Episode

Bugcheck 0xD1 DRIVER_IRQL_NOT_LESS_OR_EQUAL

The DRIVER_IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x000000D1. This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

At the higher IRQL (levels), the kernel blocks attempts to perform the I/O operation, causing the request to fail, and subsequently a failure to access the memory.

The Interrupt Request Level (IRQL) is the priority ranking of an interrupt. Each processor has an IRQL setting that threads can raise or lower. Interrupts that occur at or below the processor's IRQL setting are masked and will not interfere with the current operation. Interrupts that occur above the processor's IRQL setting take precedence over the current operation.

There are two common forms:

1) The address is valid: The driver is incorrectly designed.

2) The address is invalid: Memory Corruption has caused the issue.

For 1), determine the driver at fault by using "k" or "!analyze -v" in the Debugging Tools for Windows. Once identified, try updating or rolling back the driver. Depending on the vendor, the driver is obtained from Windows Update or the OEM web site.

For 2), enable Driver Verifier on the blamed driver (and optionally all 3rd party drivers). The verified drivers will be bounds checked, and the machine will Bugcheck on the cause (rather than the effect). If the issue reproduces, the Driver Verifier based Bugcheck will indicate the driver. If the issue does not reproduce, disable Driver Verifier (to remove the performance overhead).

Additional Resources: