Fuente: Microsoft Corp.
  Error Codes in Windows NT
14/Dic/97
NT  FeBI

 Códigos bug de Windows NT (Stop Codes)

 

 
 
 
 
 
 
 
 

This Microsoft´s article contains a list of bug codes, listed in order of bug code number. Some codes include parameter definitions and explanations.

Bug codes with no descriptions are usually from checked builds of Windows NT. If you receive one of these codes, run the kernel debugger, and type the following commands:
    kb
    !process 0 7
    !vm
    !errlog

NOTE: BUGCODES.H and EXLEVELS.H are both in the Windows NT DDK.

List of Bug Codes

Code Name Value Description
APC_INDEX_MISMATCH  (0x1) This is a kernel internal error. This error could be caused by a  mismatch between EnterCricticalRegion and KeLeaveCriticalRegion  in a file system.
DEVICE_QUEUE_NOT_BUSY  (0x2)
INVALID_AFFINITY_SET  (0x3)
INVALID_DATA_ACCESS_TRAP  (0x4)
INVALID_PROCESS_ATTACH_ATTEMPT  (0x5)
INVALID_PROCESS_DETACH_ATTEMPT  (0X6)
INVALID_SOFTWARE_INTERRUPT  (0x7)
IRQL_NOT_DISPATCH_LEVEL  (0x8)
IRQL_NOT_GREATER_OR_EQUAL  (0x9)
IRQL_NOT_LESS_OR_EQUAL  (0xA) An attempt was made to touch pageable memory at a process internal  request level (IRQL) that is too high. This error is usually caused by  drivers using improper addresses. If the kernel debugger is available, get a stack back trace. 

Parameters: 

  • 1 - Memory referenced 
  • 2 - IRQL
  • 3 - Value: 0 = read operation, 1 = write operation 
  • 4 - Address that referenced memory
NO_EXCEPTION_HANDLING_SUPPORT  (0xB)
MAXIMUM_WAIT_OBJECTS_EXCEEDED  (0xC)
MUTEX_LEVEL_NUMBER_VIOLATION  (0xD) Try to identify the mutexes using the NTOS\EX\EXLEVELS.H header file.  You should be able to pinpoint the mutexes that are getting acquired  in an incorrect sequence. 

Parameters: 

  1. Current thread's mutex level
  2. Mutex level attempting to acquire
NO_USER_MODE_CONTEXT  (0xE)
SPIN_LOCK_ALREADY_OWNED  (0xF)
SPIN_LOCK_NOT_OWNED  (0x10)
THREAD_NOT_MUTEX_OWNER  (0x11)
TRAP_CAUSE_UNKNOWN  (0x12)
EMPTY_THREAD_REAPER_LIST  (0x13)
CREATE_DELETE_LOCK_NOT_LOCKED  (0x14)
LAST_CHANCE_CALLED 
_FROM_KMODE 		 (0x15)
CID_HANDLE_CREATION  (0x16)
CID_HANDLE_DELETION  (0x17)
REFERENCE_BY_POINTER  (0x18)
BAD_POOL_HEADER  (0x19)
MEMORY_MANAGEMENT  (0x1A)
PFN_SHARE_COUNT  (0x1B)
PFN_REFERENCE_COUNT  (0x1C)
NO_SPIN_LOCK_AVAILABLE  (0x1D)
KMODE_EXCEPTION_NOT_HANDLED  (0x1E) This is a very common bug code. Usually the exception address  pinpoints the driver or function that caused the problem. Always note  this address as well as the link date of the driver or image that  contains this address. A common error is exception code 0x80000003.  This error means a hard-coded breakpoint or assertion was hit, but the  system was booted with the /NODEBUG switch. This problem should not  occur very often. If it occurs repeatedly, make sure a debugger is  connected and the system is booted with the /DEBUG switch.  On non-Intel systems, if the address of the exception is 0XBFC0304,  the bug code is the result of a cache-parity error on the CPU. If the  problem reoccurs frequently, contact the hardware manufacturer. 

Parameters: 

  1. The exception code that was not handled
  2. The address at which the exception occurred
  3. Parameter 0 of the exception
  4. Parameter 1 of the exception
SHARED_RESOURCE_CONV_ERROR  (0x1F)
KERNEL_APC_PENDING_DURING_EXIT  (0x20) The key data item is the thread's APC disable count. If the count is  nonzero, it is the source of the problem. A negative value indicates  that a file system has called FsRtlEnterFileSystem more times than  FsRtlExitFileSystem. A positive value indicates that the reverse is  true. If you see this situation, check all file systems installed on  the machine. Third-party redirectors are especially suspect since they  do not receive the heavy-duty testing that NTFS, FAT, HPFS, and RDR  receive.  The current IRQL should also be 0. If it is not, a driver's  cancellation routine can cause this bug code by returning at an  elevated IRQL. Always try to note what you were doing or closing  and note all the installed drivers at the time of the bug code. This  symptom is usually caused by a severe bug in a third-party driver. 

Parameters: 

  1. The address of the APC found pending during exit
  2. The thread's APC disable count
  3. The current
IRQL QUOTA_UNDERFLOW  (0x21)
FILE_SYSTEM  (0x22)
FAT_FILE_SYSTEM  (0x23)
NTFS_FILE_SYSTEM  (0x24)
NPFS_FILE_SYSTEM  (0x25)
CDFS_FILE_SYSTEM  (0x26)
RDR_FILE_SYSTEM  (0x27)
CORRUPT_ACCESS_TOKEN  (0x28)
SECURITY_SYSTEM  (0x29)
INCONSISTENT_IRP  (0x2A) An IRP was encountered that was in an inconsistent state; that is,  some field or fields of the IRP were inconsistent with the remaining  state of the IRP--for example, an IRP that was being completed, but  was still marked as being queued for a driver's device queue. This bug  code is not currently being used in the system, but exists for  debugging purposes. 

Parameter: 

  1. Address of the IRP that was found to be inconsistent
PANIC_STACK_SWITCH  (0x2B) This error indicates that the kernel mode stack was overrun. This  error normally occurs when a kernel mode driver uses too much stack  space. It can also occur when serious data corruption occurs in the  kernel.
PORT_DRIVER_INTERNAL  (0x2C)
SCSI_DISK_DRIVER_INTERNAL  (0x2D)
DATA_BUS_ERROR  (0x2E) This bug code is normally caused by a parity error in the system  memory. This error can also be caused by a driver accessing a  0x8XXXXXXX address that does not exist. 

 Parameters: 

  1. Virtual address that caused the fault
  2. Physical address that caused the fault 
  3. Processor status register (PSR)
  4. Faulting instruction register (FIR)
INSTRUCTION_BUS_ERROR  (0x2F)
SET_OF_INVALID_CONTEXT  (0x30)
PHASE0_INITIALIZATION_FAILED  (0x31) System initialization failed early on. The kernel debugger is required  to make sense of this error, since this code tells you almost nothing.
PHASE1_INITIALIZATION_FAILED  (0x32) Parameters: 
  1. Windows NT status code that describes why the system thinks  initialization failed
  2. Indicates location within INIT.C where phase 1 initialization  failure occurred
UNEXPECTED_INITIALIZATION_CALL  (0x33)
CACHE_MANAGER  (0x34)
NO_MORE_IRP_STACK_LOCATIONS  (0x35) A higher level driver has attempted to call a lower level driver  through the IoCallDriver()interface, but there are no more stack  locations in the packet, so the lower level driver would not be able  to access its parameters, as there are no parameters for it. This is a  disastrous situation, since the higher level driver thinks it has  filled in the parameters for the lower level driver (something it MUST  do before calling the lower level driver); however, since there is no  stack location for the latter driver, the former has written off of the  end of the packet. This means that some other memory has probably been  corrupted. 

Parameter: 

  1. Address of the ¿¿¿DEVICE OBJECT???
IRP DEVICE_REFERENCE_ 
COUNT_NOT_ZERO		 (0x36) A device driver has attempted to delete one of its device objects from   the system but the reference count for that object was nonzero,   meaning there were still outstanding references to the device. (The   reference count indicates the number of reasons why this device object   cannot be deleted.) This is a bug in the calling device driver. 

Parameter: 

  1. Address of the device object 
FLOPPY_INTERNAL_ERROR  (0x37)
SERIAL_DRIVER_INTERNAL  (0x38)
SYSTEM_EXIT_OWNED_MUTEX  (0x39)
SYSTEM_UNWIND_PREVIOUS_USER  (0x3A)
SYSTEM_SERVICE_EXCEPTION  (0x3B)
INTERRUPT_UNWIND_ATTEMPTED  (0x3C)
INTERRUPT_EXCEPTION_NOT_HANDLED (0x3D)
MULTIPROCESSOR_CONFIGURATION 
_NOT_SUPPORTED		 (0x3E) The system has multiple processors, but they are asymmetric in relation   to one another. To be symmetric, all processors must be of the same   type and level. For example, trying to mix a Pentium-level processor   with an 80486 would cause this error. Additionally, on x86 systems,   floating-point capabilities must be present on all or no processors. 
NO_MORE_SYSTEM_PTES  (0x3F) No System PTEs left. Usually caused by a driver not cleaning up   properly. If kernel debugger is available, get a stack trace and enter   the following command:   !sysptes 3 
TARGET_MDL_TOO_SMALL  (0x40) A driver has called the IoBuildPartialMdl()function and passed it an   MDL to map part of a source MDL, but the target MDL is not large   enough to map the entire range of addresses requested. This is a   driver bug. The source and target MDLs, as well as the address range   length to be mapped, are the arguments to the IoBuildPartialMdl()   function:   IoBuildPartialMdl( IN PMDL SourceMdl,   IN OUT PMDL TargetMdl,   IN PVOID VirtualAddress,   IN ULONG Length ) 
MUST_SUCCEED_POOL_EMPTY  (0x41) If kernel debugger is available, the VM command lists various sizes. 

Parameters: 

  1. Size of the request that could not be satisfied
  2. Number of pages used of nonpaged pool
  3. Number of too large PAGE_SIZE requests from nonpaged pool
  4. Number of pages available 
ATDISK_DRIVER_INTERNAL  (0x42)
NO_SUCH_PARTITION  (0x43)
MULTIPLE_IRP_COMPLETE_REQUESTS  (0x44) A driver has requested that an IRP be completed [IoCompleteRequest()],   but the packet has already been completed. This is a difficult bug to find because the easiest case, a driver actually attempted to complete its own packet twice, is generally not what happened. Rather, two   separate drivers each tries to own the packet, and each attempts to   complete it. The first actually works, and the second fails. Tracking down which drivers in the system actually did this is difficult, because the tracks of the first driver have been covered by the second. However, the driver stack for the current request can be found by examining the DeviceObject fields in each of the stack locations. 

Parameter: 

  1. Address of the IRP 
INSUFFICIENT_SYSTEM_MAP_REGS  (0x45)
DEREF_UNKNOWN_LOGON_SESSION  (0x46)
REF_UNKNOWN_LOGON_SESSION  (0x47)
CANCEL_STATE_IN_COMPLETED_IRP  (0x48) This error indicates that an I/O Request Packet (IRP)that is to be   canceled has a cancel routine specified in it, meaning the packet is   in a state in which the packet can be canceled. However, the packet no   longer belongs to a driver, as it has entered I/O completion. This is   either a driver bug, or more than one driver is accessing the same   packet, which is not likely and much more difficult to debug. 

Parameter: 

  1. Pointer to the IRP 
PAGE_FAULT_WITH_INTERRUPTS_OFF  (0x49) This means exactly what it says. Treat it as a case of 0x0A above. 
IRQL_GT_ZERO_AT_SYSTEM_SERVICE  (0x4A)
STREAMS_INTERNAL_ERROR  (0x4B)
FATAL_UNHANDLED_HARD_ERROR  (0x4C) If a hard error occurs during system boot before Windows NT is up, and   it is a real error, the system will halt with a blue screen.   The following are some common cases: 
  • x218 - A necessary registry hive file could not be loaded. The hive   file may be corrupted or missing. The Emergency Repair disk may be required to recover from this. The driver may have corrupted the registry data while loading into memory, or the memory where the registry file was loaded is not actually memory. In particular, AST EISA machines with 16 MB or more of memory must have access to the memory above 16 MB that is ENABLED in the EISA configuration utility, or the registry file is liable to get loaded in this spot, but will return just 0xffffffff when the memory is read.
  • x21A - Either Winlogon or CSRSS (Windows)died unexpectedly. The exit   code tells more information. Usually it is c0000005, meaning that an unhandled exception crashed either of these processes. There is not much you can do unless this becomes a persistent problem.
  • x221 - This means that a driver is corrupted, or a system DLL was detected to be corrupted. Windows NT does its best to check the integrity of drivers and important system DLLs. A blue screen is displayed with the name of the corrupted file. If this occurs,   boot an alternate operating system, or reinstall if no   alternate exists. Make sure the on-disk file that is listed as bad matches the version on the compact disc and replace it if   necessary. In some cases, random corruption can mean that there is a hardware problem in the I/O path to the file. 
NO_PAGES_AVAILABLE  (0x4D) No free pages available to continue operations. If the kernel debugger   is available, type the following commands: 
  !process 0 7 
  !vm   dd mmpagingfiles   dd @$p   Parameters:   1 - Number of dirty pages   2 - Number of physical pages in machine   3 - Extended commit value in pages   4 - Total commit value in pages 
PFN_LIST_CORRUPT  (0x4E) Caused by corrupting I/O driver structures. If the kernel debugger is   available, get a stack trace. 

Parameters: 

  1. Value 1
  2. ListHead value that was corrupted
  3. Number of pages available
  4. 0
    1. Value 2
    2. Entry in list being removed
    3. Highest physical page number 
    4. Reference count of entry being removed 
NDIS_INTERNAL_ERROR  (0x4F)
PAGE_FAULT_IN_NONPAGED_AREA  (0x50)
REGISTRY_ERROR  (0x51) Something has gone wrong with the registry. If a kernel debugger is   available, get a stack trace. If the stack trace indicates you are in   a system worker thread (CmpWorker will be on the call list), enter the   following kernel debugger commands: 
  dd CmpRegistryMutex+18 L1 
  !thread <whatever value the above command printed out> 
This will give you the thread and stack trace that made the registry   call. 

This error can also indicate that the registry received an I/O error   while trying to read one of its files, so the error can be caused by   hardware problems or file system corruption. It can also occur because   of a failure in a refresh operation that is used only by the security   system, and then only when resource limits are encountered. When you   see this bug code, note whether the machine is a PDC or BDC, and how   many accounts are in its security account manager (SAM) database,   whether it might be a replication target, and whether the volume where   the hive files reside is nearly full. 

Parameters: 

  1. Value 1 (indicates where bug code occurred)
  2. Value 2 (indicates where bug code occurred)
  3. May be pointer to hive
  4. May be return code of HvCheckHive if the hive is corrupted 
MAILSLOT_FILE_SYSTEM  (0x52)
NO_BOOT_DEVICE  (0x53)
LM_SERVER_INTERNAL_ERROR  (0x54)
DATA_COHERENCY_EXCEPTION  (0x55)
INSTRUCTION_COHERENCY 
_EXCEPTION		 (0x56)
XNS_INTERNAL_ERROR  (0x57)
FTDISK_INTERNAL_ERROR  (0x58) The system was booted from a revived primary partition, so the hives   say the mirror is all right, when in fact it is not. The real images of   the hives are on the shadow. You must boot from the shadow. 
PINBALL_FILE_SYSTEM  (0x59)
CRITICAL_SERVICE_FAILED  (0x5A)
SET_ENV_VAR_FAILED  (0x5B)
HAL_INITIALIZATION_FAILED  (0x5C)
HEAP_INITIALIZATION_FAILED  (0x5D)
OBJECT_INITIALIZATION_FAILED  (0x5E)
SECURITY_INITIALIZATION_FAILED  (0x5F)
PROCESS_INITIALIZATION_FAILED  (0x60)
HAL1_INITIALIZATION_FAILED  (0x61)
OBJECT1_INITIALIZATION_FAILED  (0x62)
SECURITY1_INITIALIZATION_FAILED (0x63)
SYMBOLIC_INITIALIZATION_FAILED  (0x64)
MEMORY1_INITIALIZATION_FAILED  (0x65)
CACHE_INITIALIZATION_FAILED  (0x66)
CONFIG_INITIALIZATION_FAILED  (0x67) This means the registry could not allocate the pool needed to contain   the registry files. This error should never occur, since it is early   enough in system initialization that there is always plenty of the   paged pool available. 

Parameters: 

  1. 5
  2. Indicates location in NTOS\CONFIG\CMSYSINI that failed 
FILE_INITIALIZATION_FAILED  (0x68)
IO1_INITIALIZATION_FAILED (0x69) Initialization of the I/O system failed for some reason. There is   practically no other information available. In general, this error   occurs because Setup made some incorrect decisions about the   installation of the system, or the user has reconfigured the system. 
LPC_INITIALIZATION_FAILED  (0x6A)
PROCESS1_INITIALIZATION_FAILED  (0x6B) Parameters: 
  1. Indicates the status code that suggests that Windows NT   initialization failed
  2. Indicates the location in NTOS\PS\PSINIT.C where the failure   was detected 
REFMON_INITIALIZATION_FAILED  (0x6C)
SESSION1_INITIALIZATION_FAILED  (0x6D)
SESSION2_INITIALIZATION_FAILED  (0x6E)
SESSION3_INITIALIZATION_FAILED  (0x6F)
SESSION4_INITIALIZATION_FAILED  (0x70)
SESSION5_INITIALIZATION_FAILED  (0x71) These bug code codes (SESSION1 - SESSION5) indicate the location in   NTOS\INIT\INIT.C where the failure was detected. 

Parameter: 

  1. Indicates the status code that suggests that Windows NT   initialization failed 
ASSIGN_DRIVE_LETTERS_FAILED  (0x72)
CONFIG_LIST_FAILED  (0x73) Indicates that one of the core system hives is corrupted or unreadable.   This hive can be either SOFTWARE, SECURITY, or SAM. 

Parameters: 

  1. 5
  2. 2
  3. Index of hive in list
  4. Pointer to UNICODE_STRING containing file name of hive 
BAD_SYSTEM_CONFIG_INFO  (0x74) This error may indicate that the SYSTEM hive loaded by the   OSLOADER/NTLDR was corrupted. However, this is unlikely, since OSLOADER   checks a hive to make sure it is not corrupted after loading it.   This error may also indicate that some critical registry keys and   values are not present. Booting from LastKnownGood may correct the   problem, but you may need to reinstall or use the Emergency Repair   Disk. 
CANNOT_WRITE_CONFIGURATION  (0x75) This error will occur if the SYSTEM hive files (SYSTEM and SYSTEM.ALT)   cannot be grown to accommodate additional data written into the hive   between registry initialization and phase one initialization (when the   file systems are available). This error usually means there are 0   bytes of free space available on the drive, although it could be caused   by trying to store the registry on a read-only device. 
PROCESS_HAS_LOCKED_PAGES  (0x76) This error is caused by a driver not cleaning up completely after an   I/O operation. 

Parameters: 

  1. Process address
  2. Number of locked pages
  3. Number of private pages
  4. 0 
KERNEL_STACK_INPAGE_ERROR  (0x77) The requested page of kernel data could not be read in. This error is   caused by a bad block in a paging file or a disk controller error (in   extremely rare cases, it is caused by running out of resources,   specifically, the nonpaged pool with a status of c0000009a   [STATUS INSUFFICIENT RESOURCES]).   If the first and second arguments are 0, the stack signature in the   kernel stack was not found. This error is caused by bad hardware.   An I/O status of c000009c (STATUS_DEVICE DATA_ERROR) or C000016AL   (STATUS_DISK OPERATION_FAILED) normally indicates the data could not   be read from the disk due to a bad block. Upon reboot, Autocheck will   run and attempt to map out the bad sector. If the status is C0000185   (STATUS_IO DEVICE_ERROR) and the paging file is on a SCSI disk device,   the cabling and termination should be checked. 

Parameters: 

  1. 0
  2. 0
  3. PTE value at time of error
  4. Address of signature on kernel stack
    1. Status code
    2. I/O status code
    3. Page file number
    4. Offset into page file 
PHASE0_EXCEPTION  (0x78)
MISMATCHED_HAL  (0x79) The HAL revision level and HAL configuration type do not match that of   the kernel or the machine type. This error is probably occurring   because the user has manually updated either NTOSKRNL.EXE or HAL.DLL.   Or, the machine has a multiprocessor (MP) HAL and a uniprocessor (UP)   kernel, or the reverse. 

Parameters: 

  1. Type of mismatch (1, 2, or 3):
  2. The PRCB release levels mismatch (something is out of   date). If this is the case, parameters 2 and 3 are:
  3. 2 - Major PRCB level of NTOSKRNL.EXE
  4. 3 - Major PRCB level of HAL.DLL
  5. The build types mismatch. If this is the case, parameters   2 and 3 are:
  6. 2 - Build type of NTOSKRNL.EXE
  7. 3 - Build type of HAL.DLL.  Build Types are:
    • 0 - Free multiprocessor-enabled build
    • 1 - Checked multiprocessor-enabled build
    • 2 - Free uniprocessor build
    • 3 - Micro Channel Architecture (MCA) computers require a   MCA-specific HAL. If this is the case, parameters 2 and 3   are:
      • 2 - Machine type as detected by NTDETECT.COM   A value of a 2 would mean the computer is MCA.
      • 3 - Machine type that HAL supports   A value of a 2 would mean the HAL is built for MCA. 
KERNEL_DATA_INPAGE_ERROR  (0x7A) The requested page of kernel data could not be read in. This error is   caused by a bad block in the paging file or a disk controller error.   See also KERNEL_STACK_INPAGE_ERROR. 

Parameters: 

  1. Lock type that was held (value 1, 2, 3, or PTE address)
  2. Error status (normally I/O status code)
  3. Current process (virtual address for lock type 3, or PTE)
  4. Virtual address that could not be in-paged 
INACCESSIBLE_BOOT_DEVICE  (0x7B) During the initialization of the I/O system, the driver for the boot   device may have failed to initialize the device that the system is   attempting to boot from, or the file system that is supposed to read   that device may have either failed its initialization or simply not   recognized the data on the boot device as a file system structure. In   the former case, the first argument is the address of a Unicode string   data structure that is the ARC name of the device from which the boot   was being attempted. In the latter case, the first argument is the   address of the device object that could not be mounted.   If this is the initial setup of the system, this error may have  occurred because the system was installed on an unsupported disk or   SCSI controller. Note that some controllers are supported only by   drivers that are in the Windows Driver Library (WDL), which requires   the user to do a custom installation. 
This error can also be caused by the installation of a new SCSI   adapter or disk controller or by repartitioning the disk with the   system partition. If this is the case, on x86 systems, the BOOT.INI   file must be edited; on ARC systems, Setup must be run. For   information on changing BOOT.INI, see the Windows NT Advanced Server   "Administrator's Guide."   If the argument is a pointer to an ARC name string, the format of the   first two (and in this case only) long words will be:   USHORT Length;   USHORT MaximumLength;   PVOID Buffer;   That is, the first long word will contain something like 00800020,   where 20 is the actual length of the Unicode string, and the next long   word will contain the address of buffer. This address will be in   system space, so the high-order bit will be set.   If the argument is a pointer to a device object, the format of the   first word will be:   USHORT Type;   That is, the first word will contain a 0003, where the Type code will   always be 0003.   Note that this makes it immediately obvious whether the argument is a   pointer to an ARC name string or a device object, since a Unicode   string can never have an odd number of bytes, and a device object will   always have a Type code of 3. 

Parameter: 

  1. Pointer to the device object or Unicode string of ARC name 
BUGCODE_PSS_MESSAGE  (0x7C)
INSTALL_MORE_MEMORY  (0x7D) Not enough memory to boot Windows NT (needs 5 MB). 

Parameters: 

  1. Number of physical pages found
  2. Lowest physical page
  3. Highest physical page
  4. 0 
WINDOWS_NT_BANNER  (0x4000007E)
UNEXPECTED_KERNEL_MODE_TRAP  (0x7F) This error means a trap occurred in kernel mode, either a kind of trap   that the kernel is not allowed to have or catch (a bound trap), or a   kind of trap that is always instant death (double fault). The first   number in the bug code parentheses is the number of the trap (8 =   double fault). To learn more about what these traps are, consult an   Intel x86 family manual.   From kernel debugger, a KB and !TRAP on the appropriate frame (which   will be the EBP that goes with a procedure named KiTrap--at least on   x86 machines) will show where the trap was taken. 
NMI_HARDWARE_FAILURE  (0x80) The HAL is supposed to report whatever specific data it has and to   tell the user to call his or her hardware vendor for support. 
SPIN_LOCK_INIT_FAILURE  (0x81)
SETUP_FAILURE  (0x85) (NOTE: Textmode setup no longer uses bugchecks to bail out of serious   error conditions. Therefore, you will never encounter a bugcheck 0x85.   All bugchecks have been replaced with friendlier and (where possible)   more descriptive error messages. Some of the former bugchecks, however,   have simply been replaced by our own bugcheck screen, and the codes for   these error conditions are the same as before. These are documented   below.)

The first extended bugcheck field is a code indicating what the problem   is, and the other fields are used differently depending on that value. 

  1.  What problem:
    • 0:  The OEM HAL font is not a valid .fon format file,   and so setup is unable to display text.   This indicates that vgaxxx.fon on the boot floppy   or CD-ROM is damaged.
    • 1:  Video initialization failed. NO LONGER A BUGCHECK CODE.   This error now has its own error screen, and the   user is only presented with the two relevant   parameters detailed below.   This may indicate that the disk containing vga.sys   (or other video driver appropriate to the machine)   is damaged or that machine has video hardware that   we cannot communicate with.
  2. What failed:
    • 0: NtCreateFile of \device\video0
    • 1: IOCTL_VIDEO_QUERY_NUM_AVAIL_MODES
    • 2: IOCTL_VIDEO_QUERY_AVAIL_MODES
    • 3: Desired video mode not supported. This is indicative of an internal setup error.
    • 4: IOCTL_VIDEO_SET_CURRENT_MODE (unable to set   video mode)
    • 5: IOCTL_VIDEO_MAP_VIDEO_MEMORY
    • 6: IOCTL_VIDEO_LOAD_AND_SET_FONT
  3. Status code from NT API call, if appropriate.  p; 
  4. 2:  Out of memory. NO LONGER A BUGCHECK CODE.   This error now uses a more friendly error screen   that works regardless of how far along in setup we   are. 
  5. 3:  Keyboard initialization failed. NO LONGER A BUGCHECK CODE.   There are now 2 error screens for the two different   possible errors we can get here. This may indicate   that the disk containing the keyboard driver   (i8042prt.sys or kbdclass.sys) is damaged or that   machine has keyboard hardware we cannot communicate with.   It may also mean that the keyboard layout dll could   not be loaded. 
  6. 2 - What failed: 
    • 0: NtCreateFile of \device\KeyboardClass0   failed.   "Setup did not find a keyboard connected to   your computer."
    • 1: Unable to load keyboard layout dll.   "Setup could not load the keyboard layout   file <filename>."   Indicates that the cd or floppy is missing a   file (kbdus.dll for us release, other layout   dlls for localized ones). 
    • 4:  Setup was unable to resolve the ARC device pathname   of the device from which setup was started. This is an internal Setup error.
    • 5:  Partitioning sanity check failed. This indicates a   bug in a disk driver. The parameters are   meaningful only to the setup group. 
MBR_CHECKSUM_MISMATCH  (0x8B) This message occurs during the boot process when the MBR checksum the   system calculates does not match the checksum passed in by the loader.   This is usually an indication of a virus. There are many forms of   viruses and not all can be detected. The newer ones usually can only be   detected by a virus scanner that has recently been upgraded. Boot a   write-protected disk containing a virus scanner and attempt to clean out   the infection. 

KerBugCheckEx parameters: 

  1. Disk Signature from MBR.
  2. MBR check sum calculated by osloader.
  3. MBR checksum calculated by system. 

The following bugcodes are added in Windows NT versions 3.51 and 4.x:

Code Name Value Description
PP0_INITIALIZATION_FAILED  (0x8F) This message occurs if phase 0 initialization of the kernel-mode Plug   and Play Manager failed. There's really nothing going on here that could   cause a failure. 
PP1_INITIALIZATION_FAILED  (0x90) This message occurs if phase 1 initialization of the kernel-mode Plug   and Play Manager failed. This is where we do most of our initialization,   including setting up the environment (registry, etc.) for drivers to   subsequently call during I/O init. The following bugcodes are added in Windows NT version 4.x: 
UP_DRIVER_ON_MP_SYSTEM  (0x92) This message occurs if a UNIPROCESSOR only driver is loaded on a   MultiProcessor system with more than one active processor.   KeBugCheckEx parameters:   1 - The Base address of the driver. 
INVALID_KERNEL_HANDLE  (0x93) This message occurs if kernel code (server, redirector, other driver,   and so forth) attempts to close a handle that is not a valid handle. 
  1. The handle that NtClose was called with.
  2. 0 means a protected handle was closed.   1 means an invalid handle was closed. 
KERNEL_STACK_LOCKED_AT_EXIT  (0x94) This message occurs when a thread exits while its kernel stack is   marked as not swapable 
INVALID_WORK_QUEUE_ITEM  (0x96) This message occurs when KeRemoveQueue removes a queue entry whose flink   or blink field is null. This is almost always called by code misusing   worker thread work items, but any queue misuse can cause this. The rule   is that an entry on a queue may only be inserted on the list once. When   an item is removed from a queue, its flink field is set to NULL. This   bugcheck occurs when remove queue attempts to remove an entry, but the   flink or blink field is NULL. In order to debug this problem, you need   to know the queue being referenced. If the queue is one of the EX worker   queues (ExWorkerQueue), then the item being removed is a WORK_QUEUE_ITEM   (see ex.h). This bug heck assumes that this is the case. The bugcheck ex   parameters are designed to help identify the driver misusing the queue   item. 
BOUND_IMAGE_UNSUPPORTED  (0x97) MmLoadSystemImage was called to load a bound image. This is not   supported in the kernel. Make sure bind.exe was not run on the   image. 

KeBugCheckEx parameters: 

  1. The address of the queue entry whose flink/blink field is NULL
  2. The address of the queue being references. Usually this   is one of the ExWorkerQueues.
  3. The base address of the ExWorkerQueue array. This will   help determine if the queue in question is an   ExWorkerQueue and if so, the offset from this   parameter will isolate the queue.
  4. If this is an ExWorkerQueue (which it usually is), this   is the address of the worker routine that would have   been called if the work item was valid. This can be   used to isolate the driver that is misusing the work   queue. 
END_OF_NT_EVALUATION_PERIOD  (0x98) Your NT System is an evaluation unit with an expiration date. The trial   period is over. 

KeBugCheckEx parameters: 

  1. The low order 32 bits of your installation date
  2. The high order 32 bits of your installation date
  3. The trial period in minutes 
INVALID_REGION_OR_SEGMENT  (0x99) ExInitializeRegion or ExInterlockedExtendRegion was called with an   invalid set of parameters. 
SYSTEM_LICENSE_VIOLATION  (0x9A) A violation of the software license agreement has occurred.

This can be due to either attempting to change the product type of an offline system, or an attempt to change the trial period of an evaluation unit of NT. 

  •   1 
    • 0 - means that offline product type changes were   attempted 
      • 2 - if 1, product should be LanmanNT or ServerNT.   If 0, should be WinNT 
      • 3 - partial serial number 
      • 4 - first two characters of product type from   product options. 
    • 1 - means that offline changes to the nt evaluation unit   time period
      • 2 - registered evaluation time from source 1
      • 3 - partial serial number
      • 4 - registered evaluation time from alternate source
    • 2 - means that the setup key could not be opened
      • 2 - status code associated with the open failure 
    • 3 - The SetupType value from the setup key is missing   so GUI setup mode could not be detected
      • 2 - status code associated with the key lookup failure
    • 4 - The SystemPrefix value from the setup key is missing
      • 2 - status code associated with the key lookup failure 
    • 5 - means that offline changes were made to the number of   licensed processors
      • 2 - see setup code
      • 3 - invalid value found in licensed processors
      • 4 - officially licensed number of processors 
KeBugCheckEx parameters: 
  1. The segment address which must reside on a quadword boundary.
  2. The segment size which must be greater than the block size plus the size of a segment header.
  3. The block size which must be a multiple of eight and   smaller than the segment size minus the size of the segment header. 
UDFS_FILE_SYSTEM  (0x9B) See the comment for FAT_FILE_SYSTEM 
MACHINE_CHECK_EXCEPTION  (0x9C) A fatal Machine Check Exception has occurred. 

KeBugCheckEx parameters: 

If the processor has ONLY MCE feature available (For   example Intel Pentium), the parameters are: 

  1. Low  32 bits of P5_MC_TYPE MSR 
  2. High 32 bits of P5_MC_ADDR MSR
  3. Low  32 bits of P5_MC_ADDR MSR
If the processor also has MCA feature available (for   example, Intel Pentium Pro), the parameters are: 
  1. Bank number
  2. Address field of MCi_ADDR MSR for the MCA bank that had   the error 
  3. High 32 bits of MCi_STATUS MSR for the MCA bank that   had the error
  4. Low  32 bits of MCi_STATUS MSR for the MCA bank that    had the error