BugCodes.txt-10

Subscribe to the RSS feed Last updated: 22 Oct 2015

bugcodes.txt

Win10 SDK

BugChecks and what to do about them:

Bugchecks with no descriptions are either checked builds
only or very rare. If you get one of these and a kernel
debugger is available do the following
kb
!process 0 7
!vm
!errlog

Note:
Please use following format for modifications in this file, it helps
the debugger to extract the description text from this file:

PARAMETERS
-
VALUES: - If parameter values are explained.
:
-
-
-
:
-
VALUES: - If parameter values are explained.
:
END_VALUES
-

-
END_VALUES
DESCRIPTION - if more description text for bugcheck follows

APC_INDEX_MISMATCH (0x1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->CombinedApcDisable field. This consists of two separate 16-bit
fields, the SpecialApcDisable and the KernelApcDisable. A negative value
of either indicates that a driver has disabled special or normal APCs
(respectively) without re-enabling them; a positive value indicates that
a driver has enabled special or normal APCs (respectively) too many times.

PARAMETERS
1 - Address of system call function or worker routine
2 - Thread->ApcStateIndex
3 - (Thread->SpecialApcDisable << 16) | Thread->KernelApcDisable
4 - Call type (0 - system call, 1 - worker routine)

DEVICE_QUEUE_NOT_BUSY (0x2)

INVALID_AFFINITY_SET (0x3)

INVALID_DATA_ACCESS_TRAP (0x4)

INVALID_PROCESS_ATTACH_ATTEMPT (0x5)

INVALID_PROCESS_DETACH_ATTEMPT (0x6)

INVALID_SOFTWARE_INTERRUPT (0x7)

IRQL_NOT_DISPATCH_LEVEL (0x8)

IRQL_NOT_GREATER_OR_EQUAL (0x9)

IRQL_NOT_LESS_OR_EQUAL (0xA)
PARAMETERS
1 - memory referenced
2 - IRQL
3 - bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
4 - address which referenced memory

DESCRIPTION
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

NO_EXCEPTION_HANDLING_SUPPORT (0xB)

MAXIMUM_WAIT_OBJECTS_EXCEEDED (0xC)

MUTEX_LEVEL_NUMBER_VIOLATION (0xD)

NO_USER_MODE_CONTEXT (0xE)

SPIN_LOCK_ALREADY_OWNED (0xF)

SPIN_LOCK_NOT_OWNED (0x10)

THREAD_NOT_MUTEX_OWNER (0x11)

TRAP_CAUSE_UNKNOWN (0x12)

PARAMETERS
1 - Unexpected interrupt.
2 - Unknown floating point exception.
3 - The enabled and asserted status bits (see processor definition).

EMPTY_THREAD_REAPER_LIST (0x13)

CREATE_DELETE_LOCK_NOT_LOCKED (0x14)

LAST_CHANCE_CALLED_FROM_KMODE (0x15)

CID_HANDLE_CREATION (0x16)

CID_HANDLE_DELETION (0x17)

REFERENCE_BY_POINTER (0x18)
PARAMETERS
1 - Object type of the object whose reference count is being lowered
2 - Object whose reference count is being lowered
3 - Reserved
4 - Reserved

The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object’s reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.

BAD_POOL_HEADER (0x19)

The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
PARAMETERS
1 -
VALUES:
2 : the verifier pool pattern check failed. The owner has likely corrupted the pool block
Parameter 2 - the pool entry being checked.
Parameter 3 - size of the block.
Parameter 4 - 0.

3 : the pool freelist is corrupt.
Parameter 2 - the pool entry being checked.
Parameter 3 - the read back flink freelist value (should be the same as 2).
Parameter 4 - the read back blink freelist value (should be the same as 2).

5 : the adjacent pool block headers are corrupt.
Parameter 2 - One entry whose headers are not consistent.
Parameter 3 - (reserved)
Parameter 4 - Another entry whose headers are not consistent.

6 : the pool block header previous size is corrupt (too large).
Parameter 2 - One incorrectly calculated entry.
Parameter 3 - (reserved)
Parameter 4 - The bad entry that caused the miscalculation.

7 : the pool block header size is corrupt.
Parameter 2 - 0.
Parameter 3 - (reserved)
Parameter 4 - The bad pool entry.

8 : the pool block header size is corrupt.
Parameter 2 - 0.
Parameter 3 - (reserved)
Parameter 4 - The bad pool entry (should have nonzero size but doesn't).

9 : the pool block header size is corrupt (too large).
Parameter 2 - One incorrectly calculated entry.
Parameter 3 - (reserved)
Parameter 4 - The bad entry that caused the miscalculation.

0xA : a pool block header size is corrupt.
Parameter 2 - The pool entry we were looking for within the page.
Parameter 3 - (reserved)
Parameter 4 - The VA of the page that should have contained the pool entry.

0x20 : a pool block header size is corrupt.
Parameter 2 - The pool entry we were looking for within the page.
Parameter 3 - The next pool entry.
Parameter 4 - (reserved)

0x21 : the data following the pool block being freed is corrupt. Typically this means the consumer (call stack ) has overrun the block.
Parameter 2 - The pool pointer being freed.
Parameter 3 - The number of bytes allocated for the pool block.
Parameter 4 - The corrupted value found following the pool block.

END_VALUES

MEMORY_MANAGEMENT (0x1A)

PARAMETERS
1 - The subtype of the bugcheck.
VALUES:
0x1 : The fork clone block reference count is corrupt. Only occurs
on checked builds.
0x777 : The caller is unlocking a system cache address that is not
currently locked. (This address was either never mapped or
is being unlocked twice.)
0x778 : The system is using the very last system cache view address,
instead of preserving it.
0x780 : The PTEs mapping the argument system cache view have been
corrupted.
0x781 : The PTEs mapping the argument system cache view have been
corrupted.
0x1000 : A caller of MmGetSystemAddressForMdl* tried to map a fully-
cached physical page as non-cached. This action would cause
a conflicting hardware translation buffer entry, and so it
was refused by the operating system. Since the caller
specified "bugcheck on failure" in the requesting MDL, the
system had no choice but to bugcheck in this instance.
0x1010 : The caller is unlocking a pageable section that is not
currently locked. (This section was either never locked or
is being unlocked twice.)
0x1234 : The caller is trying lock a nonexistent pageable section.
0x1235 : The caller is trying to protect an MDL with an invalid
mapping.
0x3451 : The PTEs of an outswapped kernel thread stack are corrupt.
0x5200 : A page on a free pool SLIST has been corrupted. This can be the result
of a write-after-free bug in a driver, or an overrun from a previous
page. Parameter 2 contains the address of a free pool block. Parameter 4
contains the value that was expected to be at that address. Parameter 3
contains the actual value that was found.
0x8888 : Internal memory management structures are corrupt.
0x8889 : Internal memory management structures are corrupt.
0x888A : Internal memory management structures (likely the PTE or PFN) are corrupt.
0x41283 : The working set index encoded in the PTE is corrupt.
0x41284 : A PTE or the working set list is corrupt.
0x41286 : The caller is trying to free an invalid pool address.
0x41785 : The working set list is corrupt.
0x41287 : An illegal page fault occurred while holding working set synchronization.
Parameter 2 contains the referenced virtual address.
0x41790 : A page table page has been corrupted. On a 64 bit OS, parameter 2
contains the address of the PFN for the corrupted page table page.
On a 32 bit OS, parameter 2 contains a pointer to the number of used
PTEs, and parameter 3 contains the number of used PTEs.
0x41792 : A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
0x61940 : A PDE has been unexpectedly invalidated.
0x03030303 : (Ia64 Only) Boot loader is broken, machine needs new boot loader.
END_VALUES

DESCRIPTION
# Any other values for parameter 1 must be individually examined.

PFN_SHARE_COUNT (0x1B)

PFN_REFERENCE_COUNT (0x1C)

NO_SPIN_LOCK_AVAILABLE (0x1D)

KMODE_EXCEPTION_NOT_HANDLED (0x1E)
PARAMETERS
1 - The exception code that was not handled
VALUES
0x80000002: (STATUS_DATATYPE_MISALIGNMENT) An unaligned data reference was encountered.
The trap frame will supply additional information.
0x80000003: This means a hard coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
END_VALUES
2 - The address that the exception occurred at
3 - Parameter 0 of the exception
4 - Parameter 1 of the exception

SHARED_RESOURCE_CONV_ERROR (0x1F)

KERNEL_APC_PENDING_DURING_EXIT (0x20)
PARAMETERS
1 - The address of the APC found pending during exit.
2 - The thread's APC disable count
3 - The current IRQL

DESCRIPTION
The key data item is the thread's APC disable count.
If this is non-zero, then this is the source of the problem.

The APC disable count is decremented each time a driver calls
KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a mutex. The APC
disable count is incremented each time a driver calls KeLeaveCriticalRegion,
FsRtlExitFileSystem, or KeReleaseMutex. Since these calls should always be in
pairs, this value should be zero when a thread exits. A negative value
indicates that a driver has disabled APC calls without re-enabling them. A
positive value indicates that the reverse is true.

If you ever see this error, be very suspicious of all drivers installed on the
machine -- especially unusual or non-standard drivers. Third party file
system redirectors are especially suspicious since they do not generally
receive the heavy duty testing that NTFS, FAT, RDR, etc receive.

This current IRQL should also be 0. If it is not, that a driver's
cancelation routine can cause this bugcheck by returning at an elevated
IRQL. Always attempt to note what you were doing/closing at the
time of the crash, and note all of the installed drivers at the time of
the crash. This symptom is usually a severe bug in a third party
driver.

QUOTA_UNDERFLOW (0x21)
PARAMETERS
1 - The process (if any) that was initially charged.
2 - The quota type in question (paged pool, nonpaged pool, etc.)
3 - The initial charge amount to return.
4 - The remaining (unreturned) charge.

DESCRIPTION
This bugcheck occurs if a kernel component mishandles quota charges and
returns more quota than was previously charged to a particular quota block.

FILE_SYSTEM (0x22)

FAT_FILE_SYSTEM (0x23)

If you see FatExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.

NTFS_FILE_SYSTEM (0x24)

If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.

NPFS_FILE_SYSTEM (0x25)

CDFS_FILE_SYSTEM (0x26)

If you see CdExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.

RDR_FILE_SYSTEM (0x27)
If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.

The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,

CORRUPT_ACCESS_TOKEN (0x28)

SECURITY_SYSTEM (0x29)

INCONSISTENT_IRP (0x2A)
PARAMETERS
1 - Address of the IRP that was found to be inconsistent

DESCRIPTION
An IRP was encountered that was in an inconsistent state; i.e., some field
or fields of the IRP were inconsistent w/the remaining state of the IRP.
An example would be an IRP that was being completed, but was still marked
as being queued to a driver's device queue. This bugcheck code is not
currently being used in the system, but exists for debugging purposes.

PANIC_STACK_SWITCH (0x2B)
PARAMETERS
1 - Trap Frame
DESCRIPTION
This error indicates that the kernel mode stack was overrun. This normally
occurs when a kernel-mode driver uses too much stack space. It can also
occur when serious data corruption occurs in the kernel.

PORT_DRIVER_INTERNAL (0x2C)

SCSI_DISK_DRIVER_INTERNAL (0x2D)

DATA_BUS_ERROR (0x2E)
This bugcheck is normally caused by a parity error in the system memory.
PARAMETERS
1 - Virtual address that caused the fault
2 - Physical address that caused the fault.
3 - Processor status register (PSR)
4 - Faulting instruction register (FIR)
DESCRIPTION
This error can also be caused by a driver accessing a bad virtual
address whose backing physical address does not exist.

INSTRUCTION_BUS_ERROR (0x2F)

SET_OF_INVALID_CONTEXT (0x30)

Attempt to set the stack pointer in the trap frame to a lower value than
the current stack pointer value. This would cause the kernel run with a
stack pointer pointing to stack which is no longer valid.
PARAMETERS
1 - New stack pointer
2 - Old stack pointer
3 - TrapFrame address
4 - 0

PHASE0_INITIALIZATION_FAILED (0x31)

System init failed early on. A debugger is required to analyze this.

PHASE1_INITIALIZATION_FAILED (0x32)
PARAMETERS
1 - NT status code that describes why the system initialization failed.
2 - (reserved)
3 - (reserved)

UNEXPECTED_INITIALIZATION_CALL (0x33)

CACHE_MANAGER (0x34)
See the comment for FAT_FILE_SYSTEM (0x23)

NO_MORE_IRP_STACK_LOCATIONS (0x35)
PARAMETERS
1 - Address of the IRP

DESCRIPTION
A higher level driver has attempted to call a lower level driver through
the IoCallDriver() interface, but there are no more stack locations in the
packet, hence, the lower level driver would not be able to access its
parameters, as there are no parameters for it. This is a disasterous
situation, since the higher level driver "thinks" it has filled in the
parameters for the lower level driver (something it MUST do before it calls
it), but since there is no stack location for the latter driver, the former
has written off of the end of the packet. This means that some other memory
has probably been trashed at this point.

DEVICE_REFERENCE_COUNT_NOT_ZERO (0x36)
PARAMETERS
1 - Address of the device object

DESCRIPTION
A device driver has attempted to delete one of its device objects from the
system but the reference count for that object was non-zero, meaning that
there are still outstanding references to the device. (The reference count
indicates the number of reasons why this device object cannot be deleted.)
This is a bug in the calling device driver.

FLOPPY_INTERNAL_ERROR (0x37)

SERIAL_DRIVER_INTERNAL (0x38)

SYSTEM_EXIT_OWNED_MUTEX (0x39)

SYSTEM_UNWIND_PREVIOUS_USER (0x3A)

SYSTEM_SERVICE_EXCEPTION (0x3B)
An exception happened while executing a system service routine.

PARAMETERS
1- Exception code that caused the bugcheck
2- Address of the instruction which caused the bugcheck
3- Address of the context record for the exception that caused the bugcheck
4- zero.

INTERRUPT_UNWIND_ATTEMPTED (0x3C)

INTERRUPT_EXCEPTION_NOT_HANDLED (0x3D)

MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED (0x3E)
The system has multiple processors, but they are asymmetric in relation
to one another. In order to be symmetric all processors must be of
the same type and level. For example, trying to mix a Pentium level
processor with an 80486 would cause this bugcheck.

NO_MORE_SYSTEM_PTES (0x3F)
PARAMETERS
1 - PTE Type (0 - system expansion, 1 nonpaged pool expansion)
2 - Requested size
3 - Total free system PTEs
4 - Total system PTEs

DESCRIPTION
No System PTEs left. Usually caused by a driver not cleaning up
properly. If kernel debugger available get stack trace and
"!sysptes 3".

Set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\TrackPtes
to a DWORD 1 value and reboot. Then the system will save stack traces
so the guilty driver can be identified. There is no other way to find out
which driver is neglecting to clean up the I/Os.

A bugcheck DRIVER_USED_EXCESSIVE_PTES will then occur if the system runs out of
PTEs again and the offending driver's name will be printed.

TARGET_MDL_TOO_SMALL (0x40)

A driver has called the IoBuildPartialMdl() function and passed it an MDL
to map part of a source MDL, but the target MDL is not large enough to map
the entire range of addresses requested. This is a driver bug. The source
and target MDLs, as well as the address range length to be mapped are the
arguments to the IoBuildPartialMdl() function, i.e.;

IoBuildPartialMdl(
IN PMDL SourceMdl,
IN OUT PMDL TargetMdl,
IN PVOID VirtualAddress,
IN ULONG Length
)

MUST_SUCCEED_POOL_EMPTY (0x41)

PARAMETERS
1 - size of the request that could not be satisfied
2 - number of pages used of nonpaged pool
3 - number of > PAGE_SIZE requests from nonpaged pool
4 - number of pages available

DESCRIPTION
No component should ever ask for must-succeed pool as if there is none left,
the system crashes. Instead, components should ask for normal pool and
gracefully handle the scenario where the pool is temporarily empty. This
bugcheck definitely reveals a bug in the caller (use kb to identify the caller).
In addition, the fact that the pool is empty may be either a transient condition
or possibly a leak in another component (distinguish between the 2 cases by
following the directions below).

Type kb to show the calling stack.
Type !vm 1 to display total pool usage.
Then type !poolused 2 to display per-tag nonpaged pool usage.
Then type !poolused 4 to display per-tag paged pool usage.
The crash should be looked at by the tag owner that is consuming the most pool.

ATDISK_DRIVER_INTERNAL (0x42)

NO_SUCH_PARTITION (0x43)

MULTIPLE_IRP_COMPLETE_REQUESTS (0x44)
PARAMETERS
1 - Address of the IRP

DESCRIPTION
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed. This is a tough bug to find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened. Rather, two separate drivers each
believe that they own the packet, and each attempts to complete it. The
first actually works, and the second fails. Tracking down which drivers
in the system actually did this is difficult, generally because the trails
of the first driver have been covered by the second. However, the driver
stack for the current request can be found by examining the DeviceObject
fields in each of the stack locations.

INSUFFICIENT_SYSTEM_MAP_REGS (0x45)

DEREF_UNKNOWN_LOGON_SESSION (0x46)

REF_UNKNOWN_LOGON_SESSION (0x47)

CANCEL_STATE_IN_COMPLETED_IRP (0x48)
PARAMETERS
1 - Pointer to the IRP
2 - Cancel routine set by the driver.

DESCRIPTION
This bugcheck indicates that an I/O Request Packet (IRP) that is to be
cancelled, has a cancel routine specified in it -- meaning that the packet
is in a state in which the packet can be cancelled -- however, the packet
no longer belongs to a driver, as it has entered I/O completion. This is
either a driver bug, or more than one driver is accessing the same packet,
which is not likely and much more difficult to find. The cancel routine
parameter will provide a clue as to which driver or stack is the culprit.

PAGE_FAULT_WITH_INTERRUPTS_OFF (0x49)

IRQL_GT_ZERO_AT_SYSTEM_SERVICE (0x4A)

Returning to usermode from a system call at an IRQL > PASSIVE_LEVEL.
PARAMETERS
1 - Address of system function (system call routine)
2 - Current IRQL
3 - 0
4 - 0

STREAMS_INTERNAL_ERROR (0x4B)

FATAL_UNHANDLED_HARD_ERROR (0x4C)

If a hard error occurs during system booting before windows is up, and
the hard error is a real error, the system will blue screen crash.

Some common cases are:

x218 - This means a necessary registry hive file could not be
loaded. The obvious reason is if it is corrupt or missing.
In this case, either the Emergency Repair Disk or a
reinstall is required.

Some less obvious reasons are that the driver has corrupted
the registry data while loading into memory, or the memory
where the registry file was loaded is not actually memory.

x21a - This means that either winlogon, or csrss (windows) died
unexpectedly. The exit code tells more information. Usually
it is c0000005 meaning that an unhandled exception crashed
either of these processes.

x221 - This means that a driver is corrupt, or a system DLL was
detected to be corrupt.

Safeboot or boot an alternate OS (or reinstall)
and then make sure the on disk file that is listed as bad
matches the version on CD and replace if necessary. In some
cases, random corruption can mean that there is a hardware
problem in the I/O path to the file.

NO_PAGES_AVAILABLE (0x4D)
PARAMETERS
1 - Total number of dirty pages
2 - Number of dirty pages destined for the pagefile(s).
3 - Internal flags.
4 - Most recent modified write error status.

DESCRIPTION
No free pages available to continue operations.
If kernel debugger available "!vm 3".

This bugcheck can occur for the following reasons:

1. A driver has blocked, deadlocking the modified or mapped
page writers. Examples of this include mutex deadlocks or
accesses to paged out memory in filesystem drivers, filter
drivers, etc. This indicates a driver bug.

If parameter 1 or 2 is large, then this is a possibility. Type
"!vm 3" in the kernel debugger.

2. The storage driver(s) are not processing requests. Examples
of this are stranded queues, non-responding drives, etc. This
indicates a driver bug.

If parameter 1 or 2 is large, then this is a possibility. Type
"!process 0 7" in the kernel debugger.

3. Not enough pool is available for the storage stack to write out
modified pages. This indicates a driver bug.

If parameter 3 is small, then this is a possibility. Type
"!vm" and "!poolused 2" in the kernel debugger.

4. A high priority realtime thread has starved the balance set
manager from trimming pages and/or starved the modified writer
from writing them out. This indicates a bug in the component
that created this thread.

This one is hard to determine, try "!ready"

5. All the processes have been trimmed to their minimums and all
modified pages written, but still no memory is available. The
freed memory must be stuck in transition pages with non-zero
reference counts - thus they cannot be put on the freelist.
A driver is neglecting to unlock the pages preventing the
reference counts from going to zero which would free the pages.
This may be due to transfers that never finish and the driver
never aborts or other driver bugs.

If parameter 4 is large, then this is a possibility. But it
is very hard to find the driver. Try "!process 0 1" and look
for any that have a lot of locked pages.

If the problem cannot be found, then try booting with /DEBUG and a kernel
debugger attached, so if it reproduces, a debug session can be initiated
to identify the cause.

PFN_LIST_CORRUPT (0x4E)
PARAMETERS
1 -
VALUES:
1 : A list head was corrupt
2 - ListHead value which was corrupt
3 - number of pages available
4 - 0
2 : A list entry was corrupt
2 - entry in list being removed
3 - highest physical page number
4 - reference count of entry being removed
7 : A driver has unlocked a page more times than it locked it
2 - page frame number
3 - current share count
4 - 0
0x8F : The free or zeroed page listhead is corrupt
2 - new page
3 - old page
4 - 0
0x99 : A PTE or PFN is corrupt
2 - page frame number
3 - current page state
4 - 0
END_VALUES

DESCRIPTION
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.

NDIS_INTERNAL_ERROR (0x4F)

PAGE_FAULT_IN_NONPAGED_AREA (0x50)
PARAMETERS
1 - memory referenced.
2 - value 0 = read operation, 1 = write operation.
3 - If non-zero, the instruction address which referenced the bad memory
address.
4 - (reserved)

DESCRIPTION
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.

REGISTRY_ERROR (0x51)
PARAMETERS
1 - (reserved)
2 - (reserved)
3 - depends on where Windows bugchecked, may be pointer to hive
4 - depends on where Windows bugchecked, may be return code of
HvCheckHive if the hive is corrupt.

DESCRIPTION
Something has gone badly wrong with the registry. If a kernel debugger
is available, get a stack trace. It can also indicate that the registry got
an I/O error while trying to read one of its files, so it can be caused by
hardware problems or filesystem corruption.

It may occur due to a failure in a refresh operation, which is used only
in by the security system, and then only when resource limits are encountered.

MAILSLOT_FILE_SYSTEM (0x52)

NO_BOOT_DEVICE (0x53)

LM_SERVER_INTERNAL_ERROR (0x54)

DATA_COHERENCY_EXCEPTION (0x55)

INSTRUCTION_COHERENCY_EXCEPTION (0x56)

XNS_INTERNAL_ERROR (0x57)

VOLMGRX_INTERNAL_ERROR (0x58)

Windows cannot boot from a secondary plex of a mirrored volume when the mirror
is not up to date. Please boot from the primary plex of the mirrored volume.

PINBALL_FILE_SYSTEM (0x59)
See the comment for FAT_FILE_SYSTEM (0x23)

CRITICAL_SERVICE_FAILED (0x5A)

SET_ENV_VAR_FAILED (0x5B)

HAL_INITIALIZATION_FAILED (0x5C)

UNSUPPORTED_PROCESSOR (0x5D)
The system failed because the processor does not support all the required hardware features.
This error is most likely due to lack of support for one or more of NX, PAE or SSE2.

OBJECT_INITIALIZATION_FAILED (0x5E)

SECURITY_INITIALIZATION_FAILED (0x5F)

PROCESS_INITIALIZATION_FAILED (0x60)

HAL1_INITIALIZATION_FAILED (0x61)

OBJECT1_INITIALIZATION_FAILED (0x62)

SECURITY1_INITIALIZATION_FAILED (0x63)

SYMBOLIC_INITIALIZATION_FAILED (0x64)

MEMORY1_INITIALIZATION_FAILED (0x65)

CACHE_INITIALIZATION_FAILED (0x66)

CONFIG_INITIALIZATION_FAILED (0x67)

PARAMETERS
1 - (reserved)
2 - location selector
3 - NT status code

DESCRIPTION
This means the registry couldn't allocate the pool needed to contain the
registry files. This should never happen, since it is early enough in
system initialization that there is always plenty of paged pool available.

FILE_INITIALIZATION_FAILED (0x68)

IO1_INITIALIZATION_FAILED (0x69)

Initialization of the I/O system failed for some reason. There is
very little information available. In general, setup really made
some bad decisions about the installation of the system, or the user has
reconfigured the system.

LPC_INITIALIZATION_FAILED (0x6A)

PROCESS1_INITIALIZATION_FAILED (0x6B)
PARAMETERS
1 - Indicates the NT status code that caused the failure.
2 - (reserved)

REFMON_INITIALIZATION_FAILED (0x6C)

SESSION1_INITIALIZATION_FAILED (0x6D)
1 - Indicates the NT status code that caused the failure.
2 - (reserved)

DESCRIPTION
The initial session process could not be created.

BOOTPROC_INITIALIZATION_FAILED (0x6E)
1 - Indicates the NT status code that caused the failure.
2 - (reserved)

DESCRIPTION
A failure occured during initialization on the boot processor.

ASSIGN_DRIVE_LETTERS_FAILED (0x72)

CONFIG_LIST_FAILED (0x73)
Indicates that one of the core system hives cannot be linked in the
registry tree. The hive is valid, it was loaded OK. Examine the 2nd
bugcheck argument to see why the hive could not be linked in the
registry tree.

PARAMETERS
1 - 1
2 - Indicates the NT status code that tripped Windows into
thinking that it had failed to load the hive.
3 - Index of hive in hivelist
4 - Pointer to UNICODE_STRING containing filename of hive

DESCRIPTION
This can be either SAM, SECURITY, SOFTWARE or DEFAULT. One common reason
for this to happen is if you are out of disk space on the system drive
(in which case param 2 is 0xC000017D - STATUS_NO_LOG_SPACE) or an attempt
to allocate pool has failed (in which case param 2 is 0xC000009A -
STATUS_INSUFFICIENT_RESOURCES). Other status codes must be individually
investigated.

BAD_SYSTEM_CONFIG_INFO (0x74)
Can indicate that the SYSTEM hive loaded by the osloader/NTLDR
was corrupt. This is unlikely, since the osloader will check
a hive to make sure it isn't corrupt after loading it.

It can also indicate that some critical registry keys and values
are not present. (i.e. somebody used regedt32 to delete something
that they shouldn't have) Booting from LastKnownGood may fix
the problem, but if someone is persistent enough in mucking with
the registry they will need to reinstall or use the Emergency
Repair Disk.

PARAMETERS
1 - (reserved)
2 - (reserved)
3 - (reserved)
4 - usually the NT status code.

CANNOT_WRITE_CONFIGURATION (0x75)

This will result if the SYSTEM hive file cannot be converted to a
mapped file. This usually happens if the system is out of pool and
we cannot reopen the hive.

PARAMETERS
1 - 1
2 - Indicates the NT status code that tripped Windows into
thinking that it had failed to convert the hive.

DESCRIPTION
Normally you shouldn't see this as the conversion happens at early
during system initialization, so enough pool should be available.

PROCESS_HAS_LOCKED_PAGES (0x76)

Caused by a driver not cleaning up correctly after an I/O.

PARAMETERS
1 - Subclass of memory corruption.
VALUES
0x0 : Locked memory pages found in process being terminated.
2 - Process address.
3 - Number of locked pages.
4 - Pointer to driver stacks (if enabled) or 0 if not.

Issue a !search over all of physical memory for the current process pointer.
This will yield at least one MDL which points to it. Then do another !search
for each MDL found, this will yield the IRP(s) that point to it, revealing
which driver is leaking the pages.

Otherwise, set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\TrackLockedPages to a DWORD 1 value and reboot. Then the system
will save stack traces so the guilty driver can be easily identified.
When you enable this flag, if the driver commits the error again you will
see a different bugcheck - DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (0xCB) -
which can identify the offending driver(s).

0x1 : Driver is attempting to unlock process memory pages that are not locked.
2 - MDL specified by the driver.
3 - Current number of locked memory pages in that process.
4 - Pointer to driver stacks for that process (if enabled) or 0 if not.
END_VALUES

KERNEL_STACK_INPAGE_ERROR (0x77)
PARAMETERS
1 - status code
2 - i/o status code
3 - page file number
4 - offset into page file

1 - status code
VALUES:
0 : (page was retrieved from page cache)
2 - value found in stack where signature should be
3 - 0
4 - address of signature on kernel stack

1 : (page was retrieved from disk)
2 - value found in stack where signature should be
3 - 0
4 - address of signature on kernel stack

2 : (page was retrieved from disk, storage stack returned SUCCESS,
but the Status.Information != PAGE_SIZE)
2 - value found in stack where signature should be
3 - 0
4 - address of signature on kernel stack
3 : (page was retrieved from disk, but storage stack returned STATUS_END_OF_FILE,
for a pagefile read)
2 - faulting virtual address
3 - the internal memory management inpage block
4 - 0

4 : (page was retrieved from disk, storage stack returned SUCCESS,
but the Status.Information != request size for a pagefile read)
2 - faulting virtual address
3 - the internal memory management inpage block
4 - 0
END_VALUES

DESCRIPTION
The requested page of kernel data could not be read in. Caused by
bad block in paging file or disk controller error.

In the case when the first arguments is 0 or 1, the stack signature
in the kernel stack was not found. Again, bad hardware.

An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or
C000016AL (STATUS_DISK_OPERATION_FAILED) normally indicates
the data could not be read from the disk due to a bad
block. Upon reboot autocheck will run and attempt to map out the bad
sector. If the status is C0000185 (STATUS_IO_DEVICE_ERROR) and the paging
file is on a SCSI disk device, then the cabling and termination should be
checked. See the knowledge base article on SCSI termination.

PHASE0_EXCEPTION (0x78)

MISMATCHED_HAL (0x79)
PARAMETERS
1 - type of mismatch
VALUES:
1:
The PRCB release levels mismatch. (something is out of date)
2 - Major PRCB level of ntoskrnl.exe
3 - Major PRCB level of hal.dll

2:
The build types mismatch.
2 - Build type of ntoskrnl.exe
3 - Build type of hal.dll

Build type
0 = Free multiprocessor enabled build
1 = Checked multiprocessor enabled build
2 = Free uniprocessor build
3 = checked uniprocessor build

END_VALUES

DESCRIPTION
The HAL revision level and HAL configuration type does not match that
of the kernel or the machine type. This would probably happen if the
user has manually updated either ntoskrnl.exe or hal.dll and managed to
get a conflict.

You have an MP (multi-processor) Hal and a UP (uni-processor) Kernel,
or the reverse.

KERNEL_DATA_INPAGE_ERROR (0x7A)
PARAMETERS
1 - lock type that was held (value 1,2,3, or PTE address)
2 - error status (normally i/o status code)
3 - current process (virtual address for lock type 3, or PTE)
4 - virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

DESCRIPTION
The requested page of kernel data could not be read in. Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.

If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.

If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.

INACCESSIBLE_BOOT_DEVICE (0x7B)
PARAMETERS
1 - Pointer to the device object or Unicode string of ARC name
2 - (reserved)
3- (reserved)

DESCRIPTION
During the initialization of the I/O system, it is possible that the driver
for the boot device failed to initialize the device that the system is
attempting to boot from, or it is possible for the file system that is
supposed to read that device to either fail its initialization or to simply
not recognize the data on the boot device as a file system structure that
it recognizes. In the former case, the argument (#1) is the address of a
Unicode string data structure that is the ARC name of the device from which
the boot was being attempted. In the latter case, the argument (#1) is the
address of the device object that could not be mounted.

If this is the initial setup of the system, then this error can occur if
the system was installed on an unsupported disk or SCSI controller. Note
that some controllers are supported only by drivers which are in the Windows
Driver Library (WDL) which requires the user to do a custom install. See
the Windows Driver Library for more information.

This error can also be caused by the installation of a new SCSI adapter or
disk controller or repartitioning the disk with the system partition. If
this is the case, on x86 systems the boot.ini file must be edited or on ARC
systems setup must be run. See the "Advanced Server System Administrator's
User Guide" for information on changing boot.ini.

If the argument is a pointer to an ARC name string, then the format of the
first two (and in this case only) longwords will be:

USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;

That is, the first longword will contain something like 00800020 where 20
is the actual length of the Unicode string, and the next longword will
contain the address of buffer. This address will be in system space, so
the high order bit will be set.

If the argument is a pointer to a device object, then the format of the first
word will be:

USHORT Type;

That is, the first word will contain a 0003, where the Type code will ALWAYS
be 0003.

Note that this makes it immediately obvious whether the argument is a pointer
to an ARC name string or a device object, since a Unicode string can never
have an odd number of bytes, and a device object will always have a Type
code of 3.

BUGCODE_NDIS_DRIVER (0x7C)

This is the NDIS Driver Bugcheck for Windows Server 2003 and later.
For Windows 2000 and Windows XP, see 0xD2, BUGCODE_ID_DRIVER.

PARAMETERS
1 - NDIS BugCheck Code
VALUES:
1 : Driver called NdisMAllocateSharedMemory at raised IRQL
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - The length of the requested shared memory
4 - The current IRQL
2 : During a call to NdisMAllocateSharedMemory, NDIS detected
that a previously allocated shared memory page has been
corrupted.
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - The shared memory page that was corrupted.
4 - A pointer to a NDIS_WRAPPER_CONTEXT that keeps
track of shared memory allocations by the driver.
3 : A Driver called NdisMFreeSharedMemory(Async) with a shared
memory pointer that has already been freed.
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - The page that this shared was allocated from.
4 - The virtual address of the shared memory.
4 : [Only enabled on special instrumented NDIS.] AddDevice was
called with a driver that is not on the list of drivers
that are registered with NDIS.
2 - A pointer to NDIS_M_DRIVER_BLOCK.
3 - The driver object. (A pointer to DRIVER_OBJECT)
4 - Not used
5 : An Ethernet driver indicated receiving a packet using a
packet descriptor that is currently in use by protocol
stack. (Caught by checking stack packet location)
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - The packet descriptor used by the driver. Use
!ndiskd.pkt on this pointer for more info.
4 - A pointer to the packet array that contained this
packet descriptor. (not much of a use)
6 : An Ethernet driver indicated receiving a packet using a
packet descriptor that is currently in use by protocol
stack. (caught by checking packet reference count)
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - The packet descriptor used by the driver. Use
!ndiskd.pkt on this pointer for more info.
4 - A pointer to the packet array that contained this
packet descriptor. (not much of a use)
7 : A FDDI driver indicated receiving a packet using a packet
descriptor that is currently in use by protocol stack.
(caught by checking packet reference count)
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - The packet descriptor used by the driver. Use
!ndiskd.pkt on this pointer for more info.
4 - A pointer to the packet array that contained this
packet descriptor. (not much of a use)
8 : A Miniport did not deregister its interrupt during the halt
process.
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - A pointer to NDIS_MINIPORT_INTERRUPT
4 - Not used.
9 : A Miniport halted without successfully canceling all its
timers.
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - A pointer to miniport's timer queue. type:
NDIS_MINIPORT_TIMER.
4 - Not used.
0xA : A miniport driver is getting unloaded prematurely.
2 - A pointer to NDIS_M_DRIVER_BLOCK.
3 - The driver object. (A pointer to DRIVER_OBJECT).
4 - The ref count for the miniport driver.
0xB : A Miniport failed initialization without deregistering
its interrupt.
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - A pointer to NDIS_MINIPORT_INTERRUPT
4 - Not used.
0xC : A Miniport failed initialization without successfully
canceling all its timers.
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - A pointer to miniport's timer queue. type:
NDIS_MINIPORT_TIMER.
4 - Not used.
0xD : A Miniport did not deregister its interrupt during the
halt process. (halt called from initialize routine after
miniport returned success from its initialize handler)
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - A pointer to NDIS_MINIPORT_INTERRUPT
4 - Not used.
0xE : A Miniport halted without successfully canceling all its
timers. (halt called from initialize routine after
miniport returned success from its initialize handler)
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - A pointer to miniport's timer queue. type:
NDIS_MINIPORT_TIMER.
4 - Not used.
0xF : A Miniport driver is calling NdisMResetComplete without
any pending reset request.
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - Reset status.
4 - AddressingReset BOOLEAN. (not much of a use).
0x10 : After resuming from a low power state, a Miniport failed
initialization without deregistering its interrupt.
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - A pointer to NDIS_MINIPORT_INTERRUPT
4 - Not used.
0x11 : After resuming from a low power state, a Miniport failed
initialization without successfully canceling all its
timers.
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - A pointer to miniport's timer queue. type:
NDIS_MINIPORT_TIMER.
4 - Not used.
0x12 : A miniport driver indicated receiving a packet using a
packet descriptor that is currently in use by protocol
stack. (caught by checking packet reference count)
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - The packet descriptor used by the driver. Use
!ndiskd.pkt on this pointer for more info.
4 - A pointer to the packet array that contained this
packet descriptor. (not much of a use)
0x13 : A Token-Ring miniport driver indicated receiving a
packet using a packet descriptor that is currently in
use by protocol stack. (caught by checking packet
reference count)
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - The packet descriptor used by the driver. Use
!ndiskd.pkt on this pointer for more info.
4 - A pointer to the packet array that contained this
packet descriptor. (not much of a use)
END_VALUES

INSTALL_MORE_MEMORY (0x7D)
PARAMETERS
1 - Number of physical pages found
2 - Lowest physical page
3 - Highest physical page
4 - 0

DESCRIPTION
Not enough memory to boot Windows.

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (0x7E)
PARAMETERS
1 - The exception code that was not handled
VALUES
0x80000002: (STATUS_DATATYPE_MISALIGNMENT) An unaligned data reference was encountered.
The trap frame will supply additional information.
0x80000003: This means a hard coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
END_VALUES
2 - The address that the exception occurred at
3 - Exception Record Address
4 - Context Record Address

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (0x1000007E)
PARAMETERS
1 - The exception code that was not handled
VALUES
0x80000002: (STATUS_DATATYPE_MISALIGNMENT) An unaligned data reference was encountered.
The trap frame will supply additional information.
0x80000003: This means a hard coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
END_VALUES
2 - The address that the exception occurred at
3 - Exception Record Address
4 - Context Record Address

DESCRIPTION
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.

UNEXPECTED_KERNEL_MODE_TRAP (0x7F)

This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:

PARAMETERS
1 - x86 trap number
VALUES:
0: EXCEPTION_DIVIDED_BY_ZERO
1: EXCEPTION_DEBUG
2: EXCEPTION_NMI
3: EXCEPTION_INT3
5: EXCEPTION_BOUND_CHECK
6: EXCEPTION_INVALID_OPCODE
7: EXCEPTION_NPX_NOT_AVAILABLE
8: EXCEPTION_DOUBLE_FAULT
9: EXCEPTION_NPX_OVERRUN
A: EXCEPTION_INVALID_TSS
B: EXCEPTION_SEGMENT_NOT_PRESENT
C: EXCEPTION_STACK_FAULT
D: EXCEPTION_GP_FAULT
F: EXCEPTION_RESERVED_TRAP
10: EXCEPTION_NPX_ERROR
11: EXCEPTION_ALIGNMENT_CHECK
END_VALUES

DESCRIPTION
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif

kb will then show the corrected stack.

UNEXPECTED_KERNEL_MODE_TRAP_M (0x1000007F)

kb will then show the corrected stack.

NMI_HARDWARE_FAILURE (0x80)

This is typically due to a hardware malfunction. The hardware supplier should
be called.

SPIN_LOCK_INIT_FAILURE (0x81)

DFS_FILE_SYSTEM (0x82)

SETUP_FAILURE (0x85)

(NOTE: Textmode setup no longer uses bugchecks to bail out of serious
error conditions. Therefore, you will never encounter a bugcheck 0x85.
All bugchecks have been replaced with friendlier and (where possible)
more descriptive error messages. Some of the former bugchecks, however,
have simply been replaced by our own bugcheck screen, and the codes for
these error conditions are the same as before. These are documented below.)

The first extended bugcheck field is a code indicating what the
problem is, and the other fields are used differently depending on
that value.
PARAMETERS
1 -
VALUES:
0: The oem hal font is not a valid .fon format file, and so setup
is unable to display text.
This indicates that vgaxxx.fon on the boot floppy or CD-ROM
is damaged.

1: Video initialization failed. NO LONGER A BUGCHECK CODE.
This error now has its own error screen, and the user is only
presented with the two relevant parameters detailed below.

This may indicate that the disk containing vga.sys
(or other video driver appropriate to the machine)
is damaged or that machine has video hardware that
Windows cannot communicate with.

3 - Status code from NT API call, if appropriate.

2 - What failed:
VALUES:
0 : NtCreateFile of \device\video0
1 : IOCTL_VIDEO_QUERY_NUM_AVAIL_MODES
2 : IOCTL_VIDEO_QUERY_AVAIL_MODES
3: Desired video mode not supported. This is indicative of
an internal setup error.
4: IOCTL_VIDEO_SET_CURRENT_MODE (unable to set video mode)
5: IOCTL_VIDEO_MAP_VIDEO_MEMORY
6: IOCTL_VIDEO_LOAD_AND_SET_FONT
END_VALUES

2: Out of memory. NO LONGER A BUGCHECK CODE.
This error now uses a more friendly error screen that works
regardless of how far along in setup Windows is.

3: Keyboard initialization failed. NO LONGER A BUGCHECK CODE.
There are now 2 error screens for the two different possible errors
that can occur here.
This may indicate that the disk containing the keyboard driver
(i8042prt.sys or kbdclass.sys) is damaged, or that the machine has
keyboard hardware Windows cannot communicate with.

It may also mean that the keyboard layout dll could not be loaded.

2 - What failed:
VALUES:
0: NtCreateFile of \device\KeyboardClass0 failed.
"Setup did not find a keyboard connected to your computer."
1: Unable to load keyboard layout dll.
"Setup could not load the keyboard layout file ."
Indicates that the cd or floppy is missing a file (kbdus.dll
for us release, other layout dlls for localized ones).
END_VALUES

4: Setup was unable to resolve the ARC device pathname of
the device from which setup was started. This is an internal
Setup error.

5: Partitioning sanity check failed. This indicates a bug in
a disk driver. The parameters are meaningful only to the setup
group.

END_VALUES

MBR_CHECKSUM_MISMATCH (0x8B)

This message occurs during the boot process when the MBR checksum the system
calculates does not match the checksum passed in by the loader. This is usually
an indication of a virus. There are many forms of viruses and not all can be
detected. The newer ones usually can only be detected by a virus scanner that
has recently been upgraded. Boot a write-protected disk containing a virus
scanner and attempt to clean out the infection.

PARAMETERS

1 - Disk Signature from MBR.
2 - MBR checksum calculated by osloader.
3 - MBR checksum calculated by system.

KERNEL_MODE_EXCEPTION_NOT_HANDLED (0x8E)
PARAMETERS
1 - The exception code that was not handled
VALUES
0x80000002: (STATUS_DATATYPE_MISALIGNMENT) An unaligned data reference was encountered.
The trap frame will supply additional information.
0x80000003: This means a hard coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
END_VALUES
2 - The address that the exception occurred at
3 - Trap Frame

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (0x1000008E)
PARAMETERS
1 - The exception code that was not handled
VALUES
0x80000002: (STATUS_DATATYPE_MISALIGNMENT) An unaligned data reference was encountered.
The trap frame will supply additional information.
0x80000003: This means a hard coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
END_VALUES
2 - The address that the exception occurred at
3 - Trap Frame

PP0_INITIALIZATION_FAILED (0x8F)

This message occurs if phase 0 initialization of the kernel-mode Plug and
Play Manager failed.

PP1_INITIALIZATION_FAILED (0x90)

This message occurs if phase 1 initialization of the kernel-mode Plug and
Play Manager failed. This is where most of the initialization is done,
including setting up the environment (registry, etc.) for drivers to
subsequently call during I/O init.

UP_DRIVER_ON_MP_SYSTEM (0x92)

This message occurs if a UNIPROCESSOR only driver is loaded on a MultiProcessor
system with more than one active processor.

PARAMETERS

1 - The Base address of the driver.

INVALID_KERNEL_HANDLE (0x93)

This message occurs if kernel code attempts to close or reference a handle
that is not a valid handle. Only invalid or protected handles passed to NtClose
will cause this bugcheck, unless bad handle detection is enabled.

PARAMETERS

2 -
VALUES
0 : A protected handle was closed.
1 : An invalid handle was closed or referenced.
END_VALUES

4 -
VALUES
0 : The error occurred closing an invalid kernel handle.
1 - The handle that NtClose was called with
1 : The error occurred referencing an invalid kernel handle and
bad handle detection was enabled.
1 - The handle that was referenced
END_VALUES

KERNEL_STACK_LOCKED_AT_EXIT (0x94)

This message occurs when a thread exits while its kernel stack is
marked as not swappable.

PARAMETERS

1 - (reserved)
2 - (reserved)
3 - (reserved)

INVALID_WORK_QUEUE_ITEM (0x96)

This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null. This is almost always called by code misusing
worker thread work items, but any queue misuse can cause this. The rule
is that an entry on a queue may only be inserted on the list once. When an
item is removed from a queue, it's flink field is set to NULL. This bugcheck
occurs when remove queue attempts to remove an entry, but the flink or blink
field is NULL. In order to debug this problem, you need to know the queue being
referenced.

In an attempt to help identify the guilty driver, this bugcheck assumes the
queue is a worker queue (ExWorkerQueue) and prints the worker routine as
parameter 4 below.

PARAMETERS

1 - The address of the queue entry whose flink/blink field is NULL
2 - The address of the queue being references. Usually this is one
of the ExWorkerQueues.
3 - The base address of the ExWorkerQueue array. This will help determine
if the queue in question is an ExWorkerQueue and if so, the offset from
this parameter will isolate the queue.
4 - If this is an ExWorkerQueue (which it usually is), this is the address
of the worker routine that would have been called if the work item was
valid. This can be used to isolate the driver that is misusing the work
queue.

BOUND_IMAGE_UNSUPPORTED (0x97)

END_OF_NT_EVALUATION_PERIOD (0x98)

Your Windows System is an evaluation unit with an expiration date. The trial
period is over.

PARAMETERS

1 - The low order 32 bits of your product expiration date
2 - The high order 32 bits of your product expiration date

INVALID_REGION_OR_SEGMENT (0x99)

ExInitializeRegion or ExInterlockedExtendRegion was called with an invalid
set of parameters.

SYSTEM_LICENSE_VIOLATION (0x9A)

A violation of the software license agreement has occurred. This can be due to
either attempting to change the product type of an offline system, or an attempt
to change the trial period of an evaluation unit of Windows.

PARAMETERS
1 - Violation type
VALUES:
0 : means that offline product type changes were attempted
2 - if 1, product should be LanmanNT or ServerNT. If 0, should be WinNT
3 - partial serial number
4 - first two characters of product type from product options.

1 : means that offline changes to the nt evaluation unit time period
2 - registered evaluation time from source 1
3 - partial serial number
4 - registered evaluation time from alternate source

2 : means that the setup key could not be opened
2 - status code associated with the open failure

3 : The SetupType or SystemSetupInProgress value from the setup key is missing
so setup mode could not be detected
2 - status code associated with the key lookup failure

4 : The SystemPrefix value from the setup key is missing
2 - status code associated with the key lookup failure

5 : means that offline changes were made to the number of licensed processors
2 - see setup code
3 - invalid value found in licensed processors
4 - officially licensed number of processors

6 : means that ProductOptions key could not be opened
2 - status code associated with the open failure

7 : means that ProductType value could not be read
2 - status code associated with the read failure

8 : means that Change Notify on ProductOptions failed
2 - status code associated with the change notify failure

9 : means that Change Notify on SystemPrefix failed
2 - status code associated with the change notify failure

0xA : An NTW system was converted to an NTS system

0xB : Reference of setup key failed
2 - status code associated with the change failure

0xC : Reference of product options key failed
2 - status code associated with the change failure

0xD : Open of ProductOptions in worker thread failed
2 - status code associated with the failure

0xF : Open of setup key failed
2 - status code associated with the failure

0x10 : Failure occurred in the setup key worker thread
2 - status code associated with the failure
3 - 0 means set value failed, 1 means change notify failed

0x11 : Failure occurred in the product options key worker thread
2 - status code associated with the failure
3 - 0 means set value failed, 1 means change notify failed

0x12 : Could not open the LicenseInfoSuites key for the suite
2 - status code associated with the failure

0x13 : Could not query the LicenseInfoSuites key for the suite
2 - status code associated with the failure

0x14 : Could not allocate memory
2 - size of memory alllocation

0x15 : Could not re-set the ConcurrentLimit value for the suite key
2 - status code associated with the failure

0x16 : Could not open the license key for a suite product
2 - status code associated with the failure

0x17 : Could not re-set the ConcurrentLimit value for a suite product
2 - status code associated with the failure

0x18 : Could not start the change notify for the LicenseInfoSuites
2 - status code associated with the open failure

0x19 : A suite is running on a system that must be pdc

0x1A : Failure occurred when enumerating the suites
2 - status code associated with the failure

END_VALUES

UDFS_FILE_SYSTEM (0x9B)

If you see UdfExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more helpful stack
trace.

MACHINE_CHECK_EXCEPTION (0x9C)

A fatal Machine Check Exception has occurred.

KeBugCheckEx parameters;

x86 Processors
If the processor has ONLY MCE feature available (For example Intel
Pentium), the parameters are:

1 - Low 32 bits of P5_MC_TYPE MSR
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of P5_MC_ADDR MSR
4 - Low 32 bits of P5_MC_ADDR MSR

If the processor also has MCA feature available (For example Intel
Pentium Pro), the parameters are:

1 - Bank number
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error

IA64 Processors

1 - Bugcheck Type
1 - MCA_ASSERT
2 - MCA_GET_STATEINFO
SAL returned an error for SAL_GET_STATEINFO while processing MCA.
3 - MCA_CLEAR_STATEINFO
SAL returned an error for SAL_CLEAR_STATEINFO while processing MCA.
4 - MCA_FATAL
FW reported a fatal MCA.
5 - MCA_NONFATAL
SAL reported a recoverable MCA and we don't support currently
support recovery or SAL generated an MCA and then couldn't
produce an error record.
0xB - INIT_ASSERT
0xC - INIT_GET_STATEINFO
SAL returned an error for SAL_GET_STATEINFO while processing INIT event.
0xD - INIT_CLEAR_STATEINFO
SAL returned an error for SAL_CLEAR_STATEINFO while processing INIT event.
0xE - INIT_FATAL
Not used.
2 - Address of log
3 - Size of log
4 - Error code in the case of x_GET_STATEINFO or x_CLEAR_STATEINFO

AMD64 Processors

1 - Bank number
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error

USER_MODE_HEALTH_MONITOR (0x9E)

One or more critical user mode components failed to satisfy a health check.

Hardware mechanisms such as watchdog timers can detect that basic kernel
services are not executing. However, resource starvation issues, including
memory leaks, lock contention, and scheduling priority misconfiguration,
may block critical user mode components without blocking DPCs or
draining the nonpaged pool.

Kernel components can extend watchdog timer functionality to user mode
by periodically monitoring critical applications. This bugcheck indicates
that a user mode health check failed in a manner such that graceful
shutdown is unlikely to succeed. It restores critical services by
rebooting and/or allowing application failover to other servers.

PARAMETERS
1 - Process that failed to satisfy a health check within the
configured timeout
2 - Health monitoring timeout (seconds)
3 - Watchdog source. In combination with process address helps to identify
what sub-component has created whti watchdog.
0 - WatchdogSourceDefault
Source was not specified
1 - WatchdogSourceRhsCleanup
Monitors that RHS process goes away when
terminating on graceful exit
2 - WatchdogSourceRhsResourceDeadlockBugcheckNow
RHS was asked to immediately bugcheck machine
on resource deadlock
3 - WatchdogSourceRhsExceptionFromResource
Resource has leaked unhandled exception from an entry point,
RHS is terminating and this watchdog monitors that
process will go away
4 - WatchdogSourceRhsUnhandledException
Unhandled exception in RHS.
RHS is terminating and this watchdog monitors that
process will go away
5 - WatchdogSourceRhsResourceDeadlock
Monitors that RHS process goes away when
terminating on resource deadlock
6 - WatchdogSourceRhsResourceTypeDeadlock
Monitors that RHS process goes away when
terminating on resource type deadlock
7 - WatchdogSourceClussvcUnhandledException
Unhandled exception in clussvc.
clussvc is terminating and this watchdog monitors that
process will go away
8 - WatchdogSourceClussvcBugcheckMessageRecieved
Another cluster node has send message asking to bugcheck this node.
9 - WatchdogSourceClussvcWatchdogBugcheck
User mode watchdog has expired and created netft watchdog
to bugchecked the node.
10 - WatchdogSourceClussvcIsAlive
Cluster service sends heartbeat to netft every 500 millseconds.
By default netft expects at least 1 heartbeat per second.
If this watchdog was triggered that means clussvc is o not getting
CPU to send heartbers.
101 - WatchdogSourceRhsResourceDeadlockPhysicalDisk
102 - WatchdogSourceRhsResourceDeadlockStoragePool
103 - WatchdogSourceRhsResourceDeadlockFileServer
104 - WatchdogSourceRhsResourceDeadlockSODAFileServer
105 - WatchdogSourceRhsResourceDeadlockStorageReplica
106 - WatchdogSourceRhsResourceDeadlockStorageQOS
107 - WatchdogSourceRhsResourceDeadlockStorageNFSV2
Values above are subclasses of WatchdogSourceRhsResourceDeadlock
For the resource types that are known to cause RHS termination hangs
we isolate them to separate codes so we can quickly triage dumps.
201 - WatchdogSourceRhsResourceTypeDeadlockPhysicalDisk
202 - WatchdogSourceRhsResourceTypeDeadlockStoragePool
203 - WatchdogSourceRhsResourceTypeDeadlockFileServer
204 - WatchdogSourceRhsResourceTypeDeadlockSODAFileServer
205 - WatchdogSourceRhsResourceTypeDeadlockStorageReplica
206 - WatchdogSourceRhsResourceTypeDeadlockStorageQOS
207 - WatchdogSourceRhsResourceTypeDeadlockStorageNFSV2
Values above are subclasses of WatchdogSourceRhsResourceTypeDeadlock
For the resource types that are known to cause RHS termination hangs
we isolate them to separate codes so we can quickly triage dumps.

DRIVER_POWER_STATE_FAILURE (0x9F)

A driver has failed to complete a power IRP within a specific time.

PARAMETERS

1 - SubCode
VALUES:
1 : The device object is being freed which still has an
outstanding power request which it has not completed
2 - DeviceObject
2 : The device object completed the irp for the system power
state request, but failed to call PoStartNextPowerIrp
2 - Optional Target device's DEVICE_OBJECT
3 - DeviceObject
4 - Optional DriverObject
3 : A device object has been blocking an Irp for too long a time
2 - Physical Device Object of the stack
3 - nt!TRIAGE_9F_POWER on Win7 and higher, otherwise the Functional Device Object of the stack
4 - The blocked IRP
4 : The power transition timed out waiting to synchronize with the Pnp
subsystem.
2 - Timeout in seconds.
3 - The thread currently holding on to the Pnp lock.
4 - nt!TRIAGE_9F_PNP on Win7 and higher
0x500 : The device object completed the irp for the system power
state request, but failed to call PoStartNextPowerIrp.
3 - Optional Target device's DEVICE_OBJECT
4 - DeviceObject
END_VALUES

INTERNAL_POWER_ERROR (0xA0)

The power policy manager experienced a fatal error.

PARAMETERS:

1 -
VALUES:
0x1 : Error Handling power IRP.
2 -
VALUES:
1 : A device has overrun its maximum number of reference counts.
3 - maximum number of references allowed.
2 : Too many inrush power irps have been queue.
3 - maximum number of pending irps allowed.
3 : Too many inrush power irps have been queue.
3 - maximum number of pending irps allowed.
4 : Too many inrush power irps have been queue.
3 - maximum number of pending irps allowed.
5 : Power IRP has been sent to a passive level deviceobject.
6 : The system has failed to allocate a necessary power irp.
3 - target device object
4 - whether or not this is a system or device power irp
VALUES:
0x0 : system power irp
0x1 : device power irp
END_VALUES
END_VALUES
0x2 : (POP_INTERNAL) An internal failure has occurred while attempting to process
a power event. To debug this, dump the stack and look for the
function ntoskrnl!_PopInternalError. The first argument is
(error_code << 16) | __LINE__. If the caller is PopExceptionFilter, then
the first argument to this function is of type PEXCEPTION_POINTERS.
In the debugger, type 'dt nt!_EXCEPTION_POINTERS '.
Then type '.cxr '.
All subsequent debugger commands will show you the actual
source of the error. Start with a stack trace by typing 'kb'.
0x3 : The checksum for a hibernation context page does not match.
2 - Expected checksum
3 - Actual checksum
4 - Linenumber of the failure.
0x4 : The checksum for a page about to be written to the hibernation file
does not match its expected checksum.
2 - Expected checksum
3 - Actual checksum
4 - Linenumber of the failure.
0x5 : An unknown shutdown code has been sent to the system shutdown handler.

0x7 : (POP_MISC) Unhandled exception. To debug this, dump the stack. Look
for the function ntoskrnl!PopExceptionFilter. The first
argument to this function is of type PEXCEPTION_POINTERS.
In the debugger, type 'dt nt!_EXCEPTION_POINTERS '.
Then type '.cxr '.
All subsequent debugger commands will show you the actual
source of the error. Start with a stack trace by typing 'kb'.
0x8 : (POP_SYS) A fatal error has occured while processing a system power event.
2 -
VALUES:
0x100 : An unknown device type is being processed.
3 - DEVICE_OBJECT
4 - POWER_CHANNEL_SUMMARY
END_VALUES
0x9 : A fatal error occured while preparing the hibernate file.
2 - Status code
3 - Mirroring phase
0xA : A bugcheck was requested when waking for debugging purposes.
2 -
VALUES:
0 : A bugcheck was requested immediately upon resuming.
1 : A bugcheck was requested during resume once all non-pagable
devices have been powered on.
2 : A bugcheck was requested during resume once all devices
have been powered on.
END_VALUES
0xB : The hibernation file is too small.
2 - Size of the hibernation file.
3 - Hibernation progress before running out of space.
VALUES:
0 : HIBERFILE_PROGRESS_FREE_MAP
1 : HIBERFILE_PROGRESS_RESUME_CONTEXT
2 : HIBERFILE_PROGRESS_PROCESSOR_STATE
3 : HIBERFILE_PROGRESS_SECURE_RANGES
4 : HIBERFILE_PROGRESS_MEMORY_RANGES
4 - Size of the remaining memory ranges.
5 : HIBERFILE_PROGRESS_TABLE_PAGES
6 : HIBERFILE_PROGRESS_MEMORY_IMAGE
END_VALUES
0xC : Dump stack failed to initialize.
2 - Status code
3 - Address of the dump stack context
0x101 : Unhandled exception occured while processing a system power event.
3 - ExceptionPointer. To debug this, in the debugger type:
'dt nt!_EXCEPTION_POINTERS '. Then type:
'.cxr '.
All subsequent debugger commands will show you the actual
source of the error. Start with a stack trace by typing 'kb'.

0x102 : Hibernation working buffer size is not page aligned
3 - DUMP_INITIALIZATION_CONTEXT
4 - POP_HIBER_CONTEXT
0x103 : All working pages have failed to be accounted for during the hibernation process.
3 - POP_HIBER_CONTEXT
0x104 : An attempt was made to map internal hibernate memory while
the internal memory structures were locked.
3 - POP_HIBER_CONTEXT
0x105 : An attempt was made to map internal hibernate memory with
an unsupported memory type flag.
3 - POP_HIBER_CONTEXT
0x106 : A memory descriptor list was created during the hibernation process which
describes memory that is not paged-aligned.
3 - MDL
0x107 : A data mismatch has occurred in the internal hibernation data
structures.
3 - POP_HIBER_CONTEXT
4 - PO_MEMORY_RANGE_ARRAY
0x108 : The disk subsystem failed to properly write part of the hibernation
file.
3 - POP_HIBER_CONTEXT
0x109 : The checksum for the processor state data does not match its
expected checksum.
3 - Expected checksum
4 - Actual checksum
0x10A : The disk subsystem failed to properly read or write part of the hibernation
file.
3 - POP_HIBER_CONTEXT
4 - NTSTATUS failure code
0x10B : An attempt was made to mark pages for the boot phase of hibernate
at the wrong time using PoSetHiberRange API.
3 - Current hibernate progress
0x10C : PoSetHiberRange API was called with invalid parameters.
3 - Flags provided to the API
4 - Length to mark
0x10D : The secure kernel subsystem failed while providing data for resume.
3 - POP_HIBER_CONTEXT
4 - NTSTATUS failure code
0x10E : The disk subsystem returned corrupt data while reading from the
hibernation file.
3 - Incorrect checksum
4 - Previous disk read's checksum
0x200 : An unknown device type is being checked for an idle state.
3 - DEVICE_OBJECT
4 - DEVICE_OBJECT_POWER_EXTENSION
0x300 : An unknown status was returned from a battery power IRP.
3 - DEVICE_OBJECT
4 - IRP
0x301 : The battery has entered an unknown state..
3 - DEVICE_OBJECT
4 - IRP
0x400 : A device has overrun its maximum number of reference counts.
3 - IO_STACK_LOCATION
4 - DEVICE_OBJECT
0x401 : Too many inrush power irps have been queue.
3 - Pending IRP list.
4 - DEVICE_OBJECT
0x402 : Too many inrush power irps have been queue.
3 - Pending IRP list.
4 - DEVICE_OBJECT
0x403 : Too many inrush power irps have been queue.
3 - Pending IRP list.
4 - DEVICE_OBJECT
0x404 : Power IRP has been sent to a passive level deviceobject.
3 - IO_STACK_LOCATION.
4 - DEVICE_OBJECT
0x500 : An unknown status was returned from a thermal power IRP.
3 - IRP
4 - DEVICE_OBJECT
0x599 : Test hook to trigger a bugcheck when the storage controller is
in a low power state.
2 - Platform State just returned from.
0x600 : A driver has attempted a duplicate registration with the Power
Runtime Framework.
2 - DEVICE_OBJECT PDO.
0x601 : No Power Engine Plugins accepted device registration.
2 - POP_FX_DEVICE device.
3 - PEP_DEVICE_REGISTER PEP registration.
0x602 : Device node sleep count does not match its activation count.
2 - DEVICE_NODE device node.
3 - Sleep count.
0x603 : A Power Engine Plugin made an invalid work request.
2 - POP_FX_PLUGIN Power Engine Plugin.
3 - Work request type.
0x605 : A Power Engine Plugin failed to accept mandatory device power
management notification.
2 - Notification ID.
3 - POP_FX_PLUGIN Power Engine Plugin.
0x606 : A Power Engine Plugin attempted to transition critical system
resource component to Active (or Idle) condition when resource
was already Active (or Idle).
2 - POP_FX_COMPONENT component.
3 - POP_FX_COMPONENT_FLAGS component condition.
4 - New condition for the component.
0x607 : A runtime power management framework device removal lock acquire
failed when it must have succeeded.
2 - POP_FX_DEVICE device.
3 - NTSTATUS failure code
0x608 : A driver has attempted to transition a component to idle without
a preceeding active request.
2 - POP_FX_COMPONENT component
3 - POP_FX_COMPONENT_FLAGS component condition
0x609 : A Power Engine Plugin has requested either device power required
or device power not required without an intervening request
of the opposite type.
2 - POP_FX_PLUGIN Power Engine Plugin
3 - POP_FX_DEVICE device
4 - Duplicate Request Type
VALUES:
0 : DevicePowerRequired
1 : DevicePowerNotRequired
END_VALUES
0x610 : A Power Engine Plugin has requested device power not required
while a previous device power required request is outstanding.
2 - POP_FX_PLUGIN Power Engine Plugin
3 - POP_FX_DEVICE device
0x611 : A Power Engine Plugin has requested an operation on an invalid
component.
2 - POP_FX_PLUGIN Power Engine Plugin
3 - POP_FX_DEVICE device
4 - Invalid component index
0x612 : A Power Engine Plugin has requested additional work to be done
in the context of a device notification where no buffer was
supplied by PO for the request.
2 - POP_FX_PLUGIN PowerEnginePlugin
0x613 : A driver has attempted to complete a request when no such
outstanding request is pending.
2 - POP_FX_DEVICE device
3 - Component index
4 - Operation
VALUES:
0 : Complete device power not required
1 : Report device powered on
2 : Complete idle condition
END_VALUES
0x614 : A driver has requested an active/idle transition on a component
with an illegal parameter.
2 - POP_FX_DEVICE device
3 - Component index
4 - Illegal parameter
VALUES:
0 : PO_FX_FLAG_BLOCKING used at IRQL >= DISPATCH_LEVEL
1 : PO_FX_FLAG_BLOCKING and PO_FX_FLAG_ASYNC_ONLY both specified
2 : Invalid component index
END_VALUES
0x615 : A Power Engine Plugin has illegally indicated the completion of
a component activation.
2 - POP_FX_PLUGIN PowerEnginePlugin
3 - POP_FX_COMPONENT component
4 - Illegal Action
VALUES:
0 : Component not in idle state 0
1 : Component is already active
2 : No outstanding activation request
3 : Outstanding idle state transition
END_VALUES
0x616 : A Power Engine Plugin has illegally requested a component idle
state transition.
2 - POP_FX_PLUGIN PowerEnginePlugin
3 - POP_FX_COMPONENT component
4 - Illegal Action
VALUES:
0 : Invalid idle state
1 : Component is already in the requested state
2 : Requested a non-zero idle state without passing through idle state 0
END_VALUES
0x617 : A Power Engine Plugin has returned an invalid acceptance type when
processing a device registration notification.
2 - POP_FX_PLUGIN PowerEnginePlugin
3 - UNICODE_STRING DeviceId
4 - PEP_DEVICE_REGISTER PEP Registration
0x618 : A runtime power worker thread has been blocked for too long.
2 - POP_FX_WORK_ORDER_WATCHDOG_INFO WorkOrder
0x619 : A device has blocked entry into the deepest runtime idle power
power state for too long.
2 - POP_FX_DEVICE Device
3 - Component index
0x61A : A Power Engine Plugin has supplied invalid information about a
component's performance state information.
2 - POP_FX_PLUGIN Power Engine Plugin
3 - POP_FX_DEVICE device
4 - Component index
0x61B : A driver has issued a perf state request before registering for
device perf states.
2 - POP_FX_DEVICE device
3 - Component index
0x61C : A driver has issued a perf state request with invalid parameters.
2 - POP_FX_DEVICE device
3 - Component index
4 - Invalid Parameter
VALUES:
0 : PerfChangesCount exceeds the number of perf state sets
registered for this component
END VALUES:
0x61D : A driver has issued a perf state request while a previous
request is outstanding.
2 - POP_FX_DEVICE device
3 - Component index
4 - Outstanding request context
0x61E : A Power Engine Plugin has attempted to perform a critical
transition on a debugger device while automatic transitions
are enabled.
0x61F : A Power Engine Plugin has attempted to enable automatic debugger
transitions for a coordinated idle state that is not a
platform-wide state.
2 - POP_FX_DEVICE device
3 - Coordinated idle state index
0x620 : A Power Engine Plugin has attempted to register a D-state
dependency for a coordinated idle state that is not a
platform-wide state.
2 - POP_FX_DEVICE device
3 - Coordinated idle state index
0x621 : A Power Engine Plugin has attempted to register an F-state
dependency for a coordinated idle state that is not a
platform-wide state.
2 - POP_FX_DEVICE device
3 - Component index
4 - Coordinated idle state index
0x666 : Default Power Engine Plugin has attempted to trigger a new
activity that conflicts with another activity.
2 - PPOP_PEP_ACTIVITY activities.
3 - New activity type.
VALUES:
0 : DevicePowerOn
1 : ComponentIdleStateChange
2 : ComponentActivating
3 : ComponentActive
4 : DevicePowerOff
5 : DeviceSuspend
END_VALUES
4 - Conflicting activity type.
VALUES:
0 : DevicePowerOn
1 : ComponentIdleStateChange
2 : ComponentActivating
3 : ComponentActive
4 : DevicePowerOff
5 : DeviceSuspend
END_VALUES
0x667 : Default Power Engine Plugin has attempted to complete an
activity that is not running.
2 - POP_PEP_ACTIVITY activity.
3 - Activity type.
VALUES:
0 : DevicePowerOn
1 : ComponentIdleStateChange
2 : ComponentActivating
3 : ComponentActive
4 : DevicePowerOff
5 : DeviceSuspend
END_VALUES
4 - POP_PEP_ACTIVITY_STATUS activity status.
0x668 : Default Power Engine Plugin has attempted to remove a platform
idle state constraint that was not previously constrained.
2 - PPPM_COORDINATED_STATE whose reference count is being updated.
3 - The invalid reference count value observed by this function.
4 - The mask of platform idle states being updated.
0x669 : Default Power Engine Plugin has encountered an internal
consistency error while attempting to exclusively notify PoFx
about the availability of a platform idle state.
2 - PPPM_COORDINATED_STATE whose reference count is being updated.
3 - The invalid reference count value observed by this function.
0x680 : The runtime power framework could not parse a required ACPI
table due to it either being missing or malformed. This is
usually due to a BIOS error.
2 NTSTATUS failure code.
0x700 : A Power Engine Plugin has specified invalid processor idle
dependencies during an idle select notification.
2 - PEPHANDLE
3 - PEP_PPM_IDLE_SELECT
0x701 : A processor was not able to complete an idle transition within
the allocated interval. This indicates the specified processor
is hung.
2 - The index of the selected idle state of the hung processor.
3 - The PRCB address of the hung processor.
4 - The index of the hung processor.
0x702 : A processor woke up from a non-interruptible state without the
the OS initiating an explicit wake through the PEP (using the
necessary PPM idle synchronization).
2 - The index of the selected idle state of the processor.
3 - The idle synchronization state of the processor.
4 - The PRCB address of the hung processor.
0x703 : A Power Engine Plugin has specified invalid processor idle
dependencies during a query platform state notification.
2 - PEPHANDLE
3 - PEP_PPM_QUERY_PLATFORM_STATE
0x704 : A coordinated idle state transition did not complete in a timely
manner.
0x705 : A Power Engine Plugin has altered a read only field in the
buffer passed into a notification.
2 - PEPHANDLE
3 - Notification
4 - Four-character tag identifying the illegally altered field.
Decode in a kernel debugger with: .formats
0x706 : A Power Engine Plugin has returned an illegal value in one of
the fields of the buffer passed into a notification.
2 - Notification
3 - Four-character tag identifying the field containing the
illegal value. Decode in a kernel debugger with:
.formats
4 - Illegal value or index into an array where an illegal value
exists.
0x800 : The monitor unexpectedly turned on while the system was in
connected standby.
2 - Current CS state
END_VALUES

PCI_BUS_DRIVER_INTERNAL (0xA1)

The PCI Bus driver detected inconsistency
problems in its internal structures and could not continue.

MEMORY_IMAGE_CORRUPT (0xA2)
On a system wake operation, various regions of memory may be CRCed to
guard against memory failures.

PARAMETERS

1 -
VALUES:
2 : Table page check failure
2 - IF PARAMETER 3 IS ZERO:
the page number in of the table page which failed
IF PARAMETER 3 IS NONZERO:
the page number with the failing page run index
3 - the index which failed to match the run (or zero)

3 : The checksum for the range of memory listed is incorrect
2 - starting physical page # of the range
3 - length (in pages) of the range
4 - the page number of the table page containing this run
END_VALUES

ACPI_DRIVER_INTERNAL (0xA3)

The ACPI Driver detected an internal inconsistency. The inconsistency is
so severe that continuing to run would cause serious problems.

The ACPI driver calls this when the state is so inconsistent that proceeding
would actually be dangerous. The problem may or may not be a BIOS issue, but
there is no way to tell.

CNSS_FILE_SYSTEM_FILTER (0xA4)
See the comment for FAT_FILE_SYSTEM (0x23)

ACPI_BIOS_ERROR (0xA5)

The ACPI Bios in the system is not fully compliant with the ACPI specification.
The first value indicates where the incompatibility lies:

PARAMETERS

1 -
VALUES:

1 : ACPI_ROOT_RESOURCES_FAILURE.
ACPI cannot find the SCI Interrupt vector in the resources handed
to it when ACPI is started.

2 - ACPI's deviceExtension
3 - ACPI's ResourceList
4 -
VALUES:
0 : No resource list found
1 : No IRQ resource found in list
END_VALUES

2 : ACPI_ROOT_PCI_RESOURCE_FAILURE
ACPI could not process the resource list for the PCI root buses

2 - The ACPI Extension for the PCI bus.
3 -
VALUES:
0 : ACPI cannot convert the BIOS' resource list into the proper
format. This probably represents a flaw in the BIOS' list
encoding procedure.
4 - Pointer to the QUERY_RESOURCES irp
1 : ACPI cannot convert the BIOS' resource list into the proper
format. This probably represents a flaw in the BIOS' list
encoding procedure.
4 - Pointer to the QUERY_RESOURCE_REQUIREMENTS irp
2 : ACPI found an empty resource list.
4 - 0
3 : ACPI could not find the current bus number in the CRS.
4 - Pointer to the PNP CRS descriptor
Other : Any other value is a pointer to the Resource List for PCI.
This indicates that there is an overlap between the list of
resources that PCI claims to decode and the list of memory
regions reported by the E820 BIOS interface.
4 - Pointer to the E820 Memory Table
END_VALUES

3 : ACPI_FAILED_MUST_SUCCEED_METHOD
ACPI tried to run a control method while creating device extensions
to represent the ACPI namespace, but this control method failed.

2 - The ACPI Object that was being run
3 - return value from the interpreter
4 - Name of the control method (in ULONG format)

4 : ACPI_PRW_PACKAGE_EXPECTED_INTEGER
ACPI evaluated a _PRW and expected to find an integer as a
package element.

2 - The ACPI Extension for which the _PRW belongs to
3 - Pointer to the method
4 - The DataType returned (see amli.h)

5 : ACPI_PRW_PACKAGE_TOO_SMALL
ACPI evaluated a _PRW and the package that came back failed to
contain at least 2 elements. The ACPI specification requires that
two elements to always be present in a _PRW.

2 - The ACPI Extension for which the _PRW belongs to
3 - Pointer to the _PRW
4 - Number of elements in the _PRW

6 : ACPI_PRx_CANNOT_FIND_OBJECT
ACPI tried to find a named object named, but could not find it.

2 - The ACPI Extension for which the _PRx belongs to
3 - Pointer to the _PRx
4 - Pointer to the name of the object to look for

7 : ACPI_EXPECTED_BUFFER
ACPI evaluated a method and expected to receive a Buffer in return.
However, the method returned some other data type

2 - The ACPI Extension for which the method belongs to
3 - Pointer to the method
4 - The DataType returned (see amli.h)

8 : ACPI_EXPECTED_INTEGER
ACPI evaluated a method and expected to receive an Integer in return.
However, the method returned some other data type

2 - The ACPI Extension for which the method belongs to
3 - Pointer to the method
4 - The DataType returned (see amli.h)

9 : ACPI_EXPECTED_PACKAGE
ACPI evaluated a method and expected to receive a Package in return.
However, the method returned some other data type

2 - The ACPI Extension for which the method belongs to
3 - Pointer to the method
4 - The DataType returned (see amli.h)

0xA : ACPI_EXPECTED_STRING
ACPI evaluated a method and expected to receive a String in return.
However, the method returned some other data type

2 - The ACPI Extension for which the method belongs to
3 - Pointer to the method
4 - The DataType returned (see amli.h)

0xB : ACPI_EJD_CANNOT_FIND_OBJECT
ACPI cannot find the object referenced to by an _EJD string

2 - The ACPI Extension for which which the _EJD belongs to
3 - The status returned by the interpreter
4 - Name of the object ACPI is trying to find

0xC : ACPI_CLAIMS_BOGUS_DOCK_SUPPORT
ACPI provides faulty/insufficient information for dock support

2 - The ACPI Extension for which ACPI found a dock device
3 - Pointer to the _EJD method
4 -
VALUES:
0: Bios does not claim system is dockage
1: Duplicate device extensions for dock device
END_VALUES

0xD : ACPI_REQUIRED_METHOD_NOT_PRESENT
ACPI could not find a required method/object in the namespace
This is the bugcheck that is used if a vendor does not have an
_HID or _ADR present

2 - The ACPI Extension that ACPI needs the object for
3 - The (ULONG) name of the method ACPI looked for
4 -
VALUES:
0: Base Case
1: Conflict
END_VALUES

0xE : ACPI_POWER_NODE_REQUIRED_METHOD_NOT_PRESENT
ACPI could not find a requird method/object in the namespace for
a power resource (or entity other than a "device"). This is the
bugcheck used if a vendor does not have an _ON, _OFF, or _STA present
for a power resource

2 - The NS PowerResource that ACPI needs the object for
3 - The (ULONG) name of the method ACPI looked for
4 -
VALUES:
0: Base Case
END_VALUES

0xF : ACPI_PNP_RESOURCE_LIST_BUFFER_TOO_SMALL
ACPI could not parse the resource descriptor
2 - The current buffer that ACPI was parsing
3 - The buffer's tag
4 - The specified length of the buffer

0x10 : ACPI_CANNOT_MAP_SYSTEM_TO_DEVICE_STATES
ACPI could not map determine the system to device state mapping
correctly.
2 - The ACPI Extension for which ACPI is trying to do the mapping
3 -
VALUES:
0 : The _PRx mapped back to a non-supported S-state
4 - The DEVICE_POWER_STATE (ie: x+1)
1 : ACPI cannot find a D-state to associate with the S-state
4 - The SYSTEM_POWER_STATE that is causing the problem
2 : The device claims to be able to wake the system when the
system is in this S-state, but the system doesn't actually
support this S-state.
4 - The SYSTEM_POWER_STATE that is causing the problem
END_VALUES

0x11 : ACPI_SYSTEM_CANNOT_START_ACPI
The system could not enter ACPI mode

2 -
VALUES:
0 : System could not initialize AML interpreter
1 : System could not find RSDT
2 : System could not allocate critical driver structures
3 : System could not load RSDT
4 : System could not load DDBs
5 : System cannot connect Interrupt vector
6 : SCI_EN never becomes set in PM1 Control Register
7 : Table checksum is incorrect
3 - Pointer to the table that had a bad checksum
4 - Creator Revision
8 : Failed to load DDB
3 - Pointer to the table that ACPI failed to load
4 - Creator Revision
9 : Unsupported Firmware Version
3 - FADT Version
0xA : System could not find MADT
0xB : System could not find any valid Local SAPIC structures in
the MADT
0xC: The OS is not capable of supporting active docking on this platform
0xD: Some of the specified system sleep states are not supported on this platform
END_VALUES

0x14 : ACPI_PNP_RESOURCE_LIST_LENGTH_TOO_LARGE
ACPI could not parse the resource descriptor, the length exceeds
MAXULONG.
2 - The current buffer that ACPI was parsing
3 - The buffer's tag
4 - Pointer to a variable containing ULONGLONG length of the buffer

0x15 : ACPI_TABLE_LOADTABLE
ACPI had a fatal error when processing a LoadTable instruction
2 - AML Context (!amli r Context)
3 -
VALUES:
1 : Failed to load the table
2 : Parameter Path String Object was not found
3 : Failed to insert ParameterData into ParameterPathString
4 : Out of System Memory
END_VALUES
4 - NT status code

0x16 : ACPI_ILLEGAL_PARENT
ACPI had a fatal error when processing an xSDT. An object was
declared as a child of a parent that cannot have children.
2 - Pointer to the parent NSOBJ
3 - Pointer to the illegal child NSOBJ

0x17 : ACPI_INVALID_GPE_INDEX
ACPI had a fatal error when processing a GPE index. An invalid
index was specified.
2 - GPE Bit Index.

0x1000 : ACPI_BIOS_USING_OS_MEMORY
ACPI had a fatal error when processing a memory operation region.
The memory operation region tried to map memory that has been
allocated for OS usage.
2 - The high portion of the physical address of the memory region.
3 - The low portion of the physical address of the memory region.
4 - The length of memory being mapped.

0x2001 : ACPI_FAILED_PIC_METHOD
ACPI tried to evaluate the PIC control method but failed

2 - InterruptModel (Integer)
3 - return value from interpreter
4 - Pointer to the PIC control method

0x10001 : ACPI_CANNOT_ROUTE_INTERRUPTS
ACPI tried to do interrupt routing, but failed

2 - Pointer to the device object
3 - Pointer to the parent of the device object
4 - Pointer to the PRT

0x10002 : ACPI_PRT_CANNOT_FIND_LINK_NODE
ACPI could not find the link node referenced in a _PRT
(This code exists in Windows 2000, but is obsolete in XP)

2 - Pointer to the device object
3 - Pointer to the string name ACPI is looking for, but could not find.
4 - Pointer to the PRT. Dump this with !acpikd.nsobj

0x10003 : ACPI_PRT_CANNOT_FIND_DEVICE_ENTRY
ACPI could not find a mapping in the _PRT package for a device
(This code exists in Windows 2000, but is obsolete in XP)

2 - Pointer to the device object
3 - The Device ID / Function Number. This DWORD is encoded
as follows: Bits 5:0 are the PCI Device Number, Bits 8:6 are
the PCI function number.
4 - Pointer to the PRT. Dump this with !acpikd.nsobj

0x10005 : ACPI_PRT_HAS_INVALID_FUNCTION_NUMBERS
ACPI found an entry in the _PRT for which the function ID isn't
all F's. The generic format for a _PRT entry is that the device
number is specified, but the function number isn't. If it isn't
done this way, then the machine vendor can introduce dangerous
ambiguities.
(This code exists in Windows 2000, but is obsolete in XP)

2 - Pointer to the PRT object. Dump this with !acpikd.nsobj
3 - Pointer to the current PRT Element. This is an index into the PRT.
4 - The DeviceID/FunctionID of the element. This DWORD is
encoded. Bits 15:0 are the PCI Function Number.
Bits 31:16 are the PCI Device Number.

0x10006 : ACPI_LINK_NODE_CANNOT_BE_DISABLED
ACPI found a link node, but cannot disable it. Link nodes must
be disable to allow for reprogramming

2 - Pointer to the link node. This device is missing the _DIS method.

0x10007 :
The _PRT contained a reference to a vector not described in the
I/O APIC entries MAPIC table.
2 - The vector that couldn't be found

0x10008 :
The ACPI SCI interrupt level is invalid.

0x10009 :
The FADT could not be located.

0x1000a :
The RSDT\XSDT could not be located.

0x1000b :
The ACPI table length was out of sync with the table revision
2 - The ACPI table signature
3 - pointer to the ACPI table

0x1000c :
_DSM method for interrupts returned malformed data.
2 - Revision ID
3 - Function Index

0x1000d :
A device used both GPE and GPIO interrupts, which is not supported.
2 - The ACPI Extension for the device
3 -
VALUES:
0 : _PRW specified with no wake-capable interrupts and at least one
GPIO interrupt
1 : Since there are wake-capable interrupts, _PRW should specify a
GpeInfo value of 0xffffffff

0x20000 :
The PM_TMR_BLK entry in the Fixed ACPI Description Table doesn't
point to a working ACPI timer block.
2 - The I/O port in the Fixed Table

END_VALUES

DESCRIPTION
This bug check covers a great variety of ACPI problems. If a kernel debugger
is attached, use "!analyze -v". This command will analyze the precise problem,
and display whatever information is most useful for debugging the specific
error.

BAD_EXHANDLE (0xA7)

The kernel mode handle table detected an inconsistent handle table
entry state.

SESSION_HAS_VALID_POOL_ON_EXIT (0xAB)
PARAMETERS
1 - session ID
2 - number of paged pool bytes that are leaking
3 - number of nonpaged pool bytes that are leaking
4 - total number of paged and nonpaged allocations that are leaking.
nonpaged allocations are in the upper half of this word,
paged allocations are in the lower half of this word.

DESCRIPTION
Caused by a session driver not freeing its pool allocations prior to a
session unload. This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.

HAL_MEMORY_ALLOCATION (0xAC)

The HAL was unable to obtain memory for a system critical requirement.
These allocations are made early in system initialization and such a
failure is not expected. It probably indicates some other critical error
such as pool corruption or massive consumption.

PARAMETERS
1 - Allocation size.
2 - 0
3 - Pointer to string containing file name.
4 - (reserved)

VIDEO_DRIVER_DEBUG_REPORT_REQUEST (0xAD)

This request is the special code for non-fatal minidumps created by Video Port
on behalf of the Video Driver during Run-Time. Should never appear in
Full Dump or as code of system bugcheck.

PARAMETERS
1 - driver specific
2 - driver specific
3 - driver specific
4 - number of all reports requested since boot time

DESCRIPTION
A Video Driver requested the Debug Report.

BGI_DETECTED_VIOLATION (0xB1)

VIDEO_DRIVER_INIT_FAILURE (0xB4)

PARAMETERS
1 - Driver failure data.
2 - Graphics device list.
3 - Graphics device list data.
4 - Possible cause of the bugcheck.
VALUES:
0x0 : Indicates generic failure.
0x1 : Indicates failure is possibly due to system shutdown.
0x2 : Indicates failure is caused by failure to load/initialize with a PhysDisp that is still in memory.
Check win32k!gpLastFailedPhysDisp. (It is a win32k!PGRAPHICS_DEVICE)
0x3 : Indicates failure is due to not being able to load the driver. (check driver file)
0x4 : Indicates failure is due to not being able to get modes from the driver. (likely memory issue)
0x5 : Indicates failure is due to not being able to set mode using the driver. (likely GDI resource issue)
END_VALUES

DESCRIPTION
The system was not able to go into graphics mode because no display drivers
were able to start. This usually occurs if no video miniport drivers load
successfully.

ATTEMPTED_SWITCH_FROM_DPC (0xB8)
PARAMETERS
1 - Original thread which is the cause of the failure
2 - New thread
3 - Stack address of the original thread
DESCRIPTION
A wait operation, attach process, or yield was attempted from a DPC routine.
This is an illegal operation and the stack track will lead to the offending
code and original DPC routine.

CHIPSET_DETECTED_ERROR (0xB9)

SESSION_HAS_VALID_VIEWS_ON_EXIT (0xBA)
PARAMETERS
1 - session ID
2 - number of mapped views that are leaking
3 - address of this session's mapped views table
4 - size of this session's mapped views table.

DESCRIPTION
Caused by a session driver not unmapping its mapped views prior to a
session unload. This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.

NETWORK_BOOT_INITIALIZATION_FAILED (0xBB)
PARAMETERS
1 - the part of network initialization that failed
2 - the failure status
DESCRIPTION
Caused if we are booting off the network, and a critical function fails during
IO initialization. Currently the codes for the first value are:
1 - updating the registry.
2 - starting the network stack - Windows sends IOCTLs to the redirector and
datagram receiver, then waits for the redirector to be ready. If it is not
ready within a certain period of time, initialization fails.
3 - failed sending the DHCP IOCTL to TCP - this is how Windows informs the
transport of its IP adress.

NETWORK_BOOT_DUPLICATE_ADDRESS (0xBC)
PARAMETERS
1 - the IP address, show as a hex DWORD. So an address aa.bb.cc.dd will
appear as 0xddccbbaa.
2 - the hardware address of the other machine.
3 - the hardware address of the other machine.
4 - the hardware address of the other machine. For Ethernet, a MAC address
of aa-bb-cc-dd-ee-ff will be indicated by the second parameter
containing 0xaabbccdd, the third parameter containing 0xeeff0000, and
the fourth parameter containing 0x00000000.
DESCRIPTION
This indicates that when TCP/IP sent out an ARP for its IP address, it got
a response from another machine, indicating a duplicate IP address. When we
are booting off the network this is a fatal error.

INVALID_HIBERNATED_STATE (0xBD)
The hibernated memory image does not match the current hardware configuration.
This bugcheck occurs when a system resumes from hibernate and discovers that the
hardware has been changed while the system was hibernated.

Note: This bug check no longer exists in any version of Windows.

PARAMETERS
1 - hardware that was invalid
VALUES:
1 : Number of installed processors is less than before the hibernation
2 - number of processors before hibernation
3 - number of processors after hibernation
END_VALUES

ATTEMPTED_WRITE_TO_READONLY_MEMORY (0xBE)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).

PARAMETERS
1 - Virtual address for the attempted write.
2 - PTE contents.
3 - (reserved)
4 - (reserved)

DESCRIPTION
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.

MUTEX_ALREADY_OWNED (0xBF)

This thread is attempting to acquire ownership of a mutex it already owns.

PARAMETERS
1 - Address of Mutex
2 - Thread
3 - 0
4 - (reserved)

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (0xC1)

Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.

PARAMETERS
4 - subclass of driver violation.
VALUES:
0x20 : caller is trying to free pool which is not allocated
1 - address trying to free
2 - (reserved)
3 - 0.

0x21 : Caller is trying to free an incorrect Special Pool memory block.

- The value of parameter 2 is stored at the very beginning of the memory
page that contains the virtual address being freed (parameter 1).

- The value of parameter 3 is computed as the number of bytes
available between the virtual address being freed (parameter 1)
and the end of that memory page.

- Under normal system behavior, the computed number of bytes (parameter 3)
is equal to the number of bytes stored in the header (parameter 2)
rounded up to an alignment of 8 bytes on 32 bit systems and 16 bytes
on 64 bit systems.

- On this system, the value of parameter 3 was smaller than the value of
parameter 2, so either the caller specified an incorrect virtual
address to be freed, or the beginning of this Special Pool memory page
was corrupted.

1 - Address trying to free.
2 - Size of the memory block, as recorded in the pool block header.
3 - Size of the memory block, as computed based on the address being freed.

0x22 : Caller is trying to free an incorrect Special Pool memory block.

- The value of parameter 2 is stored at the very beginning of the memory
page that contains the virtual address being freed (parameter 1).

- The value of parameter 3 is computed as the number of bytes
available between the virtual address being freed (parameter 1)
and the end of that memory page.

- On this system, the value of parameter 3 was larger than the rounded up
value of parameter 2, so either the caller specified an incorrect virtual
address to be freed, or the beginning of this Special Pool memory page
was corrupted.

1 - Address trying to free.
2 - Size of the memory block, as recorded in the pool block header.
3 - Size of the memory block, as computed based on the address being freed.

0x23 : caller is freeing an address where nearby bytes within the same page have been corrupted
1 - address trying to free
2 - address where bits are corrupted
3 - (reserved)

0x24 : caller is freeing an address where bytes after the end of the allocation have been overwritten
1 - address trying to free
2 - address where bits are corrupted
3 - (reserved)

0x30 : caller is trying to allocate pool from an incorrect IRQL level
1 - current IRQL
2 - pool type
3 - number of bytes

0x31 : caller is trying to free pool from an incorrect IRQL level
1 - current IRQL
2 - pool type
3 - address trying to free

0x32 : caller is freeing an address where nearby bytes within the same page have a single bit error
1 - address trying to free
2 - address where one bit is corrupted
3 - (reserved)

END_VALUES

BAD_POOL_CALLER (0xC2)

The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.

PARAMETERS
1 - type of pool violation the caller is guilty of.
VALUES:

0x0 : The caller is requesting a zero byte pool allocation.
Parameter 2 - zero.
Parameter 3 - the pool type being allocated.
Parameter 4 - the pool tag being used.

0x1 : Pool header has been corrupted
Parameter 2 - Pointer to pool header
Parameter 3 - First part of pool header contents
Parameter 4 - 0

0x2 : Pool header has been corrupted
Parameter 2 - Pointer to pool header
Parameter 3 - First part of pool header contents
Parameter 4 - 0

0x4 : Pool header has been corrupted
Parameter 2 - Pointer to pool header
Parameter 3 - First part of pool header contents
Parameter 4 - 0

0x6 : Attempt to free pool which was already freed
Parameter 2 - (reserved)
Parameter 3 - Pointer to pool header
Parameter 4 - Pool header contents

0x7 : Attempt to free pool which was already freed
Parameter 2 - (reserved)
Parameter 3 - Memory contents of the pool block
Parameter 4 - Address of the block of pool being deallocated

0x8 : Attempt to allocate pool at invalid IRQL
Parameter 2 - Current IRQL
Parameter 3 - Pool type
Parameter 4 - Size of allocation

0x9 : Attempt to free pool at invalid IRQL
Parameter 2 - Current IRQL
Parameter 3 - Pool type
Parameter 4 - Address of pool

0xA : Attempt to free some other component's protected pool.
Parameter 2 - Address of pool
Parameter 3 - Allocator's tag
Parameter 4 - Tag being used in the attempted free.

0xB/0xC/0xD : Attempt to release quota on a corrupted pool allocation.
Parameter 2 - Address of pool
Parameter 3 - Pool allocation's tag
Parameter 4 - Quota process pointer (bad).

0x40 : Attempt to free usermode address to kernel pool
Parameter 2 - Starting address
Parameter 3 - Start of system address space
Parameter 4 - 0

0x41 : Attempt to free a non-allocated nonpaged pool address
Parameter 2 - Starting address
Parameter 3 - physical page frame
Parameter 4 - highest physical page frame

0x42 : Attempt to free a virtual address which was never in any pool
Parameter 2 - Address being freed.
Parameter 3 - 0
Parameter 4 - 0

0x43 : Attempt to free a virtual address which was never in any pool
Parameter 2 - Address being freed.
Parameter 3 - 0
Parameter 4 - 0

0x44: Attempt to free a non-allocated nonpaged pool address
Parameter 2 - Starting address
Parameter 3 - (reserved)
Parameter 4 - 0

0x46 : Attempt to free an invalid pool address
Parameter 2 - Starting address
Parameter 3 - 0
Parameter 4 - 0

0x47 : Attempt to free a non-allocated nonpaged pool address
Parameter 2 - Starting address
Parameter 3 - physical page frame
Parameter 4 - highest physical page frame

0x48 : Attempt to free a non-allocated paged pool address
Parameter 2 - Starting address
Parameter 3 - (reserved)
Parameter 4 - (reserved)

0x50 : Attempt to free a non-allocated paged pool address
Parameter 2 - Starting address
Parameter 3 - Start offset in pages from beginning of paged pool
Parameter 4 - Size in bytes of paged pool

0x60 : Attempt to free an invalid contiguous memory address (ie: caller of MmFreeContiguousMemory is passing a bad pointer).
Parameter 2 - Starting address
Parameter 3 - 0
Parameter 4 - 0

0x62 : Attempt to free a contiguous memory address where bytes after the end of the allocation have been overwritten
Parameter 2 - Starting address
Parameter 3 - Address where bits are corrupted
Parameter 4 - (reserved)

0x99 : Attempt to free pool with invalid address (or corruption in pool header)
Parameter 2 - Address being freed
Parameter 3 - 0
Parameter 4 - 0

0x9A : Attempt to allocate must-succeed pool (this pool type has been deprecated)
Parameter 2 - Pool type
Parameter 3 - Size of allocation in bytes
Parameter 4 - Allocation's pool tag

0x9B : Attempt to allocate pool with a tag of zero. This would make the pool untrackable and worse, corrupt the existing tag tables.
Parameter 2 - Pool type
Parameter 3 - Size of allocation in bytes
Parameter 4 - Caller's address.

0x9C : Attempt to allocate pool with a tag of BIG. This would make the pool untrackable and worse, corrupt the existing tag tables.
Parameter 2 - Pool type
Parameter 3 - Size of allocation in bytes
Parameter 4 - Caller's address.

0x9D : Attempt to allocate pool with a tag that does not contain any letters or digits.
Using these tags makes tracking pool issues very hard.
Parameter 2 - Incorrect pool tag used.
Parameter 3 - Pool type
Parameter 4 - Caller's address.

0x41286 : Attempt to free a paged pool address in the middle of an allocation.
Parameter 2 - (reserved)
Parameter 3 - (reserved)
Parameter 4 - Start offset in pages from beginning of paged pool

END_VALUES

DRIVER_VERIFIER_DETECTED_VIOLATION (0xC4)

A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.

PARAMETERS
1 - subclass of driver violation.
VALUES
0x00 : caller is trying to allocate zero bytes
2 - current IRQL
3 - pool type
4 - number of bytes

0x01 : caller is trying to allocate paged pool at DISPATCH_LEVEL or above
2 - current IRQL
3 - pool type
4 - number of bytes

0x02 : caller is trying to allocate nonpaged pool at an IRQL above DISPATCH_LEVEL
2 - current IRQL
3 - pool type
4 - number of bytes

0x03 : caller is trying to allocate more than one page of must succeed
pool, but one page is the maximum allowed by this API.

0x10 : caller is freeing a bad pool address
2 - bad pool address

0x11 : caller is trying to free paged pool at DISPATCH_LEVEL or above
2 - current IRQL
3 - pool type
4 - pool address

0x12 : caller is trying to free nonpaged pool at an IRQL above DISPATCH_LEVEL
2 - current IRQL
3 - pool type
4 - pool address

0x13 : the pool the caller is trying to free is already free.
2 - (reserved)
3 - pool header
4 - pool header contents

0x14 : the pool the caller is trying to free is already free.
2 - (reserved)
3 - pool header
4 - pool header contents

0x15 : the pool the caller is trying to free contains an active timer.
2 - timer entry
3 - pool type
4 - pool address being freed

0x16 : the pool the caller is trying to free is a bad address.
2 - line number
3 - pool address
4 - 0

0x17 : the pool the caller is trying to free contains an active ERESOURCE.
2 - resource entry
3 - pool type
4 - pool address being freed

0x30 : raising IRQL to an invalid level,
2 - current IRQL,
3 - new IRQL
0x31 : lowering IRQL to an invalid level,
2 - current IRQL,
3 - new IRQL
4 - 0 means the new IRQL is bad, 1 means the IRQL is invalid inside a DPC routine

0x32 : releasing a spinlock when not at DISPATCH_LEVEL.
2 - current IRQL,
3 - spinlock address

0x33 : acquiring a fast mutex when not at APC_LEVEL or below.
2 - current IRQL,
3 - fast mutex address

0x34 : releasing a fast mutex when not at APC_LEVEL.
2 - current IRQL,
3 - thread APC disable count
4 - fast mutex address

0x35 : kernel is releasing a spinlock when not at DISPATCH_LEVEL.
2 - current IRQL,
3 - spinlock address
4 - old irql.

0x36 : kernel is releasing a queued spinlock when not at DISPATCH_LEVEL.
2 - current IRQL,
3 - spinlock number,
4 - old irql.

0x37 : a resource is being acquired but APCs are not disabled.
2 - current IRQL,
3 - thread APC disable count,
4 - resource.

0x38 : a resource is being released but APCs are not disabled.
2 - current IRQL,
3 - thread APC disable count,
4 - resource.

0x39 : a mutex is being acquired unsafe, but irql is not APC_LEVEL on entry.
2 - current IRQL,
3 - thread APC disable count,
4 - mutex.

0x3A : a mutex is being released unsafe, but irql is not APC_LEVEL on entry.
2 - current IRQL,
3 - thread APC disable count,
4 - mutex.

0x3B : KeWaitXxx routine is being called at DISPATCH_LEVEL or higher.
2 - current irql,
3 - object to wait on,
4 - time out parameter.

0x3C : ObReferenceObjectByHandle is being called with a bad handle.
2 - Handle value specified by the caller.
3 - Object type specified by the caller.

0x3D : ERESOURCE address is unaligned.
2 - 0
3 - 0
4 - bad resource address passed in.

0x3E : KeLeaveCriticalRegion is being called for a thread that has not entered a critical region.
2 - 0
3 - 0
4 - 0

0x3F : ObReferenceObject is being called on an object that has a reference count of zero or
ObDereferenceObject is being called on an object with a reference count of zero
2 - Object address
3 - new object reference count -1 = dereference case, 1 = reference case
4 - 0

0x40 : Acquiring a spinlock at IRQL < DISPATCH_LEVEL.
2 - Current IRQL
3 - Spinlock address

0x41 : Releasing a spinlock at IRQL < DISPATCH_LEVEL.
2 - Current IRQL
3 - Spinlock address

0x42 : acquiring a spinlock when caller is already above DISPATCH_LEVEL.
2 - current IRQL,
3 - spinlock address

0x51 : freeing memory where the caller has written past the end of the
allocation, overwriting our stored byte count.
2 - base address of the allocation,
3 - corrupt address,
4 - charged bytes.

0x52 : freeing memory where the caller has written past the end of the
allocation, overwriting our stored virtual address.
2 - base address of the allocation,
3 - hash entry,
4 - charged bytes.

0x53 : freeing memory where the caller has written past the end of the
allocation, overwriting our stored virtual address.
2 - base address of the allocation,
3 - header,
4 - (reserved)

0x54 : freeing memory where the caller has written past the end of the
allocation, overwriting our stored virtual address.
2 - base address of the allocation,
3 - pool hash size,
4 - listindex.

0x59 : freeing memory where the caller has written past the end of the
allocation, overwriting our stored virtual address.
2 - base address of the allocation,
3 - listindex,
4 - (reserved)

0x60 : A driver has forgotten to free its pool allocations prior to unloading.
2 - paged bytes
3 - nonpaged bytes,
4 - total # of (paged+nonpaged) allocations that weren't freed.

To get the name of the driver at fault, type
dp ViBadDriver l1; dS @$p

Then type !verifier 3 drivername.sys for info on the allocations
that were leaked that caused the bugcheck.

0x61 : A driver is unloading and allocating memory (in another thread) at the same time.
2 - paged bytes
3 - nonpaged bytes,
4 - total # of (paged+nonpaged) allocations that weren't freed.

To get the name of the driver at fault, type
dp ViBadDriver l1; dS @$p

Then type !verifier 3 drivername.sys for info on the allocations
that were leaked that caused the bugcheck.

0x62 : A driver has forgotten to free its pool allocations prior to unloading.
2 - name of the driver having the issue.
3 - verifier internal structure with driver information.
4 - total # of (paged+nonpaged) allocations that weren't freed.

Type !verifier 3 drivername.sys for info on the allocations
that were leaked that caused the bugcheck.

0x6F : MmProbeAndLockPages called on pages not in PFN database. This
is typically a driver calling this routine to lock its own
private dualport RAM. Not only is this not needed, it can also
corrupt memory on machines with noncontiguous physical RAM.
2 - MDL address
3 - physical page being locked
4 - highest physical page in the system

0x70 : MmProbeAndLockPages called when not at DISPATCH_LEVEL or below.
2 - current IRQL
3 - MDL address
4 - access mode

0x71 : MmProbeAndLockProcessPages called when not at DISPATCH_LEVEL or below.
2 - current IRQL
3 - MDL address
4 - process address

0x72 : MmProbeAndLockSelectedPages called when not at DISPATCH_LEVEL or below.
2 - current IRQL
3 - MDL address
4 - process address

0x73 : MmMapIoSpace called when not at DISPATCH_LEVEL or below.
2 - current IRQL
3 - low 32 bits of the physical address (full 64 on Win64)
4 - number of bytes

0x74 : MmMapLockedPages called when not at DISPATCH_LEVEL or below.
2 - current IRQL
3 - MDL address
4 - access mode

0x75 : MmMapLockedPages called when not at APC_LEVEL or below.
2 - current IRQL
3 - MDL address
4 - access mode

0x76 : MmMapLockedPagesSpecifyCache called when not at DISPATCH_LEVEL or below.
2 - current IRQL
3 - MDL address
4 - access mode

0x77 : MmMapLockedPagesSpecifyCache called when not at APC_LEVEL or below.
2 - current IRQL
3 - MDL address
4 - access mode

0x78 : MmUnlockPages called when not at DISPATCH_LEVEL or below.
2 - current IRQL
3 - MDL address
4 - 0

0x79 : MmUnmapLockedPages called when not at DISPATCH_LEVEL or below.
2 - current IRQL
3 - virtual address being unmapped
4 - MDL address

0x7A : MmUnmapLockedPages called when not at APC_LEVEL or below.
2 - current IRQL
3 - virtual address being unmapped
4 - MDL address

0x7B : MmUnmapIoSpace called when not at APC_LEVEL or below.
2 - current IRQL
3 - virtual address being unmapped
4 - number of bytes

0x7C : MmUnlockPages called with an MDL whose pages were never
successfully locked.
2 - MDL address.
3 - MDL flags.
4 - 0.

0x7D : MmUnlockPages called with an MDL whose pages are from nonpaged
pool - these should never be unlocked.
2 - MDL address.
3 - MDL flags.
4 - 0.

0x7E : Allocating or freeing physical pages for MDL at incorrect IRQL.
2 - Current IRQL value.
3 - Maximum allowed IRQL value.
4 - 0.

0x80 : KeSetEvent called when not at DISPATCH_LEVEL or below.
2 - current IRQL.
3 - event address.
4 - 0.

0x81 : MmMapLockedPages called without MDL_MAPPING_CAN_FAIL
2 - MDL address.
3 - MDL flags.
4 - 0.

0x82 : MmMapLockedPagesSpecifyCache called without MDL_MAPPING_CAN_FAIL
2 - MDL address.
3 - MDL flags.
4 - Whether to bugcheck on failure.

0x83 : MmMapIoSpace called to map, but the caller hasn't locked down the MDL pages.
2 - Starting physical address to map.
3 - Number of bytes to map.
4 - The first page frame number that isn't locked down.

0x84 : MmMapIoSpace called to map, but the caller hasn't locked down the MDL pages.
2 - Starting physical address to map.
3 - Number of bytes to map.
4 - The first page frame number that is on the free list.

0x85 : MmMapLockedPages called to map, but the caller hasn't locked down the MDL pages.
2 - MDL address.
3 - Number of pages to map.
4 - The first page frame number that isn't locked down.

0x86 : MmMapLockedPages called to map, but the caller hasn't locked down the MDL pages.
2 - MDL address.
3 - Number of pages to map.
4 - The first page frame number that is on the free list.

0x87 : MmMapIoSpace called to map, but the caller's cache type conflicts with an already existing mapping.
2 - Base physical page (shift left for physical address) of the existing (conflicting) mapping.
3 - Number of pages already mapped in the existing (conflicting) mapping.
4 - MEMORY_CACHING_TYPE of the existing (conflicting mapping).

0x88 : MmMapIoSpace called to map a physical range as noncached or writecombined, but the caller's physical range already has an existing cached mapping.
2 - Base physical page (shift left for physical address) of the requested mapping.
3 - Number of pages in the requested mapping.
4 - MEMORY_CACHING_TYPE of the requested mapping.

0x89 : An MDL is not marked as I/O but contains non-memory page addresses.
2 - MDL address.
3 - Pointer to the non-memory page in the MDL.
4 - The non-memory page number in the MDL.

0x8A : MmMapLockedPages* called to map a physical range as noncached or writecombined, but the caller's physical range already has an existing cached mapping.
2 - MDL address.
3 - Conflicting physical page (shift left for physical address) of the requested mapping.
4 - MEMORY_CACHING_TYPE of the requested mapping.

0x90 : A driver switched stacks. The current stack is neither a thread
stack nor a DPC stack. Typically the driver doing this should be
on the stack obtained from `kb' command.

0x91 : A driver switched stacks using a method that is not supported by
the operating system. The only supported way to extend a kernel
mode stack is by using KeExpandKernelStackAndCallout.

0xA0 : A CRC error was detected on the sector (synchronously).
2 - Request Irp.
3 - Device object of the lower device.
4 - Sector number on which the CRC error was detected.

0xA1 : A CRC error was detected on the sector (asynchronously).
2 - *COPY* of original Irp (actual irp has been completed)
3 - Device object of the lower device.
4 - Sector number on which the CRC error was detected.

0xA2 : CRCDISK checksum copies don't match (possible paging error)
2 - Request Irp or copy.
3 - Device object of the lower device.
4 - Sector number on which the CRC error was detected.

0xB0 : MmProbeAndLockPages called on an MDL having incorrect flags.
For example, calling MmProbeAndLockPages for an MDL set-up
by calling MmBuildMdlForNonPagedPool is incorrect.
2 - MDL address.
3 - MDL flags.
4 - Incorrect MDL flags.

0xB1 : MmProbeAndLockProcessPages called on an MDL having incorrect flags.
For example, calling MmProbeAndLockProcessPages for an MDL set-up
by calling MmBuildMdlForNonPagedPool is incorrect.
2 - MDL address.
3 - MDL flags.
4 - Incorrect MDL flags.

0xB2 : MmMapLockedPages called on an MDL having incorrect flags.
For example, calling MmMapLockedPages for an MDL
that is already mapped to a system address is incorrect.
2 - MDL address.
3 - MDL flags.
4 - Incorrect MDL flags.

0xB3 : MmMapLockedPages called on an MDL having incorrect flags.
For example, calling MmMapLockedPages for an MDL
that was not locked is incorrect.
2 - MDL address.
3 - MDL flags.
4 - Missing MDL flags (at least one of them was expected).

0xB4 : MmUnlockPages called on a partial MDL (created with IoBuildPartialMdl).
2 - MDL address.
3 - MDL flags.
4 - Unexpected partial MDL flag.

0xB5 : MmUnmapLockedPages called on a partial MDL (created with IoBuildPartialMdl).
2 - MDL address.
3 - MDL flags.
4 - Unexpected partial MDL flag.

0xB6 : MmUnmapLockedPages called on an MDL that is not mapped to a system address.
2 - MDL address.
3 - MDL flags.
4 - Missing MDL flag.

0xB7 : The system BIOS has corrupted low physical memory during a sleep transition.
2 - Number of physical pages corrupted.
3 - First corrupted physical page.
4 - Last corrupted physical page.

0xB8 : The pages that are described by the MDL are still mapped.
The driver must unmap the pages before calling IoFreeMdl.
2 - MDL address.
3 - MDL flags.
4 - Reserved (unused).

0xC0 : Calling IoCallDriver with interrupts disabled.
2 - IRP address.

0xC1 : Driver dispatch routine returned with interrupts disabled.
2 - Driver dispatch routine address.

0xC2 : Interrupts disabled before calling Fast I/O dispatch routine.

0xC3 : Driver Fast I/O dispatch routine returned with interrupts disabled.
2 - Driver dispatch routine address.

0xC5 : Thread APC disable count changed by driver dispatch routine.
2 - Driver dispatch routine address.
3 - Current thread APC disable count.
4 - Thread APC disable count before calling driver dispatch routine.

0xC6 : Thread APC disable count changed by driver Fast I/O dispatch routine.
2 - Driver Fast I/O dispatch routine address.
3 - Current thread APC disable count.
4 - Thread APC disable count before calling driver dispatch routine.

0xCA : Re-initializing lookaside list.
2 - Lookaside list address.

0xCB : Deleting uninitialized lookaside list.
2 - Lookaside list address.

0xCC : Freeing pool allocation that contains active lookaside list.
2 - Lookaside list address.
3 - Pool allocation start address.
4 - Pool allocation size.

0xCD : Lookaside list allocation block size is too small.
2 - Lookaside list address.
3 - Block size specified by the caller.
4 - Minimum supported block size.

0xD0 : Re-initializing ERESOURCE.
2 - ERESOURCE address.

0xD1 : Deleting uninitialized ERESOURCE.
2 - ERESOURCE address.

0xD2 : Freeing pool allocation that contains active ERESOURCE.
2 - ERESOURCE address.
3 - Pool allocation start address.
4 - Pool allocation size.

0xD5 : IoReleaseRemoveLock tag doesn't match previous IoAcquireRemoveLock tag.
2 - Address of the chk build Remove Lock structure.
3 - Tag that doesn't match previous IoAcquireRemoveLock tag.

If the driver calling IoReleaseRemoveLock is not built chk,
Parameter 2 is the chk build Remove Lock used by the Driver Verifier
on behalf of the driver. In this case, the address of the RemoveLock
used by the driver is not used at all, because the Driver Verifier is
replacing the lock address for all the Remove Lock APIs.

0xD6 : Tag used for IoReleaseRemoveLockAndWait call is incorrect.
2 - Address of the chk build Remove Lock structure.
3 - Tag that doesn't match previous IoAcquireRemoveLock tag.
4 - Expected previous IoAcquireRemoveLock tag.

0xD7 : Re-initializing Remove Lock.
2 - Address of the chk build Remove Lock structure used internally by Verifier.
3 - Address of the Remove Lock structure specified by the driver.

A Remove Lock cannot be re-initialized, even after calling
IoReleaseRemoveLockAndWait, because other threads might still be
using that lock (by calling IoAcquireRemoveLock). The driver should
allocate the Remove Lock inside its device extension, and initialize
it a single time. The lock will be deleted together with the device
extension.

0xDA : Unloading driver that forgot to deregister its WMI callback function.
2 - Driver start address.
3 - WMI callback address inside the driver.

0xDB : Deleting device object that was not deregistered from WMI.
2 - Device object address.

0xDC : Incorrect RegHandle value specified as parameter for EtwUnregister.

0xDD : Unloading driver that forgot to call EtwUnregister.
2 - Address where the culprit driver called EtwRegister.
3 - Start address of the culprit driver.
4 - Address of the leaked ETW_REG_ENTRY structure.

0xDF : Synchronization object address in session address space.
2 - Synchronization object address.

0xE0 : Calling OS Kernel API with user-mode address as parameter.
2 - Address used as API parameter.
3 - Size in bytes of the address range used as API parameter.

0xE1 : Synchronization object address is bogus or pageable.
2 - Synchronization object address.

0xE2 : IRP field is a user-mode address but Irp->RequestorMode is KernelMode.
2 - IRP address.
3 - User-mode address present as the value of an IRP field.

0xE3 : Kernel Zw API called with user-mode address as parameter.
2 - Address inside the driver making the incorrect API call.
3 - User-mode address used as API parameter.

0xE4 : Kernel Zw API called with malformed UNICODE_STRING structure as parameter.
2 - Address inside the driver making the incorrect API call.
3 - Address of the incorrect UNICODE_STRING structure.

0xE5 : Calling Kernel API at incorrect IRQL.
2 - Current IRQL.

0xE6 : Kernel Zw API was not called at IRQL = PASSIVE_LEVEL and with special kernel APCs enabled.
2 - Address inside the driver making the Zw API call.
3 - Current IRQL.
4 - Special kernel APCs.

0xEA : A pushlock is being acquired but APCs are not disabled.
2 - Current IRQL.
3 - Thread APC disable count.
4 - Pushlock address.

0xEB : A pushlock is being released but APCs are not disabled.
2 - Current IRQL.
3 - Thread APC disable count.
4 - Pushlock address.

0xF0 : Calling memcpy with overlapping source and destination buffers.
2 - Destination buffer address.
3 - Source buffer address.
4 - Number of bytes to copy.

0xF5 : ObReferenceObjectByHandle is being called with a NULL handle.
2 - Handle value specified by the caller.
3 - Object type specified by the caller.

0xF6 : Referencing user handle as KernelMode.
2 - Handle value being referenced.
3 - Address of the current process.
4 - Address inside the driver that is performing the incorrect reference.

0xF7 : Attempting UserMode reference for Kernel Handle, in the context of the System Process.
2 - Handle value specified by the caller.
3 - Object type specified by the caller.
4 - AccessMode specified by the caller.

0xFA : IRP completion routine returned at changed IRQL.
2 - Completion routine address.
3 - IRQL value before calling completion routine.
4 - Current IRQL value, after calling completion routine.

0xFB : Thread APC disable count changed by driver IRP completion routine.
2 - Completion routine address.
3 - Current thread APC disable count.
4 - Thread APC disable count before calling IRP completion routine.

0xFC : Calling ZwNotifyChangeKey (from kernel mode) with unsupported ApcContext value.
2 - Address inside the driver making the incorrect API call.
3 - Provided ApcContext value.

0x105 : Freeing IRP using ExFreePool instead of IoFreeIrp.
2 - IRP address.

0x10A : Attempting to charge pool quota to the Idle process.

0x10B : Attempting to charge pool quota from a DPC routine. This is incorrect because the current process context is undefined.

0x110 : Extended thread context corrupted by Interrupt Service Routine.
2 - The address of the Interrupt Service Routine.
3 - Address of the extended context saved before executing ISR.
4 - Address of the extended context saved after executing ISR.

0x111 : Interrupt Service Routine returned at changed IRQL.
2 - The address of the Interrupt Service Routine.
3 - IRQL before executing ISR.
4 - IRQL after executing ISR.

0x115 : System didn't finish shutting down in a long time.
2 - The address of the thread responsible for the shutdown, that might be deadlocked.

0x11A : Calling KeEnterCriticalRegion at IRQL > APC_LEVEL.
2 - Current IRQL.

0x11B : Calling KeLeaveCriticalRegion at IRQL > APC_LEVEL.
2 - Current IRQL.

0x120 : Waiting at IRQL > DISPATCH_LEVEL.
2 - IRQL value.
3 - Object to wait on.
4 - Timeout parameter.

0x121 : Waiting at DISPATCH_LEVEL, without a timeout.
2 - IRQL value.
3 - Object to wait on.
4 - Timeout parameter.

0x122 : Waiting at DISPATCH_LEVEL, with a timeout different than zero.
2 - IRQL value.
3 - Object to wait on.
4 - Address of the time out value.

0x123 : UserMode Wait for an object on the kernel stack.
2 - Object to wait on.

0x130 : Work item in session address space.
2 - Work item address.

0x131 : Work item in pageable memory.
2 - Work item address.

0x135 : Cancelled IRP wasn't completed in due time.
2 - IRP address.
3 - Number of milliseconds allowed between the IoCancelIrp call and the completion for this IRP.

0x13A : Incorrect Verifier Pool Tracking internal value.
2 - Address of the pool block being freed.
3 - Incorrect value.
4 - Address of the incorrect value.

0x13B : Incorrect Verifier Pool Tracking internal value.
2 - Address of the pool block being freed.
3 - Address of the incorrect value.
4 - Address of a pointer to the incorrect memory page.

0x13C : Incorrect Verifier Pool Tracking internal value.
2 - Address of the pool block being freed.
3 - Incorrect value.
4 - Address of the incorrect value.

0x13D : Incorrect Verifier Pool Tracking internal value.
2 - Address of the pool block being freed.
3 - Address of the incorrect value.
4 - Correct value that was expected.

0x13E : Pool block address specified by the caller is different from the address tracked by Verifier.
2 - Pool block address specified by the caller.
3 - Pool block address tracked by Verifier.
4 - Pointer to the pool block address tracked by Verifier.

0x13F : Number of memory bytes being freed is different from the number of bytes tracked by Verifier.
2 - Address of the pool block being freed.
3 - Number of bytes being freed.
4 - Pointer to the number of bytes tracked by Verifier.

0x1000 : Acquiring recursively a lock that doesn't support recursive acquire.
2 - Lock address.
3 - Verifier internal data.
4 - Verifier internal data.

0x1001 : Verifier predicted potential deadlock.
2 - Lock address.
3 - Verifier internal data.

0x1003 : Releasing two locks in reverse order of their acquire.
2 - First lock address.
3 - Second lock address.
4 - Verifier internal data.

0x1004 : Releasing lock that was acquired from a different thread.
2 - Lock address.
3 - Address of the thread that acquired the lock.
4 - Address of the current thread, that releases the lock.

0x1005 : Re-initializing active lock.
2 - Lock address.
3 - Verifier internal data.

0x1006 : Lock owned by a terminated thread.
2 - Lock address or lock owner thread address.
3 - Lock owner thread address or verifier internal data.
4 - Verifier internal data.

0x1007 : Releasing lock that is not owned by the current thread.
2 - Lock address.
3 - Verifier internal data.
4 - Verifier internal data.

0x1008 : Acquiring lock using mismatched API for this lock type.
2 - Lock address.
3 - Verifier internal data.
4 - Verifier internal data.

0x1009 : Releasing lock using mismatched API for this lock type.
2 - Lock address.
3 - Verifier internal data.
4 - Verifier internal data.

0x100A : Terminated thread owns lock.
2 - Owner thread address.
3 - Verifier internal data.

0x100B : Deleted lock is still owned by a thread.
2 - Lock address.
3 - Owner thread address.
4 - Verifier internal data.

0x1010 : Invariant MDL buffer contents for Write Irp were modified.
2 - Device object to which the Write IRP was issued.
3 - The address of the IRP.
4 - System-Space Virtual Address for the buffer that the MDL describes.

0x1011 : Invariant MDL buffer contents for Read Irp were modified during dispatch or buffer backed by dummy pages.
2 - Device object to which the Read IRP was issued.
3 - The address of the IRP.
4 - System-Space Virtual Address for the buffer that the MDL describes.

0x1012 : Verifier extension state storage detected corruption.
2 - A pointer to the string describing the violation.
3 - Data that is involved in this corruption (0 if not used).
4 - Data that is involved in this corruption (0 if not used).

0x1013 : Verifier detected internal corruption in the captured original I/O callbacks.
2 - A pointer to the driver object.
3 - A pointer to the captured original I/O callbacks.
4 - Reserved (unused).

0x2000 : Code Integrity Issue: The caller specified an executable pool type. (Expected: NonPagedPoolNx)
2 - The address in the driver's code where the error was detected.
3 - Pool Type.
4 - Pool Tag (if provided).

0x2001 : Code Integrity Issue: The caller specified an executable page protection. (Expected: cleared PAGE_EXECUTE* bits)
2 - The address in the driver's code where the error was detected.
3 - Page Protection (WIN32_PROTECTION_MASK).

0x2002 : Code Integrity Issue: The caller specified an executable MDL mapping. (Expected: MdlMappingNoExecute)
2 - The address in the driver's code where the error was detected.
3 - Page Priority (MM_PAGE_PRIORITY logically OR'd with MdlMapping*).

0x2003 : Code Integrity Issue: The image contains an executable and writable section.
2 - The image file name (Unicode string).
3 - The address of the section header.
4 - The section name (UTF-8 encoded string).

0x2004 : Code Integrity Issue: The image contains a section that is not page aligned.
2 - The image file name (Unicode string).
3 - The address of the section header.
4 - The section name (UTF-8 encoded string).

0x0000A001: VM Switch: The caller supplied NetBufferList's SourceHandle must be set
Parameter 2 - A pointer to the NetBufferList object.
Parameter 3 - A pointer to the virtual switch object (if NON-NULL).
Parameter 4 - Reserved (unused).

0x0000A002: VM Switch: The caller supplied NetBufferList's forwarding detail is not zero
Parameter 2 - A pointer to the NetBufferList object.
Parameter 3 - A pointer to the virtual switch object (if NON-NULL).
Parameter 4 - Reserved (unused).

0x0000A003: VM Switch: The caller supplied a NetBufferList with packet header or routing context that is NULL
Parameter 2 - A pointer to the NetBufferList object.
Parameter 3 - A pointer to the virtual switch object (if NON-NULL).
Parameter 4 - Reserved (unused).

0x0000A004: VM Switch: The caller specified invalid port and nic index combination
Parameter 2 - ID of invalid port.
Parameter 3 - NIC Index.
Parameter 4 - A pointer to the virtual switch object (if NON-NULL).

0x0000A005: VM Switch: The caller supplied an invalid destination
Parameter 2 - A pointer to the NetBufferList object.
Parameter 3 - A pointer to the Destination list.
Parameter 4 - A pointer to the virtual switch object (if NON-NULL).

0x0000A006: VM Switch: The caller supplied an invalid Source NIC or Port object
Parameter 2 - A pointer to the NetBufferList object.
Parameter 3 - A pointer to the virtual switch object (if NON-NULL).
Parameter 4 - Reserved (unused).

0x0000A007: VM Switch: The caller supplied an invalid destination list
Parameter 2 - A pointer to the NetBufferList object.
Parameter 3 - A pointer to the virtual switch object (if NON-NULL).
Parameter 4 - Reserved (unused).

0x0000A008: VM Switch: Attempting to reference a NIC when not allowed
Parameter 2 - Parent NIC object.
Parameter 3 - NIC index.
Parameter 4 - A pointer to the virtual switch object (if NON-NULL).

0x0000A009: VM Switch: Attempt to reference a port when not allowed
Parameter 2 - Port being referenced.
Parameter 3 - A pointer to the virtual switch object (if NON-NULL).
Parameter 4 - Reserved (unused).

0x0000A00A: VM Switch: Failure context is already set
Parameter 2 - A pointer to the NetBufferList object.
Parameter 3 - ContextTypeInfo object.
Parameter 4 - Reserved (unused).

0x0000A00B: VM Switch: Invalid direction provided for dropped NetBufferList
Parameter 2 - A pointer to the NetBufferList object.
Parameter 3 - NDIS_SWITCH_REPORT_FILTERED_NBL_FLAGS_*
Parameter 4 - A pointer to the virtual switch object (if NON-NULL).

0x0000A00C: VM Switch: NetBufferList Chain has multiple source ports when NDIS_SEND_FLAGS_SWITCH_SINGLE_SOURCE flag is set
Parameter 2 - A pointer to the NetBufferLists object.
Parameter 3 - Send Flags value.
Parameter 4 - A pointer to the virtual switch object (if NON-NULL).

0x0000A00D: VM Switch: One ore more NBLs in chain have invalid destination when NDIS_RECEIVE_FLAGS_SWITCH_DESTINATION_GROUP flag is set
Parameter 2 - A pointer to the NetBufferLists object.
Parameter 3 - Recieve Flags value.
Parameter 4 - A pointer to the virtual switch object (if NON-NULL).

0x0000A00E: VM Switch: Attempting to complete NetBufferList through WNV when VMS_NBL_ROUTING_CONTEXT_FLAG_NO_WNV_PROCESSING flag is set
Parameter 2 - A pointer to the NetBufferLists object.
Parameter 3 - A pointer to the virtual switch context.
Parameter 4 - A pointer to the virtual switch object (if NON-NULL).

0x00081001: ID of the 'KsDeviceMutex' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00081002: ID of the 'KsStreamPointerClone' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00081003: ID of the 'KsStreamPointerLock' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00081004: ID of the 'KsStreamPointerUnlock' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00081005: ID of the 'KsCallbackReturn' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00081006: ID of the 'KsIrqlDeviceCallbacks' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00081007: ID of the 'KsIrqlFilterCallbacks' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00081008: ID of the 'KsIrqlPinCallbacks' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00081009: ID of the 'KsIrqlDDIs' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0008100A: ID of the 'KsFilterMutex' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0008100B: ID of the 'KsProcessingMutex' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00082001: ID of the 'KsTimedPinSetDeviceState' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00082002: ID of the 'KsTimedDeviceCallbacks' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00082003: ID of the 'KsTimedFilterCallbacks' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00082004: ID of the 'KsTimedPinCallbacks' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00082005: ID of the 'KsTimedProcessingMutex' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00071001: ID of the 'PcIrqlDDIs' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00071003: ID of the 'PcIrqlIport' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00071004: ID of the 'PcUnmapAllocatedPages' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00071005: ID of the 'PcAllocatedPages' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00071006: ID of the 'PcRegisterAdapterPower' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00071007: ID of the 'PcAddAdapterDevice' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00071008: ID of the 'PcPropertyRequest' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00071009: ID of the 'PcAllocateAndMapPages' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0007100A: ID of the 'PcPoRequestPowerIrp' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00072001: ID of the 'PcTimedWaveRtStreamSetState' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00020002: ID of the 'IrqlApcLte' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020003: ID of the 'IrqlDispatch' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020004: ID of the 'IrqlExAllocatePool' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020005: ID of the 'IrqlExApcLte1' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020006: ID of the 'IrqlExApcLte2' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020007: ID of the 'IrqlExApcLte3' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020008: ID of the 'IrqlExPassive' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020009: ID of the 'IrqlIoApcLte' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002000A: ID of the 'IrqlIoPassive1' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002000B: ID of the 'IrqlIoPassive2' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002000C: ID of the 'IrqlIoPassive3' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002000D: ID of the 'IrqlIoPassive4' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002000E: ID of the 'IrqlIoPassive5' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002000F: ID of the 'IrqlKeApcLte1' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020010: ID of the 'IrqlKeApcLte2' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020011: ID of the 'IrqlKeDispatchLte' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020015: ID of the 'IrqlKeReleaseSpinLock' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020016: ID of the 'IrqlKeSetEvent' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020019: ID of the 'IrqlMmApcLte' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002001A: ID of the 'IrqlMmDispatch' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002001B: ID of the 'IrqlObPassive' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002001C: ID of the 'IrqlPsPassive' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002001D: ID of the 'IrqlReturn' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0002001E: ID of the 'IrqlRtlPassive' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0002001F: ID of the 'IrqlZwPassive' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00020022: ID of the 'IrqlIoDispatch' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00040003: ID of the 'CriticalRegions' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00040006: ID of the 'QueuedSpinLock' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00040007: ID of the 'QueuedSpinLockRelease' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00040009: ID of the 'SpinLock' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0004000A: ID of the 'SpinlockRelease' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0004000E: ID of the 'GuardedRegions' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0004100B: ID of the 'RequestedPowerIrp' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x0004100F: ID of the 'IoSetCompletionExCompleteIrp' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00043006: ID of the 'PnpRemove' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00091001: ID of the 'NdisOidComplete' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00091002: ID of the 'NdisOidDoubleComplete' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0009100E: ID of the 'NdisOidDoubleRequest' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00092003: ID of the 'NdisTimedOidComplete' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0009200D: ID of the 'NdisTimedDataSend' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0009200F: ID of the 'NdisTimedDataHang' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00092010: ID of the 'NdisFilterTimedPauseComplete' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00092011: ID of the 'NdisFilterTimedDataSend' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00092012: ID of the 'NdisFilterTimedDataReceive' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00093004: ID of the 'WlanAssociation' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00093005: ID of the 'WlanConnectionRoaming' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00093006: ID of the 'WlanDisassociation' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00093101: ID of the 'WlanAssert' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Reserved (unused).
Parameter 4 - Reserved (unused).

0x00094007: ID of the 'WlanTimedAssociation' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00094008: ID of the 'WlanTimedConnectionRoaming' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x00094009: ID of the 'WlanTimedConnectRequest' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0009400B: ID of the 'WlanTimedLinkQuality' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

0x0009400C: ID of the 'WlanTimedScan' rule that was violated.
Parameter 2 - A pointer to the string describing the violated rule condition.
Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
Parameter 4 - Address of supplemental states (third argument to !ruleinfo).

END_VALUES

DRIVER_CORRUPTED_EXPOOL (0xC5)
PARAMETERS
1 - memory referenced
2 - IRQL
3 - value 0 = read operation, 1 = write operation
4 - address which referenced memory

DESCRIPTION
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.

DRIVER_CAUGHT_MODIFYING_FREED_POOL (0xC6)
PARAMETERS
1 - memory referenced
2 - value 0 = read operation, 1 = write operation
3 - previous mode.
4 - 4.

DESCRIPTION
An attempt was made to access freed pool memory. The faulty component is
displayed in the current kernel stack.

TIMER_OR_DPC_INVALID (0xC7)

Kernel timer or DPC used incorrectly.

PARAMETERS
1 - Type of incorrect usage.
VALUES
0x0 : Timer object found in memory which must not contain such items.
2 - Address of the timer object.
3 - Start of memory range being checked.
4 - End of memory range being checked.

0x1 : DPC object found in memory which must not contain such items.
2 - Address of the DPC object.
3 - Start of memory range being checked.
4 - End of memory range being checked.

0x2 : DPC routine found in memory which must not contain such items.
2 - Address of the DPC routine.
3 - Start of memory range being checked.
4 - End of memory range being checked.

0x3 : Incorrect processor number for DPC.
2 - Address of the DPC object.
3 - Processor number.
4 - Number of processors in the system.

0x4 : Thread APC disable count was changed during DPC routine execution.
2 - Address of the DPC routine.
3 - Thread APC disable count before calling DPC routine.
4 - Thread APC disable count after calling DPC routine.

0x5 : Thread APC disable count was changed during timer DPC routine execution.
2 - Address of the DPC routine.
3 - Thread APC disable count before calling DPC routine.
4 - Thread APC disable count after calling DPC routine.

0x6 : The DPC routine is invalid.
2 - Address of the DPC object.

The specified DPC object has a NULL routine address. This usually indicates
that the memory associated with the DPC object was either freed or
otherwise misused.

0x7 : An invalid timer insertion request was detected.
2 - Address of the timer object.
3 - Address of a LONGLONG that contains the timer's due time.

0x8 : A concurrent expiration attempt was detected.
2 - Failure mode:
VALUES:
0 : Non clock owner executing timer expiration in serialized mode.
1 : Concurrent single timer expiration attempt.
3 - Address of the current timer object.
4 - Address of the previous timer object.
END_VALUES

More than one processor attempted to expire a given timer table.
This is a fatal error.

0x9 : An Ex timer routine was called with invalid arguments.
2 - Which argument was invalid:
VALUES:
0 : Attributes in the allocate timer routine.
1 : Extended parameters' version.
2 : Due time in the set timer routine. The third parameter
is the due time's address.
3 : Extended set parameters' relaxed timer tolerance. The
third parameter is the set parameters' address.
END_VALUES
3 - The invalid argument's value or address. It should be assumed
that this parameter is the argument's value by unless
documentation states otherwise.

END_VALUES

IRQL_UNEXPECTED_VALUE (0xC8)

The processor's IRQL is not what it should be at this time. This is
usually caused by a lower level routine changing IRQL for some period
and not restoring IRQL at the end of that period (eg acquires spinlock
but doesn't release it).

PARAMETERS
1 - (Current IRQL << 16) | (Expected IRQL << 8) | UniqueValue
DESCRIPTION
if UniqueValue is 0 or 1
2 = APC->KernelRoutine
3 = APC
4 = APC->NormalRoutine

DRIVER_VERIFIER_IOMANAGER_VIOLATION (0xC9)
The IO manager has caught a misbehaving driver.
PARAMETERS
1 - Code that specifies the violation
VALUES:
1 : Invalid IRP passed to IoFreeIrp
2 - the IRP passed in
2 : IRP still associated with a thread at IoFreeIrp
2 - the IRP passed in
3 : Invalid IRP passed to IoCallDriver
2 - the IRP passed in
4 : Invalid Device object passed to IoCallDriver
2 - the Device object
5 : Irql not equal across call to the driver dispatch routine
2 - the device object associated with the offending driver
3 - the Irql before the call
4 - the Irql after the call
6 : IRP passed to IoCompleteRequest contains invalid status
2 - the status
3 - the IRP
7 : IRP passed to IoCompleteRequest still has cancel routine set
2 - the cancel routine pointer
3 - the IRP
8 : Call to IoBuildAsynchronousFsdRequest threw an exception
2 - the Device object
3 - the IRP major function
4 - the exception status
9 : Call to IoBuildDeviceIoControlRequest threw an exception
2 - the Device object
3 - the IoControlCode
4 - the exception status
0xA : Reinitialization of Device object timer
2 - the Device object
0xC : Invalid IOSB in IRP at APC IopCompleteRequest (appears to be on
stack that was unwound)
2 - IOSB address
3 - IRP address
0xD : Invalid UserEvent in IRP at APC IopCompleteRequest (appears to
be on stack that was unwound)
2 - UserEvent address
3 - IRP address
0xE : Irql > DPC at IoCompleteRequest
2 - the current Irql
3 - the IRP
0xF : Driver sent an create request with file object that's been closed or had its open cancelled.
2 - Device Object to which the IRP is being sent
3 - Pointer to IRP
4 - Pointer to FileObject

0x10 : IoCallDriver called above DISPATCH_LEVEL
2 - Current IRQL.

0x11 : IRQL not equal across call to driver Fast I/O dispatch routine
2 - Driver Fast I/O dispatch routine address.
3 - IRQL before calling driver dispatch routine.
4 - Current IRQL.

0x12 : IRQL not equal across call to driver dispatch routine
2 - Driver dispatch routine address.
3 - IRQL before calling driver dispatch routine.
4 - Current IRQL.

0x200 : Unknown I/O Verification error.

0x201 : A device is deleting itself while there is another device beneath it in the
driver stack. This may be because the caller has forgotten to call
IoDetachDevice first, or the lower driver may have incorrectly deleted itself.
2 - The address in the driver's code where the error was detected.

0x202 : A driver has attempted to detach from a device object that is not attached to
anything. This may occur if detach was called twice on the same device object.
2 - The address in the driver's code where the error was detected.
3 - Device object address.

0x203 : A driver has called IoCallDriver without setting the CancelRoutine in the IRP
to NULL.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x204 : The caller has passed in NULL as a DeviceObject.

0x205 : The caller is forwarding an IRP that is currently queued beneath it. The code
handling IRPs returning STATUS_PENDING in this driver appears to be broken.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x206 : The caller has incorrectly forwarded an IRP (control field not zeroed). The
driver should use IoCopyCurrentIrpStackLocationToNext or
IoSkipCurrentIrpStackLocation.

0x207 : The caller has manually copied the stack and has inadvertently copied the upper
layer's completion routine. Please useIoCopyCurrentIrpStackLocationToNext.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x208 : This IRP is about to run out of stack locations. Someone may have forwarded this
IRP from another stack.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x209 : The caller is completing an IRP that is currently queued beneath it. The code
handling IRPs returning STATUS_PENDING in this driver appears to be broken.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x20A : The caller of IoFreeIrp is freeing an IRP that is still in use.

0x20B : The caller of IoFreeIrp is freeing an IRP that is still in use.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x20C : The caller of IoFreeIrp is freeing an IRP that is still queued to a thread.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x20D : The caller of IoInitializeIrp has passed an IRP that was allocated with
IoAllocateIrp. This is incorrect and unnecessary, and has caused a quota leak.
Check the documentation for IoReuseIrp if this IRP is being recycled.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x20E : A PNP IRP has an invalid status. Any PNP IRP must have its status initialized
to STATUS_NOT_SUPPORTED.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x20F : A Power IRP has an invalid status. Any Power IRP must have its status
initialized to STATUS_NOT_SUPPORTED.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x210 : A WMI IRP has an invalid status. Any WMI IRP must have its status initialized
to STATUS_NOT_SUPPORTED.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x211 : The caller has forwarded an IRP while skipping a device object in the stack.
The caller is probably sending IRPs to the PDO instead of to the device
returned by IoAttachDeviceToDeviceStack.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x212 : The caller has trashed or has not properly copied the IRP's stack.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x213 : The caller has changed the status field of an IRP it does not understand.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x214 : The caller has changed the information field of an IRP it does not understand.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x215 : A non-successful non-STATUS_NOT_SUPPORTED IRP status for IRP_MJ_PNP is being
passed down stack. Failed PNP IRPs must be completed.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x216 : The previously-set IRP_MJ_PNP status has been converted to STATUS_NOT_SUPPORTED.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x217 : The driver has not handled a required IRP. The driver must update the status of
the IRP to indicate whether or not it has been handled.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x218 : The driver has responded to an IRP that is reserved for other device objects
elsewhere in the stack.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x219 : A non-successful non-STATUS_NOT_SUPPORTED IRP status for IRP_MJ_POWER is being
passed down stack. Failed POWER IRPs must be completed.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x21A : The previously-set IRP_MJ_POWER status has been converted to STATUS_NOT_SUPPORTED.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x21B : A driver has returned a suspicious status. This is probably due to an uninitialized
variable bug in the driver.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x21C : The caller has copied the IRP stack but not set a completion routine.
This is inefficient -- use IoSkipCurrentIrpStackLocation instead.

0x21D : An IRP dispatch handler has not properly detached from the stack below it upon
receiving a remove IRP.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Device object address.

0x21E : An IRP dispatch handler has not properly deleted its device object upon
receiving a remove IRP.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Device object address.

0x21F : A driver has not filled out a dispatch routine for a required IRP major function.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x220 : IRP_MJ_SYSTEM_CONTROL has been completed by someone other than the ProviderId.
This IRP should either have been completed earlier or should have been passed
down.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - ProviderId.

0x221 : An IRP dispatch handler for a PDO has deleted its device object, but the
hardware has not been reported as missing in a bus relations query.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Device object address.

0x222 : A Bus Filter's IRP dispatch handler has detached upon receiving a remove IRP
when the PDO is still alive. Bus Filters must clean up in FastIoDetach
callbacks.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Device object address.

0x223 : An IRP dispatch handler for a bus filter has deleted its device object, but
the PDO is still present. Bus filters must clean up in FastIoDetach callbacks.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Device object address.

0x224 : An IRP dispatch handler has returned a status that is inconsistent with the
IRP's IoStatus.Status field.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Expected status code.

0x225 : An IRP dispatch handler has returned a status that is incorrect (0xFFFFFFFF).
This is probably due to an uninitialized stack variable.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Status code.

0x226 : An IRP dispatch handler has returned without passing down or completing this IRP,
or someone forgot to return STATUS_PENDING.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x227 : An IRP completion routine is in pageable code.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x228 : A driver's completion routine has not marked the IRP pending if the
PendingReturned field was set in the IRP passed to it. This may cause the OS
to hang, especially if an error is returned by the stack.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x229 : A cancel routine has been set for an IRP that is currently being processed by
drivers lower in the stack, possibly stomping their cancel routine.

0x22A : The physical device object (PDO) has not responded to a required IRP.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x22B : The physical device object (PDO) has forgotten to fill out the device relation
list with the PDO for the TargetDeviceRelation query.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x22C : The code implementing the TargetDeviceRelation query has not called
ObReferenceObject on the PDO.

0x22D : The caller has completed a IRP_MJ_PNP it didn't understand instead of passing
it down.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x22E : The caller has completed a successful IRP_MJ_PNP instead of passing it down.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x22F : The caller has completed an untouched IRP_MJ_PNP (instead of passing the IRP down),
or non-PDO has failed the IRP using incorrect value of STATUS_NOT_SUPPORTED.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x230 : The caller has completed an IRP_MJ_POWER it didn't understand instead of
passing it down.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x231 : The caller has completed a successful IRP_MJ_POWER instead of passing it down.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x232 : The caller has completed an untouched IRP_MJ_POWER (instead of passing the IRP down),
or non-PDO has failed the IRP using incorrect value of STATUS_NOT_SUPPORTED.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x233 : The version field of the query capabilities structure in a query capabilities
IRP was not properly initialized.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x234 : The size field of the query capabilities structure in a query capabilities IRP
was not properly initialized.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x235 : The address field of the query capabilities structure in a query capabilities
IRP was not properly initialized to -1.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x236 : The UI Number field of the query capabilities structure in a query capabilities
IRP was not properly initialized to -1.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x237 : A driver has sent an IRP that is restricted for system use only.

0x238 : The caller of IoInitializeIrp has passed an IRP that was allocated with
IoAllocateIrp. This is incorrect, unnecessary, and negatively impacts
performance in normal use. Check the documentation for IoReuseIrp if this
IRP is being recycled.

0x239 : The caller of IoCompleteRequest is completing an IRP that has never been
forwarded via a call to IoCallDriver or PoCallDriver. This may be a bug.

0x23A : A driver has forwarded an IRP at an IRQL that is incorrect for this major code.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x23B : The caller has changed the status field of an IRP it does not understand.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x23C : A driver has completed an IRP without setting the cancel routine in the IRP to NULL.

0x23D : A driver has returned STATUS_PENDING but did not mark the IRP pending via a
call to IoMarkIrpPending.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Status code.

0x23E : A driver has marked an IRP pending but didn't return STATUS_PENDING.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Status code.

0x23F : A driver has not inherited the DO_POWER_pageable bit from the stack it has
attached to.

0x240 : A driver is attempting to delete a device object that has already been deleted
via a prior call to IoDeleteDevice.
2 - The address in the driver's code where the error was detected.

0x241 : A driver has detached its device object during a surprise remove IRP.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Device object address.

0x242 : A driver has deleted its device object during a surprise remove IRP.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Device object address.

0x243 : A driver has failed to clear the DO_DEVICE_INITIALIZING flag at the end of
AddDevice.

0x244 : A driver has not copied either the DO_BUFFERED_IO or the DO_DIRECT_IO flag
from the device object it is attaching to.

0x245 : A driver has set both the DO_BUFFERED_IO and the DO_DIRECT_IO flags.
These flags are mutually exclusive.

0x246 : A driver has failed to copy the DeviceType field from the device object it is
attaching to.

0x247 : A driver has failed an IRP that cannot be failed.

0x248 : A driver has added a device object that is not a PDO to a device relations query.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Device object address.

0x249 : A driver has enumerated two child PDOs that returned identical Device IDs.
2 - The address in the driver's code where the error was detected.
3 - First device object address.
4 - Second device object address.

0x24A : A driver has mistakenly called a file I/O function at an IRQL other than
PASSIVE_LEVEL.
2 - The address in the driver's code where the error was detected.

0x24B : A driver has succeeded IRP_MJ_PNP.IRP_MN_QUERY_DEVICE_RELATIONS(TargetRelations)
but did not properly fill out the request or forward the IRP to the underlying
hardware stack.
2 - The address in the driver's code where the error was detected.
3 - Device object address.

0x24C : A driver has returned STATUS_PENDING but did not mark the IRP pending via a
call to IoMarkIrpPending.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Status code.

0x24D : A driver has passed an invalid device object to a function that requires a PDO.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Device object address.

0x300 : A driver has returned a suspicious status. This is probably due to an uninitialized
variable bug in the driver.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Suspicious status code.

0x301 : A driver has forwarded an IRP at IRQL > DISPATCH_LEVEL.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Incorrect IRQL value.

0x302 : A driver has forwarded an IRP at IRQL >= APC_LEVEL. The I/O Completion APC routine
will not be able to run for this IRP.
2 - The address in the driver's code where the error was detected.
3 - IRP address.
4 - Incorrect IRQL value.

0x306 : The driver is completing an IRP_MJ_PNP.IRP_MN_REMOVE_DEVICE
request with a failure status code.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x310 : A driver should not reinitialize an IRP that is still in use.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x311 : A driver should not reinitialize an IRP that was created with
IoMakeAssociatedIrp,
IoBuildAsynchronousFsdRequest,
IoBuildSynchronousFsdRequest, or
IoBuildDeviceIoControlRequest.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

0x312 : The caller provided the IRP Status Information field with a value that
is greater than the output section of the system buffer.
2 - The address in the driver's code where the error was detected.
3 - IRP address.

END_VALUES

PNP_DETECTED_FATAL_ERROR (0xCA)

PnP encountered a severe error, either as a result of a problem in a driver or
a problem in PnP itself. The first argument describes the nature of the
problem, the second argument is the address of the PDO. The other arguments
vary depending on argument 1.

PARAMETERS
Argument 1 -
VALUES:
1 : Duplicate PDO

A specific instance of a driver has enumerated multiple PDOs with
identical device id and unique ids.

2 - Newly reported PDO.

3 - PDO of which it is a duplicate.

2 : Invalid PDO

An API which requires a PDO has been called with either an FDO,
a PDO which hasn't been initialized yet (returned to PnP in a
QueryDeviceRelation/BusRelations), or some random piece of
memory.

2 - Purported PDO.

3 - Driver object.

3 : Invalid ID

An enumerator has returned an ID which contains illegal
characters or isn't properly terminated. IDs must only contain
characters in the range 0x20-7F inclusive with the exception of
0x2C (comma) which is illegal.

2 - PDO whose IDs were queried.

3 - Address of ID buffer.

4 - Type of ID
VALUES
1 : DeviceID
2 : UniqueID
3 : HardwareIDs
4 : CompatibleIDs
END_VALUES

4 : Invalid enumeration of deleted PDO

An enumerator has returned a PDO which it has previously deleted
using IoDeleteDevice.

2 - PDO with DOE_DELETE_PENDING set.

5 : PDO freed while still linked in devnode tree.

The object manager reference count on a PDO dropped to zero
while the devnode was still linked in the tree. This usually
indicates that the driver is not adding a reference when
returning the PDO in a query IRP.

2 - PDO.

8 : NULL pointer returned as a bus relation.

One or more NULL pointers returned in a query BusRelations.

2 - PDO for the stack that returned the invalid BusRelations.

3 - Total number of PDOs returned in BusRelations.

4 - Index (zero based) at which first NULL PDO found.

9 : Invalid connection type passed to IoDisconnectInterruptEx.

A driver has passed an invalid connection type to
IoDisconnectInterruptEx. The connection type passed to this
API must match the one returned by a corresponding successful
call to IoConnectInterruptEx.

2 - Connection type that was passed to IoDisconnectInterruptEx.

0xA : Incorrect notify callback behavior

Driver failed to preserve IRQL or combined APC disable across
a PlugPlay notification.

2 - Driver Object.

3 - IRQL after returning from driver callback.

4 - Combined APC disable count after returning from driver callback.

0xB : Deleted PDO reported as relation

One of the removal relations for the device being removed has
already been deleted.

2 - Related PDO

3 - Removal relations

0xC : Power relations produced a cyclic dependency.

A driver has created a cyclic dependency between two devices that
creates a deadlock during a system power transition.

2 - PDO of the device reporting new power relations.

3 - PDO of the device which causes a cycle.

0xD : Request to idle inactive device.

PnP Manager is trying to Idle device that has not been Activated
for this PnP transaction.

2 - DevNode of the device.

3 - Power flag for the PnP transaction.

END_VALUES

DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (0xCB)
PARAMETERS
1 - The calling address in the driver that locked the pages or if the
IO manager locked the pages this points to the dispatch routine of
the top driver on the stack to which the IRP was sent.
2 - The caller of the calling address in the driver that locked the
pages. If the IO manager locked the pages this points to the device
object of the top driver on the stack to which the IRP was sent.
3 - A pointer to the MDL containing the locked pages.
4 - The number of locked pages.

DESCRIPTION
Caused by a driver not cleaning up completely after an I/O.

When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.

PAGE_FAULT_IN_FREED_SPECIAL_POOL (0xCC)
PARAMETERS
1 - memory referenced
2 - value 0 = read operation, 1 = write operation
3 - if non-zero, the address which referenced memory.
4 - Mm internal code.

DESCRIPTION
Memory was referenced after it was freed.
This cannot be protected by try-except.

When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.

PAGE_FAULT_BEYOND_END_OF_ALLOCATION (0xCD)
PARAMETERS
1 - memory referenced
2 - value 0 = read operation, 1 = write operation
3 - if non-zero, the address which referenced memory.
4 - Mm internal code.

DESCRIPTION
N bytes of memory was allocated and more than N bytes are being referenced.
This cannot be protected by try-except.

When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.

DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (0xCE)

A driver unloaded without cancelling timers, DPCs, worker threads, etc.
The broken driver's name is displayed on the screen.
PARAMETERS
1 - memory referenced
2 - value 0 = read operation, 1 = write operation
3 - If non-zero, the instruction address which referenced the bad memory
address.
4 - Mm internal code.

TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE (0xCF)
PARAMETERS
1 - memory referenced
2 - value 0 = read operation, 1 = write operation
3 - If non-zero, the instruction address which referenced the bad memory
address.
4 - Mm internal code.

A driver has been incorrectly ported to Terminal Server. It is referencing
session space addresses from the system process context. Probably from
queueing an item to a system worker thread.
The broken driver's name is displayed on the screen.

DRIVER_CORRUPTED_MMPOOL (0xD0)
PARAMETERS
1 - memory referenced
2 - IRQL
3 - value 0 = read operation, 1 = write operation
4 - address which referenced memory

An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool. You can also set
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\ProtectNonPagedPool
to a DWORD 1 value and reboot. Then the system will unmap freed nonpaged pool,
preventing drivers (although not DMA-hardware) from corrupting the pool.

DRIVER_IRQL_NOT_LESS_OR_EQUAL (0xD1)
PARAMETERS
1 - memory referenced
2 - IRQL
3 - value 0 = read operation, 1 = write operation
4 - address which referenced memory

DESCRIPTION
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

BUGCODE_ID_DRIVER (0xD2)

This is the NDIS Driver Bugcheck for Windows 2000 and Windows XP.
For Windows Server 2003 and later, see 0x7C, BUGCODE_NDIS_DRIVER.

DESCRIPTION
The meaning of the bug check parameters cannot be determined by examining the
parameters alone. You must also examine the text of a DbgPrint message.

For details, see either the debugger documentation or the DDK documentation.

DRIVER_PORTION_MUST_BE_NONPAGED (0xD3)
PARAMETERS
1 - memory referenced
2 - IRQL
3 - value 0 = read operation, 1 = write operation
4 - address which referenced memory

DESCRIPTION
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.

An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers marking code or data as pageable when it should be
marked nonpaged.

If kernel debugger is available get stack backtrace.

SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD (0xD4)

A driver unloaded without cancelling lookaside lists, DPCs, worker threads, etc.
The broken driver's name is displayed on the screen.

PARAMETERS
1 - memory referenced
2 - IRQL
3 - value 0 = read operation, 1 = write operation
4 - address which referenced memory

DESCRIPTION
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.

An attempt was made to access the driver at raised IRQL after it unloaded.

If kernel debugger is available get stack backtrace.

DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL (0xD5)
PARAMETERS
1 - memory referenced
2 - value 0 = read operation, 1 = write operation
3 - if non-zero, the address which referenced memory.
4 - (reserved)

DESCRIPTION
Memory was referenced after it was freed.
This cannot be protected by try-except.

When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.

DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION (0xD6)
PARAMETERS
1 - memory referenced
2 - value 0 = read operation, 1 = write operation
3 - if non-zero, the address which referenced memory.
4 - (reserved)

DESCRIPTION
N bytes of memory was allocated and more than N bytes are being referenced.
This cannot be protected by try-except.

When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.

DRIVER_UNMAPPING_INVALID_VIEW (0xD7)
PARAMETERS
1 - virtual address to unmap.
2 - 1 if the view is being unmapped, 2 if the view is being committed.
3 - 0.
4 - 0.

DESCRIPTION
A driver (usually win32k.sys, but can be determined from the stack trace for
certain) is trying to unmap an address that was not mapped.

DRIVER_USED_EXCESSIVE_PTES (0xD8)
PARAMETERS
1 - If non-null, the guilty driver's name (Unicode string).
2 - If parameter 1 non-null, the number of PTEs used by the guilty driver.
3 - Total free system PTEs
4 - Total system PTEs

DESCRIPTION
No System PTEs left. Usually caused by a driver not cleaning up
properly. If non-null, Parameter 1 shows the name of the driver
who is consuming the most PTEs. The calling stack also shows the name of
the driver which bugchecked. Both drivers need to be fixed and/or the number
of PTEs increased.

When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.

LOCKED_PAGES_TRACKER_CORRUPTION (0xD9)

PARAMETERS
1 - Type of error.
VALUES:
1 : The MDL is being inserted twice on the same process list.

2 - Address of internal lock tracking structure.
3 - Address of memory descriptor list.
4 - Number of pages locked for the current process.

2 : The MDL is being inserted twice on the systemwide list.

2 - Address of internal lock tracking structure.
3 - Address of memory descriptor list.
4 - Number of pages locked for the current process.

3 : The MDL was found twice in the process list when being freed.

Arguments:

2 - Address of first internal tracking structure found.
3 - Address of internal lock tracking structure.
4 - Address of memory descriptor list.

4 : The MDL was found in the systemwide list on free after it was removed.

2 - Address of internal lock tracking structure.
3 - Address of memory descriptor list.
4 - 0.
END_VALUES

SYSTEM_PTE_MISUSE (0xDA)

PARAMETERS
1 - Type of error.
VALUES:
1 : The PTE mapping being freed is a duplicate.

2 - Address of internal lock tracking structure.
3 - Address of memory descriptor list.
4 - Address of duplicate internal lock tracking structure.

2 : The number of PTE mappings being freed is incorrect.

2 - Address of internal lock tracking structure.
3 - Number of PTEs the system thinks should be freed.
4 - Number of PTEs the driver is requesting to free.

3 : The PTE mapping address being freed is incorrect.

2 - Address of first internal tracking structure found.
3 - The PTE address the system thinks should be freed.
4 - The PTE address the driver is requesting to free.

4 : The first page of the mapped MDL has changed since the MDL was mapped.

2 - Address of internal lock tracking structure.
3 - Page frame number the system thinks should be first in the MDL.
4 - Page frame number that is currently first in the MDL.

5 : The start virtual address in the MDL being freed has changed since
the MDL was mapped.

2 - Address of first internal tracking structure found.
3 - The virtual address the system thinks should be freed.
4 - The virtual address the driver is requesting to free.

6 : The MDL being freed was never (or is currently not) mapped.

2 - The MDL specified by the driver.
3 - The virtual address specified by the driver.
4 - The number of PTEs to free (specified by the driver).

7 : The PTE range is being double allocated.

2 - Starting PTE.
3 - Number of PTEs.
4 - Caller Id (system internal).

8 : The caller is asking to free an incorrect number of PTEs.

2 - Starting PTE.
3 - Number of PTEs the caller is freeing.
4 - Number of PTEs the system thinks should be freed.

9 : The caller is asking to free PTEs where one of them is not allocated.

2 - Starting PTE.
3 - Number of PTEs the caller is freeing.
4 - PTE index that the system thinks is already free.

0xA : The caller is asking to allocate 0 PTEs.

2 - Whether the driver requested "bugcheck on failure" in the MDL.
3 - Number of PTEs the caller is allocating.
4 - Type of PTE pool requested.

0xB : The PTE list is already corrupted at the time of this allocation.
The corrupt PTE is below the lowest possible PTE address.

2 - Corrupt PTE.
3 - Number of PTEs the caller is allocating.
4 - Type of PTE pool requested.

0xC : The PTE list is already corrupted at the time of this allocation.
The corrupt PTE is above the lowest possible PTE address.

2 - Corrupt PTE.
3 - Number of PTEs the caller is allocating.
4 - Type of PTE pool requested.

0xD : The caller is trying to free 0 PTEs.

2 - Starting PTE.
3 - Number of PTEs the caller is freeing.
4 - Type of PTE pool.

0xE : The caller is trying to free PTEs and the guard PTE has been overwritten.

2 - Starting PTE.
3 - Number of PTEs the caller is freeing.
4 - Type of PTE pool.

0xF : The caller is trying to free a bogus PTE.
The bogus PTE is below the lowest possible PTE address.

2 - Bogus PTE.
3 - Number of PTEs the caller is trying to free.
4 - Type of PTE pool being freed.

0x10 : The caller is trying to free a bogus PTE.
The bogus PTE is above the highest possible PTE address.

2 - Bogus PTE.
3 - Number of PTEs the caller is trying to free.
4 - Type of PTE pool being freed.

0x11 : The caller is trying to free a bogus PTE.
The bogus PTE is at the base of the PTE address space.

2 - Bogus PTE.
3 - Number of PTEs the caller is trying to free.
4 - Type of PTE pool being freed.
END_VALUES

DESCRIPTION
A driver has corrupted system PTEs.

Set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\TrackPtes
to a DWORD 3 value and reboot. If the same bugcheck occurs again the stack trace will
identify the offending driver.

DRIVER_CORRUPTED_SYSPTES (0xDB)
PARAMETERS
1 - memory referenced
2 - IRQL
3 - value 0 = read operation, 1 = write operation
4 - address which referenced memory

DESCRIPTION
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted system PTEs. Set
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\TrackPtes
to a DWORD 3 value and reboot. Then the system will save stack traces and
perform validity checks so the guilty driver can be identified.
There is no other way to find out which driver did this. When you enable
this flag, if the driver commits the error again you will see a different
bugcheck - SYSTEM_PTE_MISUSE - and the stack trace will identify the offending
driver(s).

DRIVER_INVALID_STACK_ACCESS (0xDC)

A driver accessed a stack address that lies below the stack pointer of the
stack's thread.

POOL_CORRUPTION_IN_FILE_AREA (0xDE)

A driver corrupted pool memory used for holding pages destined for disk.
This was discovered by the memory manager when dereferencing the file.

IMPERSONATING_WORKER_THREAD (0xDF)

A workitem forgot to disable impersonation before it completed.

PARAMETERS
1 - Worker Routine that caused this bugcheck.
2 - Parameter passed to this worker routine.
3 - Pointer to the Workitem.

ACPI_BIOS_FATAL_ERROR (0xE0)

Your computer (BIOS) has reported that a component in your system is too faulty
for Windows to be able to run.

You can determine which component is faulty by running the diagnostic disk or
tool that came with your computer.

If you do not have this tool, you must contact your system vendor and report
this error message to them. They will be able to assist you in correcting this
hardware problem, thereby allowing Windows to operate. Microsoft cannot assist
in the debugging of this problem -- only the hardware vendor can interpret the
bug check parameters and debug this error.

WORKER_THREAD_RETURNED_AT_BAD_IRQL (0xE1)
PARAMETERS
1 - address of worker routine (do ln on this to find guilty driver)
2 - IRQL returned at (should have been 0, but isn't).
3 - workitem parameter
4 - workitem address

MANUALLY_INITIATED_CRASH (0xE2)

The user manually initiated this crash dump.

RESOURCE_NOT_OWNED (0xE3)

A thread tried to release a resource it did not own.

PARAMETERS
1 - Address of resource
2 - Address of thread
3 - Address of owner table if there is one

WORKER_INVALID (0xE4)

A executive worker item was found in memory which must not contain such
items or a work item was queued that is currently active in the system.
Usually this is memory being freed. This is usually caused by
a device driver that has not cleaned up properly before freeing memory.

PARAMETERS
1 - Code position indicator
VALUES:
0x00 : Free of active worker item
2 - Address of worker item
3 - Start of pool block
4 - End of pool block

0x01 : Queuing of active worker item
2 - Address of worker item
3 - Queue number
4 - 0

0x02 : Free of queued I/O worker item
2 - Address of worker item
3 - Address of I/O worker routine
4 - 0

0x03 : I/O with invalid object
2 - Address of work item
3 - Address of invalid object
4 - 0

0x05 : Work item queued before work queue initialized
2 - Address of work item
3 - Queue number
4 - Numa node targeted or -1 if all nodes were searched

0x06 : Invalid queue type provided
2 - Address of work item
3 - Queue number
4 - 0

0x07 : Queuing work item with invalid work routine address
2 - Address of work item
3 - Address of work routine
4 - 0

END_VALUES

DRIVER_VERIFIER_DMA_VIOLATION (0xE6)

An illegal DMA operation was attempted by a driver being verified.
PARAMETERS
1- Violation code.
VALUES:
0x00 : Miscellaneous DMA error.
2 - Violation code.
VALUES:
0x00 :
3 -
4 -
0x01 : Cannot flush all the requested bytes before the end
of the map register file.
3 - Number of bytes left in the MDL.
4 - Number of bytes left requested to be flushed.
0x02 : Not enough map registers.
3 - Map registers needed.
4 - Number of contiguous map registers.
END_VALUES
0x03 : Freed too many common buffers.
2 - Number of extra common buffers freed.
0x04 : Driver has freed too many simultaneous adapter channels
2 - Number of extra adapter channels freed.
0x05 : Freed too many map registers.
2 - Number of extra map registers freed.
0x06 : Driver has freed too many scatter gather lists.
2 - Allocated scatter-gather lists.
3 - Freed scatter-gather lists.
0x07 : Cannot put adapter until all common buffers are freed.
2 - Pointer to the DMA adapter.
3 - Number of outstanding common buffers.
4 - Pointer to the corresponding internal verifier data.
0x08 : Cannot put adapter until all adapter channels are freed.
2 - Pointer to the DMA adapter.
3 - Number of outstanding adapter channels.
4 - Pointer to the corresponding internal verifier data.
0x09 : Cannot put adapter until all map registers are freed.
2 - Pointer to the DMA adapter.
3 - Number of outstanding map registers.
4 - Pointer to the corresponding internal verifier data.
0x0A : Cannot put adapter until all scatter gather lists are freed.
2 - Pointer to the DMA adapter.
3 - Number of outstanding scatter-gather lists.
4 - Pointer to the corresponding internal verifier data.
0x0B : Driver has allocated too many simultaneous adapter channels.
2 - Outstanding adapter channels.
0x0C : Allocating too many map registers at a time.
2 - Required map registers.
3 - Maximum map registers.
0x0D : Driver did not flush adapter buffers.
2 - Number of bytes mapped.
3 - Maximum number of bytes that can be mapped at a time.
0x0E : Buffer not locked. DMA transfer has been attempted with a
pageable buffer.
2 - Address of the DMA buffer MDL.
0x0F : DMA map register corruption.
2 - Violation code.
VALUES:
0x00 :
3 -
4 -
0x01 : The tag before the DMA buffer has been modified.
Expected tag is DmaVrfy0.
3 - Buffer length.
4 - Buffer start.
0x02 : The tag after the DMA buffer has been modified.
Expected tag is DmaVrfy0.
3 - Buffer length.
4 - Buffer start.
0x03 : Free map register was overwritten.
3 - Corruption address. Expected fill pattern is 0x0F.
0x04 : Padding before the buffer has been incorrectly modified.
3 - Buffer start. Expected padding is 0x0F.
4 - Corruption address.
0x05 : Padding after the buffer has been incorrectly modified.
3 - Buffer start.
4 - Corruption address. Expected padding pattern is 0x0F.
END_VALUES
0x10 : Cannot free map registers, registers still mapped.
2 - Number of registers still mapped.
0x11 : Too many outstanding reference counts for adapter.
2 - Reference count.
3 - Pointer to the DMA adapter.
4 - Pointer to the corresponding internal verifier data.
0x12 : MDL flags not set.
0x13 : Bad IRQL.
2 - Violation code.
VALUES:
0x00 :
3 -
4 -
0x01 : Current IRQL is different than expected.
3 - Expected IRQL.
4 - Current IRQL.
0x02 : Current IRQL is higher than expected.
3 - Expected maximum IRQL.
4 - Current IRQL.
END_VALUES
0x14 : Bad IRQL.
0x15 : Allocated too many map registers.
2 - Allocated map registers.
3 - Maximum map registers.
0x16 : Cannot flush buffers that aren't mapped.
2 - Address in the system virtual space of the map register.
3 - Pointer to the corresponding internal verifier data.
0x17 : Mismatched map flush.
0x18 : Driver has attempted to access an adapter that has already
been released.
2 - Pointer to the DMA adapter.
3 - Pointer to the corresponding internal verifier data.
0x19 : The driver passed a null DMA_ADAPTER value to a HAL routine.
0x1A : Flush without transfer.
0x1B : The driver passed an address and an MDL to a HAL routine, but
this address is not contained in this MDL.
2 - Virtual address that is out of MDL bounds.
3 - MDL.
0x1C : Data loss.
0x1D : The driver attempted to map a buffer that is already mapped.
2 - Buffer to map start.
3 - Buffer to map end.
4 - System address in buffer that is already mapped.
0x1E : The driver attempted to use HalGetAdapter that is an obsolete
DMA API.
0x1F : Invalid DMA buffer.
2 - Violation code.
VALUES:
0x00 :
3 -
4 -
0x01 : Virtual buffer address is before the first MDL.
3 - Virtual address of the start of the DMA buffer.
4 - Pointer to the first MDL describing the DMA buffer.
0x02 : Virtual address is after the first MDL.
3 - Virtual address of the start of the DMA buffer.
4 - Pointer to the first MDL describing the DMA buffer.
0x03 : Extra transfer length crosses a page boundary.
3 - Pointer to the MDL describing the DMA buffer.
4 - Length of the DMA transfer.
0x04 : Virtual address of a DMA buffer is not cache aligned.
3 - Virtual address of the start of the DMA buffer.
4 - Pointer to MDL describing the DMA buffer.
0x05 : DMA buffer length is not cache aligned.
3 - Length of the DMA buffer.
4 - Pointer to MDL describing the DMA buffer.
END_VALUES
0x20 : Cannot flush map register that isn't mapped.
2 - Map register base.
3 - The VA of the start of the DMA buffer.
4 - Pointer to the MDL used to describe the DMA buffer.
0x21 : Driver is attempting to map a 0-length transfer.
2 - Pointer to the corresponding internal verifier data.
0x22 : DMA buffer not mapped in system VA.
2 - MDL.
0x23 : Cannot flush a channel that hasn't been completed or cancelled.
2 - Violation code.
VALUES:
0x00 : Illegal channel flush
3 - Controller Id.
4 - Channel Number.
END_VALUES
0x24 : Insufficient buffer for requested length.
2 - Unaccounted length.
0x25 : Unknown device description version.
END_VALUES

INVALID_FLOATING_POINT_STATE (0xE7)

While restoring the previously saved floating point state for a thread,
the state was found to be invalid. The first argument indicates which
validity check failed.
PARAMETERS
1 - indicates which validity check failed.
VALUES:
0 : Saved context flags field is invalid, either FLOAT_SAVE_VALID
is not set or some of the reserved bits are non-zero. Second
argument is the flags field.

1 : The current processor interrupt priority level (IRQL) is not
the same as when the floating point context was saved.
Second argument is saved IRQL, third is current IRQL.

2 : The saved context does not belong to the current thread.
Second argument is the saved address of the thread this
floating point context belongs to, third argument is the
current thread.
END_VALUES

INVALID_CANCEL_OF_FILE_OPEN (0xE8)

The fileobject passed to IoCancelFileOpen is invalid. It should have reference
of 1. The driver that called IoCancelFileOpen is at fault.

PARAMETERS
1 - FileObject passed to IoCancelFileOpen
2 - DeviceObject passed to IoCancelFileOpen

ACTIVE_EX_WORKER_THREAD_TERMINATION (0xE9)

An executive worker thread is being terminated without having gone through
the worker thread rundown code. A stack trace should indicate the cause.

PARAMETERS
1 - The exiting ETHREAD.

THREAD_STUCK_IN_DEVICE_DRIVER (0xEA)

The device driver is spinning in an infinite loop, most likely waiting for
hardware to become idle. This usually indicates problem with the hardware
itself or with the device driver programming the hardware incorrectly.

PARAMETERS
1 - Pointer to a stuck thread object. Do .thread then kb on it to find
the hung location.
2 - Pointer to a DEFERRED_WATCHDOG object.
3 - Pointer to offending driver name.
4 - Number of times this error occurred. If a debugger is attached,
this error is not always fatal -- see DESCRIPTION below. On the
blue screen, this will always equal 1.

DESCRIPTION

If the kernel debugger is connected and running when watchdog detects a
timeout condition then DbgBreakPoint() will be called instead of KeBugCheckEx()
and detailed message including bugcheck arguments will be printed to the
debugger. This way we can identify an offending thread, set breakpoints in it,
and hit go to return to the spinning code to debug it further. Because
KeBugCheckEx() is not called the .bugcheck directive will not return bugcheck
information in this case. The arguments are already printed out to the kernel
debugger. You can also retrieve them from a global variable via
"dd watchdog!g_WdBugCheckData l5" (use dq on NT64).

On MP machines (OS builds <= 3790) it is possible to hit a timeout when the spinning thread is
interrupted by hardware interrupt and ISR or DPC routine is running at the time
of the bugcheck (this is because the timeout's work item can be delivered and
handled on the second CPU and the same time). If this is the case you will have
to look deeper at the offending thread's stack (e.g. using dds) to determine
spinning code which caused the timeout to occur.

THREAD_STUCK_IN_DEVICE_DRIVER_M (0x100000EA)

DESCRIPTION

On MP machines it is possible to hit a timeout when the spinning thread is
interrupted by hardware interrupt and ISR or DPC routine is running at the time
of the bugcheck (this is because the timeout's work item can be delivered and
handled on the second CPU and the same time). If this is the case you will have
to look deeper at the offending thread's stack (e.g. using dds) to determine
spinning code which caused the timeout to occur.

SAVER_UNSPECIFIED (0x1000F000)
The system was bug checked to collect diagnostic logs to aid in investigations.
PARAMETERS
1 - Depends on caller, may be current process ID
2 - Depends on caller, may be current Thread ID
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_BLANKSCREEN (0x1000F002)
The system was bug checked to collect diagnostic logs to aid in investigations.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_INPUT (0x1000F003)
The system was bug checked to collect diagnostic logs to aid in investigations.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_WATCHDOG (0x1000F004)
The system was bug checked to collect logs during UI Stress automation when an application was not responsive and determined to be hung.
PARAMETERS
1 - Depends on caller, may be the foreground process ID
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_STARTNOTVISIBLE (0x1000F005)
The system was bug checked to collect logs during UI Stress automation when the start page is not visible when it is expected to be visible.
PARAMETERS
1 - Depends on caller, may be the Process ID
2 - Depends on caller, may be the Thread ID
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_NAVIGATIONMODEL (0x1000F006)
The system was bug checked to collect logs when the execution manager tried to shut down a process but it either timed out or did not shutdown properly.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_OUTOFMEMORY (0x1000F007)
The system was bug checked to collect logs for an out of memory situation on the system.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_GRAPHICS (0x1000F008)
The system was bug checked to collect logs for an audio hang.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_NAVSERVERTIMEOUT (0x1000F009)
The system was bug checked to collect logs for a server navigation testing infrastructure timeout.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_CHROMEPROCESSCRASH (0x1000F00A)
The system was bug checked to collect logs for the UI Stress automation if an exception occured in the context of the Chrome PID.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_NOTIFICATIONDISMISSAL (0x1000F00B)
The system was bug checked to collect logs for the UI Stress automation when a notification dialog is unable to be dismissed.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_SPEECHDISMISSAL (0x1000F00C)
The system was bug checked to collect logs for the UI Stress automation when a Speech UI dialog is unable to be dismissed.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_CALLDISMISSAL (0x1000F00D)
The system was bug checked to collect logs for the UI Stress automation when an active phone call dialog is unable to be dismissed.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_APPBARDISMISSAL (0x1000F00E)
The system was bug checked to collect logs for the UI Stress automation when a UI blocking app bar is unable to be dismissed.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_RILADAPTATIONCRASH (0x1000F00F)
The system was bug checked to collect logs for cases like fatal modem failure or PnP issues in the Radio Interface Layer.
PARAMETERS
1 - Usually the source line number for the call
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_APPLISTUNREACHABLE (0x1000F010)
The system was bug checked to collect logs for the UI Stress automation when the application list is not reachable.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_REPORTNOTIFICATIONFAILURE (0x1000F011)
The system was bug checked to collect logs for an event notification failure.
PARAMETERS
1 - Depends on caller, may be the HRESULT for the problem
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_UNEXPECTEDSHUTDOWN (0x1000F012)
The system was bug checked to collect logs when an unexpected shutdown occurs during UI Stress automation.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_RPCFAILURE (0x1000F013)
The system was bug checked to collect logs for an RPC failure.
PARAMETERS
1 - Depends on caller, may be the Process ID
2 - Depends on caller, may be the current Thread ID
3 - Depends on caller, may be the HRESULT for the problem
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_AUXILIARYFULLDUMP (0x1000F014)
The system was bug checked to collect diagnostic logs to aid in investigations.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_ACCOUNTPROVSVCINITFAILURE (0x1000F015)
The system was bug checked to collect logs on an initialization failure of AccountProvSvc.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_MTBFCOMMANDTIMEOUT (0x1000F100)
The system was bug checked to collect logs for a command isused during an MTBF test pass that timed out.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_MTBFCOMMANDHANG (0x1000F101)
The system was bug checked to collect logs for a command isused during an MTBF test pass that could not be terminated.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_MTBFPASSBUGCHECK (0x1000F102)
The system was bug checked to collect logs for successful completion of all loops and iterations of an MTBF-Full test pass.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_MTBFIOERROR (0x1000F103)
The system was bug checked to collect logs for an IO error when mtbfclient.exe is writing to storage.
PARAMETERS
1 - Depends on caller, may be the HRESULT for the problem
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_RENDERTHREADHANG (0x1000F200)
The system was bug checked to collect logs for a rendering thread hang.
PARAMETERS
1 - Depends on caller, may be the current Process ID
2 - Depends on caller, may be the current Thread ID
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_RENDERMOBILEUIOOM (0x1000F201)
The system was bug checked to collect logs for a when DWM is using more than the set commit memory thresholds in an MTBF run.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_DEVICEUPDATEUNSPECIFIED (0x1000F300)
The system was bug checked to collect logs for an unspecified device update crash.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_AUDIODRIVERHANG (0x3000F400)
The system was bug checked to collect logs for an audio hang.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_BATTERYPULLOUT (0x1000F500)
The system was bug checked to collect logs in the case of a battery pull out.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_MEDIACORETESTHANG (0x1000F600)
The system was bug checked to collect logs for a media hang.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_RESOURCEMANAGEMENT (0x1000F700)
The system was bug checked to collect logs for a resource management problem.
PARAMETERS
1 - Depends on caller, may be the HRESULT for the problem
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_CAPTURESERVICE (0x1000F800)
The system was bug checked to collect logs for the camera driver failing to load.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_WAITFORSHELLREADY (0x1000F900)
The system was bug checked to collect logs for a problem during waiting for shell ready.
PARAMETERS
1 - Depends on caller, may be the current Process ID
2 - Depends on caller, may be the current Thread ID
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_NONRESPONSIVEPROCESS (0xC0000194)
The system was bug checked to collect logs for a non responsive process.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

SAVER_SICKAPPLICATION (0x66888866)
The system was bug checked to collect logs for a sick application that is being aborted.
PARAMETERS
1 - Unused
2 - Unused
3 - Unused
4 - Unused
DESCRIPTION
Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

DIRTY_MAPPED_PAGES_CONGESTION (0xEB)
PARAMETERS
1 - Total number of dirty pages
2 - Number of dirty pages destined for the pagefile(s).
3 - Internal flags.
4 - Most recent modified write error status.

DESCRIPTION
No free pages available to continue operations.

If kernel debugger available, type "!vm 3".

This bugcheck usually occurs for the following reasons:

If parameter 1 or 2 is large, then this is a possibility. Type
"!vm 3" in the kernel debugger.

2. The storage driver(s) are not processing requests. Examples
of this are stranded queues, non-responding drives, etc. This
indicates a driver bug.

If parameter 1 or 2 is large, then this is a possibility. Type
"!process 0 7" in the kernel debugger.

3. Not enough pool is available for the storage stack to write out
modified pages. This indicates a driver bug.

If parameter 3 is small, then this is a possibility. Type
"!vm" and "!poolused 2" in the kernel debugger.

SESSION_HAS_VALID_SPECIAL_POOL_ON_EXIT (0xEC)
PARAMETERS
1 - session ID
2 - number of special pool pages that are leaking

DESCRIPTION
Caused by a session driver not freeing its pool allocations prior to a
session unload. This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.

UNMOUNTABLE_BOOT_VOLUME (0xED)

The IO subsystem attempted to mount the boot volume and it failed.

PARAMETERS
1 - Device object of the boot volume
2 - Status code from the filesystem on why it failed to mount the volume

CRITICAL_PROCESS_DIED (0xEF)

A critical system process died

PARAMETERS
1 - Process object or thread object
2 - If this is 0, a process died. If this is 1, a thread died.

SCSI_VERIFIER_DETECTED_VIOLATION (0xF1)
PARAMETERS
1 - Error code:
VALUES
1000 : Miniport passed bad params to ScsiPortInitialize

2 - First argument to ScsiPortInitialize
3 - Second argument to ScsiPortInitialize

1001 : Miniport stalled processor too long

2 - Delay in microseconds supplied by miniport

1002 : Miniport routine executed too long

2 - Address of routine that ran too long
3 - Address of miniport's HwDeviceExtension
4 - Duration of the routine in microseconds

1003 : Miniport completed a request multiple times

2 - Address of miniport's HwDeviceExtension
3 - Address of SRB of multiply completed request

1004 : Miniport has completed request with bad status

2 - Address of SRB
3 - Address of miniport's HwDeviceExtension

1005 : Miniport has asked for the next LU request while
an untagged request is active

2 - Address of miniport's HwDeviceExtension
3 - Address of logical unit extension

1006 : Miniport called ScsiportGetPhysicalAddress with a bad VA

2 - Address of miniport's HwDeviceExtension
3 - VA supplied by the miniport

1007 : Miniport had outstanding requests at the end of a bus reset period

2 - Address of adapter extension
3 - Address of miniport's HwDeviceExtension

1008 : Miniport passed invalid BusDataType

2 - Bus-specific configuration data type
3 - Address of miniport's HwDeviceExtension
4 - System-assigned number of the I/O bus

2000 : Miniport passed bad parameters to StorPortInitialize

2 - First argument to StorPortInitialize
3 - Second argument to StorPortInitialize

2001 : Miniport stalled processor too long

2 - Delay in microseconds supplied by miniport

2002 : Miniport called a storport function that can only be called from HwStorFindAdapter routine

2003 : Address passed to StorPortGetDeviceBase is not assigned by PnP manager

2004 : Miniport completed a request multiple times

2005 : Miniport called device memory access function with a bad virtual address
END_VALUES

DESCRIPTION
The SCSI verifier has detected an error in a SCSI miniport driver being verified.

HARDWARE_INTERRUPT_STORM (0xF2)

Note: This bug check no longer exists in any version of Windows.

PARAMETERS
1 - address of the ISR (or first ISR in the chain) connected to the storming interrupt vector
2 - ISR context value
3 - address of the interrupt object for the storming interrupt vector
4 - 0x1 if the ISR is not chained, 0x2 if the ISR is chained

DESCRIPTION
This bugcheck will show up on the screen when the kernel
detects an interrupt "storm". An interrupt storm is defined as a level
triggered interrupt signal staying in the asserted state. This is fatal
to the system in the manner that the system will hard hang, or "bus lock".

This can happen because of the following:

- A piece of hardware does not release its interrupt signal after being told
to do so by the device driver
- A device driver does not instruct its hardware to release the interrupt
signal because it does not believe the interrupt was initiated from its
hardware
- A device driver claims the interrupt even though the interrupt was not
initiated from its hardware. Note that this can only occur when multiple
devices are sharing the same IRQ.
- The ELCR (edge level control register) is set incorrectly.
- Edge and Level interrupt triggered devices share an IRQ (e.g. COM port and
PCI SCSI controller).

All of these cases will instantly hard hang your system. Instead of hard
hanging the system, this bugcheck is initiated since in many cases it can
identify the culprit.

When the bugcheck occurs, the module containing the ISR (interrupt service
routine) of the storming IRQ is displayed on the screen. This is an
example of what you would see:

*** STOP: 0x000000F2 (0xFCA7C55C, 0x817B9B28, 0x817D2AA0, 0x00000002)

An interrupt storm has caused the system to hang.

*** Address FCA7C55C base at FCA72000, Datestamp 3A72BDEF - ACPI.sys

In the event the fourth parameter is a 0x00000001, the module pointed to
is very likely the culprit. Either the driver is broken, or the hardware
is malfunctioning.

In the event the fourth parameter is a 0x00000002, the module pointed to
is the first ISR in the chain, and is never guaranteed to be the culprit.
A user experiencing this bugcheck repeatedly should try to isolate the
problem by looking for devices that are on the same IRQ as the one for
which the module is a driver for (in this case, the same IRQ that ACPI
is using). In the future, we may be able to list all devices on a
chained ISR.

DISORDERLY_SHUTDOWN (0xF3)

No free pages available to continue operations.

Because applications are not terminated and drivers are
not unloaded, they can continue to access pages even after
the modified writer has terminated. This can cause the
system to run out of pages since the pagefile(s) cannot be used.

PARAMETERS
1 - Total number of dirty pages
2 - Number of dirty pages destined for the pagefile(s).
3 - Internal flags.
4 - Most recent modified write error status.

CRITICAL_OBJECT_TERMINATION (0xF4)

A process or thread crucial to system operation has unexpectedly exited or been
terminated.

Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.

PARAMETERS
1 - Terminating object type
VALUES:
3 : Process
6 : Thread
END_VALUES
2 - Terminating object
3 - Process image file name
4 - Explanatory message (ascii)

FLTMGR_FILE_SYSTEM (0xF5)

An unrecoverable failure occured inside the filter manager.

PARAMETERS
Parm 1 - The reason for the failure
VALUES:
102 : A mini-filter requested a post-operation callback when none was
defined

Parm 2 - The CallBackData associated with this operation

103 : An internal object ran out of space and the system is unable to
allocate new space.

Parm 2 - The CallBackData associated with this operation
Parm 4 - The error associated with the operation

104 : A FileNameInformation structure was over-derefenced.

Parm 2 - The address of the NAME_CACHE_NODE structure
Parm 3 - The address of the FLT_FILE_NAME_INFORMATION structure

106 : Attempt to cancel an open file which is not allowed.

Parm 2 - The file object we are trying to cancel

107 : Invalid BACKPOCKET IRPCTRL state

Parm 2 - Frame ID
Parm 3 - If not NULL, backpocket IRPCTRL being used
Parm 4 - Thread

108 : Too many nested PageFaults for BACKPOCKED IRPCTRL

Parm 2 - Frame ID
Parm 3 - BackPocket slot ID
Parm 4 - Thread

109 : The context structure was over-dereferenced

Parm 2 - Address of the Context structure
Parm 3 - Address of the CONTEXT_NODE structure

110 : The context structure was referenced after being freed

Parm 2 - Address of the Context structure
Parm 3 - Address of the CONTEXT_NODE structure

END_VALUES

PCI_VERIFIER_DETECTED_VIOLATION (0xF6)

The PCI driver detected an error in a device or BIOS being verified.

PARAMETERS
1 - Failure detected
VALUES:
1 : An active bridge was reprogrammed by the BIOS during a docking event
2 : The PMCSR register was not updated within the spec mandated time
3 : A driver has written to OS controlled portions of a PCI device's config space
END_VALUES

DRIVER_OVERRAN_STACK_BUFFER (0xF7)

A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.

DESCRIPTION

A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.

Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).

PARAMETERS
1 - Actual security check cookie from the stack

2 - Expected security check cookie

3 - Complement of the expected security check cookie

4 - zero

RAMDISK_BOOT_INITIALIZATION_FAILED (0xF8)

An initialization failure occurred while attempting to boot from the RAM disk.

PARAMETERS
1 - Action that failed
VALUES:
1 : No LoaderXIPRom descriptor was found in the loader memory list
2 : Unable to open the RAM disk driver (ramdisk.sys, \Device\Ramdisk)
3 : FSCTL_CREATE_RAM_DISK failed
4 : Unable to create GUID string from binary GUID
5 : Unable to create symbolic link pointing to RAM disk device
END_VALUES
2 - NT status code

DRIVER_RETURNED_STATUS_REPARSE_FOR_VOLUME_OPEN (0xF9)

A driver returned STATUS_REPARSE to a Create request with no trailing names.
STATUS_REPARSE should be returned only for Create requests with trailing names
as that indicates the driver is supporting name spaces.

PARAMETERS
1 - Device object that was opened.
2 - Device object to which the Create IRP was issued.
3 - New name of the file (to be reparsed) (UNICODE string)
4 - Information returned by the driver for the Create IRP

HTTP_DRIVER_CORRUPTED (0xFA)

The HTTP kernel driver (http.sys) reached a corrupted state and can not
recover.

PARAMETERS
1 - State identifier
VALUES:
1 : A work item is invalid. This will eventually result in
corruption of the thread pool and an access violation.
2 - Address of work item
3 - Name of file containing work item check, __FILE__
4 - Line number in file, __LINE__
END_VALUES

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (0xFC)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).

PARAMETERS
1 - Virtual address for the attempted execute.
2 - PTE contents.
3 - (reserved)
4 - (reserved)

DESCRIPTION
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.

DIRTY_NOWRITE_PAGES_CONGESTION (0xFD)
PARAMETERS
1 - Total number of dirty pages
2 - Number of nowrite dirty pages.
3 - Internal flags.
4 - Most recent modified write error status.

DESCRIPTION
No free pages available to continue operations.

If kernel debugger available, type "!vm 3 and !memusage 1".

This bugcheck usually occurs because the component owning the
modified nowrite pages failed to write out these pages after
marking the relevant files as dont-write to memory management.
This indicates a driver bug.

BUGCODE_USB_DRIVER (0xFE)
PARAMETERS
1 - USB Bugcheck Code:
VALUES
1 : INTERNAL_ERROR An internal error has occured in the USB stack

2 : BAD_URB The USB client driver has submitted a URB that is
still attached to another IRP still pending in the bus
driver.

2 - Address of pending IRP.
3 - Address of IRP passed in.
4 - Address URB that caused the error.

3 : MINIPORT_ERROR The USB miniport driver has generated a
bugcheck. This is usually in response to catastrophic
hardware failure.

4 : IRP_URB_DOUBLE_SUBMIT The caller has submitted an irp
that is already pending in the USB bus driver.

2 - Address of IRP
3 - Address of URB

5 : USBBUGCODE_INVALID_PHYSICAL_ADDRESS The host controller is
using a physical memory address that was not allocated by
the USBport driver.
2 - Device extension pointer of the host controller
3 - PCI Vendor,Product id for the controller
4 - Pointer to Endpoint data structure

6 : USBBUGCODE_BAD_SIGNATURE An Internal data structure (object)
has been corrupted.
2 - Object address
3 - Signature that was expected

7 : USBBUGCODE_MINIPORT_ASSERT_FAILURE

2 - Pointer to usbport.sys debug log
3 - Msg string
4 - File name

8 : USBBUGCODE_RESERVED_USBHUB
2 - Reserved Subtype
VALUES
1 : USBHUB_TRAP_FATAL
3 - Context
4 - Log Pointer

2 : USBHUB_BAD_IRP
Invalid or unregistered IRP_MJ_ code.
3 - DeviceObject
4 - IRP

3 : USBHUB_BAD_CONTENT_ID_PARAMETER

4 : USBHUB_PDO_TRAP_FATAL
3 - Context if next arg null, else PDO
4 - Context if not null

5 : USBHUB_TRAP_NONFATAL

6 : USBHUB_TRAP_FATAL_TIMEOUT
3 - TimeoutCode
VALUES
0 : TimeoutCode: Timeout_Not_Fatal
4 - TimeoutContext - PortData
1 : TimeoutCode: Timeout_SyncResumePort - Failed resuming a suspended port
4 - TimeoutContext - PortData
2 : TimeoutCode: Timeout_PCE_Suspend_Action0 - PortData->DriverResetEvent
4 - TimeoutContext - PortData
3 : TimeoutCode: Timeout_PCE_Suspend_Action1 - PortData->PortResumeEvent
4 - TimeoutContext - PortData
4 : TimeoutCode: Timeout_PCE_Suspend_Action2 - PortData->PortChangeListDone
4 - TimeoutContext - PortData
5 : TimeoutCode: Timeout_PCE_Suspend_Action3 - PortData->PortSuspendEvent
4 - TimeoutContext - PortData
6 : TimeoutCode: Timeout_PCE_Disable_Action - PortData->PortChangeListDone - Timeout trying to set Disable bit
4 - TimeoutContext - PortData
7 : TimeoutCode: Timeout_PCE_Close_Action - PortData->PortChangeListDone - Timeout trying to set Port Change Queue WAIT bit
4 - TimeoutContext - PortData
8 : TimeoutCode: Timeout_SSP_Disable_Action - hubExt->SSP_GlobalResumeEvent - Timeout on ClearHubIdleReady trying to disable
4 - State_Context - PortData
9 : TimeoutCode: Timeout_SysPowerSx_Action - hubExt->SSP_GlobalResumeEvent - Timeout on ClearHubIdleReady tryting to resume suspended port
4 - State_Context - PortData
END_VALUES
END_VALUES

9 : USBBUGCODE_RESERVED_DUMP A critical error was hit in dump miniport driver.
2 - dmpusbstor or uaspstor driver error code
3 - failure status code
4 - dmpusbstor or uaspstor extension

10: USBBUGCODE_BOOT_DEVICE_RESET_FAILED A critical error was hit in the hub driver while resetting the device
2 - driver error code
3 - hub state context
4 - hub extension

END_VALUES

DESCRIPTION
USB Driver bugcheck, first parameter is USB bugcheck code.

RESERVE_QUEUE_OVERFLOW (0xFF)

An attempt was made to insert a new item in a reserve queue which caused the
queue to overflow.

PARAMETERS
1 - The address of the reserve queue.
2 - The size of the reserve queue.
3 - 0.
4 - 0.

LOADER_BLOCK_MISMATCH (0x100)

The loader block in not valid or mismatches the system that is being loaded.

PARAMETERS
1 - The OS major version of the loader block.
2 - The OS minor version of the loader block.
3 - The size of the loader block.
4 - The size of the loader block extension.

CLOCK_WATCHDOG_TIMEOUT (0x101)

An expected clock interrupt was not received on a secondary processor in an
MP system within the allocated interval. This indicates that the specified
processor is hung and not processing interrupts.

PARAMETERS
1 - Clock interrupt time out interval in nominal clock ticks.
2 - 0.
3 - The PRCB address of the hung processor.
4 - 0.

DPC_WATCHDOG_TIMEOUT (0x102)

The DPC watchdog routine was not executed within the allocated time interval.
This means that either an ISR is hung at an IRQL that is below clock level and
above dispatch level, or a DPC routine is hung on the specified processor.

PARAMETERS
1 - DPC watchdog time out interval in nominal clock ticks.
2 - The PRCB address of the hung processor.
3 - 0.
4 - 0.

MUP_FILE_SYSTEM (0x103)
MUP file system detected an error.

PARAMETERS
1 - Type of MUP error
VALUES
1 : MUP_BUGCHECK_NO_FILECONTEXT
Could not locate MUP file context corresponding to a file object.
2 - Irp Address if an IRP was used, NULL otherwise.
3 - FILE_OBJECT Address whose MUP file context could not be found
4 - DEVICE_OBJECT Address

2 : MUP_BUGCHECK_UNEXPECTED_FILECONTEXT
MUP filecontext is known to exist for file object, but was not what
was expected (may be NULL).
2 - Expected MUP_FILE_CONTEXT Address
3 - MUP_FILE_CONTEXT Address that was actually retrived from the file object
4 - 0

3 : MUP_BUGCHECK_UNEXPECTED_IRP_NTSTATUS
IRP completion status was unexpected/invalid.
2 - MUP_IRP_CONTEXT Address
3 - IRP completion status code
4 - Driver object of UNC provider which completed the IRP (may be NULL)

4 : MUP_BUGCHECK_CREATE_PENDING
An I/O operation was started on a file object before its create was complete.
2 - Irp Address
3 - FILE_OBJECT
4 - MUP_FILE_CONTEXT for the file object

0x100 : MUP_BUGCHECK_MUST_NOT_BE_CALLED
A routine that must not be called during this operation was called or
a routine that must be called by a specific thread was called by an unexpected thread.
2 - Expected Thread
3 - FILE_OBJECT Address
4 - DEVICE_OBJECT Address

AGP_INVALID_ACCESS (0x104)

An invalid AGP memory accessa was detected.
This is most likely caused by an unsigned, or improperly tested video driver,
or old BIOS. Check for updated display drivers and system BIOS.

PARAMETERS
1 - Last AGP memory allocation type, 1=allocation, 0=free.
2 - Address of Memory Descriptor List (MDL) for last allocation.
3 - Base Address Page Frame Number (PFN) of last AGP allocation.
4 - 0.

AGP_GART_CORRUPTION (0x105)

The Graphics Aperture Redirection Table (Gart) is corrupt.
This is most likey caused by errant device Direct Memory Access (DMA).
Enable the driver verifier against unsigned drivers, and remove them
or disable them one at a time until the culprit is idnetified.

PARAMETERS
1 - Base address of the Graphics Aperture Redirection Table (Gart).
2 - Offset into Gart where corruption occurred.
3 - Base address of the Gart-cache (copy of Gart).
4 - 0.

AGP_ILLEGALLY_REPROGRAMMED (0x106)

The AGP HW has been reprogrammed by an unauthorized agent.
This is most likely caused by an unsigned, or improperly tested video driver.
Check video manufacturer's web site for updated display drivers, or use
VGA-mode.

PARAMETERS
1 - Originally programmed AGP Command Register value.
2 - Current Command Register value.
3 - 0.
4 - 0.

THIRD_PARTY_FILE_SYSTEM_FAILURE (0x108)

DESCRIPTION
A 3rd party file system or file system filter has failed in an
unrecoverable way.

PARAMETERS
1 - Identifies the file system that failed
VALUES:
1 : psfs.sys (Polyserve)
2 - ExceptionRecord.
3 - ContextRecord.
4 - File System specific value.

CRITICAL_STRUCTURE_CORRUPTION (0x109)

This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:

1) A driver has inadvertently or deliberately modified critical kernel code
or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx

2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.

3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.

PARAMETERS
1 - Reserved
2 - Reserved
3 - Failure type dependent information
4 - Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification
8 : Object type
9 : A processor IVT
a : Modification of a system service function
b : A generic session data region
c : Modification of a session function or .pdata
d : Modification of an import table
e : Modification of a session import table
f : Ps Win32 callout modification
10 : Debug switch routine modification
11 : IRP allocator modification
12 : Driver call dispatcher modification
13 : IRP completion dispatcher modification
14 : IRP deallocator modification
15 : A processor control register
16 : Critical floating point control register modification
17 : Local APIC modification
18 : Kernel notification callout modification
19 : Loaded module list modification
1a : Type 3 process list corruption
1b : Type 4 process list corruption
1c : Driver object corruption
1d : Executive callback object modification
1e : Modification of module padding
1f : Modification of a protected process
20 : A generic data region
21 : A page hash mismatch
22 : A session page hash mismatch
23 : Load config directory modification
24 : Inverted function table modification
25 : Session configuration modification
102 : Modification of win32k.sys

APP_TAGGING_INITIALIZATION_FAILED (0x10A)

FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION (0x10C)

DESCRIPTION
A violation has been detected in the use of FsRtl
Extra Create Parameter package.

PARAMETERS
1 - Type of violation
VALUES:
0x01 : Extra Create Parameter signature invalid - bad pointer or memory corruption
0x02 : Extra Create Parameter has spurious (undefined) flags set
0x03 : Extra Create Parameter was not allocated by FsRtl
0x04 : Extra Create Parameter has flags set that are illegal for one passed by a create caller
0x05 : Extra Create Parameter size corrupted - its less than header size
0x06 : Extra Create Parameter being freed has non-empty list pointers
0x11 : Extra Create Parameter List signature invalid - bad pointer or memory corruption
0x12 : Extra Create Parameter List has spurious (undefined) flags set
0x13 : Extra Create Parameter List was not allocated by FsRtl
0x14 : Extra Create Parameter List has flags set that are illegal for one passed by a create caller
0x15 : Extra Create Parameter List passed by create caller is empty
END_VALUES
2 - 0.
3 - Ecp.
4 - EcpList.

WDF_VIOLATION (0x10D)

The Kernel-Mode Driver Framework was notified that Windows detected an error
in a framework-based driver. In general, the dump file will yield additional
information about the driver that caused this bug check.

PARAMETERS
1 - The subtype of the bugcheck.
VALUES:
0x1 : A framework-based driver has timed out during a power operation.
This typically means that the device stack did not set the
DO_POWER_PAGABLE bit and a driver attempted a pagable operation
after the paging device stack was powered down.
2 - Pointer to a WDF_POWER_ROUTINE_TIMED_OUT_DATA structure.
3 - Reserved.
4 - Reserved.

0x2 : An attempt is being made to acquire a lock that is currently
being held. The lock in question can be determined by examining
the caller's stack.
2 - Reserved.
3 - Reserved.
4 - Reserved.

0x3 : Windows Driver Framework Verifier has encountered a fatal error.
In particular, an I/O request has been completed, but a framework
request object cannot be deleted because there are outstanding
references to the input buffer or the output buffer, or both. The
driver's IFR will include details on the outstanding references.
2 - WDFREQUEST handle
3 - The number of outstanding references remaining on both buffers.
4 - Reserved.

0x4 : A NULL parameter was passed to a function that required a non-
NULL value. Use the "ln" debugger command with the value of
Parameter 3 as its argument to determine the function which
requires a non-NULL parameter.
2 - Reserved.
3 - The caller's address.
4 - Reserved.

0x5 : A framework object handle of the incorrect type was passed to
a framework object method.
2 - The handle value passed in.
3 - Reserved.
4 - Reserved.

0x6 : A fatal error was made in handling a WDF request. In this case,
Parameter 2 further specifies the type of fatal error that has
been made, as defined by the enumeration WDF_REQUEST_FATAL_ERROR.
2 - Type of the fatal error.
VALUES:
0x1 : No more I/O stack locations are available to format the
underlying IRP.
3 - The address of the IRP.
4 - Reserved.

0x2 : An attempt was made to format a framework request object
that did not contain an IRP.
3 - The WDF request handle value.
4 - Reserved.

0x3 : The driver attempted to send a framework request that has
already been sent to an I/O target.
3 - The WDF request handle value.
4 - Reserved.

0x4 : The driver has completed a framework request, but has
written more bytes to the output buffer than are specified
in the IRP.
3 - A pointer to a
WDF_REQUEST_FATAL_ERROR_INFORMATION_LENGTH_MISMATCH_DATA
structure, which contains a pointer to the IRP, a WDF
request handle value, an IRP major function, and the
number of bytes attempted to be written.
4 - Reserved.
0x5 : An attempt was made to retrieve a request from the wrong
queue.
3 - A pointer to an IO_CSQ_IRP_CONTEXT structure, which
contains a pointer to the IRP and a pointer to the IRP's
queue. The structure belongs to a WDF request object.
Please see the driver's WDF logs for more information.
4 - Reserved.
END_VALUES

0x7 : A driver attempted to delete a framework object incorrectly
by calling WdfObjectDereference to delete a handle instead
of calling WdfObjectDelete.
2 - Reserved.
3 - Reserved.
4 - Reserved.

0x8 : An operation occurred on a DMA transaction object while it
was not in the correct state.
2 - Reserved.
3 - Reserved.
4 - Reserved.

0xA : A fatal error has occurred while processing a request on the
queue.
2 - Pointer to a WDF_QUEUE_FATAL_ERROR_DATA structure.
3 - Reserved.
4 - Reserved.

0xB : An attempt to acquire or release a lock was invalid. In this
case, Parameter 3 further specifies the error that has been
made.
3 - Type of the error.
VALUES:
0x0 : A handle passed to either WdfObjectAcquireLock or
WdfObjectReleaseLock represents an object that does not
support synchronization locks.
2 - The handle value.
4 - Reserved.

0x1 : The spin lock is being released by a thread which did not
acquire it.
2 - A WDF spinlock handle.
4 - Reserved.
END_VALUES

0xC : A new state changing PnP IRP arrived while another state changing
PnP IRP is being processed.
2 - WDFDEVICE Handle.
3 - New Pnp IRP.
4 - Reserved.

0xD : A power irp was received for the device but the irp was not
requested by the device (the power policy owner). Possibly there
are multiple power policy owners. Only one driver in the stack can
be the power policy owner. A KMDF driver can change power policy
ownership by calling the DDI WdfDeviceInitSetPowerPolicyOwnership.

2 - Device object pointer.
3 - Power Irp.
4 - Reserved.

0xE : The IRQL at which framework called driver's event callback
function is not same as the IRQL at which the callback
returned from driver. This can happen if driver changed IRQL
directly or indirectly inside the callback. For example, driver
acquired spinlock, which raises IRQL to DISPATCH_LEVEL,
and then forgot to release spinlock.

2 - IRQL before callback.
3 - IRQL after callback.
4 - Reserved.

0xF : The driver entered critical region in an event callback but did
not leave critical region before returning from callback.

2 - Address of event callback function.
3 - Reserved.
4 - Reserved.

END_VALUES

VIDEO_MEMORY_MANAGEMENT_INTERNAL (0x10E)

PARAMETERS
1 - The subtype of the bugcheck:
VALUES:
0x1 : Trying to rotate a non-rotate range.
0x2 : Process heap being destroyed isn't empty.
0x3 : Unmap from aperture segment failed.
0x4 : Rotation failed in a must succeed path.
0x5 : Deferred command failed.
0x6 : Can't reallocate resource for an allocation having it's
eviction cancelled.
0x7 : Invalid deferred free usage.
0x8 : Invalid reference in splitted DMA buffer.
0x9 : Failed to evict allocation.
0xA : Invalid use of pinned allocation.
0xB : Driver returned an invalid error code from BuildPagingBuffer.
0xC : A resource leak was detected in a segment.
0xD : A segment is being used improperly.
0xE : Fail to map allocation into an aperture segment.
0xF : Driver returned an invalid error code from AcquireSwizzlingRange.
0x10 : Driver returned an invalid error code from ReleaseSwizzlingRange.
0x11 : Invalid usage of an aperture segment.
0x12 : Driver overflowed the provided DMA buffer.
0x13 : Driver overflowed the provided private data buffer.
0x14 : Failed to purge all segment.
0x15 : Trying to free a VAD still in the rotated state.
0x16 : Driver broke the guaranteed DMA buffer model contract.
0x17 : Unexpected system command failure.
0x18 : Fail to release pinned allocation's resource.
0x19 : Driver failed to patch a DMA buffer.
0x1A : Freeing the owner of a shared allocation.
0x1B : Trying to release an aperture range that is still busy.
END_VALUES

DESCRIPTION
The video memory manager encountered a condition that it can't recover from. By crashing,
the video memory manager is attempting to get enough information into the minidump such that
somebody can pinpoint what lead to this condition.

MSRPC_STATE_VIOLATION (0x112)
This is a bugcheck initiated by MSRPC.SYS. The most common cause is that
the caller of MSRPC.SYS violated the state semantics for calling MSRPC.SYS.
See the parameters for more information.
PARAMETERS
1 - State violation type:
VALUES:
0x01 : Non-continuable exception continued by caller. Parameter is the exception code
0x02 : ALPC returned invalid error. Parameter is the error.
0x03 : Caller unloaded MSRPC with calls pending. Parameter is the session to the server.
0x04 : Invalid close received from ALPC. Parameter is the session to the server.
0x05 : Invalid close received from ALPC - different type of close. Parameter is the session to the server.
0x06 : An attempt was made to bind an RPC handle a second time. Parameter is the binding handle.
0x07 : An attempt was made to perform an operation on a binding handle that was not bound. Parameter is the binding handle.
0x08 : An attempt was made to set security information on a binding handle that was already bound. Parameter is the binding handle.
0x09 : An attempt was made to set an option on a binding handle that was already bound. Parameter is the binding handle.
0x0A : An attempt was made to push on an async pipe without waiting for the notification. Parameter is the call object.
0x0B : An attempt was made to push on an async pipe without waiting for the notification. Parameter is the call object.
0x0C : An attempt was made to push on an async pipe without waiting for the notification - different type. Parameter is the pipe object.
0x0E : An attempt was made to push on an async pipe without waiting for the notification - third type. Parameter is the pipe object.
0x0F : An attempt was made to synchronously terminate the pipe a second time. Parameter is the pipe object.
0x15 : RPC internal error. Parameter is the object closest to the error.
0x16 : Two causally ordered calls are issued in order that cannot be enforced by RPC.
0x17 : Server manager routine did not un-sibscribe from notifications prior to completing the call. Parameter is the call object.
0x18 : Invalid overation on the async handle. Parameter is the async handle.

2 - State violation parameter. See state violation type for description of this parameter.

VIDEO_DXGKRNL_FATAL_ERROR (0x113)

PARAMETERS
1 - The subtype of the bugcheck:
VALUES:
0x1 : The display driver has filled in an invalid allocation handle

DESCRIPTION
The dxgkrnl has detected that a violation has occurred. This resulted
in a condition that dxgkrnl can no longer progress. By crashing, dxgkrnl
is attempting to get enough information into the minidump such that somebody
can pinpoint the crash cause. Any other values after parameter 1 must be
individually examined according to the subtype.

VIDEO_SHADOW_DRIVER_FATAL_ERROR (0x114)

PARAMETERS
1 - The subtype of the bugcheck:
VALUES:
0x1 : Present failure

DESCRIPTION
The shadow driver has detected that a violation has occurred. This resulted
in a condition that shadow driver can no longer progress. By crashing, shadow driver
is attempting to get enough information into the minidump such that somebody
can pinpoint the crash cause. Any other values after parameter 1 must be
individually examined according to the subtype.

AGP_INTERNAL (0x115)

PARAMETERS
1 - The subtype of the bugcheck:
VALUES:
0x1 : Device being stopped/removed with interface reference still existing.

DESCRIPTION
The AGP driver has detected that a violation has occurred. This resulted
in a condition that AGP driver can no longer progress. By crashing, the AGP driver
is attempting to get enough information into the minidump such that somebody
can pinpoint the crash cause. Any other values after parameter 1 must be
individually examined according to the subtype.

VIDEO_TDR_FAILURE (0x116)

PARAMETERS
1 - Optional pointer to internal TDR recovery context (TDR_RECOVERY_CONTEXT).
2 - The pointer into responsible device driver module (e.g. owner tag).
3 - Optional error code (NTSTATUS) of the last failed operation.
4 - Optional internal context dependent data.

DESCRIPTION
Attempt to reset the display driver and recover from timeout failed.

VIDEO_TDR_TIMEOUT_DETECTED (0x117)

PARAMETERS
1 - Optional pointer to internal TDR recovery context (TDR_RECOVERY_CONTEXT).
2 - The pointer into responsible device driver module (e.g owner tag).
3 - The secondary driver specific bucketing key.
4 - Optional internal context dependent data.

DESCRIPTION
The display driver failed to respond in timely fashion.
(This code can never be used for a real bugcheck.)

VIDEO_SCHEDULER_INTERNAL_ERROR (0x119)

PARAMETERS
1 - The subtype of the bugcheck:
VALUES:
0x1 : The driver has reported an invalid fence ID.
0x2 : The driver failed upon the submission of a command.
0x3 : The driver failed upon the patching command buffer.
0x4 : The driver reported the invalid flip capability.

DESCRIPTION
The video scheduler has detected that fatal violation has occurred. This resulted
in a condition that video scheduler can no longer progress. Any other values after
parameter 1 must be individually examined according to the subtype.

EM_INITIALIZATION_ERROR (0x11A)

DRIVER_RETURNED_HOLDING_CANCEL_LOCK (0x11B)

PARAMETERS
1 - The address of the IRP that was cancelled (may not be valid).
2 - The address of the cancel routine.

DESCRIPTION
A driver has returned from a cancellation routine holding the global cancel
lock. This will result in any subsequent cancellation calls to fail either
resulting in a deadlock or another bugcheck.

ATTEMPTED_WRITE_TO_CM_PROTECTED_STORAGE (0x11C)
An attempt was made to write to the read-only protected storage of the
configuration manager.

PARAMETERS
1 - Virtual address for the attempted write.
2 - PTE contents.
3 - (reserved)
4 - (reserved)

DESCRIPTION
An attempt was made to write to the read-only protected storage of the
configuration manager.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.

EVENT_TRACING_FATAL_ERROR (0x11D)

Event Tracing subsystem has encountered an unexpected fatal error. First parameter indicates
the type of failure.

PARAMETERS
1 - The subtype of the bugcheck.
VALUES:
0x01 : Unable to initialize security.
0x02 : Unable to initialize processor.
0x03 : Kernel mode registration corruption.
0x04 : Invalid handle in unregistration.
0x05 : Data overrun in EventWrite call.
0x06 : Event has been lost.
0x07 : Trace buffer corruption.
0x08 : Unable to allocate cache-aware rundown protection for ETW LoggerContext.
2 - Logger Id
0x09 : The reference count of ETW GuidEntry is illegal for the current state of the object.
2 - Pointer to ETW_GUID_ENTRY
END_VALUES

TOO_MANY_RECURSIVE_FAULTS (0x11E)

DESCRIPTION
A file system has caused too many recursive faults under low resource
conditions to be handled.

INVALID_DRIVER_HANDLE (0x11F)

PARAMETERS
1 - The handle value for the driver object.
2 - The status returned trying to reference the object.
3 - The address of the PDRIVER_OBJECT.

DESCRIPTION
Someone has closed the initial handle for a driver between inserting the driver
object and referencing the handle.

BITLOCKER_FATAL_ERROR (0x120)

BitLocker Drive Encryption encountered a problem that it cannot recover from.

PARAMETERS
1 - Type of problem
VALUES:
1 : Fatal error occurred that BitLocker cannot resume from without
causing catastrophic disk corruption.
2 - Device object.
3 - Original Error code.
4 - Secondary Error code (double-error).
2 : Work item corrupted.
2 - Work item (internal).
3 - reserved.
4 - reserved.
3 : Work item queue corrupted.
2 - Work queue global data (internal).
3 - reserved.
4 - reserved.
4 : Memory corrupted while performing crypto operation.
2 - Work item (internal).
3 - Byte offset.
4 - Byte length.

DRIVER_VIOLATION (0x121)

PARAMETERS
1 - The subtype of the bugcheck.
VALUES:
0x1 : A driver has called a function which can only be called at a
specific IRQL.
2 - The current IRQL.
3 - The required IRQL.
END_VALUES

DESCRIPTION
A driver has caused a violation. Parameter 1 describes the type of violation.
Look at the call stack to determine the misbehaving driver.

BC_BLUETOOTH_VERIFIER_FAULT (0xbfe)

PARAMETERS
1 - The subtype of the Bluetooth verifier fault.
VALUES:
0x1 : An attempt was made to submit a Bluetooth Request Block that is already in use
2 - Brb pointer
3 - Reserved
4 - Reserved
0x2 : An attempt was made to free a Bluetooth Request Block that is in use
2 - Brb pointer
3 - Reserved
4 - Reserved
0x3 : An attempt was made to allocate or initialize an invalid BRB type
2 - Brb pointer
3 - pdo extension (if available)
4 - Reserved
0x4 : Invalid Bluetooth Request Block pointer was submitted
2 - Brb pointer
3 - Reserved
4 - Reserved
0x5 : A Bluetooth Request Block with an invalid size was submitted
2 - Brb pointer
3 - Actual Size
4 - Expected Size
0x6 : The IOCTL_BTH_GET_DEVICE_INFO was called with invalid parameters
2 - Reserved
3 - Reserved
4 - Reserved
0x7 : BRB_L2CA_UNREGISTER_SERVER was submitted with an invalid server handle
2 - Server handle
3 - Reserved
4 - Reserved
0x8 : BRB_L2CA_CLOSE_CHANNEL was submitted with an invalid channel handle
2 - Brb pointer
3 - Channel handle
4 - Reserved
0x9 : BRB_SCO_UNREGISTER_SERVER was submitted with an invalid server handle
2 - Server handle
3 - Reserved
4 - Reserved
END_VALUES

DESCRIPTION
The Bluetooth profile driver verifier has caught a violation.
Look at the call stack to dertermine the misbehaving driver.

BC_BTHMINI_VERIFIER_FAULT (0xbff)

PARAMETERS
1 - The subtype of the BthMini verifier fault.
VALUES:
0x1 : An attempt was made to return a packet with type that mis-matched its original request.
2 - Returned packet type
3 - Expected packet type
4 - Reserved
0x2 : An attempt was made to return an unexpected status code and caused the packet to be discarded.
2 - Unexpected return status
3 - Reserved
4 - Reserved
0x3 : Incorrect output buffer size was returned to indicate number of bytes written by the lower transport driver.
2 - Unexpected buffer size
3 - Expected buffer size
4 - Reserved
END_VALUES

DESCRIPTION
The Bluetooth miniport extensible driver verifier has caught a violation.
Look at the call stack to dertermine the misbehaving driver.

THREAD_TERMINATE_HELD_MUTEX (0x4000008A)

PARAMETERS
1 - The address of the KTHREAD that owns the KMUTEX.
2 - The address of the KMUTEX that is owned.

DESCRIPTION
A driver acquired a mutex on a thread that exited before the
mutex could be released. This can be caused by a driver returning
to user mode without releasing a mutex or by a driver acquiring a
mutex and then causing an exception that results in the thread it
is running on being terminated. Look at the callstack. If there is
a driver on the stack that is directly followed by system exception
handling routines and then thread termination routines, this driver
is at fault and needs to be fixed so that it does not cause an
unhandled exception while holding a kernel mutex. If the stack just
shows normal thread termination code and no driver is implicated, run
!pool or 'ln' on the address of the mutex (parameter 2) and see if you
can discover who owns the it. This bug will almost certainly be in the
code of the owner of that mutex.

WINLOGON_FATAL_ERROR (0xC000021A)

The Winlogon process terminated unexpectedly.

PARAMETERS
1 - String that identifies the problem.
2 - Error Code.

MANUALLY_INITIATED_CRASH1 (0xDEADDEAD)

The user manually initiated this crash dump.

WHEA_INTERNAL_ERROR (0x122)

CRYPTO_SELF_TEST_FAILURE (0x123)

The cryptographic subsystem failed a mandatory algorithm self-test during bootstrap.

WHEA_UNCORRECTABLE_ERROR (0x124)

PARAMETERS
1 - Error Source Type
VALUES:
0x0 : Machine Check Exception
2 - Address of the WHEA_ERROR_RECORD structure.
3 - High order 32-bits of the MCi_STATUS value.
4 - Low order 32-bits of the MCi_STATUS value.

0x1 : Corrected Machine Check
2 - Address of the WHEA_ERROR_RECORD structure.

0x2 : Corrected Platform Error
2 - Address of the WHEA_ERROR_RECORD structure.

0x3 : Non-maskable Interrupt
2 - Address of the WHEA_ERROR_RECORD structure.

0x4 : PCI Express Error
2 - Address of the WHEA_ERROR_RECORD structure.

0x5 : Generic Error
2 - Address of the WHEA_ERROR_RECORD structure.

0x6 : INIT Error
2 - Address of the WHEA_ERROR_RECORD structure.

0x7 : BOOT Error
2 - Address of the WHEA_ERROR_RECORD structure.

0x8 : SCI Generic Error
2 - Address of the WHEA_ERROR_RECORD structure.

0x9 : Itanium Machine Check Abort
2 - Address of the WHEA_ERROR_RECORD structure.
3 - Length in bytes of the SAL log.
4 - Address of the SAL log.

0xa : Itanium Corrected Machine Check
2 - Address of the WHEA_ERROR_RECORD structure.

0xb : Itanium Corrected Platform Error
2 - Address of the WHEA_ERROR_RECORD structure.
END_VALUES

DESCRIPTION
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.

NMR_INVALID_STATE (0x125)

NMR (network module registrar) has detected an invalid state. Parameter 1 describes
the type of the state.

PARAMETERS
1 - The subtype of the bugcheck.
VALUES:
0x1 : Invalid NMR binding handle. The signature of NMR binding has been corrupted.
2 - Invalid binding handle.
3 - Pointer to binding itself.
4 - Reserved.

0x2 : Multiple NMR client detach. Client detach has been completed more than once.
2 - Pointer to the binding.
3 - Reserved.
4 - Reserved.

0x3 : Multiple NMR provider detach. Provider detach has been completed more than once.
2 - Pointer to the binding.
3 - Reserved.
4 - Reserved.

0x4 : Invalid NMR module. Module type does not match expected type.
2 - Pointer to NMR module.
3 - Expected type.
4 - Reserved.

0x5 : Invalid NMR module state. Current operation can not be performed on the state.
2 - Pointer to NMR module.
3 - Reserved.
4 - Reserved.

NETIO_INVALID_POOL_CALLER (0x126)

An invalid pool request has been made to netio managed memory pool (e.g. FSB and MDL).

PARAMETERS
1 - The subtype of the bugcheck.
VALUES:
0x1 : Invalid pool. Pool is at an invalid state.
2 - Pointer to memory block.
3 - Pointer to page.
4 - Pointer to CPU pool.

0x2 : Invalid MDL. MDL is at an invalid state.
2 - Pointer to MDL.
3 - Pointer to CPU pool.
4 - Pointer to pool header.

PAGE_NOT_ZERO (0x127)
This bugcheck indicates that a page that should have been filled with zero was not. Typically this is due to a hardware error or some privileged component modified a page after freeing it.
PARAMETERS
1 - virtual address mapping the corrupted page
2 - physical page number
3 - zero
4 - zero

WORKER_THREAD_RETURNED_WITH_BAD_IO_PRIORITY (0x128)
A worker threads IOPriority was wrongly modified by the called worker routine.
PARAMETERS
1 - address of worker routine (do ln on this to find guilty driver)
2 - Current IoPrioirity value
3 - workitem parameter
4 - workitem address

WORKER_THREAD_RETURNED_WITH_BAD_PAGING_IO_PRIORITY (0x129)
A worker threads Paging IOPriority was wrongly modified by the called worker routine.
PARAMETERS
1 - address of worker routine (do ln on this to find guilty driver)
2 - Current Paging IoPrioirity value
3 - workitem parameter
4 - workitem address

MUI_NO_VALID_SYSTEM_LANGUAGE (0x12a)
Windows did not find any installed, licensed language packs for the system default UI language.
PARAMETERS
1 - The subtype of the bugcheck.
VALUES:
0x1 : Windows did not find any installed language packs during
phase I initialization.
2 - NT status code that describes the reason of failure.

0x2 : Windows did not find any installed, licensed language packs
for the system default UI language during kernel cache creation.
2 - NT status code that describes the reason of failure.

FAULTY_HARDWARE_CORRUPTED_PAGE (0x12B)
This bugcheck indicates that a single bit error was found in this page. This is a hardware memory error.
PARAMETERS
1 - virtual address mapping the corrupted page
2 - physical page number
3 - zero
4 - zero

EXFAT_FILE_SYSTEM (0x12C)

If you see FppExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.

VOLSNAP_OVERLAPPED_TABLE_ACCESS (0x12D)

This bugcheck indicates that a volsnap tried to access a common table
from two different threads which may result in table corruption and
eventually corrupt the table.

INVALID_MDL_RANGE (0x12E)

A driver has called the IoBuildPartialMdl() function and passed it an MDL
to map part of a source MDL, but the virtual address range specified is
outside the range in the source MDL. This is a driver bug. The source
and target MDLs, as well as the address range length to be mapped are the
arguments to the IoBuildPartialMdl() function, i.e.;

IoBuildPartialMdl(
IN PMDL SourceMdl,
IN OUT PMDL TargetMdl,
IN PVOID VirtualAddress,
IN ULONG Length
)

VHD_BOOT_INITIALIZATION_FAILED (0x12F)

An initialization failure occurred while attempting to boot from a VHD.

PARAMETERS
1 - Action that failed
VALUES:
1 : Couldn't extract VHD information from boot device.
2 : Timeout waiting for VHD parent device to surface.
3 : VHD path string memory allocation error.
4 : VHD path construction failed.
5 : VHD boot device mount failed.
6 : Disable sleep states failed.
7 : VHD information memory allocation error.
8 : VHD information construction failed.
END_VALUES
2 - NT status code

DYNAMIC_ADD_PROCESSOR_MISMATCH (0x130)

This bugcheck indicates that a new processor added to the system is
incompatible with the current configuration.

INVALID_EXTENDED_PROCESSOR_STATE (0x131)

Invalid combination of parameters was detected while saving or restoring
extended processor state.

PARAMETERS
1 - Indicates which validity check failed.
VALUES:
0 : Invalid feature mask was passed or extended processor state is
not enabled.
2 - Nonzero if extended state is enabled.
3 - The low 32 bits of the feature mask.
4 - The high 32 bits of the feature mask.
1 : An attempt to save or restore extended extended state was made
at IRQL higher than DISPATCH_LEVEL.
2 - The IRQL.
2 : The previously saved state is for an equal or higher level.
2 - The saved level.
3 - The current level.
3 : The previously saved state is for a different thread.
2 - The saved thread.
3 - The current thread.
4 : Previously saved state is for a different level.
2 - The saved level.
3 - The current level.

END_VALUES

RESOURCE_OWNER_POINTER_INVALID (0x132)

An invalid resource owner pointer was supplied.

DPC_WATCHDOG_VIOLATION (0x133)

The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.

PARAMETERS
1 - Indicates the violation type.
VALUES:
0 : A single DPC or ISR exceeded its time allotment. The offending
component can usually be identified with a stack trace.
2 - The DPC time count (in ticks).
3 - The DPC time allotment (in ticks).
1 : The system cumulatively spent an extended period of time at
DISPATCH_LEVEL or above. The offending component can usually be
identified with a stack trace.
2 - The watchdog period.

END_VALUES

DRIVE_EXTENDER (0x134)

The drive extender component has experienced a severe internal error that
prevents continued system operation.

REGISTRY_FILTER_DRIVER_EXCEPTION (0x135)
This bugcheck is caused by an unhandled exception in a registry filtering driver.
PARAMETERS
1 - ExceptionCode
2 - Address of the context record for the exception that caused the bugcheck
3 - The driver's callback routine address
4 - Internal
DESCRIPTION
This bugcheck indicates that a registry filtering driver didn't handle exception inside
its notification routine. One can identify the driver by the 3rd parameter.

VHD_BOOT_HOST_VOLUME_NOT_ENOUGH_SPACE (0x136)

An initialization failure occurred while attempting to boot from a VHD.
The volume that hosts the VHD does not have enough free space to expand the VHD.

PARAMETERS
1 - Action that failed
VALUES:
0 : Unable to expand VHD file to full size.
END_VALUES
2 - NT status code

WIN32K_HANDLE_MANAGER (0x0137)
The win32k/ntuser handle manager has detected a fatal error.
PARAMETERS
1 - Type of failed operation.
VALUES:
0 : Attempt to free type 0 object
END_VALUES
2 - Address of the object

GPIO_CONTROLLER_DRIVER_ERROR (0x138)

This bugcheck happens when the GPIO class extension driver encounters a fatal error.

PARAMETERS
1 - Type of problem
VALUES:
0x1 : The GPIO controller managing the specific GSIV is not registered.
2 - GSIV.
0x2 : Client driver specified an invalid context to lock or unlock request.
2 - Context value.
0x3 : PoFx requested that the GPIO controller send a bank through an
inappropriate F1 power state and/or critical transition.
2 - Indicates if a critical transition is being requested.
3 - Indicates if the bank is already in F1 due to a
non-critical transition.
4 - Indicates if the bank is already in F1 due to a critical
transition.
0x4 : PoFx requested that the GPIO controller send a bank through an
inappropriate F0 power state and/or critical transition.
2 - Indicates if a critical transition is being requested.
3 - Indicates if the bank is in F1 due to a non-critical
critical transition.
4 - Indicates if the bank is in F1 due to a critical
transition.
0x5 : On-Soc GPIO interrupt operation failed.
2 - NTSTATUS.
3 - GPIO device extension.
4 - GPIO interrupt parameters.
0x6 : On-Soc GPIO IO operation failed.
2 - NTSTATUS.
3 - GPIO device extension.
4 - GPIO IO parameters.
0x7 : _DSM method returned malformed data.
2 - Revision ID.
3 - Function Index.
0x8 : The class extension and client driver disagree on which interrupts are enabled.
2 - Pointer to the class extension's representation of a bank.
3 - Upper 32 bits of the subset of the client driver's enabled mask that are unexpectedly set.
4 - Lower 32 bits of the subset of the client driver's enabled mask that are unexpectedly set.
0x9 : An enable or disable operation for an interrupt pin took too long.
2 - GPIO device extension.
3 - Stage that the operation is up to.
4 - GSIV if the stage is 1, or ACPI event method name if the stage is 0.
END_VALUES

KERNEL_SECURITY_CHECK_FAILURE (0x139)

A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.

PARAMETERS
1 - Type of memory safety violation
VALUES:
0 : A stack-based buffer has been overrun.
1 : VTGuard instrumentation code detected an attempt to use an
illegal virtual function table.
2 : Stack cookie instrumentation code detected a stack-based
buffer overrun.
3 : A LIST_ENTRY has been corrupted (i.e. double remove).
4 : The thread's stack pointer was outside the legal stack
extents for the thread.
5 : An invalid parameter was passed to a function that considers
invalid parameters fatal.
6 : The stack cookie security cookie was not properly initialized
by the loader.
7 : Fatal program exit requested.
8 : A compiler-inserted array bounds check detected an illegal
array indexing operation.
9 : A call to RtlQueryRegistryValues was made specifying
RTL_QUERY_REGISTRY_DIRECT without RTL_QUERY_REGISTRY_TYPECHECK,
and the target value is not in a trusted system hive.
10 : Indirect call guard check detected invalid control transfer.
11 : Write guard check detected invalid memory write.
12 : An attempt was made to switch to an invalid fiber context.
13 : An attempt was made to assign an invalid register context.
14 : The reference count for an object is invalid.
18 : An attempt was made to switch to an invalid jmp_buf context.
19 : An unsafe modification was made to read-only data.
20 : A cryptographic self-test failed.
21 : An invalid exception chain was detected.
22 : A cryptographic library error occurred.
23 : An invalid call was made from within DllMain.
24 : An invalid image base address was detected.
25 : An unrecoverable failure was encountered while protecting a delay load import.
26 : A call was made to an unsafe extension.
27 : A deprecated service was invoked.
28 : An out of bounds buffer access was detected.
29 : An RTL_BALANCED_NODE RBTree entry has been corrupted.

END_VALUES
2 - Address of the trap frame for the exception that caused the bugcheck
3 - Address of the exception record for the exception that caused the bugcheck
4 - Reserved

KERNEL_MODE_HEAP_CORRUPTION (0x13A)

The kernel mode heap manager has detected corruption in a heap.

PARAMETERS
1 - Type of corruption detected
VALUES:
0x3 : A corrupt entry header was detected.
0x4 : Multiple corrupt entry headers were detected.
0x5 : A corrupt entry header in a large allocation was detected.
0x6 : A corruption was detected with features consistent with a buffer overrun.
0x7 : A corruption was detected with features consistent with a buffer underrun.
0x8 : A free block was passed to an operation that is only valid for busy blocks.
0x9 : An invalid argument was specified for the current operation.
0xA : A corruption was detected with features consistent with a use-after-free error.
0xB : The wrong heap was specified for the current operation.
0xC : A corrupt free list was detected.
0xD : The heap detected list corruption in a list other than the free list.
END_VALUES
2 - Address of the heap that reported the corruption
3 - Address at which the corruption was detected

PASSIVE_INTERRUPT_ERROR (0x13B)

The kernel has detected issues with passive level interrupt.

PARAMETERS
1 - Type of error detected
VALUES
0x1 : A driver tried to acquire an interrupt spinlock but passed in a passive-level interrupt object.
END_VALUES
2 - Address of the KINTERRUPT object for the passive-level interrupt.

INVALID_IO_BOOST_STATE (0x13C)
A thread exited with an invalid I/O boost state. This should be zero when
a thread exits.

PARAMETERS
1 - Pointer to the thread which had the invalid boost state.
2 - Current boost state.

CRITICAL_INITIALIZATION_FAILURE (0x13D)

This bugcheck is generated when early kernel initialization has failed.

PARAMETERS
1 - Reserved
2 - Reserved
3 - Reserved
4 - Reserved

STORAGE_DEVICE_ABNORMALITY_DETECTED (0x140)

Storage driver stack encountered rate of responsiveness violations, exceeding the threshold or other failure to respond according to the specification

PARAMETERS
1 - Optional internal context dependent data.

DESCRIPTION
The storage stack detected device failure to respond as expected or rate of violations exceeded the threshold
(This code can never be used for a real bugcheck; it is used to identify live dumps including device telemetry.)

VIDEO_ENGINE_TIMEOUT_DETECTED (0x141)

DESCRIPTION
One of the the display engines failed to respond in timely fashion.
(This code can never be used for a real bugcheck.)

VIDEO_TDR_APPLICATION_BLOCKED (0x142)

DESCRIPTION
Application has been blocked from accessing Graphics hardware.
(This code can never be used for a real bugcheck.)

PROCESSOR_DRIVER_INTERNAL (0x143)

The Processor Power Management(PPM) driver encountered a fatal error.

PARAMETERS
1 -
VALUES:
1 : Power Engine Plugin(PEP) failed to accept a required notification
2 - PEP runtime Notification type
3 - Pointer to notification message
4 - Pointer to processor device context (FDO_DATA) issuing the notification
2 : Power Engine Plugin(PEP) returned invalid processor idle state
2 - Type of invalid state
VALUES:
0x0 : PEP requested too many processors for coordinated idle state
3 - Number of processors requested to participate in coordinated idle transitions
4 - Pointer to processor device context (FDO_DATA)

0x1 : PEP requested processor to be in an invalid idle state
3 - Idle state index requested
4 - Pointer to processor device context (FDO_DATA) corresponding to the invalid idle state

0x2 : PEP requested the platform to be in an invalid idle state
3 - Platform idle state index requested
4 - Pointer to processor device context (FDO_DATA) corresponding to the invalid idle state

END_VALUES

DESCRIPTION
The processor driver detected an irreconcilable condition which prompted it to
bugcheck. This likely happens during the processor idle and perf-state change
execution, which may involve other entities such has kernel, HAL and the Power
Engine Plugin(PEP). Information from bugcheck will help identify which of the
assumptions made by the processor driver in dealing with other entities was
violated. The root cause may lie in other entities and a dump file may reveal
more information to ascertain the reason for bugcheck.

BUGCODE_USB3_DRIVER (0x144)
PARAMETERS
1 - USB 3 Bugcheck Code
VALUES
1 : USB3_BUGCODE_CLIENT_USED_AN_ACTIVE_URB A client driver used
an URB that it had previously sent to the core USB stack
and core USB stack is still processing it.

2 - Irp (Optional), the Irp used to resend the Urb to the core
stack.
3 - Urb, The pointer to the Urb that has been re-used.
4 - Client's Device Object.

2 : USB3_BUGCODE_BOOT_DEVICE_FAILED A Boot Or Paging Device
failed re-enumeration.

2 - Pdo for the failed device.
3 - Type of failed device.
VALUES
1 : USB Storage Device.
2 : USB Hub.
3 : USB Controller.
END_VALUES
4 - 0.

3 : USB3_BUGCODE_CLIENT_CORRUPTED_URB A client driver sent a
corrupted URB to the core stack. This can happen because
of the following reasons:
* Client driver did not allocate the Urb using
USBD_xxxUrbAllocate Routines.
* Client driver did a buffer under-run for the Urb.

2 - Irp (Optional), the Irp used to send the Urb to the core stack.
3 - Urb, The pointer to the Urb that has been corrupted.
4 - Client's Device Object.

0x800 : USB3_VERIFIER_BUGCODE_OPEN_STATIC_STREAMS_WITH_IRQL_TOO_HIGH
Open Streams request should only be called at PASSIVE LEVEL.

2 - IRQL at which the open static streams request was sent.
3 - Pointer to the Open Static Streams Irp.
4 - Client's Device Object.

0x801 : USB3_VERIFIER_BUGCODE_OPEN_STATIC_STREAMS_WITHOUT_QUERYING_FOR_CAPABILITY
Before a client driver can send a open streams request,
it must query for streams capability. Only if the query is
successful the client driver can attempt to open static
streams.

2 - Irp, Pointer to the Open Static Streams Irp.
3 - Urb, The pointer to the Open Static Streams Urb.
4 - Client's Device Object.

0x802 : USB3_VERIFIER_BUGCODE_OPEN_STATIC_STREAMS_INVALID_STREAM_COUNT
A Client driver tried to open an invalid number of
static streams. The Number of Streams cannot be 0, and cannot
be greater than the value returned to the client driver in
the query Usb capability call.

2 - Number of Static Streams client driver tried to open.
3 - Number of static streams that were granted to the client driver.
4 - Urb, The pointer to the Open Static Streams Urb.

0x803 : USB3_VERIFIER_BUGCODE_STATIC_STREAMS_ALREADY_OPEN
A client driver cannot open static streams for an endpoint for
which static streams have already been opened. The client driver
must first close the previously opened static streams.

2 - Irp, Pointer to the Open Static Streams Irp.
3 - Urb, The pointer to the Open Static Streams Urb.
4 - Client's Device Object.

0x804 : USB3_VERIFIER_BUGCODE_CLIENT_LEAKED_USBD_HANDLE A client driver
forgot to close a handle it created earlier using
USBD_CreateHandle or forgot to free an urb it allocated.

2 - The Leaked Handle Context. Please run !usbanalyze -v to get
information about the leaked handle and urbs. You must turn
on Driver Verifier on the client driver to ensure
information about Leaked Urbs is presented.
3 - Device Object passed into the call USBD_CreateHandle.

0x805 : USB3_VERIFIER_BUGCODE_STATIC_STREAMS_CLOSE_IN_INVALID_DEVICE_STATE
A client driver sent a close static streams urb in an invalid
state like after processing D0 Exit.

2 - WDFREQUEST Handle for the close static streams urb.
3 - Urb, Pointer to the close static streams urb.
4 - Client's Device Object.

0x806 : USB3_VERIFIER_BUGCODE_CHAINED_MDL_WITHOUT_QUERYING_FOR_CAPABILITY
Before a client driver can send a Chained Mdl, it must query
for chained mdl capability. Only if the query is successful the
client driver can attempt to use chained Mdls.
2 - Irp, Pointer to the Irp.
3 - Urb, Pointer to the Urb.
4 - Client's Device Object.

0x807 : USB3_VERIFIER_BUGCODE_CLIENT_USED_CHAINED_MDL A client driver
has sent an URB to the core stack with TransferBufferLength
longer than the MmGetMdlByteCount of the MDL passed in. The
client driver must use USBD_QueryUsbCapability and use the
URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER_USING_CHAINED_MDL or
URB_FUNCTION_ISOCH_TRANSFER_USING_CHAINED_MDL to send a
chained MDL.

2 - Mdl, the chained MDL.
3 - Urb, The pointer to the Urb that used the changed MDL.
4 - Client's Device Object if available.

0x1001 : USB3_WER_BUGCODE_USBXHCI_HOST_SYSTEM_ERROR
The xHCI controller asserted the HSE bit, which indicates a
host system error.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1002 : USB3_WER_BUGCODE_USBXHCI_HOST_CONTROLLER_ERROR
The xHCI controller asserted the HCE bit, which indicates a
host controller error.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1003 : USB3_WER_BUGCODE_USBXHCI_ENDPOINT_ERROR_AFTER_STOP
The xHCI stop endpoint command returned an unhandled completion
code.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1004 : USB3_WER_BUGCODE_USBXHCI_CONTEXT_ERROR_AFTER_STOP
The xHCI endpoint state received a context state error after an
xHCI endpoint stop command was issued.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1005 : USB3_WER_BUGCODE_USBXHCI_CONTEXT_ERROR_AFTER_STALL_SET_DEQUEUE
Set dequeue pointer failed during an attempt to clear stall on
control endpoint.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1006 : USB3_WER_BUGCODE_USBXHCI_CONTEXT_ERROR_AFTER_STALL_RESET_EP
Reset EP failed during an attempt to clear stall on control
endpoint.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1007 : USB3_WER_BUGCODE_USBXHCI_RESET_RECOVERY_RESET_FAILED
The reset of the xHCI controller failed during reset recovery.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1008 : USB3_WER_BUGCODE_USBXHCI_RESET_RECOVERY_RESTART_FAILED
The restart of the xHCI controller failed during reset recovery.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1009 : USB3_WER_BUGCODE_USBXHCI_COMMAND_ABORT_FAILED
An xHCI controller command failed to complete after the command
timeout abort.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x100A : USB3_WER_BUGCODE_USBXHCI_CONTEXT_ERROR_AFTER_SET_DEQUEUE
Set dequeue pointer failed during an attempt to set the dequeue
pointer after endpoint stop completion.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x100B : USB3_WER_BUGCODE_USBXHCI_RESET_RECOVERY_STOP_FAILED
The stop of the xHCI controller failed during reset recovery.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x100C : USB3_WER_BUGCODE_USBXHCI_FIRMWARE_NOT_SUPPORTED
The firmware in the xHCI controller is not supported. The xHCI
driver will not load on this controller unless the firmware is
updated.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x100D : USB3_WER_BUGCODE_USBXHCI_CONTROLLER_GONE
The controller was detected to be physically removed.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x100E : USB3_WER_BUGCODE_USBXHCI_STREAM_ENDPOINT_ERROR
The driver detect an error on a stream enabled endpoint.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x100F : USB3_WER_BUGCODE_USBXHCI_FIRMWARE_OUTDATED
The firmware in the xHCI controller is outdated. The xHCI driver
will continue working with this controller but may run into some
issues. A firmware update is recommended.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1010 : USB3_WER_BUGCODE_USBXHCI_UNHANDLED_TRANSFER_EVENT_TRB_COMPLETION_CODE
A transfer event TRB completed with an unhandled completion code.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1011 : USB3_WER_BUGCODE_USBXHCI_EVENT_RING_FULL_ERROR
The controller reported that the event ring became full. The controller
is also known to drop events when this happens.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1012 : USB3_WER_BUGCODE_USBXHCI_OUT_OF_ORDER_COMMAND_COMPLETION
The controller completed a command out of order.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1013 : USB3_WER_BUGCODE_USBXHCI_DEQUEUEPOINTER_MISMATCH_AFTER_COMMAND_ABORT
After command abort completion, the command ring dequeue pointer reported
by the controller is incorrect.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1014 : USB3_WER_BUGCODE_USBXHCI_BAD_SLOTID
After enable slot completion, controller gave us a bad slot id.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1015 : USB3_WER_BUGCODE_USBXHCI_SET_ADDRESS_FAILED_BSR1
Controller failed a SetAddress command with BSR1. That is unexpected.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1016 : USB3_WER_BUGCODE_USBXHCI_ENABLE_SLOT_FAILED
Controller failed to enable a slot during a usbdevice reset. This is unexpected.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1017 : USB3_WER_BUGCODE_USBXHCI_OUT_OF_ORDER_COMMAND_COMPLETION
Controller failed an endpoints configure command where we were deconfiguring
the endpoints. That is unexpected.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1018 : USB3_WER_BUGCODE_USBXHCI_DISABLE_SLOT_FAILED
Controller failed a disable slot command. That is unexpected.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1019 : USB3_WER_BUGCODE_USBXHCI_USBDEVICE_RESET_FAILED
Controller failed a USB device reset command. That is unexpected.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x101a : USB3_WER_BUGCODE_USBXHCI_CONTEXT_ERROR_AFTER_RESET_SET_DEQUEUE
After endpoint reset, Set Dequeue Pointer command failed.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x101b : USB3_WER_BUGCODE_USBXHCI_ENDPOINT_ERROR_AFTER_RESET
The xHCI reset endpoint command returned an unhandled completion code.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x101c : USB3_WER_BUGCODE_USBXHCI_D0ENTRY_FAILED
The D0Entry for xHCI failed.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x101d : USB3_WER_BUGCODE_USBXHCI_ENDPOINTS_RECONFIGURE_FAILED_ON_CANCEL
Temporarily dropping and adding a stream endpoint (as 2 commands) failed, when
using the Configure Endpoint command instead of Set Dequeue Pointer
during request cancellation.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x101e : USB3_WER_BUGCODE_USBXHCI_INVALID_TRANSFER_EVENT_PTR_ED_1
The controller indicated a transfer completion that was not pending on
the controller. EventData == 1 (dereferencing the Transfer Event TRB's
pointer would have caused a bugcheck)
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x101f : USB3_WER_BUGCODE_USBXHCI_INVALID_TRANSFER_EVENT_PTR_ED_0
The controller indicated a transfer completion that was not pending
on the controller. EventData == 0 (logical address in transfer event TRB not matched)
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1020 : USB3_WER_BUGCODE_USBXHCI_INVALID_TRANSFER_EVENT_PTR_ED_0_DUPLICATE
The controller indicated a transfer completion that was not pending on the controller.
EventData == 0 (logical address in transfer event TRB not matched)
The Transfer Event TRB may be redundant (points somewhere near a recently completed request).
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1021 : USB3_WER_BUGCODE_USBXHCI_ENDPOINTS_RECONFIGURE_FAILED_ON_RESET
Temporarily dropping and adding a stream endpoint (as 2 commands) failed, when
using the Configure Endpoint command as part of resetting an endpoint that was
not Halted.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x1022 : USB3_WER_BUGCODE_USBXHCI_ENDPOINTS_RECONFIGURE_FAILED
Dropping and adding the same endpoint (as 1 command) failed.
2 - XHCI_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x3000 : USB3_WER_BUGCODE_USBHUB3_HUB_RESET_SUCCESSFUL
A misbehaving hub was successfully reset by the hub driver.
2 - USBHUB3_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x3001 : USB3_WER_BUGCODE_USBHUB3_HUB_RESET_UNSUCCESSFUL
A misbehaving hub failed to be reset successfully by the hub driver.
2 - USBHUB3_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x3002 : USB3_WER_BUGCODE_USBHUB3_SUPERSPEED_DISABLED
A non-function SuperSpeed hub was disabled by the hub driver.
2 - USBHUB3_LIVEDUMP_CONTEXT
3 - 0
4 - 0

0x3003 : USB3_WER_BUGCODE_USBHUB3_DEVICE_ENUMERATION_FAILURE
A USB device failed enumeration.
2 - USBHUB3_LIVEDUMP_CONTEXT
3 - 0
4 - 0

END_VALUES

DESCRIPTION
This bugcheck usually happens when the USB3 core stack detects an invalid
operation being performed by a USB client. This bugcheck may also occur
due to hardware failure on a USB Boot Device.

SECURE_BOOT_VIOLATION (0x145)

Secure Boot policy enforcement could not be started due to an invalid policy or
a required operation not being completed.

PARAMETERS
1 - The status code of the failure.
2 - Address of the Secure Boot policy.
3 - Size of the Secure Boot policy.
4 - Reserved

ABNORMAL_RESET_DETECTED (0x147)
Windows underwent an abnormal reset. No context or exception records were
saved, and bugcheck callbacks were not called.

IO_OBJECT_INVALID (0x148)
An object passed to an I/O routine was invalid.

PARAMETERS
1 - Code position indicator
VALUES:
0x00 : Attempt to initialize I/O worker item with invalid object.
2 - Address of worker item
3 - Address of invalid object
4 - Reserved

REFS_FILE_SYSTEM (0x149)

If you see RefsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.

KERNEL_WMI_INTERNAL (0x14A)

The internal kernel WMI subsystem has encountered a fatal error.

PARAMETERS
1 -
VALUES:
0 : A kernel WMI entry reference count was incremented from 0.
2 - Pointer to the kernel WMI entry.

1 : A kernel WMI datasource was removed prematurely.
2 - Pointer to the kernel WMI datasource.

2 : A kernel WMI entry reference count has invalid value for the current state.
2 - Pointer to the kernel WMI entry.

END_VALUES

SOC_SUBSYSTEM_FAILURE (0x14B)
A SOC subsystem has experienced an unrecoverable critical fault.

PARAMETERS
1 - nt!SOC_SUBSYSTEM_FAILURE_DETAILS
2 - Reserved
3 - Reserved
4 - (Optional) address to vendor supplied general purpose data block.

FATAL_ABNORMAL_RESET_ERROR (0x14C)
An unrecoverable system error occurred or the system has abnormally reset.

DESCRIPTION
The system encountered an unexpected error and restarted. Issues that may
cause this error include: hardware watchdog timer in application or auxiliary
processors indicating a system hang, user-initiated key sequence because of
a hang, a brownout, or failures in the default bugcheck path. The cache may
not be flushed and the resulting full memory dump may not contain the current
thread context.

EXCEPTION_SCOPE_INVALID (0x14D)

An internal inconsistency in exception dispatching has been detected.

PARAMETERS
1 - Reserved
2 - Reserved
3 - Reserved
4 - Reserved

SOC_CRITICAL_DEVICE_REMOVED (0x14E)
A critical SOC device has been unexpectedly removed or failed. This is an
unrecoverable error.

PARAMETERS
1 - Indicates the ID of the device which was removed (4 character packed code)
2 - Reserved
3 - Reserved
4 - Reserved

PDC_WATCHDOG_TIMEOUT (0x14F)
A system component failed to respond within the allocated time period,
preventing the system from exiting connected standby.

PARAMETERS
1 - Client ID of the hung component.
2 - Client type of the hung component.
VALUES:
0x1 : A notification client failed to respond.
3 - Pointer to the notification client (pdc!_PDC_NOTIFICATION_CLIENT).
4 - Pointer to a pdc!PDC_14F_TRIAGE structure.
0x2 : A resiliency client failed to respond.
3 - Pointer to the resiliency client (pdc!_PDC_RESILIENCY_CLIENT).
4 - Pointer to a pdc!PDC_14F_TRIAGE structure.
0x3 : An activator client held a reference for too long
3 - Pointer to the activation client (pdc!_PDC_ACTIVATOR_CLIENT).
4 - Pointer to a pdc!PDC_14F_TRIAGE structure.
0x100 : Win32k did not complete a monitor-on request in a timely manner.
3 - The most recent POWER_MONITOR_REQUEST_REASON value for this request.
4 - A value indicating the internal path taken to initiate the request.
END_VALUES

TCPIP_AOAC_NIC_ACTIVE_REFERENCE_LEAK (0x150)

UNSUPPORTED_INSTRUCTION_MODE (0x151)
An attempt was made to execute code using an unsupported processor
instruction mode (for example, executing classic ARM instructions
instead of ThumbV2 instructiosn). This is not permitted.

PARAMETERS
1 - Program counter when the problem was detected
2 - Trap Frame
3 - Reserved
4 - Reserved

INVALID_PUSH_LOCK_FLAGS (0x152)
The flags supplied to one of push lock APIs were invalid.

PARAMETERS
1 - The invalid flags supplied by the caller
2 - The address of the push lock
3 - Reserved
4 - Reserved

KERNEL_LOCK_ENTRY_LEAKED_ON_THREAD_TERMINATION (0x153)
A thread was terminated before it had freed all its AutoBoost lock entries.
This is typically caused when a thread never released a lock it previously
acquired (e.g. by relying on another thread to release it), or if the thread
did not supply a consistent set of flags to lock package APIs.

PARAMETERS
1 - The address of the thread
2 - The address of the entry that was not freed
3 - A status code indicating the state of the entry
VALUES:
0x1 : Lock pointer was not NULL
0x2 : Thread pointer reserved bits were set
0x3 : Thread pointer was corrupted
0x4 : The entry had residual IO or CPU boosts left
END_VALUES
4 - Reserved

UNEXPECTED_STORE_EXCEPTION (0x154)
The store component caught an unexpected exception.

PARAMETERS
1 - Pointer to the store context or data manager
2 - Exception information
3 - Reserved
4 - Reserved

OS_DATA_TAMPERING (0x155)

WINSOCK_DETECTED_HUNG_CLOSESOCKET_LIVEDUMP (0x156)
Winsock detected a hung transport endpoint close request.

PARAMETERS
1 - AFD endpoint pointer (!afdkd.endp )
2 - Transport endpoint type
VALUES:
1 : UDP datagram
2 : RAW datagram
3 : TCP listener
4 : TCP endpoint
END_VALUES
3 - Number of buffered send bytes for datagram endpoints
4 - afd!NETIO_SUPER_TRIAGE_BLOCK

DESCRIPTION
While processing a closesocket request, Winsock detected a hung transport
endpoint close request. The system generated a live dump for analysis, then
the closesocket request was completed without waiting for the completion of
hung transport endpoint close request.

KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION (0x157)
An illegal operation was attempted on the priority floor of a particular
thread.

PARAMETERS
1 - The address of the thread
2 - The target priority value
3 - A status code indicating the nature of the violation
VALUES:
0x1 : The priority counter for the target priority overflowed
0x2 : The priority counter for the target priority underflowed
0x3 : The target priority value was illegal
END_VALUES
4 - Reserved

ILLEGAL_IOMMU_PAGE_FAULT (0x158)
The IOMMU has delivered a page fault packet for an invalid ASID. This is not
safe since the ASID may have already been reused.

PARAMETERS
1 - The invalid ASID.
2 - The number of ASIDs currently in use.
3 - The process using this ASID.
4 - The ASID's reference count.

HAL_ILLEGAL_IOMMU_PAGE_FAULT (0x159)
The IOMMU has delivered a page fault against an ASID that was in the process of
being freed. The driver was responsible for completing any inflight requests
before this point in time and this bugcheck indicates a driver in the system
did not do so.

PARAMETERS
1 - IOMMU Vendor disambiguation.
2 - Pointer to fault packet.
3 - Vendor specific fault packet data.
4 - Vendor specific fault packet data.

SDBUS_INTERNAL_ERROR (0x15a)
An unrecoverable hardware failure has occured on an SD-attached device.

PARAMETERS
1 - Pointer to the internal SD work packet that caused the failure
2 - Pointer the controller socket information
3 - Pointer to the SD request packet sent down to the bus driver
4 - Reserved

WORKER_THREAD_RETURNED_WITH_SYSTEM_PAGE_PRIORITY_ACTIVE (0x15b)
A worker thread's system page priority was leaked by the called worker routine.
PARAMETERS
1 - Address of worker routine (do ln on this to find guilty driver)
2 - Current system page priority value
3 - WorkItem parameter
4 - WorkItem address

PDC_WATCHDOG_TIMEOUT_LIVEDUMP (0x15c)
PARAMETERS
1 - Client ID of the hung component.
2 - Client type of the hung component.
VALUES:
0x1 : A notification client failed to respond.
3 - Pointer to the notification client (pdc!_PDC_NOTIFICATION_CLIENT).
4 - Pointer to a pdc!PDC_14F_TRIAGE structure.
0x2 : A resiliency client failed to respond.
3 - Pointer to the resiliency client (pdc!_PDC_RESILIENCY_CLIENT).
4 - Pointer to a pdc!PDC_14F_TRIAGE structure.
0x3: An activator client held a reference for too long
3 - Pointer to the activation client (pdc!_PDC_ACTIVATOR_CLIENT).
4 - Pointer to a pdc!PDC_14F_TRIAGE structure.
END_VALUES

DESCRIPTION
A system component failed to respond within the allocated time period,
preventing the system from entering or exiting connected standby.
(This code can never be used for a real bugcheck; it is used to identify live dumps including device telemetry.)

SOC_SUBSYSTEM_FAILURE_LIVEDUMP (0x15d)

PARAMETERS
1 - nt!SOC_SUBSYSTEM_FAILURE_DETAILS
2 - Reserved
3 - Reserved
4 - (Optional) address to vendor supplied general purpose data block.

DESCRIPTION
An SOC subsystem has experienced a critical fault, and will attempt
to perform recovery steps.
(This code can never be used for a real bugcheck; it is used to identify live dumps including device telemetry.)

BUGCODE_NDIS_DRIVER_LIVE_DUMP (0x15e)
An NDIS driver has suffered a fatal error and NDIS has taken a
live kernel memory dump to collect diagnostic information.

PARAMETERS
1 - NDIS bugcheck subcode
VALUES:
1 : A miniport has encountered a fatal error and requested
re-enumeration.
2 - A pointer to Miniport block. !ndiskd.miniport on
this pointer for more info.
3 - A pointer to the Miniport's PDO
4 - The fatal error that caused this live dump to be taken
END_VALUES

DESCRIPTION
An NDIS driver has suffered a fatal error and NDIS has taken a
live kernel memory dump to collect diagnostic information.
(This code can never be used for a real bugcheck.)

CONNECTED_STANDBY_WATCHDOG_TIMEOUT_LIVEDUMP (0x15f)
Connected standby watchdog timeout

PARAMETERS
1 - CS watchdog subcode
VALUES:
1 : DRIPS watchdog timeout. The system has been in the resiliency phase
of connected standby with no activators active and no device
constraints unsatisfied for too long without entering DRIPS
(deepest runtime idle platform state).
2 - A pointer to additional information (nt!POP_DRIPS_WATCHDOG_METRICS).
3 - Non-DRIPS duration in milliseconds
4 - Reserved
2 : DRIPS watchdog device constraint timeout. The system has been in
the resiliency phase of connected standby for too long without
entering DRIPS (deepest runtime idle platform state) due to an
unsatisfied device constraint with no activators active.
2 - nt!TRIAGE_POP_FX_DEVICE Device
3 - Component index
4 - Reserved
END_VALUES

DESCRIPTION
This machine is exhibiting behavior that reduces screen-off battery life.
Typically this is caused by CPU activity, device activity, or devices being in
an insufficiently idle state.
(This code can never be used for a real bugcheck; it is used to identify live dumps including device telemetry.)

WIN32K_ATOMIC_CHECK_FAILURE (0x160)
A Win32k function has violated an ATOMICCHECK.

PARAMETERS
1 - Count of functions on the stack currently inside of an ATOMIC operation.
2 - Reserved.
3 - Reserved.
4 - Reserved.

LIVE_SYSTEM_DUMP (0x161)

The system administrator requested the collection of a live system memory dump.
(This code can never be used for a real bugcheck.)

KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE (0x162)
A lock tracked by AutoBoost was released by a thread that did not own the lock.
This is typically caused when some thread releases a lock on behalf of another
thread (which is not legal with AutoBoost tracking enabled) or when some thread
tries to release a lock it no longer owns.

PARAMETERS
1 - The address of the thread
2 - The lock address
3 - The session ID of the thread
4 - Reserved

WORKER_THREAD_TEST_CONDITION (0x163)
A test for kernel worker threads raised a failure.

PARAMETERS
1 - Active test flags.
2 - Flag corresponding to the test that triggered the failure.
3 - Reserved.
4 - Reserved.

WIN32K_CRITICAL_FAILURE (0x164)
Win32k has encountered a critical failure.

PARAMETERS
1 - Type of the failure.
VALUES:
0x1 : REGION_VALIDATION_FAILURE
Region is out of surface bounds.
2 - Pointer to DC
3 - Pointer to SURFACE
4 - Pointer to REGION
0x2 : OPERATOR_NEW_USED
Operator "new" is used to allocate memory.
2 - 0
3 - 0
4 - 0
END_VALUES

CLUSTER_CSV_STATUS_IO_TIMEOUT_LIVEDUMP (0x165)
SMB client on the non-coordinating node complains that an IO on coordinating node is taking too long and fails all IOs with STATUS_IO_TIMEOUT.
In response to that cluster service captures live dump on the coordinating node so we can analyze what IO is taking time.

PARAMETERS
1 - Optional cluster service PID.
2 - Cluster Node Id for the node that observed STATUS_IO_TIMEOUT.
3 - Reserved.
4 - Reserved.

DESCRIPTION
SMB client on the non-coordinating node complains that an IO on coordinating node is taking too long and fails all IOs with STATUS_IO_TIMEOUT.
In response to that cluster service captures live dump on the coordinating node so we can analyze what IO is taking time.
Additional information is available in the dump's secondary data streams.
(This code can never be used for a real bugcheck; it is used to identify live dumps including Cluster Shared Volume telemetry.)

CLUSTER_RESOURCE_CALL_TIMEOUT_LIVEDUMP (0x166)
A Cluster Resource call took longer than configured timeout.

PARAMETERS
1 - Resource Host Monitor PID.
2 - TID of the thread that handles resource call.
3 - Resource call type.
1 OPEN
2 CLOSE
3 ONLINE
4 OFFLINE
5 TERMINATE
6 ARBITRATE
7 RELEASE
8 RESOURCE CONTROL
9 RESOURCE TYPE CONTROL
10 LOOKS ALIVE
11 IS ALIVE
12 FAILURE NOTIFICATION
13 SHUTDOWN PROCESS
14 CANCEL
4 - Subcode.
When parameter 3 equals 8 then this parameter contains cluster resource control code.
When parameter 3 equals 9 then this parameter contains cluster resource type control code.

DESCRIPTION
A Cluster Resource call took longer than configured timeout. The system generated a live dump for analysis of the delay.
(This code can never be used for a real bugcheck.)

CLUSTER_CSV_SNAPSHOT_DEVICE_INFO_TIMEOUT_LIVEDUMP (0x167)
A Cluster Service call to the volsnap to query snapshot information took too long.

PARAMETERS
1 - Cluster Service PID.
2 - TID of the thread that handles volsnap query.
3 - 1 if we timeout out while CSV volume is active and 2 if we timeout out even after taking CSV volume down.
4 - Reserved.

DESCRIPTION:
A Cluster Service call to the volsnap to query snapshot information took too long.
(This code can never be used for a real bugcheck.)

CLUSTER_CSV_STATE_TRANSITION_TIMEOUT_LIVEDUMP (0x168)
A Cluster Shared Volume state transition took too long.

PARAMETERS
1 - Cluster Service PID.
2 - CSV target state Id.
0 Waiting for volume to transition to the Init state.
1 Waiting for volume to transition to the Paused state.
2 Waiting for volume to transition to the Draining state.
3 Waiting for volume to transition to the Set-Down-Level state.
4 Waiting for volume to transition to the Active state.
3 - Reserved.
4 - Reserved.

DESCRIPTION:
A Cluster Shared Volume state transition took too long. The system generated a live dump for analysis of the delay.
(This code can never be used for a real bugcheck.)

CLUSTER_CSV_VOLUME_ARRIVAL_LIVEDUMP (0x169)
The Cluster Shared Volume Manager was asked to create a new volume device object, and volume has not arrived in time.

PARAMETERS
1 - Cluster Service PID.
2 - Reserved.
3 - Reserved.
4 - Reserved.

DESCRIPTION
The Cluster Shared Volume Manager was asked to create a new volume device object, and volume has not arrived in time.
The system generated a live dump for analysis of the delay.
(This code can never be used for a real bugcheck.)

CLUSTER_CSV_VOLUME_REMOVAL_LIVEDUMP (0x16a)
A Cluster Shared Volume Manager volume removal request has timed out.

PARAMETERS
1 - Cluster Service PID.
2 - Reserved.
3 - Reserved.
4 - Reserved.

DESCRIPTION
A Cluster Shared Volume Manager volume removal request has timed out.
The system generated a live dump for analysis of the delay.
(This code can never be used for a real bugcheck.)

CLUSTER_CSV_CLUSTER_WATCHDOG_LIVEDUMP (0x16b)
The Cluster service user mode watchdog detected that a thread is not making forward progress for a long time.

PARAMETERS
1 - Cluster Service PID.
2 - Id of the thread that is stuck.
3 - Reserved.
4 - Reserved.

DESCRIPTION
The Cluster service user mode watchdog detected that a thread is not making forward progress for a long time.
(This code can never be used for a real bugcheck.)

INVALID_RUNDOWN_PROTECTION_FLAGS (0x16c)
The flags supplied to one of the rundown protection APIs were invalid.

PARAMETERS
1 - The invalid flags supplied by the caller.
2 - The address of the rundown ref.
3 - Reserved.
4 - Reserved.

INVALID_SLOT_ALLOCATOR_FLAGS (0x16d)
The flags supplied to one of the slot allocator APIs were invalid.

PARAMETERS
1 - The invalid flags supplied by the caller.
2 - Reserved.
3 - Reserved.
4 - Reserved.

ERESOURCE_INVALID_RELEASE (0x16e)
The target thread pointer supplied to ExReleaseResourceForThreadLite was invalid.
This bugcheck will hit if a call to ExSetOwnerPointerEx was skipped by the API
client (if a cross-thread release was intended) OR if the caller accidentally
passed in a value other that supplied by ExGetCurrentResourceThread.

PARAMETERS
1 - The resource being released.
2 - The current thread.
3 - The incorrect target thread that was passed in.
4 - Reserved.

CLUSTER_CSV_STATE_TRANSITION_INTERVAL_TIMEOUT_LIVEDUMP (0x16f)
A Cluster Shared Volume next state transition request has not arrived.

DESCRIPTION
A Cluster Shared Volume next state transition request has not arrived.
(This code can never be used for a real bugcheck.)

CRYPTO_LIBRARY_INTERNAL_ERROR (0x170)
An internal error in the crypto libraries.
This bugcheck will hit if the crypto libraries detect an anomaly
that should never occur but which might be the symptom of an
active attack, and the library has no safe method of signaling
the error to the caller.

PARAMETERS
1 - ID of failure.
2 - Reserved.
3 - Reserved.
4 - Reserved.

CLUSTER_CSV_CLUSSVC_DISCONNECT_WATCHDOG (0x171)
Cluster disconnect is not making forward progress.

PARAMETERS
1 - Id of the thread that is handling cluster disconnect.
2 - Timeout in milliseconds.
3 - Reserved.
4 - Reserved.

PREVIOUS_FATAL_ABNORMAL_RESET_ERROR (0x175)
An unrecoverable system error occurred or the system has abnormally reset on Windows phone devices.
The system generated a live dump to collect device crash data from the previous error.

DESCRIPTION
The system on Windows Phone devices encountered an unexpected error and
restarted. Issues that may cause this error include: hardware watchdog timer in
application or auxiliary processors indicating a system hang, user-initiated key
sequence because of a hang, etc.
(This code can never be used for a real bugcheck.)

ELAM_DRIVER_DETECTED_FATAL_ERROR (0x178)
ELAM driver detected a fatal error.

PARAMETERS
1 - Type of the failure.
VALUES:
0x0 : TPM attestation could not be revoked.
2 - Pointer to the BDCB_IMAGE_INFORMATION structure for the driver being inspected.
3 - TBS_RESULT failure code.

0x10000 : ELAM-vendor defined failure.
2 - (Optional) ELAM vendor supplied value.
3 - (Optional) ELAM vendor supplied value.

END_VALUES

2 - Reserved.
3 - Reserved.
4 - (Optional) ELAM vendor supplied general purpose data block.

WVR_LIVEDUMP_REPLICATION_IOCONTEXT_TIMEOUT (0x180)
A SR replication I/O context has not completed for a long time

PARAMETERS
1 - The address of SR replica member.
2 - The address of the I/O context.
3 - Reserved.
4 - The system time when the bugcheck is captured, it is used for correlating live dumps on remote replication partners if available.

WVR_LIVEDUMP_STATE_TRANSITION_TIMEOUT (0x181)
A SR state transition event has not completed for a long time

PARAMETERS
1 - The address of SR replica member.
2 - The address of state transition event.
3 - Reserved.
4 - The system time when the bugcheck is captured, it is used for correlating live dumps on remote replication partners if available.

WVR_LIVEDUMP_RECOVERY_IOCONTEXT_TIMEOUT (0x182)
A SR recovery I/O context has not been completed for a long time

WVR_LIVEDUMP_APP_IO_TIMEOUT (0x183)
An applicaton's Write Irp being replicated has not been completed for a long time

PARAMETERS
1 - The address of SR partition manager that the application's write Irp is queued to.
2 - The address of the application's write Irp.
3 - Reserved.
4 - The system time when the bugcheck is captured, it is used for correlating live dumps on remote replication partners if available.

WVR_LIVEDUMP_MANUALLY_INITIATED (0x184)
The bugcheck is requested by user manually via SR IOCTL

PARAMETERS
1 - Reserved.
2 - Reserved.
3 - Reserved.
4 - The system time when the bugcheck is initiated, it is used for correlating live dumps on remote replication partners if available.

WVR_LIVEDUMP_STATE_FAILURE (0x185)
The SR state machine is entering failure state due to fatal error

PARAMETERS
1 - The address of SR replica member.
2 - The NT status code for the error that caused failure state.
3 - The thread that encountered the error.
4 - Reserved.

WVR_LIVEDUMP_CRITICAL_ERROR (0x186)
SR has encountered a critical error

PARAMETERS
1 - The address of SR replica member if available.
2 - The NT status code for the critical error.
3 - Reserved.
4 - Reserved.

VIDEO_DWMINIT_TIMEOUT_FALLBACK_BDD (0x187)

PARAMETERS
1 - Reason Code.
1 DWM failed to initialize after retries, stopping display adapters and falling back to BDD.
2 - Reserved.
3 - Reserved.
4 - Reserved.

DESCRIPTION
Video fell back to BDD rather than using the IHV driver. This always generates a live dump.
(This code can never be used for a real bugcheck.)

CLUSTER_CSVFS_LIVEDUMP (0x188)
CSVFS initiated this livedump to help debuggign an inconsistent state. First parameter contains the reason code

PARAMETERS
1 - Reason Code.
1 Cache purge on oplock downgrade to none has failed.
2 Cache purge on oplock upgrade from none has failed.
3 Cache purge on set purge failure mode.
2 - Patameter1.
For Reason Code 1 this parameter contains an address of CSVFS!_SCB.
For Reason Code 2 this parameter contains an address of CSVFS!_SCB.
For Reason Code 3 this parameter contains an address of CSVFS!_SCB.
3 - Reserved.
4 - Reserved.

DESCRIPTION
When CSVFS detects that current state might cause data coruption or other sort of inconsistency it would
generate live dump with this status code. Parameter1 has code pointing to what scenario this live dump
is created for. Other parameters should be interpreted in context of the reason code.
(This code can never be used for a real bugcheck.)

BAD_OBJECT_HEADER (0x189)
The OBJECT_HEADER has been corrupted

PARAMETERS
1 - Pointer to bad OBJECT_HEADER
2 - Pointer to the resulting OBJECT_TYPE based on the TypeIndex in the OBJECT_HEADER

SECURE_KERNEL_ERROR (0x18B)

The secure kernel has encountered a fatal error.

WIN32K_CRITICAL_FAILURE_LIVEDUMP (0x190)
Win32k has encountered a critical failure.
Live dump is captured to collect the debug information.

PF_DETECTED_CORRUPTION (0x191)

PARAMETERS
1 - (reserved)

KERNEL_AUTO_BOOST_LOCK_ACQUISITION_WITH_RAISED_IRQL (0x192)
A lock tracked by AutoBoost was acquired while executing at DISPATCH_LEVEL or
above.

PARAMETERS
1 - The address of the thread.
2 - The lock address.
3 - The IRQL at which the lock was acquired.
4 - Reserved.

VIDEO_DXGKRNL_LIVEDUMP (0x193)

PARAMETERS
1 - Reason Code.
100 Internal
2 - Reserved.
3 - Reserved.
4 - Reserved.

DESCRIPTION
Livedumps triggered by dxgkrnl

DRIVER_VERIFIER_DETECTED_VIOLATION_LIVEDUMP (0x1C4)

A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
(This code can never be used for a real bugcheck;
it is used to identify live dumps including device/driver telemetry.)

PARAMETERS
1 - subclass of driver violation.
VALUES

END_VALUES

XBOX_360_SYSTEM_CRASH (0x360)

XBOX 360 system crash has occurred.

XBOX_360_SYSTEM_CRASH_RESERVED (0x420)

XBOX 360 reserved system crash code.

HYPERVISOR_ERROR (0x20001)

The hypervisor has encountered a fatal error.