Descriptions of Bug Codes for Windows NTID: Q103059
|
This article contains a list of bug codes, listed in order of bug code
number. Some codes include parameter definitions and explanations.
Bug codes with no descriptions are usually from checked builds of Windows
NT. If you receive one of these codes, run the kernel debugger, and type
the following commands:
kb
!process 0 7
!vm
!errlog This is a kernel internal error. This error could be caused by a mismatch between KeEnterCricticalRegion and KeLeaveCriticalRegion in a file system.
DEVICE_QUEUE_NOT_BUSY (0x2)
INVALID_AFFINITY_SET (0x3)
INVALID_DATA_ACCESS_TRAP (0x4)
INVALID_PROCESS_ATTACH_ATTEMPT (0x5)
INVALID_PROCESS_DETACH_ATTEMPT (0x6)
INVALID_SOFTWARE_INTERRUPT (0x7)
IRQL_NOT_DISPATCH_LEVEL (0x8)
IRQL_NOT_GREATER_OR_EQUAL (0x9)
IRQL_NOT_LESS_OR_EQUAL (0xA) An attempt was made to touch pageable memory at a process internal request level (IRQL) that is too high. This error is usually caused by drivers using improper addresses. If the kernel debugger is available, get a stack back trace.
Parameters:
1 - Memory referenced
2 - IRQL
3 - Value: 0 = read operation, 1 = write operation
4 - Address that referenced memory
NO_EXCEPTION_HANDLING_SUPPORT (0xB)
MAXIMUM_WAIT_OBJECTS_EXCEEDED (0xC)
MUTEX_LEVEL_NUMBER_VIOLATION (0xD) Try to identify the mutexes using the NTOS\EX\EXLEVELS.H header file. You should be able to pinpoint the mutexes that are getting acquired in an incorrect sequence.
Parameters:
1 - Current thread's mutex level
2 - Mutex level attempting to acquire
NO_USER_MODE_CONTEXT (0xE)
SPIN_LOCK_ALREADY_OWNED (0xF)
SPIN_LOCK_NOT_OWNED (0x10)
THREAD_NOT_MUTEX_OWNER (0x11)
TRAP_CAUSE_UNKNOWN (0x12)
EMPTY_THREAD_REAPER_LIST (0x13)
CREATE_DELETE_LOCK_NOT_LOCKED (0x14)
LAST_CHANCE_CALLED_FROM_KMODE (0x15)
CID_HANDLE_CREATION (0x16)
CID_HANDLE_DELETION (0x17)
REFERENCE_BY_POINTER (0x18)
BAD_POOL_HEADER (0x19)
MEMORY_MANAGEMENT (0x1A)
PFN_SHARE_COUNT (0x1B)
PFN_REFERENCE_COUNT (0x1C)
NO_SPIN_LOCK_AVAILABLE (0x1D)
KMODE_EXCEPTION_NOT_HANDLED (0x1E) This is a very common bug code. Usually the exception address pinpoints the driver or function that caused the problem. Always note this address as well as the link date of the driver or image that contains this address. A common error is exception code 0x80000003. This error means a hard-coded breakpoint or assertion was hit, but the system was booted with the /NODEBUG switch. This problem should not occur very often. If it occurs repeatedly, make sure a debugger is connected and the system is booted with the /DEBUG switch.
On non-Intel systems, if the address of the exception is 0XBFC0304, the bug code is the result of a cache-parity error on the CPU. If the problem reoccurs frequently, contact the hardware manufacturer.
Parameters:
1 - The exception code that was not handled
2 - The address at which the exception occurred
3 - Parameter 0 of the exception
4 - Parameter 1 of the exception
SHARED_RESOURCE_CONV_ERROR (0x1F)
KERNEL_APC_PENDING_DURING_EXIT (0x20) The key data item is the thread's APC disable count. If the count is nonzero, it is the source of the problem. A negative value indicates that a file system has called FsRtlEnterFileSystem more times than FsRtlExitFileSystem. A positive value indicates that the reverse is true. If you see this situation, check all file systems installed on the machine. Third-party redirectors are especially suspect since they do not receive the heavy-duty testing that NTFS, FAT, HPFS, and RDR receive.
The current IRQL should also be 0. If it is not, a driver's cancellation routine can cause this bug code by returning at an elevated IRQL. Always try to note what you were doing or closing and note all the installed drivers at the time of the bug code. This symptom is usually caused by a severe bug in a third-party driver.
Parameters:
1 - The address of the APC found pending during exit
2 - The thread's APC disable count
3 - The current IRQL
QUOTA_UNDERFLOW (0x21)
FILE_SYSTEM (0x22)
FAT_FILE_SYSTEM (0x23)
NTFS_FILE_SYSTEM (0x24)
NPFS_FILE_SYSTEM (0x25)
CDFS_FILE_SYSTEM (0x26)
RDR_FILE_SYSTEM (0x27)
CORRUPT_ACCESS_TOKEN (0x28)
SECURITY_SYSTEM (0x29)
INCONSISTENT_IRP (0x2A) An IRP was encountered that was in an inconsistent state; that is, some field or fields of the IRP were inconsistent with the remaining state of the IRP--for example, an IRP that was being completed, but was still marked as being queued for a driver's device queue. This bug code is not currently being used in the system, but exists for debugging purposes.
Parameter:
1 - Address of the IRP that was found to be inconsistent
PANIC_STACK_SWITCH (0x2B) This error indicates that the kernel mode stack was overrun. This error normally occurs when a kernel mode driver uses too much stack space. It can also occur when serious data corruption occurs in the kernel.
PORT_DRIVER_INTERNAL (0x2C)
SCSI_DISK_DRIVER_INTERNAL (0x2D)
DATA_BUS_ERROR (0x2E) This bug code is normally caused by a parity error in the system memory. This error can also be caused by a driver accessing a 0x8XXXXXXX address that does not exist.
Parameters:
1 - Virtual address that caused the fault
2 - Physical address that caused the fault
3 - Processor status register (PSR)
4 - Faulting instruction register (FIR)
INSTRUCTION_BUS_ERROR (0x2F)
SET_OF_INVALID_CONTEXT (0x30)
PHASE0_INITIALIZATION_FAILED (0x31) System initialization failed early on. The kernel debugger is required to make sense of this error, since this code tells you almost nothing.
PHASE1_INITIALIZATION_FAILED (0x32)
Parameters:
1 - Windows NT status code that describes why the system thinks
initialization failed
2 - Indicates location within INIT.C where phase 1 initialization
failure occurred
UNEXPECTED_INITIALIZATION_CALL (0x33)
CACHE_MANAGER (0x34)
NO_MORE_IRP_STACK_LOCATIONS (0x35) A higher level driver has attempted to call a lower level driver through the IoCallDriver() interface, but there are no more stack locations in the packet, so the lower level driver would not be able to access its parameters, as there are no parameters for it. This is a disastrous situation, since the higher level driver thinks it has filled in the parameters for the lower level driver (something it MUST do before calling the lower level driver); however, since there is no stack location for the latter driver, the former has written off of the end of the packet. This means that some other memory has probably been corrupted.
Parameter:
1 - Address of the IRP
DEVICE_REFERENCE_COUNT_NOT_ZERO (0x36) A device driver has attempted to delete one of its device objects from the system but the reference count for that object was nonzero, meaning there were still outstanding references to the device. (The reference count indicates the number of reasons why this device object cannot be deleted.) This is a bug in the calling device driver.
Parameter:
1 - Address of the device object
FLOPPY_INTERNAL_ERROR (0x37)
SERIAL_DRIVER_INTERNAL (0x38)
SYSTEM_EXIT_OWNED_MUTEX (0x39)
SYSTEM_UNWIND_PREVIOUS_USER (0x3A)
SYSTEM_SERVICE_EXCEPTION (0x3B)
INTERRUPT_UNWIND_ATTEMPTED (0x3C)
INTERRUPT_EXCEPTION_NOT_HANDLED (0x3D)
MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED (0x3E) The system has multiple processors, but they are asymmetric in relation to one another. To be symmetric, all processors must be of the same type and level. For example, trying to mix a Pentium-level processor with an 80486 would cause this error. Additionally, on x86 systems, floating-point capabilities must be present on all or no processors.
NO_MORE_SYSTEM_PTES (0x3F) No System PTEs left. Usually caused by a driver not cleaning up properly. If kernel debugger is available, get a stack trace and enter the following command:
!sysptes 3
TARGET_MDL_TOO_SMALL (0x40) A driver has called the IoBuildPartialMdl() function and passed it an MDL to map part of a source MDL, but the target MDL is not large enough to map the entire range of addresses requested. This is a driver bug. The source and target MDLs, as well as the address range length to be mapped, are the arguments to the IoBuildPartialMdl() function:
IoBuildPartialMdl( IN PMDL SourceMdl,
IN OUT PMDL TargetMdl,
IN PVOID VirtualAddress,
IN ULONG Length )
MUST_SUCCEED_POOL_EMPTY (0x41) If kernel debugger is available, the VM command lists various sizes.
Parameters:
1 - Size of the request that could not be satisfied
2 - Number of pages used of nonpaged pool
3 - Number of too large PAGE_SIZE requests from nonpaged pool
4 - Number of pages available
ATDISK_DRIVER_INTERNAL (0x42)
NO_SUCH_PARTITION (0x43)
MULTIPLE_IRP_COMPLETE_REQUESTS (0x44) A driver has requested that an IRP be completed [IoCompleteRequest()], but the packet has already been completed. This is a difficult bug to find because the easiest case, a driver actually attempted to complete its own packet twice, is generally not what happened. Rather, two separate drivers each tries to own the packet, and each attempts to complete it. The first actually works, and the second fails. Tracking down which drivers in the system actually did this is difficult, because the tracks of the first driver have been covered by the second. However, the driver stack for the current request can be found by examining the DeviceObject fields in each of the stack locations.
Parameter:
1 - Address of the IRP
INSUFFICIENT_SYSTEM_MAP_REGS (0x45)
DEREF_UNKNOWN_LOGON_SESSION (0x46)
REF_UNKNOWN_LOGON_SESSION (0x47)
CANCEL_STATE_IN_COMPLETED_IRP (0x48) This error indicates that an I/O Request Packet (IRP) that is to be canceled has a cancel routine specified in it, meaning the packet is in a state in which the packet can be canceled. However, the packet no longer belongs to a driver, as it has entered I/O completion. This is either a driver bug, or more than one driver is accessing the same packet, which is not likely and much more difficult to debug.
Parameter:
1 - Pointer to the IRP
PAGE_FAULT_WITH_INTERRUPTS_OFF (0x49)
This means exactly what it says. Treat it as a case of 0x0A above.
IRQL_GT_ZERO_AT_SYSTEM_SERVICE (0x4A)
STREAMS_INTERNAL_ERROR (0x4B)
FATAL_UNHANDLED_HARD_ERROR (0x4C) If a hard error occurs during system boot before Windows NT is up, and it is a real error, the system will halt with a blue screen.
The following are some common cases:
x218 - A necessary registry hive file could not be loaded. The hive
file may be corrupted or missing. The Emergency Repair disk may
be required to recover from this.
The driver may have corrupted the registry data while loading
into memory, or the memory where the registry file was loaded
is not actually memory. In particular, AST EISA machines with
16 MB or more of memory must have access to the memory above 16
MB that is ENABLED in the EISA configuration utility, or the
registry file is liable to get loaded in this spot, but will
return just 0xffffffff when the memory is read.
x21A - Either Winlogon or CSRSS (Windows) died unexpectedly. The exit
code tells more information. Usually it is c0000005, meaning
that an unhandled exception crashed either of these processes.
There is not much you can do unless this becomes a persistent
problem.
x221 - This means that a driver is corrupted, or a system DLL was
detected to be corrupted. Windows NT does its best to check the
integrity of drivers and important system DLLs. A blue screen
is displayed with the name of the corrupted file. If this
occurs,boot an alternate operating system, or reinstall if no
alternate exists. Make sure the on-disk file that is listed as
bad matches the version on the compact disc and replace it if
necessary. In some cases, random corruption can mean that there
is a hardware problem in the I/O path to the file.
NO_PAGES_AVAILABLE (0x4D)
No free pages available to continue operations. If the kernel debugger is available, type the following commands:
!process 0 7
!vm
dd mmpagingfiles
dd @$p Parameters:
1 - Number of dirty pages
2 - Number of physical pages in machine
3 - Extended commit value in pages
4 - Total commit value in pages
PFN_LIST_CORRUPT (0x4E) Caused by corrupting I/O driver structures. If the kernel debugger is available, get a stack trace.
Parameters:
1 - Value 1
2 - ListHead value that was corrupted
3 - Number of pages available
4 - 0
1 - Value 2
2 - Entry in list being removed
3 - Highest physical page number
4 - Reference count of entry being removed
NDIS_INTERNAL_ERROR (0x4F)
PAGE_FAULT_IN_NONPAGED_AREA (0x50)
REGISTRY_ERROR (0x51) Something has gone wrong with the registry. If a kernel debugger is available, get a stack trace. If the stack trace indicates you are in a system worker thread (CmpWorker will be on the call list), enter the following kernel debugger commands:
dd CmpRegistryMutex+18 L1 !thread <whatever value the above command printed out>
This will give you the thread and stack trace that made the registry call.
This error can also indicate that the registry received an I/O error while trying to read one of its files, so the error can be caused by hardware problems or file system corruption. It can also occur because of a failure in a refresh operation that is used only by the security system, and then only when resource limits are encountered. When you see this bug code, note whether the machine is a PDC or BDC, and how many accounts are in its security account manager (SAM) database, whether it might be a replication target, and whether the volume where the hive files reside is nearly full.
Parameters:
1 - Value 1 (indicates where bug code occurred)
2 - Value 2 (indicates where bug code occurred)
3 - May be pointer to hive
4 - May be return code of HvCheckHive if the hive is corrupted
MAILSLOT_FILE_SYSTEM (0x52)
NO_BOOT_DEVICE (0x53)
LM_SERVER_INTERNAL_ERROR (0x54)
DATA_COHERENCY_EXCEPTION (0x55)
INSTRUCTION_COHERENCY_EXCEPTION (0x56)
XNS_INTERNAL_ERROR (0x57)
FTDISK_INTERNAL_ERROR (0x58) The system was booted from a revived primary partition, so the hives say the mirror is all right, when in fact it is not. The real images of the hives are on the shadow. You must boot from the shadow.
PINBALL_FILE_SYSTEM (0x59)
CRITICAL_SERVICE_FAILED (0x5A)
SET_ENV_VAR_FAILED (0x5B)
HAL_INITIALIZATION_FAILED (0x5C)
HEAP_INITIALIZATION_FAILED (0x5D)
OBJECT_INITIALIZATION_FAILED (0x5E)
SECURITY_INITIALIZATION_FAILED (0x5F)
PROCESS_INITIALIZATION_FAILED (0x60)
HAL1_INITIALIZATION_FAILED (0x61)
OBJECT1_INITIALIZATION_FAILED (0x62)
SECURITY1_INITIALIZATION_FAILED (0x63)
SYMBOLIC_INITIALIZATION_FAILED (0x64)
MEMORY1_INITIALIZATION_FAILED (0x65)
CACHE_INITIALIZATION_FAILED (0x66)
CONFIG_INITIALIZATION_FAILED (0x67) This means the registry could not allocate the pool needed to contain the registry files. This error should never occur, since it is early enough in system initialization that there is always plenty of the paged pool available.
Parameters:
1 - 5
2 - Indicates location in NTOS\CONFIG\CMSYSINI that failed
FILE_INITIALIZATION_FAILED (0x68)
IO1_INITIALIZATION_FAILED (0x69) Initialization of the I/O system failed for some reason. There is practically no other information available. In general, this error occurs because Setup made some incorrect decisions about the installation of the system, or the user has reconfigured the system.
LPC_INITIALIZATION_FAILED (0x6A)
PROCESS1_INITIALIZATION_FAILED (0x6B) Parameters:
1 - Indicates the status code that suggests that Windows NT
initialization failed
2 - Indicates the location in NTOS\PS\PSINIT.C where the failure
was detected
REFMON_INITIALIZATION_FAILED (0x6C)
SESSION1_INITIALIZATION_FAILED (0x6D)
SESSION2_INITIALIZATION_FAILED (0x6E)
SESSION3_INITIALIZATION_FAILED (0x6F)
SESSION4_INITIALIZATION_FAILED (0x70)
SESSION5_INITIALIZATION_FAILED (0x71) These bug code codes (SESSION1 - SESSION5) indicate the location in NTOS\INIT\INIT.C where the failure was detected.
Parameter:
1 - Indicates the status code that suggests that Windows NT
initialization failed
ASSIGN_DRIVE_LETTERS_FAILED (0x72)
CONFIG_LIST_FAILED (0x73) Indicates that one of the core system hives is corrupted or unreadable. This hive can be either SOFTWARE, SECURITY, or SAM.
Parameters:
1 - 5
2 - 2
3 - Index of hive in list
4 - Pointer to UNICODE_STRING containing file name of hive
BAD_SYSTEM_CONFIG_INFO (0x74) This error may indicate that the SYSTEM hive loaded by the OSLOADER/NTLDR was corrupted. However, this is unlikely, since OSLOADER checks a hive to make sure it is not corrupted after loading it.
This error may also indicate that some critical registry keys and values are not present. Booting from LastKnownGood may correct the problem, but you may need to reinstall or use the Emergency Repair Disk.
This error will occur if the SYSTEM hive files (SYSTEM and SYSTEM.ALT) cannot be grown to accommodate additional data written into the hive between registry initialization and phase one initialization (when the file systems are available). This error usually means there are 0 bytes of free space available on the drive, although it could be caused by trying to store the registry on a read-only device.
This error is caused by a driver not cleaning up completely after an I/O operation.
Parameters:
1 - Process address
2 - Number of locked pages
3 - Number of private pages
4 - 0
KERNEL_STACK_INPAGE_ERROR (0x77) The requested page of kernel data could not be read in. This error is caused by a bad block in a paging file or a disk controller error (in extremely rare cases, it is caused by running out of resources, specifically, the nonpaged pool with a status of c0000009a [STATUS_INSUFFICIENT_RESOURCES]).
If the first and second arguments are 0, the stack signature in the kernel stack was not found. This error is caused by bad hardware.
An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or C000016AL (STATUS_DISK_OPERATION_FAILED) normally indicates the data could not be read from the disk due to a bad block. Upon reboot, Autocheck will run and attempt to map out the bad sector. If the status is C0000185 (STATUS_IO_DEVICE_ERROR) and the paging file is on a SCSI disk device, the cabling and termination should be checked.
Parameters:
1 - 0
2 - 0
3 - PTE value at time of error
4 - Address of signature on kernel stack
1 - Status code
2 - I/O status code
3 - Page file number
4 - Offset into page file
PHASE0_EXCEPTION (0x78)
MISMATCHED_HAL (0x79) The HAL revision level and HAL configuration type do not match that of the kernel or the machine type. This error is probably occurring because the user has manually updated either NTOSKRNL.EXE or HAL.DLL. Or, the machine has a multiprocessor (MP) HAL and a uniprocessor (UP) kernel, or the reverse.
Parameters:
1 - Type of mismatch (1, 2, or 3):
1 - The PRCB release levels mismatch (something is out of date). If this is the case, parameters 2 and 3 are:
2 - Major PRCB level of NTOSKRNL.EXE 3 - Major PRCB level of HAL.DLL
2 - The build types mismatch. If this is the case, parameters 2 and 3 are:
2 - Build type of NTOSKRNL.EXE 3 - Build type of HAL.DLL
Build Types
-----------
0 - Free multiprocessor-enabled build
1 - Checked multiprocessor-enabled build
2 - Free uniprocessor build
3 - Micro Channel Architecture (MCA) computers require a
MCA-specific HAL. If this is the case, parameters 2 and 3
are:
2 - Machine type as detected by NTDETECT.COM
A value of a 2 would mean the computer is MCA.
3 - Machine type that HAL supports
A value of a 2 would mean the HAL is built for MCA.
KERNEL_DATA_INPAGE_ERROR (0x7A) The requested page of kernel data could not be read in. This error is caused by a bad block in the paging file or a disk controller error. See also KERNEL_STACK_INPAGE_ERROR.
Parameters:
1 - Lock type that was held (value 1, 2, 3, or PTE address)
2 - Error status (normally I/O status code)
3 - Current process (virtual address for lock type 3, or PTE)
4 - Virtual address that could not be in-paged
INACCESSIBLE_BOOT_DEVICE (0x7B) During the initialization of the I/O system, the driver for the boot device may have failed to initialize the device that the system is attempting to boot from, or the file system that is supposed to read that device may have either failed its initialization or simply not recognized the data on the boot device as a file system structure. In the former case, the first argument is the address of a Unicode string data structure that is the ARC name of the device from which the boot was being attempted. In the latter case, the first argument is the address of the device object that could not be mounted.
If this is the initial setup of the system, this error may have occurred because the system was installed on an unsupported disk or SCSI controller. Note that some controllers are supported only by drivers that are in the Windows Driver Library (WDL), which requires the user to do a custom installation.
This error can also be caused by the installation of a new SCSI adapter or disk controller or by repartitioning the disk with the system partition. If this is the case, on x86 systems, the BOOT.INI file must be edited; on ARC systems, Setup must be run. For information on changing BOOT.INI, see the Windows NT Advanced Server "Administrator's Guide."
If the argument is a pointer to an ARC name string, the format of the first two (and in this case only) long words will be:
USHORT Length;
USHORT MaximumLength;
PVOID Buffer; That is, the first long word will contain something like 00800020, where 20 is the actual length of the Unicode string, and the next long word will contain the address of buffer. This address will be in system space, so the high-order bit will be set.
If the argument is a pointer to a device object, the format of the first word will be:
USHORT Type; That is, the first word will contain a 0003, where the Type code will always be 0003.
Note that this makes it immediately obvious whether the argument is a pointer to an ARC name string or a device object, since a Unicode string can never have an odd number of bytes, and a device object will always have a Type code of 3.
Parameter:
1 - Pointer to the device object or Unicode string of ARC name
BUGCODE_PSS_MESSAGE (0x7C)
INSTALL_MORE_MEMORY (0x7D)
Not enough memory to boot Windows NT (needs 5 MB).
Parameters:
1 - Number of physical pages found
2 - Lowest physical page
3 - Highest physical page
4 - 0
WINDOWS_NT_BANNER (0x4000007E)
UNEXPECTED_KERNEL_MODE_TRAP (0x7F) This error means a trap occurred in kernel mode, either a kind of trap that the kernel is not allowed to have or catch (a bound trap), or a kind of trap that is always instant death (double fault). The first number in the bug code parentheses is the number of the trap (8 = double fault). To learn more about what these traps are, consult an Intel x86 family manual.
From kernel debugger, a KB and !TRAP on the appropriate frame (which will be the EBP that goes with a procedure named KiTrap--at least on x86 machines) will show where the trap was taken.
NMI_HARDWARE_FAILURE (0x80)
The HAL is supposed to report whatever specific data it has and to
tell the user to call his or her hardware vendor for support.
SPIN_LOCK_INIT_FAILURE (0x81)
SETUP_FAILURE (0x85) (NOTE: Textmode setup no longer uses bugchecks to bail out of serious error conditions. Therefore, you will never encounter a bugcheck 0x85. All bugchecks have been replaced with friendlier and (where possible) more descriptive error messages. Some of the former bugchecks, however, have simply been replaced by our own bugcheck screen, and the codes for these error conditions are the same as before. These are documented below.)
The first extended bugcheck field is a code indicating what the problem is, and the other fields are used differently depending on that value.
1 -
0: The OEM HAL font is not a valid .fon format file,
and so setup is unable to display text.
This indicates that vgaxxx.fon on the boot floppy
or CD-ROM is damaged.
1: Video initialization failed. NO LONGER A BUGCHECK CODE.
This error now has its own error screen, and the
user is only presented with the two relevant
parameters detailed below.
This may indicate that the disk containing vga.sys
(or other video driver appropriate to the machine)
is damaged or that machine has video hardware that
we cannot communicate with.
2 - What failed:
0: NtCreateFile of \device\video0
1: IOCTL_VIDEO_QUERY_NUM_AVAIL_MODES
2: IOCTL_VIDEO_QUERY_AVAIL_MODES
3: Desired video mode not supported. This is
indicative of an internal setup error.
4: IOCTL_VIDEO_SET_CURRENT_MODE (unable to set
video mode)
5: IOCTL_VIDEO_MAP_VIDEO_MEMORY
6: IOCTL_VIDEO_LOAD_AND_SET_FONT
3 - Status code from NT API call, if appropriate.
2: Out of memory. NO LONGER A BUGCHECK CODE.
This error now uses a more friendly error screen
that works regardless of how far along in setup we
are.
3: Keyboard initialization failed. NO LONGER A BUGCHECK CODE.
There are now 2 error screens for the two different
possible errors we can get here. This may indicate
that the disk containing the keyboard driver
(i8042prt.sys or kbdclass.sys) is damaged or that
machine has keyboard hardware we cannot communicate with.
It may also mean that the keyboard layout dll could
not be loaded.
2 - What failed:
0: NtCreateFile of \device\KeyboardClass0
failed.
"Setup did not find a keyboard connected to
your computer."
1: Unable to load keyboard layout dll.
"Setup could not load the keyboard layout
file <filename>."
Indicates that the cd or floppy is missing a
file (kbdus.dll for us release, other layout
dlls for localized ones).
4: Setup was unable to resolve the ARC device pathname
of the device from which setup was started. This is
an internal Setup error.
5: Partitioning sanity check failed. This indicates a
bug in a disk driver. The parameters are
meaningful only to the setup group.
MBR_CHECKSUM_MISMATCH (0x8B) This message occurs during the boot process when the MBR checksum the system calculates does not match the checksum passed in by the loader. This is usually an indication of a virus. There are many forms of viruses and not all can be detected. The newer ones usually can only be detected by a virus scanner that has recently been upgraded. Boot a write-protected disk containing a virus scanner and attempt to clean out the infection.
KerBugCheckEx parameters:
1 - Disk Signature from MBR.
2 - MBR check sum calculated by osloader.
3 - MBR checksum calculated by system.
PP0_INITIALIZATION_FAILED (0x8F)
This message occurs if phase 0 initialization of the kernel-mode Plug
and Play Manager failed. There's really nothing going on here that
could cause a failure.
PP1_INITIALIZATION_FAILED (0x90)
This message occurs if phase 1 initialization of the kernel-mode Plug
and Play Manager failed. This is where we do most of our initialization,
including setting up the environment (registry, etc.) for drivers to
subsequently call during I/O init.
UP_DRIVER_ON_MP_SYSTEM (0x92)
This message occurs if a UNIPROCESSOR only driver is loaded on a
MultiProcessor system with more than one active processor.
KeBugCheckEx parameters:
1 - The Base address of the driver.
INVALID_KERNEL_HANDLE (0x93)
This message occurs if kernel code (server, redirector, other driver,
and so forth) attempts to close a handle that is not a valid handle.
1 - The handle that NtClose was called with.
2 - 0 means a protected handle was closed.
1 means an invalid handle was closed.
KERNEL_STACK_LOCKED_AT_EXIT (0x94)
This message occurs when a thread exits while its kernel stack is
marked as not swapable
INVALID_WORK_QUEUE_ITEM (0x96)
This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null. This is almost always called by code misusing
worker thread work items, but any queue misuse can cause this. The rule
is that an entry on a queue may only be inserted on the list once. When
an item is removed from a queue, its flink field is set to NULL. This
bugcheck occurs when remove queue attempts to remove an entry, but the
flink or blink field is NULL. In order to debug this problem, you need
to know the queue being referenced. If the queue is one of the EX worker
queues (ExWorkerQueue), then the item being removed is a
WORK_QUEUE_ITEM
(see ex.h). This bug heck assumes that this is the case. The bugcheck ex
parameters are designed to help identify the driver misusing the queue
item.
BOUND_IMAGE_UNSUPPORTED (0x97)
MmLoadSystemImage was called to load a bound image. This is not
supported in the kernel. Make sure bind.exe was not run on the
image.
KeBugCheckEx parameters:
1 - The address of the queue entry whose flink/blink field is NULL
2 - The address of the queue being references. Usually this
is one of the ExWorkerQueues.
3 - The base address of the ExWorkerQueue array. This will
help determine if the queue in question is an
ExWorkerQueue and if so, the offset from this
parameter will isolate the queue.
4 - If this is an ExWorkerQueue (which it usually is), this
is the address of the worker routine that would have
been called if the work item was valid. This can be
used to isolate the driver that is misusing the work
queue.
END_OF_NT_EVALUATION_PERIOD (0x98)
Your NT System is an evaluation unit with an expiration date. The trial
period is over.
KeBugCheckEx parameters:
1 - The low order 32 bits of your installation date
2 - The high order 32 bits of your installation date
3 - The trial period in minutes
INVALID_REGION_OR_SEGMENT (0x99)
>
ExInitializeRegion or ExInterlockedExtendRegion was called with an
invalid set of parameters.
SYSTEM_LICENSE_VIOLATION (x9a)
A violation of the software license agreement has occurred. This can be
due to either attempting to change the product type of an offline
system, or an attempt to change the trial period of an evaluation unit
of NT.
1 - 0 - means that offline product type changes were
attempted
2 - if 1, product should be LanmanNT or ServerNT.
If 0, should be WinNT
3 - partial serial number
4 - first two characters of product type from
product options.
1 - means that offline changes to the nt evaluation unit
time period
2 - registered evaluation time from source 1
3 - partial serial number
4 - registered evaluation time from alternate source
2 - means that the setup key could not be opened
2 - status code associated with the open failure
3 - The SetupType value from the setup key is missing
so GUI setup mode could not be detected
2 - status code associated with the key lookup failure
4 - The SystemPrefix value from the setup key is missing
2 - status code associated with the key lookup failure
5 - means that offline changes were made to the number of
licensed processors
2 - see setup code
3 - invalid value found in licensed processors
4 - officially licensed number of processors
KeBugCheckEx parameters:
1 - The segment address which must reside on a quadword boundary.
2 - The segment size which must be greater than the block
size plus the size of a segment header.
3 - The block size which must be a multiple of eight and
smaller than the segment size minus the size of the
segment header.
UDFS_FILE_SYSTEM (0x9B)
See the comment for FAT_FILE_SYSTEM
MACHINE_CHECK_EXCEPTION (0x9C)
A fatal Machine Check Exception has occurred.
KeBugCheckEx parameters:
If the processor has ONLY MCE feature available (For
example Intel Pentium), the parameters are:
1 - Low 32 bits of P5_MC_TYPE MSR
2 -
3 - High 32 bits of P5_MC_ADDR MSR
4 - Low 32 bits of P5_MC_ADDR MSR
If the processor also has MCA feature available (for
example, Intel Pentium Pro), the parameters are:
1 - Bank number
2 - Address field of MCi_ADDR MSR for the MCA bank that had
the error
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that
had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that
had the error Additional query words: prodnt stop bugcode bugcheck 0x00000035 debugref
Keywords : kbother ntstop NTSrvWkst
Version : 3.1 3.5 3.51 4.0
Platform : NT
Issue type : Last Reviewed: January 14, 1999