DRIVER_VERIFIER_DETECTED_VIOLATION    |    Fix Error Code 0x000000C4    |    Repair Windows Error 0x000000C4


STOP 0x000000C4 : DRIVER_VERIFIER_DETECTED_VIOLATION

STOP Errors are usually the result of a hardware malfunction or device driver issue. It is also possible to receive a Blue Screen Error due to bad system memory, malfunctioning power supply, components overheating, or hardware overclocked beyond its specification. In older versions of the Windows OS you may also receive Blue Screen Errors due to incompatible DLL files.

Since the only option when receiving a Blue Screen Error is to reboot, any unsaved data is lost. With that in mind, it is very important to eliminate these errors to protect your data.

Basic Troubleshooting

Troubleshooting STOP Errors can be a difficult and time consuming process. Try these basic steps to fix your own Blue Scree Error. We hope it will help you avoid an expensive service call and provide a rewarding experience of solving the problem on your own.

Advanced Troubleshooting

The following details are for advanced users. These are provided for your convenience and may help those with advanced knowledge discover the root cause of their STOP Error.


Stop 0xC4: DRIVER_VERIFIER_DETECTED_VIOLATION

The DRIVER_VERIFIER_DETECTED_VIOLATION stop error code has a value of 0x000000C4. This is the general stop error code code for fatal errors found by Driver Verifier.

Parameters

Four stop error code parameters are displayed on the blue screen. Parameter 1 identifies the type of violation. The meaning of the remaining parameters varies with the value of Parameter 1. The parameter values are described in the following table.

Parameter 1Parameter 2Parameter 3Parameter 4Cause of Error
0x00Current IRQLPool type0 The driver requested a zero-byte pool allocation.
0x01Current IRQLPool typeSize of allocation, in bytesThe driver attempted to allocate paged memory with IRQL > APC_LEVEL.
0x02Current IRQLPool typeSize of allocation, in bytesThe driver attempted to allocate nonpaged memory with IRQL > DISPATCH_LEVEL.
0x03 (Windows Vista and later operating systems only)ReservedReservedReservedThe driver attempted to allocate multiple pages of must succeed pool, but at most one page can be allocated using this routine.
0x10Bad Address0 0 The driver attempted to free an address that was not returned from an allocate call.
0x11Current IRQLPool typeAddress of poolThe driver attempted to free paged pool with IRQL > APC_LEVEL.
0x12Current IRQLPool typeAddress of poolThe driver attempted to free nonpaged pool with IRQL > DISPATCH_LEVEL.
0x13
or
0x14
Reserved Pointer to pool headerPool header contentsThe driver attempted to free memory pool which was already freed.
0x15Timer entryPool type (-1 for special pool)Pool address being freedThe driver attempted to free pool which contains an active timer.
0x16ReservedPool address0 The driver attempted to free pool at a bad address, or the driver passed invalid parameters to a memory routine.
0x17Resource entryPool type (-1 for special pool)Pool address being freedThe driver attempted to free pool which contains an active ERESOURCE.
0x30Current IRQLRequested IRQL0 The driver passed an invalid parameter to KeRaiseIrql.

(The parameter was either a value lower than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized parameter.)

0x31Current IRQLRequested IRQL0: New IRQL is bad

1: New IRQL is invalid inside a DPC routine

The driver passed an invalid parameter to KeLowerIrql.

(The parameter was either a value higher than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized parameter.)

0x32Current IRQLSpin lock address0 The driver called KeReleaseSpinLock at an IRQL other than DISPATCH_LEVEL.

(This may be due to a double-release of a spin lock.)

0x33Current IRQLFast mutex address0 The driver attempted to acquire fast mutex with IRQL > APC_LEVEL.
0x34Current IRQLFast mutex address0 The driver attempted to release fast mutex at an IRQL other than APC_LEVEL.
0x35Current IRQLSpin lock addressOld IRQLThe kernel released a spin lock with IRQL not equal to DISPATCH_LEVEL.
0x36Current IRQLSpin lock numberOld IRQLThe kernel released a queued spin lock with IRQL not equal to DISPATCH_LEVEL.
0x37Current IRQLThread APC disable countResourceThe driver tried to acquire a resource, but APCs are not disabled.
0x38Current IRQLThread APC disable countResourceThe driver tried to release a resource, but APCs are not disabled.
0x39Current IRQLThread APC disable countMutexThe driver tried to acquire a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry.
0x3ACurrent IRQLThread APC disable countMutexThe driver tried to release a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry.
0x3BCurrent IRQLObject to wait forTime-out parameterThe driver called KeWaitXxx with IRQL >= DISPATCH_LEVEL.

(This is permitted only if the driver already owns the DISPATCHER lock and it passes a time-out value of zero to the routine.)

0x3CHandle passed to routineObject type0 The driver called ObReferenceObjectByHandle with a bad handle.
0x3D0 0 Address of the bad resource The driver passed a bad (unaligned) resource to ExAcquireResourceExclusive.
0x3E000The driver called KeLeaveCriticalRegion for a thread that is not currently in a critical region.
0x3FObject addressNew object reference count.

-1: dereference case

1: reference case

0The driver applied ObReferenceObject to an object that has a reference count of zero, or the driver applied ObDereferenceObject to an object that has a reference count of zero.
0x40Current IRQLSpin lock address0 The driver called KeAcquireSpinLockAtDpcLevel with IRQL < DISPATCH_LEVEL.
0x41Current IRQLSpin lock address0 The driver called KeReleaseSpinLockFromDpcLevel with IRQL < DISPATCH_LEVEL.
0x42Current IRQLSpin lock address0 The driver called KeAcquireSpinLock with IRQL > DISPATCH_LEVEL.
0x51Base address of allocationAddress of the reference beyond the allocationNumber of charged bytesThe driver attempted to free memory after having written past the end of the allocation. A stop error code with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x52Base address of allocationReservedNumber of charged bytesThe driver attempted to free memory after having written past the end of the allocation. A stop error code with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x53,
0x54,
or
0x59
Base address of allocationReserved Reserved The driver attempted to free memory after having written past the end of the allocation. A stop error code with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x60Bytes allocated from paged poolBytes allocated from nonpaged poolTotal number of allocations that were not freedThe driver is unloading without first freeing its pool allocations. A stop error code with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x61Bytes allocated from paged poolBytes allocated from nonpaged poolTotal number of allocations that were not freedA driver thread is attempting to allocate pool memory while the driver is unloading. A stop error code with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x62Name of the driverReserved Total number of allocations that were not freed, including both paged and nonpaged poolThe driver is unloading without first freeing its pool allocations. A stop error code with this parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x6FMDL addressPhysical page being lockedHighest physical page in the systemThe driver passed a page to MmProbeAndLockPages that was not in the PFN database.

(This often results from a driver that attempts to lock its own private dualport RAM. Such behavior can corrupt memory on machines with noncontiguous physical RAM.)

0x70Current IRQLMDL addressAccess modeThe driver called MmProbeAndLockPages with IRQL > DISPATCH_LEVEL.
0x71Current IRQLMDL addressProcess addressThe driver called MmProbeAndLockProcessPages with IRQL > DISPATCH_LEVEL.
0x72Current IRQLMDL addressProcess addressThe driver called MmProbeAndLockSelectedPages with IRQL > DISPATCH_LEVEL.
0x73Current IRQLIn 32-bit Windows: Low 32 bits of the physical address

In 64-bit Windows: the 64-bit physical address

Number of bytesThe driver called MmMapIoSpace with IRQL > DISPATCH_LEVEL.
0x74Current IRQLMDL addressAccess modeThe driver called MmMapLockedPages in kernel mode with IRQL > DISPATCH_LEVEL.
0x75Current IRQLMDL addressAccess modeThe driver called MmMapLockedPages in user mode with IRQL > APC_LEVEL.
0x76Current IRQLMDL addressAccess modeThe driver called MmMapLockedPagesSpecifyCache in kernel mode with IRQL > DISPATCH_LEVEL.
0x77Current IRQLMDL addressAccess modeThe driver called MmMapLockedPagesSpecifyCache in user mode with IRQL > APC_LEVEL.
0x78Current IRQLMDL address0 The driver called MmUnlockPages with IRQL > DISPATCH_LEVEL.
0x79Current IRQLVirtual address being unmappedMDL addressThe driver called MmUnmapLockedPages in kernel mode with IRQL > DISPATCH_LEVEL.
0x7ACurrent IRQLVirtual address being unmappedMDL addressThe driver called MmUnmapLockedPages in user mode with IRQL > APC_LEVEL.
0x7BCurrent IRQLVirtual address being unmappedNumber of bytesThe driver called MmUnmapIoSpace with IRQL > APC_LEVEL.
0x7CMDL addressMDL flags0 The driver called MmUnlockPages, and passed an MDL whose pages were never successfully locked.
0x7DMDL addressMDL flags0 The driver called MmUnlockPages, and passed an MDL whose pages are from nonpaged pool.

(These should never be unlocked.)

0x80Current IRQLEvent address0 The driver called KeSetEvent with IRQL > DISPATCH_LEVEL.
0x81MDL addressMDL flags0 The driver called MmMapLockedPages.

(You should use MmMapLockedPagesSpecifyCache instead, with the BugCheckOnFailure parameter set to FALSE.)

0x82MDL addressMDL flags0 The driver called MmMapLockedPagesSpecifyCache with the BugCheckOnFailure parameter equal to TRUE.

(This parameter should be set to FALSE.)

0x83Start of physical address range to mapNumber of bytes to mapFirst page frame number that isn't locked downThe driver called MmMapIoSpace without having locked down the MDL pages. The physical pages represented by the physical address range being mapped must have been locked down prior to making this call.
0x84Start of physical address range to mapNumber of bytes to mapFirst page frame number that is on the free listThe driver called MmMapIoSpace without having locked down the MDL pages (or after freeing the MDL pages).
0x85MDL addressNumber of pages to mapFirst page frame number that isn't locked downThe driver called MmMapLockedPages without having locked down the MDL pages.
0x86MDL addressNumber of pages to mapFirst page frame number that is on the free listThe driver called MmMapLockedPages without having locked down the MDL pages (or after freeing the MDL pages).
0x87Base physical page of the existing mapping

(Shift left for physical address)

Number of pages already mapped in the existing mappingMEMORY_CACHING_TYPE of the existing mappingThe driver called MmMapIoSpace, but the caller's cache type conflicts with an existing mapping.
0x88Base physical page of the requested mapping

(Shift left for physical address)

Number of pages in the requested mappingMEMORY_CACHING_TYPE of the requested mappingThe driver called MmMapIoSpace to map a physical range as non-cached or write-combined, but the caller's physical range already has an existing cached mapping.
0x89MDL addressPointer to the non-memory page in the MDLThe non-memory page number in the MDLAn MDL is not marked as "I/O", but it contains non-memory page addresses.
0x8AMDL addressBase physical page of the requested mapping

(Shift left for physical address)

MEMORY_CACHING_TYPE of the requested mappingThe driver called MmMapLockedPagesXxx to map a physical range as non-cached or write-combined, but the caller's physical range already has an existing cached mapping.
0x90 (Windows 2000, Windows XP, and Windows Server 2003 only)ReservedReservedReservedThe driver switched stacks, and the current stack is neither a thread stack nor a DPC stack.

(Typically, the driver doing this should be on the stack obtained by using the kb (Display Stack Backtrace) debugger command.)

0x91Reserved Reserved Reserved The driver switched stacks using a method that is not supported by the operating system. The only supported way to extend a kernel mode stack is by using KeExpandKernelStackAndCallout.
0xA0 (Windows Server 2003 and later operating systems only)Pointer to the IRP making the read or write requestDevice object of the lower deviceNumber of the sector in which the error was detectedA cyclic redundancy check (CRC) error was detected on a hard disk. A stop error code with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0xA1 (Windows Server 2003 and later operating systems only)Copy of the IRP making the read or write request. (The actual IRP has been completed.)Device object of the lower deviceNumber of the sector in which the error was detectedA CRC error was detected on a sector (asynchronously). A stop error code with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0xA2 (Windows Server 2003 and later operating systems only)IRP making the read or write request, or a copy of this IRPDevice object of the lower deviceNumber of the sector in which the error was detectedThe CRCDISK checksum copies don't match. This could be a paging error. A stop error code with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0xB0 (Windows Vista and later operating systems only)MDL addressMDL flagsIncorrect MDL flagsThe driver called MmProbeAndLockPages for an MDL with incorrect flags. For example, the driver passed an MDL created by MmBuildMdlForNonPagedPool to MmProbeAndLockPages.
0xB1 (Windows Vista and later operating systems only)MDL addressMDL flagsIncorrect MDL flagsThe driver called MmProbeAndLockProcessPages for an MDL with incorrect flags. For example, the driver passed an MDL created by MmBuildMdlForNonPagedPool to MmProbeAndLockProcessPages.
0xB2 (Windows Vista and later operating systems only)MDL addressMDL flagsIncorrect MDL flagsThe driver called MmMapLockedPages for an MDL with incorrect flags. For example, the driver passed an MDL that is already mapped to a system address or that was not locked to MmMapLockedPages.
0xB3 (Windows Vista and later operating systems only)MDL addressMDL flagsMissing MDL flags (at least one was expected)The driver called MmMapLockedPages for an MDL with incorrect flags. For example, the driver passed an MDL that is not locked to MmMapLockedPages.
0xB4 (Windows Vista and later operating systems only)MDL addressMDL flagsUnexpected partial MDL flagThe driver called MmUnlockPages for a partial MDL. A partial MDL is one that was created by IoBuildPartialMdl.
0xB5 (Windows Vista and later operating systems only)MDL addressMDL flagsUnexpected partial MDL flag The driver called MmUnmapLockedPages for a partial MDL. A partial MDL is one that was created by IoBuildPartialMdl.
0xB6 (Windows Vista and later operating systems only)MDL addressMDL flagsMissing MDL flag The driver called MmUnmapLockedPages for an MDL that is not mapped to a system address.
0xB7 (Windows Vista and later operating systems only)Number of corrupted physical pages Address of first corrupted physical pageAddress of last corrupted physical pageThe system BIOS has corrupted low physical memory during a sleep transition.
0xC0 (Windows Vista and later operating systems only)Address of the IRPReservedReservedThe driver called IoCallDriver with interrupts disabled.
0xC1 (Windows Vista and later operating systems only)Address of the driver dispatch routineReservedReservedA driver dispatch routine was returned with interrupts disabled.
0xC2 (Windows Vista and later operating systems only)ReservedReservedReservedThe driver called a Fast I/O dispatch routine after interrupts were disabled.
0xC3 (Windows Vista and later operating systems only)Address of the driver Fast I/O dispatch routineReservedReservedA driver Fast I/O dispatch routine was returned with interrupts disabled.
0xC5 (Windows Vista and later operating systems only)Address of the driver dispatch routineThe current thread’s APC disable countThe thread’s APC disable count prior to calling the driver dispatch routineA driver dispatch routine has changed the thread’s APC disable count.

The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a mutex.

The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem.

Because these calls should always be in pairs, the APC disable count should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.

0xC6 (Windows Vista and later operating systems only)Address of the driver Fast I/O dispatch routineCurrent thread’s APC disable countThe thread’s APC disable count prior to calling the Fast I/O driver dispatch routineA driver Fast I/O dispatch routine has changed the thread’s APC disable count.

The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a mutex.

The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem.

Because these calls should always be in pairs, the APC disable count should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.



0xCA (Windows Vista and later operating systems only)Address of the lookaside listReservedReservedThe driver has attempted to re-initialize a lookaside list.
0xCB (Windows Vista and later operating systems only)Address of the lookaside listReservedReservedThe driver has attempted to delete an uninitialized lookaside list.
0xCC (Windows Vista and later operating systems only)Address of the lookaside listStarting address of the pool allocationSize of the pool allocationThe driver has attempted to free a pool allocation that contains an active lookaside list.
0xCD (Windows Vista and later operating systems only)Address of the lookaside listBlock size specified by the callerMinimum supported block sizeThe driver has attempted to create a lookaside list with an allocation block size that is too small.
0xD0 (Windows Vista and later operating systems only)Address of the ERESOURCE structureReservedReservedThe driver has attempted to re-initialize an ERESOURCE structure.
0xD1 (Windows Vista and later operating systems only)Address of the ERESOURCE structureReservedReservedThe driver has attempted to delete an uninitialized ERESOURCE structure.
0xD2 (Windows Vista and later operating systems only)Address of the ERESOURCE structureStarting address of the pool allocationSize of the pool allocationThe driver has attempted to free a pool allocation that contains an active ERESOURCE structure.
0xD5 (Windows Vista and later operating systems only)Address of the IO_REMOVE_LOCK structure created by the checked build version of the driverCurrent IoReleaseRemoveLock tagReservedThe current IoReleaseRemoveLock tag does not match the previous IoAcquireRemoveLock tag. If the driver calling IoReleaseRemoveLock is not in a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A stop error code with this parameter occurs only when the I/O Verification option of Driver Verifier is active.
0xD6 (Windows Vista and later operating systems only)Address of the IO_REMOVE_LOCK structure created by the checked build version of the driverTag that does not match previous IoAcquireRemoveLock tagPrevious IoAcquireRemoveLock tagThe current IoReleaseRemoveLockAndWait tag does not match the previous IoAcquireRemoveLock tag. If the driver calling IoReleaseRemoveLock is not a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A stop error code with this parameter occurs only when the I/O Verification option of Driver Verifier is active.
0xD7 (Windows 7operating systems and later only)Address of the checked build Remove Lock structure that is used internally by Driver VerifierAddress of the Remove Lock structure that is specified by the driverReservedA Remove Lock cannot be re-initialized, even after it calls IoReleaseRemoveLockAndWait, because other threads might still be using that lock (by calling IoAcquireRemoveLock). The driver should allocate the Remove Lock inside its device extension, and initialize it a single time. The lock will be deleted together with the device extension.
0xDA (Windows Vista and later operating systems only)Starting address of the driverWMI callback address inside the driverReservedAn attempt was made to unload a driver that has not deregistered its WMI callback function.
0xDB (Windows Vista and later operating systems only)Address of the device objectReservedReservedAn attempt was made to delete a device object that was not deregistered from WMI.
0xDC (Windows Vista and later operating systems only)ReservedReservedReservedAn invalid RegHandle value was specified as a parameter of the function EtwUnregister.
0xDD (Windows Vista and later operating systems only)Address of the call to EtwRegisterStarting address of the unloading driverReservedAn attempt was made to unload a driver without calling EtwUnregister.
0xDF (Windows 7operating systems and later only)Synchronization object address The synchronization object is in session address space. Synchronization objects are not allowed in session address space because they can be manipulated from another session or from system threads that have no session virtual address space.
0xE0 (Windows Vista and later operating systems only)User-mode address that is used as a parameterSize ,in bytes, of the address range that is used as a parameterReservedA call was made to an operating system kernel function that specified a user-mode address as a parameter.
0xE1 (Windows Vista and later operating systems only)Address of the synchronization objectReservedReservedA synchronization object was found to have an address that was either invalid or pageable.
0xE2 (Windows Vista and later operating systems only)Address of the IRPUser-mode address present in the IRP ReservedAn IRP with Irp->RequestorMode set to KernelMode was found to have a user-mode address as one of its members.
0xE3 (Windows Vista and later operating systems only)Address of the call to the APIUser-mode address used as a parameter in the APIReservedA driver has made a call to a kernel-mode ZwXxx routine with a user-mode address as a parameter.
0xE4 (Windows Vista and later operating systems only)Address of the call to the APIAddress of the malformed UNICODE_STRING structureReservedA driver has made a call to a kernel-mode ZwXxx routine with a malformed UNICODE_STRING structure as a parameter.
0xE5 (Windows Vista and later operating systems only)Current IRQLReservedReservedA call was made to a Kernel API at the incorrect IRQL.
0xEA (Windows Vista and later operating systems only)Current IRQLThe thread’s APC disable countAddress of the pushlockA driver has attempted to acquire a pushlock while APCs are enabled.
0xEB (Windows Vista and later operating systems only)Current IRQLThe thread’s APC disable countAddress of the pushlockA driver has attempted to release a pushlock while APCs are enabled.
0xF0 (Windows Vista and later operating systems only)Address of the destination bufferAddress of the source bufferNumber of bytes to copyA driver called the memcpy function with overlapping source and destination buffers.
0xF5 (Windows Vista and later operating systems only)Address of the NULL handleObject typeReservedA driver passed a NULL handle to ObReferenceObjectByHandle.
0xF6 (Windows 7operating systems and later)Handle value being referencedAddress of the current processAddress inside the driver that performs the incorrect referenceA driver references a user-mode handle as kernel mode.
0xFA (Windows 7operating systems and later)Completion routine address.IRQL value before it calls the completion routineCurrent IRQL value, after it calls the completion routineThe IRP completion routine returned at an IRQL that was different from the IRQL the routine was called at.
0xFB (Windows 7operating systems and later)Completion routine addressCurrent thread’s APC disable countThe thread’s APC disable count before it calls the IRP completion routineThe thread’s APC disable count was changed by the driver’s IRP completion routine.

The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a mutex.

The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem.

Because these calls should always be in pairs, the APC disable count should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.



0x105

(Windows 7operating systems and later)

Address of the IRPThe driver uses ExFreePool instead of IoFreeIrp to release the IRP.
0x10A

(Windows 7operating systems and later)

The driver attempts to charge pool quota to the Idle process.
0x10B

(Windows 7operating systems and later)





The driver attempts to charge pool quota from a DPC routine. This is incorrect because the current process context is undefined.
0x110

(Windows 7operating systems and later)

Address of the Interrupt Service RoutineAddress of the extended context that was saved before it executed the ISRAddress of the extended context was saved after it executed the ISRThe interrupt service routine (ISR) for the driver has corrupted the extended thread context.
0x115

(Windows 7operating systems and later)

The address of the thread that is responsible for the shutdown, which might be deadlockedDriver Verifier detected that the system has taken longer than 20 minutes and shutdown is not complete.
0x11A

(Windows 7operating systems and later)

Current IRQLThe driver calls KeEnterCriticalRegion at IRQL > APC_LEVEL.
0x11B

(Windows 7operating systems and later)

Current IRQLThe driver calls KeLeaveCriticalRegion at IRQL > APC_LEVEL.
0x120

(Windows 7operating systems and later)

Address of the IRQL valueAddress of the Object to wait onAddress of Timeout valueThe thread waits at IRQL > DISPATCH_LEVEL. Callers of KeWaitForSingleObject or KeWaitForMultipleObjects must run at IRQL <= DISPATCH_LEVEL.
0x121

(Windows 7operating systems and later)

Address of the IRQL valueAddress of the Object to wait onAddress of Timeout valueThe thread waits at IRQL equals DISPATCH_LEVEL and the Timeout is NULL. Callers of KeWaitForSingleObject or KeWaitForMultipleObjects can run at IRQL <= DISPATCH_LEVEL. If a NULL pointer is supplied for Timeout, the calling thread remains in a wait state until the Object is signaled.



0x122

(Windows 7operating systems and later)

Address of the IRQL valueAddress of the Object to wait onAddress of the Timeout value The thread waits at DISPATCH_LEVEL and Timeout value is not equal to zero (0). If the Timeout != 0, the callers of KeWaitForSingleObject or KeWaitForMultipleObjects must run at IRQL <= APC_LEVEL.
0x123

(Windows 7operating systems and later)

Address of the Object to wait onThe caller of KeWaitForSingleObject or KeWaitForMultipleObjects specified the wait as UserMode, but the Object is on the kernel stack.
0x130

(Windows 7operating systems and later)

Address of work itemThe work item is in session address space. Work items are not allowed in session address space because they can be manipulated from another session or from system threads that have no session virtual address space.
0x131

(Windows 7operating systems and later)

Address of work itemThe work item is in pageable memory. Work items have to be in nonpageable memory because the kernel uses them at DISPATCH_LEVEL.
0x135Address of IRPNumber of milliseconds allowed between the IoCancelIrp call and the completion for this IRPThe canceled IRP did not completed in the expected time The driver took longer than expected to complete the canceled IRP.
0x13AAddress of the pool block being freedIncorrect valueAddress of the incorrect valueThe driver has called ExFreePool and Driver Verifier detects an error in one of the internal values that is used to track pool usage.
0x13BAddress of the pool block being freedAddress of the incorrect valueAddress of a pointer to the incorrect memory pageThe driver has called ExFreePool and Driver Verifier detects an error in one of the internal values that is used to track pool usage.
0x13CAddress of the pool block being freedIncorrect valueAddress of the incorrect valueThe driver has called ExFreePool and Driver Verifier detects an error in one of the internal values that is used to track pool usage.
0x13DAddress of the pool block being freedAddress of the incorrect valueCorrect value that was expectedThe driver has called ExFreePool and Driver Verifier detects an error in one of the internal values that is used to track pool usage.
0x13EPool block address specified by the callerPool block address tracked by Driver VerifierPointer to the pool block address that is tracked by Driver VerifierThe pool block address specified by the caller of ExFreePool is different from the address tracked by Driver Verifier.
0x13FAddress of the pool block being freedNumber of bytes being freedPointer to the number of bytes tracked by Driver VerifierThe number of bytes of memory being freed in the call to ExFreePool is different from the number of bytes tracked by Driver Verifier.
0x1000 (Windows XP and later operating systems only)Address of the resourceReservedReservedSelf-deadlock: The current thread has tried to recursively acquire a resource. A stop error code with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1001 (Windows XP and later operating systems only)Address of the resource that was the final cause of the deadlockReservedReservedDeadlock: A lock hierarchy violation has been found. A stop error code with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.

(Use the !deadlock debugger extension for further information.)

0x1002 (Windows XP and later operating systems only)Address of the resourceReservedReservedUninitialized resource: A resource has been acquired without having been initialized first. A stop error code with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1003 (Windows XP and later operating systems only)Address of the resource that is being released deadlockedAddress of the resource that should have been released firstReservedUnexpected release: A resource has been released in an incorrect order. A stop error code with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1004 (Windows XP and later operating systems only)Address of the resourceAddress of the thread that acquired the resourceAddress of the current threadUnexpected thread: The wrong thread releases a resource. A stop error code with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1005 (Windows XP and later operating systems only)Address of the resourceReservedReservedMultiple initialization: A resource is initialized more than one time. A stop error code with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1006 (Windows XP and later operating systems only)Address of the thread being deletedAddress of the resource owned by the threadReservedThread holds resources: A thread is deleted before the thread can release its resources. A stop error code with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1007 (Windows XP and later operating systems only)Address of the resourceReservedReservedUnacquired resource: A resource is released before it has been acquired. A stop error code with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x1008

(operating systems and later)

Lock addressDriver Verifier internal dataDriver Verifier internal dataThe driver tried to acquire a lock by using an API that is mismatched for this lock type.
0x1009

(operating systems and later)

Lock addressDriver Verifier internal dataDriver Verifier internal dataThe driver tried to release a lock by using an API that is mismatched for this lock type.
0x100A

(operating systems and later)

Owner thread addressDriver Verifier internal dataThe terminated thread owns the lock.
0x100B

(operating systems and later)

Lock addressOwner thread addressDriver Verifier internal addressThe deleted lock is still owned by a thread.

Cause

See the description of each code in the Parameters section for a description of the cause. Further information can be obtained by using the !analyze -v debugger extension.

Resolving the Problem

This stop error code can only occur when Driver Verifier has been instructed to monitor one or more drivers. If you did not intend to use Driver Verifier, you should deactivate it. You might consider removing the driver which caused this problem as well.

If you are the driver writer, use the information obtained through this stop error code to fix the bugs in your code.

For full details on Driver Verifier, see Driver Verifier.

Comments

The _POOL_TYPE codes are enumerated in Ntddk.h. In particular, 0 (zero) indicates nonpaged pool and 1 (one) indicates paged pool.

Helpful Tools

The following products are free to try. We have found them to be of the highest quality and value. They have been extremely useful in our own pc troubleshooting and maintainance and we highly recommend trying them out for yourself.


Anti-Malware Pro

With a lightning fast free scan and the largest authentic spyware detection database we have seen, Anti-Malware Pro finds and removes threats to your PC stability and security. Download Anti-Malware Pro


DriverFinder

DriverFinder will scan your system for driver and software updates. Its easy to use interface makes keeping your drivers updated quick and simple. They will even send you an email notification when new driver updates are available for your system! It doesn't get any more convenient than this. Download DriverFinder





Browse STOP Error Codes:





Is a STOP error code missing?

Help us to make errorDecoder.com the best resource we possibly can by submitting you very own STOP error code details. If you have detailed information on any STOP error code please let us know by visiting the following link.

Submit Error Details Form

STOP 0x000000C4    |    DRIVER_VERIFIER_DETECTED_VIOLATION    |    Fix Windows Registry Errors