spacer spacer spacer
 
 
  arrow Description
  arrow Sample Screen
  arrow Key Facts
  arrow Solutions
  arrow Forum Help
  arrow Technical Details
  arrow Vendor Summary
  arrow Research this Issue
  help Solutions Help
 
  Partition Commander
Now it's easy for anyone to safely partition their hard drive! You can reclaim waste disk space, organize files, even add new OSes.		 box_image  
 
 
box_image
 Fix-It Utilities
Make your PC run like new! Includes Anti-Virus, Anti-Spyware, hardware diagnostics, registry fixer, and more!
 
  RadarSync
Ensures you have the latest drivers and software updates to make your PC run better and safer.		 box_image  
     
 
 
Fatal Error Solutions
     
 

A device driver attempting to corrupt the...

STOP: 0x000000C4

  
  Description  
     
 

Windows in various situations checks each driver to be sure it's working correctly. This error indicates it found a fatal fault in the driver and it must be disabled or replaced.

Some versions of Windows may show the description as "DRIVER_VERIFIER_DETECTED_VIOLATION".

This is a fatal Windows error, typically called a Stop message, Bug Check, or more commonly the Blue Screen of Death (BSoD). The system is in a forced reboot state. Any unsaved work is likely lost.

  
   
  Sample Screen  
     
 

A problem has been detected and Windows has been shut down to prevent damage to your computer.

A device driver attempting to corrupt the system has been caught.
The faulty driver currently on the kernel stack must be replaced
with a working version.

If this is the first time you've seen this Stop error screen, restart your computer. If this screen appears again, follow these steps:

Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode.

Technical Information:

*** STOP: 0x000000C4

Beginning dump of physical memory
Physical memory dump complete.

Contact your system administrator or technical support group for further
assistance.
 
 
Text may appear differently depending on where the error occurs.
Additional technical information (hex values) specific to a machine are not shown.
  
   
  Key Facts  
     
 
Full Title
   A device driver attempting to corrupt the system has been caught.
The faulty driver currently on the kernel stack must be replaced
with a working version. 
Stop Code
   0x000000C4 
Type
   Fatal 
occurance meter
Windows
   2000, XP, Vista, 2008, 7
Vendor
   Microsoft Corporation
 
   
  Solutions and Fixes  
     
 
  Date Votes ratings
Get the Latest Drivers
7
    Add    Flag
solution icon

Check if you are using the latest hardware drivers, especially the chipset and video drivers. Older drivers are a common contributor to BSoD issues.

You can use a product like Driver Genius or Radar Sync to verify you have the latest drivers and help keep all your drivers up-to-date. If you're comfortable with driver installations, you can individually find and install current drivers.

A some of the most popular driver download sites:
 
   
 
transparent
transparent
solves it indicator
risk indicator
effort indicator
 
  FaultWire Staff
Posted: 5-Oct-2008 		 
Avatar
 
Get the Latest Updates
7
    Add    Flag
solution icon

Install the latest Windows software updates. Don't forget to check for non-critical updates too!

To manually get updates, open Internet Explorer (you can't use a non-Microsoft browser for updates).

For IE 8 and later: Click on Safety, then Windows Update. Follow the instructions.


 

For IE 7 and older: Click on Tools, then Windows Update. Follow the instructions.
 
   
 
transparent
transparent
solves it indicator
risk indicator
effort indicator
 
  FaultWire Staff
Posted: 5-Oct-2008 		 
Avatar
 
Uninstall the Last Install
6
    Add    Flag
solution icon

If you can get the system up for more than a few minutes or can use safe mode, try removing the last installed software application or driver.

For removal of an application (Windows 7 & Vista):

  1. Click on Start, Control Panel, then Programs and Features.
  2. Select the software to uninstall and select Uninstall.

For removal of an application (Windows XP):

  1. Click on Start, Control Panel, then Add or Remove Programs.
  2. Select the software to uninstall and select Remove.

To disable a driver:

  1. Bring up the system information dialog:

    On the keyboard, press the Windows key + Pause/Break.

       or

    Select Start, right click Computer and on the drop-down, select Properties.

  2. Click on the left side option Advanced system settings (7/Vista only).
  3. In System Properties, select the Hardware tab, then click on Device Manager button.
  4. Find the hardware/driver of interest (you may need to expand a choice at the "plus" graphic) and double click the choice.
  5. Select the Driver tab. Here you can perform a number of actions such as update the driver, roll Back the driver to an older version, disable or uninstall the driver.
  6. Click OK to exit, then close the Device Manager and other previously opened dialogs.
 
   
 
transparent
transparent
solves it indicator
risk indicator
effort indicator
 
  FaultWire Staff
Posted: 5-Oct-2008 		 
Avatar
 

Also see our list of common Fatal Error Solutions.

  
 
 
  Forum Help  
     
 
Forums on topic

Check out what others say about this issue and review or add your own comments and solutions!

Go to Forums on topic.
 
   
  Technical Details  
     
 
  technical details

fatal errors for the Driver Verifier.

After the Stop code will be 4 hex values: {Parameter 1, Parameter 2, Parameter 3, Parameter 4}.

Parameter 1 specifies the cause of the issue. The Windows column with a "-" means that version and older ones, where a "+" indicates that version and all newer ones. A blank indicates all versions.

Parameter 1 Windows Cause
0x00000000 The driver requested a zero-byte pool allocation.
0x00000001 The driver attempted to allocate paged memory with IRQL > APC_LEVEL (IRQL = Interrupt Request Level).
0x00000002 The driver attempted to allocate nonpaged memory with IRQL > DISPATCH_LEVEL.
0x00000003 Vista+ The driver attempted to allocate multiple pages of must succeed pool, but at most one page can be allocated using this routine.
0x00000010 The driver attempted to free an address that was not returned from an allocate call.
0x00000011 The driver attempted to free paged pool with IRQL > APC_LEVEL.
0x00000012 The driver attempted to free nonpaged pool with IRQL > DISPATCH_LEVEL.
0x00000013 The driver attempted to free memory pool which was already freed.
0x00000014 The driver attempted to free memory pool which was already freed.
0x00000015 The driver attempted to free pool which contains an active timer.
0x00000016 The driver attempted to free pool at a bad address, or the driver passed invalid Parameters to a memory routine.
0x00000017 The driver attempted to free pool which contains an active ERESOURCE.
0x00000030 The driver passed an invalid Parameter to KeRaiseIrql (The Parameter was either a value lower than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized Parameter.)
0x00000031 The driver passed an invalid Parameter to KeLowerIrql (The Parameter was either a value higher than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized Parameter.)
0x00000032 The driver called KeReleaseSpinLock at an IRQL other than DISPATCH_LEVEL (This may be due to a double-release of a spin lock.)
0x00000033 The driver attempted to acquire fast mutex with IRQL > APC_LEVEL.
0x00000034 The driver attempted to release fast mutex at an IRQL other than APC_LEVEL.
0x00000035 The kernel released a spin lock with IRQL not equal to DISPATCH_LEVEL.
0x00000036 The kernel released a queued spin lock with IRQL not equal to DISPATCH_LEVEL.
0x00000037 The driver tried to acquire a resource, but APCs are not disabled.
0x00000038 The driver tried to release a resource, but APCs are not disabled.
0x00000039 The driver tried to acquire a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry.
0x0000003A The driver tried to release a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry.
0x0000003B The driver called KeWaitXxx with IRQL >= DISPATCH_LEVEL (This is permitted only if the driver already owns the DISPATCHER lock and it passes a time-out value of zero to the routine.)
0x0000003C The driver called ObReferenceObjectByHandle with a bad handle.
0x0000003D The driver called ObReferenceObjectByHandle with a bad handle.
0x0000003E The driver called KeLeaveCriticalRegion for a thread that is not currently in a critical region.
0x0000003F The driver applied ObReferenceObject to an object that has a reference count of zero, or the driver applied ObDereferenceObject to an object that has a reference count of zero.
0x00000040 The driver called KeAcquireSpinLockAtDpcLevel with IRQL not equal to DISPATCH_LEVEL.
0x00000041 The driver called KeReleaseSpinLockFromDpcLevel with IRQL not equal to DISPATCH_LEVEL.
0x00000042 The driver called KeAcquireSpinLock with IRQL > DISPATCH_LEVEL.
0x00000051 The driver attempted to free memory after having written past the end of the allocation. A bug check with this Parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x00000052 The driver attempted to free memory after having written past the end of the allocation. A bug check with this Parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x00000053,
0x00000054,
or
0x00000059		 The driver attempted to free memory after having written past the end of the allocation. A bug check with this Parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x00000060 The driver is unloading without first freeing its pool allocations. A bug check with this Parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x00000061 A driver thread is attempting to allocate pool memory while the driver is unloading. A bug check with this Parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x00000062 The driver is unloading without first freeing its pool allocations. A bug check with this Parameter occurs only when the Pool Tracking option of Driver Verifier is active.
0x0000006F The driver passed a page to MmProbeAndLockPages that was not in the PFN database (This often results from a driver that attempts to lock its own private dualport RAM. Such behavior can corrupt memory on machines with noncontiguous physical RAM.)
0x00000070 The driver called MmProbeAndLockPages with IRQL > DISPATCH_LEVEL.
0x00000071 The driver called MmProbeAndLockProcessPages with IRQL > DISPATCH_LEVEL.
0x00000072 The driver called MmProbeAndLockSelectedPages with IRQL > DISPATCH_LEVEL.
0x00000073 The driver called MmMapIoSpace with IRQL > DISPATCH_LEVEL.
0x00000074 The driver called MmMapLockedPages in kernel mode with IRQL > DISPATCH_LEVEL.
0x00000075 The driver called MmMapLockedPages in user mode with IRQL > APC_LEVEL.
0x00000076 The driver called MmMapLockedPagesSpecifyCache in kernel mode with IRQL > DISPATCH_LEVEL.
0x00000077 The driver called MmMapLockedPagesSpecifyCache in user mode with IRQL > APC_LEVEL.
0x00000078 The driver called MmUnlockPages with IRQL > DISPATCH_LEVEL.
0x00000079 The driver called MmUnmapLockedPages in kernel mode with IRQL > DISPATCH_LEVEL.
0x0000007A The driver called MmUnmapLockedPages in user mode with IRQL > APC_LEVEL.
0x0000007B The driver called MmUnmapIoSpace with IRQL > APC_LEVEL.
0x0000007C The driver called MmUnlockPages, and passed an MDL whose pages were never successfully locked.
0x0000007D The driver called MmUnlockPages, and passed an MDL whose pages are from nonpaged pool (These should never be unlocked.)
0x00000080 The driver called KeSetEvent with IRQL > DISPATCH_LEVEL.
0x00000081 The driver called MmMapLockedPages (You should use MmMapLockedPagesSpecifyCache instead, with the BugCheckOnFailure Parameter set to FALSE.)
0x00000082 The driver called MmMapLockedPagesSpecifyCache with the BugCheckOnFailure Parameter equal to TRUE (This Parameter should be set to FALSE.)
0x00000083 The driver called MmMapIoSpace without having locked down the MDL pages. The physical pages represented by the physical address range being mapped must have been locked down prior to making this call.
0x00000084 The driver called MmMapIoSpace without having locked down the MDL pages (or after freeing the MDL pages).
0x00000085 The driver called MmMapLockedPages without having locked down the MDL pages.
0x00000086 The driver called MmMapLockedPages without having locked down the MDL pages (or after freeing the MDL pages).
0x00000087 The driver called MmMapIoSpace, but the caller's cache type conflicts with an existing mapping.
0x00000088 The driver called MmMapIoSpace to map a physical range as non-cached or write-combined, but the caller's physical range already has an existing cached mapping.
0x00000089 An MDL is not marked as "I/O", but it contains non-memory page addresses.
0x0000008A The driver called MmMapLockedPagesXxx to map a physical range as non-cached or write-combined, but the caller's physical range already has an existing cached mapping.
0x00000090 2003- The driver switched stacks, and the current stack is neither a thread stack nor a DPC stack (Typically, the driver doing this should be on the stack obtained by using the kb (Display Stack Backtrace) debugger command.)
0x00000091 The driver switched stacks using a method that is not supported by the operating system. The only supported way to extend a kernel mode stack is by using KeExpandKernelStackAndCallout.
0x000000A0 2003+ A cyclic redundancy check (CRC) error was detected on a hard disk. A bug check with this Parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0x000000A1 2003+ A CRC error was detected on a sector (asynchronously). A bug check with this Parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0x000000A2 2003+ The CRCDISK checksum copies don't match. This could be a paging error. A bug check with this Parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active.
0x000000B0 Vista+ The driver called MmProbeAndLockPages for an MDL with incorrect flags. For example, the driver passed an MDL created by MmBuildMdlForNonPagedPool to MmProbeAndLockPages.
0x000000B1 Vista+ The driver called MmProbeAndLockProcessPages for an MDL with incorrect flags. For example, the driver passed an MDL created by MmBuildMdlForNonPagedPool to MmProbeAndLockProcessPages.
0x000000B2 Vista+ The driver called MmMapLockedPages for an MDL with incorrect flags. For example, the driver passed an MDL that is already mapped to a system address or that was not locked to MmMapLockedPages.
0x000000B3 Vista+ The driver called MmMapLockedPages for an MDL with incorrect flags. For example, the driver passed an MDL that is not locked to MmMapLockedPages.
0x000000B4 Vista+ The driver called MmUnlockPages for a partial MDL. A partial MDL is one that was created by IoBuildPartialMdl.
0x000000B5 Vista+ The driver called MmUnmapLockedPages for a partial MDL. A partial MDL is one that was created by IoBuildPartialMdl.
0x000000B6 Vista+ The driver called MmUnmapLockedPages for an MDL that is not mapped to a system address.
0x000000B7 Vista+ The system BIOS has corrupted low physical memory during a sleep transition.
0x000000C0 Vista+ The driver called IoCallDriver with interrupts disabled.
0x000000C1 Vista+ A driver dispatch routine was returned with interrupts disabled.
0x000000C2 Vista+ The driver called a Fast I/O dispatch routine after interrupts were disabled.
0x000000C3 Vista+ A driver Fast I/O dispatch routine was returned with interrupts disabled.
0x000000C5 Vista+ A driver dispatch routine has changed the thread APC disable count. The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, KeInitializeMutex, or FsRtlEnterFileSystem. The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem. Because these calls should always be in pairs, this value should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.
0x000000C6 Vista+ A driver Fast I/O dispatch routine has changed the thread APC disable count. The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, KeInitializeMutex, or FsRtlEnterFileSystem. The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem. Because these calls should always be in pairs, this value should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.
0x000000CA Vista+ The driver has attempted to re-initialize a lookaside list.
0x000000CB Vista+ The driver has attempted to delete an uninitialized lookaside list.
0x000000CC Vista+ The driver has attempted to free a pool allocation that contains an active lookaside list.
0x000000CD Vista+ The driver has attempted to create a lookaside list with an allocation block size that is too small.
0x000000D0 Vista+ The driver has attempted to re-initialize an ERESOURCE structure.
0x000000D1 Vista+ The driver has attempted to delete an uninitialized ERESOURCE structure.
0x000000D2 Vista+ The driver has attempted to free a pool allocation that contains an active ERESOURCE structure.
0x000000D5 Vista+ The current IoReleaseRemoveLock tag does not match the previous IoAcquireRemoveLock tag. If the driver calling IoReleaseRemoveLock is not in a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A bug check with this Parameter occurs only when the I/O Verification option of Driver Verifier is active.
0x000000D6 Vista+ The current IoReleaseRemoveLockAndWait tag does not match the previous IoAcquireRemoveLock tag. If the driver calling IoReleaseRemoveLock is not a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A bug check with this Parameter occurs only when the I/O Verification option of Driver Verifier is active.
0x000000DA Vista+ An attempt was made to unload a driver that has not deregistered its WMI callback function.
0x000000DB Vista+ An attempt was made to delete a device object that was not deregistered from WMI.
0x000000DC Vista+ An invalid RegHandle value was specified as a Parameter of the function EtwUnregister.
0x000000DD Vista+ An attempt was made to unload a driver without calling EtwUnregister.
0x000000E0 Vista+ A call was made to an operating system Kernel function that specified a user-mode address as a Parameter.
0x000000E1 Vista+ A synchronization object was found to have an address that was either invalid or pageable.
0x000000E2 Vista+ An IRP with Irp->RequestorMode set to KernelMode was found to have a user-mode address as one of its members.
0x000000E3 Vista+ A driver has made a call to a kernel-mode ZwXxx routine with a user-mode address as a Parameter.
0x000000E4 Vista+ A driver has made a call to a kernel-mode ZwXxx routine with a malformed UNICODE_STRING structure as a Parameter.
0x000000E5 Vista+ A call was made to a Kernel API at the incorrect IRQL.
0x000000EA Vista+ A driver has attempted to acquire a pushlock while APCs are enabled.
0x000000EB Vista+ A driver has attempted to release a pushlock while APCs are enabled.
0x000000F0 Vista+ A driver called the memcpy function with overlapping source and destination buffers.
0x000000F5 Vista+ A driver passed a NULL handle to ObReferenceObjectByHandle.
0x00001000 XP+ Self-deadlock: The current thread has tried to recursively acquire a resource. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x00001001 XP+ Deadlock: A lock hierarchy violation has been found. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active (Use the !deadlock debugger extension for further information.)
0x00001002 XP+ Uninitialized resource: A resource has been acquired without having been initialized first. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x00001003 XP+ Unexpected release: A resource has been released out of the proper order. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x00001004 XP+ Unexpected thread: The wrong thread is releasing a resource. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x00001005 XP+ Multiple initialization: A resource is being initialized more than once. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x00001006 XP+ Thread holds resources: A thread is being deleted without first releasing its resources. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active.
0x00001007 XP+ Unacquired resource: A resource is being released without having first been acquired. A bug check with this Parameter occurs only when the Deadlock Detection option of Driver Verifier is active.

Parameter 2 depends on the value of Parameter 1.

Parameter 3 depends on the value of Parameter 1.

Parameter 4 depends on the value of Parameter 1.

(For software developers: MSDN reference)

  
   
  Vendor Summary  
     
 
Vendor
   Microsoft Corporation (more info...)
Microsoft Corporation Logo
Phone
 1-425-882-8080
1-800-642-7676
Web
 Main
USA
Assistance
 Support
Downloads
 
     
    While BSoD fatal stop errors are identified by Microsoft Windows, they are often caused by non-Microsoft applications, drivers and hardware issues.  
   
  Research this Issue  
     
 
Getting search results...
  
     
  Notes  
     
  While we believe this information up to date and accurate, FAQware is not responsible for any inaccuracies. If you find something that is out of date or inaccurate, please let us know at so we can correct it.