Bug Check 0xC4: DRIVER_VERIFIER_DETECTED_VIOLATION

The DRIVER_VERIFIER_DETECTED_VIOLATION bug check has a value of 0x000000C4. This is the general bug check code for fatal errors found by Driver Verifier. For more information, see Handling a Bug Check When Driver Verifier is Enabled.

Important This topic is for programmers. If you are a customer who has received a blue screen error code while using your computer, see Troubleshoot blue screen errors.

DRIVER_VERIFIER_DETECTED_VIOLATION Parameters

Parameter 1 identifies the type of violation. The meaning of the remaining parameters varies with the value of Parameter 1. The parameter values are described in the following table.

Note If you have trouble viewing all 5 columns in this table, try the following:

  • Expand your browser window to full size.
  • Place the cursor in the table and use the arrow keys to scroll left and right.
  • Or use the MSDN Library version of this page.
Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x00 Current IRQL Pool type 0 The driver requested a zero-byte pool allocation.
0x01 Current IRQL Pool type Size of allocation, in bytes The driver attempted to allocate paged memory with IRQL > APC_LEVEL.
0x02 Current IRQL Pool type Size of allocation, in bytes The driver attempted to allocate nonpaged memory with IRQL > DISPATCH_LEVEL.
0x10 Bad Address 0 0 The driver attempted to free an address that was not returned from an allocate call.
0x11 Current IRQL Pool type Address of pool The driver attempted to free paged pool with IRQL > APC_LEVEL.
0x12 Current IRQL Pool type Address of pool The driver attempted to free nonpaged pool with IRQL > DISPATCH_LEVEL.
0x13 or 0x14 Reserved Pointer to pool header Pool header contents The driver attempted to free memory pool which was already freed.
0x16 Reserved Pool address 0 The driver attempted to free pool at a bad address, or the driver passed invalid parameters to a memory routine.
0x30 Current IRQL Requested IRQL 0 The driver passed an invalid parameter to KeRaiseIrql. (The parameter was either a value lower than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized parameter.)
0x31 Current IRQL Requested IRQL 0: New IRQL is bad 1: New IRQL is invalid inside a DPC routine The driver passed an invalid parameter to KeLowerIrql. (The parameter was either a value higher than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized parameter.)
0x32 Current IRQL Spin lock address 0 The driver called KeReleaseSpinLock at an IRQL other than DISPATCH_LEVEL. (This may be due to a double-release of a spin lock.)
0x33 Current IRQL Fast mutex address 0 The driver attempted to acquire fast mutex with IRQL > APC_LEVEL.
0x34 Current IRQL Fast mutex address 0 The driver attempted to release fast mutex at an IRQL other than APC_LEVEL.
0x35 Current IRQL Spin lock address Old IRQL The kernel released a spin lock with IRQL not equal to DISPATCH_LEVEL.
0x36 Current IRQL Spin lock number Old IRQL The kernel released a queued spin lock with IRQL not equal to DISPATCH_LEVEL.
0x37 Current IRQL Thread APC disable count Resource The driver tried to acquire a resource, but APCs are not disabled.
0x38 Current IRQL Thread APC disable count Resource The driver tried to release a resource, but APCs are not disabled.
0x39 Current IRQL Thread APC disable count Mutex The driver tried to acquire a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry.
0x3A Current IRQL Thread APC disable count Mutex The driver tried to release a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry.
0x3C Handle passed to routine Object type 0 The driver called ObReferenceObjectByHandle with a bad handle.
0x3D 0 0 Address of the bad resource The driver passed a bad (unaligned) resource to ExAcquireResourceExclusive.
0x3E 0 0 0 The driver called KeLeaveCriticalRegion for a thread that is not currently in a critical region.
0x3F Object address New object reference count. -1: dereference case 1: reference case 0 The driver applied ObReferenceObject to an object that has a reference count of zero, or the driver applied ObDereferenceObject to an object that has a reference count of zero.
0x40 Current IRQL Spin lock address 0 The driver called KeAcquireSpinLockAtDpcLevel with IRQL < DISPATCH_LEVEL.
0x41 Current IRQL Spin lock address 0 The driver called KeReleaseSpinLockFromDpcLevel with IRQL < DISPATCH_LEVEL.
0x42 Current IRQL Spin lock address 0 The driver called KeAcquireSpinLock with IRQL > DISPATCH_LEVEL.
0x51 Base address of allocation Address of the reference beyond the allocation Number of charged bytes The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x52 Base address of allocation Reserved Number of charged bytes The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x53, 0x54, or 0x59 Base address of allocation Reserved Reserved The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x60 Bytes allocated from paged pool Bytes allocated from nonpaged pool Total number of allocations that were not freed The driver is unloading without first freeing its pool allocations. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x61 Bytes allocated from paged pool Bytes allocated from nonpaged pool Total number of allocations that were not freed A driver thread is attempting to allocate pool memory while the driver is unloading. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x62 Name of the driver Reserved Total number of allocations that were not freed, including both paged and nonpaged pool The driver is unloading without first freeing its pool allocations. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x70 Current IRQL MDL address Access mode The driver called MmProbeAndLockPages with IRQL > DISPATCH_LEVEL.
0x71 Current IRQL MDL address Process address The driver called MmProbeAndLockProcessPages with IRQL > DISPATCH_LEVEL.
0x72 Current IRQL MDL address Process address The driver called MmProbeAndLockSelectedPages with IRQL > DISPATCH_LEVEL.
0x73 Current IRQL In 32-bit Windows: Low 32 bits of the physical address In 64-bit Windows: the 64-bit physical address Number of bytes The driver called MmMapIoSpace with IRQL > DISPATCH_LEVEL.
0x74 Current IRQL MDL address Access mode The driver called MmMapLockedPages in kernel mode with IRQL > DISPATCH_LEVEL.
0x75 Current IRQL MDL address Access mode The driver called MmMapLockedPages in user mode with IRQL > APC_LEVEL.
0x76 Current IRQL MDL address Access mode The driver called MmMapLockedPagesSpecifyCache in kernel mode with IRQL > DISPATCH_LEVEL.
0x77 Current IRQL MDL address Access mode The driver called MmMapLockedPagesSpecifyCache in user mode with IRQL > APC_LEVEL.
0x78 Current IRQL MDL address 0 The driver called MmUnlockPages with IRQL > DISPATCH_LEVEL.
0x79 Current IRQL Virtual address being unmapped MDL address The driver called MmUnmapLockedPages in kernel mode with IRQL > DISPATCH_LEVEL.
0x7A Current IRQL Virtual address being unmapped MDL address The driver called MmUnmapLockedPages in user mode with IRQL > APC_LEVEL.
0x7B Current IRQL Virtual address being unmapped Number of bytes The driver called MmUnmapIoSpace with IRQL > APC_LEVEL.
0x7C MDL address MDL flags 0 The driver called MmUnlockPages, and passed an MDL whose pages were never successfully locked.
0x7D MDL address MDL flags 0 The driver called MmUnlockPages, and passed an MDL whose pages are from nonpaged pool. (These should never be unlocked.)
0x7E Current IRQL DISPATCH_LEVEL 0 The driver called MmAllocatePagesForMdl, MmAllocatePagesForMdlEx, or MmFreePagesFromMdl with IRQL > DISPATCH_LEVEL.
0x7F Current IRQL MDL address MDL flags The driver called BuildMdlForNonPagedPool and passed an MDL whose pages are from paged pool.
0x80 Current IRQL Event address 0 The driver called KeSetEvent with IRQL > DISPATCH_LEVEL.
0x81 MDL address MDL flags 0 The driver called MmMapLockedPages. (You should use MmMapLockedPagesSpecifyCache instead, with the BugCheckOnFailure parameter set to FALSE.)
0x82 MDL address MDL flags 0 The driver called MmMapLockedPagesSpecifyCache with the BugCheckOnFailure parameter equal to TRUE. (This parameter should be set to FALSE.)
0x83 Start of physical address range to map Number of bytes to map First page frame number that isn't locked down The driver called MmMapIoSpace without having locked down the MDL pages. The physical pages represented by the physical address range being mapped must have been locked down prior to making this call.
0x85 MDL address Number of pages to map First page frame number that isn't locked down The driver called MmMapLockedPages without having locked down the MDL pages.
0x89 MDL address Pointer to the non-memory page in the MDL The non-memory page number in the MDL An MDL is not marked as "I/O", but it contains non-memory page addresses.
0x91 Reserved Reserved Reserved The driver switched stacks using a method that is not supported by the operating system. The only supported way to extend a kernel mode stack is by using KeExpandKernelStackAndCallout.
0xA0 (Windows Server 2003 and later operating systems only) Pointer to the IRP making the read or write request Device object of the lower device Number of the sector in which the error was detected A cyclic redundancy check (CRC) error was detected on a hard disk. A bug check with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0xA1 (Windows Server 2003 and later operating systems only) Copy of the IRP making the read or write request. (The actual IRP has been completed.) Device object of the lower device Number of the sector in which the error was detected A CRC error was detected on a sector (asynchronously). A bug check with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0xA2 (Windows Server 2003 and later operating systems only) IRP making the read or write request, or a copy of this IRP Device object of the lower device Number of the sector in which the error was detected The CRCDISK checksum copies don't match. This could be a paging error. A bug check with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0xB0 (Windows Vista and later operating systems only) MDL address MDL flags Incorrect MDL flags The driver called MmProbeAndLockPages for an MDL with incorrect flags. For example, the driver passed an MDL created by MmBuildMdlForNonPagedPool to MmProbeAndLockPages.
0xB1 (Windows Vista and later operating systems only) MDL address MDL flags Incorrect MDL flags The driver called MmProbeAndLockProcessPages for an MDL with incorrect flags. For example, the driver passed an MDL created by MmBuildMdlForNonPagedPool to MmProbeAndLockProcessPages.
0xB2 (Windows Vista and later operating systems only) MDL address MDL flags Incorrect MDL flags The driver called MmMapLockedPages for an MDL with incorrect flags. For example, the driver passed an MDL that is already mapped to a system address or that was not locked to MmMapLockedPages.
0xB3 (Windows Vista and later operating systems only) MDL address MDL flags Missing MDL flags (at least one was expected) The driver called MmMapLockedPages for an MDL with incorrect flags. For example, the driver passed an MDL that is not locked to MmMapLockedPages.
0xB4 (Windows Vista and later operating systems only) MDL address MDL flags Unexpected partial MDL flag The driver called MmUnlockPages for a partial MDL. A partial MDL is one that was created by IoBuildPartialMdl.
0xB8 (Windows Vista and later operating systems only) MDL address MDL flags Reserved The pages that are described by the MDL are still mapped. The driver must unmap the pages before calling IoFreeMdl.
0xC0 (Windows Vista and later operating systems only) Address of the IRP Reserved Reserved The driver called IoCallDriver with interrupts disabled.
0xC1 (Windows Vista and later operating systems only) Address of the driver dispatch routine Reserved Reserved A driver dispatch routine was returned with interrupts disabled.
0xC2 (Windows Vista and later operating systems only) Reserved Reserved Reserved The driver called a Fast I/O dispatch routine after interrupts were disabled.
0xC3 (Windows Vista and later operating systems only) Address of the driver Fast I/O dispatch routine Reserved Reserved A driver Fast I/O dispatch routine was returned with interrupts disabled.
0xC5 (Windows Vista and later operating systems only) Address of the driver dispatch routine The current thread's APC disable count The thread's APC disable count prior to calling the driver dispatch routine A driver dispatch routine has changed the thread's APC disable count. The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a mutex. The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem. Because these calls should always be in pairs, the APC disable count should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.
0xC6 (Windows Vista and later operating systems only) Address of the driver Fast I/O dispatch routine Current thread's APC disable count The thread's APC disable count prior to calling the Fast I/O driver dispatch routine A driver Fast I/O dispatch routine has changed the thread's APC disable count. The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a mutex. The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem. Because these calls should always be in pairs, the APC disable count should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.
0xCA (Windows Vista and later operating systems only) Address of the lookaside list Reserved Reserved The driver has attempted to re-initialize a lookaside list.
0xCB (Windows Vista and later operating systems only) Address of the lookaside list Reserved Reserved The driver has attempted to delete an uninitialized lookaside list.
0xCC (Windows Vista and later operating systems only) Address of the lookaside list Starting address of the pool allocation Size of the pool allocation The driver has attempted to free a pool allocation that contains an active lookaside list.
0xCD (Windows Vista and later operating systems only) Address of the lookaside list Block size specified by the caller Minimum supported block size The driver has attempted to create a lookaside list with an allocation block size that is too small.
0xD0 (Windows Vista and later operating systems only) Address of the ERESOURCE structure Reserved Reserved The driver has attempted to re-initialize an ERESOURCE structure.
0xD1 (Windows Vista and later operating systems only) Address of the ERESOURCE structure Reserved Reserved The driver has attempted to delete an uninitialized ERESOURCE structure.
0xD2 (Windows Vista and later operating systems only) Address of the ERESOURCE structure Starting address of the pool allocation Size of the pool allocation The driver has attempted to free a pool allocation that contains an active ERESOURCE structure.
0xD5 (Windows Vista and later operating systems only) Address of the IO_REMOVE_LOCK structure created by the checked build version of the driver Current IoReleaseRemoveLock tag Reserved The current IoReleaseRemoveLock tag does not match the previous IoAcquireRemoveLock tag. If the driver calling IoReleaseRemoveLock is not in a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A bug check with this parameter occurs only when the I/O Verification option of Driver Verifier is active.
0xD6 (Windows Vista and later operating systems only) Address of the IO_REMOVE_LOCK structure created by the checked build version of the driver Tag that does not match previous IoAcquireRemoveLock tag Previous IoAcquireRemoveLock tag The current IoReleaseRemoveLockAndWait tag does not match the previous IoAcquireRemoveLock tag. If the driver calling IoReleaseRemoveLock is not a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A bug check with this parameter occurs only when the I/O Verification option of Driver Verifier is active.
0xD7 (Windows 7 operating systems and later only) Address of the checked build Remove Lock structure that is used internally by Driver Verifier Address of the Remove Lock structure that is specified by the driver Reserved A Remove Lock cannot be re-initialized, even after it calls IoReleaseRemoveLockAndWait, because other threads might still be using that lock (by calling IoAcquireRemoveLock). The driver should allocate the Remove Lock inside its device extension, and initialize it a single time. The lock will be deleted together with the device extension.
0xDA (Windows Vista and later operating systems only) Starting address of the driver WMI callback address inside the driver Reserved An attempt was made to unload a driver that has not deregistered its WMI callback function.
0xDB (Windows Vista and later operating systems only) Address of the device object Reserved Reserved An attempt was made to delete a device object that was not deregistered from WMI.
0xDC (Windows Vista and later operating systems only) Reserved Reserved Reserved An invalid RegHandle value was specified as a parameter of the function EtwUnregister.
0xDD (Windows Vista and later operating systems only) Address of the call to EtwRegister Starting address of the unloading driver For Windows 8 and later versions, this parameter is the ETW RegHandle value. An attempt was made to unload a driver without calling EtwUnregister.
0xDF (Windows 7 operating systems and later only) Synchronization object address The synchronization object is in session address space. Synchronization objects are not allowed in session address space because they can be manipulated from another session or from system threads that have no session virtual address space.
0xE0 (Windows Vista and later operating systems only) User-mode address that is used as a parameter Size ,in bytes, of the address range that is used as a parameter Reserved A call was made to an operating system kernel function that specified a user-mode address as a parameter.
0xE1 (Windows Vista and later operating systems only) Address of the synchronization object Reserved Reserved A synchronization object was found to have an address that was either invalid or pageable.
0xE2 (Windows Vista and later operating systems only) Address of the IRP User-mode address present in the IRP Reserved An IRP with Irp->RequestorMode set to KernelMode was found to have a user-mode address as one of its members.
0xE3 (Windows Vista and later operating systems only) Address of the call to the API User-mode address used as a parameter in the API Reserved A driver has made a call to a kernel-mode ZwXxx routine with a user-mode address as a parameter.
0xE4 (Windows Vista and later operating systems only) Address of the call to the API Address of the malformed UNICODE_STRING structure Reserved A driver has made a call to a kernel-mode ZwXxx routine with a malformed UNICODE_STRING structure as a parameter.
0xE5 (Windows Vista and later operating systems only) Current IRQL Reserved Reserved A call was made to a Kernel API at the incorrect IRQL.
0xE6 (Windows Vista and later operating systems only) Address inside the driver making the Zw API call Current IRQL Special kernel APCs. Kernel Zw API was not called at IRQL = PASSIVE_LEVEL and with special kernel APCs enabled.
0xEA (Windows Vista and later operating systems only) Current IRQL The thread's APC disable count Address of the pushlock A driver has attempted to acquire a pushlock while APCs are enabled.
0xEB (Windows Vista and later operating systems only) Current IRQL The thread's APC disable count Address of the pushlock A driver has attempted to release a pushlock while APCs are enabled.
0xF0 (Windows Vista and later operating systems only) Address of the destination buffer Address of the source buffer Number of bytes to copy A driver called the memcpy function with overlapping source and destination buffers.
0xF5 (Windows Vista and later operating systems only) Address of the NULL handle Object type Reserved A driver passed a NULL handle to ObReferenceObjectByHandle.
0xF6 (Windows 7 operating systems and later) Handle value being referenced Address of the current process Address inside the driver that performs the incorrect reference A driver references a user-mode handle as kernel mode.
0xF7 (Windows 7 operating systems and later) Handle value specified by the caller Object type specified by the caller AccessMode specified by the caller A driver is attempting a user-mode reference for a kernel handle in the context of the system process.
0xFA (Windows 7 operating systems and later) Completion routine address. IRQL value before it calls the completion routine Current IRQL value, after it calls the completion routine The IRP completion routine returned at an IRQL that was different from the IRQL the routine was called at.
0xFB (Windows 7 operating systems and later) Completion routine address Current thread's APC disable count The thread's APC disable count before it calls the IRP completion routine The thread's APC disable count was changed by the driver's IRP completion routine. The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a mutex. The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem. Because these calls should always be in pairs, the APC disable count should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.
0x105 (Windows 7 operating systems and later) Address of the IRP The driver uses ExFreePool instead of IoFreeIrp to release the IRP.
0x10A (Windows 7 operating systems and later) The driver attempts to charge pool quota to the Idle process.
0x10B (Windows 7 operating systems and later) The driver attempts to charge pool quota from a DPC routine. This is incorrect because the current process context is undefined.
0x110 (Windows 7 operating systems and later) Address of the Interrupt Service Routine Address of the extended context that was saved before it executed the ISR Address of the extended context was saved after it executed the ISR The interrupt service routine (ISR) for the driver has corrupted the extended thread context.
0x111 (Windows 7 operating systems and later) Address of the Interrupt Service Routine IRQL before executing ISR IRQL after executing ISR The interrupt Service Routine returned a changed IRQL.
0x115 (Windows 7 operating systems and later) The address of the thread that is responsible for the shutdown, which might be deadlocked Driver Verifier detected that the system has taken longer than 20 minutes and shutdown is not complete.
0x11A (Windows 7 operating systems and later) Current IRQL The driver calls KeEnterCriticalRegion at IRQL > APC_LEVEL.
0x11B (Windows 7 operating systems and later) Current IRQL The driver calls KeLeaveCriticalRegion at IRQL > APC_LEVEL.
0x120 (Windows 7 operating systems and later) Address of the IRQL value Address of the Object to wait on Address of Timeout value The thread waits at IRQL > DISPATCH_LEVEL. Callers of KeWaitForSingleObject or KeWaitForMultipleObjects must run at IRQL <= DISPATCH_LEVEL.
0x121 (Windows 7 operating systems and later) Address of the IRQL value Address of the Object to wait on Address of Timeout value The thread waits at IRQL equals DISPATCH_LEVEL and the Timeout is NULL. Callers of KeWaitForSingleObject or KeWaitForMultipleObjects can run at IRQL <= DISPATCH_LEVEL. If a NULL pointer is supplied for Timeout, the calling thread remains in a wait state until the Object is signaled.
0x122 (Windows 7 operating systems and later) Address of the IRQL value Address of the Object to wait on Address of the Timeout value The thread waits at DISPATCH_LEVEL and Timeout value is not equal to zero (0). If the Timeout != 0, the callers of KeWaitForSingleObject or KeWaitForMultipleObjects must run at IRQL <= APC_LEVEL.
0x123 (Windows 7 operating systems and later) Address of the Object to wait on The caller of KeWaitForSingleObject or KeWaitForMultipleObjects specified the wait as UserMode, but the Object is on the kernel stack.
0x130 (Windows 7 operating systems and later) Address of work item The work item is in session address space. Work items are not allowed in session address space because they can be manipulated from another session or from system threads that have no session virtual address space.
0x131 (Windows 7 operating systems and later) Address of work item The work item is in pageable memory. Work items have to be in nonpageable memory because the kernel uses them at DISPATCH_LEVEL.
0x135 Address of IRP Number of milliseconds allowed between the IoCancelIrp call and the completion for this IRP The canceled IRP did not completed in the expected time The driver took longer than expected to complete the canceled IRP.
0x13A Address of the pool block being freed Incorrect value Address of the incorrect value The driver has called ExFreePool and Driver Verifier detects an error in one of the internal values that is used to track pool usage.
0x13B Address of the pool block being freed Address of the incorrect value Address of a pointer to the incorrect memory page The driver has called ExFreePool and Driver Verifier detects an error in one of the internal values that is used to track pool usage.
0x13C Address of the pool block being freed Incorrect value Address of the incorrect value The driver has called ExFreePool and Driver Verifier detects an error in one of the internal values that is used to track pool usage.
0x13D Address of the pool block being freed Address of the incorrect value Correct value that was expected The driver has called ExFreePool and Driver Verifier detects an error in one of the internal values that is used to track pool usage.
0x13E Pool block address specified by the caller Pool block address tracked by Driver Verifier Pointer to the pool block address that is tracked by Driver Verifier The pool block address specified by the caller of ExFreePool is different from the address tracked by Driver Verifier.
0x13F Address of the pool block being freed Number of bytes being freed Pointer to the number of bytes tracked by Driver Verifier The number of bytes of memory being freed in the call to ExFreePool is different from the number of bytes tracked by Driver Verifier.
0x140 Current IRQL MDL address Associated virtual address with this MDL A non-locked MDL was constructed from either pageable or tradable memory.
0x1000 (Windows XP and later operating systems only) Address of the resource Reserved Reserved Self-deadlock: The current thread has tried to recursively acquire a resource. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1001 (Windows XP and later operating systems only) Address of the resource that was the final cause of the deadlock Reserved Reserved Deadlock: A lock hierarchy violation has been found. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active. (Use the !deadlock extension for further information.)
0x1002 (Windows XP and later operating systems only) Address of the resource Reserved Reserved Uninitialized resource: A resource has been acquired without having been initialized first. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1003 (Windows XP and later operating systems only) Address of the resource that is being released deadlocked Address of the resource that should have been released first Reserved Unexpected release: A resource has been released in an incorrect order. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1004 (Windows XP and later operating systems only) Address of the resource Address of the thread that acquired the resource Address of the current thread Unexpected thread: The wrong thread releases a resource. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1005 (Windows XP and later operating systems only) Address of the resource Reserved Reserved Multiple initialization: A resource is initialized more than one time. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1007 (Windows XP and later operating systems only) Address of the resource Reserved Reserved Unacquired resource: A resource is released before it has been acquired. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1008 (Windows 7 operating systems and later) Lock address Driver Verifier internal data Driver Verifier internal data The driver tried to acquire a lock by using an API that is mismatched for this lock type.
0x1009 (Windows 7 operating systems and later) Lock address Driver Verifier internal data Driver Verifier internal data The driver tried to release a lock by using an API that is mismatched for this lock type.
0x100A (Windows 7 operating systems and later) Owner thread address Driver Verifier internal data The terminated thread owns the lock.
0x100B (Windows 7 operating systems and later) Lock address Owner thread address Driver Verifier internal address The deleted lock is still owned by a thread.
0xA001 (Windows 8.1 operating systems and later) A pointer to the NetBufferList object A pointer to the virtual switch object (if NON-NULL) Reserved (unused) VM Switch: The SourceHandle for the caller-supplied NetBufferList must be set. See the AllocateNetBufferListForwardingContext routine.
0xA002 (Windows 8.1 operating systems and later) A pointer to the NetBufferList object A pointer to the virtual switch object (if NON-NULL). Reserved (unused) VM Switch: The caller supplied NetBufferList's forwarding detail is not zero. See the AllocateNetBufferListForwardingContext routine.
0xA003 (Windows 8.1 operating systems and later) A pointer to the NetBufferList object A pointer to the virtual switch object (if NON-NULL). Reserved (unused) VM Switch: The caller supplied a NetBufferList with packet header or routing context that is NULL. See Packet Management Guidelines for the Extensible Switch Data Path.
0xA004 (Windows 8.1 operating systems and later) ID of invalid port NIC Index A pointer to the virtual switch object (if NON-NULL). VM Switch: The caller specified an invalid Port and NIC index combination. See Hyper-V Extensible Switch Port and Network Adapter States.
0xA005 (Windows 8.1 operating systems and later) A pointer to the NetBufferList object A pointer to the Destination list. A pointer to the virtual switch object (if NON-NULL). VM Switch: The caller supplied an invalid destination. See AddNetBufferListDestination and UpdateNetBufferListDestinations.
0xA006 (Windows 8.1 operating systems and later) A pointer to the NetBufferList object A pointer to the virtual switch object (if NON-NULL). Reserved (unused) VM Switch: The caller supplied an invalid source NIC or Port object. See Hyper-V Extensible Switch Port and Network Adapter States.
0xA007 (Windows 8.1 operating systems and later) A pointer to the NetBufferList object A pointer to the virtual switch object (if NON-NULL). Reserved (unused) VM Switch: The caller supplied an invalid destination list. See AddNetBufferListDestination and UpdateNetBufferListDestinations.
0xA008 (Windows 8.1 operating systems and later) Parent NIC object NIC index A pointer to the virtual switch object (if NON-NULL). VM Switch: Attempting to reference a NIC when not allowed. See Hyper-V Extensible Switch Port and Network Adapter States.
0xA009 (Windows 8.1 operating systems and later) Port being referenced A pointer to the virtual switch object (if NON-NULL) Reserved (unused) VM Switch: Attempt to reference a port when not allowed. See Hyper-V Extensible Switch Port and Network Adapter States.
0xA00A (Windows 8.1 operating systems and later) A pointer to the NetBufferList object ContextTypeInfo object Reserved (unused) VM Switch: Failure context is already set. See SetNetBufferListSwitchContext.
0xA00B (Windows 8.1 operating systems and later) A pointer to the NetBufferList object NDIS_SWITCH_REPORT_FILTERED_NBL_FLAGS_* A pointer to the virtual switch object (if NON-NULL) VM Switch: Invalid direction provided for dropped NetBufferList. See ReportFilteredNetBufferLists.
0xA00C (Windows 8.1 operating systems and later) A pointer to the NetBufferList object Send Flags value A pointer to the virtual switch object (if NON-NULL) VM Switch: NetBufferList chain has multiple source ports when NDIS_SEND_FLAGS_SWITCH_SINGLE_SOURCE flag is set. See Hyper-V Extensible Switch Send and Receive Flags.
0xA00D (Windows 8.1 operating systems and later) A pointer to the NetBufferList object A pointer to the virtual switch context A pointer to the virtual switch object (if NON-NULL) VM Switch: One or more NetBufferLists in chain have invalid destination when NDIS_RECEIVE_FLAGS_SWITCH_DESTINATION_GROUP flag is set. See Hyper-V Extensible Switch Send and Receive Flags.
0x2000 (Windows 7 operating systems and later) The first argument passed to the StorPortInitialize routine. This parameter is a pointer to the driver object that the operating system passed to the miniport driver in the first argument of the miniport driver's DriverEntry routine. The second argument passed to the StorPortInitialize routine. This parameter is a pointer to context information that the operating system passed to the miniport driver in the second argument of the miniport driver's DriverEntry routine. Reserved The Storport miniport driver passed a bad argument (a NULL pointer) to the StorPortInitialize routine.
0x00020002 (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlApcLte. The rule specifies that the driver must call ObGetObjectSecurity and ObReleaseObjectSecurity only when IRQL <= APC_LEVEL.
0x00020003 (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlDispatch. The IrqlDispatch rule specifies that the driver must call certain routines only when IRQL = DISPATCH_LEVEL
0x00020004 (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlExAllocatePool. The IrqlExAllocatePool rule specifies that the driver calls ExAllocatePoolWithTag and ExAllocatePoolWithTagPriority only when at IRQL<=DISPATCH_LEVEL.
0x00020005 (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlExApcLte1. The IrqlExApcLte1 rule specifies that the driver calls ExAcquireFastMutex and ExTryToAcquireFastMutex only at IRQL <= APC_LEVEL.
0x00020006 (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlExApcLte2. The IrqlExApcLte2 rule specifies that the driver calls certain routines only when IRQL <= APC_LEVEL.
0x00020007 (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlExApcLte3. The IrqlExApcLte3 rule specifies that the driver must call certain executive support routines only when IRQL <= APC_LEVEL.
0x00020008 (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlExPassive. The IrqlExPassive rule specifies that the driver must call certain executive support routines only when IRQL = PASSIVE_LEVEL.
0x00020009 (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlIoApcLte. The IrqlIoApcLte rule specifies that the driver must call certain I/O manager routines only when IRQL <= APC_LEVEL.
0x0002000A (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlIoPassive1. The IrqlIoPassive1 rule specifies that the driver must call certain I/O manager routines only when IRQL = PASSIVE_LEVEL.
0x0002000B (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlIoPassive2. The IrqlIoPassive2 rule specifies that the driver must call certain I/O manager routines only when IRQL = PASSIVE_LEVEL.
0x0002000C (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlIoPassive3. The IrqlIoPassive3 rule specifies that the driver must call certain I/O manager routines only when IRQL = PASSIVE_LEVEL.
0x0002000D (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlIoPassive4. The IrqlIoPassive4 rule specifies that the driver must call certain I/O manager routines only when IRQL = PASSIVE_LEVEL.
0x0002000E (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlIoPassive5. The IrqlIoPassive5 rule specifies that the driver must call certain I/O manager routines only when IRQL = PASSIVE_LEVEL.
0x0002000F (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlKeApcLte1. The IrqlKeApcLte1 rule specifies that the driver must call certain kernel routines only when IRQL <= APC_LEVEL.
0x00020010 (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlKeApcLte2. The IrqlKeApcLte2 rule specifies that the driver must call certain kernel routines only when IRQL <= APC_LEVEL.
0x00020011 (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlKeDispatchLte. The IrqlKeDispatchLte rule specifies that the driver must call certain kernel routines only when IRQL <= DISPATCH_LEVEL.
0x00020015 (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlKeReleaseSpinLock. The IrqlKeReleaseSpinLock rule specifies that the driver must call KeReleaseSpinLock only when IRQL = DISPATCH_LEVEL.
0x00020016 (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlKeSetEvent. The IrqlKeSetEvent rule specifies that the KeSetEvent routine is only called at IRQL <= DISPATCH_LEVEL when Wait is set to FALSE, and at IRQL <= APC_LEVEL when Wait is set to TRUE.
0x00020019 (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlMmApcLte. The IrqlMmApcLte rule specifies that the driver must call certain memory manager routines only when IRQL <= APC_LEVEL.
0x0002001A (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlMmDispatch. The IrqlMmDispatch rule specifies that the driver must call MmFreeContiguousMemory only when IRQL = DISPATCH_LEVEL.
0x0002001B (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlObPassive. The IrqlObPassive rule specifies that the driver must call ObReferenceObjectByHandle only when IRQL = PASSIVE_LEVEL.
0x0002001C (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlPsPassive. The IrqlPsPassive rule specifies that the driver must call certain process and thread manager routines only when IRQL = PASSIVE_LEVEL.
0x0002001D (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the DDI compliance rule IrqlReturn.
0x0002001E (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlRtlPassive. The IrqlRtlPassive rule specifies that the driver must call RtlDeleteRegistryValue only when IRQL = PASSIVE_LEVEL.
0x0002001F (Windows 8 operating systems and later) Pointer to the string that describes the violated rule condition. Optional pointer to the rule state variable(s). Reserved The driver violated the DDI compliance rule IrqlZwPassive. The IrqlZwPassive rule specifies that the driver must call ZwClose only when IRQL = PASSIVE_LEVEL.
0x00020022 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Reserved (unused) Reserved (unused) The driver violated the DDI compliance rule IrqlIoDispatch.
0x00040003 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the DDI compliance rule CriticalRegions.
0x00040006 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the DDI compliance rule QueuedSpinLock.
0x00040007 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the DDI compliance rule QueuedSpinLockRelease.
0x00040009 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the DDI compliance rule SpinLock.
0x0004000B (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the DDI compliance rule SpinlockRelease.
0x0004000E (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the DDI compliance rule GuardedRegions.
0x0004100B (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Reserved Reserved The driver violated the DDI compliance rule RequestedPowerIrp.
0x0004100F (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the DDI compliance rule IoSetCompletionExCompleteIrp.
0x00043006 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Reserved Reserved The driver violated the DDI compliance rule PnpRemove.
0x00091001 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the DDI compliance rule NdisOidComplete.
0x00091002 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the DDI compliance rule NdisOidDoubleComplete.
0x0009100E (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the DDI compliance rule NdisOidDoubleRequest.
0x00092003 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the NDIS/WIFI verification rule NdisTimedOidComplete.
0x0009200D (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the NDIS/WIFI verification rule NdisTimedDataSend.
0x0009200F (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the NDIS/WIFI verification rule NdisTimedDataHang.
0x00093004 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the NDIS/WIFI verification rule WlanAssociation.
0x00093005 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the NDIS/WIFI verification rule WlanConnectionRoaming.
0x00093006 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the NDIS/WIFI verification rule WlanDisassociation.
0x00094007 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the NDIS/WIFI verification rule WlanTimedAssociation.
0x00094008 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the NDIS/WIFI verification rule WlanTimedConnectionRoaming.
0x00094009 (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the NDIS/WIFI verification rule WlanTimedConnectRequest.
0x0009400B (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the NDIS/WIFI verification rule WlanTimedLinkQuality.
0x0009400C (Windows 8.1 operating systems and later) Pointer to the string that describes the violated rule condition. Address of internal rule state (second argument to !ruleinfo). Address of supplemental states (third argument to !ruleinfo). The driver violated the NDIS/WIFI verification rule WlanTimedScan.

Cause

See the description of each code in the Parameters section for a description of the cause. Further information can be obtained by using the !analyze -v extension.

Resolution

This bug check can only occur when Driver Verifier has been instructed to monitor one or more drivers. If you did not intend to use Driver Verifier, you should deactivate it. You might also consider removing the driver that caused this problem.

If you are the driver writer, use the information obtained through this bug check to fix the bugs in your code.

For full details on Driver Verifier, see the Driver Verifier section of the Windows Driver Kit (WDK).

Remarks

The _POOL_TYPE codes are enumerated in Ntddk.h. In particular, 0 (zero) indicates nonpaged pool and 1 (one) indicates paged pool.

(Windows 8 and later versions of Windows) If DDI compliance checking causes a bug check, run Static Driver Verifier on the driver source code and specify the DDI compliance rule (identified by the parameter 1 value) that caused the bug check. Static Driver Verifier can help you locate the cause of the problem in your source code.

See also

Handling a Bug Check When Driver Verifier is Enabled