Descriptions of Bug Codes for Windows NT

• Microsoft Windows NT Advanced Server, version 3.1
• Microsoft Windows NT operating system, version 3.1
• Microsoft Windows NT Server, version 3.5, 3.51, and 4.0
• Microsoft Windows NT Workstation, version 3.5, 3.51, and 4.0

SUMMARY

This article contains a list of bug codes, listed in order of bug code number. Some codes include parameter definitions and explanations.

Bug codes with no descriptions are usually from checked builds of Windows NT. If you receive one of these codes, run the kernel debugger, and type the following commands:

   kb
   !process 0 7
   !vm
   !errlog

MORE INFORMATION

List of Bug Codes

APC_INDEX_MISMATCH               (0x1)

   This is a kernel internal error. This error could be caused by a
   mismatch between KeEnterCricticalRegion and KeLeaveCriticalRegion
   in a file system.

DEVICE_QUEUE_NOT_BUSY            (0x2)

INVALID_AFFINITY_SET             (0x3)

INVALID_DATA_ACCESS_TRAP         (0x4)

INVALID_PROCESS_ATTACH_ATTEMPT   (0x5)

INVALID_PROCESS_DETACH_ATTEMPT   (0x6)

INVALID_SOFTWARE_INTERRUPT       (0x7)

IRQL_NOT_DISPATCH_LEVEL          (0x8)

IRQL_NOT_GREATER_OR_EQUAL        (0x9)

IRQL_NOT_LESS_OR_EQUAL           (0xA)

   An attempt was made to touch pageable memory at a process internal
   request level (IRQL) that is too high. This error is usually caused by
   drivers using improper addresses. If the kernel debugger is available,
   get a stack back trace.

   Parameters:

      1 - Memory referenced
      2 - IRQL
      3 - Value: 0 = read operation, 1 = write operation
      4 - Address that referenced memory

NO_EXCEPTION_HANDLING_SUPPORT    (0xB)

MAXIMUM_WAIT_OBJECTS_EXCEEDED    (0xC)

MUTEX_LEVEL_NUMBER_VIOLATION     (0xD)

   Try to identify the mutexes using the NTOS\EX\EXLEVELS.H header file.
   You should be able to pinpoint the mutexes that are getting acquired
   in an incorrect sequence.

   Parameters:

      1 - Current thread's mutex level
      2 - Mutex level attempting to acquire

NO_USER_MODE_CONTEXT             (0xE)

SPIN_LOCK_ALREADY_OWNED          (0xF)

SPIN_LOCK_NOT_OWNED              (0x10)

THREAD_NOT_MUTEX_OWNER           (0x11)

TRAP_CAUSE_UNKNOWN               (0x12)

EMPTY_THREAD_REAPER_LIST         (0x13)

CREATE_DELETE_LOCK_NOT_LOCKED    (0x14)

LAST_CHANCE_CALLED_FROM_KMODE    (0x15)

CID_HANDLE_CREATION              (0x16)

CID_HANDLE_DELETION              (0x17)

REFERENCE_BY_POINTER             (0x18)

BAD_POOL_HEADER                  (0x19)

MEMORY_MANAGEMENT                (0x1A)

PFN_SHARE_COUNT                  (0x1B)

PFN_REFERENCE_COUNT              (0x1C)

NO_SPIN_LOCK_AVAILABLE           (0x1D)

KMODE_EXCEPTION_NOT_HANDLED      (0x1E)

   This is a very common bug code. Usually the exception address
   pinpoints the driver or function that caused the problem. Always note
   this address as well as the link date of the driver or image that
   contains this address. A common error is exception code 0x80000003.
   This error means a hard-coded breakpoint or assertion was hit, but the
   system was booted with the /NODEBUG switch. This problem should not
   occur very often. If it occurs repeatedly, make sure a debugger is
   connected and the system is booted with the /DEBUG switch.

   On non-Intel systems, if the address of the exception is 0XBFC0304,
   the bug code is the result of a cache-parity error on the CPU. If the
   problem reoccurs frequently, contact the hardware manufacturer.

   Parameters:

      1 - The exception code that was not handled
      2 - The address at which the exception occurred
      3 - Parameter 0 of the exception
      4 - Parameter 1 of the exception

SHARED_RESOURCE_CONV_ERROR       (0x1F)

KERNEL_APC_PENDING_DURING_EXIT   (0x20)

   The key data item is the thread's APC disable count. If the count is
   nonzero, it is the source of the problem. A negative value indicates
   that a file system has called FsRtlEnterFileSystem more times than
   FsRtlExitFileSystem. A positive value indicates that the reverse is
   true. If you see this situation, check all file systems installed on
   the machine. Third-party redirectors are especially suspect since they
   do not receive the heavy-duty testing that NTFS, FAT, HPFS, and RDR
   receive.

   The current IRQL should also be 0. If it is not, a driver's
   cancellation routine can cause this bug code by returning at an
   elevated IRQL. Always try to note what you were doing or closing
   and note all the installed drivers at the time of the bug code. This
   symptom is usually caused by a severe bug in a third-party driver.

   Parameters:

      1 - The address of the APC found pending during exit
      2 - The thread's APC disable count
      3 - The current IRQL

QUOTA_UNDERFLOW                  (0x21)

FILE_SYSTEM                      (0x22)

FAT_FILE_SYSTEM                  (0x23)

NTFS_FILE_SYSTEM                 (0x24)

NPFS_FILE_SYSTEM                 (0x25)

CDFS_FILE_SYSTEM                 (0x26)

RDR_FILE_SYSTEM                  (0x27)

CORRUPT_ACCESS_TOKEN             (0x28)

SECURITY_SYSTEM                  (0x29)

INCONSISTENT_IRP                 (0x2A)

   An IRP was encountered that was in an inconsistent state; that is,
   some field or fields of the IRP were inconsistent with the remaining
   state of the IRP--for example, an IRP that was being completed, but
   was still marked as being queued for a driver's device queue. This bug
   code is not currently being used in the system, but exists for
   debugging purposes.

   Parameter:

      1 - Address of the IRP that was found to be inconsistent

PANIC_STACK_SWITCH               (0x2B)

   This error indicates that the kernel mode stack was overrun. This
   error normally occurs when a kernel mode driver uses too much stack
   space. It can also occur when serious data corruption occurs in the
   kernel.

PORT_DRIVER_INTERNAL             (0x2C)

SCSI_DISK_DRIVER_INTERNAL        (0x2D)

DATA_BUS_ERROR                   (0x2E)

   This bug code is normally caused by a parity error in the system
   memory. This error can also be caused by a driver accessing a
   0x8XXXXXXX address that does not exist.

   Parameters:

      1 - Virtual address that caused the fault
      2 - Physical address that caused the fault
      3 - Processor status register (PSR)
      4 - Faulting instruction register (FIR)

INSTRUCTION_BUS_ERROR            (0x2F)

SET_OF_INVALID_CONTEXT           (0x30)

PHASE0_INITIALIZATION_FAILED     (0x31)

   System initialization failed early on. The kernel debugger is required
   to make sense of this error, since this code tells you almost nothing.

PHASE1_INITIALIZATION_FAILED     (0x32)

   Parameters:

      1 - Windows NT status code that describes why the system thinks
          initialization failed
      2 - Indicates location within INIT.C where phase 1 initialization
          failure occurred

UNEXPECTED_INITIALIZATION_CALL   (0x33)

CACHE_MANAGER                    (0x34)

NO_MORE_IRP_STACK_LOCATIONS      (0x35)

   A higher level driver has attempted to call a lower level driver
   through the IoCallDriver() interface, but there are no more stack
   locations in the packet, so the lower level driver would not be able
   to access its parameters, as there are no parameters for it. This is a
   disastrous situation, since the higher level driver thinks it has
   filled in the parameters for the lower level driver (something it MUST
   do before calling the lower level driver); however, since there is no
   stack location for the latter driver, the former has written off of the
   end of the packet. This means that some other memory has probably been
   corrupted.

   Parameter:

      1 - Address of the IRP

   A device driver has attempted to delete one of its device objects from
   the system but the reference count for that object was nonzero,
   meaning there were still outstanding references to the device. (The
   reference count indicates the number of reasons why this device object
   cannot be deleted.) This is a bug in the calling device driver.

   Parameter:

      1 - Address of the device object

FLOPPY_INTERNAL_ERROR            (0x37)

SERIAL_DRIVER_INTERNAL           (0x38)

SYSTEM_EXIT_OWNED_MUTEX          (0x39)

SYSTEM_UNWIND_PREVIOUS_USER      (0x3A)

SYSTEM_SERVICE_EXCEPTION         (0x3B)

INTERRUPT_UNWIND_ATTEMPTED       (0x3C)

MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED (0x3E)

   The system has multiple processors, but they are asymmetric in relation
   to one another. To be symmetric, all processors must be of the same
   type and level. For example, trying to mix a Pentium-level processor
   with an 80486 would cause this error. Additionally, on x86 systems,
   floating-point capabilities must be present on all or no processors.

NO_MORE_SYSTEM_PTES              (0x3F)

   No System PTEs left. Usually caused by a driver not cleaning up
   properly. If kernel debugger is available, get a stack trace and enter
   the following command:

      !sysptes 3

TARGET_MDL_TOO_SMALL             (0x40)

   A driver has called the IoBuildPartialMdl() function and passed it an
   MDL to map part of a source MDL, but the target MDL is not large
   enough to map the entire range of addresses requested. This is a
   driver bug. The source and target MDLs, as well as the address range
   length to be mapped, are the arguments to the IoBuildPartialMdl()
   function:

      IoBuildPartialMdl( IN PMDL SourceMdl,
                         IN OUT PMDL TargetMdl,
                         IN PVOID VirtualAddress,
                         IN ULONG Length )

MUST_SUCCEED_POOL_EMPTY          (0x41)

   If kernel debugger is available, the VM command lists various sizes.

   Parameters:

      1 - Size of the request that could not be satisfied
      2 - Number of pages used of nonpaged pool
      3 - Number of too large PAGE_SIZE requests from nonpaged pool
      4 - Number of pages available

ATDISK_DRIVER_INTERNAL           (0x42)

NO_SUCH_PARTITION                (0x43)

MULTIPLE_IRP_COMPLETE_REQUESTS   (0x44)

   A driver has requested that an IRP be completed [IoCompleteRequest()],
   but the packet has already been completed. This is a difficult bug to
   find because the easiest case, a driver actually attempted to complete
   its own packet twice, is generally not what happened. Rather, two
   separate drivers each tries to own the packet, and each attempts to
   complete it. The first actually works, and the second fails. Tracking
   down which drivers in the system actually did this is difficult,
   because the tracks of the first driver have been covered by the
   second. However, the driver stack for the current request can be found
   by examining the DeviceObject fields in each of the stack locations.

   Parameter:

      1 - Address of the IRP

INSUFFICIENT_SYSTEM_MAP_REGS     (0x45)

DEREF_UNKNOWN_LOGON_SESSION      (0x46)

REF_UNKNOWN_LOGON_SESSION        (0x47)

CANCEL_STATE_IN_COMPLETED_IRP    (0x48)

   This error indicates that an I/O Request Packet (IRP) that is to be
   canceled has a cancel routine specified in it, meaning the packet is
   in a state in which the packet can be canceled. However, the packet no
   longer belongs to a driver, as it has entered I/O completion. This is
   either a driver bug, or more than one driver is accessing the same
   packet, which is not likely and much more difficult to debug.

   Parameter:

      1 - Pointer to the IRP

PAGE_FAULT_WITH_INTERRUPTS_OFF   (0x49)

IRQL_GT_ZERO_AT_SYSTEM_SERVICE   (0x4A)

STREAMS_INTERNAL_ERROR           (0x4B)

FATAL_UNHANDLED_HARD_ERROR       (0x4C)

   If a hard error occurs during system boot before Windows NT is up, and
   it is a real error, the system will halt with a blue screen.

   The following are some common cases:

   x218 - A necessary registry hive file could not be loaded. The hive
          file may be corrupted or missing. The Emergency Repair disk may
          be required to recover from this.

          The driver may have corrupted the registry data while loading
          into memory, or the memory where the registry file was loaded
          is not actually memory. In particular, AST EISA machines with
          16 MB or more of memory must have access to the memory above 16
          MB that is ENABLED in the EISA configuration utility, or the
          registry file is liable to get loaded in this spot, but will
          return just 0xffffffff when the memory is read.

   x21A - Either Winlogon or CSRSS (Windows) died unexpectedly. The exit
          code tells more information. Usually it is c0000005, meaning
          that an unhandled exception crashed either of these processes.
          There is not much you can do unless this becomes a persistent
          problem.

   x221 - This means that a driver is corrupted, or a system DLL was
          detected to be corrupted. Windows NT does its best to check the
          integrity of drivers and important system DLLs. A blue screen
          is displayed with the name of the corrupted file. If this

          boot an alternate operating system, or reinstall if no
          alternate exists. Make sure the on-disk file that is listed as
          bad matches the version on the compact disc and replace it if
          necessary. In some cases, random corruption can mean that there
          is a hardware problem in the I/O path to the file.

NO_PAGES_AVAILABLE               (0x4D)

   No free pages available to continue operations. If the kernel debugger
   is available, type the following commands:

      !process 0 7
      !vm
      dd mmpagingfiles
      dd @$p

   Parameters:

      1 - Number of dirty pages
      2 - Number of physical pages in machine
      3 - Extended commit value in pages
      4 - Total commit value in pages

PFN_LIST_CORRUPT                 (0x4E)

   Caused by corrupting I/O driver structures. If the kernel debugger is
   available, get a stack trace.

   Parameters:

      1 - Value 1
      2 - ListHead value that was corrupted
      3 - Number of pages available
      4 - 0
      1 - Value 2
      2 - Entry in list being removed
      3 - Highest physical page number
      4 - Reference count of entry being removed

NDIS_INTERNAL_ERROR              (0x4F)

PAGE_FAULT_IN_NONPAGED_AREA      (0x50)

REGISTRY_ERROR                   (0x51)

   Something has gone wrong with the registry. If a kernel debugger is
   available, get a stack trace. If the stack trace indicates you are in
   a system worker thread (CmpWorker will be on the call list), enter the
   following kernel debugger commands:

      dd CmpRegistryMutex+18 L1
      !thread <whatever value the above command printed out>

   This will give you the thread and stack trace that made the registry
   call.

   This error can also indicate that the registry received an I/O error
   while trying to read one of its files, so the error can be caused by
   hardware problems or file system corruption. It can also occur because
   of a failure in a refresh operation that is used only by the security
   system, and then only when resource limits are encountered. When you
   see this bug code, note whether the machine is a PDC or BDC, and how
   many accounts are in its security account manager (SAM) database,
   whether it might be a replication target, and whether the volume where
   the hive files reside is nearly full.

   Parameters:

      1 - Value 1 (indicates where bug code occurred)
      2 - Value 2 (indicates where bug code occurred)
      3 - May be pointer to hive
      4 - May be return code of HvCheckHive if the hive is corrupted

MAILSLOT_FILE_SYSTEM             (0x52)

NO_BOOT_DEVICE                   (0x53)

LM_SERVER_INTERNAL_ERROR         (0x54)

DATA_COHERENCY_EXCEPTION         (0x55)

XNS_INTERNAL_ERROR               (0x57)

FTDISK_INTERNAL_ERROR            (0x58)

   The system was booted from a revived primary partition, so the hives
   say the mirror is all right, when in fact it is not. The real images of
   the hives are on the shadow. You must boot from the shadow.

PINBALL_FILE_SYSTEM              (0x59)

CRITICAL_SERVICE_FAILED          (0x5A)

SET_ENV_VAR_FAILED               (0x5B)

HAL_INITIALIZATION_FAILED        (0x5C)

HEAP_INITIALIZATION_FAILED       (0x5D)

OBJECT_INITIALIZATION_FAILED     (0x5E)

SECURITY_INITIALIZATION_FAILED   (0x5F)

PROCESS_INITIALIZATION_FAILED    (0x60)

HAL1_INITIALIZATION_FAILED       (0x61)

OBJECT1_INITIALIZATION_FAILED    (0x62)

SYMBOLIC_INITIALIZATION_FAILED   (0x64)

MEMORY1_INITIALIZATION_FAILED    (0x65)

CACHE_INITIALIZATION_FAILED      (0x66)

CONFIG_INITIALIZATION_FAILED     (0x67)

   This means the registry could not allocate the pool needed to contain
   the registry files. This error should never occur, since it is early
   enough in system initialization that there is always plenty of the
   paged pool available.

   Parameters:

      1 - 5
      2 - Indicates location in NTOS\CONFIG\CMSYSINI that failed

FILE_INITIALIZATION_FAILED       (0x68)

IO1_INITIALIZATION_FAILED        (0x69)

   Initialization of the I/O system failed for some reason. There is
   practically no other information available. In general, this error
   occurs because Setup made some incorrect decisions about the
   installation of the system, or the user has reconfigured the system.

LPC_INITIALIZATION_FAILED        (0x6A)

PROCESS1_INITIALIZATION_FAILED   (0x6B)

   Parameters:

      1 - Indicates the status code that suggests that Windows NT
          initialization failed
      2 - Indicates the location in NTOS\PS\PSINIT.C where the failure
          was detected

REFMON_INITIALIZATION_FAILED     (0x6C)

SESSION1_INITIALIZATION_FAILED   (0x6D)

SESSION2_INITIALIZATION_FAILED   (0x6E)

SESSION3_INITIALIZATION_FAILED   (0x6F)

SESSION4_INITIALIZATION_FAILED   (0x70)

SESSION5_INITIALIZATION_FAILED   (0x71)

   These bug code codes (SESSION1 - SESSION5) indicate the location in
   NTOS\INIT\INIT.C where the failure was detected.

   Parameter:

      1 - Indicates the status code that suggests that Windows NT
          initialization failed

ASSIGN_DRIVE_LETTERS_FAILED      (0x72)

CONFIG_LIST_FAILED               (0x73)

   Indicates that one of the core system hives is corrupted or unreadable.
   This hive can be either SOFTWARE, SECURITY, or SAM.

   Parameters:

      1 - 5
      2 - 2
      3 - Index of hive in list
      4 - Pointer to UNICODE_STRING containing file name of hive

BAD_SYSTEM_CONFIG_INFO           (0x74)

   This error may indicate that the SYSTEM hive loaded by the
   OSLOADER/NTLDR was corrupted. However, this is unlikely, since OSLOADER
   checks a hive to make sure it is not corrupted after loading it.

   This error may also indicate that some critical registry keys and
   values are not present. Booting from LastKnownGood may correct the
   problem, but you may need to reinstall or use the Emergency Repair
   Disk.

CANNOT_WRITE_CONFIGURATION       (0x75)

   This error will occur if the SYSTEM hive files (SYSTEM and SYSTEM.ALT)
   cannot be grown to accommodate additional data written into the hive
   between registry initialization and phase one initialization (when the
   file systems are available). This error usually means there are 0
   bytes of free space available on the drive, although it could be caused
   by trying to store the registry on a read-only device.

PROCESS_HAS_LOCKED_PAGES         (0x76)

   This error is caused by a driver not cleaning up completely after an
   I/O operation.

   Parameters:

      1 - Process address
      2 - Number of locked pages
      3 - Number of private pages
      4 - 0

KERNEL_STACK_INPAGE_ERROR        (0x77)

   The requested page of kernel data could not be read in. This error is
   caused by a bad block in a paging file or a disk controller error (in
   extremely rare cases, it is caused by running out of resources,
   specifically, the nonpaged pool with a status of c0000009a
   [STATUS_INSUFFICIENT_RESOURCES]).

   If the first and second arguments are 0, the stack signature in the
   kernel stack was not found. This error is caused by bad hardware.

   An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or C000016AL
   (STATUS_DISK_OPERATION_FAILED) normally indicates the data could not
   be read from the disk due to a bad block. Upon reboot, Autocheck will
   run and attempt to map out the bad sector. If the status is C0000185
   (STATUS_IO_DEVICE_ERROR) and the paging file is on a SCSI disk device,
   the cabling and termination should be checked.

   Parameters:

      1 - 0
      2 - 0
      3 - PTE value at time of error
      4 - Address of signature on kernel stack
      1 - Status code
      2 - I/O status code
      3 - Page file number
      4 - Offset into page file

PHASE0_EXCEPTION                 (0x78)

MISMATCHED_HAL                   (0x79)

   The HAL revision level and HAL configuration type do not match that of
   the kernel or the machine type. This error is probably occurring
   because the user has manually updated either NTOSKRNL.EXE or HAL.DLL.
   Or, the machine has a multiprocessor (MP) HAL and a uniprocessor (UP)
   kernel, or the reverse.

   Parameters:

      1 - Type of mismatch (1, 2, or 3):

          1 - The PRCB release levels mismatch (something is out of
              date). If this is the case, parameters 2 and 3 are:

              2 - Major PRCB level of NTOSKRNL.EXE
              3 - Major PRCB level of HAL.DLL

      2 - The build types mismatch. If this is the case, parameters
          2 and 3 are:

              2 - Build type of NTOSKRNL.EXE
              3 - Build type of HAL.DLL

              Build Types
              -----------

                 0 - Free multiprocessor-enabled build
                 1 - Checked multiprocessor-enabled build
                 2 - Free uniprocessor build

       3 - Micro Channel Architecture (MCA) computers require a
           MCA-specific HAL. If this is the case, parameters 2 and 3
           are:

              2 - Machine type as detected by NTDETECT.COM
                  A value of a 2 would mean the computer is MCA.
              3 - Machine type that HAL supports
                  A value of a 2 would mean the HAL is built for MCA.

KERNEL_DATA_INPAGE_ERROR         (0x7A)

   The requested page of kernel data could not be read in. This error is
   caused by a bad block in the paging file or a disk controller error.
   See also KERNEL_STACK_INPAGE_ERROR.

   Parameters:

      1 - Lock type that was held (value 1, 2, 3, or PTE address)
      2 - Error status (normally I/O status code)
      3 - Current process (virtual address for lock type 3, or PTE)
      4 - Virtual address that could not be in-paged

INACCESSIBLE_BOOT_DEVICE         (0x7B)

   During the initialization of the I/O system, the driver for the boot
   device may have failed to initialize the device that the system is
   attempting to boot from, or the file system that is supposed to read
   that device may have either failed its initialization or simply not
   recognized the data on the boot device as a file system structure. In
   the former case, the first argument is the address of a Unicode string
   data structure that is the ARC name of the device from which the boot
   was being attempted. In the latter case, the first argument is the
   address of the device object that could not be mounted.

   If this is the initial setup of the system, this error may have
   occurred because the system was installed on an unsupported disk or
   SCSI controller. Note that some controllers are supported only by
   drivers that are in the Windows Driver Library (WDL), which requires
   the user to do a custom installation.

   This error can also be caused by the installation of a new SCSI
   adapter or disk controller or by repartitioning the disk with the
   system partition. If this is the case, on x86 systems, the BOOT.INI
   file must be edited; on ARC systems, Setup must be run. For
   information on changing BOOT.INI, see the Windows NT Advanced Server
   "Administrator's Guide."

   If the argument is a pointer to an ARC name string, the format of the
   first two (and in this case only) long words will be:

      USHORT Length;
      USHORT MaximumLength;
      PVOID Buffer;

   That is, the first long word will contain something like 00800020,
   where 20 is the actual length of the Unicode string, and the next long
   word will contain the address of buffer. This address will be in
   system space, so the high-order bit will be set.

   If the argument is a pointer to a device object, the format of the
   first word will be:

      USHORT Type;

   That is, the first word will contain a 0003, where the Type code will
   always be 0003.

   Note that this makes it immediately obvious whether the argument is a
   pointer to an ARC name string or a device object, since a Unicode
   string can never have an odd number of bytes, and a device object will
   always have a Type code of 3.

   Parameter:

      1 - Pointer to the device object or Unicode string of ARC name

BUGCODE_PSS_MESSAGE              (0x7C)

INSTALL_MORE_MEMORY              (0x7D)

   Not enough memory to boot Windows NT (needs 5 MB).

   Parameters:

      1 - Number of physical pages found
      2 - Lowest physical page
      3 - Highest physical page
      4 - 0

WINDOWS_NT_BANNER                (0x4000007E)

UNEXPECTED_KERNEL_MODE_TRAP      (0x7F)

   This error means a trap occurred in kernel mode, either a kind of trap
   that the kernel is not allowed to have or catch (a bound trap), or a
   kind of trap that is always instant death (double fault). The first
   number in the bug code parentheses is the number of the trap (8 =
   double fault). To learn more about what these traps are, consult an
   Intel x86 family manual.

   From kernel debugger, a KB and !TRAP on the appropriate frame (which
   will be the EBP that goes with a procedure named KiTrap--at least on
   x86 machines) will show where the trap was taken.

NMI_HARDWARE_FAILURE             (0x80)

   The HAL is supposed to report whatever specific data it has and to
   tell the user to call his or her hardware vendor for support.

SPIN_LOCK_INIT_FAILURE           (0x81)

SETUP_FAILURE                    (0x85)

   (NOTE: Textmode setup no longer uses bugchecks to bail out of serious
   error conditions. Therefore, you will never encounter a bugcheck 0x85.
   All bugchecks have been replaced with friendlier and (where possible)
   more descriptive error messages. Some of the former bugchecks, however,
   have simply been replaced by our own bugcheck screen, and the codes for
   these error conditions are the same as before. These are documented
   below.)

   The first extended bugcheck field is a code indicating what the problem
   is, and the other fields are used differently depending on that value.

      1 -
         0:  The OEM HAL font is not a valid .fon format file,
             and so setup is unable to display text.
             This indicates that vgaxxx.fon on the boot floppy
             or CD-ROM is damaged.

         1:  Video initialization failed. NO LONGER A BUGCHECK CODE.
             This error now has its own error screen, and the
             user is only presented with the two relevant
             parameters detailed below.

             This may indicate that the disk containing vga.sys
             (or other video driver appropriate to the machine)
             is damaged or that machine has video hardware that
             we cannot communicate with.

             2 - What failed:
                 0: NtCreateFile of \device\video0
                 1: IOCTL_VIDEO_QUERY_NUM_AVAIL_MODES
                 2: IOCTL_VIDEO_QUERY_AVAIL_MODES
                 3: Desired video mode not supported. This is
                    indicative of an internal setup error.
                 4: IOCTL_VIDEO_SET_CURRENT_MODE (unable to set
                    video mode)
                 5: IOCTL_VIDEO_MAP_VIDEO_MEMORY
                 6: IOCTL_VIDEO_LOAD_AND_SET_FONT

             3 - Status code from NT API call, if appropriate.

         2:  Out of memory. NO LONGER A BUGCHECK CODE.
             This error now uses a more friendly error screen
             that works regardless of how far along in setup we
             are.

         3:  Keyboard initialization failed. NO LONGER A BUGCHECK CODE.
             There are now 2 error screens for the two different
             possible errors we can get here. This may indicate
             that the disk containing the keyboard driver
             (i8042prt.sys or kbdclass.sys) is damaged or that
             machine has keyboard hardware we cannot communicate with.

             It may also mean that the keyboard layout dll could
             not be loaded.

             2 - What failed:
                 0: NtCreateFile of \device\KeyboardClass0
                    failed.
                    "Setup did not find a keyboard connected to
                    your computer."
                 1: Unable to load keyboard layout dll.
                    "Setup could not load the keyboard layout
                    file <filename>."
                    Indicates that the cd or floppy is missing a
                    file (kbdus.dll for us release, other layout
                    dlls for localized ones).

         4:  Setup was unable to resolve the ARC device pathname
             of the device from which setup was started. This is
             an internal Setup error.

         5:  Partitioning sanity check failed. This indicates a
             bug in a disk driver. The parameters are
             meaningful only to the setup group.

MBR_CHECKSUM_MISMATCH            (0x8B)

   This message occurs during the boot process when the MBR checksum the
   system calculates does not match the checksum passed in by the loader.
   This is usually an indication of a virus. There are many forms of
   viruses and not all can be detected. The newer ones usually can only be
   detected by a virus scanner that has recently been upgraded. Boot a
   write-protected disk containing a virus scanner and attempt to clean

   the infection.

   KerBugCheckEx parameters:

      1 - Disk Signature from MBR.
      2 - MBR check sum calculated by osloader.
      3 - MBR checksum calculated by system.

The following bugcodes are added in Windows NT versions 3.51 and 4.x:

PP0_INITIALIZATION_FAILED        (0x8F)

   This message occurs if phase 0 initialization of the kernel-mode Plug
   and Play Manager failed. There's really nothing going on here that

   cause a failure.

PP1_INITIALIZATION_FAILED        (0x90)

   This message occurs if phase 1 initialization of the kernel-mode Plug
   and Play Manager failed. This is where we do most of our

   including setting up the environment (registry, etc.) for drivers to
   subsequently call during I/O init.

UP_DRIVER_ON_MP_SYSTEM           (0x92)

   This message occurs if a UNIPROCESSOR only driver is loaded on a
   MultiProcessor system with more than one active processor.

   KeBugCheckEx parameters:

      1 - The Base address of the driver.

INVALID_KERNEL_HANDLE           (0x93)

   This message occurs if kernel code (server, redirector, other driver,
   and so forth) attempts to close a handle that is not a valid handle.

      1 - The handle that NtClose was called with.

      2 - 0 means a protected handle was closed.
          1 means an invalid handle was closed.

KERNEL_STACK_LOCKED_AT_EXIT     (0x94)

   This message occurs when a thread exits while its kernel stack is
   marked as not swapable

INVALID_WORK_QUEUE_ITEM         (0x96)

   This message occurs when KeRemoveQueue removes a queue entry whose

   or blink field is null. This is almost always called by code misusing
   worker thread work items, but any queue misuse can cause this. The rule
   is that an entry on a queue may only be inserted on the list once. When
   an item is removed from a queue, its flink field is set to NULL. This
   bugcheck occurs when remove queue attempts to remove an entry, but the
   flink or blink field is NULL. In order to debug this problem, you need
   to know the queue being referenced. If the queue is one of the EX

   queues (ExWorkerQueue), then the item being removed is a

   (see ex.h). This bug heck assumes that this is the case. The bugcheck

   parameters are designed to help identify the driver misusing the queue
   item.

BOUND_IMAGE_UNSUPPORTED         (0x97)

   MmLoadSystemImage was called to load a bound image. This is not
   supported in the kernel. Make sure bind.exe was not run on the
   image.


   KeBugCheckEx parameters:

      1 - The address of the queue entry whose flink/blink field is NULL
      2 - The address of the queue being references. Usually this
          is one of the ExWorkerQueues.
      3 - The base address of the ExWorkerQueue array. This will
          help determine if the queue in question is an
          ExWorkerQueue and if so, the offset from this
          parameter will isolate the queue.
      4 - If this is an ExWorkerQueue (which it usually is), this
          is the address of the worker routine that would have
          been called if the work item was valid. This can be
          used to isolate the driver that is misusing the work
          queue.


END_OF_NT_EVALUATION_PERIOD     (0x98)

   Your NT System is an evaluation unit with an expiration date. The trial
   period is over.

   KeBugCheckEx parameters:

      1 - The low order 32 bits of your installation date
      2 - The high order 32 bits of your installation date
      3 - The trial period in minutes

INVALID_REGION_OR_SEGMENT       (0x99)

   ExInitializeRegion or ExInterlockedExtendRegion was called with an
   invalid set of parameters.

SYSTEM_LICENSE_VIOLATION        (x9a)

   A violation of the software license agreement has occurred. This can be
   due to either attempting to change the product type of an offline
   system, or an attempt to change the trial period of an evaluation unit
   of NT.

   1 - 0 - means that offline product type changes were
           attempted
           2 - if 1, product should be LanmanNT or ServerNT.
               If 0, should be WinNT
           3 - partial serial number
           4 - first two characters of product type from
               product options.

       1 - means that offline changes to the nt evaluation unit
           time period
           2 - registered evaluation time from source 1
           3 - partial serial number
           4 - registered evaluation time from alternate source

       2 - means that the setup key could not be opened
           2 - status code associated with the open failure

       3 - The SetupType value from the setup key is missing
           so GUI setup mode could not be detected
           2 - status code associated with the key lookup failure

       4 - The SystemPrefix value from the setup key is missing
           2 - status code associated with the key lookup failure

       5 - means that offline changes were made to the number of
           licensed processors
           2 - see setup code
           3 - invalid value found in licensed processors
           4 - officially licensed number of processors

   KeBugCheckEx parameters:

      1 - The segment address which must reside on a quadword boundary.
      2 - The segment size which must be greater than the block
          size plus the size of a segment header.
      3 - The block size which must be a multiple of eight and
          smaller than the segment size minus the size of the
          segment header.

UDFS_FILE_SYSTEM              (0x9B)
      See the comment for FAT_FILE_SYSTEM

MACHINE_CHECK_EXCEPTION         (0x9C)

   A fatal Machine Check Exception has occurred.

   KeBugCheckEx parameters:

      If the processor has ONLY MCE feature available (For
      example Intel Pentium), the parameters are:

         1 - Low  32 bits of P5_MC_TYPE MSR
         2 -
         3 - High 32 bits of P5_MC_ADDR MSR
         4 - Low  32 bits of P5_MC_ADDR MSR

      If the processor also has MCA feature available (for
      example, Intel Pentium Pro), the parameters are:

         1 - Bank number
         2 - Address field of MCi_ADDR MSR for the MCA bank that had
             the error
         3 - High 32 bits of MCi_STATUS MSR for the MCA bank that
             had the error
         4 - Low  32 bits of MCi_STATUS MSR for the MCA bank that
             had the error