2 SP1
KB 2888929    "KMODE_EXCEPTION_NOT_HANDLED" Stop error when a driver tries to close static streams for USB 3.0 devices in Windows RT 8.1, Windows 8.1, or Windows Server 2012 R2

    More STOP message articles at this search:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000001e&x=10&y=10&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The KMODE_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000001E. This indicates that a kernel-mode program generated an exception which the error handler did not catch.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The exception code that was not handled
2 The address at which the exception occurred
3 Parameter 0 of the exception
4 Parameter 1 of the exception

Cause

This is a very common bug check. To interpret it, you must identify which exception was generated.

Common exception codes include:

For a complete list of exception codes, see the ntstatus.h file located in the inc directory of the Windows Driver Kit.

Resolving the Problem

If you are not equipped to debug this problem, you should use some basic troubleshooting techniques. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates. Try changing video adapters. Check with your hardware vendor for any BIOS updates. Disable BIOS memory options such as caching or shadowing.

If you plan to debug this problem, you may find it difficult to obtain a stack trace. Parameter 2 (the exception address) should pinpoint the driver or function that caused this problem.

If exception code 0x80000003 occurs, this indicates that a hard-coded breakpoint or assertion was hit, but the system was started with the /NODEBUG switch. This problem should rarely occur. If it occurs repeatedly, make sure a kernel debugger is connected and the system is started with the /DEBUG switch.

If exception code 0x80000002 occurs, the trap frame will supply additional information.

If the specific cause of the exception is unknown, the following should be considered:

Hardware incompatibility. First, make sure that any new hardware installed is listed in the Microsoft Windows Marketplace Tested Products List.

Faulty device driver or system service. In addition, a faulty device driver or system service might be responsible for this error. Hardware issues, such as BIOS incompatibilities, memory conflicts, and IRQ conflicts can also generate this error.

If a driver is listed by name within the bug check message, disable or remove that driver. Disable or remove any drivers or services that were recently added. If the error occurs during the startup sequence and the system partition is formatted with NTFS file system, you might be able to use Safe Mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in Safe Mode, you need to start the computer by using the Recovery Console to access the file.

If the problem is associated with Win32k.sys, the source of the error might be a third-party remote control program. If such software is installed, the service can be removed by starting the system using the Recovery Console and deleting the offending system service file.

Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing bug check 0x1E. Disabling memory caching of the BIOS might also resolve the error. You should also run hardware diagnostics, especially the memory scanner, supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer.

The error that generates this message can occur after the first restart during Windows Setup, or after Setup is finished. A possible cause of the error is a system BIOS incompatibility. BIOS problems can be resolved by upgrading the system BIOS version.

To get a stack trace if the normal stack tracing procedures fail
  1. Use the kb (Display Stack Backtrace) command to display parameters in the stack trace. Look for the call to NT!PspUnhandledExceptionInSystemThread. (If this function is not listed, see the note below.)
  2. The first parameter to NT!PspUnhandledExceptionInSystemThread is a pointer to a structure, which contains pointers to an except statement:typedef struct _EXCEPTION_POINTERS {
        PEXCEPTION_RECORD ExceptionRecord;
        PCONTEXT ContextRecord;
        } EXCEPTION_POINTERS, *PEXCEPTION_POINTERS;


    ULONG PspUnhandledExceptionInSystemThread(
        IN PEXCEPTION_POINTERS ExceptionPointers
        )

    Use the dd (Display Memory) command on that address to display the necessary data.

  3. The first retrieved value is an exception record and the second is a context record. Use the .exr (Display Exception Record) command and the .cxr (Display Context Record) command with these two values as their arguments, respectively.
  4. After the .cxr command executes, use the kb command to display a stack trace that is based on the context record information. This stack trace indicates the calling stack where the unhandled exception occurred.

Note  This procedure assumes that you can locate NT!PspUnhandledExceptionInSystemThread. However, in some cases (such as an access violation crash) you will not be able to do this. In that case, look for ntoskrnl!KiDispatchException. The third parameter passed to this function is a trap frame address. Use the .trap (Display Trap Frame) command with this address to set the Register Context to the proper value. You can then perform stack traces and issue other commands.

Here is an example of bug check 0x1E on an x86 processor:

kd> .bugcheck                 get the bug check data
Bugcheck code 0000001e
Arguments c0000005 8013cd0a 00000000 0362cffff

kd> kb                        start with a stack trace 
FramePtr  RetAddr   Param1   Param2   Param3   Function Name 
8013ed5c  801263ba  00000000 00000000 fe40cb00 NT!_DbgBreakPoint 
8013eecc  8013313c  0000001e c0000005 8013cd0a NT!_KeBugCheckEx+0x194
fe40cad0  8013318e  fe40caf8 801359ff fe40cb00 NT!PspUnhandledExceptionInSystemThread+0x18
fe40cad8  801359ff  fe40cb00 00000000 fe40cb00 NT!PspSystemThreadStartup+0x4a
fe40cf7c  8013cb8e  fe43a44c ff6ce388 00000000 NT!_except_handler3+0x47
00000000  00000000  00000000 00000000 00000000 NT!KiThreadStartup+0xe

kd> dd fe40caf8 L2            dump EXCEPTION_POINTERS structure
0xFE40CAF8  fe40cd88 fe40cbc4                   ..@...@.

kd> .exr fe40cd88             first DWORD is the exception record
Exception Record @ FE40CD88:
   ExceptionCode: c0000005
  ExceptionFlags: 00000000
  Chained Record: 00000000
ExceptionAddress: 8013cd0a
NumberParameters: 00000002
   Parameter[0]: 00000000
   Parameter[1]: 0362cfff

kd> .cxr fe40cbc4             second DWORD is the context record
CtxFlags: 00010017
eax=00087000 ebx=00000000 ecx=03ff0000 edx=ff63d000 esi=0362cfff edi=036b3fff
eip=8013cd0a esp=fe40ce50 ebp=fe40cef8 iopl=0         nv dn ei pl nz ac po cy
vip=0    vif=0
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010617
0x8013cd0a  f3a4             rep movsb

kd> kb                        kb gives stack for context record
ChildEBP RetAddr  Args to Child
fe40ce54 80402e09 ff6c4000 ff63d000 03ff0000 NT!_RtlMoveMemory@12+0x3e
fe40ce68 80403c18 ffbc0c28 ff6ce008 ff6c4000 HAL!_HalpCopyBufferMap@20+0x49
fe40ce9c fe43b1e4 ff6cef90 ffbc0c28 ff6ce009 HAL!_IoFlushAdapterBuffers@24+0x148
fe40ceb8 fe4385b4 ff6ce388 6cd00800 ffbc0c28 QIC117!_kdi_FlushDMABuffers@20+0x28
fe40cef8 fe439894 ff6cd008 ffb6c820 fe40cf4c QIC117!_cqd_CmdReadWrite@8+0x26e
fe40cf18 fe437d92 ff6cd008 ffb6c820 ff6e4e50 QIC117!_cqd_DispatchFRB@8+0x210
fe40cf30 fe43a4f5 ff6cd008 ffb6c820 00000000 QIC117!_cqd_ProcessFRB@8+0x134
fe40cf4c 80133184 ff6ce388 00000000 00000000 QIC117!_kdi_ThreadRun@4+0xa9
fe40cf7c 8013cb8e fe43a44c ff6ce388 00000000 NT!_PspSystemThreadStartup@8+0x40

    WinDbg Output Example:
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002508f6d, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception


STOP 0x0000001F: SHARED_RESOURCE_CONV_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818893.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557414(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SHARED_RESOURCE_CONV_ERROR bug check has a value of 0x0000001F.

This bug check appears very infrequently.

    WinDbg Output Example:
SHARED_RESOURCE_CONV_ERROR (1f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000020: KERNEL_APC_PENDING_DURING_EXIT    (go to top of page)

Usual causes:  Device driver, kernel

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818895.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557421(v=VS.85).aspx

    Knowledge Base Articles:
KB 905539    You may receive a "Stop 0x00000020" error message on a computer that is running Windows Small Business Server 2003 or Windows Server 2003
KB 920911    Stop error message on a Windows Server 2003-based computer: "Stop 0x00000020"
   
    WinDbg Help File Entry:

The KERNEL_APC_PENDING_DURING_EXIT bug check has a value of 0x00000020. This indicates that an asynchronous procedure call (APC) was still pending when a thread exited.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the APC found pending during exit
2 The thread's APC disable count
3 The current IRQL
4 Reserved

Cause

The key data item is the thread's APC disable count (Parameter 2). If this is non-zero, it will indicate the source of the problem.

The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, KeWaitForSingleObject, KeWaitForMultipleObjects, KeWaitForMutexObject, or FsRtlEnterFileSystem. The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem.

Since these calls should always be in pairs, this value should be zero when a thread exits. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.

If you ever see this error, be very suspicious of all drivers installed on the machine — especially unusual or non-standard drivers.

This current IRQL (Parameter 3) should be zero. If it is not, that a driver's cancellation routine may have caused this bug check by returning at an elevated IRQL. In this case, carefully note what was running (and what was closing) at the time of the crash, and note all of the installed drivers at the time of the crash. The cause in this case is usually a severe bug in a driver.

    WinDbg Output Example:
KERNEL_APC_PENDING_DURING_EXIT (20)
The key data item is the thread's APC disable count.
If this is non-zero, then this is the source of the problem.
The APC disable count is decremented each time a driver calls
KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a mutex.  The APC
disable count is incremented each time a driver calls KeLeaveCriticalRegion,
FsRtlExitFileSystem, or KeReleaseMutex.  Since these calls should always be in
pairs, this value should be zero when a thread exits.  A negative value
indicates that a driver has disabled APC calls without re-enabling them.  A
positive value indicates that the reverse is true.
If you ever see this error, be very suspicious of all drivers installed on the
machine -- especially unusual or non-standard drivers.  Third party file
system redirectors are especially suspicious since they do not generally
receive the heavy duty testing that NTFS, FAT, RDR, etc receive.
This current IRQL should also be 0.  If it is not, that a driver's
cancelation routine can cause this bugcheck by returning at an elevated
IRQL.  Always attempt to note what you were doing/closing at the
time of the crash, and note all of the installed drivers at the time of
the crash.  This symptom is usually a severe bug in a third party
driver.
Arguments:
Arg1: 0000000000000000, The address of the APC found pending during exit.
Arg2: 0000000000000000, The thread's APC disable count
Arg3: 0000000000000000, The current IRQL
Arg4: 0000000000000000


STOP 0x00000021: QUOTA_UNDERFLOW    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818898.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557424(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The QUOTA_UNDERFLOW bug check has a value of 0x00000021. This indicates that quota charges have been mishandled by returning more quota to a particular block than was previously charged.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The process that was initially charged, if available.
2 The quota type. For the list of all possible quota type values, see the header file Ps.h in the Windows Driver Kit (WDK).
3 The initial charged amount of quota to return.
4 The remaining amount of quota that was not returned.

    WinDbg Output Example:
QUOTA_UNDERFLOW (21)
This bugcheck occurs if a kernel component mishandles quota charges and
returns more quota than was previously charged to a particular quota block.
Arguments:
Arg1: 0000000000000000, The process (if any) that was initially charged.
Arg2: 0000000000000000, The quota type in question (paged pool, nonpaged pool, etc.)
Arg3: 0000000000000000, The initial charge amount to return.
Arg4: 0000000000000000, The remaining (unreturned) charge.


STOP 0x00000022: FILE_SYSTEM    (go to top of page)

Usual causes:  http://msdn.microsoft.com/en-us/library/ms818901.aspx

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818901(v=MSDN.10).aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557425(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The FILE_SYSTEM bug check has a value of 0x00000022.

This bug check appears very infrequently.

    WinDbg Output Example:
FILE_SYSTEM (22)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000023: FAT_FILE_SYSTEM    (go to top of page)

Usual causes:  Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818907.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557429(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x23

    Knowledge Base Articles:
KB 289205    STOP Errors 0x00000023 and 0x0000000A in Fastfat.sys When a Program Queries the File System (2000 Server)
KB 305358    A "Stop 0x23" Error Message Appears When You Use Removable Media with the Same Attributes (2000)
KB 899327    You may receive a "Stop 0x00000023" error message after you remove a USB floppy drive cable from a Windows Server 2003-based computer
KB 900626    Stop error message when you suddenly remove a storage device from a computer that is running Windows XP: "STOP 0x00000023 FAT_FILE_SYSTEM"
KB 913318    Stop error message when you insert and then remove a removable storage media on a Windows XP-based computer: "STOP 0x00000023"
   
    WinDbg Help File Entry:

The FAT_FILE_SYSTEM bug check has a value of 0x00000023. This indicates that a problem occurred in the FAT file system.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 If FatExceptionFilter is on the stack, this parameter specifies the address of the exception record.
3 If FatExceptionFilter is on the stack, this parameter specifies the address of the context record.
4 Reserved

Cause

One possible cause of this bug check is disk corruption. Corruption in the file system or bad blocks (sectors) on the disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to the disk, thus causing the error.

Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Resolving the Problem

To debug this problem: Use the .cxr (Display Context Record) command with Parameter 3, and then use kb (Display Stack Backtrace).

To resolve a disk corruption problem: Check Event Viewer for error messages from SCSI and FASTFAT (System Log) or Autochk (Application Log) that might help pinpoint the device or driver that is causing the error. Try disabling any virus scanners, backup programs, or disk defragmenter tools that continually monitor the system. You should also run hardware diagnostics supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer. Run Chkdsk /f /r to detect and resolve any file system structural corruption. You must restart the system before the disk scan begins on a system partition.

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This will increase the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
FAT_FILE_SYSTEM (23)
    If you see FatExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000024: NTFS_FILE_SYSTEM    (go to top of page)

Usual causes:  Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818912.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557433(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x24

    Knowledge Base Articles:
KB 142648    STOP 0x00000024 in Ntfs.sys (NT)
KB 195857    Open Handles Cause STOP 0x0000001E or STOP 0x00000024 (NT, 2000)
KB 228888    Error message in Windows 2000: "Stop 0x24" or "NTFS_FILE_SYSTEM"
KB 840551    Intermittent errors in IA64 editions of Windows Server 2003: Stop error code 0x0000009C (MACHINE_CHECK_EXCEPTION), Stop error code 0x00000024 (NTFS_FILE_SYSTEM), or Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)
KB 910311    Error message in Windows Server 2003: "STOP: 0x00000024 (0x0019033c, 0xf4d7d42c, 0xf4d7d128, 0xf7197421) "
KB 934454    FIX: Error message on a Windows Server 2003 R2-based computer that has the Server for NFS component installed: "STOP 0x0000008E" or "STOP 0x00000024"
KB 935806    Troubleshooting Stop error messages that may occur when you try to install Windows Vista
KB 937455    You may receive various Stop error messages on a computer that is running Windows Server 2003
KB 954495    Stop error 0x24 may occur on a computer that has file system filter drivers installed in Windows Server 2003 and in Windows XP Professional x64 Edition
KB 957535    Error message on a computer that is running Windows Vista Service Pack 1 or Windows Server 2008: "Stop 0x00000024"
KB 961799    A Stop error occurs on a Windows Server 2003-based server when a user accesses shared files on the server by using an SMB connection
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)
KB 975663    Stop error message on a computer that is running Windows Server 2008 SP2 or Windows Vista SP2: "0x00000024 NTFS_FILE_SYSTEM"
KB 2792165    "0x00000024" Stop error when a third-party application unmounts a corrupted storage volume on a Windows Server 2008 SP2-based storage server
KB 2824200    "0x00000024" or "0x00000050" Stop error on a computer that is running Windows Vista or Windows Server 2008

    WinDbg Help File Entry:

The NTFS_FILE_SYSTEM bug check has a value of 0x00000024. This indicates a problem occurred in ntfs.sys, the driver file that allows the system to read and write to NTFS drives.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 If NtfsExceptionFilter is on the stack, this parameter specifies the address of the exception record.
3 If NtfsExceptionFilter is on the stack, this parameter specifies the address of the context record.
4 Reserved

Cause

One possible cause of this bug check is disk corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error.

Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Resolving the Problem

To debug this problem: Use the .cxr (Display Context Record) command with Parameter 3, and then use kb (Display Stack Backtrace).

To resolve a disk corruption problem: Check Event Viewer for error messages from SCSI and FASTFAT (System Log) or Autochk (Application Log) that might help pinpoint the device or driver that is causing the error. Try disabling any virus scanners, backup programs, or disk defragmenter tools that continually monitor the system. You should also run hardware diagnostics supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer. Run Chkdsk /f /r to detect and resolve any file system structural corruption. You must restart the system before the disk scan begins on a system partition.

To resolve a nonpaged pool memory depletion problem: Either add new physical memory to the computer (thus increasing the quantity of nonpaged pool memory available to the kernel), or reduce the number of files on the Services for Macintosh (SFM) volume.

    WinDbg Output Example:
NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001904ab
Arg2: 8e854430
Arg3: 8e85412c
Arg4: 81b5d1c4


STOP 0x00000025: NPFS_FILE_SYSTEM    (go to top of page)

Usual causes:  Insufficient physical memory, Indexing, Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818917.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557436(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The NPFS_FILE_SYSTEM bug check has a value of 0x00000025. This indicates that a problem occurred in the NPFS file system.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 Reserved
3 Reserved
4 Reserved

Cause

One possible cause of this bug check is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Resolving the Problem

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This will increase the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
NPFS_FILE_SYSTEM (25)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000026: CDFS_FILE_SYSTEM    (go to top of page)

Usual causes:  Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818922.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557441(v=VS.85).aspx

    Knowledge Base Articles:
KB 124284    STOP 0x00000026 when Accessing a CD Using an Indirect Path (NT)

    WinDbg Help File Entry:

The CDFS_FILE_SYSTEM bug check has a value of 0x00000026. This indicates that a problem occurred in the CD file system.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 If CdExceptionFilter is on the stack, this parameter specifies the address of the exception record.
3 If CdExceptionFilter is on the stack, this parameter specifies the address of the context record.
4 Reserved

Cause

One possible cause of this bug check is disk corruption. Corruption in the file system or bad blocks (sectors) on the disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to the disk, thus causing the error.

Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Resolving the Problem

To debug this problem: Use the .cxr (Display Context Record) command with Parameter 3, and then use kb (Display Stack Backtrace).

To resolve a disk corruption problem: Check Event Viewer for error messages from SCSI and FASTFAT (System Log) or Autochk (Application Log) that might help pinpoint the device or driver that is causing the error. Try disabling any virus scanners, backup programs, or disk defragmenter tools that continually monitor the system. You should also run hardware diagnostics supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer. Run Chkdsk /f /r to detect and resolve any file system structural corruption. You must restart the system before the disk scan begins on a system partition.

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This will increase the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
CDFS_FILE_SYSTEM (26)
    If you see CdExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000027: RDR_FILE_SYSTEM    (go to top of page)

Usual causes:  Insufficient physical memory, Indexing, Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818927.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557446(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x27

    Knowledge Base Articles:
KB 261939    "Stop 0x00000027 RDR_FILE_SYSTEM" Error Message During Shutdown (2000 Server)
KB 310916    XADM: When the File System Accesses Items Created in Workflow-Enabled Folders, a Bugcheck May Occur (2000 Server)
KB 831128    "STOP 0x00000027 in mrxsmb.sys" error message when you try to copy files to a network-attached storage device (2000)
KB 892932    You receive a Stop error message when you use the Remote Installation Service to deploy a Windows Server 2003 Remote Installation Preparation image on a client computer
KB 919030    Error message that you receive when you open a protected document on a computer that is running a 64-bit version of Windows Server 2003: "STOP 0x00000027"
KB 937278    Error message when multiple processes access a file that is in an NFS shared folder on a Windows Server 2003 R2-based computer that has Client for NFS installed: "STOP 0x00000027"
KB 952185    A Windows Server 2003-based computer restarts unexpectedly, and a Stop error "0x00000027" occurs
KB 974759    Stop error message on a computer that is running Windows Server 2008 or Windows Vista: "0x00000027 RDR_FILE_SYSTEM"
KB 978972    Stop error message when you rename a file or folder by using a DFS shared path on a computer that is running Windows Server 2003: "Stop error code 0x00000027 (RDR_FILE_SYSTEM)"
KB 981109    "0x00000027" Stop error when you try to log on a client computer that is running Windows 7 or Windows Server 2008 R2
KB 2487035     "0x00000027" Stop error when you try to access earlier versions of shared files that are hosted on a remote file server in Windows Vista or in Windows Server 2008
KB 2494418    "0x00000027" Stop error occurs when you access shared network resources by using the SMB 2.0 protocol in Windows Server 2008 R2 or in Windows 7
KB 2500603    "0x00000027" Stop error occurs when you redirect some folders to network share in Windows Vista or in Windows Server 2008
KB 2584874    "0x00000027" Stop error when you try to access a shared network resource in Windows Server 2008 R2 or in Windows 7
KB 2624677    "0x00000027" Stop error when you access a shared network resource that is hosted on a computer that is running Windows Server 2008 R2 or Windows 7
KB 2639032    "0x0000003B," "0x00000027," and "0x0000007e" Stop errors when a connection to a CSV is lost on a Windows Server 2008 R2-based failover cluster
KB 2696083    "0x00000027" Stop error when you redirect folders to a network share in Windows Vista SP2 or in Windows Server 2008 SP2
KB 2780130    "0x00000027" Stop error when you try to use a redirected smart card to log on to a Windows 7 or Windows Server 2008 R2-based remote computer
KB 2839149    Stop Error 0x00000027 in Rdbss.sys on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2870965    "0x00000027" Stop error when you try to access some shared resources in Windows Vista SP2 or Windows Server 2008 SP2

    WinDbg Help File Entry:

The RDR_FILE_SYSTEM bug check has a value of 0x00000027. This indicates that a problem occurred in the SMB redirector file system.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The high 16 bits (the first four hexadecimal digits after the "0x") identify the type of problem. Possible values include:

0xCA550000 RDBSS_BUG_CHECK_CACHESUP

0xC1EE0000 RDBSS_BUG_CHECK_CLEANUP

0xC10E0000 RDBSS_BUG_CHECK_CLOSE

0xBAAD0000 RDBSS_BUG_CHECK_NTEXCEPT



2 If RxExceptionFilter is on the stack, this parameter specifies the address of the exception record.
3 If RxExceptionFilter is on the stack, this parameter specifies the address of the context record.
4 Reserved

Cause

One possible cause of this bug check is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Resolving the Problem

To debug this problem: Use the .cxr (Display Context Record) command with Parameter 3, and then use kb (Display Stack Backtrace).

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This will increase the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
RDR_FILE_SYSTEM (27)
    If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
    exception record and context record. Do a .cxr on the 3rd parameter and then kb to
    obtain a more informative stack trace.
    The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
    as follows:
     RDBSS_BUG_CHECK_CACHESUP  = 0xca550000,
     RDBSS_BUG_CHECK_CLEANUP   = 0xc1ee0000,
     RDBSS_BUG_CHECK_CLOSE     = 0xc10e0000,
     RDBSS_BUG_CHECK_NTEXCEPT  = 0xbaad0000,
Arguments:
Arg1: baad0075
Arg2: bde817c4
Arg3: bde814c0
Arg4: 90ae9b4d


STOP 0x00000028: CORRUPT_ACCESS_TOKEN    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818930.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557448(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CORRUPT_ACCESS_TOKEN bug check has a value of 0x00000028.

This bug check appears very infrequently.

    WinDbg Output Example:
CORRUPT_ACCESS_TOKEN (28)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000029: SECURITY_SYSTEM    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818934.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557452(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SECURITY_SYSTEM bug check has a value of 0x00000029.

This bug check appears very infrequently.

    WinDbg Output Example:
SECURITY_SYSTEM (29)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000002A: INCONSISTENT_IRP    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818938.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557457(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INCONSISTENT_IRP bug check has a value of 0x0000002A. This indicates that an IRP was found to contain inconsistent information.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the IRP that was found to be inconsistent
2 Reserved
3 Reserved
4 Reserved

Cause

An IRP was discovered to be in an inconsistent state. Usually this means some field of the IRP was inconsistent with the remaining state of the IRP. An example would be an IRP that was being completed, but was still marked as being queued to a driver's device queue.

Comments

This bug check code is not currently being used in the system, but exists for debugging purposes.

    WinDbg Output Example:
INCONSISTENT_IRP (2a)
An IRP was encountered that was in an inconsistent state; i.e., some field
or fields of the IRP were inconsistent w/the remaining state of the IRP.
An example would be an IRP that was being completed, but was still marked
as being queued to a driver's device queue.  This bugcheck code is not
currently being used in the system, but exists for debugging purposes.
Arguments:
Arg1: 0000000000000000, Address of the IRP that was found to be inconsistent
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000002B: PANIC_STACK_SWITCH    (go to top of page)

Usual causes:  Device driver, ?memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818941.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557460(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PANIC_STACK_SWITCH bug check has a value of 0x0000002B. This indicates that the kernel mode stack was overrun.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The trap frame
2 Reserved
3 Reserved
4 Reserved

Cause

This error normally appears when a kernel-mode driver uses too much stack space. It can also appear when serious data corruption occurs in the kernel.

    WinDbg Output Example:
PANIC_STACK_SWITCH (2b)
This error indicates that the kernel mode stack was overrun. This normally
occurs when a kernel-mode driver uses too much stack space.  It can also
occur when serious data corruption occurs in the kernel.
Arguments:
Arg1: 0000000000000000, Trap Frame
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000002C: PORT_DRIVER_INTERNAL    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818943.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557461(v=VS.85).aspx

    Knowledge Base Articles:
KB 301353    "Stop 0x2c" Error Message in Scsiport.sys When Returning from Hibernation (2000)
   
    WinDbg Help File Entry:

The PORT_DRIVER_INTERNAL bug check has a value of 0x0000002C.

This bug check appears very infrequently.

    WinDbg Output Example:
PORT_DRIVER_INTERNAL (2c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000002D: SCSI_DISK_DRIVER_INTERNAL    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818950.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557463(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SCSI_DISK_DRIVER_INTERNAL bug check has a value of 0x0000002D.

This bug check appears very infrequently.

    WinDbg Output Example:
SCSI_DISK_DRIVER_INTERNAL (2d)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000002E: DATA_BUS_ERROR    (go to top of page)

Usual causes:  Defective memory (not just RAM), Hard disk corruption, BIOS, SCSI controller, Network adapter, reseat adapter cards, Device driver, malware

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818953.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557468(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x2e

    Knowledge Base Articles:
KB 185787    STOP 0x0000002E on Alpha with ISA Sound Card (NT)
KB 218132    Troubleshooting "STOP 0x0000002E" or "DATA_BUS_ERROR" Error Message (2000)

    WinDbg Help File Entry:

The DATA_BUS_ERROR bug check has a value of 0x0000002E. This typically indicates that a parity error in system memory has been detected.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Virtual address that caused the fault
2 Physical address that caused the fault
3 Processor status register (PSR)
4 Faulting instruction register (FIR)

Cause

This error is almost always caused by a hardware problem — a configuration issue, defective hardware, or incompatible hardware.

The most common hardware problems that can cause this error are defective RAM, Level 2 (L2) RAM cache errors, or video RAM errors. Hard disk corruption can also cause this error.

This bug check can also be caused when a device driver attempts to access an address in the 0x8xxxxxxx range that does not exist (in other words, that does not have a physical address mapping).

Resolving the Problem

Resolving a hardware problem: If hardware has recently been added to the system, remove it to see if the error recurs.

If existing hardware has failed, remove or replace the faulty component. You should run hardware diagnostics supplied by the system manufacturer to determine which hardware component has failed. For details on these procedures, see the owner's manual for your computer. Check that all adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure that adapter card contacts are clean.

If the problem occurs on a newly installed system, check the availability of updates for the BIOS, the SCSI controller or network cards. Updates of this kind are typically available on the Web site or the bulletin board system (BBS) of the hardware manufacturer.

If the error occurs after installing a new or updated device driver, the driver should be removed or replaced. If, under this circumstance, the error occurs during startup and the system partition is formatted with NTFS, you might be able to use Safe Mode to rename or delete the faulty driver.

If the driver is used as part of the system startup process in Safe Mode, you need to start the computer using the Recovery Console in order to access the file.

For additional error messages that might help pinpoint the device or driver that is causing the error, check the System Log in Event Viewer. Disabling memory caching or shadowing in the BIOS might also resolve this error. In addition, check the system for viruses, using any up-to-date commercial virus scanning software that examines the Master Boot Record of the hard disk. All Windows file systems can be infected by viruses.

Resolving a hard disk corruption problem: Run Chkdsk /f /r on the system partition. You must restart the system before the disk scan begins. If you cannot start the system due to the error, use the Recovery Console and run Chkdsk /r.

Warning  If your system partition is formatted with the file allocation table (FAT) file system, the long filenames used by Windows can be damaged if Scandisk or another Microsoft MS-DOS-based hard disk tool is used to verify the integrity of your hard disk from MS-DOS. Always use the version of Chkdsk that matches your Windows version.

    WinDbg Output Example:
DATA_BUS_ERROR (2e)
This bugcheck is normally caused by a parity error in the system memory.
This error can also be caused by a driver accessing a bad virtual
address whose backing physical address does not exist.
Arguments:
Arg1: 0000000000000000, Virtual address that caused the fault
Arg2: 0000000000000000, Physical address that caused the fault.
Arg3: 0000000000000000, Processor status register (PSR)
Arg4: 0000000000000000, Faulting instruction register (FIR)


STOP 0x0000002F: INSTRUCTION_BUS_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818956.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557471(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INSTRUCTION_BUS_ERROR bug check has a value of 0x0000002F.

This bug check appears very infrequently.

    WinDbg Output Example:
INSTRUCTION_BUS_ERROR (2f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000030: SET_OF_INVALID_CONTEXT    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818959.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557478(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SET_OF_INVALID_CONTEXT bug check has a value of 0x00000030. This indicates that the stack pointer in a trap frame had an invalid value.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The new stack pointer
2 The old stack pointer
3 The trap frame address
4 0

Cause

This bug check occurs when some routine attempts to set the stack pointer in the trap frame to a lower value than the current stack pointer value.

If this error were not caught, it would cause the kernel to run with a stack pointer pointing to stack which is no longer valid.

    WinDbg Output Example:
SET_OF_INVALID_CONTEXT (30)
Attempt to set the stack pointer in the trap frame to a lower value than
the current stack pointer value.   This would cause the kernel run with a
stack pointer pointing to stack which is no longer valid.
Arguments:
Arg1: 0000000000000000, New stack pointer
Arg2: 0000000000000000, Old stack pointer
Arg3: 0000000000000000, TrapFrame address
Arg4: 0000000000000000, 0


STOP 0x00000031: PHASE0_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818963.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557479(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PHASE0_INITIALIZATION_FAILED bug check has a value of 0x00000031. This indicates that system initialization failed.

Parameters

None

Cause

System initialization failed at a very early stage.

Resolving the Problem

A debugger is required to analyze this.

    WinDbg Output Example:
PHASE0_INITIALIZATION_FAILED (31)
    System init failed early on.  A debugger is required to analyze this.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000032: PHASE1_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818967.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557483(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PHASE1_INITIALIZATION_FAILED bug check has a value of 0x00000032. This indicates that system initialization failed.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The NT status code that describes why the system initialization failed
2 Reserved
3 Reserved
4 Reserved

    WinDbg Output Example:
PHASE1_INITIALIZATION_FAILED (32)
Arguments:
Arg1: 0000000000000000, NT status code that describes why the system initialization failed.
Arg2: 0000000000000000, (reserved)
Arg3: 0000000000000000, (reserved)
Arg4: 0000000000000000


STOP 0x00000033: UNEXPECTED_INITIALIZATION_CALL    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818970.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557488(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The UNEXPECTED_INITIALIZATION_CALL bug check has a value of 0x00000033.

This bug check appears very infrequently.

    WinDbg Output Example:
UNEXPECTED_INITIALIZATION_CALL (33)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000034: CACHE_MANAGER    (go to top of page)

Usual causes:  Insufficient physical memory, Indexing, Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818973.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557491(v=VS.85).aspx

    Knowledge Base Articles:
KB 2800422    "0x00000034" Stop error and file corruption when you burn a Live File System formatted disc in Windows 7 or Windows Server 2008 R2

    WinDbg Help File Entry:

The CACHE_MANAGER bug check has a value of 0x00000034. This indicates that a problem occurred in the file system's cache manager.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 Reserved
3 Reserved
4 Reserved

Cause

One possible cause of this bug check is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Resolving the Problem

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This will increase the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
CACHE_MANAGER (34)
    See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000035: NO_MORE_IRP_STACK_LOCATIONS    (go to top of page)

Usual causes:  Device driver, ?memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818976.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557494(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x35
    OSROnline Listing:  http://www.osronline.com/article.cfm?article=337

    Knowledge Base Articles:
KB 906866    You may receive a "STOP 0x00000035 NO_MORE_IRP_STACK_LOCATIONS" error message when you try to log on to a domain (Server 2003, XP)

    WinDbg Help File Entry:

The NO_MORE_IRP_STACK_LOCATIONS bug check has a value of 0x00000035. This bug check occurs when the IoCallDriver packet has no more stack locations remaining.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Address of the IRP
2 Reserved
3 Reserved
4 Reserved

Cause

A higher-level driver has attempted to call a lower-level driver through the IoCallDriver interface, but there are no more stack locations in the packet. This will prevent the lower-level driver from accessing its parameters.

This is a disastrous situation, since the higher level driver is proceeding as if it has filled in the parameters for the lower level driver (as required). But since there is no stack location for the latter driver, the former has actually written off the end of the packet. This means that some other memory has been corrupted as well.

    WinDbg Output Example:
NO_MORE_IRP_STACK_LOCATIONS (35)
A higher level driver has attempted to call a lower level driver through
the IoCallDriver() interface, but there are no more stack locations in the
packet, hence, the lower level driver would not be able to access its
parameters, as there are no parameters for it.  This is a disasterous
situation, since the higher level driver "thinks" it has filled in the
parameters for the lower level driver (something it MUST do before it calls
it), but since there is no stack location for the latter driver, the former
has written off of the end of the packet.  This means that some other memory
has probably been trashed at this point.
Arguments:
Arg1: fffffa8011d42010, Address of the IRP
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000



STOP 0x00000036: DEVICE_REFERENCE_COUNT_NOT_ZERO    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818980.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557496(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DEVICE_REFERENCE_COUNT_NOT_ZERO bug check has a value of 0x00000036. This indicates that a driver attempted to delete a device object that still had a positive reference count.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the device object
2 Reserved
3 Reserved
4 Reserved

Cause

A device driver has attempted to delete one of its device objects from the system, but the reference count for that object was non-zero.

This means there are still outstanding references to the device. (The reference count indicates the number of reasons why this device object cannot be deleted.)

This is a bug in the calling device driver.

    WinDbg Output Example:
DEVICE_REFERENCE_COUNT_NOT_ZERO (36)
A device driver has attempted to delete one of its device objects from the
system but the reference count for that object was non-zero, meaning that
there are still outstanding references to the device.  (The reference count
indicates the number of reasons why this device object cannot be deleted.)
This is a bug in the calling device driver.
Arguments:
Arg1: 0000000000000000, Address of the device object
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000037: FLOPPY_INTERNAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818986.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff557498(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The FLOPPY_INTERNAL_ERROR bug check has a value of 0x00000037.

This bug check appears very infrequently.

    WinDbg Output Example:
FLOPPY_INTERNAL_ERROR (37)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000038: SERIAL_DRIVER_INTERNAL    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818989.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558936(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SERIAL_DRIVER_INTERNAL bug check has a value of 0x00000038.

This bug check appears very infrequently.

    WinDbg Output Example:
SERIAL_DRIVER_INTERNAL (38)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000039: SYSTEM_EXIT_OWNED_MUTEX    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818992.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558941(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SYSTEM_EXIT_OWNED_MUTEX bug check has a value of 0x00000039. This indicates that the worker routine returned without releasing the mutex object that it owned.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the worker routine that caused the error.
2 The parameter passed to the worker routine.
3 The address of the work item.
4 Reserved.

Cause

The worker routine returned while it still owned a mutex object. The current worker thread will proceed to run other unrelated work items, and the mutex will never be released.

Resolving the Problem

A debugger is required to analyze this problem. To find the driver that caused the error, use the ln (List Nearest Symbols) debugger command:

kd> ln address

Where address is the worker routine given in Parameter 1.

    WinDbg Output Example:
SYSTEM_EXIT_OWNED_MUTEX (39)
Arguments:
Arg1: 8261f8fa
Arg2: 00000000
Arg3: 82746500
Arg4: 00000000


STOP 0x0000003A: SYSTEM_UNWIND_PREVIOUS_USER    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818995.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558945(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SYSTEM_UNWIND_PREVIOUS_USER bug check has a value of 0x0000003A.

This bug check appears very infrequently.

    WinDbg Output Example:
SYSTEM_UNWIND_PREVIOUS_USER (3a)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000003B: SYSTEM_SERVICE_EXCEPTION    (go to top of page)

Usual causes:  System service, Device driver, graphics driver, ?memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms818997.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558949(v=VS.85).aspx

   Knowledge Base Articles:
KB 914215    Error message that is similar to the following when a volume is dismounted on a Windows Server 2003-based computer: "STOP 0x0000003B SYSTEM_SERVICE_EXCEPTION"
KB 918564    Error message after you install the Windows Server 2003 Scalable Networking Pack in Windows Server 2003: "STOP 0x0000008E" or "STOP: 0x0000003B"
KB 923187    Error message in x64-based versions of Windows Server 2003: "Stop 0x0000003B (c0000005, fffffadca82a63d4, fffffadca35fb4f0, 0)"
KB 941410    The computer crashes, and you receive a "Stop 0x0000003b" error message after you enable large image-based page files in Windows Server 2003
KB 951684    A computer that is running Windows Server 2008 for Itanium-Based Systems may restart unexpectedly when you hot-replace CPUs, and a Stop error message occurs: "0x0000003B"
KB 979762    Stop error in Windows Vista and in Windows Server 2008 when you try to print a document: "0x0000003B" or "0x0000007f"
KB 980932    "STOP 0x0000003B" Stop error on a computer that is running Windows 7 or Windows Server 2008 R2 when you use some IEEE 1394 devices
KB 2260182    "0x0000003B" Stop error may occur when you run an App-V application on a computer that has App-V RDS client installed and that is running Windows 7 or Windows Server 2008 R2
KB 2286188   Stop error when you try to wake the computer up from or try to enter hibernate (the S4 power state) or standby (the S3 power state) in Windows Vista or in Windows Server 2008: "Stop 0x0000003B SYSTEM_SERVICE_EXCEPTION"
KB 2359223    "0x0000003B" Stop error occurs in Windows Server 2008 R2 and in Windows 7 when an application or a service performs a GUI-related operation
KB 2487324    "0x0000003B" or "0x0000007f" Stop errors may occur when you try to print a document in Windows Server 2008 R2
KB 2518298   "0x0000003B" Stop error on a terminal server in Windows Server 2008
KB 2525246    "0x0000003B" Stop error when you remotely control a Remote Desktop session in Windows Server 2008 R2
KB 2584454    "0x0000003B" Stop error when you run certain applications in Windows 7 or in Windows Server 2008 R2
KB 2639032    "0x0000003B," "0x00000027," and "0x0000007e" Stop errors when a connection to a CSV is lost on a Windows Server 2008 R2-based failover cluster
KB 2666484    "0x0000003B" Stop error on Windows Server 2008 R2-based RD Session Host servers that use an RD Connection Broker
KB 2678763    When the Filestream feature is enabled in SQL Server 2008, you receive a Stop error, and the computer restarts unexpectedly
KB 2705742    "0x0000003B" Stop error when you use a Citrix XenApp application in Windows 7 or in Windows Server 2008 R2
KB 2719704    "0x0000003B" or "0x000000D5" Stop error in Windows 7 or in Windows Server 2008 R2
KB 2748302    Stop error when you use a Citrix XenApp application in Windows 7 or in Windows Server 2008 R2
KB 2780102    "0x0000003B" Stop error when a Remote Desktop Connection Broker and a Windows 7 SP1 or Windows Server 2008 R2 SP1-based computer are in an RDS farm
KB 2785338    "0x0000003b" Stop error when the memory usage of memory-mapped file is high in Windows 7 or Windows Server 2008 R2

    More STOP error messages at this search link:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000003b&x=7&y=14&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The SYSTEM_SERVICE_EXCEPTION bug check has a value of 0x0000003B. This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The exception that caused the bug check
2 The address of the exception record for the exception that caused the bug check
3 The address of the context record for the exception that caused the bug check
4 0

Cause

This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code.

    WinDbg Output Example:
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000124283, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88003f42ff0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.



STOP 0x0000003C: INTERRUPT_UNWIND_ATTEMPTED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819002.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558955(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INTERRUPT_UNWIND_ATTEMPTED bug check has a value of 0x0000003C.

This bug check appears very infrequently.

    WinDbg Output Example:
INTERRUPT_UNWIND_ATTEMPTED (3c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000003D: INTERRUPT_EXCEPTION_NOT_HANDLED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819004.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558963(v=VS.85).aspx

    Knowledge Base Articles:
KB 2494666    Stop errors may occur after you use the Driver Verifier manager to apply standard settings to all drivers in Windows 7 or in Windows Server 2008 R2

    WinDbg Help File Entry:

The INTERRUPT_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000003D.

This bug check appears very infrequently.

    WinDbg Output Example:
INTERRUPT_EXCEPTION_NOT_HANDLED (3d)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: fffffa6007024333



STOP 0x0000003E: MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED    (go to top of page)

Usual causes:  All processors aren't the same type and level

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819006.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558965(v=VS.85).aspx

    Knowledge Base Articles:
KB 973879    You receive a "Stop 0x0000003E" error message when you try to install Windows Vista Service Pack 2 or Windows Server 2008 Service Pack 2 on a computer that has certain multiple processors

    WinDbg Help File Entry:

The MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED bug check has a value of 0x0000003E. This indicates that the system has multiple processors, but they are asymmetric in relation to one another.

Parameters

None

Cause

In order to be symmetric, all processors must be of the same type and level. This system contains processors of different types (for example, a Pentium processor and an 80486 processor).

    WinDbg Output Example:
MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED (3e)
The system has multiple processors, but they are asymmetric in relation
to one another.  In order to be symmetric all processors must be of
the same type and level.  For example, trying to mix a Pentium level
processor with an 80486 would cause this bugcheck.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000003F: NO_MORE_SYSTEM_PTES    (go to top of page)

Usual causes:  Device driver, Video driver, backup utilities, disk-intensive applications

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819008.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558968(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x3f

    Knowledge Base Articles:
KB 145882    STOP 0x3f and events 1001 and 2021 appear on heavily used IIS (Server 2008)
KB 256004    How to troubleshoot "STOP 0x0000003F" and "STOP 0x000000D8" error messages in Windows Server 2003, Windows XP, and Windows 2000
KB 294301    How to troubleshoot fatal system errors in Access 2002 running on Microsoft Windows 2000
KB 304101    Backup program is unsuccessful when you back up a large system volume (NT Server, 2000 Server, Server 2003)
KB 955033    Stop 0x0000003F or STOP 0x000000D8 occurs on Windows Server 2003 computer with Veritas Backup installed
   
     WinDbg Help File Entry:

The NO_MORE_SYSTEM_PTES bug check has a value of 0x0000003F. This is the result of a system which has performed too many I/O actions. This has resulted in fragmented system page table entries (PTE).

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 0: system expansion PTE type

1: nonpaged pool expansion PTE type

2 Size of memory request
3 Total free system PTEs
4 Total system PTEs

Cause

In almost all cases, the system is not actually out of PTEs. Rather, a driver has requested a large block of memory, but there is no contiguous block of sufficient size to satisfy this request.

Often video drivers will allocate large amounts of kernel memory that must succeed. Some backup programs do the same.

Resolving the Problem

A possible work-around: Modify the registry to increase the total number of system PTEs. If this does not help, remove any recently-installed software, especially backup utilities or disk-intensive applications.

Debugging the problem: The following method can be used to debug bug check 0x3F.

First, get a stack trace, and use the !sysptes 3 extension command.

Then set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\TrackPtes equal to DWORD 1, and reboot. This will cause the system to save stack traces.

This allows you to display more detailed information about the PTE owners. For example:

0: kd> !sysptes 4

0x2c47 System PTEs allocated to mapping locked pages

VA       MDL     PageCount  Caller/CallersCaller
f0e5db48 eb6ceef0        1 ntkrpamp!MmMapLockedPages+0x15/ntkrpamp!IopfCallDriver+0x35
f0c3fe48 eb634bf0        1 netbt!NbtTdiAssociateConnection+0x1f/netbt!DelayedNbtProcessConnect+0x17c
f0db38e8 eb65b880        1 mrxsmb!SmbMmAllocateSessionEntry+0x89/mrxsmb!SmbCepInitializeExchange+0xda
f8312568 eb6df880        1 rdbss!RxCreateFromNetRoot+0x3d7/rdbss!RxCreateFromNetRoot+0x93
f8363908 eb685880        1 mrxsmb!SmbMmAllocateSessionEntry+0x89/mrxsmb!SmbCepInitializeExchange+0xda
f0c54248 eb640880        1 rdbss!RxCreateFromNetRoot+0x3d7/rdbss!RxCreateFromNetRoot+0x93
f0ddf448 eb5f3160        1 mrxsmb!MrxSmbUnalignedDirEntryCopyTail+0x387/mrxsmb!MRxSmbCoreInformation+0x36
f150bc08 eb6367b0        1 mrxsmb!MrxSmbUnalignedDirEntryCopyTail+0x387/mrxsmb!MRxSmbCoreInformation+0x36
f1392308 eb6fba70        1 netbt!NbtTdiOpenAddress+0x1fb/netbt!DelayedNbtProcessConnect+0x17c
eb1bee64 edac5000      200 VIDEOPRT!pVideoPortGetDeviceBase+0x118/VIDEOPRT!VideoPortMapMemory+0x45
f139b5a8 edd4b000       12 rdbss!FsRtlCopyWrite2+0x34/rdbss!RxDriverEntry+0x149
eb41f400 ede92000       20 VIDEOPRT!pVideoPortGetDeviceBase+0x139/VIDEOPRT!VideoPortGetDeviceBase+0x1b
eb41f198 edf2a000       20 NDIS!NdisReadNetworkAddress+0x3a/NDIS!NdisFreeSharedMemory+0x58
eb41f1e4 eb110000       10 VIDEOPRT!pVideoPortGetDeviceBase+0x139/VIDEOPRT!VideoPortGetDeviceBase+0x1b
......

If the system runs out of PTEs again after the TrackPtes registry value has been set, bug check 0xD8 (DRIVER_USED_EXCESSIVE_PTES) will be issued instead of 0x3F. The name of the driver causing this error will be displayed as well.

    WinDbg Output Example:
NO_MORE_SYSTEM_PTES (3f)
No System PTEs left.  Usually caused by a driver not cleaning up
properly.  If kernel debugger available get stack trace and
"!sysptes 3".
Set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\TrackPtes
to a DWORD 1 value and reboot.  Then the system will save stack traces
so the guilty driver can be identified.  There is no other way to find out
which driver is neglecting to clean up the I/Os.
A bugcheck DRIVER_USED_EXCESSIVE_PTES will then occur if the system runs out of
PTEs again and the offending driver's name will be printed.
Arguments:
Arg1: 0000000000000000, PTE Type (0 - system expansion, 1 nonpaged pool expansion)
Arg2: 0000000000000000, Requested size
Arg3: 0000000000000000, Total free system PTEs
Arg4: 0000000000000000, Total system PTEs


STOP 0x00000040: TARGET_MDL_TOO_SMALL    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819198.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558972(v=VS.85).aspx

    Knowledge Base Articles:
KB 187302    Stop 0x00000040 in NetBT Protocol (NT)
KB 967787    Stop error message when you have the TCP Chimney feature enabled and the TCP transfer buffer size is set to 32 MB in Windows Vista, Windows Server 2008, or Windows Server 2003: "Stop 0x00000040 TARGET_MDL_TOO_SMALL"
   
    WinDbg Help File Entry:

The TARGET_MDL_TOO_SMALL bug check has a value of 0x00000040. This indicates that a driver has improperly used IoBuildPartialMdl.

Parameters

None

Cause

This is a driver bug. A driver has called the IoBuildPartialMdl function and passed it an MDL to map part of a source MDL, but the target MDL is not large enough to map the entire range of addresses requested.

Resolving the Problem

The source and target MDLs, as well as the address range length to be mapped, are the first, second, and fourth arguments to the IoBuildPartialMdl function. Therefore, doing a stack trace on this particular function might help during the debugging process. Ensure that your code is correctly calculating the necessary size for the target MDL for the address range length that you are passing to this function.

    WinDbg Output Example:
TARGET_MDL_TOO_SMALL (40)
A driver has called the IoBuildPartialMdl() function and passed it an MDL
to map part of a source MDL, but the target MDL is not large enough to map
the entire range of addresses requested.  This is a driver bug.  The source
and target MDLs, as well as the address range length to be mapped are the
arguments to the IoBuildPartialMdl() function, i.e.;
    IoBuildPartialMdl(
        IN PMDL SourceMdl,
        IN OUT PMDL TargetMdl,
        IN PVOID VirtualAddress,
        IN ULONG Length
        )
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000041: MUST_SUCCEED_POOL_EMPTY    (go to top of page)

Usual causes:  Device driver, ?memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819202.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558974(v=VS.85).aspx

    Knowledge Base Articles:
KB 833213    You receive a "STOP 0x00000041" error message on a computer that is running Windows NT Server 4.0
KB 904375    You receive a "STOP 0x00000041 MUST_SUCCEED_POOL_EMPTY" error message on a Windows 2000 Service Pack 4-based computer
   
    WinDbg Help File Entry:

The MUST_SUCCEED_POOL_EMPTY bug check has a value of 0x00000041. This indicates that a kernel-mode thread has requested too much must-succeed pool.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The size of the request that could not be satisfied
2 The number of pages used from nonpaged pool
3 The number of requests from nonpaged pool larger than PAGE_SIZE
4 The number of pages available

Cause

In Microsoft Windows 2000, only a small amount of must-succeed pool is permitted. In Windows XP and later, no driver is permitted to request must-succeed pool.

If a must-succeed request cannot be filled, this bug check is issued.

Resolving the Problem

Replace or rewrite the driver which is making the request. A driver should not request must-succeed pool. Instead, it should ask for normal pool and gracefully handle the scenario where the pool is temporarily empty.

The kb (Display Stack Backtrace) command will show the driver that caused the error.

Additionally, it is possible that a second component has depleted the must-succeed pool. To determine if this is the case, first use the kb command. Then use !vm 1 to display total pool usage, !poolused 2 to display per-tag nonpaged pool usage, and !poolused 4 to display per-tag paged pool usage. The component associated with the tag using the most pool is probably the source of the problem.

    WinDbg Output Example:
MUST_SUCCEED_POOL_EMPTY (41)
No component should ever ask for must-succeed pool as if there is none left,
the system crashes.  Instead, components should ask for normal pool and
gracefully handle the scenario where the pool is temporarily empty.  This
bugcheck definitely reveals a bug in the caller (use kb to identify the caller).
In addition, the fact that the pool is empty may be either a transient condition
or possibly a leak in another component (distinguish between the 2 cases by
following the directions below).
Type kb to show the calling stack.
Type !vm 1 to display total pool usage.
Then type !poolused 2 to display per-tag nonpaged pool usage.
Then type !poolused 4 to display per-tag paged pool usage.
The crash should be looked at by the tag owner that is consuming the most pool.
Arguments:
Arg1: 0000000000000000, size of the request that could not be satisfied
Arg2: 0000000000000000, number of pages used of nonpaged pool
Arg3: 0000000000000000, number of > PAGE_SIZE requests from nonpaged pool
Arg4: 0000000000000000, number of pages available


STOP 0x00000042: ATDISK_DRIVER_INTERNAL    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819204.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558976(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The ATDISK_DRIVER_INTERNAL bug check has a value of 0x00000042.

This bug check appears very infrequently.

    WinDbg Output Example:
ATDISK_DRIVER_INTERNAL (42)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000043: NO_SUCH_PARTITION    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819206.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558978(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The NO_SUCH_PARTITION bug check has a value of 0x00000043.

This bug check appears very infrequently.

    WinDbg Output Example:
NO_SUCH_PARTITION (43)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000044: MULTIPLE_IRP_COMPLETE_REQUESTS    (go to top of page)

Usual causes:  Device driver(s)

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819207.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558982(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x44

    Knowledge Base Articles:
KB 294876    "Stop 0x00000044 Multiple_IRP_Complete_Requests" Error Message During a Shutdown or Standby Operation (2000)
KB 296734    STOP 0x00000044 Error Message Appears While You Are Using MSMQ (2000)
KB 832212    "Stop 0x00000044" error message when the HP Insight Management Agent is configured (2000, Server 2003)
KB 839619    You receive a "Stop 0x00000044 Multiple_IRP_Complete_Requests" error message on Windows XP Professional
KB 867774    "Stop 0x00000044" error message on a Windows 2000-based computer that uses a Gigabit network adapter
KB 930570    Error message in the Usbhub.sys process when you wake a Windows Vista-based computer from sleep or from hibernation: "STOP 0x00000044"
KB 935192    Error message when you resume a Windows XP-based computer from hibernation after you apply hotfix 918005: "Stop 0x00000044" or “Stop 0x000000F4”
KB 942528    You randomly receive a "STOP 0x00000044" error message after you install a third-party program on a Windows Server 2003-based computer
KB 973056    Stop 0x44 (MULTIPLE_IRP_COMPLETE_REQUESTS) Disabling Idle USB Device with KMDF-based Driver (Vista)
KB 977694    Stop error message when you access shared files in Windows Server 2008 or in Windows Vista: 0x00000044 or 0x000000CC
KB 980143    "0x00000044" Stop error message when you use MPIO DSM in Windows Server 2008 R2 to manage a storage device that is connected by Fibre Channel or by Fibre Channel over Ethernet
KB 2549724   "0x00000044" Stop error when you access shared files in Windows Server 2008 R2 or in Windows 7
KB 2552033    "0x00000044" Stop error on a computer that is running Windows 7 or Windows Server 2008 R2

    WinDbg Help File Entry:

The MULTIPLE_IRP_COMPLETE_REQUESTS bug check has a value of 0x00000044. This in2280732228073222807322280732dicates that a driver has tried to requested an IRP be completed that is already complete.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the IRP
2 Reserved
3 Reserved
4 Reserved

Cause

A driver has called IoCompleteRequest to ask that an IRP be completed, but the packet has already been completed.

Resolving the Problem

This is a tough bug to find because the simplest case — a driver that attempted to complete its own packet twice — is usually not the source of the problem. More likely, two separate drivers each believe that they own the packet, and each has attempted to complete it. The first request succeeds, and the second fails, resulting in this bug check.

Tracking down which drivers in the system caused the error is difficult, because the trail of the first driver has been covered by the second. However, the driver stack for the current request can be found by examining the device object fields in each of the stack locations.

    WinDbg Output Example:
MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed.  This is a tough bug to find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened.  Rather, two separate drivers each
believe that they own the packet, and each attempts to complete it.  The
first actually works, and the second fails.  Tracking down which drivers
in the system actually did this is difficult, generally because the trails
of the first driver have been covered by the second.  However, the driver
stack for the current request can be found by examining the DeviceObject
fields in each of the stack locations.
Arguments:
Arg1: 0000000000000000, Address of the IRP
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000045: INSUFFICIENT_SYSTEM_MAP_REGS    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819209.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558984(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INSUFFICIENT_SYSTEM_MAP_REGS bug check has a value of 0x00000045.

This bug check appears very infrequently.

    WinDbg Output Example:
INSUFFICIENT_SYSTEM_MAP_REGS (45)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000046: DEREF_UNKNOWN_LOGON_SESSION    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819211.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558987(v=VS.85).aspx

    Knowledge Base Articles:
KB 157936    SMC9232N Driver Causing Multiple STOP Messages (NT)

    WinDbg Help File Entry:

The DEREF_UNKNOWN_LOGON_SESSION bug check has a value of 0x00000046.

This bug check appears very infrequently.

    WinDbg Output Example:
DEREF_UNKNOWN_LOGON_SESSION (46)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000047: REF_UNKNOWN_LOGON_SESSION    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819213.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558991(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The REF_UNKNOWN_LOGON_SESSION bug check has a value of 0x00000047.

This bug check appears very infrequently.

    WinDbg Output Example:
REF_UNKNOWN_LOGON_SESSION (47)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000048: CANCEL_STATE_IN_COMPLETED_IRP    (go to top of page)

Usual causes:  Device driver(s)

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819214.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558993(v=VS.85).aspx

    Knowledge Base Articles:
KB 308605    Stop 0x00000048 or Stop 0x0000000A Caused By Named Pipe File System (Npfs.sys) (NT)
KB 331484    "Stop 0x00000048" occurs when you stop the Computer Browser service (2000)
KB 983169    "Stop error code 0x00000048 CANCEL_STATE_IN_COMPLETED_IRP" error message in Windows Server 2003 Service Pack 2

    WinDbg Help File Entry:

The CANCEL_STATE_IN_COMPLETED_IRP bug check has a value of 0x00000048. This indicates that an I/O request packet (IRP) was completed, and then was subsequently canceled.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 A pointer to the IRP
2 The cancel routine set by the driver
3 Reserved
4 Reserved

Cause

An IRP that had a Cancel routine set was completed normally, without cancellation. But after it was complete, a driver called the IRP's Cancel routine.

This could be caused by a driver that completed the IRP and then attempted to cancel it.

It could also be caused by two drivers each trying to access the same IRP in an improper way.

Resolving the Problem

The cancel routine parameter can be used to determine which driver or stack caused the bug check.

    WinDbg Output Example:
CANCEL_STATE_IN_COMPLETED_IRP (48)
This bugcheck indicates that an I/O Request Packet (IRP) that is to be
cancelled, has a cancel routine specified in it -- meaning that the packet
is in a state in which the packet can be cancelled -- however, the packet
no longer belongs to a driver, as it has entered I/O completion.  This is
either a driver bug, or more than one driver is accessing the same packet,
which is not likely and much more difficult to find. The cancel routine
parameter will provide a clue as to which driver or stack is the culprit.
Arguments:
Arg1: 0000000000000000, Pointer to the IRP
Arg2: 0000000000000000, Cancel routine set by the driver.
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000049: PAGE_FAULT_WITH_INTERRUPTS_OFF    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819216.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff558996(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PAGE_FAULT_WITH_INTERRUPTS_OFF bug check has a value of 0x00000049.

This bug check appears very infrequently.

    WinDbg Output Example:
PAGE_FAULT_WITH_INTERRUPTS_OFF (49)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000004A: IRQL_GT_ZERO_AT_SYSTEM_SERVICE    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819218.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559001(v=VS.85).aspx

    Knowledge Base Articles:
KB 969873    A Stop error occurs when you profile an application in Visual Studio 2008 SP1 on a computer that uses an AMD processor and has Hyper-V enabled


    WinDbg Help File Entry:

The IRQL_GT_ZERO_AT_SYSTEM_SERVICE bug check has a value of 0x0000004A. This indicates that a thread is returning to user mode from a system call when its IRQL is still above PASSIVE_LEVEL.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the system function (system call routine)
2 The current IRQL
3 0
4 0

    WinDbg Output Example:
IRQL_GT_ZERO_AT_SYSTEM_SERVICE (4a)
Returning to usermode from a system call at an IRQL > PASSIVE_LEVEL.
Arguments:
Arg1: 0000000077b90aca, Address of system function (system call routine)
Arg2: 000000000000000c, Current IRQL
Arg3: 0000000000000000, 0
Arg4: fffff98013565ca0, 0


STOP 0x0000004B: STREAMS_INTERNAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819221.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559007(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The STREAMS_INTERNAL_ERROR bug check has a value of 0x0000004B.

This bug check appears very infrequently.

    WinDbg Output Example:
STREAMS_INTERNAL_ERROR (4b)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000004C: FATAL_UNHANDLED_HARD_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819224.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559010(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The FATAL_UNHANDLED_HARD_ERROR bug check has a value of 0x0000004C.

This bug check appears very infrequently.

    WinDbg Output Example:
FATAL_UNHANDLED_HARD_ERROR (4c)
If a hard error occurs during system booting before windows is up, and
the hard error is a real error, the system will blue screen crash.
Some common cases are:
    x218 - This means a necessary registry hive file could not be
           loaded.  The obvious reason is if it is corrupt or missing.
           In this case, either the Emergency Repair Disk or a
           reinstall is required.
           Some less obvious reasons are that the driver has corrupted
           the registry data while loading into memory, or the memory
           where the registry file was loaded is not actually memory.
    x21a - This means that either winlogon, or csrss (windows) died
           unexpectedly.  The exit code tells more information.  Usually
           it is c0000005 meaning that an unhandled exception crashed
           either of these processes.
    x221 - This means that a driver is corrupt, or a system DLL was
           detected to be corrupt.
           Safeboot or boot an alternate OS (or reinstall)
           and then make sure the on disk file that is listed as bad
           matches the version on CD and replace if necessary.  In some
           cases, random corruption can mean that there is a hardware
           problem in the I/O path to the file.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000004D: NO_PAGES_AVAILABLE    (go to top of page)

Usual causes:  Device driver, memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms841500.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559012(v=VS.85).aspx

    Knowledge Base Articles:
KB 907419    A computer that is running Windows Powered Network-Attached Storage 2.01 may stop responding
KB 960772    The system may generate Stop error 0x4D when an application uses the VirtualLock function to lock pages in Windows Server 2003 or in Windows XP Professional x64 Edition

    WinDbg Help File Entry:

The NO_PAGES_AVAILABLE bug check has a value of 0x0000004D. This indicates that no free pages are available to continue operations.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The total number of dirty pages
2 The number of dirty pages destined for the page file
3 Windows XP and Windows 2000: The size of the nonpaged pool available at the time the bug check occurred

Windows Server 2003 and later: Reserved

4 Windows 2000: The number of transition pages that are currently stranded

Windows XP and later: The most recent modified write error status.


Cause

To see general memory statistics, use the !vm 3 extension.

This bug check can occur for any of the following reasons:

If the problem cannot be found, then try booting with a kernel debugger attached from the beginning, and monitor the situation.

    WinDbg Output Example:
NO_PAGES_AVAILABLE (4d)
No free pages available to continue operations.
If kernel debugger available "!vm 3".
        This bugcheck can occur for the following reasons:
        1.  A driver has blocked, deadlocking the modified or mapped
            page writers.  Examples of this include mutex deadlocks or
            accesses to paged out memory in filesystem drivers, filter
            drivers, etc.  This indicates a driver bug.
            If parameter 1 or 2 is large, then this is a possibility.  Type
            "!vm 3" in the kernel debugger.
        2.  The storage driver(s) are not processing requests.  Examples
            of this are stranded queues, non-responding drives, etc.  This
            indicates a driver bug.
            If parameter 1 or 2 is large, then this is a possibility.  Type
            "!process 0 7" in the kernel debugger.
        3.  Not enough pool is available for the storage stack to write out
            modified pages.  This indicates a driver bug.
            If parameter 3 is small, then this is a possibility.  Type
            "!vm" and "!poolused 2" in the kernel debugger.
        4.  A high priority realtime thread has starved the balance set
            manager from trimming pages and/or starved the modified writer
            from writing them out.  This indicates a bug in the component
            that created this thread.
            This one is hard to determine, try "!ready"
        5.  All the processes have been trimmed to their minimums and all
            modified pages written, but still no memory is available.  The
            freed memory must be stuck in transition pages with non-zero
            reference counts - thus they cannot be put on the freelist.
            A driver is neglecting to unlock the pages preventing the
            reference counts from going to zero which would free the pages.
            This may be due to transfers that never finish and the driver
            never aborts or other driver bugs.
            If parameter 4 is large, then this is a possibility.  But it
            is very hard to find the driver.  Try "!process 0 1" and look
            for any that have a lot of locked pages.
If the problem cannot be found, then try booting with /DEBUG and a kernel
debugger attached, so if it reproduces, a debug session can be initiated
to identify the cause.
Arguments:
Arg1: 0000000000000000, Total number of dirty pages
Arg2: 0000000000000000, Number of dirty pages destined for the pagefile(s).
Arg3: 0000000000000000, Internal flags.
Arg4: 0000000000000000, Most recent modified write error status.


STOP 0x0000004E: PFN_LIST_CORRUPT    (go to top of page)

Usual causes:  Device driver, ?memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms841511.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559014(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x4e
    OSROnline Listing:  http://www.osronline.com/article.cfm?article=334

    Knowledge Base Articles:
KB 139281    STOP Msg: 0x0000004E or 0x0000000A Under Heavy Computer Usage (NT)
KB 920872    Audio playback does not play the audio file from the correct position after you pause it, and you randomly receive a Stop error message when you try to play audio files in Windows XP Service Pack 2 (SP2)
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)
KB 2447725    "0x00000004E" Stop error occurs when some users try to access shared files in Windows Server 2008 or in Windows Vista
KB 2853579    "0x0000004E" Stop error when shadow copying fails on a computer that is running Windows Server 2012

    WinDbg Help File Entry:

The PFN_LIST_CORRUPT bug check has a value of 0x0000004E. This indicates that the page frame number (PFN) list is corrupted.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x01 The ListHead value that was corrupted The number of pages available 0 The list head was corrupt.
0x02 The entry in the list that is being removed The highest physical page number The reference count of the entry being removed A list entry was corrupt.
0x07 The page frame number The current share count 0 A driver has unlocked a certain page more times than it locked it.
0x8F New page number Old page number 0 The free or zeroed page listhead is corrupt.
0x99 Page frame number Current page state 0 A page table entry (PTE) or PFN is corrupt.
0x9A Page frame number Current page state The reference count of the entry that is being removed A driver attempted to free a page that is still locked for IO.

Cause

This error is typically caused by a driver passing a bad memory descriptor list. For example, the driver might have called MmUnlockPages twice with the same list.

If a kernel debugger is available, examine the stack trace.

    WinDbg Output Example:
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0008dd83, page frame number
Arg3: 00000002, current page state
Arg4: 0008de02, 0


STOP 0x0000004F: NDIS_INTERNAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms841523.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559017(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x4f

    Knowledge Base Articles:

    WinDbg Help File Entry:

The NDIS_INTERNAL_ERROR bug check has a value of 0x0000004F.

This bug check appears very infrequently.

    WinDbg Output Example:
NDIS_INTERNAL_ERROR (4f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA    (go to top of page)

Usual causes:  Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus,  Device driver, NTFS corruption, BIOS

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms841534.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559023(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x50
    OSROnline Listing:  http://www.osronline.com/article.cfm?article=335

    Knowledge Base Articles:
KB 171003    "Stop 0x50" Error Message While Installing Windows (NT, 2000)
KB 196389    STOP 0x0000000A or STOP 0x00000050 in NTOSKRNL.EXE (NT)
KB 250975    STOP Errors When Running MITAC 6133 Laptop on Battery Power (2000)
KB 252192    "Stop 0x00000050" in Ntfs.sys Under Stress Accessing Freed FCB (2000)
KB 286154    STOP 0X0000001E in Protcls.sys When You Undock a Toshiba Tecra 8100 (XP)
KB 310628    Easy CD Creator 5.0 does not function in Windows XP
KB 315335    "STOP 0x0000008e" error message during Windows XP setup
KB 317153    Stop 0x0000001e or Stop 0x00000050 Error in Navap.sys When You Use Norton AutoProtect Feature (NT Server, 2000 Server)
KB 323256    Stop 0x50 Error Message When You Rename a Large Number of Files on Windows 2000
KB 326189    "Stop" Errors Occur in ObpDestroySecurityDescriptorHeader (NT Server)
KB 329293    STOP: 0x00000050 Page_Fault_In_Non-Paged_Area Error After Installing Service Pack 1 (SP1) (XP)
KB 329772    "Stop error code 0x00000050" occurs when you start the computer for the first time (2000)
KB 810982    "Stop error code 0x00000050 (PAGE_FAULT_IN_NON_PAGED_AREA)" error message in Sentinel.sys when you start your computer (2000)
KB 811016    "Stop error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA)" when you use a PC card (2000)
KB 812343    Network activity causes your computer to stop responding, and you receive "Stop error code 0x00000050 (FAULT_IN_NONPAGED_AREA)" (2000)
KB 830848    Windows Server 2003 crashes intermittently, and you receive a "Stop error code 0x00000050" error message
KB 831239    "Stop error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA) in ppbint.dll" error message when you open a document (NT, 2000)
KB 883516    You receive Stop error code 0x00000019 or Stop error code 0x00000050 in the Tcpip.sys file on a Windows 2000 Server-based computer
KB 889681    You receive a "Stop error code 0x00000050" error message on your Windows 2000-based computer
KB 894278    The computer may automatically restart, or you may receive a "serious error" message or a Stop error message in Windows Server 2003, in Windows XP, or in Windows 2000
KB 903251    You may receive an error message on a Windows-based computer: "STOP 0x00000050" or "STOP 0x0000008e" (2000, XP, Server 2003)
KB 911028    When you use a 32-bit program to print a document from a 64-bit version of Microsoft Windows, you may receive a Stop error message, or objects on the page are omitted (XP, Server 2003)
KB 923150    When you restart Windows Server 2003 after you use the Driver Verifier utility, you may receive a Stop error: "STOP 0x00000050" or "STOP 0x000000F4"
KB 929637    Error message during Windows Vista startup if the Nero InCD program is installed and if the "Special pool" feature is enabled in the Driver Verifier utility: "Stop 00000050"
KB 950298    Error message on a Windows Server 2003-based file server: "Stop error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA)"
KB 951418    Stop error in Win7 and in Win2008 R2: "0x00000050 PAGE_FAULT_IN_NONPAGED_AREA"
KB 951880    Stop error when Windows Server 2003-based server restarts unexpectedly: "Stop 0x00000050"
KB 952844    You receive a "STOP: 0x00000050" error message when you start a Windows Server 2003-based computer by using the iSCSI Boot Initiator
KB 955066    Windows Server 2003 Terminal Server may crash during the terminal session logoff process, and you may receive a Stop error message: "Stop error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA)"
KB 955803    Stop error during the shutdown process on a Windows Server 2008 or Windows Vista SP1-based computer: "Stop 0x00000050"
KB 956182    Stop error message when you try to perform directory listing of a NFS share that is mounted on a Windows Server 2008-based NFS client: "STOP 0x00000050"
KB 957187    Stop error if you use some OpenType fonts on a computer that is running Windows Server 2003, Windows Vista, or Windows Server 2008: "Stop error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA)"
KB 957319    You receive a "Stop 0x00000050" or "Stop 0x0000008E" error message when you restart a Windows XP-based computer
KB 958282    Stop error message when an application calls the NtGdiRectInRegion function on a Windows XP-based computer: "Stop 0x00000050"
KB 958867    You receive a "Stop 0x00000050" or "Stop 0x0000000A" error message when you hot-replace memory on a Windows Server 2008-based computer
KB 959338    You receive a PAGE_FAULT_IN_NONPAGED_AREA Stop error when you print a document from a Windows Server 2003 server that is running as a terminal server
KB 959828   Stop error on a Windows Server 2003 SP2-based terminal server or a Windows Server 2008 SP2-based terminal server when users print documents in terminal sessions: "0x0000008E" or "0x00000050"
KB 960852    Stop error when an application calls the SystemParametersInfo function on a Windows Server 2003-based computer: "0x00000050"
KB 960882    Error message when a Windows Server 2003-based computer is shutting down: "Stop 0x000000CE" or "Stop 0x00000050"
KB 961799    A Stop error occurs on a Windows Server 2003-based server when a user accesses shared files on the server by using an SMB connection
KB 965497    You receive the Stop error 0x00000050 and then the computer restarts automatically if the OpenFileById function opens a folder and then the handle returned is used to rename files on a computer that is running Windows Server 2008 or Windows Vista
KB 966319    During user logon or logoff, you receive stop error code 0x00000050, and the system restarts automatically on a computer that is running Windows Server 2008 or Windows Vista SP1
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)
KB 970694 (not working)  "Stop 0x50" error - Enabling/disabling Bluetooth on Vista with Feature Pack for Wireless
KB 971075    Error message on a computer that runs Windows Server 2003 or Windows XP x64 Edition: "Stop 0x00000050"
KB 971251    Stop error code on a computer that is running Windows Server 2003 Service Pack 2: "0x00000050"
KB 973092    Stop error code occurs on a computer that is running Windows Server 2003 Service Pack 2: "0x00000050 PAGE_FAULT_IN_NONPAGED_AREA"
KB 973350 (Link Not Working)  "Stop 0x50" error - Enabling/disabling Bluetooth on Vista/Server 2008
KB 973618    Stop error when a surprise removal of a USB host controller occurs on a computer that is running Windows Server 2003: "Stop 0x00000050"
KB 974560    Error message during stress tests on a computer that is running Windows 7 if Driver Verifier is enabled: "Stop 0x00000050"
KB 975070    Error message after you apply update 973879: "Stop 0x0000007e" or "Stop 0x00000050" (Vista, Server 2008)
KB 975192    Error message after you enable or disable Microsoft Bluetooth Enumerator in Device Manager on a Windows Vista-based computer that has Windows Vista Feature Pack for Wireless installed: “Stop 0x00000050”
KB 975986    Stop error message on a computer that is running Windows Server 2003 SP2 and that has almost 4 GB or more of physical memory: "0x00000050" or "0x0000000A"
KB 976452    Error message on a blue screen when you perform an operation to a DFS server from a computer that is running Windows Vista or Windows Server 2008: "PAGE_FAULT_IN_NONPAGED_AREA"
KB 976748    Stop error code after you install Microsoft Multipath I/O (MPIO) on a computer that is running Windows Server 2008: "0x000000D1" or "0x00000050"
KB 979538    "Stop 0x0000007E" or "Stop 0x00000050" Stop error message in Windows 7 or Windows Server 2008 R2
KB 980135    Stop error message if under heavy load in Windows Server 2008 and in Windows Vista: "Stop 0x00000050"
KB 981471    Stop error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA) in Windows Server 2003 SP2
KB 987574    You may receive a Stop error message after you insert media into a removable disk device in Windows XP, Windows Server 2003, or Windows 2000
KB 2028815    "0x00000050" Stop error message occurs when you use multiple volume managers in Windows Server 2008
KB 2279561    "0x00000050" Stop error occurs on a terminal server that is running Windows Server 2003 if a user mode printer driver is used in a terminal server session
KB 2280072    "0x00000050" Stop error on a computer that is running Windows Vista or Windows Server 2008
KB 2460912    "0x0000007E" or "0x00000050" Stop error when you create snapshots of a volume in Windows Server 2008 R2 or in Windows 7
KB 2516405    "0x00000050" Stop error occurs when you run an application that uses the RegSetValueEx function on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2633799    You randomly receive various Stop errors when you change the network adapter teaming configuration in Windows Server 2008 or in Windows Vista
KB 2637924    "0x00000050" Stop error when you disconnect a HID during the system startup process in Windows 7 or in Windows Server 2008 R2
KB 2691226    Stop 0x50 on Windows Server 2008 R2 with RealVNC VNC Server 4.6 (Windows 7 also)
KB 2695584    "0x0000007E" or "0X00000050" Stop error when you run the Common Scenario Stress with IO test in Windows 7 or in Windows Server 2008 R2
KB 2709236    0x00000050 Stop error when Windows tries to back up registry hives on a computer that is running Windows Vista SP2 or Windows Server 2008 SP2
KB 2719594    "0x00000050" Stop error in Windows 7 or in Windows Server 2008 R2
KB 2727941    "0x00000050" Stop error when you create a volume snapshot in Windows Vista, in Windows Server 2008, in Windows 7 or in Windows Server 2008 R2
KB 2781406    "0x00000050" Stop error and an automatic restart on a Windows Server 2008 R2-based computer
KB 2787113    "0x00000050" Stop error when you create a snapshot by using the VSS in Windows Vista or in Windows Server 2008
KB 2788573    "0x00000050" Stop error when you run a WFP-based application to register a callout routine in Windows 7 or Windows Server 2008 R2
KB 2795491    "0x00000050" Stop error after a registry hive that contains many registry entries and subkeys is loaded in Windows Server 2008 SP2
KB 2824200    "0x00000024" or "0x00000050" Stop error on a computer that is running Windows Vista or Windows Server 2008
KB 2834026    "0x00000050" Stop error when you try to create a virtual machine or copy a VHD or VHDX file to a SMB share in Windows Server 2012
KB 2834140    "0x00000050" Stop error after you install update 2670838 on a computer that is running Windows 7 SP1 or Windows Server 2008 R2 SP1
KB 2902124    Stop error 0x50 occurs in Ndis.sys on a Windows 8-based or Windows Server 2012-based computer (0xD5 when running Verifier)
KB 2931772    "0x00000050" Stop error on the terminal server that is running Windows 7 SP1 or Windows Server 2008 R2 SP1 when a session is disconnected

    Many more STOP errors in this search:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x00000019&x=10&y=3&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The PAGE_FAULT_IN_NONPAGED_AREA bug check has a value of 0x00000050. This indicates that invalid system memory has been referenced.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read operation

1: Write operation

3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).

Another common cause is the installation of a faulty system service.

Antivirus software can also trigger this error, as can a corrupted NTFS volume.

Resolving the Problem

Resolving a faulty hardware problem: If hardware has been added to the system recently, remove it to see if the error recurs. If existing hardware has failed, remove or replace the faulty component. You should run hardware diagnostics supplied by the system manufacturer. For details on these procedures, see the owner's manual for your computer.

Resolving a faulty system service problem: Disable the service and confirm that this resolves the error. If so, contact the manufacturer of the system service about a possible update. If the error occurs during system startup, restart your computer, and press F8 at the character-mode menu that displays the operating system choices. At the resulting Windows Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time.

Resolving an antivirus software problem: Disable the program and confirm that this resolves the error. If it does, contact the manufacturer of the program about a possible update.

Resolving a corrupted NTFS volume problem: Run Chkdsk /f /r to detect and repair disk errors. You must restart the system before the disk scan begins on a system partition. If the hard disk is SCSI, check for problems between the SCSI controller and the disk.

Finally, check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. Disabling memory caching of the BIOS might also resolve it.

Comments

Typically, this address is in freed memory or is simply invalid.

This cannot be protected by a try - except handler — it can only be protected by a probe.

    WinDbg Output Example:
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffe0d408, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 9712ebd2, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 00000000, (reserved)


STOP 0x00000051: REGISTRY_ERROR    (go to top of page)

Usual causes:  Hardware failure, File system corruption, Security issues

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms841638.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559026(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x51

    Knowledge Base Articles:
KB 321771    You Receive a "Stop 0x51 (REGISTRY_ERROR)" Error Message (2000)
KB 810558    "Stop 0x00000051 REGISTRY_ERROR" Error Message When You Back Up the Registry Hive (2000)
KB 815265    "STOP 0x00000051" or "STOP 0x0000001E" error message when you start Configuration Manager in Windows 2000 Server or in Windows XP
KB 834728    You receive a "Stop 0x00000051" error message during registry restoration (2000)
KB 838213    List of base operating system fixes in Windows XP Service Pack 2 and Windows XP Tablet PC Edition 2005
KB 898792    A fix is available for a registry problem on Dell PowerEdge servers that have specific nonnative disk controllers and factory installed versions of Windows Server 2003
KB 907317    You receive a "Stop 0x00000051 REGISTRY_ERROR" message when a corrupted user profile is loaded on a computer that is running Windows Server 2003
KB 925844    Error message when a Windows Server 2003-based computer is running under high stress: "STOP 0x00000051 REGISTRY_ERROR"
KB 940795    Error message after you install Windows Server 2003 Service Pack 1 or Service Pack 2 on a Dell PowerEdge server: "Stop 0x00000051"

    WinDbg Help File Entry:

The REGISTRY_ERROR bug check has a value of 0x00000051. This indicates that a severe registry error has occurred.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Reserved
2 Reserved
3 The pointer to the hive (if available)
4 If the hive is corrupt, the return code of HvCheckHive (if available)

Cause

Something has gone wrong with the registry. If a kernel debugger is available, get a stack trace.

This error may indicate that the registry encountered an I/O error while trying to read one of its files. This can be caused by hardware problems or file system corruption.

It may also occur due to a failure in a refresh operation, which is used only in by the security system, and then only when resource limits are encountered.

    WinDbg Output Example:
REGISTRY_ERROR (51)
Something has gone badly wrong with the registry.  If a kernel debugger
is available, get a stack trace. It can also indicate that the registry got
an I/O error while trying to read one of its files, so it can be caused by
hardware problems or filesystem corruption.
It may occur due to a failure in a refresh operation, which is used only
in by the security system, and then only when resource limits are encountered.
Arguments:
Arg1: 0000000000000000, (reserved)
Arg2: 0000000000000000, (reserved)
Arg3: 0000000000000000, depends on where Windows bugchecked, may be pointer to hive
Arg4: 0000000000000000, depends on where Windows bugchecked, may be return code of
    HvCheckHive if the hive is corrupt.


STOP 0x00000052: MAILSLOT_FILE_SYSTEM    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms841797.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559031(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The MAILSLOT_FILE_SYSTEM bug check has a value of 0x00000052.

This bug check appears very infrequently.

    WinDbg Output Example:
MAILSLOT_FILE_SYSTEM (52)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000053: NO_BOOT_DEVICE    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms842023.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559035(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The NO_BOOT_DEVICE bug check has a value of 0x00000053.

This bug check appears very infrequently.

    WinDbg Output Example:
NO_BOOT_DEVICE (53)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000054: LM_SERVER_INTERNAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms842035.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559040(v=VS.85).aspx

    Knowledge Base Articles:
KB 313169    "Stop 0x00000054" Error Message in Windows 2000
KB 912947    Error message when you install a Volume Shadow Copy Service update on a Windows Server 2003 SP1-based computer: "STOP: 0x00000054 (0x00361595, 0xf12db001, 0x00000000, 0x00000000)"

    WinDbg Help File Entry:

The LM_SERVER_INTERNAL_ERROR bug check has a value of 0x00000054.

This bug check appears very infrequently.

    WinDbg Output Example:
LM_SERVER_INTERNAL_ERROR (54)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000055: DATA_COHERENCY_EXCEPTION    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms842046.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559044(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DATA_COHERENCY_EXCEPTION bug check has a value of 0x00000055.

This bug check appears very infrequently.

    WinDbg Output Example:
DATA_COHERENCY_EXCEPTION (55)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000056: INSTRUCTION_COHERENCY_EXCEPTION    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms842057.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559049(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INSTRUCTION_COHERENCY_EXCEPTION bug check has a value of 0x00000056.

This bug check appears very infrequently.

    WinDbg Output Example:
INSTRUCTION_COHERENCY_EXCEPTION (56)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000057: XNS_INTERNAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819226.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559054(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The XNS_INTERNAL_ERROR bug check has a value of 0x00000057.

This bug check appears very infrequently.

    WinDbg Output Example:
XNS_INTERNAL_ERROR (57)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000058: FTDISK_INTERNAL_ERROR    (go to top of page)

Usual causes:  Booting system from wrong copy of a mirrored volume

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819227.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559058(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x58

    Knowledge Base Articles:
KB 128630    How to Recover From a STOP 0x00000058 FTDISK_INTERNAL_ERROR (NT Server, 2000 Server)

    WinDbg Help File Entry:

The FTDISK_INTERNAL_ERROR bug check has a value of 0x00000058. This is issued if the system is booted from the wrong copy of a mirrored partition.

Parameters

None

Cause

The hives are indicating that the mirror is valid, but it is not. The hives should actually be pointing to the shadow partition.

This is almost always caused by the primary partition being revived.

Resolving the Problem

Reboot the system from the shadow partition.

    WinDbg Output Example:
VOLMGRX_INTERNAL_ERROR (58)
Windows cannot boot from a secondary plex of a mirrored volume when the mirror
is not up to date. Please boot from the primary plex of the mirrored volume.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000059: PINBALL_FILE_SYSTEM    (go to top of page)

Usual causes:  Indexing, Device driver, Insufficient memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819229.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559061(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PINBALL_FILE_SYSTEM bug check has a value of 0x00000059. This indicates that a problem occurred in the Pinball file system.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 Reserved
3 Reserved
4 Reserved

Cause

One possible cause of this bug check is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Resolving the Problem

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This will increase the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
PINBALL_FILE_SYSTEM (59)
    See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000005A: CRITICAL_SERVICE_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819231.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559064(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x5a

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CRITICAL_SERVICE_FAILED bug check has a value of 0x0000005A.

This bug check appears very infrequently.

    WinDbg Output Example:
CRITICAL_SERVICE_FAILED (5a)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000005B: SET_ENV_VAR_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819232.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559066(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SET_ENV_VAR_FAILED bug check has a value of 0x0000005B.

This bug check appears very infrequently.

    WinDbg Output Example:
SET_ENV_VAR_FAILED (5b)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000005C: HAL_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  System couldn't initialize the HAL - many causes.  Hardware, file system, boot corruption, etc

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819234.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559069(v=VS.85).aspx

    Knowledge Base Articles:
KB 965228    Windows Server 2008 IA-64 systems cannot start, and Stop error 0x0000005C is generated on a computer that has many of I/O SAPIC controllers installed
KB 2303458    A fix is available for three issues in the x2APIC mode in x64-based versions of Windows Server 2008 R2
KB 2508054    "0x0000005C" Stop error code or assertion failure in the startup process if you enable Driver Verifier in Windows Server 2008 R2

KB 2616137    Adding the Hyper-V role in Windows Server 2008 R2 may cause a Stop 0x5C on reboot if x2APIC is enabled


    WinDbg Help File Entry:

The HAL_INITIALIZATION_FAILED bug check has a value of 0x0000005C.

This indicates that the HAL initialization failed.

    WinDbg Output Example:
HAL_INITIALIZATION_FAILED (5c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000005D: UNSUPPORTED_PROCESSOR    (go to top of page)

Usual causes:  Unsupported processor

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819236.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559072(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The UNSUPPORTED_PROCESSOR bug check has a value of 0x0000005D. This indicates that the computer is attempting to run Windows on an unsupported processor.

Parameters

None

Cause

Windows requires a higher-grade processor than the one you are using.

    WinDbg Output Example:
UNSUPPORTED_PROCESSOR (5d)
    386 - System failed because the processor is only a 386 or
    compatible.  The system requires a Pentium (or higher) compatible processor.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000005E: OBJECT_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819238.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559078(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The OBJECT_INITIALIZATION_FAILED bug check has a value of 0x0000005E.

This bug check appears very infrequently.

    WinDbg Output Example:
OBJECT_INITIALIZATION_FAILED (5e)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000005F: SECURITY_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819244.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559085(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SECURITY_INITIALIZATION_FAILED bug check has a value of 0x0000005F.

This bug check appears very infrequently.

    WinDbg Output Example:
SECURITY_INITIALIZATION_FAILED (5f)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000060: PROCESS_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819246.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559094(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PROCESS_INITIALIZATION_FAILED bug check has a value of 0x00000060.

This bug check appears very infrequently.

    WinDbg Output Example:
PROCESS_INITIALIZATION_FAILED (60)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000061: HAL1_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819248.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559097(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The HAL1_INITIALIZATION_FAILED bug check has a value of 0x00000061.

This bug check appears very infrequently.

    WinDbg Output Example:
HAL1_INITIALIZATION_FAILED (61)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000062: OBJECT1_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819250.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559104(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The OBJECT1_INITIALIZATION_FAILED bug check has a value of 0x00000062.

This bug check appears very infrequently.

    WinDbg Output Example:
OBJECT1_INITIALIZATION_FAILED (62)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 000000000000000


STOP 0x00000063: SECURITY1_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819251.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559108(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SECURITY1_INITIALIZATION_FAILED bug check has a value of 0x00000063.

This bug check appears very infrequently.

    WinDbg Output Example:
SECURITY1_INITIALIZATION_FAILED (63)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000064: SYMBOLIC_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819254.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559117(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SYMBOLIC_INITIALIZATION_FAILED bug check has a value of 0x00000064.

This bug check appears very infrequently.

    WinDbg Output Example:
SYMBOLIC_INITIALIZATION_FAILED (64)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000065: MEMORY1_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819258.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559120(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The MEMORY1_INITIALIZATION_FAILED bug check has a value of 0x00000065.

This bug check appears very infrequently.

    WinDbg Output Example:
MEMORY1_INITIALIZATION_FAILED (65)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000066: CACHE_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819262.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559123(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CACHE_INITIALIZATION_FAILED bug check has a value of 0x00000066.

This bug check appears very infrequently.

    WinDbg Output Example:
CACHE_INITIALIZATION_FAILED (66)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000067: CONFIG_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  Shouldn't happen :0) - Insufficient paged pool early in the boot sequence prevents registry from loading, could also be (IMO) a problem with the registry being too large for the system memory (but very unlikely)

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819267.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559126(v=VS.85).aspx

    Knowledge Base Articles:
KB 317053    "STOP 0x00000067" Error Message When You Attempt to Start Windows (NT, 2000)

    WinDbg Help File Entry:

The CONFIG_INITIALIZATION_FAILED bug check has a value of 0x00000067. This bug check indicates that the registry configuration failed.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 Reserved
2 The location selector
3 The NT status code
4 Reserved

Cause

The registry could not allocate the pool that it needed to contain the registry files. This situation should never occur, because the register allocates this pool early enough in system initialization so that plenty of paged pool should be available.

    WinDbg Output Example:
CONFIG_INITIALIZATION_FAILED (67)
This means the registry couldn't allocate the pool needed to contain the
registry files.  This should never happen, since it is early enough in
system initialization that there is always plenty of paged pool available.
Arguments:
Arg1: 0000000000000000, (reserved)
Arg2: 0000000000000000, location selector
Arg3: 0000000000000000, NT status code
Arg4: 0000000000000000


STOP 0x00000068: FILE_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819268.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559132(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The FILE_INITIALIZATION_FAILED bug check has a value of 0x00000068.

This bug check appears very infrequently.

    WinDbg Output Example:
FILE_INITIALIZATION_FAILED (68)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000069: IO1_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  Improper setup, Improper configuration after setup

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819274.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559133(v=VS.85).aspx

    Knowledge Base Articles:
KB 826727    Computer Stops Responding, and You Receive a "Stop 0x00000069" Error Message (2000 Server, Server 2003)

    WinDbg Help File Entry:

The IO1_INITIALIZATION_FAILED bug check has a value of 0x00000069. This bug check indicates that the initialization of the I/O system failed for some reason.

Parameters

None

Cause

There is very little information available to analyze this error.

Most likely, the setup routine has improperly installed the system, or a user has reconfigured the system.

    WinDbg Output Example:
IO1_INITIALIZATION_FAILED (69)
Initialization of the I/O system failed for some reason.  There is
very little information available.  In general, setup really made
some bad decisions about the installation of the system, or the user has
reconfigured the system.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000006A: LPC_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819277.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559137(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The LPC_INITIALIZATION_FAILED bug check has a value of 0x0000006A.

This bug check appears very infrequently.

    WinDbg Output Example:
LPC_INITIALIZATION_FAILED (6a)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000006B: PROCESS1_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  Hard drive, Cables, Missing boot files, Disabled driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819280.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559142(v=VS.85).aspx

    Knowledge Base Articles:
KB 307012    "Stop 0x0000006B" After Installing a Windows 2000 Service Pack
KB 311562    "An Unexpected Error (768) Occurred at Line 5118@ind:Xp\Client\Boot\Setup\Setup.c" Error Message During Windows XP Setup
KB 319026    Random Pool Corruption Is Caused by Rdbss.sys (2000)   
KB 327536    "Stop 0x0000006b" or Setup stops responding at "Setup is starting Windows" when you install a Windows XP SP1 client image from a Windows 2000-based RIS server
KB 330134    STOP: 0x0000006B "Process1_ Initialization_Failed" error message when you try to upgrade to Windows XP
KB 967551    Rollup update for the volsnap.sys driver in Windows Server 2003
KB 981833    "STOP: 0x0000006B" Stop error message during startup on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2746140    You receive "0x0000006B" and "0XC000021A" Stop error message after uninstalling McAfee Agent 4.6.2 in Windows Vista, Windows 7, Windows Server 2008 or Windows Server 2008 R2

    WinDbg Help File Entry:

The PROCESS1_INITIALIZATION_FAILED bug check has a value of 0x0000006B. This bug check indicates that the initialization of the Microsoft Windows operating system failed.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The NT status code that caused the failure
2 Reserved
3 Reserved
4 Reserved

Cause

Any part of the disk subsystem can cause the PROCESS1_INITIALIZATION_FAILED bug check, including bad disks, bad or incorrect cables, mixing different ATA-type devices on the same chain, or drives that are not available becuase of hardware regeneration.

This bug check can also be caused by a missing file from the boot partition or by a driver file that a user accidentally disabled in the Drivers tab.

    WinDbg Output Example:
PROCESS1_INITIALIZATION_FAILED (6b)
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that caused the failure.
Arg2: 0000000000000000, (reserved)
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000006C: REFMON_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819283.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559147(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The REFMON_INITIALIZATION_FAILED bug check has a value of 0x0000006C.

This bug check appears very infrequently.

    WinDbg Output Example:
REFMON_INITIALIZATION_FAILED (6c)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000006D: SESSION1_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  See ntstatus.h in the SDK to look up the value of parameter 1 (ntstatus.h also located at this link:  ntstatus.html )

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819286.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559152(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SESSION1_INITIALIZATION_FAILED bug check has a value of 0x0000006D. This bug check indicates that the initialization of the Microsoft Windows operating system failed.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The NT status code that caused the initialization failure
2 0
3 0
4 0

    WinDbg Output Example:
SESSION1_INITIALIZATION_FAILED (6d)
    1 - Indicates the NT status code that caused the failure.
DESCRIPTION
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000006E: SESSION2_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  See ntstatus.h in the SDK to look up the value of parameter 1

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819287.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559154(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SESSION2_INITIALIZATION_FAILED bug check has a value of 0x0000006E. This bug check indicates that the initialization of the Microsoft Windows operating system failed.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The NT status code that caused the Windows operating system to conclude that initialization failed
2 0
3 0
4 0

    WinDbg Output Example:
SESSION2_INITIALIZATION_FAILED (6e)
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that tripped Windows into thinking
    that initialization failed.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000006F: SESSION3_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  See ntstatus.h in the SDK to look up the value of parameter 1

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819290.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559156(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x6f

    Knowledge Base Articles:
KB 153742    STOP 0x0000006F During System Initialization (NT, 2000)
KB 236086    System or Boot Disk Listed as Dynamic Unreadable in Disk Management (2000)
KB 939008    Error message when you start a Windows Vista-based computer on which Windows ReadyBoost is running: "STOP: 0x0000006F SESSION3 INITIALIZATION FAILED"

    WinDbg Help File Entry:

The SESSION3_INITIALIZATION_FAILED bug check has a value of 0x0000006F. This bug check indicates that the initialization of the Microsoft Windows operating system initialization.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The NT status code that caused the Windows operating system to conclude that initialization failed
2 0
3 0
4 0

    WinDbg Output Example:
SESSION3_INITIALIZATION_FAILED (6f)
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that tripped Windows into thinking
    that initialization failed.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000070: SESSION4_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  See ntstatus.h in the SDK to look up the value of parameter 1

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819291.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559167(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SESSION4_INITIALIZATION_FAILED bug check has a value of 0x00000070. This bug check indicates that the initialization of the Microsoft Windows operating system failed.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The NT status code that caused the Windows operating system to conclude that initialization failed
2 0
3 0
4 0

    WinDbg Output Example:
SESSION4_INITIALIZATION_FAILED (70)
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that tripped Windows into thinking
    that initialization failed.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000071: SESSION5_INITIALIZATION_FAILED    (go to top of page)

Usual causes:  See ntstatus.h in the SDK to look up the value of parameter 1

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819294.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559171(v=VS.85).aspx

    Knowledge Base Articles:
KB 887359    You receive a "STOP 0x00000071" error message after you install the 811493 (MS03-013) security update on your Windows 2000 Professional-based computer

    WinDbg Help File Entry:

The SESSION5_INITIALIZATION_FAILED bug check has a value of 0x00000071. This bug check indicates that the initialization of the Microsoft Windows operating system failed.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The NT status code that caused the Windows operating system to conclude that initialization failed
2 0
3 0
4 0

    WinDbg Output Example:
SESSION5_INITIALIZATION_FAILED (71)
The bugcheck code (SESSION1 - SESSION5) indicates the point during
initialization when the failure was detected.
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that tripped Windows into thinking
    that initialization failed.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000072: ASSIGN_DRIVE_LETTERS_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819296.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559178(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The ASSIGN_DRIVE_LETTERS_FAILED bug check has a value of 0x00000072.

This bug check appears very infrequently.

    WinDbg Output Example:
ASSIGN_DRIVE_LETTERS_FAILED (72)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000073: CONFIG_LIST_FAILED    (go to top of page)

Usual causes:  Disk issues, File system issues, Low disk space, Low memory available for pool allocation

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819301.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559183(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CONFIG_LIST_FAILED bug check has a value of 0x00000073. This bug check indicates that one of the top-level registry keys, also known as core system hives, cannot be linked in the registry tree.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 1
2 The NT status code that led the Windows operating system to assume that it failed to load the hive
3 The index of the hive in the hive list
4 A pointer to a UNICODE_STRING structure that contains the file name of the hive

Cause

The registry hive that cannot be linked might be SAM, SECURITY, SOFTWARE, or DEFAULT. The hive is valid, because it was loaded successfully.

Examine Parameter 2 to see why the hive could not be linked in the registry tree. One common cause of this error is that the Windows operating system is out of disk space on the system drive. (In this situation, this parameter is 0xC000017D, STATUS_NO_LOG_SPACE.) Another common problem is that an attempt to allocate pool has failed. (In this situation, Parameter 2 is 0xC000009A, STATUS_INSUFFICIENT_RESOURCES.) You must investigate other status codes.

    WinDbg Output Example:
CONFIG_LIST_FAILED (73)
Indicates that one of the core system hives cannot be linked in the
registry tree. The hive is valid, it was loaded OK. Examine the 2nd
bugcheck argument to see why the hive could not be linked in the
registry tree.
This can be either SAM, SECURITY, SOFTWARE or DEFAULT. One common reason
for this to happen is if you are out of disk space on the system drive
(in which case param 2 is 0xC000017D - STATUS_NO_LOG_SPACE) or an attempt
to allocate pool has failed (in which case param 2 is 0xC000009A -
STATUS_INSUFFICIENT_RESOURCES). Other status codes must be individually
investigated.
Arguments:
Arg1: 0000000000000000, 1
Arg2: 0000000000000000, Indicates the NT status code that tripped Windows into
    thinking that it had failed to load the hive.
Arg3: 0000000000000000, Index of hive in hivelist
Arg4: 0000000000000000, Pointer to UNICODE_STRING containing filename of hive


STOP 0x00000074: BAD_SYSTEM_CONFIG_INFO    (go to top of page)

Usual causes:  System hive corruption, Missing registry keys/values, bad memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819304.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559188(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x74

    Knowledge Base Articles:
KB 283433    Cannot Start Windows XP After You Install Windows 2000
KB 326679    "STOP 0x00000074 BAD_SYSTEM_CONFIG_INFO" Error Message When You Start Your Computer (XP)

    WinDbg Help File Entry:

The BAD_SYSTEM_CONFIG_INFO bug check has a value of 0x00000074. This bug check indicates that there is an error in the registry.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 Reserved
2 Reserved
3 Reserved
4 The NT status code (if it is available)

Cause

The BAD_SYSTEM_CONFIG_INFO bug check occurs if the SYSTEM hive is corrupt. However, this corruption is unlikely, because the boot loader, known as NT Loader (NTLDR) in versions of Windows prior to Vista, checks a hive for corruption when it loads the hive.

This bug check can also occur if some critical registry keys and values are missing. These keys and values might be missing if a user manually edited the registry.

Resolving the Problem

Try restarting the computer by selecting "last known good configuration" in the boot options.

If the restart does not fix the problem, the registry damage is too extensive. You must reinstall the OS or use the Emergency Repair Disk (ERD) that you previously created by using the Windows Backup tool.

    WinDbg Output Example:
BAD_SYSTEM_CONFIG_INFO (74)
Can indicate that the SYSTEM hive loaded by the osloader/NTLDR
was corrupt.  This is unlikely, since the osloader will check
a hive to make sure it isn't corrupt after loading it.
It can also indicate that some critical registry keys and values
are not present.  (i.e. somebody used regedt32 to delete something
that they shouldn't have)  Booting from LastKnownGood may fix
the problem, but if someone is persistent enough in mucking with
the registry they will need to reinstall or use the Emergency
Repair Disk.
Arguments:
Arg1: 0000000000000000, (reserved)
Arg2: 0000000000000000, (reserved)
Arg3: 0000000000000000, (reserved)
Arg4: 0000000000000000, usually the NT status code.


STOP 0x00000075: CANNOT_WRITE_CONFIGURATION    (go to top of page)

Usual causes:  Shouldn't happen :0) - Insufficient paged pool early in the boot sequence prevents registry from loading, could also be (IMO) a problem with the registry being too large for the system memory (but very unlikely)

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819308.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559192(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CANNOT_WRITE_CONFIGURATION bug check has a value of 0x00000075. This bug check indicates that the SYSTEM registry hive file cannot be converted to a mapped file.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 1
2 The NT status code that led the Windows operating system to assume that it had failed to convert the hive
3 Reserved
4 Reserved

Cause

The CANNOT_WRITE_CONFIGURATION bug check typically occurs if the system is out of pool and the Windows operating system cannot reopen the hive.

This bug check should almost never occur, because the conversion of the hive file occurs early enough during system initialization so that enough pool should be available.

    WinDbg Output Example:
CANNOT_WRITE_CONFIGURATION (75)
This will result if the SYSTEM hive file cannot be converted to a
mapped file. This usually happens if the system is out of pool and
we cannot reopen the hive.
Normally you shouldn't see this as the conversion happens at early
during system initialization, so enough pool should be available.
Arguments:
Arg1: 0000000000000000, 1
Arg2: 0000000000000000, Indicates the NT status code that tripped Windows into
    thinking that it had failed to convert the hive.
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000076: PROCESS_HAS_LOCKED_PAGES    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819309.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559194(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x76

    Knowledge Base Articles:
KB 256010    "STOP 0x00000076 - PROCESS_HAS_LOCKED_PAGES" error message in Windows 2000, Windows XP Professional, and Windows Server 2003, Standard Edition
KB 825760    You Receive Stop Error 0x00000076 or 0x000000CB When You Quit Your Backup Software (2000, XP)
KB 825820    "0x00000076" or "0x000000CB" Stop Error Occurs When Windows 2000 Server Tries to Run a Process on a Remote Server
KB 895473    The computer restarts, you receive an error message, or an event is logged in the System log on a Windows Server 2003-based computer that is running in PAE mode and that has a Sybase database installed
KB 951033    Stop error message on a Windows Server 2003-based computer that has Citrix Presentation Server 4.5 installed: "0x00000076" or "0x000000CB"
KB 979742    "0x000000CB" Stop error or "0x00000076" Stop error in Windows Vista or in Windows Server 2008 when you access shared network resources by using SMB version 1 protocol on the computer

    WinDbg Help File Entry:

The PROCESS_HAS_LOCKED_PAGES bug check has a value of 0x00000076. This bug check indicates that a driver failed to release locked pages after an I/O operation.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 0
2 The process address.
3 The number of locked pages.
4 A pointer to driver stacks (if they are enabled). Otherwise, this parameter is 0.

Cause

A driver failed to release pages that it locked.

Resolving the Problem

First, use the !search extension on the current process pointer throughout all of physical memory. This extension might find at least one memory descriptor list (MDL) that points to the current process. Next, use !search on each MDL that you find to obtain the I/O request packet (IRP) that points to the current process. From this IRP, you can identify which driver is leaking the pages.

Otherwise, you can detect which driver caused the error by editing the registry:

  1. In the \\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management registry key, create or edit the TrackLockedPages value, and then set it equal to DWORD 1.
  2. Restart the computer.

The system then saves stack traces, so you can easily identify the driver that caused the problem. If the driver causes the same error again, bug check 0xCB (DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS) is issued, and the name of the driver that causes this error is displayed.

    WinDbg Output Example:
PROCESS_HAS_LOCKED_PAGES (76)
Caused by a driver not cleaning up correctly after an I/O.
Arguments:
Arg1: 0000000000000000, Locked memory pages found in process being terminated.
Arg2: 0000000000000000, Process address.
Arg3: 0000000000000000, Humber of locked pages.
Arg4: 0000000000000000, Pointer to driver stacks (if enabled) or 0 if not.
    Issue a !search over all of physical memory for the current process pointer.
    This will yield at least one MDL which points to it.  Then do another !search
    for each MDL found, this will yield the IRP(s) that point to it, revealing
    which driver is leaking the pages.
    Otherwise, set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
    Management\TrackLockedPages to a DWORD 1 value and reboot.  Then the system
    will save stack traces so the guilty driver can be easily identified.
    When you enable this flag, if the driver commits the error again you will
    see a different bugcheck - DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (0xCB) -
    which can identify the offending driver(s).


STOP 0x00000077: KERNEL_STACK_INPAGE_ERROR    (go to top of page)

Usual causes:  Memory, Corrupt paging file, File system errors, Disk errors, Bad cables, BIOS, Missing Service Pack, Bad motherboard, Virus infection (particulary in the MBR), Improperly seated cards

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819312.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559197(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x77

    Knowledge Base Articles:
KB 228753    Troubleshooting "Stop 0x00000077" or "KERNEL_STACK_INPAGE_ERROR" (NT, 2000)
KB 315266    You receive an error message on a Windows XP-based computer: "Stop 0x00000077" or "KERNEL_STACK_INPAGE_ERROR"
KB 950415    Error message on a computer that is running the Windows operating system: "Stop 0x00000077 KERNEL_STACK_INPAGE_ERROR" (2000, XP, Server 2003)
KB 954429    You experience problems on a multiprocessor computer that is running Windows Server 2003, Windows Vista, or Windows Server 2008 when you resume the computer from hibernation
KB 956871    The system may crash when you put a Windows Vista-based computer or a Windows Server 2008-based computer into hibernation
KB 967352    Stop error message when you put a computer that is running Windows Vista or Windows Server 2008 into hibernation: "STOP 0x000000A0," "STOP 0x0000007a," or "STOP 0x00000077"
KB 977178    You receive various Stop error messages in Windows 7 or in Windows Server 2008 R2 when you resume a computer that has a large SATA hard disk
KB 2498326    Stop Error on Windows Server 2008 R2 During Upgrade of FCoE Adapter Driver

    WinDbg Help File Entry:

The KERNEL_STACK_INPAGE_ERROR bug check has a value of 0x00000077. This bug check indicates that the requested page of kernel data from the paging file could not be read into memory.

Parameters

The four parameters that listed in the message have two possible meanings.

If the first parameter is 0, 1, or 2, the parameters have the following meaning.

Parameter Description
1 0: The page of kernel data was retrieved from page cache.

1: The page was retrieved from a disk.

2: The page was retrieved from a disk, the storage stack returned SUCCESS, but Status.Information is not equal to PAGE_SIZE.

2 The value that appears in the stack where the signature should be.
3 0
4 The address of the signature on the kernel stack

If the first parameter is any value other than 0, 1, or 2, the parameters have the following meaning.

Parameter Description
1 The status code
2 The I/O status code
3 The page file number
4 The offset into page file

Cause

If the first parameter is 0 or 1, the stack signature in the kernel stack was not found. This error is probably caused by defective hardware, such as a RAM error.

If the first parameter is 2, the driver stack returned an inconsistent status for the read of the page. For example, the driver stack returned a success status even though it did not read the whole page.

If the first parameter is any value other than 0, 1, or 2, the value of the first parameter is an NTSTATUS error code that the driver stack returns after it tries to retrieve the page of kernel data. You can determine the exact cause of this error from the I/O status code (the second parameter). Some common status codes include the following:

These status codes are the most common ones that have specific causes. For more information about other possible status codes that might be returned, see the Ntstatus.h file in the Microsoft Windows Driver Kit (WDK).

A virus infection can also cause this bug check.

Resolving the Problem

Resolving a bad block problem: If you can restart the computer after the error, Autochk runs automatically and attempts to map the bad sector to prevent it from being used anymore.

If Autochk does not scan the hard disk for errors, you can manually start the disk scanner. Run Chkdsk /f /r on the system partition. You must restart the computer before the disk scan begins. If you cannot start the system because the error, use the Recovery Console and run Chkdsk /r.

Warning  If your system partition is formatted with the FAT file system, the long file names that the Windows operating system uses might be damaged if you use Scandisk or another MS-DOS-based hard disk tool to verify the integrity of your hard disk drive from MS-DOS. Always use the version of Chkdsk that matches your version of the Windows operating system.

Resolving a defective hardware problem: If the I/O status is 0xC0000185 and the paging file is on an SCSI disk, check the disk cabling and SCSI termination for problems.

Resolving a failing RAM problem: Run the hardware diagnostics that the system manufacturer supplies, especially the memory scanner. For more information about these procedures, see the owner's manual for your computer.

Check that all the adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure adapter card contacts are clean.

Check the System Log in Event Viewer for additional error messages that might help identify the device that is causing the error. You can also disable memory caching of the BIOS to try to resolve this error.

Make sure that the latest Windows Service Pack is installed.

If the preceding steps fail to resolve the error, take the system motherboard to a repair facility for diagnostic testing. A crack, a scratched trace, or a defective component on the motherboard can cause this error.

Resolving a virus infection: Check your computer for viruses by using any up-to-date, commercial virus scanning software that examines the Master Boot Record of the hard disk. All Windows file systems can be infected by viruses.

See Also

Bug Check 0x7A (KERNEL_DATA_INPAGE_ERROR)

    WinDbg Output Example:
KERNEL_STACK_INPAGE_ERROR (77)
The requested page of kernel data could not be read in.  Caused by
bad block in paging file or disk controller error.
In the case when the first arguments is 0 or 1, the stack signature
in the kernel stack was not found.  Again, bad hardware.
An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or
C000016AL (STATUS_DISK_OPERATION_FAILED)  normally indicates
the data could not be read from the disk due to a bad
block.  Upon reboot autocheck will run and attempt to map out the bad
sector.  If the status is C0000185 (STATUS_IO_DEVICE_ERROR) and the paging
file is on a SCSI disk device, then the cabling and termination should be
checked.  See the knowledge base article on SCSI termination.
Arguments:
Arg1: c0000056, status code
Arg2: c0000056, i/o status code
Arg3: 00000000, page file number
Arg4: 126fb000, offset into page file


KERNEL_STACK_INPAGE_ERROR (77)
The requested page of kernel data could not be read in.  Caused by
bad block in paging file or disk controller error.
In the case when the first arguments is 0 or 1, the stack signature
in the kernel stack was not found.  Again, bad hardware.
An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or
C000016AL (STATUS_DISK_OPERATION_FAILED)  normally indicates
the data could not be read from the disk due to a bad
block.  Upon reboot autocheck will run and attempt to map out the bad
sector.  If the status is C0000185 (STATUS_IO_DEVICE_ERROR) and the paging
file is on a SCSI disk device, then the cabling and termination should be
checked.  See the knowledge base article on SCSI termination.
Arguments:
Arg1: 0000000000000000, (page was retrieved from page cache)
Arg2: 0000000000000000, value found in stack where signature should be
Arg3: 0000000000000000, 0
Arg4: 0000000000000000, address of signature on kernel stack


STOP 0x00000078: PHASE0_EXCEPTION    (go to top of page)

Usual causes:  Break set in boot sequence without a debugger being enabled

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819314.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559206(v=VS.85).aspx

    Knowledge Base Articles:
KB 184758    STOP 0x78 When NonPagedPoolSize > Seven-eighths of Physical Memory (NT)
KB 980358    Stop error when you startup Windows Preinstallation Environment (PE) on a computer that has the Pentium 233 MHz MMX process installed: "STOP 0x00000078"

    WinDbg Help File Entry:

The PHASE0_EXCEPTION bug check has a value of 0x00000078.

This bug check occurs when an unexpected break is encountered during HAL initialization. This break can occur if you have set the /break parameter in your boot settings but have not enabled kernel debugging.

    WinDbg Output Example:
PHASE0_EXCEPTION (78)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000079: MISMATCHED_HAL    (go to top of page)

Usual causes:  HAL doesn't match ntoskrnl.exe (or Ntkrnlmp.exe) and/or the system

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819317.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559209(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x79

    Knowledge Base Articles:
KB 329972    "STOP 0x00000079 mismatched_hal" error message occurs after you install Windows XP on a Windows Server 2003-based computer
KB 833143    You receive a "0x00000079 (0x00000004, 0x0000AC31, 0x00000000, 0x00000000)" stop error message when you start a Windows XP-based or a Windows 2000-based guest PC in Virtual PC 2004
KB 841384    STOP 0x00000079" error message appears on a Windows NT 4.0-based computer

    WinDbg Help File Entry:

The MISMATCHED_HAL bug check has a value of 0x00000079. This bug check indicates that the Hardware Abstraction Layer (HAL) revision level or configuration does not match that of the kernel or the computer.

Parameters

The following parameters appear on the blue screen. Parameter 1 indicates the type of mismatch.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause.
0x1 The major processor control block (PRCB) level of Ntoskrnl.exe. The major PRCB level of Hal.dll. Reserved The PRCB release levels are mismatched. (Something is out of date.)
0x2 The build type of Ntoskrnl.exe. The build type of Hal.dll. Reserved The build types are mismatched.
0x3 The size of the loader parameter extension. The major version of the loader parameter extension. The minor version of the loader parameter extension. The loader (ntldr) and HAL versions are mismatched.

When Parameter 1 equals 0x2, the following build type codes are used:

Cause

The MISMATCHED_HAL bug check often occurs when a user manually updates Ntoskrnl.exe or Hal.dll.

The error can also indicate that one of those two files is out of date. For example, the HAL might be designed for Microsoft Windows 2000 and the kernel is designed for Windows XP. Or the computer might erroneously have a multiprocessor HAL and a single-processor kernel installed, or vice versa.

The Ntoskrnl.exe kernel file is for single-processor systems and Ntkrnlmp.exe is for multiprocessor systems. However, these file names correspond to the files on the installation media.After you have installed the Windows operating system, the file is renamed to Ntoskrnl.exe, regardless of the source file that is used. The HAL file also uses the name Hal.dll after installation, but there are several possible HAL files on the installation media. For more information, see "Installing the Checked Build" in the Windows Driver Kit (WDK).

Resolving the Problem

Restart the computer by using the product CD or the Windows Setup disks. At the Welcome screen, press F10 to start the Recovery Console. Use the Copy command to copy the correct HAL or kernel file from the original CD into the appropriate folder on the hard disk. The Copy command detects whether the file that you are copying is in the Microsoft compressed file format. If so, it automatically expands the file that is copied on the target drive.

    WinDbg Output Example:
MISMATCHED_HAL (79)
The HAL revision level and HAL configuration type does not match that
of the kernel or the machine type.  This would probably happen if the
user has manually updated either ntoskrnl.exe or hal.dll and managed to
get a conflict.
You have an MP (multi-processor) Hal and a UP (uni-processor) Kernel,
or the reverse.
Arguments:
Arg1: 0000000000000000, type of mismatch
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000007A: KERNEL_DATA_INPAGE_ERROR    (go to top of page)

Usual causes:  Memory, Paging file corruption, File system, Hard drive, Cabling, Virus infection, Improperly seated cards, BIOS, Bad motherboard, Missing Service Pack

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819320.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559211(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x7a
    OSROnline Listing:  http://www.osronline.com/article.cfm?article=336

    Knowledge Base Articles:
KB 250975    STOP Errors When Running MITAC 6133 Laptop on Battery Power (2000)
KB 275149    Error Message "Stop 0x0000007A" Occurs During Setup on an ATA66-based Computer (2000)
KB 293857    "Stop 0x0000007" Error Message Because of a Memory Leak in the Daprotim.sys File (2000)
KB 327020    Error Message Occurs When You Start Disk Management After Extending a Hardware Array (2000)
KB 330100    Connecting a hard disk drive in slave only mode leads to system halt during resume from standby (XP, Server 2003)
KB 913379    BIOS manufacturers should not clear the IDE Decode Enable bit in the _STM ACPI method (2000, XP, Server 2003, Vista)
KB 954429    You experience problems on a multiprocessor computer that is running Windows Server 2003, Windows Vista, or Windows Server 2008 when you resume the computer from hibernation
KB 956871    The system may crash when you put a Windows Vista-based computer or a Windows Server 2008-based computer into hibernation
KB 967352    Stop error message when you put a computer that is running Windows Vista or Windows Server 2008 into hibernation: "STOP 0x000000A0," "STOP 0x0000007a," or "STOP 0x00000077"
KB 977178    You receive various Stop error messages in Windows 7 or in Windows Server 2008 R2 when you resume a computer that has a large SATA hard disk
KB 2494016   Stop error 0x0000007a occurs on a virtual machine that is running on a Windows Server 2008 R2-based failover cluster with a cluster shared volume, and the state of the CSV is switched to redirected access
KB 2498326    Stop Error on Windows Server 2008 R2 During Upgrade of FCoE Adapter Driver
KB 2848061    0x0000007a Stop error when you resume a Windows 8-based computer from Hibernate mode

    WinDbg Help File Entry:

The KERNEL_DATA_INPAGE_ERROR bug check has a value of 0x0000007A. This bug check indicates that the requested page of kernel data from the paging file could not be read into memory.

Parameters

The four parameters that are listed in the message can have three possible meanings. If the first parameter is 1 or 2, or 3 and the third parameter is 0, the parameters have the following definitions.

Parameter Description
1 The lock type that was held (1, 2, or 3)
2 The error status (usually an I/O status code)
3 If Lock Type is 1: the current process

If Lock Type is 2 or 3: 0

4 The virtual address that could not be paged into memory

If the first parameter is 3 (and the third parameter is nonzero) or 4, the parameters have the following definitions.

Parameter Description
1 The lock type that was held (3 or 4)
2 The error status (typically an I/O status code)
3 The address of the InPageSupport structure
4 The faulting address

Otherwise, the parameters have the following definitions.

Parameter Description
1 The address of the page table entry (PTE)
2 The error status (usually an I/O status code)
3 The PTE contents
4 The faulting address

Cause

Frequently, you can determine the cause of the KERNEL_DATA_INPAGE_ERROR bug check from the error status (Parameter 2). Some common status codes include the following:

These status codes are the most common ones that have specific causes. For more information about other possible status codes that can be returned, see the Ntstatus.h file in the Microsoft Windows Driver Kit (WDK).

Another common cause of this error message is defective hardware or failing RAM.

A virus infection can also cause this bug check.

Resolving the Problem

Resolving a bad block problem: An I/O status code of 0xC000009C or 0xC000016A typically indicates that the data could not be read from the disk because of a bad block (sector). If you can restart the computer after the error, Autochk runs automatically and attempts to map the bad sector to prevent it from being used anymore.

If Autochk does not scan the hard disk for errors, you can manually start the disk scanner. Run Chkdsk /f /r on the system partition. You must restart the computer before the disk scan begins. If you cannot start the computer because of the error, use the Recovery Console and run Chkdsk /r.

Warning  If your system partition is formatted with the FAT file system, the long file names that the Windows operating system uses might be damaged if you use Scandisk or another MS-DOS-based hard disk tool to verify the integrity of your hard disk from MS-DOS. Always use the version of Chkdsk that matches your version of Windows.

Resolving a defective hardware problem: If the I/O status is C0000185 and the paging file is on an SCSI disk, check the disk cabling and SCSI termination for problems.

Resolving a failing RAM problem: Run the hardware diagnostics that the system manufacturer supplies, especially the memory scanner. For more information about these procedures, see the owner's manual for your computer.

Check that all the adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure adapter card contacts are clean.

Check the System Log in Event Viewer for additional error messages that might help identify the device that is causing the error. You can also disable memory caching of the BIOS to try to resolve this error.

Make sure that the latest Windows Service Pack is installed.

If the preceding steps do not resolve the error, take the system motherboard to a repair facility for diagnostic testing. A crack, a scratched trace, or a defective component on the motherboard can cause this error.

Resolving a virus infection: Check your computer for viruses by using any up-to-date, commercial virus scanning software that examines the Master Boot Record of the hard disk. All Windows file systems can be infected by viruses.

See Also

Bug Check 0x77 (KERNEL_STACK_INPAGE_ERROR)

    WinDbg Output Example:
KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: 8dd047f8, lock type that was held (value 1,2,3, or PTE address)
Arg2: c0000056, error status (normally i/o status code)
Arg3: 2d113864, current process (virtual address for lock type 3, or PTE)
Arg4: 902f90ba, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)


STOP 0x0000007B: INACCESSIBLE_BOOT_DEVICE    (go to top of page)

Usual causes:  Hard drive, File system, Boot sequence errors, Device driver, Virus infection (in particular check the MBR)

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819323.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559218(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x7b

    Knowledge Base Articles:
KB 303786    Missing [SysprepMassStorage] section causes a "Stop error code 0x0000007B (INACCESSABLE_BOOT_DEVICE)" error message on Windows XP Sysprep images
KB 311724    Error messages when you try to gain access to an NTFS volume (2000 Server)
KB 314082    You receive a Stop 0x0000007B error after you move the Windows XP system disk to another computer
KB 316401    "STOP 0x0000007B" error message when you restart your Windows XP-based computer
KB 324103    Advanced troubleshooting for "Stop 0x0000007B" errors in Windows XP
KB 822051    How to troubleshoot "Stop 0x0000007B" error messages that occur when you run Windows 2000 Setup
KB 822052    How to troubleshoot "Stop 0x0000007B" error messages in Windows 2000
KB 826901    "Stop 0x0000007B" error message after you remove Dell OpenManage software in Windows 2000 Server
KB 839210    "STOP 0x0000007B: INACCESSIBLE_BOOT_DEVICE" error message when you start your computer from a WinPE CD-ROM or from a Windows Server 2003 CD-ROM by using a USB CD-ROM device
KB 883114    "STOP 0x0000007B: INACCESSIBLE_BOOT_DEVICE" error message when you use a USB CD-ROM device to install Windows Server 2003 or Windows 2000
KB 922976    Error message when you start a Windows 7 or Windows Vista-based computer after you change the SATA mode of the boot drive: "STOP 0x0000007B INACCESSABLE_BOOT_DEVICE"
KB 935806    Troubleshooting Stop error messages that may occur when you try to install Windows Vista
KB 942813    Stop error when you try to restart a Windows PE 2.0 system that uses AMD Barcelona processor and that has the Operating System Capabilities (OSC) method enabled in the BIOS: "STOP: 0x0000007B (INACCESSIBLE_BOOT_DEVICE)" (Vista)
KB 957018    Stop error on a computer that is running an Itanium-based version of Windows Server 2008 and that has Qlogic 8-gigabyte Fibre Channel cards installed: "STOP 0x0000007B"
KB 975453    Error message when you start a Windows 7-based computer after you attach a RAID disk: "STOP 0x0000007B INACCESSABLE_BOOT_DEVICE"
KB 976042    Windows may fail to boot from an iSCSI drive if networking hardware is changed (Server 2008 R2)
KB 2134360    Stop error 0x7B and installation may fail when you try to upgrade to a Windows Server 2008-based or a Windows Server 2008 R2-based computer that has SAN drives that are managed by EMC's PowerPath Device Specific Module (DSM)
KB 2344941    "0x0000007B" Stop error when you replace an iSCSI or PCI Express network adapter or a motherboard with an identical device on a Windows Server 2008 R2-based or Windows 7-based computer
KB 2487376    FIX: Stop error when you replace an iSCSI network adapter or a motherboard by using an identical device on a Windows Server 2008-based or Windows Vista-based computer: "0x0000007B"
KB 2507616    "0x0000007B" Stop error after replacing or switching to an alternate iSCSI boot adapter on a Windows Server 2008 R2-based or Windows 7-based computer
KB 2550978    "0x0000007B" Stop error after you replace an identical iSCSI network adapter in Windows Server 2008 R2 SP1 or in Windows 7 SP1
KB 2673509    You receive error: Stop error code 0x0000007B (INACCESSIBLE_BOOT_DEVICE) after you install Windows Updates (Vista/Win7)
KB 2743013    STOP 0x0000007B error on reboot after Bitlocker drive encryption (Win7)
KB 2773300    "Stop 0x0000007B" error after you use a Group Policy setting to prevent the installation of devices in Windows 7 and Windows Server 2008 R2

    WinDbg Help File Entry:

The INACCESSIBLE_BOOT_DEVICE bug check has a value of 0x0000007B. This bug check indicates that the Microsoft Windows operating system has lost access to the system partition during startup.

Parameters

The following parameters appear in the message.

Parameter Description
1 The address of a UNICODE_STRING structure, or the address of the device object that could not be mounted
2 0
3 0
4 0

To determine the meaning of Parameter 1, look at the data that it points to. If the first word (USHORT) at this address is even, Parameter 1 is the beginning of a Unicode string. If the first word (USHORT) at this address is 0x3, Parameter 1 is the first field (Type) of a device object.

Cause

The INACCESSIBLE_BOOT_DEVICE bug check frequently occurs because of a boot device failure. During I/O system initialization, the boot device driver might have failed to initialize the boot device (typically a hard disk). File system initialization might have failed because it did not recognize the data on the boot device. Also, repartitioning the system partition or installing a new SCSI adapter or disk controller might induce this error.

This error can also occur because of incompatible disk hardware. If the error occurred at the initial setup of the system, the system might have been installed on an unsupported disk or SCSI controller. Some controllers are supported only by drivers that are in the Windows Driver Library (WDL). (These drivers require the user to do a custom installation.)

Resolving the Problem

This error always occurs while the system is starting. This error frequently occurs before the debugger connection is established, so debugging can be difficult or impossible.

Resolving a failed boot device problem: If a boot device is at fault, you must edit the boot options.For more information about changing these options, see Configuring Software on the Target Computer .

Resolving an incompatible disk hardware problem: If Setup autodetects the controller, you might have to skip detection and use a specific manufacturer's disk to load the driver. Also, check the availability of updates for the system BIOS and SCSI controller firmware. Updates of this kind are typically available on the Web site or BBS of the hardware manufacturer.

Remove any recently added hardware, especially hard disk drives or controllers, to see if the error is resolved. If the problematic hardware is a hard disk drive, the disk firmware version might be incompatible with your version of the Windows operating system. Contact the manufacturer for updates. If you removed another piece of hardware and the error is resolved, IRQ or I/O port conflicts likely exist. Reconfigure the new device according to the manufacturer's instructions.

Confirm that all hard disk drivers, hard disk controllers, and SCSI adapters are listed in the Microsoft Windows Marketplace Tested Products List.

If you recently added a driver, restart your computer, and press F8 at the character-based menu that displays the operating system choices. In the Advanced Options menu, select the Last Known Good Configuration option. This option is most effective when you add only one driver or service at a time.

In addition, check your computer for viruses by using any up-to-date, commercial virus scanning software that examines the Master Boot Record of the hard disk. All Windows file systems can be infected by viruses.

This error can also occur because of hard disk corruption. Run Chkdsk /f /r on the system partition. You must restart the computer before the disk scan begins. If you cannot start the computer because of the error, use the Recovery Console and run Chkdsk /r.

If you cannot start the system in the last known good configuration, you should try to start off the Windows CD. Then, you can run Chkdsk from the Repair Console.

Warning  If your system partition is formatted with the FAT file system, the long file names that the Windows operating system uses might be damaged if you use Scandisk or another MS-DOS-based hard disk tool to verify the integrity of your hard disk drive from MS-DOS. Always use the version of Chkdsk that matches your version of Windows.

If your system has SCSI adapters, contact the adapter manufacturer to obtain updated Windows drivers. Try disabling sync negotiation in the SCSI BIOS, checking the cabling and the SCSI IDs of each device, and confirming proper termination. For IDE devices, define the onboard IDE port as Primary only. Also check each IDE device for the proper master/subordinate/stand alone setting. Try removing all IDE devices except for hard disks. Finally, check the System Log in Event Viewer for additional error messages that might help identify the device or driver that is causing the error.

To analyze this error: Run an lm (List Loaded Modules) command in the debugger. Verify that the following drivers were loaded: disk, classpnp, ftdisk, partmgr, and FAT or NTFS.

kd> lm 

start    end        module name
80001000 80016000   hal          (deferred)
80016000 80018c40   bootvid      (deferred)
80019000 8001dfc0   pciidex      (deferred)
8001e000 8001ff60   dmload       (deferred)
80086000 80086980   pciide       (deferred)
802c1000 802cc000   pci          (deferred)
802cc000 802d39a0   isapnp       (deferred)
802d4000 802ed000   ftdisk       (deferred)
802ed000 802f3820   mountmgr     (deferred)
802f4000 802fad40   fdc          (deferred)
802fb000 802fdc20   partmgr      (deferred)
802fe000 802fef00   wmilib       (deferred)
8039b000 803b8000   dmio         (deferred)
803b8000 803cb000   atapi        (deferred)
803cb000 803d1560   disk         (deferred)
803d2000 803d8e80   classpnp     (deferred)
803d9000 803fa000   fastfat      (deferred)
80400000 80540000   nt           (pdb symbols)   \\localsymbols\symbols\exe\ntoskrnl.dbg
80540000 80546f20   ksecdd       (deferred)
80547000 80554620   cnss         (deferred)
80555000 80579000   ndis         (deferred)

You probably have pci or isapnp loaded. Also make sure your controller drivers are loaded. That is, make sure Atapi.sys is loaded with the channel drivers (pciide and pciidex or intelid) or scsiport.sys is loaded with the appropriate miniport driver.

It is helpful to know as much as possible about the boot device that Windows is installed on. For example, you can investigate the following items:

The !devnode extension gives you more information, if you know what your boot devices are.

Typically Plug and Play cannot assign resources to the boot device. You can verify this restriction by finding an entry for the service. If the status flags include DNF_INSUFFICIENT_RESOURCES or do not include DNF_STARTED or DNF_ENUMERATED, you have found the problem. Try !devnode 0 1 scsi or !devnode 0 1 atapi to save some time instead of dumping the whole device tree.

    WinDbg Output Example:
INACCESSIBLE_BOOT_DEVICE (7b)
During the initialization of the I/O system, it is possible that the driver
for the boot device failed to initialize the device that the system is
attempting to boot from, or it is possible for the file system that is
supposed to read that device to either fail its initialization or to simply
not recognize the data on the boot device as a file system structure that
it recognizes.  In the former case, the argument (#1) is the address of a
Unicode string data structure that is the ARC name of the device from which
the boot was being attempted.  In the latter case, the argument (#1) is the
address of the device object that could not be mounted.
If this is the initial setup of the system, then this error can occur if
the system was installed on an unsupported disk or SCSI controller.  Note
that some controllers are supported only by drivers which are in the Windows
Driver Library (WDL) which requires the user to do a custom install.  See
the Windows Driver Library for more information.
This error can also be caused by the installation of a new SCSI adapter or
disk controller or repartitioning the disk with the system partition.  If
this is the case, on x86 systems the boot.ini file must be edited or on ARC
systems setup must be run.  See the "Advanced Server System Administrator's
User Guide" for information on changing boot.ini.
If the argument is a pointer to an ARC name string, then the format of the
first two (and in this case only) longwords will be:
    USHORT Length;
    USHORT MaximumLength;
    PWSTR Buffer;
That is, the first longword will contain something like 00800020 where 20
is the actual length of the Unicode string, and the next longword will
contain the address of buffer.  This address will be in system space, so
the high order bit will be set.
If the argument is a pointer to a device object, then the format of the first
word will be:
    USHORT Type;
That is, the first word will contain a 0003, where the Type code will ALWAYS
be 0003.
Note that this makes it immediately obvious whether the argument is a pointer
to an ARC name string or a device object, since a Unicode string can never
have an odd number of bytes, and a device object will always have a Type
code of 3.
Arguments:
Arg1: 0000000000000000, Pointer to the device object or Unicode string of ARC name
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000007C: BUGCODE_NDIS_DRIVER    (go to top of page)

Usual causes:  Device driver, ?Network hardware

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559221(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The BUGCODE_NDIS_DRIVER bug check has a value of 0x0000007C. This bug check indicates that a problem occurred with an NDIS driver.

Parameters

The following parameters appear on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x01 The address of the miniport block The number of bytes that are requested The current IRQL A driver called NdisMAllocateSharedMemory at a raised IRQL.
0x02 The address of the miniport block The shared memory page that was corrupted The address of NDIS_WRAPPER_CONTEXT that keeps track of the driver's shared memory allocations During a call to NdisMAllocateSharedMemory, NDIS detected that a previously-allocated shared memory page had been corrupted.
0x03 The address of the miniport block The page that contains the shared memory The virtual address of the shared memory A driver called NdisMFreeSharedMemory[Async] with a shared memory pointer that had already been freed.
0x04 The address of NDIS_M_DRIVER_BLOCK The address of DRIVER_OBJECT 0 AddDevice was called with a driver that is not on the list of drivers that are registered with NDIS.

(Enabled only on special instrumented NDIS.)

0x05
0x06
The address of the miniport block The address of the packet descriptor that the driver uses The address of the packet array that contained this packet descriptor An Ethernet driver indicated that it received a packet by using a packet descriptor that the protocol stack is currently using.
0x07 The address of the miniport block The address of the packet descriptor that the driver uses The address of the packet array that contained this packet descriptor An FDDI driver indicated that it received a packet by using a packet descriptor that the protocol stack is currently using.
0x08 The address of the miniport block The address of NDIS_MINIPORT_INTERRUPT 0 A miniport driver did not deregister its interrupt during the halt process.
0x09 The address of the miniport block The address of the miniport driver's timer queue (NDIS_MINIPORT_TIMER) 0 A miniport driver stopped without successfully canceling all its timers.
0x0A The address of NDIS_M_DRIVER_BLOCK The address of DRIVER_OBJECT The reference count for the miniport driver A miniport driver is getting unloaded prematurely.
0x0B The address of the miniport block The address of NDIS_MINIPORT_INTERRUPT 0 A miniport driver failed its initialization without deregistering its interrupt.
0x0C The address of the miniport block The address of the miniport driver's timer queue (NDIS_MINIPORT_TIMER) 0 A miniport driver failed its initialization without successfully canceling all its timers.
0x0D The address of the miniport block The address of NDIS_MINIPORT_INTERRUPT 0 A miniport driver did not deregister its interrupt during the halt process. (The halt was called from the initialize routine after the miniport driver returned success from its initialize handler.)
0x0E The address of the miniport block The address of the miniport driver's timer queue (NDIS_MINIPORT_TIMER) 0 A miniport driver stopped without successfully canceling all its timers. (The halt was called from the initialize routine after the miniport driver returned success from its initialize handler.)
0x0F The address of the miniport block The reset status AddressingReset (BOOLEAN) A miniport driver called NdisMResetComplete without any pending reset request.
0x10 The address of the miniport block The address of NDIS_MINIPORT_INTERRUPT 0 After resuming from a low-power state, a miniport driver failed its initialization without deregistering its interrupt.
0x11 The address of the miniport block The address of the miniport driver's timer queue (NDIS_MINIPORT_TIMER) 0 After resuming from a low-power state, a miniport driver failed its initialization without successfully canceling all its timers.
0x12 The address of the miniport block The address of the packet descriptor that the driver uses The address of the packet array that contained this packet descriptor A miniport driver indicated that it received a packet by using a packet descriptor that the protocol stack is currently using.
0x13 The address of the miniport block The address of the packet descriptor that the driver uses The address of the packet array that contained this packet descriptor A Token-Ring miniport driver indicated that it received a packet by using a packet descriptor that the protocol stack currently uses.

Cause

Parameter 1 indicates the specific cause of the BUGCODE_NDIS_DRIVER bug check.

If one of the bug check parameters specifies the address of the miniport block, you can obtain more information by using !ndiskd.miniport together with this address.

If one of the bug check parameters specifies the address of the packet descriptor that the driver uses, you can obtain more information by using !ndiskd.pkt together with this address.

Comments

This bug check code occurs only on Microsoft Windows Server 2003 and later versions of Windows. In Windows 2000 and Windows XP, the corresponding code is bug check 0xD2 (BUGCODE_ID_DRIVER).

    WinDbg Output Example:
BUGCODE_NDIS_DRIVER (7c)
This is the NDIS Driver Bugcheck for Windows Server 2003 and later.
For Windows 2000 and Windows XP, see 0xD2, BUGCODE_ID_DRIVER.
Arguments:
Arg1: 0000000000000000, NDIS BugCheck Code
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000007D: INSTALL_MORE_MEMORY    (go to top of page)

Usual causes:  Self explanatory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819332.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559232(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INSTALL_MORE_MEMORY bug check has a value of 0x0000007D. This bug check indicates that there is not enough memory to start up the Microsoft Windows operating system.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The number of physical pages that are found
2 The lowest physical page
3 The highest physical page
4 0

Cause

The Windows operating system does not have sufficient memory to complete the startup process.

Resolving the Problem

Install more memory.

    WinDbg Output Example:
INSTALL_MORE_MEMORY (7d)
Not enough memory to boot Windows.
Arguments:
Arg1: 0000000000000000, Number of physical pages found
Arg2: 0000000000000000, Lowest physical page
Arg3: 0000000000000000, Highest physical page
Arg4: 0000000000000000, 0


STOP 0x0000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED    (go to top of page)

Usual causes:  Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control,

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559239(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x7e

    Knowledge Base Articles:
KB 310628    Easy CD Creator 5.0 does not function in Windows XP
KB 321637    When you use a Creative Labs SoundBlaster 16 Joystick with a game port in Windows XP, you receive a "serious error" or a "STOP: 0x0000007E" error message
KB 330182    How to troubleshoot a Stop 0x0000007E error in Windows XP
KB 818966    "STOP: 0x0000007E" Error Message When You Install Windows XP Disk Image from a Remote Installation Services Server
KB 820362    Error Message: STOP 0x0000007e (0xc0000005, 0xf72ddc76, 0xf791e920, 0xf791e570) (Server 2003)
KB 839641    You receive a stop error 0x7E in Pci.sys (2000, XP, Server 2003)
KB 884868    Stop error code 0x0000007E occurs after you disconnect your USB 2.0 flash storage device (XP)
KB 900485    Error message in Windows XP Service Pack 2: "Stop 0x7E"
KB 906099    Error message on a Windows Server 2003-based computer: "STOP 0x0000007E"
KB 924083    FIX: You receive stop error 0x7E on a Windows Server 2003 computer that is running the Server for NFS service and that has McAfee VirusScan Enterprise 8.0i installed
KB 929734    You have problems after you resume a Windows Vista-based computer from sleep or from hibernation
KB 930311    Occasional error message on a portable Windows Vista-based computer that wakes from sleep to perform network-related tasks: "STOP 0x0000007E"
KB 930979    You may receive a "Stop 0x0000007E" error message after you enable the BitLocker Drive Encryption feature in Windows Vista
KB 932755    An updated Storport storage driver is available for Windows Server 2003
KB 935806    Troubleshooting Stop error messages that may occur when you try to install Windows Vista
KB 939180    Stop error message when an application that uses Winsock is running on a Windows Server 2003-based computer: "Stop 0x0000007E"
KB 940322    Error message after you enable the ETW trace log on a computer that is running Windows XP: "0x0000007E (0xC0000005, parameter2, parameter3, parameter4 ) SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 941021    Error message when you repeatedly restart a Windows Vista-based computer: "Stop 0x0000007E"
KB 942237    Error message after you wake a Windows XP-based computer from standby or from hibernation: "Stop 0x0000007E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 950570    Error message when you start a multiprocessor computer that runs Windows Vista: "STOP: 0x0000007E"
KB 953356    Error message after you upgrade a computer that uses a processor other than an Intel processor to Windows XP Service Pack 2 or to Windows XP Service Pack 3: "STOP: 0x0000007E"
KB 953403    Stop error when you attach a Niveus Ice Vault Disc Changer to a Windows Vista SP1-based computer or to a Windows Server 2008-based computer: "STOP: 0x0000007E"
KB 953531    A "0x0000007E" Stop error occurs in Windows Server 2008 after you unmount and delete a persistent VSS snapshot
KB 953794    The error "Stop 0x0000007E" occurs when you try to shut down a Windows Server 2003 based computer with a Broadcom NIC installed but disabled
KB 954589    Stop error message when you plug a USB storage device into the USB port of a Windows Vista SP1-based or Windows Server 2008-based computer: "Stop 0x0000007E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 958092    After the Terminal Services mirror driver is disconnected from a Windows Server 2008-based or Windows Vista-based remote computer, you receive a Stop error on the remote computer: "Stop 0x0000007E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 960038    You receive a "0x0000007E" Stop error on Windows Server 2008-based computers that host Hyper-V virtual machines when you use the Hyper-V writer to back up virtual machines
KB 960652    Stop error when you copy a file from a redirected disk to a Windows Server 2003-based terminal server in a terminal server session: "0x0000007E"
KB 961799    A Stop error occurs on a Windows Server 2003-based server when a user accesses shared files on the server by using an SMB connection
KB 962943    FIX: You receive a Stop 0x0000007e error message on a blue screen when the AppPoolCredentials attribute is set to true and you use a domain account as the application pool identity in IIS 7.0 (Vista, Server 2008)
KB 965494    Stop error when a registry management problem occurs on a Windows Server 2008 or Windows Vista SP1-based computer: "0x0000007E"
KB 967544    Stop error message after you add a new device that supports MSI-X interrupts on a computer that is running Windows Vista or Windows Server 2008: "0x0000007E"
KB 967999    Stop error message when you start a Windows Server 2008-based computer from an iSCSI boot device that is connected over MPIO paths:"Stop 0x0000007E"

KB 968451    Stop error message when you enable File Server Resource Manager quota management on an NTFS volume on a Windows Server 2003 R2-based computer: "Stop 0x0000007E"
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)
KB 971280    Random Stop errors on a Windows Server 2003-based computer that performs input/output to file shares hosted on another computer or to a network-attached storage device
KB 973482    Stop error 0x0A, or Stop error 0x7E may occur on a computer that is running Windows Vista or Windows Server 2008
KB 974598    You receive a "Stop 0x0000007E" error on the first restart after you enable Hyper-V on a Windows Server 2008 R2-based computer
KB 975070    Error message after you apply update 973879: "Stop 0x0000007e" or "Stop 0x00000050" (Vista, Server 2008)
KB 977001    Stop error code when you enable shadow copies on a volume that is larger than 64 terabytes on a computer that is running Windows Server 2008 or Windows Vista: "0x0000007E"
KB 979538    "Stop 0x0000007E" or "Stop 0x00000050" Stop error message in Windows 7 or Windows Server 2008 R2
KB 979557    Stop error message on a terminal server that is running a 64-bit version of Windows Server 2008 when a user remotely controls another terminal server session: "Stop error code 0x0000007E (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED)"
KB 980082    Stop error in Win7 and in Win2008 R2 when you run a backup application: "0x0000007E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED"
KB 981122    Stop error in Windows Server 2003 SP2: "0x0000007E"
KB 981751    "0x0000007E" Stop error in Windows Server 2008 or in Windows Vista
KB 983615    "Stop 0x0000007E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED" error when the GPU is under heavy load conditions in Windows 7 or Windows Server 2008 R2
KB 2299380    "0x0000007E" Stop error when you back up a Windows Server 2008 R2-based or Windows 7-based computer that is running virtual machines
KB 2394911    Stop error "0x000000D1" or "0x0000007E" in an SMB2 environment in Windows 7 or in Windows Server 2008 R2
KB 2431799    Stop error 0x0000007E occurs when multiple users establish Remote Desktop Services sessions to a Windows Server 2008 R2-based computer
KB 2460907   "0x0000007E" Stop error when you create snapshots in Windows Server 2008 or in Windows Vista
KB 2460912    "0x0000007E" or "0x00000050" Stop error when you create snapshots of a volume in Windows Server 2008 R2 or in Windows 7
KB 2479442    Stop error during startup in Windows Server 2008 or in Windows Vista
KB 2511500    "0x0000007E" Stop error after you perform a hot removal of a PCI device in Windows 7 or in Windows Server 2008 R2
KB 2528614   Operating system intermittently crashes with a "0x0000007E" Stop error message on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2547257    "0x0000007E" or "0x0000000A" Stop error occurs when you play and at the same time record TV content on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2548124    "0x0000007E" Stop error when you run a VSS-based backup application in Windows 7 or in Windows Server 2008 R2
KB 2579274    "0x0000007E" Stop error message when a connection is reset on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2591271    "0x0000007E" Stop error when you restart a computer that is running Windows Server 2008 R2 or Windows 7
KB 2614451    "STOP: 0x0000007E" error occurs when you write some data onto a CD or DVD in Windows Server 2008 R2 or in Windows 7
KB 2639032    "0x0000003B," "0x00000027," and "0x0000007e" Stop errors when a connection to a CSV is lost on a Windows Server 2008 R2-based failover cluster
KB 2695584    "0x0000007E" or "0X00000050" Stop error when you run the Common Scenario Stress with IO test in Windows 7 or in Windows Server 2008 R2
KB 2705368    "0x0000007E" Stop error when you use McAfee Device Control tool or a similar tool to restrict USB audio in Windows XP SP3
KB 2768523    "0x0000007E" Stop error after you configure a computer to host a web service in Windows Server 2008 R2
KB 2831184    "0x0000007E" Stop error when a file on a Windows 7 SP1-based or Windows Server 2008 R2 SP1-based computer is opened from multiple client computers
KB 2854942    "0x0000007E" Stop error when you remove a USB HID device from a Windows XP SP3-based computer
KB 2857407    "0x0000007E" Stop error when you try to shut down a Windows 8 or Windows Server 2012-based computer

    More STOP error messages at these search links:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x00000024&x=13&y=11&mkt=en-US&FORM=QBME1&l=1
 http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000007e&x=11&y=11&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The SYSTEM_THREAD_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000007E. This bug check indicates that a system thread generated an exception that the error handler did not catch.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The exception code that was not handled
2 The address where the exception occurred
3 The address of the exception record
4 The address of the context record

Cause

The SYSTEM_THREAD_EXCEPTION_NOT_HANDLED bug check is a very common bug check. To interpret it, you must identify which exception was generated.

Common exception codes include the follwoing:

For a complete list of exception codes, see the Ntstatus.h file that is located in the inc directory of the Microsoft Windows Driver Kit (WDK).

Resolving the Problem

If you are not equipped to debug this problem, you should use some basic troubleshooting techniques.

If you plan to debug this problem, you might find it difficult to obtain a stack trace. Parameter 2 (the exception address) should identify the driver or function that caused this problem.

If exception code 0x80000003 occurs, a hard-coded breakpoint or assertion was hit, but the system was started with the /NODEBUG switch. This problem should rarely occur. If it occurs repeatedly, make sure that a kernel debugger is connected and the system is started with the /DEBUG switch.

If exception code 0x80000002 occurs, the trap frame supplies additional information.

If you do not know the specific cause of the exception, consider the following issues:

If a driver is listed by name within the bug check message, disable or remove that driver. Disable or remove any drivers or services that were recently added. If the error occurs during the startup sequence and the system partition is formatted with NTFS file system, you might be able to use Safe Mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in Safe Mode, you must start the computer by using the Recovery Console to access the file.

If the problem is associated with Win32k.sys, the source of the error might be a third-party remote control program. If such software is installed, you can remove the service by starting the computer by using the Recovery Console and then deleting the offending system service file.

Check the System Log in Event Viewer for additional error messages that might help identify the device or driver that is causing bug check 0x7E.

You can also disable memory caching of the BIOS might to try to resolve the error. You should also run hardware diagnostics, especially the memory scanner, that the system manufacturer supplies. For more information about these procedures, see the owner's manual for your computer.

The error that generates this message can occur after the first restart during Windows Setup, or after Setup is finished. A possible cause of the error is lack of disk space for installation and system BIOS incompatibilities. For problems during Windows installation that are associated with lack of disk space, reduce the number of files on the target hard disk drive. Check for and delete any temporary files that you do not have to have, Internet cache files, application backup files, and .chk files that contain saved file fragments from disk scans. You can also use another hard disk drive with more free space for the installation. You can resolve BIOS problems by upgrading the system BIOS version.

    WinDbg Output Example:
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Exception Record Address
Arg4: 0000000000000000, Context Record Address


STOP 0x0000007F: UNEXPECTED_KERNEL_MODE_TRAP    (go to top of page)

Usual causes:  Memory corruption, Hardware (memory in particular), Overclocking failure, Installing a faulty or mismatched hardware (especially memory) or a failure after installing it, 3rd party firewall, Device drivers, SCSI/network/BIOS updates needed, Improperly seated cards, Incompatible storage devices, Overclocking, Virus scanner, Backup tool, Bad motherboard, Missing Service Pack

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819336.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559244(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x7f

    Knowledge Base Articles:
KB 137539    General causes of "STOP 0x0000007F" errors (NT, 2000, XP)
KB 316526    Error Message: "STOP 0x0000007F" During Setup on Hewlett Packard Pavilion 7840 (XP)
KB 317214    Terminal Server unexpectedly restarts, or you receive "Stop error code 0x0000007F" (2000)
KB 822789    You receive a "Stop 0x0000007F" error message or your computer unexpectedly restarts (NT, 2000, XP, Server 2003)
KB 827188    You receive a "Stop error code 0x0000007F" in Windows 2000
KB 835281    You receive a "Stop error code 0x0000007F" (UNEXPECTED_KERNEL_MODE_TRAP) error message and your Windows 2000-based computer restarts
KB 838804    You receive a "0x0000007F" stop error on a Windows 2000-based computer
KB 839540    Stop error code 0x0000007f EXCEPTION_DOUBLE_FAULT occurs in Windows 2000 Server
KB 842465    Stop 7F, 0x00000008 (double-fault) error occurs because of a single-bit error in the ESP register (2000, XP, Server 2003)
KB 870908    Command AntiVirus version 4.62.4 causes an error message on a blue screen in Windows XP Service Pack 2
KB 907353    You receive a Stop error message when you use a hardware device on a computer that is running Windows 2000
KB 928006    You receive a "STOP: 0x0000007f" error message or the computer automatically restarts in Windows Server 2003
KB 935843    Error message when you try to print after you install the GDI security update 925902: "Stop 0x0000007F" (2000, XP)
KB 941020    You receive occasional Stop errors after you install a driver that manages on-board flash memory on a Windows Vista-based computer
KB 944824    Stop error message on a computer that has ISA Server 2006 installed: "Stop error code 0x0000007f (UNEXPECTED_KERNEL_MODE_TRAP)"
KB 947471    Stop error message on a Windows Server 2003-based computer that has Symantec AntiVirus software installed: "Stop error code 0x0000007f (UNEXPECTED_KERNEL_MODE_TRAP)"
KB 959523    Stop error after you install KB951376, you use the Add Bluetooth Device Wizard, you find many Bluetooth devices, and then you try to put a Windows Vista-based or Windows Server 2008-based computer to sleep: "STOP 0x0000007F"
KB 971128    Stop error when multiple third-party network drivers are installed on a computer that is running Windows Server 2008 or Windows Vista: "0x0000007F" or "0x0000008E"
KB 972907    Stop error message on a computer that is running Windows Vista or Windows Server 2008: "STOP: 0x0000007F"
KB 979762    Stop error in Windows Vista and in Windows Server 2008 when you try to print a document: "0x0000003B" or "0x0000007f"
KB 981180    Stop error message when you run an application that transfers data by using the UDP protocol in Windows Server 2008 R2 or in Windows 7: "STOP 0x0000007F"
KB 2254637   "0x0000007F" Stop error occurs when the connection to some shared files is lost on a computer that is running Windows Vista, Windows Server 2008, Windows 7 or Windows Server 2008 R2
KB 2487324    "0x0000003B" or "0x0000007f" Stop errors may occur when you try to print a document in Windows Server 2008 R2
KB 2498368    Error: 0x7F, Stop: 0x0000007F or Windows Live Mail fails to launch after installing Windows update KB2454826 (Windows 7/Server 2008 R2)
KB 2502285    "0x0000007F" Stop error after you install Windows 7 Service Pack 1 in Windows 7 (Windows 7 SP1)
KB 2519736    Stop error message in Windows Server 2008 R2 SP1 or in Windows 7 SP1: "STOP: 0x0000007F"
KB 2531771   "0x0000007F" Stop error when you try to wake the computer from Sleep (S3) mode if you use offline files in Windows Vista or in Windows Server 2008
KB 2592339    "0x0000007f" Stop error or system stops responding on a computer that is running Windows Server 2008 R2 or Windows 7 when you connect to it by using the RDP protocol


    More error messages at this link:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x0000007f&x=9&y=10&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The UNEXPECTED_KERNEL_MODE_TRAP bug check has a value of 0x0000007F. This bug check indicates that the Intel CPU generated a trap and the kernel failed to catch this trap.

This trap could be a bound trap (a trap the kernel is not permitted to catch) or a double fault (a fault that occurred while processing an earlier fault, which always results in a system failure).

Parameters

The first parameter that appears on the blue screen specifies the trap number.

The most common trap codes include the following:

The less-common trap codes include the following:

For other trap numbers, see an Intel architecture manual.

Cause

Bug check 0x7F typically occurs after you install a faulty or mismatched hardware (especially memory) or if installed hardware fails.

A double fault can occur when the kernel stack overflows. This overflow occurs if multiple drivers are attached to the same stack. For example, if two file system filter drivers are attached to the same stack and then the file system recurses back in, the stack overflows.

Resolving the Problem

Debugging: Always begin with the !analyze extension.

If this extension is not sufficient, use the kv (Display Stack Backtrace) debugger command.

After using one of these commands, use kv again to display the new stack.

Troubleshooting: If you recently added hardware to the computer, remove it to see if the error recurs. If existing hardware has failed, remove or replace the faulty component. Run hardware diagnostics that the system manufacturer supplies to determine which hardware component failed.

The memory scanner is especially important. Faulty or mismatched memory can cause this bug check. For more informaiton about these procedures, see the owner's manual for your computer. Check that all adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure adapter card contacts are clean.

If the error appears on a newly installed system, check the availability of updates for the BIOS, the SCSI controller, or network cards. These kind of updates are typically available on the Web site or BBS of the hardware manufacturer.

Confirm that all hard disk drives, hard disk controllers, and SCSI adapters are listed in the Microsoft Windows Marketplace Tested Products List.

If the error occurred after the installation of a new or updated device driver, you should remove or replace the driver. If, under this circumstance, the error occurs during the startup sequence and the system partition is formatted with NTFS, you might be able to use Safe Mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in Safe Mode, you have to start the computer by using the Recovery Console in order to access the file.

Also restart your computer, and then press F8 at the character-based menu that displays the operating system choices. At the Advanced Options menu, select the Last Known Good Configuration option. This option is most effective when you add only one driver or service at a time.

Overclocking (setting the CPU to run at speeds above the rated specification) can cause this error. If you have overclocked the computer that is experiencing the error, return the CPU to the default clock speed setting.

Check the System Log in Event Viewer for additional error messages that might help identify the device or driver that is causing the error. You can also disable memory caching of the BIOS to try to resolve the problem.

If you encountered this error while upgrading to a new version of the Windows operating system, the error might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version. If possible, remove all third-party device drivers and system services and disable any virus scanners before you upgrade. Contact the software manufacturer to obtain updates of these tools. Also make sure that you have installed the latest Windows Service Pack.

Finally, if all the above steps do not resolve the error, take the system motherboard to a repair facility for diagnostic testing. A crack, a scratched trace, or a defective component on the motherboard can also cause this error.

    WinDbg Output Example:
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff80002af243d


STOP 0x00000080: NMI_HARDWARE_FAILURE    (go to top of page)

Usual causes:  Hardware malfuntion

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559250(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x80

    Knowledge Base Articles:
KB 822720    The computer stops responding (hangs) on boot in Windows 2000 Server, or you receive a "Stop 0x00000080" error message when you add or remove a hot swap drive
KB 982488    You receive an incorrect Stop error message when you send a WHEA handler NMI in Windows Vista and in Windows Server 2008

    WinDbg Help File Entry:

The NMI_HARDWARE_FAILURE bug check has a value of 0x00000080. This bug check indicates that a hardware malfunction has occurred.

Parameters

None

Cause

A variety of hardware malfunctions can cause the NMI_HARDWARE_FAILURE bug check. The exact cause is difficult to determine.

Resolving the Problem

Remove any hardware or drivers that have been recently installed. Make sure that all memory modules are of the same type.

    WinDbg Output Example:
NMI_HARDWARE_FAILURE (80)
This is typically due to a hardware malfunction.  The hardware supplier should
be called.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000081: SPIN_LOCK_INIT_FAILURE    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819338.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559255(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SPIN_LOCK_INIT_FAILURE bug check has a value of 0x00000081.

This bug check appears very infrequently.

    WinDbg Output Example:
SPIN_LOCK_INIT_FAILURE (81)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000082: DFS_FILE_SYSTEM    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819341.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559261(v=VS.85).aspx

    Knowledge Base Articles:
KB 811814    XADM: "Stop 0x00000082" Error Message When You Mount Exchange IFS as the DFS Root (2000 Server)
KB 885443    You receive a "Stop 0x00000082" error after you install Windows XP Service Pack 2 or after you install security update 890859 in Windows 2000
KB 930184    Error message when a volume is dismounted on a Windows Server 2003 SP1-based computer: "STOP 0x00000082"

    WinDbg Help File Entry:

The DFS_FILE_SYSTEM bug check has a value of 0x00000082.

This bug check appears very infrequently.

    WinDbg Output Example:
DFS_FILE_SYSTEM (82)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000083: OFS_FILE_SYSTEM    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819344.aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (83)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000084: RECOM_DRIVER    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819347.aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (84)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000085: SETUP_FAILURE    (go to top of page)

Usual causes:  Assorted setup failures - see parameters below

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819348.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559264(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The SETUP_FAILURE bug check has a value of 0x00000085. This bug check indicates that a fatal error occurred during setup.

Parameters

The following parameters appear on the blue screen. Parameter 1 indicates the type of violation. Parameter 4 is not used. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Cause
0x0 0 0 The OEM HAL font is not a valid .fon format file, so setup cannot display text.

This cause indicates that Vgaxxx.fon on the boot floppy or CD is damaged.

0x1 The precise video initialization failure:

0: NtCreateFile of \device\video0

1: IOCTL_VIDEO_QUERY_NUM_AVAIL_MODES

2: IOCTL_VIDEO_QUERY_AVAIL_MODES

3: The desired video mode is not supported. This value indicates an internal setup error.

4: IOCTL_VIDEO_SET_CURRENT_MODE (unable to set video mode)

5: IOCTL_VIDEO_MAP_VIDEO_MEMORY

6: IOCTL_VIDEO_LOAD_AND_SET_FONT

The status code from the NT API call, if appropriate Video initialization failed.

This failure might indicate that the disk that contains Vga.sys (or another video driver that is appropriate to the computer) is damaged or that the computer has video hardware that the Microsoft Windows operating system cannot communicate with.



0x2 0 0 Out of memory.



0x3 The precise keyboard initialization failure:

0: NtCreateFile of \device\KeyboardClass0 failed. (Setup did not find a keyboard connected to the computer.)

1: Unable to load keyboard layout DLL. (Setup could not load the keyboard layout file. This failure indicates that the CD or floppy disk is missing a file, such as Kbdus.dll for the U.S. release or another layout DLL for localized releases.)

0 Keyboard initialization failed.

This failure might indicate that the disk that contains the keyboard driver (I8042prt.sys or Kbdclass.sys) is damaged or that the computer has keyboard hardware that Windows cannot communicate with. This failure might also mean that the keyboard layout DLL could not be loaded.



0x4 0 0 Setup could not resolve the ARC device path name of the device that setup was started from.

This error is an internal setup error.

0x5 Reserved Reserved Partitioning sanity check failed.

This error indicates a bug in a disk driver.




    WinDbg Output Example:
SETUP_FAILURE (85)
(NOTE:  Textmode setup no longer uses bugchecks to bail out of serious
error conditions.  Therefore, you will never encounter a bugcheck 0x85.
All bugchecks have been replaced with friendlier and (where possible)
more descriptive error messages.  Some of the former bugchecks, however,
have simply been replaced by our own bugcheck screen, and the codes for
these error conditions are the same as before.  These are documented below.)
The first extended bugcheck field is a code indicating what the
problem is, and the other fields are used differently depending on
that value.
Arguments:
Arg1: 0000000000000000, The oem hal font is not a valid .fon format file, and so setup
    is unable to display text.
    This indicates that vgaxxx.fon on the boot floppy or CD-ROM
    is damaged.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000086: AUDIT_FAILURE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (86)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000087:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (87)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000088:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (88)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000089:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (89)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000008A:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (8a)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000008B: MBR_CHECKSUM_MISMATCH    (go to top of page)

Usual causes:  Virus infection, MBR corruption, File system issues, Hard drive issues

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559268(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The MBR_CHECKSUM_MISMATCH bug check has a value of 0x0000008B. This bug check indicates that a mismatch has occurred in the MBR checksum.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The disk signature from MBR
2 The MBR checksum that the OS Loader calculates
3 The MBR checksum that the system calculates
4 Reserved

Cause

The MBR_CHECKSUM_MISMATCH bug check occurs during the boot process when the MBR checksum that the Microsoft Windows operating system calculates does not match the checksum that the loader passes in.

This error typically indicates a virus.

Resolving the Problem

There are many forms of viruses and not all can be detected. Typically, the newer viruses usually can be detected only by a virus scanner that has recently been upgraded. You should boot with a write-protected disk that contains a virus scanner and try to clean out the infection.

    WinDbg Output Example:
MBR_CHECKSUM_MISMATCH (8b)
This message occurs during the boot process when the MBR checksum the system
calculates does not match the checksum passed in by the loader. This is usually
an indication of a virus. There are many forms of viruses and not all can be
detected. The newer ones usually can only be detected by a virus scanner that
has recently been upgraded. Boot a write-protected disk containing a virus
scanner and attempt to clean out the infection.
Arguments:
Arg1: 0000000000000000, Disk Signature from MBR.
Arg2: 0000000000000000, MBR checksum calculated by osloader.
Arg3: 0000000000000000, MBR checksum calculated by system.
Arg4: 0000000000000000


STOP 0x0000008C:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (8c)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000008D:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (8d)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED    (go to top of page)

Usual causes:  Insufficient disk space, Device driver, Video card, BIOS, Breakpoint in startup without having a debugger attached, Hardware incompatibility, Faulty system service, 3rd party remote control, Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559271(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x8e

    Knowledge Base Articles:
KB 315335    "STOP 0x0000008e" error message during Windows XP setup
KB 325154    A "STOP 0x0000008E" Error Message Occurs in Wdmaud.sys (XP)
KB 330187    A "STOP: 0x0000008E" error message occurs when you change the hardware acceleration setting (XP)
KB 813818    STOP 0x0000008E error message on a blue screen and your computer does not enter hibernation or standby after you remove an IEEE 1394 storage device (XP)
KB 817873    "Stop error code 0x0000008E" error message occurs when you upgrade to Windows Server 2003
KB 823303    “Failed To Install Product Catalog” Error Message When You Install Windows XP
KB 827663    You receive a random "0x0000008E" error message on a blue screen in Windows XP
KB 829422    A "Stop error code 0x0000008E (KERNEL_MODE_EXCEPTION_NOT_HANDLED)" error occurs when a Terminal Services client prints a document (Server 2003)
KB 834450    "Stop 0x0000008E" error message in Win32k.sys when you use the keyboard to access a program menu in Windows XP
KB 840216    Stop 0x0000008e error occurs on a server that is running Microsoft Windows Server 2003
KB 893239    You may receive a Stop error message on a blue screen when you start a Microsoft Windows Server 2003-based computer or a Microsoft Windows XP-based computer
KB 903251    You may receive an error message on a Windows-based computer: "STOP 0x00000050" or "STOP 0x0000008e" (2000, XP, Server 2003)
KB 905909    You occasionally receive a "Stop 0x0000008e" error message and the computer may occasionally stop responding in Windows Server 2003
KB 907966    A Windows Server 2003-based computer crashes and then generates the following error message: "STOP: 0x0000008E"

KB 918564    Error message after you install the Windows Server 2003 Scalable Networking Pack in Windows Server 2003: "STOP 0x0000008E" or "STOP: 0x0000003B"
KB 920192    Error message in the win32k!xxxMenuWindowProc+b4f process in Windows Server 2003 or Windows XP: "Stop 0x0000008e"
KB 929161    You receive a Stop error message on a Windows Server 2003 SP1 or Windows Server 2003 SP2-based computer when a device is suddenly disconnected from a host bus adapter

KB 930916    Error message when you try to open files on an NTFS file system volume on a Windows XP-based computer: "Stop 0x0000008E"
KB 932755    An updated Storport storage driver is available for Windows Server 2003
KB 934454    FIX: Error message on a Windows Server 2003 R2-based computer that has the Server for NFS component installed: "STOP 0x0000008E" or "STOP 0x00000024"
KB 935806    Troubleshooting Stop error messages that may occur when you try to install Windows Vista
KB 944056    Error message when you try to shut down or to restart a Windows Vista-based portable computer that has Bluetooth devices installed: “Stop: 0x0000008E”
KB 945658    General troubleshooting for an error message that you may receive randomly in Windows XP: "Stop 0x0000008E"
KB 947479    Error message on a Windows Server 2003-based computer: "Stop error code 0x0000008E"
KB 952679    Stop error message when an application calls the NtGdiBitBlt function on a Windows Server 2003 SP2-based computer: "0x0000008E"
KB 955044    Stop error when an application calls the NtGdiBitBlt function on a Windows Server 2008 or Windows Vista Service Pack 1-based computer: "0x0000008E"

KB 957319    You receive a "Stop 0x00000050" or "Stop 0x0000008E" error message when you restart a Windows XP-based computer
KB 957877    Stop error on a Windows Server 2003-based terminal server that has hotfix 951749 installed: "0x0000008E"
KB 959252    Error message when you switch the operating system from a dual monitor setting to a single monitor setting on a Windows XP-based computer or on a Windows Server 2003-based computer that has the security update 954211 installed: "Stop 0x0000008E"
KB 959828   Stop error on a Windows Server 2003 SP2-based terminal server or a Windows Server 2008 SP2-based terminal server when users print documents in terminal sessions: "0x0000008E" or "0x00000050"
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)
KB 971128    Stop error when multiple third-party network drivers are installed on a computer that is running Windows Server 2008 or Windows Vista: "0x0000007F" or "0x0000008E"
KB 977456   Stop error when you run an application that has a WS_CHILD styled message-only window in Windows Server 2003 SP2 or in Windows XP Professional x64 Edition SP2: "Stop 0x0000008E"
KB 2494629    A "0x0000008E" Stop error occurs when you set the message storage limit for a Message Queuing queue to be larger than 4 GB in a 32-bit version of Windows Server 2003
KB 2494666    Stop errors may occur after you use the Driver Verifier manager to apply standard settings to all drivers in Windows 7 or in Windows Server 2008 R2
KB 2581128    "0x0000008E" Stop error may occur when a user logs off a Windows Server 2003 Terminal Server session from a client computer
KB 2652034    "0x0000008E" Stop error when Windows 7 enters and then resumes from standby repeatedly if Windows XP Mode is running
KB 2724781    "0x0000008E" Stop error in Windows 7 or in Windows Server 2008 R2
KB 2791374    Stop error 0x8E occurs on Windows XP when you print with an XPS printer driver
KB 2801465    "0x0000008E" Stop error when you print a document that has a private character embedded in Windows Server 2008
KB 2805853    "0x0000008E" Stop error on a computer that is running Windows 7 or Windows Server 2008 R2
KB 2846226    Stop Error 0x0000008E on a computer that is running Windows 7 SP1 or Windows Server 2008 R2 SP1
KB 2871206    STOP 0x8e error when printing a document on a printer shared by a Windows Server 2003 print server
KB 2916627    Stop Error 0x0000008E (KERNEL_MODE_EXCEPTION_NOT_HANDLED) when you try to access DFS in Windows 7 or Windows Server 2008 R2

    More BSOD's at this link:  http://search.microsoft.com/results.aspx?mkt=en-US&q=stop%3A%200x0000008e&qsc0=0&l=1&first=1&FORM=PEME

    WinDbg Help File Entry:

The KERNEL_MODE_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000008E. This bug check indicates that a kernel-mode application generated an exception that the error handler did not catch.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The exception code that was not handled
2 The address where the exception occurred
3 The trap frame
4 Reserved

Cause

The KERNEL_MODE_EXCEPTION_NOT_HANDLED bug check is a very common bug check. To interpret it, you must identify which exception was generated.

Common exception codes include the following:

For a complete list of exception codes, see the Ntstatus.h file that is located in the inc directory of the Microsoft Windows Driver Kit (WDK).

Resolving the Problem

If you are not equipped to debug this problem, you should use some basic troubleshooting techniques:

If you plan to debug this problem, you might find it difficult to obtain a stack trace. Parameter 2 (the exception address) should identify the driver or function that caused this problem.

If exception code 0x80000003 occurs, a hard-coded breakpoint or assertion was hit, but the computer was started with the /NODEBUG switch. This problem should rarely occur. If it occurs repeatedly, make sure that a kernel debugger is connected and that the computer is started with the /DEBUG switch.

If exception code 0x80000002 occurs, the trap frame supplies additional information.

If you do not know the specific cause of the exception, consider the following items:

If the bug check message lists a driver by name , disable or remove that driver. Also, disable or remove any drivers or services that were recently added. If the error occurs during the startup sequence and the system partition is formatted with NTFS file system, you might be able to use Safe Mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in Safe Mode, you have to start the computer by using the Recovery Console to access the file.

If the problem is associated with Win32k.sys, the source of the error might be a third-party remote control program. If such software is installed, you can remove the service by starting the system by using the Recovery Console and then deleting the offending system service file.

Check the System Log in Event Viewer for additional error messages that might help identify the device or driver that is causing bug check 0x1E. You can disable memory caching of the BIOS to try to resolve the error. You should also run hardware diagnostics, especially the memory scanner, that the system manufacturer supplies. For more information about these procedures, see the owner's manual for your computer.

The error that generates this message can occur after the first restart during Windows Setup, or after Setup is finished. A possible cause of the error is lack of disk space for installation and system BIOS incompatibilities. For problems during Windows installation that are associated with lack of disk space, reduce the number of files on the target hard disk drive. Check for and delete any temporary files that you do not have to have, Internet cache files, application backup files, and .chk files that contain saved file fragments from disk scans. You can also use another hard disk drive with more free space for the installation.

You can resolve BIOS problems by upgrading the system BIOS version.

    WinDbg Output Example:
KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 0000db6e, The address that the exception occurred at
Arg3: 00000000, Trap Frame
Arg4: 00000000


STOP 0x0000008F: PP0_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819356.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559274(v=VS.85).aspx

    Knowledge Base Articles:

     WinDbg Help File Entry:

The PP0_INITIALIZATION_FAILED bug check has a value of 0x0000008F. This bug check indicates that the Plug and Play (PnP) manager could not be initialized.

Parameters

None

Cause

An error occurred during Phase 0 initialization of the kernel-mode PnP manager.

    WinDbg Output Example:
PP0_INITIALIZATION_FAILED (8f)
This message occurs if phase 0 initialization of the kernel-mode Plug and
Play Manager failed.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000090: PP1_INITIALIZATION_FAILED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819362.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559280(v=VS.85).aspx

    Knowledge Base Articles:

     WinDbg Help File Entry:

The PP1_INITIALIZATION_FAILED bug check has a value of 0x00000090. This bug check indicates that the Plug and Play (PnP) manager could not be initialized.

Parameters

None

Cause

An error occurred during Phase 1 initialization of the kernel-mode PnP manager.

Phase 1 is where most of the initialization is done, including setting up the registry files and other environment settings for drivers to call during the subsequent I/O initialization.

    WinDbg Output Example:
PP1_INITIALIZATION_FAILED (90)
This message occurs if phase 1 initialization of the kernel-mode Plug and
Play Manager failed.  This is where most of the initialization is done,
including setting up the environment (registry, etc.) for drivers to
subsequently call during I/O init.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000091: WIN32K_INIT_OR_RIT_FAILURE    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819363.aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (91)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000092: UP_DRIVER_ON_MP_SYSTEM    (go to top of page)

Usual causes:  Wrong device driver loaded

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819366.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559285(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The UP_DRIVER_ON_MP_SYSTEM bug check has a value of 0x00000092. This bug check indicates that a uniprocessor-only driver has been loaded on a multiprocessor system.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The base address of the driver
2 Reserved
3 Reserved
4 Reserved

Cause

A driver that is compiled to work only on uniprocessor machines has been loaded, but the Microsoft Windows operating system is running on a multiprocessor system with more than one active processor.

    WinDbg Output Example:
UP_DRIVER_ON_MP_SYSTEM (92)
This message occurs if a UNIPROCESSOR only driver is loaded on a MultiProcessor
system with more than one active processor.
Arguments:
Arg1: 0000000000000000, The Base address of the driver.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000093: INVALID_KERNEL_HANDLE    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819369.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559292(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x93

    Knowledge Base Articles:
KB 816600    "Fatal System Error: 0x00000093" Error Message When You Install Apache SNMP on IBM WebSphere Application Server (Server 2003)

    WinDbg Help File Entry:

The INVALID_KERNEL_HANDLE bug check has a value of 0x00000093. This bug check indicates that an invalid or protected handle was passed to NtClose.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The handle that is passed to NtClose
2 0: The caller tried to close a protected handle

1: The caller tried to close an invalid handle

3 Reserved
4 Reserved

Cause

The INVALID_KERNEL_HANDLE bug check indicates that some kernel code (for example, a server, redirector, or another driver) tried to close an invalid handle or a protected handle.

    WinDbg Output Example:
INVALID_KERNEL_HANDLE (93)
This message occurs if kernel code (server, redirector, other driver, etc.)
attempts to close a handle that is not a valid handle.
Arguments:
Arg1: 00016f40, The handle that NtClose was called with.
Arg2: 00000000, means a protected handle was closed.
Arg3: 00000000
Arg4: 00000000


STOP 0x00000094: KERNEL_STACK_LOCKED_AT_EXIT    (go to top of page)

Usual causes:  Memory, Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819372.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559296(v=VS.85).aspx

    Knowledge Base Articles:
KB 158517    Stop 0x000000094 Running Windows NT 4.0 and NFS Maestro

    WinDbg Help File Entry:

The KERNEL_STACK_LOCKED_AT_EXIT bug check has a value of 0x00000094. This bug check indicates that a thread exited while its kernel stack was marked as not swappable

Parameters

None

    WinDbg Output Example:
KERNEL_STACK_LOCKED_AT_EXIT (94)
This message occurs when a thread exits while its kernel stack is
marked as not swapable
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000095: PNP_INTERNAL_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819375.aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (95)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000096: INVALID_WORK_QUEUE_ITEM    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819378.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559300(v=VS.85).aspx

    Knowledge Base Articles:
KB 884587    You may receive Stop error code 0x00000096 in Windows 2000 Server

    WinDbg Help File Entry:

The INVALID_WORK_QUEUE_ITEM bug check has a value of 0x00000096. This bug check indicates that a queue entry was removed that contained a null pointer.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The address of the queue entry whose flink or blink field is NULL.
2 The address of the queue that is being referenced. Typically, this queue is an ExWorkerQueue.
3 The base address of the ExWorkerQueue array. (This address helps you determine if the queue in question is indeed an ExWorkerQueue. If the queue is an ExWorkerQueue, the offset from this parameter will isolate the queue.)
4 Assuming the queue is an ExWorkerQueue, this value is the address of the worker routine that would have been called if the work item had been valid. (You can use this address to isolate the driver that is misusing the work queue.)

Cause

The INVALID_WORK_QUEUE_ITEM bug check occurs when KeRemoveQueue removes a queue entry whose flink or blink field is NULL.

Any queue misuse can cause this error. But typically this error occurs because worker thread work items are misused.

An entry on a queue can be inserted on the list only one time. When an item is removed from a queue, its flink field is set to NULL. Then, when this item is removed the second time, this bug check occurs.

In most situations, the queue that is being referenced is an ExWorkerQueue (executive worker queue). To help identify the driver that caused the error, Parameter 4 displays the address of the worker routine that would have been called if this work item had been valid. However, if the queue that is being referenced is not an ExWorkerQueue, this parameter is not useful.

    WinDbg Output Example:
INVALID_WORK_QUEUE_ITEM (96)
This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null.  This is almost always called by code misusing
worker thread work items, but any queue misuse can cause this.  The rule
is that an entry on a queue may only be inserted on the list once. When an
item is removed from a queue, it's flink field is set to NULL. This bugcheck
occurs when remove queue attempts to remove an entry, but the flink or blink
field is NULL. In order to debug this problem, you need to know the queue being
referenced.
In an attempt to help identify the guilty driver, this bugcheck assumes the
queue is a worker queue (ExWorkerQueue) and prints the worker routine as
parameter 4 below.
Arguments:
Arg1: 0000000000000000, The address of the queue entry whose flink/blink field is NULL
Arg2: 0000000000000000, The address of the queue being references. Usually this is one
    of the ExWorkerQueues.
Arg3: 0000000000000000, The base address of the ExWorkerQueue array. This will help determine
    if the queue in question is an ExWorkerQueue and if so, the offset from
    this parameter will isolate the queue.
Arg4: 0000000000000000, If this is an ExWorkerQueue (which it usually is), this is the address
    of the worker routine that would have been called if the work item was
    valid. This can be used to isolate the driver that is misusing the work
    queue.


STOP 0x00000097: BOUND_IMAGE_UNSUPPORTED    (go to top of page)

Usual causes: 

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819381.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559303(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The BOUND_IMAGE_UNSUPPORTED bug check has a value of 0x00000097.

This bug check appears very infrequently.

    WinDbg Output Example:
BOUND_IMAGE_UNSUPPORTED (97)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000098: END_OF_NT_EVALUATION_PERIOD    (go to top of page)

Usual causes:  Exactly what it says

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819384.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559306(v=VS.85).aspx

    Knowledge Base Articles:
KB 242407    Windows 2000 System Year May Change to 2019 on ASUS P2B, P2B-D, P2B-F Mainboards
KB 250920    Windows 2000 Evaluation Copy Expiration Behavior
KB 818025    Windows 2003 Server evaluation copy expiration behavior

    WinDbg Help File Entry:

The END_OF_NT_EVALUATION_PERIOD bug check has a value of 0x00000098. This bug check indicates that the trial period for the Microsoft Windows operating system has ended.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The low-order 32 bits of the product expiration date
2 The high-order 32 bits of the product expiration date
3 Reserved
4 Reserved

Cause

Your installation of the Windows operating system is an evaluation unit with an expiration date. The trial period is over.

    WinDbg Output Example:
END_OF_NT_EVALUATION_PERIOD (98)
Your Windows System is an evaluation unit with an expiration date. The trial
period is over.
Arguments:
Arg1: 0000000000000000, The low order 32 bits of your product expiration date
Arg2: 0000000000000000, The high order 32 bits of your product expiration date
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x00000099: INVALID_REGION_OR_SEGMENT    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819386.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559312(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The INVALID_REGION_OR_SEGMENT bug check has a value of 0x00000099. This bug check indicates that ExInitializeRegion or ExInterlockedExtendRegion was called with an invalid set of parameters.

Parameters

None

    WinDbg Output Example:
INVALID_REGION_OR_SEGMENT (99)
ExInitializeRegion or ExInterlockedExtendRegion was called with an invalid
set of parameters.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000009A: SYSTEM_LICENSE_VIOLATION    (go to top of page)

Usual causes:  See parameters for description

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819392.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559317(v=VS.85).aspx

    Knowledge Base Articles:
KB 192821    STOP 0x0000009A During Restore of Registry (NT)

    WinDbg Help File Entry:

The SYSTEM_LICENSE_VIOLATION bug check has a value of 0x0000009A. This bug check indicates that the software license agreement has been violated.

Parameters

The following parameters appear on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x00 0: The product should be WinNT

1: The product should be LanmanNT or ServerNT

A partial serial number The first two characters of the product type from the product options Offline product type changes have been attempted.
0x01 The registered evaluation time from source 1 A partial serial number The registered evaluation time from an alternate source Offline changes to the Microsoft Windows evaluation unit time period have been attempted.
0x02 The status code that is associated with the open failure 0 0 The setup key could not be opened.
0x03 The status code that is associated with the key lookup failure 0 0 The SetupType or SetupInProgress value from the setup key is missing, so setup mode could not be detected.
0x04 The status code that is associated with the key lookup failure 0 0 The SystemPrefix value from the setup key is missing.
0x05 (See the setup code) An invalid value was found in licensed processors The officially licensed number of processors Offline changes to the number of licensed processors have been attempted.
0x06 The status code that is associated with the open failure 0 0 The ProductOptions key could not be opened.
0x07 The status code that is associated with the read failure 0 0 The ProductType value could not be read.
0x08 The status code that is associated with the Change Notify failure 0 0 Change Notify on ProductOptions failed.
0x09 The status code that is associated with the Change Notify failure 0 0 Change Notify on SystemPrefix failed.
0x0A 0 0 0 An NTW system was converted to an NTS system.
0x0B The status code that is associated with the change failure 0 0 The reference of the setup key failed.
0x0C The status code that is associated with the change failure 0 0 The reference of the product options key failed.
0x0D The status code that is associated with the failure 0 0 The attempt to open ProductOptions in the worker thread failed.
0x0F The status code that is associated with the failure 0 0 The attempt to open the setup key failed.
0x10 The status code that is associated with the failure 0: set value failed

1: Change Notify failed

0 A failure occurred in the setup key worker thread.
0x11 The status code that is associated with the failure 0: set value failed

1: Change Notify failed

0 A failure occurred in the product options key worker thread.
0x12 The status code that is associated with the failure 0 0 Unable to open the LicenseInfoSuites key for the suite.
0x13 The status code that is associated with the failure 0 0 Unable to query the LicenseInfoSuites key for the suite.
0x14 The size of the memory allocation 0 0 Unable to allocate memory.
0x15 The status code that is associated with the failure Reserved 0 Unable to reset the ConcurrentLimit value for the suite key.
0x16 The status code that is associated with the failure 0 0 Unable to open the license key for a suite product.
0x17 The status code that is associated with the failure 0 0 Unable to reset the ConcurrentLimit value for a suite product.
0x18 The status code that is associated with the open failure Reserved 0 Unable to start the Change Notify for the LicenseInfoSuites.
0x19 0 0 0 A suite is running on a system that must be PDC.
0x1A The status code that is associated with the failure 0 0 A failure occurred when enumerating the suites.
0x1B 0 0 0 Changes to the policy cache were attempted.

Cause

The Microsoft Windows operating system detects a violation of the software license agreement.

A user might have tried to change the product type of an offline system or change the trial period of an evaluation unit of Windows. For more information about the specific violation, see the parameter list.

    WinDbg Output Example:
SYSTEM_LICENSE_VIOLATION (9a)
A violation of the software license agreement has occurred. This can be due to
either attempting to change the product type of an offline system, or an attempt
to change the trial period of an evaluation unit of Windows.
Arguments:
Arg1: 0000000000000000, means that offline product type changes were attempted
Arg2: 0000000000000000, if 1, product should be LanmanNT or ServerNT. If 0, should be WinNT
Arg3: 0000000000000000, partial serial number
Arg4: 0000000000000000, first two characters of product type from product options.


STOP 0x0000009B: UDFS_FILE_SYSTEM    (go to top of page)

Usual causes:  Disk corruption, File system corruption, SCSI/IDE drivers, Memory, Insufficient memory

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819394.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559318(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The UDFS_FILE_SYSTEM bug check has a value of 0x0000009B. This bug check indicates that a problem occurred in the UDF file system.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 If UdfExceptionFilter is on the stack, this parameter specifies the address of the exception record.
3 If UdfExceptionFilter is on the stack, this parameter specifies the address of the context record.
4 Reserved.

Cause

The UDFS_FILE_SYSTEM bug check might be caused disk corruption. Corruption in the file system or bad blocks (sectors) on the disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to the disk and cause the error.

This bug check might also occur if nonpaged pool memory is full. If the nonpaged pool memory is full, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver that requires nonpaged pool memory can also trigger this error.

Resolving the Problem

To debug this problem: Use the .cxr (Display Context Record) command with Parameter 3, and then use kb (Display Stack Backtrace).

To resolve a disk corruption problem: Check Event Viewer for error messages from SCSI and FASTFAT (System Log) or Autochk (Application Log) that might help identify the device or driver that is causing the error. Disable any virus scanners, backup application, or disk defragmenter tools that continually monitor the system. You should also run hardware diagnostics that the system manufacturer supplies. For more information about these procedures, see the owner's manual for your computer. Run Chkdsk /f /r to detect and resolve any file system structural corruption. You must restart the system before the disk scan begins on a system partition.

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This memory increases the quantity of nonpaged pool memory that is available to the kernel.

    WinDbg Output Example:
UDFS_FILE_SYSTEM (9b)
    If you see UdfExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more helpful stack
    trace.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000009C: MACHINE_CHECK_EXCEPTION    (go to top of page)

Usual causes:  Hardware error (similar to STOP 0x124)

    MSDN Listing (Win2K ResKit):  http://msdn.microsoft.com/en-us/library/ms819396.aspx
    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559323(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x9c

    Knowledge Base Articles:
KB 162363    Understanding and troubleshooting the "Stop 0x0000009C" screen (NT, 2000, XP, Server 2003)
KB 329284    Stop error message in Windows XP that you may receive: "0x0000009C (0x00000004, 0x00000000, 0xb2000000, 0x00020151)"
KB 840551    Intermittent errors in IA64 editions of Windows Server 2003: Stop error code 0x0000009C (MACHINE_CHECK_EXCEPTION), Stop error code 0x00000024 (NTFS_FILE_SYSTEM), or Stop error code 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)
KB 910621    Error message when you run a Hardware Compatibility Test on a computer that is running Windows Server 2003 for Itanium-based Systems: "Stop 0x0000009C"
KB 939315    Windows 2003 Server evaluation copy expiration behavior

    WinDbg Help File Entry:

The MACHINE_CHECK_EXCEPTION bug check has a value of 0x0000009C. This bug check indicates that a fatal machine check exception has occurred.

Parameters

The four parameters that are listed in the message have different meanings, depending on the processor type.

If the processor is based on an older x86-based architecture and has the Machine Check Exception (MCE) feature but not the Machine Check Architecture (MCA) feature (for example, the Intel Pentium processor), the parameters have the following meaning.

Parameter Description
1 The low 32 bits of P5_MC_TYPE Machine Service Report (MSR)
2 The address of the MCA_EXCEPTION structure
3 The high 32 bits of P5_MC_ADDR MSR
4 The low 32 bits of P5_MC_ADDR MSR

If the processor is based on a newer x86-based architecture and has the MCA feature and the MCE feature (for example, any Intel Processor of family 6 or higher, such as Pentium Pro, Pentium IV, or Xeon), or if the processor is an x64-based processor, the parameters have the following meaning.

Parameter Description
1 The bank number
2 The address of the MCA_EXCEPTION structure
3 The high 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 The low 32 bits of MCi_STATUS MSR for the MCA bank that had the error

On an Itanium-based processor, the parameters have the following meaning.

Note  Parameter 1 indicates the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x1 The address of the log The size of the log 0
0x2 The address of the log The size of the log The error code The system abstraction layer (SAL) returned an error for SAL_GET_STATEINFO while processing MCA.
0x3 The address of the log The size of the log The error code SAL returned an error for SAL_CLEAR_STATEINFO while it processed MCA.
0x4 The address of the log The size of the log 0 Firmware (FW) reported a fatal MCA.
0x5 The address of the log The size of the log 0 There are two possible causes:
  • SAL reported a recoverable MCA, but this recovery is not currently supported.
  • SAL generated an MCA but could not produce an error record.
0xB The address of the log The size of the log 0
0xC The address of the log The size of the log The error code SAL returned an error for SAL_GET_STATEINFO while processing an INIT event.
0xD The address of the log The size of the log The error code SAL returned an error for SAL_CLEAR_STATEINFO while it processed an INIT event.
0xE The address of the log The size of the log 0

Comments

For more information about Machine Check Architecture (MCA), see the Intel or AMD Web sites.

Note  Starting with Windows Vista, this bug check is no longer supported, and has been replaced with bug Check 0x124: WHEA_UNCORRECTABLE_ERROR.

    WinDbg Output Example:
MACHINE_CHECK_EXCEPTION (9c)
A fatal Machine Check Exception has occurred.
KeBugCheckEx parameters;
    x86 Processors
        If the processor has ONLY MCE feature available (For example Intel
        Pentium), the parameters are:
        1 - Low  32 bits of P5_MC_TYPE MSR
        2 - Address of MCA_EXCEPTION structure
        3 - High 32 bits of P5_MC_ADDR MSR
        4 - Low  32 bits of P5_MC_ADDR MSR
        If the processor also has MCA feature available (For example Intel
        Pentium Pro), the parameters are:
        1 - Bank number
        2 - Address of MCA_EXCEPTION structure
        3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
        4 - Low  32 bits of MCi_STATUS MSR for the MCA bank that had the error
    IA64 Processors
        1 - Bugcheck Type
            1 - MCA_ASSERT
            2 - MCA_GET_STATEINFO
                SAL returned an error for SAL_GET_STATEINFO while processing MCA.
            3 - MCA_CLEAR_STATEINFO
                SAL returned an error for SAL_CLEAR_STATEINFO while processing MCA.
            4 - MCA_FATAL
                FW reported a fatal MCA.
            5 - MCA_NONFATAL
                SAL reported a recoverable MCA and we don't support currently
                support recovery or SAL generated an MCA and then couldn't
                produce an error record.
            0xB - INIT_ASSERT
            0xC - INIT_GET_STATEINFO
                  SAL returned an error for SAL_GET_STATEINFO while processing INIT event.
            0xD - INIT_CLEAR_STATEINFO
                  SAL returned an error for SAL_CLEAR_STATEINFO while processing INIT event.
            0xE - INIT_FATAL
                  Not used.
        2 - Address of log
        3 - Size of log
        4 - Error code in the case of x_GET_STATEINFO or x_CLEAR_STATEINFO
    AMD64 Processors
        1 - Bank number
        2 - Address of MCA_EXCEPTION structure
        3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
        4 - Low  32 bits of MCi_STATUS MSR for the MCA bank that had the error
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000009D:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (9d)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000009E: USER_MODE_HEALTH_MONITOR    (go to top of page)

Usual causes:  Failure of critical user-mode component(s)

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559326(v=VS.85).aspx

    Knowledge Base Articles:
KB 960228    You receive a Stop error when you click the arrow to scroll down an application pop-up menu on a Windows Server 2003 SP1 or SP2-based computer
KB 2135160     FIX: "0x0000009E" Stop error when you host Hyper-V virtual machines in a Windows Server 2008 R2-based failover cluster
KB 2520235    "0x0000009E" Stop error when you add an extra storage disk to a failover cluster in Windows Server 2008 R2
KB 2814923    "0x0000009E" Stop error and disk volumes cannot be brought online on a Windows Server 2008 R2-based failover cluster
KB 2863960    Stop error message on Windows Server 2012-based computer: "DRIVER_IRQL_NOT_LESS_OR_EQUAL" or "USER_MODE_HEALTH_MONITOR"

    WinDbg Help File Entry:

The USER_MODE_HEALTH_MONITOR bug check has a value of 0x0000009E. This bug check indicates that one or more critical user-mode components failed to satisfy a health check.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The process that failed to satisfy a health check in the configured time-out
2 The health monitoring time-out, in seconds
3 Reserved
4 Reserved

Cause

Hardware mechanisms, such as watchdog timers, can detect that basic kernel services are not executing. However, resource starvation issues (including memory leaks, lock contention, and scheduling priority misconfiguration) can block critical user-mode components without blocking deferred procedure calls (DPCs) or draining the non-paged pool.

Kernel components can extend watchdog timer functionality to user mode by periodically monitoring critical applications. This bug check indicates that a user-mode health check failed in a way that prevents graceful shutdown. This bug check restores critical services by restarting or enabling application failover to other servers.

On the Microsoft Windows Server 2003, Enterprise Edition, Windows Server 2003, Datacenter Edition, and Windows 2000 with Service Pack 4 (SP4) operating systems, a user-mode hang can also cause this bug check. The bug check occurs in this situation only if the user has set HangRecoveryAction to a value of 3.

    WinDbg Output Example:
USER_MODE_HEALTH_MONITOR (9e)
One or more critical user mode components failed to satisfy a health check.
Hardware mechanisms such as watchdog timers can detect that basic kernel
services are not executing. However, resource starvation issues, including
memory leaks, lock contention, and scheduling priority misconfiguration,
may block critical user mode components without blocking DPCs or
draining the nonpaged pool.
Kernel components can extend watchdog timer functionality to user mode
by periodically monitoring critical applications. This bugcheck indicates
that a user mode health check failed in a manner such that graceful
shutdown is unlikely to succeed. It restores critical services by
rebooting and/or allowing application failover to other servers.
Arguments:
Arg1: 0000000000000000, Process that failed to satisfy a health check within the
    configured timeout
Arg2: 0000000000000000, Health monitoring timeout (seconds)
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x0000009F: DRIVER_POWER_STATE_FAILURE    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559329(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0x9f

    Knowledge Base Articles:
                       Troubleshooting specific Stop messages
KB 246243    Troubleshooting STOP 0x9F Error Messages in Windows (2000)
KB 263560    Stop 0x0000009F During Shutdown, Standby, or Restart (2000)
KB 271838    "Stop 0x0000009F" in Autosave.sys When Shutting Down Windows 2000
KB 314101    Computer Hangs During Shutdown or Displays a "Cannot Find Enough Free Resources" Error Message (XP)
KB 315249    Troubleshooting a Stop 0x9F Error in Windows XP
KB 832452    You receive a "STOP: 0x0000009F" error when you shut down or restart a Windows 2000-based computer
KB 929762    You receive a Stop 0x9F error when you wake a Windows Vista-based computer that is connected to an IEEE 1394-based device
KB 931671    Error message when you put a Windows Vista-based computer to sleep while a PPP connection is active: "STOP 0x0000009F"
KB 932755    An updated Storport storage driver is available for Windows Server 2003
KB 937322    Stop error message when you run the "Common Scenario Stress with IO" test, print to a shared printer on the network, or perform a power management operation on a Windows Vista-based computer: "Stop 0x0000009F"
KB 941858    You receive a Stop error message when you put a Windows Vista-based computer to sleep or into hibernation, or when you resume the computer from sleep or from hibernation: "0x0000009F DRIVER_POWER_STATE_FAILURE"
KB 946988    Stop error message when you try to put a Windows Vista-based computer to sleep while a dial-up network connection is active: "STOP: 0x0000009F"
KB 954429    You experience problems on a multiprocessor computer that is running Windows Server 2003, Windows Vista, or Windows Server 2008 when you resume the computer from hibernation
KB 957126    Error message when you try to resume a computer that is running Windows Vista or Windows Server 2008 from hibernation: "STOP 0x0000009F"
KB 960884    If you repeatedly unplug and re-plug a 1394a hard disk on a Windows Vista-based or Windows Server 2008-based computer that has two 1394a hard disks, the other 1394a hard disk becomes inaccessible
KB 962201    Error message when you put a Windows Vista-based or a Windows Server 2008-based computer to sleep, or you wake the computer up: "STOP: 0x0000009F"
KB 972109    The shutdown process does not finish, and you receive an error message on a computer that is running Windows Vista or Windows Server 2008: "Stop 0x0000009F"
KB 975599    Stop error when you put a computer that is running Windows 7 or Windows Server 2008 R2 to sleep or into hibernation, or when you restart the computer: "0x9F"
KB 977186    Error message when you try to resume a Windows 7-based or a Windows Server 2008 R2-based computer from hibernation: "Stop 0x0000009F"
KB 979148    "0x0000009F" or "0x000000A0" Stop errors on a computer that is running Windows Vista or Windows Server 2008 when a USB webcam is set as the default audio device
KB 981848    "0x0000009F" Stop error message when a computer enters and resumes from hibernation in Windows 7 or Windows Server 2008 R2 
KB /982091    "Stop 0x9F" or "Stop 0xFE" error on a Windows 7-based or Windows Vista-based computer that uses certain AMD USB EHCI host controllers
KB 2315295   "0x0000009F" Stop error when you resume a computer that is running Windows Server 2008 R2 or Windows 7 from sleep
KB 2459268   "0x0000009F" Stop error in Windows 7 or in Windows Server 2008 R2 when the computer enters or resumes from the Soft Off (S5) power state
KB 2482122    "0x0000009F" Stop error when you restart a Windows 7-based or Windows Server 2008 R2-based computer that has certain Wi-Fi drivers installed
KB 2677930    0x0000009F Stop error in Windows 7 during sleep operation
KB 2690653    An update is available for Windows 8 Consumer Preview
KB 2720599    "0x0000009F" Stop error when you resume a computer from hibernation in Windows 7 or in Windows Server 2008 R2
KB 2813621    "0x0000009F" Stop error when a website turns on a webcam in Windows 8
KB 2911204    Stop error 0x9F in the mf.sys driver occurs in Windows (Windows 7/Windows 8.1/Server 2008 R2/Server 2012 R2)

    More BSOD articles at this link:  http://search.microsoft.com/results.aspx?mkt=en-US&q=stop%3A%200x0000009f&qsc0=0&l=1&first=1&FORM=PEME

    WinDbg Help File Entry:

The DRIVER_POWER_STATE_FAILURE bug check has a value of 0x0000009F. This bug check indicates that the driver is in an inconsistent or invalid power state.

Parameters

The following parameters appear on the blue screen. Parameter 1 indicates the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x1 The device object Reserved Reserved The device object that is being freed still has an outstanding power request that it has not completed.
0x2 The target device's device object, if it is available The device object The driver object, if it is available The device object completed the I/O request packet (IRP) for the system power state request, but it failed to call PoStartNextPowerIrp.
0x3 (Windows 2000 only) A pointer to the target device object A pointer to the device object The IRP The device driver did not properly set the IRP as "pending" or complete the IRP.
0x3 (Windows XP and later) The physical device object (PDO) of the stack The functional device object (FDO) of the stack The blocked IRP A device object has been blocking an IRP for too long a time.
0x100 (Windows 2000 only) A pointer to the nonpaged device object A pointer to the target device object A pointer to the device object to notify The device objects in the devnode inconsistently used DO_POWER_PAGABLE.
0x101 (Windows 2000 only) The child device object (FDO) The child device object (PDO) The parent device object A parent device object has detected that a child device has not set the DO_POWER_PAGABLE bit.
0x500 (Windows XP and Windows Server 2003 only) Reserved The target device's device object, if available Device object The device object completed the IRP for the system power state request, but it failed to call PoStartNextPowerIrp.

Cause

For a description of the possible causes, see the description of each code in the Parameters section.

The errors that cause Parameter 1 to be 0x3, 0x100, or 0x101 only exist in Microsoft Windows 2000. In Windows XP and later versions of Windows, these errors are superseded by Driver Verifier tests. For more information about Driver Verifier, see the Driver Verifier section of the Windows Driver Kit.

    WinDbg Output Example:
DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 00000003, A device object has been blocking an Irp for too long a time
Arg2: 8970a028, Physical Device Object of the stack
Arg3: 89709ac8, Functional Device Object of the stack
Arg4: 8aa33d50, The blocked IRP



STOP 0x000000A0: INTERNAL_POWER_ERROR    (go to top of page)

Usual causes:  See parameters for details

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff559341(v=VS.85).aspx

    Knowledge Base Articles:
KB 314118    Device Driver Error Message Is Generated When the Computer Enters Standby or Hibernate Mode (XP)
KB 320899    Windows XP Generates a "Stop 0xA0" Error Message During Hibernation
KB 942524    Stop error message when you put a Windows Vista-based computer in hibernation: "STOP: 0x000000A0 (0x00000009, 0xc0000001, 0x00000001, 0x00000000) INTERNAL_POWER_ERROR (a0)"
KB 956871    The system may crash when you put a Windows Vista-based computer or a Windows Server 2008-based computer into hibernation
KB 969853    Stop error message when you try to put a Windows Vista-based computer or a Windows Server 2008-based computer into hibernation: "STOP: 0x000000A0 (0x00000009, 0xc000009a, 0x00000000, 0x00000000) INTERNAL_POWER_ERROR (a0)"
KB 974772    Error when entering Hibernation on a Windows 7-based computer: “STOP 0x000000A0 INTERNAL_POWER_ERROR (0x0000000B, 0x????????, 0x????????, 0x????????)”
KB 979148    "0x0000009F" or "0x000000A0" Stop errors on a computer that is running Windows Vista or Windows Server 2008 when a USB webcam is set as the default audio device
KB 2823506    "0x000000A0" Stop error when you resume Windows 8 or Windows Server 2012 from hibernate

    More BSOD articles at this link:  http://search.microsoft.com/results.aspx?mkt=en-US&q=stop%3A%200x000000a0&qsc0=0&l=1&first=1&FORM=PEME

    WinDbg Help File Entry:

The INTERNAL_POWER_ERROR bug check has a value of 0x000000A0. This bug check indicates that the power policy manager experienced a fatal error.

Parameters

The following parameters appear on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x1 1: A device has overrun its maximum number of reference counts.

2, 3, or 4: (Windows Server 2003, Windows XP, and Windows 2000 only ) Too many inrush power IRPs have been queued.

5: (Windows Server 2003, Windows XP, and Windows 2000 only) The power IRP has been sent to a passive level device object.

Except when Parameter 2 is equal to 5, this parameter indicates the maximum number of pending IRPs that are allowed.

If Parameter 2 is equal to 5, this parameter is reserved.

Reserved An error occurred during the handling of the power I/O request packet (IRP).
0x2 Reserved Reserved Reserved An internal failure has occurred while attempting to process a power event.
0x3 The expected checksum The actual checksum The line number of the failure The checksum for a hibernation context page does not match its expected checksum.
0x4 The expected checksum The actual checksum The line number of the failure The checksum for a page about to be written to the hibernation file does not match its expected checksum.
0x5 Reserved Reserved Reserved An unknown shutdown code has been sent to the system shutdown handler.
0x7 Reserved Reserved Reserved An unhandled exception has occurred.
0x8


A fatal error occurred while processing a system power event.

(See the following table for more details.)

0x9  
(see link)     
                                                                                                                                                                                                   Parameter 1 of 0x9 =  A fatal error occured  
while preparing the hibernate file  

When Parameter 1 is0x8, a fatal error occurred while processing a system power event. In this situation, Parameter 2 indicates the cause of the error. The meaning of the other parameters depends on the value of Parameter 2.

Parameter 2 Parameter 3 Parameter 4 Cause
0x100 The device object The address of the POWER_CHANNEL_SUMMARY structure (a record of device object states) An unknown device type is being processed.
0x101 Exception pointer Reserved An unhandled exception occurred.
0x102 The address of the DUMP_INITIALIZATION_CONTEXT structure, which contains the information that is passed from the system to the disk dump driver during the driver's initialization The address of the POP_HIBER_CONTEXT structure, which contains information about the state of the computer before hibernation The hibernation working buffer size is not page-aligned.
0x103 The address of the POP_HIBER_CONTEXT structure Reserved Some working pages were not accounted for during the hibernation process.
0x104 The address of the POP_HIBER_CONTEXT structure Reserved An attempt was made to map internal hibernation memory while the internal memory structures were locked.
0x105 The address of the POP_HIBER_CONTEXT structure Reserved An attempt was made to map internal hibernation memory with an unsupported memory type flag.
0x106 The MDL Reserved A memory descriptor list (MDL) was created during the hibernation process that describes memory that is not paged-aligned.
0x107 The address of the POP_HIBER_CONTEXT structure The address of the PO_MEMORY_RANGE_ARRAY structure A data mismatch occurred in the internal hibernation data structures.
0x108 The address of the POP_HIBER_CONTEXT structure Reserved The disk subsystem failed to properly write part of the hibernation file.
0x109 The expected checksum The actual checksum The checksum for the processor state data does not match its expected checksum.
0x10A The address of the POP_HIBER_CONTEXT structure The NTSTATUS failure code The disk subsystem failed to properly write part of the hibernation file.
0x200 The device object The address of the DEVICE_OBJECT_POWER_EXTENSION notification structure An unknown device type is being checked for an idle state.
0x300 The device object The IRP An unknown status was returned from a battery power IRP.
0x301 The device object The IRP The battery has entered an unknown state.
0x400 The IRP stack location The device object A device has overrun its maximum number of reference counts.
0x401,
0x402,
or
0x403
The pending IRP list The device object (Windows Server 2003, Windows XP, and Windows 2000 only) Too many inrush power IRPs have been queued.
0x404 The IRP stack location The device object (Windows Server 2003, Windows XP, and Windows 2000 only) A power IRP has been sent to a passive level device object.
0x500 The IRP The device object An unknown status was returned from a thermal power IRP.

Cause

For more information about the exact cause for the INTERNAL_POWER_ERROR bug check, see the tables in the Parameters section above.

Resolving the Problem

The following procedures will help you debug certain instances of this bug check.

Debugging bug check 0xA0 when Parameter 1 equals 0x2
  1. Examine the stack. Look for the ntoskrnl!PopExceptionFilter function. This function contains the following code as its first argument.

     (error_code << 16) | _LINE_

    If the caller is PopExceptionFilter, the first argument to this function is of type PEXCEPTION_POINTERS. Note the value of this argument.

  2. Use the dt (Display Type) command and specify the value that you found in the previous step as argument.

    dt nt!_EXCEPTION_POINTERS argument 

    . This command displays the structure. Note the address of the context record.

  3. Use the .cxr (Display Context Record) command and specify the context record that you found in the previous step as record.

    .cxr record 

    . This command sets the register context to the proper value.

  4. Use a variety of commands to analyze the source of the error. Start with kb (Display Stack Backtrace) .
Debugging bug check 0xA0 when Parameter 1 equals 0x7
  1. Examine the stack. Look for the ntoskrnl!PopExceptionFilter function. The first argument to this function is of type PEXCEPTION_POINTERS. Note the value of this argument.
  2. Use the dt (Display Type) command and specify the value that you found in the previous step as argument.

    dt nt!_EXCEPTION_POINTERS argument 

    This command displays the structure. Note the address of the context record.

  3. Use the .cxr (Display Context Record) command and specify the context record that you found in the previous step as record.

    .cxr record 

    This command sets the register context to the proper value.

  4. Use a variety of commands to analyze the source of the error. Start with kb (Display Stack Backtrace) .
Debugging bug check 0xA0 when Parameter 1 equals 0x8 and Parameter 2 equals 0x101
  1. Use the dt (Display Type) command and specify the value of Parameter 3 as argument.

    dt nt!_EXCEPTION_POINTERS argument 

    This command displays the structure. Note the address of the context record.

  2. Use the .cxr (Display Context Record) command and specify the context record that you found the previous step as record.

    .cxr record 

    This command sets the register context to the proper value.

  3. Use a variety of commands to analyze the source of the error. Start with kb (Display Stack Backtrace) .
    WinDbg Output Example:
INTERNAL_POWER_ERROR (a0)
The power policy manager experienced a fatal error.
Arguments:
Arg1: 0000000000000000,
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

    From a recent dump file that I ran into here:  http://www.sevenforums.com/crashes-debugging/84490-bsod-hibernating-windows-7-a.html#post731741
INTERNAL_POWER_ERROR (a0)
The power policy manager experienced a fatal error.
Arguments:
Arg1: 0000000000000009, A fatal error occured while preparing the hibernate file.
Arg2: ffffffffc0000185, Status code (Status code translates to : STATUS_IO_DEVICE_ERROR)
Arg3: 0000000000000001, Mirroring phase
Arg4: 0000000000000000



STOP 0x000000A1: PCI_BUS_DRIVER_INTERNAL    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560101(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The PCI_BUS_DRIVER_INTERNAL bug check has a value of 0x000000A1. This bug check indicates that the PCI Bus driver detected inconsistency problems in its internal structures and could not continue.

Parameters

None

    WinDbg Output Example:
PCI_BUS_DRIVER_INTERNAL (a1)
The PCI Bus driver detected inconsistency
problems in its internal structures and could not continue.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A2: MEMORY_IMAGE_CORRUPT    (go to top of page)

Usual causes:  Memory, Pagefile corruption, Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560105(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The MEMORY_IMAGE_CORRUPT bug check has a value of 0x000000A2. This bug check indicates that corruption has been detected in the image of an executable file in memory.

Parameters

The following parameters appear on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x02 If Parameter 3 is zero: The page number in the table page that failed

If Parameter 3 is nonzero: The page number with the failing page run index

Zero, or the index that failed to match the run 0 A table page check failure occurred.
0x03 The starting physical page number of the range The length (in pages) of the range The page number of the table page that contains this run The checksum for the range of memory listed is incorrect.

Cause

A cyclic redundancy check (CRC) check on the memory range has failed.

On a system wake operation, various regions of memory might be checked to guard against memory failures.

    WinDbg Output Example:
MEMORY_IMAGE_CORRUPT (a2)
On a system wake operation, various regions of memory may be CRCed to
guard against memory failures.
Arguments:
Arg1: 0000000000000000,
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A3: ACPI_DRIVER_INTERNAL    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560106(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The ACPI_DRIVER_INTERNAL bug check has a value of 0x000000A3. This bug check indicates that the ACPI driver detected an internal inconsistency.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 Reserved
2 Reserved
3 Reserved
4 Reserved

Cause

An inconsistency in the ACPI driver is so severe that continuing to run would cause serious problems.

One possible source of this problem is a BIOS error.

    WinDbg Output Example:
ACPI_DRIVER_INTERNAL (a3)
The ACPI Driver detected an internal inconsistency. The inconsistency is
so severe that continuing to run would cause serious problems.
The ACPI driver calls this when the state is so inconsistent that proceeding
would actually be dangerous. The problem may or may not be a BIOS issue, but
there is no way to tell.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A4: CNSS_FILE_SYSTEM_FILTER    (go to top of page)

Usual causes:  Memory, Indexing, Insufficient memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560110(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CNSS_FILE_SYSTEM_FILTER bug check has a value of 0x000000A4. This bug check indicates that a problem occurred in the CNSS file system filter.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred.
2 Reserved
3 Reserved
4 Reserved

Cause

The CNSS_FILE_SYSTEM_FILTER bug check might occur because nonpaged pool memory is full. If the nonpaged pool memory is completely full, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver that requires nonpaged pool memory can also trigger this error.

Resolving the Problem

To resolve a nonpaged pool memory depletion problem: Add new physical memory to the computer. This memory sincrease the quantity of nonpaged pool memory available to the kernel.

    WinDbg Output Example:
CNSS_FILE_SYSTEM_FILTER (a4)
    See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A5: ACPI_BIOS_ERROR    (go to top of page)

Usual causes:  BIOS

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560114(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xa5

    Knowledge Base Articles:
KB 256841    "STOP 0x000000A5" When Installing Windows 2000
KB 314830    "Stop 0x000000A5" Error When You Are Installing Windows XP
KB 831691    "Stop 0x000000A5 the ACPI BIOS in the system is not fully compliant with the ACPI specification" error message when the computer resumes from hibernation (XP)
KB 935806    Troubleshooting Stop error messages that may occur when you try to install Windows Vista
KB 969179    A Windows XP-based computer becomes unresponsive or displays a "STOP 0x000000A5" error message during system shutdown

    WinDbg Help File Entry:

The ACPI_BIOS_ERROR bug check has a value of 0x000000A5. This bug check indicates that the Advanced Configuration and Power Interface (ACPI) BIOS of the computer is not fully compliant with the ACPI specification.

Parameters

Four bug check parameters appear on the blue screen. Parameter 1 indicates the kind of the incompatibility. The meaning of the other parameters depends on the value of Parameter 1.

If the BIOS incompatibility is related to Plug and Play (PnP) or power management, the following parameters are used.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x01 ACPI's deviceExtension ACPI's ResourceList 0: No resource list is found

1: No IRQ resource is found in list

ACPI cannot find the System Control Interrupt (SCI) vector in the resources that are handed to it when ACPI is started.
0x02


(See the table later on this page)
0x03 The ACPI object that was being run The return value from the interpreter The name of the control method (in ULONG format) ACPI tried to run a control method while creating device extensions to represent the ACPI namespace, but this control method failed.
0x04 The ACPI extension that _PRW belongs to A pointer to the method The DataType returned (see Amli.h) ACPI evaluated a _PRW and expected to find an integer as a package element.
0x05 The ACPI extension that _PRW belongs to Aointer to the _PRW The number of elements in the _PRW ACPI evaluated a _PRW, and the package that came back failed to contain at least two elements. The ACPI specification requires that two elements always be present in a _PRW.
0x06 The ACPI extension that _PRx belongs to A pointer to the _PRx A pointer to the name of the object to look for ACPI tried to find a named object, but it could not find the object.
0x07 The ACPI extension that the method belongs to A pointer to the method The DataType returned (see Amli.h) ACPI evaluated a method and expected to receive a buffer in return. However, the method returned some other data type.
0x08 The ACPI extension that the method belongs to A pointer to the method The DataType returned (see Amli.h) ACPI evaluated a method and expected to receive an integer in return. However, the method returned some other data type.
0x09 The ACPI extension that the method belongs to A pointer to the method The DataType returned (see Amli.h) ACPI evaluated a method and expected to receive a package in return. However, the method returned some other data type.
0x0A The ACPI extension that the method belongs to A pointer to the method The DataType returned (see Amli.h) ACPI evaluated a method and expected to receive a string in return. However, the method returned some other data type.
0x0B The ACPI extension that _EJD belongs to The status that the interpreter returns The name of the object that ACPI is trying to find ACPI cannot find the object that an _EJD string references.
0x0C The ACPI extension that ACPI found a dock device for A pointer to the _EJD method 0: BIOS does not claim system is dockage

1: Duplicate device extensions for dock device

ACPI provides faulty or insufficient information for dock support.
0x0D The ACPI extension that ACPI needs the object for The (ULONG) name of the method that ACPI looked for 0: Base case

1: Conflict

ACPI could not find a required method or object in the namespace This bug check code is used if there is no _HID or _ADR present.
0x0E The NS PowerResource that ACPI needs the object for The (ULONG) name of the method that ACPI looked for 0: Base case ACPI could not find a required method or object in the namespace for a power resource (or entity other than a "device"). This bug check code is used if there is no _ON, _OFF, or _STA present for a power resource.
0x0F The current buffer that ACPI was parsing The buffer's tag The specified length of the buffer ACPI could not parse the resource descriptor.
0x10


(See the table later on this page)
0x11


(See the table later on this page)
0x14 The current buffer that ACPI was parsing The buffer's tag A pointer to a variable that contains the ULONGLONG length of the buffer ACPI could not parse the resource descriptor. The length exceeds MAXULONG.
0x15 The ACPI Machine Language (AML) context 1: Failed to load table

2: The Parameter Path String Object was not found

3: Failed to insert Parameter Data into the ParameterPath String Object

4: Out of system memory

The NT status code ACPI had a fatal error when attempting to load a table.
0x16 A pointer to the parent NSOBJ A pointer to the illegal child ACPI namespace object Reserved ACPI had a fatal error when processing an xSDT. An object was declared as a child of a parent that cannot have children.

If an interrupt routing failure or incompatibility has occurred, the following parameters are used.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x2001 InterruptModel (integer) The return value from the interpreter A pointer to the PIC control method ACPI tried to evaluate the PIC control method but failed.
0x10001 A pointer to the device object A pointer to the parent of the device object A pointer to the _PRT object

(See the following Comments section)

ACPI tried to do interrupt routing, but failed.
0x10002 A pointer to the device object A pointer to the string name that ACPI was looking for but could not find A pointer to the _PRT object

(See the following Comments section)

ACPI could not find the link node referenced in a _PRT.
0x10003 A pointer to the device object The device ID or function number.

This DWORD is encoded as follows: bits 5:0 are the PCI device number, and bits 8:6 are the PCI function number

A pointer to the _PRT object

(See the following Comments section)

ACPI could not find a mapping in the _PRT package for a device.
0x10005 A pointer to the _PRT object

(See the following Comments section)

A pointer to the current _PRT element.

(This pointer is an index into the _PRT.)

The device ID or function number.

This DWORD is encoded as follows: bits 15:0 are the PCI function number, and bits 31:16 are the PCI device number

ACPI found an entry in the _PRT that the function ID is not all F's for.

(The generic format for a _PRT entry is that the device number is specified, but the function number is not.)

0x10006 A pointer to the link node.

(This device is missing the _DIS method.)

0 0 ACPI found a link node, but it cannot disable the node.

(Link nodes must be disabled to allow for reprogramming.)

0x10007 The vector that could not be found 0 0 The _PRT contained a reference to a vector that is not described in the I/O APIC entry's MAPIC table.
0x10008 The invalid interrupt level. 0 0 The ACPI SCI interrupt level is invalid.



0x10009 0 0 0 The Fixed ACPI Description Table (FADT) could not be located.
0x1000A 0 0 0 The Root System Description Pointer (RSDP) or Extended System Description Table (XSDT) could not be located



0x1000B The ACPI table signature A pointer to the ACPI table 0 The length of the ACPI table is not consistent with the table revision.
0x20000 The I/O port in the Fixed Table 0 0 The PM_TMR_BLK entry in the Fixed ACPI Description Table doesn't point to a working ACPI timer block.

If a miscellaneous failure or incompatibility has occurred, the following parameters are used.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause
0x20000 The I/O port in the Fixed Table 0 0 The PM_TMR_BLK entry in the Fixed ACPI Description Table does not point to a working ACPI timer block.

If Parameter 1 equals 0x02, the ACPI BIOS could not process the resource list for the PCI root buses. In this case, Parameter 3 specifies the exact problem, and the remaining parameters have the following definitions.

Parameter 2 Parameter 3 Parameter 4 Cause
The ACPI extension for the PCI bus 0x0 A pointer to the QUERY_RESOURCES IRP ACPI cannot convert the BIOS' resource list into the proper format. This probably represents an error in the BIOS' list encoding procedure.
The ACPI extension for the PCI bus 0x1 A pointer to the QUERY_RESOURCE_REQUIREMENTS IRP ACPI cannot convert the BIOS' resource list into the proper format. This probably represents an error in the BIOS' list encoding procedure.
The ACPI extension for the PCI bus 0x2 0 ACPI found an empty resource list.
The ACPI extension for the PCI bus 0x3 A pointer to the PNP CRS descriptor ACPI could not find the current bus number in the CRS.
The ACPI extension for the PCI bus A pointer to the resource list for PCI A pointer to the E820 memory table The list of resources that PCI claims to decode overlaps with the list of memory regions that the E820 BIOS interface reports. (This kind of conflict is never permitted.)

If Parameter 1 equals 0x10, the ACPI BIOS could not determine the system-to-device-state mapping correctly. In this situation, Parameter 3 specifies the exact problem, and the remaining parameters have the following definitions.

Parameter 2 Parameter 3 Parameter 4 Cause
The ACPI extension whose mapping is needed 0x0 The DEVICE_POWER_STATE (this is "x+1") _PRx was mapped back to a non-supported S-state.
The ACPI extension whose mapping is needed 0x1 The SYSTEM_POWER_STATE that cannot be mapped ACPI cannot find a D-state to associate with the S-state.
The ACPI extension whose mapping is needed 0x2 The SYSTEM_POWER_STATE that cannot be mapped The device claims to be able to wake the system when the system is in this S-state, but the system does not actually support this S-state.

If Parameter 1 equals 0x11, the system could not enter ACPI mode. In this situation, Parameter 2 specifies the exact problem, and the remaining parameters have the following definitions.

Parameter 2 Parameter 3 Parameter 4 Cause
0x0 0 0 The system could not initialize the AML interpreter.
0x1 0 0 The system could not find RSDT.
0x2 0 0 The system could not allocate critical driver structures.
0x3 0 0 The system could not load RSDT.
0x4 0 0 The system could not load DDBs.
0x5 0 0 The system cannot connect the Interrupt vector.
0x6 0 0 SCI_EN never becomes set in PM1 Control Register.
0x7 A pointer to the table that had a bad checksum Creator revision The table checksum is incorrect.
0x8 A pointer to the table that ACPI failed to load Creator revision ACPI failed to load DDB.
0x9 FADT version 0 Unsupported firmware version.
0xA 0 0 The system could not find MADT.
0xB 0 0 The system could not find any valid Local SAPIC structures in the MADT.

Cause

The value of Parameter 1 indicates the error.

Resolving the Problem

If you are debugging this error, use the !analyze -v extension. This extension displays all the relevant data (device extensions, nsobjects, or whatever is appropriate to the specific error).

If you are not performing debugging, this error indicates that you have to obtain a new BIOS. Contact your vendor or visit the internet to get a new BIOS.

If you cannot obtain an updated BIOS, or the latest BIOS is still not ACPI compliant, you can turn off ACPI mode during text-mode setup. To turn off ACPI mode, press the F7 key when you are prompted to install storage drivers. The system does not notify you that the F7 key was pressed, but it silently disables ACPI and enables you to continue your installation.

Comments

A PCI routing table (_PRT) is the ACPI BIOS object that specifies how all the PCI devices are connected to the interrupt controllers. A computer with multiple PCI buses might have multiple _PRTs.

You can display a _PRT in the debugger by using the !acpikd.nsobj extension together with the address of the _PRT object as its argument.

    WinDbg Output Example:
ACPI_BIOS_ERROR (a5)
The ACPI Bios in the system is not fully compliant with the ACPI specification.
The first value indicates where the incompatibility lies:
This bug check covers a great variety of ACPI problems.  If a kernel debugger
is attached, use "!analyze -v".  This command will analyze the precise problem,
and display whatever information is most useful for debugging the specific
error.
Arguments:
Arg1: 0000000000000000,
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A6: FP_EMULATION_ERROR    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (a6)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A7: BAD_EXHANDLE    (go to top of page)

Usual causes:  Memory, Pagefile, Device driver

    MSDN Listing (WDK):             http://msdn.microsoft.com/en-us/library/ff560117(v=VS.85).aspx 

    Knowledge Base Articles:

    WinDbg Help File Entry:

The BAD_EXHANDLE bug check has a value of 0x000000A7. This bug check indicates that the kernel-mode handle table detected an inconsistent handle table entry state.

Parameters

None

    WinDbg Output Example:
BAD_EXHANDLE (a7)
The kernel mode handle table detected an inconsistent handle table
entry state.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A8: BOOTING_IN_SAFEMODE_MINIMAL    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (a8)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000A9: BOOTING_IN_SAFEMODE_NETWORK    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (a9)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000AA: BOOTING_IN_SAFEMODE_DSREPAIR    (go to top of page)

Usual causes: 

    Knowledge Base Articles:
KB 2617115    "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)" error when a client logs off from a Remote Desktop Services session in Windows Server 2008 R2
KB 2669129    "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)" error when you log off a Remote Desktop Services session in Windows Server 2008

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (aa)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000AB: SESSION_HAS_VALID_POOL_ON_EXIT    (go to top of page)

Usual causes:  A bug in Win32k.sys, Atmfd.dll, Rdpdd.dll, or a video driver.

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560119(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xab

    Knowledge Base Articles:
KB 901150    You may receive a “Stop 0x000000ab” error message when you log off a Terminal Services session on a Windows Server 2003 SP1-based Terminal Server
KB 907242    You receive a "Stop 0x000000ab" error message when you log off from a Terminal Services session on a Windows Server 2003 SP1-based terminal server
KB 918673    You receive a "Stop 0x000000ab" error message when a Terminal Services client computer logs off from a Terminal Services session on a Windows Server 2003 SP1-based Terminal Services computer
KB 925919    Stop error message when a client computer logs off from a Terminal Services session on a server that is running Windows Server 2003 with SP1 or with SP2: "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 928942    Error message when you log off a Terminal Services session on Windows Server 2003 Terminal Server with Service Pack 1 or with Service Pack 2: "Stop 0x000000AB"
KB 931282    Stop error message when a client computer logs off from a Terminal Services session on a server that is running Windows Server 2003 with SP1 or with SP2: "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 944916    Stop error message when a client logs off from a Terminal Services session on a server that is running Windows Server 2003 with SP1 or Windows Server 2003 with SP2: "Stop error code 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 946068    Stop error message on a terminal server that is running Windows Server 2003 Service Pack 1 or Windows Server 2003 Service Pack 2: "Stop error code 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 951749    Stop error message on a terminal server that is running Windows Server 2003 SP1 or Windows Server 2003 SP2: "Stop error code 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"
KB 959466    Stop error on a Windows Server 2003-based terminal server that has a third-party Input Method Editor (IME) installed: "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)"

KB 982362    "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)" error when a client logs off from a terminal server session in Windows Server 2003 SP1 or in Windows Server 2003 SP2
KB 2585233    "Stop 0x000000AB (SESSION_HAS_VALID_POOL_ON_EXIT)" error when a client logs off from a Windows Server 2008 R2 Remote Desktop Services session
KB 2786447    "0x000000AB" Stop error when a Citrix client logs off from a RD Session Host that is running Windows Server 2008 R2 SP1
KB 2863945    "0x000000AB" Stop error when you log off from a Windows Server 2012-based RDS server

    More BSOD articles at this link:  http://search.microsoft.com/results.aspx?qsc0=0&q=stop%3A+0x000000ab&x=0&y=0&mkt=en-US&FORM=QBME1&l=1

    WinDbg Help File Entry:

The SESSION_HAS_VALID_POOL_ON_EXIT bug check has a value of 0x000000AB. This bug check indicates that a session unload occurred while a session driver still held memory.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The session ID.
2 The number of paged pool bytes that are leaking.
3 The number of nonpaged pool bytes that are leaking.
4 The total number of paged and nonpaged allocations that are leaking. (The number of nonpaged allocations are in the upper half of this word, and paged allocations are in the lower half of this word.)

Cause

The SESSION_HAS_VALID_POOL_ON_EXIT bug check occurs because a session driver does not free its pool allocations before a session unload. This bug check indicates a bug in Win32k.sys, Atmfd.dll, Rdpdd.dll, or a video driver.

    WinDbg Output Example:
SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000000000000, session ID
Arg2: 0000000000000000, number of paged pool bytes that are leaking
Arg3: 0000000000000000, number of nonpaged pool bytes that are leaking
Arg4: 0000000000000000, total number of paged and nonpaged allocations that are leaking.
    nonpaged allocations are in the upper half of this word,
    paged allocations are in the lower half of this word.


STOP 0x000000AC: HAL_MEMORY_ALLOCATION    (go to top of page)

Usual causes:  Memory, Corruption of loading of Windows

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560121(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The HAL_MEMORY_ALLOCATION bug check has a value of 0x000000AC. This bug check indicates that the hardware abstraction layer (HAL) could not obtain sufficient memory.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 The allocation size
2 0
3 A pointer to a string that contains the file name
4 Reserved

Cause

The HAL could not obtain non-paged memory pool for a system critical requirement.

These critical memory allocations are made early in system initialization, and the HAL_MEMORY_ALLOCATION bug check is not expected. This bug check probably indicates some other critical error such as pool corruption or massive consumption.

    WinDbg Output Example:
HAL_MEMORY_ALLOCATION (ac)
The HAL was unable to obtain memory for a system critical requirement.
These allocations are made early in system initialization and such a
failure is not expected.  It probably indicates some other critical error
such as pool corruption or massive consumption.
Arguments:
Arg1: 0000000000000000, Allocation size.
Arg2: 0000000000000000, 0
Arg3: 0000000000000000, Pointer to string containing file name.
Arg4: 0000000000000000, (reserved)


STOP 0x000000AD: VIDEO_DRIVER_DEBUG_REPORT_REQUEST    (go to top of page)

Usual causes:  Video driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560125(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The VIDEO_DRIVER_DEBUG_REPORT_REQUEST bug check has a value of 0x000000AD. This bug check indicates that the video port created a non-fatal minidump on behalf of the video driver during run time.

Parameters

The following parameters appear on the blue screen.

Parameter Description
1 Driver-specific
2 Driver-specific
3 Driver-specific
4 The number of all reports that have been requested since boot time

Comments

The video port created a non-fatal minidump on behalf of the video driver during run time because the video driver requested a debug report.

The VIDEO_DRIVER_DEBUG_REPORT_REQUEST bug check can be caused only by minidump creation, not by the creation of a full dump or kernel dump.

    WinDbg Output Example:
Unknown bugcheck code (ad)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000AE:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (ae)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000AF:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (af)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B0:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (b0)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B1:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (b1)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B2:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (b2)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B3:      (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (b3)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B4: VIDEO_DRIVER_INIT_FAILURE    (go to top of page)

Usual causes:  Video driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560133(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xb4

    Knowledge Base Articles:
                      Troubleshooting specific STOP messages
KB 240369    Err Msg: Stop 0x000000B4 The Video Driver Failed to Initialize (2000)
KB 250271    "STOP 0x000000B4" or Black Screen During GUI-Mode Setup on Micron Powerdigm XSU (2000)
KB 319120    Error message: "Stop error code 0x000000B4 The video driver failed to initialize" (2000)

    WinDbg Help File Entry:

The VIDEO_DRIVER_INIT_FAILURE bug check has a value of 0x000000B4. This indicates that Windows was unable to enter graphics mode.

Parameters

None

Cause

The system was not able to go into graphics mode because no display drivers were able to start.

This usually occurs when no video miniport drivers are able to load successfully.

    WinDbg Output Example:
VIDEO_DRIVER_INIT_FAILURE (b4)
The system was not able to go into graphics mode because no display drivers
were able to start.  This usually occurs if no video miniport drivers load
successfully.
Arguments:
Arg1: 0000000000000000, Driver failure data.
Arg2: 0000000000000000, Graphics device list.
Arg3: 0000000000000000, Graphics device list data.
Arg4: 0000000000000000, Indicates generic failure.


STOP 0x000000B5: BOOTLOG_LOADED    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (b5)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B6: BOOTLOG_NOT_LOADED    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (b6)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B7: BOOTLOG_ENABLED    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (b7)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000B8: ATTEMPTED_SWITCH_FROM_DPC    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560140(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xb8

    Knowledge Base Articles:
KB 281428    "Stop 0xB8 ATTEMPTED_SWITCH_FROM_DPC" Error Message When You Use a Parallel Port Zip Drive (2000)
KB 287582    "Stop 0x000000B8" Error Message Occurs After You Install Tivoli Storage Manager (2000 Server)
KB 318988    Stop 0x000000B8 Error Occurs in a Windows 2000 Cluster
KB 319453    Problems with older version of Nwfs.sys file in Novell NetWare Client Version 4.81 (2000)
KB 824354    Your Server Stops Responding or You Receive a Stop Error Message When You Set Up a Windows Server 2003-Based Server Cluster
KB 888190    “Stop 0x000000B8” error message on a computer that has the Dell OpenManage Server Administrator installed in Windows Server 2003 or in Windows Small Business Server 2003
KB 936150    Error message when you wake Windows Vista from sleep: "STOP: 0x000000B8"
KB 980663    Stop error in Windows 7 and in Windows Server 2008 R2 if a heavy load situation exists or if connectivity issues exist: "Stop error code 0x000000B8 (ATTEMPTED_SWITCH_FROM_DPC)"
KB 2194018    "Stop 0xB8 ATTEMPTED_SWITCH_FROM_DPC" Error Message When Resuming SAN Booted Server 2008
KB 2490742    A "0x000000B8" Stop error occurs when you try to shut down or hibernate a computer that is running Windows 7 or Windows Server 2008 R2
KB 2640309    "STOP: 0x000000B8" error when you try to shut down or hibernate a computer that is running Windows Vista, Windows Server 2008, Windows 7 or Windows Server 2008 R2

    WinDbg Help File Entry:

The ATTEMPTED_SWITCH_FROM_DPC bug check has a value of 0x000000B8. This indicates that an illegal operation was attempted by a delayed procedure call (DPC) routine.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The original thread causing the failure
2 The new thread
3 The stack address of the original thread
4 Reserved

Cause

A wait operation, attach process, or yield was attempted from a DPC routine. This is an illegal operation.

Resolving the Problem

The stack trace will lead to the code in the original DPC routine that caused the error.

    WinDbg Output Example:
ATTEMPTED_SWITCH_FROM_DPC (b8)
A wait operation, attach process, or yield was attempted from a DPC routine.
This is an illegal operation and the stack track will lead to the offending
code and original DPC routine.
Arguments:
Arg1: 0000000000000000, Original thread which is the cause of the failure
Arg2: 0000000000000000, New thread
Arg3: 0000000000000000, Stack address of the original thread
Arg4: 0000000000000000


STOP 0x000000B9: CHIPSET_DETECTED_ERROR    (go to top of page)

Usual causes: 

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560144(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The CHIPSET_DETECTED_ERROR bug check has a value of 0x000000B9.

This bug check appears very infrequently.

    WinDbg Output Example:
CHIPSET_DETECTED_ERROR (b9)
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000BA: SESSION_HAS_VALID_VIEWS_ON_EXIT    (go to top of page)

Usual causes:  A bug in win32k.sys, atmfd.dll, rdpdd.dll, or a video driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560151(v=VS.85).aspx

    Knowledge Base Articles:
KB 961974    Stop error when you log off from a Terminal Services session on a terminal server that is running Windows Server 2003 SP1 or Windows Server 2003 SP2: "Stop 0x000000ba"

    WinDbg Help File Entry:

The SESSION_HAS_VALID_VIEWS_ON_EXIT bug check has a value of 0x000000BA. This indicates that a session driver still had mapped views when the session unloaded.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The session ID
2 The number of mapped views that are leaking
3 The address of this session's mapped views table
4 The size of this session's mapped views table

Cause

This error is caused by a session driver not unmapping its mapped views prior to a session unload. This indicates a bug in win32k.sys, atmfd.dll, rdpdd.dll, or a video driver.

    WinDbg Output Example:
SESSION_HAS_VALID_VIEWS_ON_EXIT (ba)
Caused by a session driver not unmapping its mapped views prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000000000000, session ID
Arg2: 0000000000000000, number of mapped views that are leaking
Arg3: 0000000000000000, address of this session's mapped views table
Arg4: 0000000000000000, size of this session's mapped views table.


STOP 0x000000BB: NETWORK_BOOT_INITIALIZATION_FAILED    (go to top of page)

Usual causes: Hardware, Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560155(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The NETWORK_BOOT_INITIALIZATION_FAILED bug check has a value of 0x000000BB. This indicates that Windows failed to successfully boot off a network.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The part of network initialization that failed. Possible values are:

1: Failure while updating the registry.

2: Failure while starting the network stack. Windows sends IOCTLs to the redirector and datagram receiver, then waits for the redirector to be ready. If it is not ready within a certain period of time, this error is issued.

3: Failure while sending the DHCP IOCTL to TCP. This is how Windows informs the transport of its IP address.

2 The failure status
3 Reserved
4 Reserved

Cause

This error is caused when Windows is booting off a network, and a critical function fails during I/O initialization.

    WinDbg Output Example:
NETWORK_BOOT_INITIALIZATION_FAILED (bb)
Caused if we are booting off the network, and a critical function fails during
IO initialization. Currently the codes for the first value are:
1 - updating the registry.
2 - starting the network stack - Windows sends IOCTLs to the redirector and
    datagram receiver, then waits for the redirector to be ready. If it is not
    ready within a certain period of time, initialization fails.
3 - failed sending the DHCP IOCTL to TCP - this is how Windows informs the
    transport of its IP adress.
Arguments:
Arg1: 0000000000000000, the part of network initialization that failed
Arg2: 0000000000000000, the failure status
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000BC: NETWORK_BOOT_DUPLICATE_ADDRESS    (go to top of page)

Usual causes:  As it states, duplicate IP addresses have been assigned

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560159(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The NETWORK_BOOT_DUPLICATE_ADDRESS bug check has a value of 0x000000BC. This indicates that a duplicate IP address was assigned to this machine while booting off a network.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The IP address, shown as a DWORD. An address of the form aa.bb.cc.dd will appear as 0xDDCCBBAA.
2 The hardware address of the other machine. (For an Ethernet connection, see the following note.)
3 The hardware address of the other machine. (For an Ethernet connection, see the following note.)
4 The hardware address of the other machine. (For an Ethernet connection, this will be zero.)

Note  When Parameter 4 equals zero, this indicates an Ethernet connection. In that case, the MAC address will be stored in Parameter 2 and Parameter 3. An Ethernet MAC address of the form aa-bb-cc-dd-ee-ff will cause Parameter 2 to equal 0xAABBCCDD, and Parameter 3 to equal 0xEEFF0000.

Cause

This error indicates that when TCP/IP sent out an ARP for its IP address, it got a response from another machine indicating a duplicate IP address.

When Windows is booting off a network, this is a fatal error.

    WinDbg Output Example:
NETWORK_BOOT_DUPLICATE_ADDRESS (bc)
This indicates that when TCP/IP sent out an ARP for its IP address, it got
a response from another machine, indicating a duplicate IP address. When we
are booting off the network this is a fatal error.
Arguments:
Arg1: 0000000000000000, the IP address, show as a hex DWORD. So an address aa.bb.cc.dd will
    appear as 0xddccbbaa.
Arg2: 0000000000000000, the hardware address of the other machine.
Arg3: 0000000000000000, the hardware address of the other machine.
Arg4: 0000000000000000, the hardware address of the other machine. For Ethernet, a MAC address
    of aa-bb-cc-dd-ee-ff will be indicated by the second parameter
    containing 0xaabbccdd, the third parameter containing 0xeeff0000, and
    the fourth parameter containing 0x00000000.


STOP 0x000000BD: INVALID_HIBERNATED STATE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
INVALID_HIBERNATED_STATE (bd)
The hibernated memory image does not match the current hardware configuration.
This bugcheck occurs when a system resumes from hibernate and discovers that the
hardware has been changed while the system was hibernated.
Note:  This bug check no longer exists in any version of Windows.
Arguments:
Arg1: 0000000000000000, hardware that was invalid
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000BE: ATTEMPTED_WRITE_TO_READONLY_MEMORY    (go to top of page)

Usual causes:  Device driver, Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560161(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xbe

    Knowledge Base Articles:
KB 227693    Installation of SessionWall-3 May Cause Computer to Stop Responding (2000 Server)
KB 306205    The Qwestdex Dex Toolbar Is Not Totally Compatible with Windows XP
KB 956246    Stop error when Windows Server 2008 or Windows Vista SP1 is running in a virtual machine, and the computer that is running the virtual machine has multiple processors: "0x000000BE"
KB 959056    Stop error message when a Windows Server 2008-based computer randomly restarts: "0x000000BE ATTEMPTED_WRITE_TO_READONLY_MEMORY"
KB 983554    "0x000000BE" Stop error message when you use the Storport.sys driver to manage some storage devices in Windows Server 2008 or in Windows Vista
KB 2563727    "0x000000BE" Stop error when you install Windows Vista or Windows Server 2008 if more than two AMD Bulldozer-based 16-core processors are installed


    WinDbg Help File Entry:

The ATTEMPTED_WRITE_TO_READONLY_MEMORY bug check has a value of 0x000000BE. This is issued if a driver attempts to write to a read-only memory segment.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Virtual address of attempted write
2 PTE contents
3 Reserved
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

    WinDbg Output Example:
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory.  The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 81dd7000, Virtual address for the attempted write.
Arg2: 01dd7121, PTE contents.
Arg3: 9730b9f4, (reserved)
Arg4: 0000000b, (reserved)


STOP 0x000000BF: MUTEX_ALREADY_OWNED    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560167(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The MUTEX_ALREADY_OWNED bug check has a value of 0x000000BF. This indicates that a thread attempted to acquire ownership of a mutex it already owned.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The address of the mutex
2 The thread that caused the error
3 0
4 Reserved

    WinDbg Output Example:
MUTEX_ALREADY_OWNED (bf)
This thread is attempting to acquire ownership of a mutex it already owns.
Arguments:
Arg1: 0000000000000000, Address of Mutex
Arg2: 0000000000000000, Thread
Arg3: 0000000000000000, 0
Arg4: 0000000000000000, (reserved)


STOP 0x000000C0: PCI_CONFIT_SPACE_ACCESS_FAILURE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (c0)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000C1: SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560183(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xc1

    Knowledge Base Articles:
KB 953026    You receive a "STOP 0x0000010E" or "STOP 0x000000C1" error message on a Windows Vista-based computer or on a Windows Server 2008-based computer

    WinDbg Help File Entry:

The SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION bug check has a value of 0x000000C1. This indicates that the driver wrote to an invalid section of the special pool.

Parameters

The following parameters are displayed on the blue screen. Parameter 4 indicates the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
Address that the driver tried to free Reserved 0 0x20 A driver attempted to free pool which was not allocated.
Address that the driver tried to free Bytes requested Bytes calculated (actually given to the caller) 0x21,
0x22
A driver attempted to free a bad address.
Address that the driver tried to free Address where bits are corrupted Reserved 0x23 A driver freed an address, but nearby bytes within the same page have been corrupted.
Address that the driver tried to free Address where bits are corrupted Reserved 0x24 A driver freed an address, but bytes occurring after the end of the allocation have been overwritten.
Current IRQL Pool type Number of bytes 0x30 A driver attempted to allocate pool at an incorrect IRQL.
Current IRQL Pool type Address that the driver tried to free 0x31 A driver attempted to free pool at an incorrect IRQL.
Address that the driver tried to free Address where one bit is corrupted Reserved 0x32 A driver freed an address, but nearby bytes within the same page have a single bit error.

The _POOL_TYPE codes are enumerated in ntddk.h. In particular, zero indicates nonpaged pool and one indicates paged pool.

Cause

A driver has written to an invalid section of the special pool.

Resolving the Problem

Obtain a backtrace of the current thread. This backtrace will usually reveal the source of the error.

For information about the special pool, consult the Driver Verifier section of the Windows Driver Kit.

    WinDbg Output Example:
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption.  Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: ba41ef78, address trying to free
Arg2: ba41eb04, address where one bit is corrupted
Arg3: 0083408c, (reserved)
Arg4: 00000032, caller is freeing an address where nearby bytes within the same page have a single bit error


SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption.  Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000, subclass of driver violation.


STOP 0x000000C2: BAD_POOL_CALLER    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560185(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xc2

    Knowledge Base Articles:
KB 265879    How to Debug "Stop 0xC2" or "Stop 0x000000C2" Error Messages (2000)
KB 307151    Computer with ATI RAGE FURY MAXX Video Adapter Stops Responding After Upgrade to Windows XP
KB 309155    "STOP 0x000000c2" Error Message Appears on a Blue Screen After You Install IomegaWare (2000)
KB 310527    Stop Error When You Upgrade from Windows 2000: Bad_Pool_Caller 0xC2
KB 321793    "STOP 0x000000C2 BAD_POOL_CALLER" Error Message on a Cluster Node (2000 Server)
KB 328776    A "Stop 0x000000C2" Error Occurs When You Try to Close a File on a Network Share (2000 Server)
KB 816669    "STOP 0x000000C2" Error Message When Running Terminal Services (2000)
KB 818323    "Stop error code 0x000000C2" error message when the computer resumes from hibernation (2000)
KB 820765    Computer intermittently stops responding and a Stop 0x000000C2 error occurs (2000)
KB 824281    "Stop error code 0x000000C2 (BAD_POOL_CALLER)" error occurs when you print in Windows 2000
KB 829788    "Stop 0xC2 (BAD_POOL_CALLER)" error may occur intermittently on a server that is running Routing and Remote Access with NAT enabled under Windows 2000
KB 888431    "Stop 0x000000C2 BAD_POOL_CALLER" error message in Windows Server 2003
KB 890756    The Windows 2000-based or Windows Server 2003-based server restarts and you receive various error messages
KB 892926    Your computer crashes with a "STOP: 0x000000C2" error when you dismount a SAN drive in Windows Server 2003
KB 896674    You receive a "STOP 0x000000C2" error message on a Windows 2000-based computer
KB 900623    You may receive a "STOP 0x000000C2 BAD_POOL_CALLER" error message when you use ATM network services in Windows 2000
KB 932701    FIX: Stop error message on a Windows Server 2003 R2-based computer that has Subsystem for UNIX-based Applications installed: "000000C2"
KB 935920    When the Emulex Elxsli2.sys driver is installed, you may receive a Stop error message after you upgrade your computer to Windows Server 2003 Service Pack 1
KB 937455    You may receive various Stop error messages on a computer that is running Windows Server 2003
KB 939868    You receive an error message when you access a Web-based program on a Windows XP-based multiprocessor computer
KB 941004    Error message when a NetDDE application is running on a Windows Server 2003-based computer: "Stop 0x000000C2"
KB 944904    Error message on a Windows XP-based computer when you work with a network share: "STOP: 0x000000C2 BAD_POOL_CALLER"
KB 947390    You receive a "Stop 0x000000C2" error message on a Windows Server 2003 R2-based computer if a compressed folder resides on an NTFS volume that has FSRM quota management enabled
KB 957509    Stop error when you use a Microsoft Device Specific Module in Windows Server 2008: "0x000000C2"
KB 958165    Stop error on a Windows Server 2003-based or Windows Server 2008-based computer that has Server for NFS enabled when an NFS client copies data to the NFS server: "Stop 0x000000C2"
KB 967776    Stop errors in Windows Vista or Windows Server 2008: “Stop: 0x00000018” or “STOP: 0x000000C2”
KB 973295    A multiprocessor computer that is running Windows Server 2003 SP2 stops responding under a heavy load if you change a Windows Firewall setting
KB 2479442    Stop error during startup in Windows Server 2008 or in Windows Vista
KB 2639793    "0x000000C2" Stop error occurs when you use IPsec on a computer that is running Windows Server 2008 or Windows Vista in a network that uses IPsec NAT-T security
KB 2641739    "0x000000C2" Stop error when you insert removable media or a removable storage device into a computer that is running Windows 7 or Windows Server 2008 R2
KB 2654363    Computer crashes when you use Driver Verifier to monitor Storport.sys if you disable the HBA in Windows 7 or Windows Server 2008 R2
KB 2719347    Stop error when a Windows 7-based or Windows Server 2008 R2-based computer crashes randomly
KB 2807654    "0x000000C2" Stop error when you try to back up a data deduplication-enabled volume in Windows 8 or Windows Server 2012
KB 2831154    A Stop Error 0x000000C2 in the Srv2.sys file may occur and SMB clients cannot obtain data from the SMB 2 server in a Windows 7 or Windows Server 2008 R2 environment
KB 2850309    "0x000000C2" Stop error when you resume a computer from sleep mode or hibernation on a Windows 8, Windows Server 2012, or Windows RT-based computer

    WinDbg Help File Entry:

The BAD_POOL_CALLER bug check has a value of 0x000000C2. This indicates that the current thread is making a bad pool request.

Parameters

The following parameters are displayed on the blue screen. Parameter 1 indicates the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x00 0 Pool type Pool tag The current thread requested a zero-byte pool allocation.
0x01,
0x02,
or
0x04
Pointer to pool header First part of pool header contents 0 The pool header has been corrupted.
0x06 Reserved Pointer to pool header Pool header contents The current thread attempted to free the pool, which was already freed.
0x07 Reserved Pool header contents Address of the block of pool being freed The current thread attempted to free the pool, which was already freed.
0x08 Current IRQL Pool type Size of allocation, in bytes The current thread attempted to allocate the pool at an invalid IRQL.
0x09 Current IRQL Pool type Address of pool The current thread attempted to free the pool at an invalid IRQL.
0x0A Address of pool Allocator's tag Tag being used in the attempted free The current thread attempted to free pool memory by using the wrong tag.

(The memory might belong to another component.)

0x0B,
0x0C,
or
0x0D
Address of pool Pool allocation's tag Bad quota process pointer The current thread attempted to release a quota on a corrupted pool allocation.
0x40 Starting address Start of system address space 0 The current thread attempted to free the kernel pool at a user-mode address.
0x41 Starting address Physical page frame Highest physical page frame The current thread attempted to free a non-allocated nonpaged pool address.
0x42
or
0x43
Address being freed 0 0 The current thread attempted to free a virtual address that was never in any pool.
0x44 Starting address Reserved 0 The current thread attempted to free a non-allocated nonpaged pool address.
0x46 Starting address 0 0 The current thread attempted to free an invalid pool address.
0x47 Starting address Physical page frame Highest physical page frame The current thread attempted to free a non-allocated nonpaged pool address.
0x48 Starting address Reserved Reserved The current thread attempted to free a non-allocated paged pool address.
0x50 Starting address Start offset, in pages, from beginning of paged pool Size of paged pool, in bytes The current thread attempted to free a non-allocated paged pool address.
0x60 Starting address 0 0 The current thread attempted to free an invalid contiguous memory address.

(The caller of MmFreeContiguousMemory is passing a bad pointer.)

0x99 Address that is being freed 0 0 The current thread attempted to free pool with an invalid address.

(This code can also indicate corruption in the pool header.)

0x9A Pool type Number of bytes requested Pool tag The current thread marked an allocation request MUST_SUCCEED.

(This pool type is no longer supported.)

0x9B Pool type Number of bytes requested Caller's address The current thread attempted to allocate a pool with a tag of 0

(This would be untrackable, and possibly corrupt the existing tag tables.)

0x9C Pool type Number of bytes requested Caller's address The current thread attempted to allocate a pool with a tag of "BIG".

(This would be untrackable and could possibly corrupt the existing tag tables.)

0x9D Incorrect pool tag used Pool type Caller's address The current thread attempted to allocate a pool with a tag that does not contain any letters or digits. Using such tags makes tracking pool issues difficult.
0x41286 Reserved Reserved Start offset from the beginning of the paged pool, in pages The current thread attempted to free a paged pool address in the middle of an allocation.

The _POOL_TYPE codes are enumerated in Ntddk.h. In particular, 0 indicates nonpaged pool and 1 indicates paged pool.

Cause

An invalid pool request has been made by the current thread.

Resolving the Problem

Activate Driver Verifier to obtain more information about these errors. For details, see the Driver Verifier section of the Windows Driver Kit (WDK).

    WinDbg Output Example:
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000099, Attempt to free pool with invalid address  (or corruption in pool header)
Arg2: 86c30ca8, Address being freed
Arg3: 00000000, 0
Arg4: 00000000, 0


BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000000, The caller is requesting a zero byte pool allocation.
Arg2: 0000000000000000, zero.
Arg3: 0000000000000000, the pool type being allocated.
Arg4: 0000000000000000, the pool tag being used.



STOP 0x000000C3: BUGCODE_PSS_MESSAGE_SIGNATURE    (go to top of page)

Usual causes: 

    Knowledge Base Articles:

    WinDbg Help File Entry:

    WinDbg Output Example:
Unknown bugcheck code (c3)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000C4: DRIVER_VERIFIER_DETECTED_VIOLATION    (go to top of page)

Usual causes:  Device driver - see parameters for more information
NOTE:  May occur in Win7 and later w/o Driver Verifier being enabled

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560187(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xc4

    Knowledge Base Articles:
KB 325672    Fatal System Error: 0x000000C4 If Deadlock Detection in Driver Verifier Is Turned on and Norton Antivirus Is Installed (XP, Server 2003)
KB 329703    "STOP" Error Messages in Qafilter.sys or Qsfilter.sys with Third-Party Quota Management Tool (2000)
KB 810148    "Stop 0x000000C4" Error Message When You Disable CardBus Controllers in Device Manager (2000)
KB 897574    You may receive a Stop error message after you insert media into a removable disk device in Windows XP, Windows Server 2003, or Windows 2000
KB 902390    You may receive a Stop error message when you use a scanner in Windows Server 2003 or in Windows XP x64 Edition
KB 932755    An updated Storport storage driver is available for Windows Server 2003
KB 946226    FIX: You receive a "Stop 0x00000019" error message or a "Stop 0x000000c4" error message when you access NFS resources by using User Name Mapping (MS Svcs for Unix)
KB 949012    Stop error message after you enable the Disk Integrity Checking feature of Driver Verifier in a Windows Server 2003 cluster environment: "Stop 0x000000C4"
KB 956469    Stop error message during restart if you enable the Force IRQL Checking setting in Driver Verifier on a computer that is running Windows Server 2003, Datacenter x64 Edition with Service Pack 2: "0x000000C4"
KB 975246    Stop error message when you connect and then disconnect a USB camera from a computer that is running Windows Vista or Windows Server 2008: "Fatal System Error: 0x000000C4 (parameter1, parameter2, parameter3, parameter4) DRIVER_VERIFIER_DETECTED_VI...
KB 2494666    Stop errors may occur after you use the Driver Verifier manager to apply standard settings to all drivers in Windows 7 or in Windows Server 2008 R2

KB 2524840    "0x000000C4" Stop error occurs when you run the "Common Scenario Stress with IO" test on a Windows 7-based computer on which Windows Virtual PC and Windows Logo Kit are installed
KB 2550576    STOP 0xC4 may occur in tcpipreg.sys following a reboot after Driver Verifier is enabled on Windows 7 SP1 or Windows Server 2008 R2 SP1
KB 2661796    "0x000000C4" Stop error when you enable Driver Verifier in Windows 7 or in Windows Server 2008 R2
KB 2724933    Stop error 0x000000C4 during resume from sleep on Windows 7
KB 2801662    "0x000000C4" Stop error when you run the WDF Fault Injection Logo Test in Windows 7 and Windows Server 2008 R2
KB 2816159    "0x000000C4" Stop error after you restart a Windows 8-based or Windows Server 2012-based computer that has the Driver Verifier tool enabled

    WinDbg Help File Entry:

The DRIVER_VERIFIER_DETECTED_VIOLATION bug check has a value of 0x000000C4. This is the general bug check code for fatal errors found by Driver Verifier.

Parameters

Four bug check parameters are displayed on the blue screen. Parameter 1 identifies the type of violation. The meaning of the remaining parameters varies with the value of Parameter 1. The parameter values are described in the following table.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x00 Current IRQL Pool type 0 The driver requested a zero-byte pool allocation.
0x01 Current IRQL Pool type Size of allocation, in bytes The driver attempted to allocate paged memory with IRQL > APC_LEVEL.
0x02 Current IRQL Pool type Size of allocation, in bytes The driver attempted to allocate nonpaged memory with IRQL > DISPATCH_LEVEL.
0x03 (Windows Vista and later operating systems only) Reserved Reserved Reserved The driver attempted to allocate multiple pages of must succeed pool, but at most one page can be allocated using this routine.
0x10 Bad Address 0 0 The driver attempted to free an address that was not returned from an allocate call.
0x11 Current IRQL Pool type Address of pool The driver attempted to free paged pool with IRQL > APC_LEVEL.
0x12 Current IRQL Pool type Address of pool The driver attempted to free nonpaged pool with IRQL > DISPATCH_LEVEL.
0x13
or
0x14
Reserved Pointer to pool header Pool header contents The driver attempted to free memory pool which was already freed.
0x15 Timer entry Pool type (-1 for special pool) Pool address being freed The driver attempted to free pool which contains an active timer.
0x16 Reserved Pool address 0 The driver attempted to free pool at a bad address, or the driver passed invalid parameters to a memory routine.
0x17 Resource entry Pool type (-1 for special pool) Pool address being freed The driver attempted to free pool which contains an active ERESOURCE.
0x30 Current IRQL Requested IRQL 0 The driver passed an invalid parameter to KeRaiseIrql.

(The parameter was either a value lower than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized parameter.)

0x31 Current IRQL Requested IRQL 0: New IRQL is bad

1: New IRQL is invalid inside a DPC routine

The driver passed an invalid parameter to KeLowerIrql.

(The parameter was either a value higher than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized parameter.)

0x32 Current IRQL Spin lock address 0 The driver called KeReleaseSpinLock at an IRQL other than DISPATCH_LEVEL.

(This may be due to a double-release of a spin lock.)

0x33 Current IRQL Fast mutex address 0 The driver attempted to acquire fast mutex with IRQL > APC_LEVEL.
0x34 Current IRQL Fast mutex address 0 The driver attempted to release fast mutex at an IRQL other than APC_LEVEL.
0x35 Current IRQL Spin lock address Old IRQL The kernel released a spin lock with IRQL not equal to DISPATCH_LEVEL.
0x36 Current IRQL Spin lock number Old IRQL The kernel released a queued spin lock with IRQL not equal to DISPATCH_LEVEL.
0x37 Current IRQL Thread APC disable count Resource The driver tried to acquire a resource, but APCs are not disabled.
0x38 Current IRQL Thread APC disable count Resource The driver tried to release a resource, but APCs are not disabled.
0x39 Current IRQL Thread APC disable count Mutex The driver tried to acquire a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry.
0x3A Current IRQL Thread APC disable count Mutex The driver tried to release a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry.
0x3B Current IRQL Object to wait for Time-out parameter The driver called KeWaitXxx with IRQL >= DISPATCH_LEVEL.

(This is permitted only if the driver already owns the DISPATCHER lock and it passes a time-out value of zero to the routine.)

0x3C Handle passed to routine Object type 0 The driver called ObReferenceObjectByHandle with a bad handle.
0x3D 0 0 Address of the bad resource The driver passed a bad (unaligned) resource to ExAcquireResourceExclusive.
0x3E 0 0 0 The driver called KeLeaveCriticalRegion for a thread that is not currently in a critical region.
0x3F Object address New object reference count.

-1: dereference case

1: reference case

0 The driver applied ObReferenceObject to an object that has a reference count of zero, or the driver applied ObDereferenceObject to an object that has a reference count of zero.
0x40 Current IRQL Spin lock address 0 The driver called KeAcquireSpinLockAtDpcLevel with IRQL not equal to DISPATCH_LEVEL.
0x41 Current IRQL Spin lock address 0 The driver called KeReleaseSpinLockFromDpcLevel with IRQL not equal to DISPATCH_LEVEL.
0x42 Current IRQL Spin lock address 0 The driver called KeAcquireSpinLock with IRQL > DISPATCH_LEVEL.
0x51 Base address of allocation Address of the reference beyond the allocation Number of charged bytes The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x52 Base address of allocation Reserved Number of charged bytes The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x53,
0x54,
or
0x59
Base address of allocation Reserved Reserved The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x60 Bytes allocated from paged pool Bytes allocated from nonpaged pool Total number of allocations that were not freed The driver is unloading without first freeing its pool allocations. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x61 Bytes allocated from paged pool Bytes allocated from nonpaged pool Total number of allocations that were not freed A driver thread is attempting to allocate pool memory while the driver is unloading. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x62 Name of the driver Reserved Total number of allocations that were not freed, including both paged and nonpaged pool The driver is unloading without first freeing its pool allocations. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x6F MDL address Physical page being locked Highest physical page in the system The driver passed a page to MmProbeAndLockPages that was not in the PFN database.

(This often results from a driver that attempts to lock its own private dualport RAM. Such behavior can corrupt memory on machines with noncontiguous physical RAM.)

0x70 Current IRQL MDL address Access mode The driver called MmProbeAndLockPages with IRQL > DISPATCH_LEVEL.
0x71 Current IRQL MDL address Process address The driver called MmProbeAndLockProcessPages with IRQL > DISPATCH_LEVEL.
0x72 Current IRQL MDL address Process address The driver called MmProbeAndLockSelectedPages with IRQL > DISPATCH_LEVEL.
0x73 Current IRQL In 32-bit Windows: Low 32 bits of the physical address

In 64-bit Windows: the 64-bit physical address

Number of bytes The driver called MmMapIoSpace with IRQL > DISPATCH_LEVEL.
0x74 Current IRQL MDL address Access mode The driver called MmMapLockedPages in kernel mode with IRQL > DISPATCH_LEVEL.
0x75 Current IRQL MDL address Access mode The driver called MmMapLockedPages in user mode with IRQL > APC_LEVEL.
0x76 Current IRQL MDL address Access mode The driver called MmMapLockedPagesSpecifyCache in kernel mode with IRQL > DISPATCH_LEVEL.
0x77 Current IRQL MDL address Access mode The driver called MmMapLockedPagesSpecifyCache in user mode with IRQL > APC_LEVEL.
0x78 Current IRQL MDL address 0 The driver called MmUnlockPages with IRQL > DISPATCH_LEVEL.
0x79 Current IRQL Virtual address being unmapped MDL address The driver called MmUnmapLockedPages in kernel mode with IRQL > DISPATCH_LEVEL.
0x7A Current IRQL Virtual address being unmapped MDL address The driver called MmUnmapLockedPages in user mode with IRQL > APC_LEVEL.
0x7B Current IRQL Virtual address being unmapped Number of bytes The driver called MmUnmapIoSpace with IRQL > APC_LEVEL.
0x7C MDL address MDL flags 0 The driver called MmUnlockPages, and passed an MDL whose pages were never successfully locked.
0x7D MDL address MDL flags 0 The driver called MmUnlockPages, and passed an MDL whose pages are from nonpaged pool.

(These should never be unlocked.)

0x80 Current IRQL Event address 0 The driver called KeSetEvent with IRQL > DISPATCH_LEVEL.
0x81 MDL address MDL flags 0 The driver called MmMapLockedPages.

(You should use MmMapLockedPagesSpecifyCache instead, with the BugCheckOnFailure parameter set to FALSE.)

0x82 MDL address MDL flags 0 The driver called MmMapLockedPagesSpecifyCache with the BugCheckOnFailure parameter equal to TRUE.

(This parameter should be set to FALSE.)

0x83 Start of physical address range to map Number of bytes to map First page frame number that isn't locked down The driver called MmMapIoSpace without having locked down the MDL pages. The physical pages represented by the physical address range being mapped must have been locked down prior to making this call.
0x84 Start of physical address range to map Number of bytes to map First page frame number that is on the free list The driver called MmMapIoSpace without having locked down the MDL pages (or after freeing the MDL pages).
0x85 MDL address Number of pages to map First page frame number that isn't locked down The driver called MmMapLockedPages without having locked down the MDL pages.
0x86 MDL address Number of pages to map First page frame number that is on the free list The driver called MmMapLockedPages without having locked down the MDL pages (or after freeing the MDL pages).
0x87 Base physical page of the existing mapping

(Shift left for physical address)

Number of pages already mapped in the existing mapping MEMORY_CACHING_TYPE of the existing mapping The driver called MmMapIoSpace, but the caller's cache type conflicts with an existing mapping.
0x88 Base physical page of the requested mapping

(Shift left for physical address)

Number of pages in the requested mapping MEMORY_CACHING_TYPE of the requested mapping The driver called MmMapIoSpace to map a physical range as non-cached or write-combined, but the caller's physical range already has an existing cached mapping.
0x89 MDL address Pointer to the non-memory page in the MDL The non-memory page number in the MDL An MDL is not marked as "I/O", but it contains non-memory page addresses.
0x8A MDL address Base physical page of the requested mapping

(Shift left for physical address)

MEMORY_CACHING_TYPE of the requested mapping The driver called MmMapLockedPagesXxx to map a physical range as non-cached or write-combined, but the caller's physical range already has an existing cached mapping.
0x90 (Windows 2000, Windows XP, and Windows Server 2003 only) Reserved Reserved Reserved The driver switched stacks, and the current stack is neither a thread stack nor a DPC stack.

(Typically, the driver doing this should be on the stack obtained by using the kb (Display Stack Backtrace) command.)

0x91 Reserved Reserved Reserved The driver switched stacks using a method that is not supported by the operating system. The only supported way to extend a kernel mode stack is by using KeExpandKernelStackAndCallout.
0xA0 (Windows Server 2003 and later operating systems only) Pointer to the IRP making the read or write request Device object of the lower device Number of the sector in which the error was detected A cyclic redundancy check (CRC) error was detected on a hard disk. A bug check with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0xA1 (Windows Server 2003 and later operating systems only) Copy of the IRP making the read or write request. (The actual IRP has been completed.) Device object of the lower device Number of the sector in which the error was detected A CRC error was detected on a sector (asynchronously). A bug check with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0xA2 (Windows Server 2003 and later operating systems only) IRP making the read or write request, or a copy of this IRP Device object of the lower device Number of the sector in which the error was detected The CRCDISK checksum copies don't match. This could be a paging error. A bug check with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0xB0 (Windows Vista and later operating systems only) MDL address MDL flags Incorrect MDL flags The driver called MmProbeAndLockPages for an MDL with incorrect flags. For example, the driver passed an MDL created by MmBuildMdlForNonPagedPool to MmProbeAndLockPages.
0xB1 (Windows Vista and later operating systems only) MDL address MDL flags Incorrect MDL flags The driver called MmProbeAndLockProcessPages for an MDL with incorrect flags. For example, the driver passed an MDL created by MmBuildMdlForNonPagedPool to MmProbeAndLockProcessPages.
0xB2 (Windows Vista and later operating systems only) MDL address MDL flags Incorrect MDL flags The driver called MmMapLockedPages for an MDL with incorrect flags. For example, the driver passed an MDL that is already mapped to a system address or that was not locked to MmMapLockedPages.
0xB3 (Windows Vista and later operating systems only) MDL address MDL flags Missing MDL flags (at least one was expected) The driver called MmMapLockedPages for an MDL with incorrect flags. For example, the driver passed an MDL that is not locked to MmMapLockedPages.
0xB4 (Windows Vista and later operating systems only) MDL address MDL flags Unexpected partial MDL flag The driver called MmUnlockPages for a partial MDL. A partial MDL is one that was created by IoBuildPartialMdl.
0xB5 (Windows Vista and later operating systems only) MDL address MDL flags Unexpected partial MDL flag The driver called MmUnmapLockedPages for a partial MDL. A partial MDL is one that was created by IoBuildPartialMdl.
0xB6 (Windows Vista and later operating systems only) MDL address MDL flags Missing MDL flag The driver called MmUnmapLockedPages for an MDL that is not mapped to a system address.
0xB7 (Windows Vista and later operating systems only) Number of corrupted physical pages Address of first corrupted physical page Address of last corrupted physical page The system BIOS has corrupted low physical memory during a sleep transition.
0xC0 (Windows Vista and later operating systems only) Address of the IRP Reserved Reserved The driver called IoCallDriver with interrupts disabled.
0xC1 (Windows Vista and later operating systems only) Address of the driver dispatch routine Reserved Reserved A driver dispatch routine was returned with interrupts disabled.
0xC2 (Windows Vista and later operating systems only) Reserved Reserved Reserved The driver called a Fast I/O dispatch routine after interrupts were disabled.
0xC3 (Windows Vista and later operating systems only) Address of the driver Fast I/O dispatch routine Reserved Reserved A driver Fast I/O dispatch routine was returned with interrupts disabled.
0xC5 (Windows Vista and later operating systems only) Address of the driver dispatch routine Current thread APC disable count Thread APC disable count prior to calling the driver dispatch routine A driver dispatch routine has changed the thread APC disable count. The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, KeInitializeMutex, or FsRtlEnterFileSystem. The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem. Because these calls should always be in pairs, this value should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.
0xC6 (Windows Vista and later operating systems only) Address of the driver Fast I/O dispatch routine Current thread APC disable count Thread APC disable count prior to calling the Fast I/O driver dispatch routine A driver Fast I/O dispatch routine has changed the thread APC disable count. The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, KeInitializeMutex, or FsRtlEnterFileSystem. The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem. Because these calls should always be in pairs, this value should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.
0xCA (Windows Vista and later operating systems only) Address of the lookaside list Reserved Reserved The driver has attempted to re-initialize a lookaside list.
0xCB (Windows Vista and later operating systems only) Address of the lookaside list Reserved Reserved The driver has attempted to delete an uninitialized lookaside list.
0xCC (Windows Vista and later operating systems only) Address of the lookaside list Starting address of the pool allocation Size of the pool allocation The driver has attempted to free a pool allocation that contains an active lookaside list.
0xCD (Windows Vista and later operating systems only) Address of the lookaside list Block size specified by the caller Minimum supported block size The driver has attempted to create a lookaside list with an allocation block size that is too small.
0xD0 (Windows Vista and later operating systems only) Address of the ERESOURCE structure Reserved Reserved The driver has attempted to re-initialize an ERESOURCE structure.
0xD1 (Windows Vista and later operating systems only) Address of the ERESOURCE structure Reserved Reserved The driver has attempted to delete an uninitialized ERESOURCE structure.
0xD2 (Windows Vista and later operating systems only) Address of the ERESOURCE structure Starting address of the pool allocation Size of the pool allocation The driver has attempted to free a pool allocation that contains an active ERESOURCE structure.
0xD5 (Windows Vista and later operating systems only) Address of the IO_REMOVE_LOCK structure created by the checked build version of the driver Current IoReleaseRemoveLock tag Reserved The current IoReleaseRemoveLock tag does not match the previous IoAcquireRemoveLock tag. If the driver calling IoReleaseRemoveLock is not in a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A bug check with this parameter occurs only when the I/O Verification option of Driver Verifier is active.
0xD6 (Windows Vista and later operating systems only) Address of the IO_REMOVE_LOCK structure created by the checked build version of the driver Tag that does not match previous IoAcquireRemoveLock tag Previous IoAcquireRemoveLock tag The current IoReleaseRemoveLockAndWait tag does not match the previous IoAcquireRemoveLock tag. If the driver calling IoReleaseRemoveLock is not a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A bug check with this parameter occurs only when the I/O Verification option of Driver Verifier is active.
0xDA (Windows Vista and later operating systems only) Starting address of the driver WMI callback address inside the driver Reserved An attempt was made to unload a driver that has not deregistered its WMI callback function.
0xDB (Windows Vista and later operating systems only) Address of the device object Reserved Reserved An attempt was made to delete a device object that was not deregistered from WMI.
0xDC (Windows Vista and later operating systems only) Reserved Reserved Reserved An invalid RegHandle value was specified as a parameter of the function EtwUnregister.
0xDD (Windows Vista and later operating systems only) Address of the call to EtwRegister Starting address of the unloading driver Reserved An attempt was made to unload a driver without calling EtwUnregister.
0xE0 (Windows Vista and later operating systems only) User-mode address used as a parameter Size ,in bytes, of the address range used as a parameter Reserved A call was made to an operating system Kernel function that specified a user-mode address as a parameter.
0xE1 (Windows Vista and later operating systems only) Address of the synchronization object Reserved Reserved A synchronization object was found to have an address that was either invalid or pageable.
0xE2 (Windows Vista and later operating systems only) Address of the IRP User-mode address present in the IRP Reserved An IRP with Irp->RequestorMode set to KernelMode was found to have a user-mode address as one of its members.
0xE3 (Windows Vista and later operating systems only) Address of the call to the API User-mode address used as a parameter in the API Reserved A driver has made a call to a kernel-mode ZwXxx routine with a user-mode address as a parameter.
0xE4 (Windows Vista and later operating systems only) Address of the call to the API Address of the malformed UNICODE_STRING structure Reserved A driver has made a call to a kernel-mode ZwXxx routine with a malformed UNICODE_STRING structure as a parameter.
0xE5 (Windows Vista and later operating systems only) Current IRQL Reserved Reserved A call was made to a Kernel API at the incorrect IRQL.
0xEA (Windows Vista and later operating systems only) Current IRQL Thread APC disable count Address of the pushlock A driver has attempted to acquire a pushlock while APCs are enabled.
0xEB (Windows Vista and later operating systems only) Current IRQL Thread APC disable count Address of the pushlock A driver has attempted to release a pushlock while APCs are enabled.
0xF0 (Windows Vista and later operating systems only) Address of the destination buffer Address of the source buffer Number of bytes to copy A driver called the memcpy function with overlapping source and destination buffers.
0xF5 (Windows Vista and later operating systems only) Address of the NULL handle Object type Reserved A driver passed a NULL handle to ObReferenceObjectByHandle.
0x1000 (Windows XP and later operating systems only) Address of the resource Reserved Reserved Self-deadlock: The current thread has tried to recursively acquire a resource. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1001 (Windows XP and later operating systems only) Address of the resource that was the final cause of the deadlock Reserved Reserved Deadlock: A lock hierarchy violation has been found. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.

(Use the !deadlock extension for further information.)

0x1002 (Windows XP and later operating systems only) Address of the resource Reserved Reserved Uninitialized resource: A resource has been acquired without having been initialized first. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1003 (Windows XP and later operating systems only) Address of the resource that is being released deadlocked Address of the resource which should have been released first Reserved Unexpected release: A resource has been released out of the proper order. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1004 (Windows XP and later operating systems only) Address of the resource Address of the thread that acquired the resource Address of the current thread Unexpected thread: The wrong thread is releasing a resource. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1005 (Windows XP and later operating systems only) Address of the resource Reserved Reserved Multiple initialization: A resource is being initialized more than once. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1006 (Windows XP and later operating systems only) Address of the thread being deleted Address of the resource owned by the thread Reserved Thread holds resources: A thread is being deleted without first releasing its resources. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1007 (Windows XP and later operating systems only) Address of the resource Reserved Reserved Unacquired resource: A resource is being released without having first been acquired. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.

Cause

See the description of each code in the Parameters section for a description of the cause. Note that values 0x1000 through 0x1020 for Parameter 1 are deadlock verifier error codes. Further information can be obtained by using the !deadlock extension.

Resolving the Problem

This bug check can only occur when Driver Verifier has been instructed to monitor one or more drivers. If you did not intend to use Driver Verifier, you should deactivate it. You might consider removing the driver which caused this problem as well.

If you are the driver writer, use the information obtained through this bug check to fix the bugs in your code.

After a Memory Allocation Tracking bug check, use the following command in the kernel debugger:

kd> dp ViBadDriver L1; dS @$p

This will return the name of the driver causing the error.

Then use the the !verifier extension:

kd> !verifier 3 drivername.sys

This will return information about the leaked memory allocations.

For full details on Driver Verifier, see the Driver Verifier section of the Windows Driver Kit (WDK).

Comments

The value of Parameter 1 is limited by the Driver Verifier options that are activated.

The _POOL_TYPE codes are enumerated in Ntddk.h. In particular, 0 (zero) indicates nonpaged pool and 1 (one) indicates paged pool.

    WinDbg Output Example:
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000b2, MmMapLockedPages called on an MDL having incorrect flags.
    For example, calling MmMapLockedPages for an MDL
    that is already mapped to a system address is incorrect.
Arg2: fffffa800ad9cf40, MDL address.
Arg3: 000000000000000c, MDL flags.
Arg4: 0000000000000004, Incorrect MDL flags.


DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000000, caller is trying to allocate zero bytes
Arg2: 0000000000000000, current IRQL
Arg3: 0000000000000000, pool type
Arg4: 0000000000000000, number of bytes


STOP 0x000000C5: DRIVER_CORRUPTED_EXPOOL    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560192(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xc5

    Knowledge Base Articles:
KB 302971    "Stop 0x1E" or "Stop 0xc5" After You Install Service Pack 2 and You Use Logitech Mouse Drivers (2000)
KB 324224    "Stop error code 0x000000C5" error message in Windows 2000
KB 961799    A Stop error occurs on a Windows Server 2003-based server when a user accesses shared files on the server by using an SMB connection
KB 967208    You receive a Stop error message some time after you use a 32-bit installer to install an NDIS intermediate driver on a computer that runs a 64-bit version of Windows Server 2003
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)

    WinDbg Help File Entry:

The DRIVER_CORRUPTED_EXPOOL bug check has a value of 0x000000C5. This indicates that the system attempted to access invalid memory at a process IRQL that was too high.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 IRQL at time of reference
3 0: Read

1: Write

4 Address that referenced memory

Cause

The kernel attempted to access pageable memory (or perhaps completely invalid memory) when the IRQL was too high. The ultimate cause of this problem is almost certainly a driver that has corrupted the system pool.

In most cases, this bug check results if a driver corrupts a small allocation (less than PAGE_SIZE). Larger allocations result in bug check 0xD0 (DRIVER_CORRUPTED_MMPOOL).

Resolving the Problem

If you have recently installed any new software, check to see if it is properly installed. Check for updated drivers on the manufacturer's website.

To debug this error, use the special pool option of Driver Verifier. If this fails to reveal the driver that caused the error, use the Global Flags utility to enable the special pool by pool tag.

For information about the special pool, consult the Driver Verifier section of the Windows Driver Kit.

    WinDbg Output Example:
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 834f51c5, address which referenced memory




STOP 0x000000C6: DRIVER_CAUGHT_MODIFYING_FREED_POOL    (go to top of page)

Usual causes:  Device driver, ?Memory

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560193(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xc6

    Knowledge Base Articles:

    WinDbg Help File Entry:

The DRIVER_CAUGHT_MODIFYING_FREED_POOL bug check has a value of 0x000000C6. This indicates that the driver attempted to access a freed memory pool.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 0: Read

1: Write

3 0: Kernel mode

1: User mode

4 Reserved

Comments

The faulty component will be displayed in the current kernel stack. This driver should be either replaced or debugged.

    WinDbg Output Example:
DRIVER_CAUGHT_MODIFYING_FREED_POOL (c6)
An attempt was made to access freed pool memory.  The faulty component is
displayed in the current kernel stack.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: 0000000000000000, previous mode.
Arg4: 0000000000000000, 4.


STOP 0x000000C7: TIMER_OR_DPC_INVALID    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560198(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xc7

    Knowledge Base Articles:

    WinDbg Help File Entry:

The TIMER_OR_DPC_INVALID bug check has a value of 0x000000C7. This is issued if a kernel timer or delayed procedure call (DPC) is found somewhere in memory where it is not permitted.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 0: Timer object

1: DPC object

2: DPC routine

2 Address of object
3 Beginning of memory range checked
4 End of memory range checked

Cause

This condition is usually caused by a driver failing to cancel a timer or DPC before freeing the memory where it resides. When Driver Verifier is active, it will catch such errors and issue this bug check.

Resolving the Problem

If you are the driver writer, use the information obtained through this bug check to fix the bugs in your code.

If you are a system administrator, you should unload the driver if the problem persists.

For full details on Driver Verifier, see the Windows Driver Kit.

    WinDbg Output Example:
TIMER_OR_DPC_INVALID (c7)
Kernel timer or DPC used incorrectly.
Arguments:
Arg1: 0000000000000000, Timer object found in memory which must not contain such items.
Arg2: 0000000000000000, Address of the timer object.
Arg3: 0000000000000000, Start of memory range being checked.
Arg4: 0000000000000000, End of memory range being checked.


STOP 0x000000C8: IRQL_UNEXPECTED_VALUE    (go to top of page)

Usual causes:  Device driver, Lower-level program

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560202(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The IRQL_UNEXPECTED_VALUE bug check has a value of 0x000000C8. This indicates that the processor's IRQL is not what it should be at this time.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 The value of the following bit computation:

(Current IRQL << 16) | (Expected IRQL << 8) | UniqueValue

2 Zero, or APC->KernelRoutine
3 Zero, or APC
4 Zero, or APC->NormalRoutine

You can determine "UniqueValue" by computing (Parameter 1 AND 0xFF). If "UniqueValue" is either zero or one, Parameter 2, Parameter 3, and Parameter 4 will equal the indicated APC pointers. Otherwise, these parameters will equal zero.

Cause

This error is usually caused by a device driver or another lower-level program that changed the IRQL for some period and did not restore the original IRQL at the end of that period. For example, the routine may have acquired a spin lock and failed to release it.

    WinDbg Output Example:
IRQL_UNEXPECTED_VALUE (c8)
The processor's IRQL is not what it should be at this time.  This is
usually caused by a lower level routine changing IRQL for some period
and not restoring IRQL at the end of that period (eg acquires spinlock
but doesn't release it).
        if UniqueValue is 0 or 1
            2 = APC->KernelRoutine
            3 = APC
            4 = APC->NormalRoutine
Arguments:
Arg1: 00000000, (Current IRQL << 16) | (Expected IRQL << 8) | UniqueValue
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000


STOP 0x000000C9: DRIVER_VERIFIER_IOMANAGER_VIOLATION    (go to top of page)

Usual causes:  Driver verifier

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560205(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xc9

    Knowledge Base Articles:
KB 931301    Error message when you attach a device that loads the Serscan.sys driver to a computer that is running Windows Server 2003 Service Pack 2: "STOP: 0x000000c9 DRIVER_VERIFIER_IOMANAGER_VIOLATION"
KB 932132    Certain Windows Server 2003 hotfixes have been repackaged to be compatible with Windows Server 2003 Service Pack 2 (SP2)
KB 942088    Error message when you perform a file operation on a Windows Server 2003-based computer that has IPv6 installed: "Stop 0x000000C9"
KB 950224    A Scalable Networking Pack (SNP) hotfix rollup package is available for Windows Server 2003
KB 2688203    "0x000000D1" and "0x000000C9" Stop errors when Message Queuing moves unsent messages to a dead-letter queue in Windows 7 or in Windows Server 2008 R2

    WinDbg Help File Entry:

The DRIVER_VERIFIER_IOMANAGER_VIOLATION bug check has a value of 0x000000C9. This is the bug check code for all Driver Verifier I/O Verification violations.

Parameters

When Driver Verifier is active and I/O Verification is selected, various I/O violations will cause this bug check to be issued. The following parameters will be displayed on the blue screen. Parameter 1 identifies the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x01 Address of IRP being freed 0 0 The driver attempted to free an object whose type is not IO_TYPE_IRP.
0x02 Address of IRP being freed 0 0 The driver attempted to free an IRP that is still associated with a thread.
0x03 Address of IRP being sent 0 0 The driver passed IoCallDriver an IRP Type not equal to IRP_TYPE.
0x04 Address of device object 0 0 The driver passed IoCallDriver an invalid device object.
0x05 Address of device object associated with offending driver IRQL before IoCallDriver IRQL after IoCallDriver The IRQL changed during a call to the driver dispatch routine.
0x06 IRP status Address of IRP being completed 0 The driver called IoCompleteRequest with a status marked as pending (or equal to -1).
0x07 Address of cancel routine Address of IRP being completed 0 The driver called IoCompleteRequest while its cancel routine was still set.
0x08 Address of device object IRP major function code Exception status code The driver passed IoBuildAsynchronousFsdRequest an invalid buffer.
0x09 Address of device object I/O control code Exception status code The driver passed IoBuildDeviceIoControlRequest an invalid buffer.
0x0A Address of device object 0 0 The driver passed IoInitializeTimer a device object with an already-initialized timer.
0x0C Address of I/O status block 0 0 The driver passed an I/O status block to an IRP, but this block is allocated on a stack which has already unwound past that point.
0x0D Address of user event object 0 0 The driver passed a user event to an IRP, but this event is allocated on a stack which has already unwound past that point.
0x0E Current IRQL Address of IRP 0 The driver called IoCompleteRequest with IRQL > DISPATCH_LEVEL.
0x0F Address of the device object to which the IRP is being sent Pointer to the IRP Pointer to file object The driver sent a create request with a file object that has been closed, or that had its open canceled.

In addition to the errors mentioned in the previous table, there are a number of I/O Verification errors that will cause Driver Verifier to halt the system, but which are not actually bug checks.

These errors cause messages to be displayed on the blue screen, in a crash dump file, and in a kernel debugger. These messages will appear differently in each of these locations. When these errors occur, the hexadecimal bug check code 0xC9 and the bug check string DRIVER_VERIFIER_IOMANAGER_VIOLATION do not appear on the blue screen or in the debugger, although they will appear in a crash dump file.

On the blue screen, the following data will be displayed:

If a kernel-mode crash dump has been enabled, the following information will appear in the crash dump file:

If a kernel debugger is attached to the system which has caused this violation, the following information will be sent to the debugger:

Note  No other bug checks can be ignored in this manner. Only this kind of I/O Verification errors can be ignored, and even these errors can only be ignored if a kernel debugger is attached.

The following table lists those I/O Verification errors that can appear. In Windows 2000, these errors will only be displayed if I/O Verification is set to Level 2.

I/O Error Code Severity Cause of Error
0x200 Unknown This code covers all unknown I/O Verification errors.
0x201 Fatal error A device is deleting itself while there is another device beneath it in the driver stack. This may be because the caller has forgotten to call IoDetachDevice first, or the lower driver may have incorrectly deleted itself.
0x202 Fatal error A driver has attempted to detach from a device object that is not attached to anything. This may occur if detach was called twice on the same device object. (Device object specified.)
0x203 Fatal error A driver has called IoCallDriver without setting the cancel routine in the IRP to NULL. (IRP specified.)
0x204 Fatal error The caller has passed in NULL as a device object. This is fatal. (IRP specified.)
0x205 Fatal error The caller is forwarding an IRP that is currently queued beneath it. The code handling IRPs returning STATUS_PENDING in this driver appears to be broken. (IRP specified.)
0x206 Fatal error The caller has incorrectly forwarded an IRP (control field not zeroed). The driver should use IoCopyCurrentIrpStackLocationToNext or IoSkipCurrentIrpStackLocation. (IRP specified.)
0x207 Fatal error The caller has manually copied the stack and has inadvertently copied the upper layer's completion routine. The driver should use IoCopyCurrentIrpStackLocationToNext. (IRP specified.)
0x208 Fatal error This IRP is about to run out of stack locations. Someone may have forwarded this IRP from another stack. (IRP specified.)
0x209 Fatal error The caller is completing an IRP that is currently queued beneath it. The code handling IRPs returning STATUS_PENDING in this driver appears to be broken. (IRP specified.)
0x20A Fatal error The caller of IoFreeIrp is freeing an IRP that is still in use. (Original IRP and IRP in use specified.)
0x20B Fatal error The caller of IoFreeIrp is freeing an IRP that is still in use. (IRP specified.)
0x20C Fatal error The caller of IoFreeIrp is freeing an IRP that is still queued against a thread. (IRP specified.)
0x20D Fatal error The caller of IoInitializeIrp has passed an IRP that was allocated with IoAllocateIrp. This is illegal and unnecessary, and has caused a quota leak. Check the documentation for IoReuseIrp if this IRP is being recycled.
0x20E Non-fatal error A PNP IRP has an invalid status. (Any PNP IRP must have its status initialized to STATUS_NOT_SUPPORTED.) (IRP specified.)
0x20F Non-fatal error A Power IRP has an invalid status. (Any Power IRP must have its status initialized to STATUS_NOT_SUPPORTED.) (IRP specified.)
0x210 Non-fatal error A WMI IRP has an invalid status. (Any WMI IRP must have its status initialized to STATUS_NOT_SUPPORTED.) (IRP specified.)
0x211 Non-fatal error The caller has forwarded an IRP while skipping a device object in the stack. The caller is probably sending IRPs to the PDO instead of to the device returned by IoAttachDeviceToDeviceStack. (IRP specified.)
0x212 Non-fatal error The caller has trashed or has not properly copied the IRP's stack. (IRP specified.)
0x213 Non-fatal error The caller has changed the status field of an IRP it does not understand. (IRP specified.)
0x214 Non-fatal error The caller has changed the information field of an IRP it does not understand. (IRP specified.)
0x215 Non-fatal error A non-successful non-STATUS_NOT_SUPPORTED IRP status for IRP_MJ_PNP is being passed down stack. (IRP specified.) Failed PNP IRPs must be completed.
0x216 Non-fatal error The previously-set IRP_MJ_PNP status has been converted to STATUS_NOT_SUPPORTED. (IRP specified.)
0x217 Non-fatal error The driver has not handled a required IRP. The driver must update the status of the IRP to indicate whether or not it has been handled. (IRP specified.)
0x218 Non-fatal error The driver has responded to an IRP that is reserved for other device objects elsewhere in the stack. (IRP specified.)
0x219 Non-fatal error A non-successful non-STATUS_NOT_SUPPORTED IRP status for IRP_MJ_POWER is being passed down stack. (IRP specified.) Failed POWER IRPs must be completed.
0x21A Non-fatal error The previously-set IRP_MJ_POWER status has been converted to STATUS_NOT_SUPPORTED. (IRP specified.)
0x21B Non-fatal error A driver has returned a suspicious status. This is probably due to an uninitialized variable bug in the driver. (IRP specified.)
0x21C Warning The caller has copied the IRP stack but not set a completion routine. This is inefficient — use IoSkipCurrentIrpStackLocation instead. (IRP specified.)
0x21D Fatal error An IRP dispatch handler has not properly detached from the stack below it upon receiving a remove IRP. (Device object, dispatch routine, and IRP specified.)
0x21E Fatal error An IRP dispatch handler has not properly deleted its device object upon receiving a remove IRP. (Device object, dispatch routine, and IRP specified.)
0x21F Non-fatal error A driver has not filled out a dispatch routine for a required IRP major function. (IRP specified.)
0x220 Non-fatal error IRP_MJ_SYSTEM_CONTROL has been completed by someone other than the ProviderId. This IRP should either have been completed earlier or should have been passed down. (IRP specified, along with the device object where it was targeted.)
0x221 Fatal error An IRP dispatch handler for a PDO has deleted its device object, but the hardware has not been reported as missing in a bus relations query. (Device object, dispatch routine, and IRP specified.)
0x222 Fatal error A Bus Filter's IRP dispatch handler has detached upon receiving a remove IRP when the PDO is still alive. Bus Filters must clean up in FastIoDetach callbacks. (Device object, dispatch routine, and IRP specified.)
0x223 Fatal error An IRP dispatch handler for a bus filter has deleted its device object, but the PDO is still present. Bus filters must clean up in FastIoDetach callbacks. (Device object, dispatch routine, and IRP specified.)
0x224 Fatal error An IRP dispatch handler has returned a status that is inconsistent with the IRP's IoStatus.Status field. (Dispatch handler routine, IRP, IRP's IoStatus.Status, and returned Status specified.)
0x225 Non-fatal error An IRP dispatch handler has returned a status that is illegal (0xFFFFFFFF). This is probably due to an uninitialized stack variable. To debug this error, use the ln (List Nearest Symbols) command with the specified address.
0x226 Fatal error An IRP dispatch handler has returned without passing down or completing this IRP, or someone forgot to return STATUS_PENDING. (IRP specified.)
0x227 Fatal error An IRP completion routine is in pageable code. (This is never permitted.) (Routine and IRP specified.)
0x228 Non-fatal error A driver's completion routine has not marked the IRP pending if the PendingReturned field was set in the IRP passed to it. This may cause Windows to hang, especially if an error is returned by the stack. (Routine and IRP specified.)
0x229 Fatal error A cancel routine has been set for an IRP that is currently being processed by drivers lower in the stack, possibly stomping their cancel routine. (Routine and IRP specified.)
0x22A Non-fatal error The physical device object (PDO) has not responded to a required IRP. (IRP specified.)
0x22B Non-fatal error The physical device object (PDO) has forgotten to fill out the device relation list with the PDO for the TargetDeviceRelation query. (IRP specified.)
0x22C Fatal error The code implementing the TargetDeviceRelation query has not called ObReferenceObject on the PDO. (IRP specified.)
0x22D Non-fatal error The caller has completed a IRP_MJ_PNP it didn't understand instead of passing it down. (IRP specified.)
0x22E Non-fatal error The caller has completed a successful IRP_MJ_PNP instead of passing it down. (IRP specified.)
0x22F Non-fatal error The caller has completed an untouched IRP_MJ_PNP (instead of passing the IRP down), or non-PDO has failed the IRP using illegal value of STATUS_NOT_SUPPORTED. (IRP specified.)
0x230 Non-fatal error The caller has completed an IRP_MJ_POWER it didn't understand instead of passing it down. (IRP specified.)
0x231 Fatal error The caller has completed a successful IRP_MJ_POWER instead of passing it down. (IRP specified.)
0x232 Non-fatal error The caller has completed an untouched IRP_MJ_POWER (instead of passing the IRP down), or non-PDO has failed the IRP using illegal value of STATUS_NOT_SUPPORTED. (IRP specified.)
0x233 Non-fatal error The version field of the query capabilities structure in a query capabilities IRP was not properly initialized. (IRP specified.)
0x234 Non-fatal error The size field of the query capabilities structure in a query capabilities IRP was not properly initialized. (IRP specified.)
0x235 Non-fatal error The address field of the query capabilities structure in a query capabilities IRP was not properly initialized to -1. (IRP specified.)
0x236 Non-fatal error The UI Number field of the query capabilities structure in a query capabilities IRP was not properly initialized to -1. (IRP specified.)
0x237 Fatal error A driver has sent an IRP that is restricted for system use only. (IRP specified.)
0x238 Warning The caller of IoInitializeIrp has passed an IRP that was allocated with IoAllocateIrp. This is illegal, unnecessary, and negatively impacts performance in normal use. If this IRP is being recycled, see IoReuseIrp in the Windows Driver Kit.
0x239 Warning The caller of IoCompleteRequest is completing an IRP that has never been forwarded via a call to IoCallDriver or PoCallDriver. This may be a bug. (IRP specified.)
0x23A Fatal error A driver has forwarded an IRP at an IRQL that is illegal for this major code. (IRP specified.)
0x23B Non-fatal error The caller has changed the status field of an IRP it does not understand. (IRP specified.)

The following table lists additional I/O Verification errors that can appear in Windows XP and later. Some of these errors will only be revealed if Enhanced I/O Verification is activated.

I/O Error Code Severity Cause of Error
0x23C Fatal error A driver has completed an IRP without setting the cancel routine in the IRP to NULL. (IRP specified.)
0x23D Non-fatal error A driver has returned STATUS_PENDING but did not mark the IRP pending via a call to IoMarkIrpPending. (IRP specified.)
0x23E Non-fatal error A driver has marked an IRP pending but didn't return STATUS_PENDING. (IRP specified.)
0x23F Fatal error A driver has not inherited the DO_POWER_PAGABLE bit from the stack it has attached to. (Device object specified.)
0x240 Fatal error A driver is attempting to delete a device object that has already been deleted via a prior call to IoDeleteDevice.
0x241 Fatal error A driver has detached its device object during a surprise remove IRP. (IRP and device object specified.)
0x242 Fatal error A driver has deleted its device object during a surprise remove IRP. (IRP and device object specified.)
0x243 Fatal error A driver has failed to clear the DO_DEVICE_INITIALIZING flag at the end of AddDevice. (Device object specified.)
0x244 Fatal error A driver has not copied either the DO_BUFFERED_IO or the DO_DIRECT_IO flag from the device object it is attaching to. (Device object specified.)
0x245 Fatal error A driver has set both the DO_BUFFERED_IO and the DO_DIRECT_IO flags. These flags are mutually exclusive. (Device object specified.)
0x246 Fatal error A driver has failed to copy the DeviceType field from the device object it is attaching to. (Device object specified.)
0x247 Fatal error A driver has failed an IRP that cannot legally be failed. (IRP specified.)
0x248 Fatal error A driver has added a device object that is not a PDO to a device relations query. (IRP and device object specified.)
0x249 Non-fatal error A driver has enumerated two child PDOs that returned identical Device IDs. (Both device objects specified.)
0x24A Fatal error A driver has mistakenly called a file I/O function with IRQL not equal to PASSIVE_LEVEL.
0x24B Fatal error A driver has completed an IRP_MN_QUERY_DEVICE_RELATIONS request of type TargetDeviceRelation as successful, but did not properly fill out the request or forward the IRP to the underlying hardware stack. (Device object specified.)
0x24C Non-fatal error A driver has returned STATUS_PENDING but did not mark the IRP pending by a call to IoMarkIrpPending. (IRP specified.)
0x24D Fatal error A driver has passed an invalid device object to a function that requires a PDO. (Device object specified.)

Cause

See the description of each code in the Parameters section for a description of the cause.

Resolving the Problem

This bug check can only occur when Driver Verifier has been instructed to monitor one or more drivers. If you did not intend to use Driver Verifier, you should deactivate it. You might consider removing the driver which caused this problem as well.

If you are the driver writer, use the information obtained through this bug check to fix the bugs in your code.

For full details on Driver Verifier, see the Windows Driver Kit.

    WinDbg Output Example:
DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 0000021f, A driver has not filled out a dispatch routine for a required IRP major function.
Arg2: 8c12bb41, The address in the driver's code where the error was detected.
Arg3: 8cf50f00, IRP address.
Arg4: 00000000


STOP 0x000000CA: PNP_DETECTED_FATAL_ERROR    (go to top of page)

Usual causes:  PnP device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560209(v=VS.85).aspx

    Knowledge Base Articles:
KB 326457    Inserting the Same SmartMedia Adapters Causes a "Stop 0x000000CA" Error Message (XP)
KB 886800    A disk signature changes unexpectedly on a Windows Server 2003 clustered physical disk resource
KB 898446    You receive a "Stop 0x000000CA" error when you use two SCSI storage devices on a Windows Server 2003-based computer
KB 938907    Error message on a Windows Server 2003-based computer: "STOP: 0x000000CA (parameter1, parameter2, parameter3, parameter4) PNP_DETECTED_FATAL_ERROR
KB 957176    Stop error when you plug two infrared (IR) receivers into a computer that is running Windows Vista or Windows Server 2008: "STOP: 0x000000CA"
KB 980856    Stop error in Windows Server 2008 R2: "0x000000CA PNP_DETECTED_FATAL_ERROR"

    WinDbg Help File Entry:

The PNP_DETECTED_FATAL_ERROR bug check has a value of 0x000000CA. This indicates that the Plug and Play Manager encountered a severe error, probably as a result of a problematic Plug and Play driver

Parameters

The following parameters are displayed on the blue screen. Parameter 1 identifies the type of violation.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x1 Address of newly-reported PDO Address of older PDO which has been duplicated Reserved Duplicate PDO: A specific instance of a driver has enumerated multiple PDOs with identical device ID and unique IDs.
0x2 Address of purported PDO Address of driver object Reserved Invalid PDO: An API which requires a PDO has been called with random memory, or with an FDO, or with a PDO which hasn't been initialized.

(An uninitialized PDO is one that has not been returned to Plug and Play by QueryDeviceRelation or QueryBusRelations.)

0x3 Address of PDO whose IDs were queried Address of ID buffer 1: DeviceID

2: UniqueID

3: HardwareIDs

4: CompatibleIDs

Invalid ID: An enumerator has returned an ID which contains illegal characters or isn't properly terminated. (IDs must contain only characters in the ranges 0x20 - 0x2B and 0x2D - 0x7F.)
0x4 Address of PDO with DOE_DELETE_PENDING set Reserved Reserved Invalid enumeration of deleted PDO: An enumerator has returned a PDO which it had previously deleted using IoDeleteDevice.
0x5 Address of PDO Reserved Reserved PDO freed while linked in devnode tree: The object manager reference count on a PDO dropped to zero while the devnode was still linked in the tree. (This usually indicates that the driver is not adding a reference when returning the PDO in a query IRP.)
0x8 Address of PDO whose stack returned the invalid bus relation Total number of PDOs returned as bus relations The index (zero-based) at which the first NULL PDO was found Null pointer returned as a bus relation: One or more of the devices present on the bus is a NULL PDO.
0x9 Connection type that was passed Reserved Reserved Invalid connection type passed to IoDisconnectInterruptEx: A driver has passed an invalid connection type to IoDisconnectInterruptEx. The connection type passed to this routine must match the one returned by a corresponding successful call to IoConnectInterruptEx.
0xA Driver object IRQL after returning from driver callback Combined APC disable count after returning from driver callback Incorrect notify callback behavior: A driver failed to preserve IRQL or combined APC disable count across a Plug 'n' Play notification.
0xB Related PDO Removal relations Reserved Deleted PDO reported as relation: One of the removal relations for the device being removed has already been deleted.

    WinDbg Output Example:
PNP_DETECTED_FATAL_ERROR (ca)
PnP encountered a severe error, either as a result of a problem in a driver or
a problem in PnP itself.  The first argument describes the nature of the
problem, the second argument is the address of the PDO.  The other arguments
vary depending on argument 1.
Arguments:
Arg1: 0000000000000000,
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000


STOP 0x000000CB: DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS    (go to top of page)

Usual causes:  Device driver, Driver verifier

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560212(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xcb

    Knowledge Base Articles:
KB 254813    "Stop 0x000000cb" Uninstalling SMS 2.0 on Windows 2000
KB 825760    You Receive Stop Error 0x00000076 or 0x000000CB When You Quit Your Backup Software (2000, XP)
KB 825820    "0x00000076" or "0x000000CB" Stop Error Occurs When Windows 2000 Server Tries to Run a Process on a Remote Server
KB 951033    Stop error message on a Windows Server 2003-based computer that has Citrix Presentation Server 4.5 installed: "0x00000076" or "0x000000CB"
KB 979742    "0x000000CB" Stop error or "0x00000076" Stop error in Windows Vista or in Windows Server 2008 when you access shared network resources by using SMB version 1 protocol on the computer

    WinDbg Help File Entry:

The DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS bug check has a value of 0x000000CB. This indicates that a driver or the I/O manager failed to release locked pages after an I/O operation.

Parameters

The four parameters listed in the message can have two possible meanings.

If a driver locked these pages, the parameters have the following meaning.

Parameter Description
1 Calling address in the driver that locked the pages
2 Caller of the calling address in driver that locked the pages
3 Address of the MDL containing the locked pages
4 Number of locked pages

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

If the I/O manager locked these pages, the parameters have the following meaning.

Parameter Description
1 Address of the dispatch routine of the top driver on the stack to which the IRP was sent
2 Address of the device object of the top driver on the stack to which the IRP was sent
3 Address of the MDL containing the locked pages
4 Number of locked pages

Comments

This bug check is issued only if the registry value \\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\TrackLockedPages is equal to DWORD 1. If this value is not set, the system will issue the less-informative bug check 0x76 (PROCESS_HAS_LOCKED_PAGES).

Starting with Windows Vista, this bug check can also be issued by Driver Verifier when the Pool Tracking option is enabled.

    WinDbg Output Example:
DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (cb)
Caused by a driver not cleaning up completely after an I/O.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 0000000000000000, The calling address in the driver that locked the pages or if the
    IO manager locked the pages this points to the dispatch routine of
    the top driver on the stack to which the IRP was sent.
Arg2: 0000000000000000, The caller of the calling address in the driver that locked the
    pages. If the IO manager locked the pages this points to the device
    object of the top driver on the stack to which the IRP was sent.
Arg3: 0000000000000000, A pointer to the MDL containing the locked pages.
Arg4: 0000000000000000, The number of locked pages.


STOP 0x000000CC: PAGE_FAULT_IN_FREED_SPECIAL_POOL    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560216(v=VS.85).aspx

    Knowledge Base Articles:
KB 973295    A multiprocessor computer that is running Windows Server 2003 SP2 stops responding under a heavy load if you change a Windows Firewall setting
KB 977694    Stop error message when you access shared files in Windows Server 2008 or in Windows Vista: 0x00000044 or 0x000000CC

    WinDbg Help File Entry:

The PAGE_FAULT_IN_FREED_SPECIAL_POOL bug check has a value of 0x000000CC. This indicates that the system has referenced memory which was earlier freed.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read

1: Write

3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

The system has accessed memory in the special pool which was already freed by a driver. This usually indicates a system-driver synchronization problem.

For information about the special pool, consult the Driver Verifier section of the Windows Driver Kit.

Comments

This cannot be protected by a try - except handler — it can only be protected by a probe.

    WinDbg Output Example:
PAGE_FAULT_IN_FREED_SPECIAL_POOL (cc)
Memory was referenced after it was freed.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: b2632fdc, memory referenced
Arg2: 00000001, value 0 = read operation, 1 = write operation
Arg3: 81cf63b8, if non-zero, the address which referenced memory.
Arg4: 00000000, Mm internal code.


STOP 0x000000CD: PAGE_FAULT_BEYOND_END_OF_ALLOCATION    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560219(v=VS.85).aspx

    Knowledge Base Articles:
KB 323256    Stop 0x50 Error Message When You Rename a Large Number of Files on Windows 2000
KB 829729    Special Pool Feature May Cause a 0x000000CD Stop Error (2000)
KB 836587    FIX: You may receive a "PAGE_FAULT_BEYOND_END_OF_ALLOCATION" stop error when you enable event logging in Server for NFS in Windows Services for UNIX 3.0 or 3.5
KB 2280732    You receive Stop error message 0x000000CD or 0x00000019 on a computer that is running Windows Server 2003 when corrupted registry hive files are loaded
KB 2870079    Windows 7 SP1 bluescreen happened during stress tests

    WinDbg Help File Entry:

The PAGE_FAULT_BEYOND_END_OF_ALLOCATION bug check has a value of 0x000000CD. This indicates that the system accessed memory beyond the end of some driver's pool allocation.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read

1: Write

3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

The driver allocated n bytes of memory from the special pool. Subsequently, the system referenced more than n bytes from this pool. This usually indicates a system-driver synchronization problem.

For information about the special pool, consult the Driver Verifier section of the Windows Driver Kit.

Comments

This cannot be protected by a try - except handler — it can only be protected by a probe.

    WinDbg Output Example:
PAGE_FAULT_BEYOND_END_OF_ALLOCATION (cd)
N bytes of memory was allocated and more than N bytes are being referenced.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff9800c6e7000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: fffff8000246cc5c, if non-zero, the address which referenced memory.
Arg4: 0000000000000000, Mm internal code.


STOP 0x000000CE: DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560226(v=VS.85).aspx
    AUMHA Listing:  http://aumha.org/a/stop.php#0xce

    Knowledge Base Articles:
KB 290114    "Stop 0x000000CE" in Vga.dll When You Try to Change Display Settings (2000)
KB 293410    STOP 0x000000CE Error Message Occurs in Vga.sys (2000)
KB 296946    "STOP 0x000000CE" Error Message in Raspppoe.sys During Upgrade from Windows NT 4.0 to Windows 2000
KB 301515    Error Message on a Blue Screen When You Stop SFU 2.0 NFS Client Service on Windows XP-Based Computer
KB 310899    "STOP 0x000000CE in Dxapi.sys" Error on Computer Where Video Adapter Has TV Tuner or Video Capture Feature (XP)
KB 327643    You Receive a "Stop 0x000000CE" Error Message During Shutdown (2000 Server)
KB 329710    "Stop 0x000000CE" Error Message During Startup (2000 Server)
KB 810022    Bugcheck with Stop Message "STOP 0x000000CE" and Svr.sys in Crashdump When Computer Shuts Down (2000)
KB 810038    Stop 0x000000E3 error occurs when redirector thread tries to release a lock (2000)
KB 875430    You receive a "Stop 0x000000CE" Stop error message when you change the resources of a parallel port device in Device Manager on your Windows 2000-based computer
KB 927547    Stop error message when you try to shut down Windows Server 2003: "STOP 0x000000CE DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS"
KB 938512    Error message when you perform a surprise removal of a USB device on a Windows XP Service Pack 2-based computer: "STOP 0x000000CE DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS"
KB 960882    Error message when a Windows Server 2003-based computer is shutting down: "Stop 0x000000CE" or "Stop 0x00000050"
KB 976488    You receive a "Stop 0x000000CD" error on the restart after you run Windows Update on a virtual machine that is running Windows Server 2000 SP4
KB 2004709    You may revieve an system blue screen in usbvideo.sys when sleeping or resuming a system running Microsoft Windows 7

    WinDbg Help File Entry:

The DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS bug check has a value of 0x000000CE. This indicates that a driver failed to cancel pending operations before unloading.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read

1: Write

3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

This driver failed to cancel lookaside lists, DPCs, worker threads, or other such items before unload.

    WinDbg Output Example:
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce)
A driver unloaded without cancelling timers, DPCs, worker threads, etc.
The broken driver's name is displayed on the screen.
Arguments:
Arg1: fffffa60044f4674, memory referenced
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation
Arg3: fffffa60044f4674, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, Mm internal code.


STOP 0x000000CF: TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560231(v=VS.85).aspx

    Knowledge Base Articles:

    WinDbg Help File Entry:

The TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE bug check has a value of 0x000000CF. This indicates that a driver has been incorrectly ported to the terminal server.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory address referenced
2 0: Read

1: Write

3 Address that referenced memory (if known)
4 Reserved

If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause

The driver is referencing session space addresses from the system process context. This probably results from the driver queuing an item to a system worker thread.

This driver needs to comply with Terminal Server's memory management rules.

    WinDbg Output Example:
TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE (cf)
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: 0000000000000000, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, Mm internal code.
    A driver has been incorrectly ported to Terminal Server.  It is referencing
    session space addresses from the system process context.  Probably from
    queueing an item to a system worker thread.
    The broken driver's name is displayed on the screen.


STOP 0x000000D0: DRIVER_CORRUPTED_MMPOOL    (go to top of page)

Usual causes:  Device driver

    MSDN Listing (WDK):               http://msdn.microsoft.com/en-us/library/ff560239(v=VS.85).aspx

    Knowledge Base Articles:
KB 969550    A Stop error occurs on an HP ProLiant server that has the firmware from an E200/E200i HP Smart Array SAS/SATA controller installed on any Windows Server platform (2000 Server, Server 2003, Server 2008)

    WinDbg Help File Entry:

The DRIVER_CORRUPTED_MMPOOL bug check has a value of 0x000000D0. This indicates that the system attempted to access invalid memory at a process IRQL that was too high.

Parameters

The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced