From time to time, a customer support incident for a bugcheck will make its way over to us on the Performance team. Those of you that have worked with support engineers on the Performance team already know that we generally don’t work with bugcheck issues. Our Setup / Cluster team has that honor. However, the STOP 0xC2 error message is BAD_POOL_CALLER, and that word POOL causes administrators and even some support engineers to think “Performance issue” rather than “Bugcheck issue”. It’s funny how we can sometimes get so hung up on a word or phrase that we develop tunnel vision! Today we’re going to clear up the confusion behind this Bugcheck …
The STOP 0xC2 message does not indicate resource depletion in the same vein as our old Event ID friends 2019 & 2020 . This bugcheck message means that some Kernel-mode process or driver attempted to perform an invalid memory operation – for example:
- Allocating a memory pool size of zero bytes
- Allocating a non-existent memory pool
- Trying to free a memory pool that has already been freed
- Allocating a free memory pool at an IRQL that is too high
Now that we know what our bugcheck actually means, how do we troubleshoot it? The key parameter is the first one – that indicates the type of violation and determines the meaning of the other three parameters. If you download and install the Debugging Tools for Windows , the Debugger.chm file provided as part of the installation has a Bugcheck Code reference section. The table below is taken directly from the section on STOP 0xC2 errors and how to interpret the different parameters.
| 0x00 | 0 | Pool type | Pool tag | The current thread requested a zero-byte pool allocation. |
| 0x01, 0x02 or 0x04 | Pointer to pool header | First part of pool header contents | 0 | The pool header has been corrupted. |
| 0x06 | Reserved | Pointer to pool header | Pool header contents | The current thread attempted to free the pool, which was already freed. |
| 0x07 | Reserved | Pool header contents | Address of the block of pool being freed | The current thread attempted to free the pool, which was already freed. |
| 0x08 | Current IRQL | Pool type | Size of allocation, in bytes | The current thread attempted to allocate the pool at an invalid IRQL. |
| 0x09 | Current IRQL | Pool type | Address of pool | The current thread attempted to free the pool at an invalid IRQL. |
| 0x0A | Address of pool | Allocator's tag | Tag being used in the attempted free | The current thread attempted to free pool memory by using the wrong tag. (The memory might belong to another component.) |
| 0x0B, 0x0C or 0x0D | Address of pool | Pool allocation's tag | Bad quota process pointer | The current thread attempted to release a quota on a corrupted pool allocation. |
| 0x40 | Starting address | Start of system address space | 0 | The current thread attempted to free the kernel pool at a user-mode address. |
| 0x41 | Starting address | Physical page frame | Highest physical page frame | The current thread attempted to free a non-allocated nonpaged pool address. |
| 0x42 or 0x43 | Address being freed | 0 | 0 | The current thread attempted to free a virtual address that was never in any pool. |
| 0x44 | Starting address | Reserved | 0 | The current thread attempted to free a non-allocated nonpaged pool address. |
| 0x46 | Starting address | 0 | 0 | The current thread attempted to free an invalid pool address. |
| 0x47 | Starting address | Physical page frame | Highest physical page frame | The current thread attempted to free a non-allocated nonpaged pool address. |
| 0x48 | Starting address | Reserved | Reserved | The current thread attempted to free a non-allocated paged pool address. |
| 0x50 | Starting address | Start offset, in pages, from beginning of paged pool | Size of paged pool, in bytes | The current thread attempted to free a non-allocated paged pool address. |
| 0x60 | Starting address | 0 | 0 | The current thread attempted to free an invalid contiguous memory address. (The caller of MmFreeContiguousMemory is passing a bad pointer.) |
| 0x99 | Address that is being freed | 0 | 0 | The current thread attempted to free pool with an invalid address. (This code can also indicate corruption in the pool header.) |
| 0x9A | Pool type | Number of bytes requested | Pool tag |
The current thread marked an allocation request MUST_SUCCEED. (This pool type is no longer supported.)
|
| 0x9B | Pool type | Number of bytes requested | Caller's address | The current thread attempted to allocate a pool with a tag of 0. (This would be untrackable, and possibly corrupt the existing tag tables.) |
| 0x9C | Pool type | Number of bytes requested | Caller's address | The current thread attempted to allocate a pool with a tag of "BIG". (This would be untrackable and could possibly corrupt the existing tag tables.) |
| 0x9D | Incorrect pool tag used | Pool type | Caller's address | The current thread attempted to allocate a pool with a tag that does not contain any letters or digits. Using such tags makes tracking pool issues difficult. |
| 0x41286 | Reserved | Reserved | Start offset from the beginning of the paged pool, in pages | The current thread attempted to free a paged pool address in the middle of an allocation. |
As you can see, there are a number of different combinations to consider when dealing with STOP 0xC2 errors, and obviously if you are comfortable with kernel debugging, then this information will mean quite a bit more to you. For administrators who aren’t as familiar with debugging, there are a number of different troubleshooting options to consider – if the Bugcheck message lists a driver by name, you may need to update (if the driver is old), roll back (if the driver was recently updated) or disable that driver and work with the driver manufacturer for a resolution. Obviously if there is a hardware component itself that is failing then removing or replacing that component would be the logical course of action. You should also consider this problem from a software compatibility perspective. Incompatible drivers, services, anti-virus scanners or backup software packages could all be potential causes for this type of issue – especially in Operating System upgrade scenarios.
There’s a lot of information to digest in this post, but the key takeaway is that the problem with a STOP 0xC2 is not (as is sometimes inferred) Pool Memory resource depletion – it is actually an invalid memory operation. That’s it for today! Until next time …
- CC Hameed
| Share this post : |
|
|
|
|
|