Bug Check 0xC4: DRIVER_VERIFIER_DETECTED_VIOLATION

来源：互联网发布：大众汽车销售数据采集编辑：程序博客网时间：2024/05/16 12:24

本文档已存档，并且将不进行维护。

Bug Check 0xC4: DRIVER_VERIFIER_DETECTED_VIOLATION

The DRIVER_VERIFIER_DETECTED_VIOLATION bug check has a value of 0x000000C4. This is the general bug check code for fatal errors found by Driver Verifier. For more information, seeHandling a Bug Check When Driver Verifier is Enabled.

Important This topic is for programmers. If you are a customer who has received a blue screen error code while using your computer, seeTroubleshoot blue screen errors.

DRIVER_VERIFIER_DETECTED_VIOLATION Parameters

Parameter 1 identifies the type of violation. The meaning of the remaining parameters varies with the value of Parameter 1. The parameter values are described in the following table.

Note If you have trouble viewing all 5 columns in this table, try the following:

Expand your browser window to full size.
Place the cursor in the table and use the arrow keys to scroll left and right.
Or use the MSDN Library version of this page.

Parameter 1Parameter 2Parameter 3Parameter 4Cause of Error

0x00

Current IRQL

Pool type

The driver requested a zero-byte pool allocation.

0x01

Current IRQL

Pool type

Size of allocation, in bytes

The driver attempted to allocate paged memory with IRQL > APC_LEVEL.

0x02

Current IRQL

Pool type

Size of allocation, in bytes

The driver attempted to allocate nonpaged memory with IRQL > DISPATCH_LEVEL.

0x10

Bad Address

The driver attempted to free an address that was not returned from an allocate call.

0x11

Current IRQL

Pool type

Address of pool

The driver attempted to free paged pool with IRQL > APC_LEVEL.

0x12

Current IRQL

Pool type

Address of pool

The driver attempted to free nonpaged pool with IRQL > DISPATCH_LEVEL.

0x13 or

0x14

Reserved

Pointer to pool header

Pool header contents

The driver attempted to free memory pool which was already freed.

0x16

Reserved

Pool address

The driver attempted to free pool at a bad address, or the driver passed invalid parameters to a memory routine.

0x30

Current IRQL

Requested IRQL

The driver passed an invalid parameter to KeRaiseIrql.

(The parameter was either a value lower than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized parameter.)

0x31

Current IRQL

Requested IRQL

0: New IRQL is bad

1: New IRQL is invalid inside a DPC routine

The driver passed an invalid parameter to KeLowerIrql.

(The parameter was either a value higher than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized parameter.)

0x32

Current IRQL

Spin lock address

The driver called KeReleaseSpinLock at an IRQL other than DISPATCH_LEVEL.

(This may be due to a double-release of a spin lock.)

0x33

Current IRQL

Fast mutex address

The driver attempted to acquire fast mutex with IRQL > APC_LEVEL.

0x34

Current IRQL

Fast mutex address

The driver attempted to release fast mutex at an IRQL other than APC_LEVEL.

0x35

Current IRQL

Spin lock address

Old IRQL

The kernel released a spin lock with IRQL not equal to DISPATCH_LEVEL.

0x36

Current IRQL

Spin lock number

Old IRQL

The kernel released a queued spin lock with IRQL not equal to DISPATCH_LEVEL.

0x37

Current IRQL

Thread APC disable count

Resource

The driver tried to acquire a resource, but APCs are not disabled.

0x38

Current IRQL

Thread APC disable count

Resource

The driver tried to release a resource, but APCs are not disabled.

0x39

Current IRQL

Thread APC disable count

Mutex

The driver tried to acquire a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry.

0x3A

Current IRQL

Thread APC disable count

Mutex

The driver tried to release a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry.

0x3C

Handle passed to routine

Object type

The driver called ObReferenceObjectByHandle with a bad handle.

0x3D

Address of the bad resource

The driver passed a bad (unaligned) resource to ExAcquireResourceExclusive.

0x3E

The driver called KeLeaveCriticalRegion for a thread that is not currently in a critical region.

0x3F

Object address

New object reference count.

-1: dereference case

1: reference case

The driver applied ObReferenceObject to an object that has a reference count of zero, or the driver appliedObDereferenceObject to an object that has a reference count of zero.

0x40

Current IRQL

Spin lock address

The driver called KeAcquireSpinLockAtDpcLevel with IRQL < DISPATCH_LEVEL.

0x41

Current IRQL

Spin lock address

The driver called KeReleaseSpinLockFromDpcLevel with IRQL < DISPATCH_LEVEL.

0x42

Current IRQL

Spin lock address

The driver called KeAcquireSpinLock with IRQL > DISPATCH_LEVEL.

0x51

Base address of allocation

Address of the reference beyond the allocation

Number of charged bytes

The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when thePool Tracking option of Driver Verifier is active.

0x52

Base address of allocation

Reserved

Number of charged bytes

The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when thePool Tracking option of Driver Verifier is active.

0x53,

0x54,

or 0x59

Base address of allocation

Reserved

The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when thePool Tracking option of Driver Verifier is active.

0x60

Bytes allocated from paged pool

Bytes allocated from nonpaged pool

Total number of allocations that were not freed

The driver is unloading without first freeing its pool allocations. A bug check with this parameter occurs only when thePool Tracking option of Driver Verifier is active.

0x61

Bytes allocated from paged pool

Bytes allocated from nonpaged pool

Total number of allocations that were not freed

A driver thread is attempting to allocate pool memory while the driver is unloading. A bug check with this parameter occurs only when thePool Tracking option of Driver Verifier is active.

0x62

Name of the driver

Reserved

Total number of allocations that were not freed, including both paged and nonpaged pool

The driver is unloading without first freeing its pool allocations. A bug check with this parameter occurs only when thePool Tracking option of Driver Verifier is active.

0x70

Current IRQL

MDL address

Access mode

The driver called MmProbeAndLockPages with IRQL > DISPATCH_LEVEL.

0x71

Current IRQL

MDL address

Process address

The driver called MmProbeAndLockProcessPages with IRQL > DISPATCH_LEVEL.

0x72

Current IRQL

MDL address

Process address

The driver called MmProbeAndLockSelectedPages with IRQL > DISPATCH_LEVEL.

0x73

Current IRQL

In 32-bit Windows: Low 32 bits of the physical address

In 64-bit Windows: the 64-bit physical address

Number of bytes

The driver called MmMapIoSpace with IRQL > DISPATCH_LEVEL.

0x74

Current IRQL

MDL address

Access mode

The driver called MmMapLockedPages in kernel mode with IRQL > DISPATCH_LEVEL.

0x75

Current IRQL

MDL address

Access mode

The driver called MmMapLockedPages in user mode with IRQL > APC_LEVEL.

0x76

Current IRQL

MDL address

Access mode

The driver called MmMapLockedPagesSpecifyCache in kernel mode with IRQL > DISPATCH_LEVEL.

0x77

Current IRQL

MDL address

Access mode

The driver called MmMapLockedPagesSpecifyCache in user mode with IRQL > APC_LEVEL.

0x78

Current IRQL

MDL address

The driver called MmUnlockPages with IRQL > DISPATCH_LEVEL.

0x79

Current IRQL

Virtual address being unmapped

MDL address

The driver called MmUnmapLockedPages in kernel mode with IRQL > DISPATCH_LEVEL.

0x7A

Current IRQL

Virtual address being unmapped

MDL address

The driver called MmUnmapLockedPages in user mode with IRQL > APC_LEVEL.

0x7B

Current IRQL

Virtual address being unmapped

Number of bytes

The driver called MmUnmapIoSpace with IRQL > APC_LEVEL.

0x7C

MDL address

MDL flags

The driver called MmUnlockPages, and passed an MDL whose pages were never successfully locked.

0x7D

MDL address

MDL flags

The driver called MmUnlockPages, and passed an MDL whose pages are from nonpaged pool.

(These should never be unlocked.)

0x7E

Current IRQL

DISPATCH_LEVEL

The driver called MmAllocatePagesForMdl, MmAllocatePagesForMdlEx, or MmFreePagesFromMdl with IRQL > DISPATCH_LEVEL.

0x7F

Current IRQL

MDL address

MDL flags

The driver called BuildMdlForNonPagedPool and passed an MDL whose pages are from paged pool.

0x80

Current IRQL

Event address

The driver called KeSetEvent with IRQL > DISPATCH_LEVEL.

0x81

MDL address

MDL flags

The driver called MmMapLockedPages.

(You should use MmMapLockedPagesSpecifyCache instead, with the BugCheckOnFailure parameter set toFALSE.)

0x82

MDL address

MDL flags

The driver called MmMapLockedPagesSpecifyCache with the BugCheckOnFailure parameter equal toTRUE.

(This parameter should be set to FALSE.)

0x83

Start of physical address range to map

Number of bytes to map

First page frame number that isn't locked down

The driver called MmMapIoSpace without having locked down the MDL pages. The physical pages represented by the physical address range being mapped must have been locked down prior to making this call.

0x85

MDL address

Number of pages to map

First page frame number that isn't locked down

The driver called MmMapLockedPages without having locked down the MDL pages.

0x89

MDL address

Pointer to the non-memory page in the MDL

The non-memory page number in the MDL

An MDL is not marked as "I/O", but it contains non-memory page addresses.

0x91

Reserved

The driver switched stacks using a method that is not supported by the operating system. The only supported way to extend a kernel mode stack is by usingKeExpandKernelStackAndCallout.

0xA0 (Windows Server 2003 and later operating systems only)

Pointer to the IRP making the read or write request

Device object of the lower device

Number of the sector in which the error was detected

A cyclic redundancy check (CRC) error was detected on a hard disk. A bug check with this parameter occurs only when theDisk Integrity Checking option of Driver Verifier is active.

0xA1 (Windows Server 2003 and later operating systems only)

Copy of the IRP making the read or write request. (The actual IRP has been completed.)

Device object of the lower device

Number of the sector in which the error was detected

A CRC error was detected on a sector (asynchronously). A bug check with this parameter occurs only when theDisk Integrity Checking option of Driver Verifier is active.

0xA2 (Windows Server 2003 and later operating systems only)

IRP making the read or write request, or a copy of this IRP

Device object of the lower device

Number of the sector in which the error was detected

The CRCDISK checksum copies don't match. This could be a paging error. A bug check with this parameter occurs only when theDisk Integrity Checking option of Driver Verifier is active.

0xB0 (Windows Vista and later operating systems only)

MDL address

MDL flags

Incorrect MDL flags

The driver called MmProbeAndLockPages for an MDL with incorrect flags. For example, the driver passed an MDL created byMmBuildMdlForNonPagedPool to MmProbeAndLockPages.

0xB1 (Windows Vista and later operating systems only)

MDL address

MDL flags

Incorrect MDL flags

The driver called MmProbeAndLockProcessPages for an MDL with incorrect flags. For example, the driver passed an MDL created byMmBuildMdlForNonPagedPool to MmProbeAndLockProcessPages.

0xB2 (Windows Vista and later operating systems only)

MDL address

MDL flags

Incorrect MDL flags

The driver called MmMapLockedPages for an MDL with incorrect flags. For example, the driver passed an MDL that is already mapped to a system address or that was not locked toMmMapLockedPages.

0xB3 (Windows Vista and later operating systems only)

MDL address

MDL flags

Missing MDL flags (at least one was expected)

The driver called MmMapLockedPages for an MDL with incorrect flags. For example, the driver passed an MDL that is not locked toMmMapLockedPages.

0xB4 (Windows Vista and later operating systems only)

MDL address

MDL flags

Unexpected partial MDL flag

The driver called MmUnlockPages for a partial MDL. A partial MDL is one that was created byIoBuildPartialMdl.

0xC0 (Windows Vista and later operating systems only)

Address of the IRP

Reserved

The driver called IoCallDriver with interrupts disabled.

0xC1 (Windows Vista and later operating systems only)

Address of the driver dispatch routine

Reserved

A driver dispatch routine was returned with interrupts disabled.

0xC2 (Windows Vista and later operating systems only)

Reserved

The driver called a Fast I/O dispatch routine after interrupts were disabled.

0xC3 (Windows Vista and later operating systems only)

Address of the driver Fast I/O dispatch routine

Reserved

A driver Fast I/O dispatch routine was returned with interrupts disabled.

0xC5 (Windows Vista and later operating systems only)

Address of the driver dispatch routine

The current thread's APC disable count

The thread's APC disable count prior to calling the driver dispatch routine

A driver dispatch routine has changed the thread's APC disable count.

The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a mutex.

The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem.

Because these calls should always be in pairs, the APC disable count should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.

0xC6 (Windows Vista and later operating systems only)

Address of the driver Fast I/O dispatch routine

Current thread's APC disable count

The thread's APC disable count prior to calling the Fast I/O driver dispatch routine

A driver Fast I/O dispatch routine has changed the thread's APC disable count.

The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a mutex.

The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem.

0xCA (Windows Vista and later operating systems only)

Address of the lookaside list

Reserved

The driver has attempted to re-initialize a lookaside list.

0xCB (Windows Vista and later operating systems only)

Address of the lookaside list

Reserved

The driver has attempted to delete an uninitialized lookaside list.

0xCC (Windows Vista and later operating systems only)

Address of the lookaside list

Starting address of the pool allocation

Size of the pool allocation

The driver has attempted to free a pool allocation that contains an active lookaside list.

0xCD (Windows Vista and later operating systems only)

Address of the lookaside list

Block size specified by the caller

Minimum supported block size

The driver has attempted to create a lookaside list with an allocation block size that is too small.

0xD0 (Windows Vista and later operating systems only)

Address of the ERESOURCE structure

Reserved

The driver has attempted to re-initialize an ERESOURCE structure.

0xD1 (Windows Vista and later operating systems only)

Address of the ERESOURCE structure

Reserved

The driver has attempted to delete an uninitialized ERESOURCE structure.

0xD2 (Windows Vista and later operating systems only)

Address of the ERESOURCE structure

Starting address of the pool allocation

Size of the pool allocation

The driver has attempted to free a pool allocation that contains an active ERESOURCE structure.

0xD5 (Windows Vista and later operating systems only)

Address of the IO_REMOVE_LOCK structure created by the checked build version of the driver

Current IoReleaseRemoveLock tag

Reserved

The current IoReleaseRemoveLock tag does not match the previous IoAcquireRemoveLock tag. If the driver calling IoReleaseRemoveLock is not in a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A bug check with this parameter occurs only when theI/O Verification option of Driver Verifier is active.

0xD6 (Windows Vista and later operating systems only)

Address of the IO_REMOVE_LOCK structure created by the checked build version of the driver

Tag that does not match previous IoAcquireRemoveLock tag

Previous IoAcquireRemoveLock tag

The current IoReleaseRemoveLockAndWait tag does not match the previous IoAcquireRemoveLock tag. If the driver calling IoReleaseRemoveLock is not a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A bug check with this parameter occurs only when theI/O Verification option of Driver Verifier is active.

0xD7 (Windows 7 operating systems and later only)

Address of the checked build Remove Lock structure that is used internally by Driver Verifier

Address of the Remove Lock structure that is specified by the driver

Reserved

A Remove Lock cannot be re-initialized, even after it calls IoReleaseRemoveLockAndWait, because other threads might still be using that lock (by callingIoAcquireRemoveLock). The driver should allocate the Remove Lock inside its device extension, and initialize it a single time. The lock will be deleted together with the device extension.

0xDA (Windows Vista and later operating systems only)

Starting address of the driver

WMI callback address inside the driver

Reserved

An attempt was made to unload a driver that has not deregistered its WMI callback function.

0xDB (Windows Vista and later operating systems only)

Address of the device object

Reserved

An attempt was made to delete a device object that was not deregistered from WMI.

0xDC (Windows Vista and later operating systems only)

Reserved

An invalid RegHandle value was specified as a parameter of the function EtwUnregister.

0xDD (Windows Vista and later operating systems only)

Address of the call to EtwRegister

Starting address of the unloading driver

For Windows 8Windows 8 and later versions, this parameter is the ETW RegHandle value.

An attempt was made to unload a driver without calling EtwUnregister.

0xDF (Windows 7 operating systems and later only)

Synchronization object address

The synchronization object is in session address space. Synchronization objects are not allowed in session address space because they can be manipulated from another session or from system threads that have no session virtual address space.

0xE0 (Windows Vista and later operating systems only)

User-mode address that is used as a parameter

Size ,in bytes, of the address range that is used as a parameter

Reserved

A call was made to an operating system kernel function that specified a user-mode address as a parameter.

0xE1 (Windows Vista and later operating systems only)

Address of the synchronization object

Reserved

A synchronization object was found to have an address that was either invalid or pageable.

0xE2 (Windows Vista and later operating systems only)

Address of the IRP

User-mode address present in the IRP

Reserved

An IRP with Irp->RequestorMode set to KernelMode was found to have a user-mode address as one of its members.

0xE3 (Windows Vista and later operating systems only)

Address of the call to the API

User-mode address used as a parameter in the API

Reserved

A driver has made a call to a kernel-mode ZwXxx routine with a user-mode address as a parameter.

0xE4 (Windows Vista and later operating systems only)

Address of the call to the API

Address of the malformed UNICODE_STRING structure

Reserved

A driver has made a call to a kernel-mode ZwXxx routine with a malformed UNICODE_STRING structure as a parameter.

0xE5 (Windows Vista and later operating systems only)

Current IRQL

Reserved

A call was made to a Kernel API at the incorrect IRQL.

0xEA (Windows Vista and later operating systems only)

Current IRQL

The thread's APC disable count

Address of the pushlock

A driver has attempted to acquire a pushlock while APCs are enabled.

0xEB (Windows Vista and later operating systems only)

Current IRQL

The thread's APC disable count

Address of the pushlock

A driver has attempted to release a pushlock while APCs are enabled.

0xF0 (Windows Vista and later operating systems only)

Address of the destination buffer

Address of the source buffer

Number of bytes to copy

A driver called the memcpy function with overlapping source and destination buffers.

0xF5 (Windows Vista and later operating systems only)

Address of the NULL handle

Object type

Reserved

A driver passed a NULL handle to ObReferenceObjectByHandle.

0xF6 (Windows 7 operating systems and later)

Handle value being referenced

Address of the current process

Address inside the driver that performs the incorrect reference

A driver references a user-mode handle as kernel mode.

0xF7 (Windows 7 operating systems and later)

Handle value specified by the caller

Object type specified by the caller

AccessMode specified by the caller

A driver is attempting a user-mode reference for a kernel handle in the context of the system process.

0xFA (Windows 7 operating systems and later)

Completion routine address.

IRQL value before it calls the completion routine

Current IRQL value, after it calls the completion routine

The IRP completion routine returned at an IRQL that was different from the IRQL the routine was called at.

0xFB (Windows 7 operating systems and later)

Completion routine address

Current thread's APC disable count

The thread's APC disable count before it calls the IRP completion routine

The thread's APC disable count was changed by the driver's IRP completion routine.

The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a mutex.

The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem.

0x105

(Windows 7 operating systems and later)

Address of the IRP

The driver uses ExFreePool instead of IoFreeIrp to release the IRP.

0x10A

(Windows 7 operating systems and later)

The driver attempts to charge pool quota to the Idle process.

0x10B

(Windows 7 operating systems and later)

The driver attempts to charge pool quota from a DPC routine. This is incorrect because the current process context is undefined.

0x110

(Windows 7 operating systems and later)

Address of the Interrupt Service Routine

Address of the extended context that was saved before it executed the ISR

Address of the extended context was saved after it executed the ISR

The interrupt service routine (ISR) for the driver has corrupted the extended thread context.

0x115

(Windows 7 operating systems and later)

The address of the thread that is responsible for the shutdown, which might be deadlocked

Driver Verifier detected that the system has taken longer than 20 minutes and shutdown is not complete.

0x11A

(Windows 7 operating systems and later)

Current IRQL

The driver calls KeEnterCriticalRegion at IRQL > APC_LEVEL.

0x11B

(Windows 7 operating systems and later)

Current IRQL

The driver calls KeLeaveCriticalRegion at IRQL > APC_LEVEL.

0x120

(Windows 7 operating systems and later)

Address of the IRQL value

Address of the Object to wait on

Address of Timeout value

The thread waits at IRQL > DISPATCH_LEVEL. Callers of KeWaitForSingleObject or KeWaitForMultipleObjects must run at IRQL <= DISPATCH_LEVEL.

0x121

(Windows 7 operating systems and later)

Address of the IRQL value

Address of the Object to wait on

Address of Timeout value

The thread waits at IRQL equals DISPATCH_LEVEL and the Timeout is NULL. Callers of KeWaitForSingleObject or KeWaitForMultipleObjects can run at IRQL <= DISPATCH_LEVEL. If aNULL pointer is supplied for Timeout, the calling thread remains in a wait state until the Object is signaled.

0x122

(Windows 7 operating systems and later)

Address of the IRQL value

Address of the Object to wait on

Address of the Timeout value

The thread waits at DISPATCH_LEVEL and Timeout value is not equal to zero (0). If the Timeout != 0, the callers of KeWaitForSingleObject or KeWaitForMultipleObjects must run at IRQL <= APC_LEVEL.

0x123

(Windows 7 operating systems and later)

Address of the Object to wait on

The caller of KeWaitForSingleObject or KeWaitForMultipleObjects specified the wait asUserMode, but the Object is on the kernel stack.

0x130

(Windows 7 operating systems and later)

Address of work item

The work item is in session address space. Work items are not allowed in session address space because they can be manipulated from another session or from system threads that have no session virtual address space.

0x131

(Windows 7 operating systems and later)

Address of work item

The work item is in pageable memory. Work items have to be in nonpageable memory because the kernel uses them at DISPATCH_LEVEL.

0x135

Address of IRP

Number of milliseconds allowed between the IoCancelIrp call and the completion for this IRP

The canceled IRP did not completed in the expected time The driver took longer than expected to complete the canceled IRP.

0x13A

Address of the pool block being freed

Incorrect value

Address of the incorrect value

The driver has called ExFreePool and Driver Verifier detects an error in one of the internal values that is used to track pool usage.

0x13B

Address of the pool block being freed

Address of the incorrect value

Address of a pointer to the incorrect memory page

The driver has called ExFreePool and Driver Verifier detects an error in one of the internal values that is used to track pool usage.

0x13C

Address of the pool block being freed

Incorrect value

Address of the incorrect value

The driver has called ExFreePool and Driver Verifier detects an error in one of the internal values that is used to track pool usage.

0x13D

Address of the pool block being freed

Address of the incorrect value

Correct value that was expected

The driver has called ExFreePool and Driver Verifier detects an error in one of the internal values that is used to track pool usage.

0x13E

Pool block address specified by the caller

Pool block address tracked by Driver Verifier

Pointer to the pool block address that is tracked by Driver Verifier

The pool block address specified by the caller of ExFreePool is different from the address tracked by Driver Verifier.

0x13F

Address of the pool block being freed

Number of bytes being freed

Pointer to the number of bytes tracked by Driver Verifier

The number of bytes of memory being freed in the call to ExFreePool is different from the number of bytes tracked by Driver Verifier.

0x1000 (Windows XP and later operating systems only)

Address of the resource

Reserved

Self-deadlock: The current thread has tried to recursively acquire a resource. A bug check with this parameter occurs only when theDeadlock Detection option of Driver Verifier is active.

0x1001 (Windows XP and later operating systems only)

Address of the resource that was the final cause of the deadlock

Reserved

Deadlock: A lock hierarchy violation has been found. A bug check with this parameter occurs only when theDeadlock Detection option of Driver Verifier is active.

(Use the !deadlock extension for further information.)

0x1002 (Windows XP and later operating systems only)

Address of the resource

Reserved

Uninitialized resource: A resource has been acquired without having been initialized first. A bug check with this parameter occurs only when theDeadlock Detection option of Driver Verifier is active.

0x1003 (Windows XP and later operating systems only)

Address of the resource that is being released deadlocked

Address of the resource that should have been released first

Reserved

Unexpected release: A resource has been released in an incorrect order. A bug check with this parameter occurs only when theDeadlock Detection option of Driver Verifier is active.

0x1004 (Windows XP and later operating systems only)

Address of the resource

Address of the thread that acquired the resource

Address of the current thread

Unexpected thread: The wrong thread releases a resource. A bug check with this parameter occurs only when theDeadlock Detection option of Driver Verifier is active.

0x1005 (Windows XP and later operating systems only)

Address of the resource

Reserved

Multiple initialization: A resource is initialized more than one time. A bug check with this parameter occurs only when theDeadlock Detection option of Driver Verifier is active.

0x1007 (Windows XP and later operating systems only)

Address of the resource

Reserved

Unacquired resource: A resource is released before it has been acquired. A bug check with this parameter occurs only when theDeadlock Detection option of Driver Verifier is active.

0x1008

(Windows 7 operating systems and later)

Lock address

Driver Verifier internal data

The driver tried to acquire a lock by using an API that is mismatched for this lock type.

0x1009

(Windows 7 operating systems and later)

Lock address

Driver Verifier internal data

The driver tried to release a lock by using an API that is mismatched for this lock type.

0x100A

(Windows 7 operating systems and later)

Owner thread address

Driver Verifier internal data

The terminated thread owns the lock.

0x100B

(Windows 7 operating systems and later)

Lock address

Owner thread address

Driver Verifier internal address

The deleted lock is still owned by a thread.

0xA001

(Windows 8.1 operating systems and later)

A pointer to the NetBufferList object

A pointer to the virtual switch object (if NON-NULL)

Reserved (unused)

VM Switch: The SourceHandle for the caller-supplied NetBufferList must be set. See theAllocateNetBufferListForwardingContext routine.

0xA002

(Windows 8.1 operating systems and later)

A pointer to the NetBufferList object

A pointer to the virtual switch object (if NON-NULL).

Reserved (unused)

VM Switch: The caller supplied NetBufferList's forwarding detail is not zero. See theAllocateNetBufferListForwardingContext routine.

0xA003

(Windows 8.1 operating systems and later)

A pointer to the NetBufferList object

A pointer to the virtual switch object (if NON-NULL).

Reserved (unused)

VM Switch: The caller supplied a NetBufferList with packet header or routing context that is NULL. SeePacket Management Guidelines for the Extensible Switch Data Path.

0xA004

(Windows 8.1 operating systems and later)

ID of invalid port

NIC Index

A pointer to the virtual switch object (if NON-NULL).

VM Switch: The caller specified an invalid Port and NIC index combination. SeeHyper-V Extensible Switch Port and Network Adapter States.

0xA005

(Windows 8.1 operating systems and later)

A pointer to the NetBufferList object

A pointer to the Destination list.

A pointer to the virtual switch object (if NON-NULL).

VM Switch: The caller supplied an invalid destination. See AddNetBufferListDestination and UpdateNetBufferListDestinations.

0xA006

(Windows 8.1 operating systems and later)

A pointer to the NetBufferList object

A pointer to the virtual switch object (if NON-NULL).

Reserved (unused)

VM Switch: The caller supplied an invalid source NIC or Port object. See Hyper-V Extensible Switch Port and Network Adapter States.

0xA007

(Windows 8.1 operating systems and later)

A pointer to the NetBufferList object

A pointer to the virtual switch object (if NON-NULL).

Reserved (unused)

VM Switch: The caller supplied an invalid destination list. See AddNetBufferListDestination and UpdateNetBufferListDestinations.

0xA008

(Windows 8.1 operating systems and later)

Parent NIC object

NIC index

A pointer to the virtual switch object (if NON-NULL).

VM Switch: Attempting to reference a NIC when not allowed. See Hyper-V Extensible Switch Port and Network Adapter States.

0xA009

(Windows 8.1 operating systems and later)

Port being referenced

A pointer to the virtual switch object (if NON-NULL)

Reserved (unused)

VM Switch: Attempt to reference a port when not allowed. See Hyper-V Extensible Switch Port and Network Adapter States.

0xA00A

(Windows 8.1 operating systems and later)

A pointer to the NetBufferList object

ContextTypeInfo object

Reserved (unused)

VM Switch: Failure context is already set. See SetNetBufferListSwitchContext.

0xA00B

(Windows 8.1 operating systems and later)

A pointer to the NetBufferList object

NDIS_SWITCH_REPORT_FILTERED_NBL_FLAGS_*

A pointer to the virtual switch object (if NON-NULL)

VM Switch: Invalid direction provided for dropped NetBufferList. See ReportFilteredNetBufferLists.

0xA00C

(Windows 8.1 operating systems and later)

A pointer to the NetBufferList object

Send Flags value

A pointer to the virtual switch object (if NON-NULL)

VM Switch: NetBufferList chain has multiple source ports when NDIS_SEND_FLAGS_SWITCH_SINGLE_SOURCE flag is set. SeeHyper-V Extensible Switch Send and Receive Flags.

0xA00D

(Windows 8.1 operating systems and later)

A pointer to the NetBufferList object

A pointer to the virtual switch context

A pointer to the virtual switch object (if NON-NULL)

VM Switch: One or more NetBufferLists in chain have invalid destination when NDIS_RECEIVE_FLAGS_SWITCH_DESTINATION_GROUP flag is set. SeeHyper-V Extensible Switch Send and Receive Flags.

0x2000

(Windows 7 operating systems and later)

The first argument passed to the StorPortInitialize routine. This parameter is a pointer to the driver object that the operating system passed to the miniport driver in the first argument of the miniport driver'sDriverEntry routine.

The second argument passed to the StorPortInitialize routine. This parameter is a pointer to context information that the operating system passed to the miniport driver in the second argument of the miniport driver'sDriverEntry routine.

Reserved

The Storport miniport driver passed a bad argument (a NULL pointer) to theStorPortInitialize routine.

0x00020002

(Windows 8 operating systems and later)