Registry Handle Leak Causes Random Blue Screens

• Microsoft Windows NT Workstation version 4.0
• Microsoft Windows NT Server version 4.0

SYMPTOMS

After a fairly long period of continuously using Attachmate Extra V6.3, the computer displays blue screen errors randomly.

CAUSE

These blue screen errors are caused by an application containing a registry handle leak. This leak occurs because an application continuously reopens a registry key but never closes it. After this has happened 65,535 times, the open instance count for this key wraps round to zero making the kernel think that there is no longer any open handles to this key. The next time an instance of the key is closed, the storage used by the kernel to reference the key is deleted.

However, any time subsequent to this that the key is opened or closed, the freed storage is written to again. This causes free pool corruption and eventually the system will crash when this freed storage is referenced in any way.

RESOLUTION

To resolve this problem, obtain the following fix or wait for the next Windows NT service pack.

This fix should have the following time stamp:

   12/05/97  22:43               919,104 ntoskrnl.exe (Intel)
   12/05/97  22:43               939,072 ntkrnlmp.exe (Intel)
   12/05/97  22:39               1,372,224 ntoskrnl.exe (Alpha)
   12/05/97  22:40               1,399,680 ntkrnlmp.exe (Alpha)

STATUS

Microsoft has confirmed this to be a problem in Windows NT version 4.0. A supported fix is now available, but has not been fully regression tested and should be applied only to systems experiencing this specific problem. Unless you are severely impacted by this specific problem, Microsoft recommends that you wait for the next Service Pack that contains this fix. Contact Microsoft Technical Support for more information.