What does NTSTATUS 0xC00000EB (STATUS_UNEXPECTED_MM_MAP_ERROR) mean?

 
Previous Next
STATUS_UNEXPECTED_MM_CREATE_ERR STATUS_UNEXPECTED_MM_EXTEND_ERR

STATUS_UNEXPECTED_MM_MAP_ERROR

A map-path fallback should be traced at the cache or section mapping boundary

STATUS_UNEXPECTED_MM_MAP_ERROR does not preserve the underlying Memory Manager exception. The documented FsRtlNormalizeNtstatus contract explains why: an exception outside the standard handled set can be replaced by a generic status selected by the caller. This value identifies the mapping fallback bucket, while the actual pool, I/O, paging, or section-related exception may already be lost.

The Cache Manager provides a concrete mapping path through CcMapData. It maps a range of a cached file, has explicit view-boundary and wait behavior, and the WDK states that failures are raised as status exceptions—for example an allocation failure raises STATUS_INSUFFICIENT_RESOURCES and an I/O failure raises the I/O status. File systems are expected to use exception handling around many Cache Manager, Memory Manager, and FsRtl routines. Those are exactly the places where preserving the pre-normalization exception is valuable.

Record file offset, requested length, wait flags, cache-map state, view boundary, original exception, and the exception filter result. Do not translate this status into “bad memory mapping” and stop there. A mapping operation can surface storage I/O or resource failures. The useful comparison with CREATE is the operation context: MAP is about obtaining access to an existing cached or section-backed range, not establishing the section object itself.

What to inspect

  • Capture the original raised status before the exception filter normalizes it.
  • Log mapping offset, length, wait mode, and cache/view state.
  • Check storage I/O and resource failures as possible original exceptions instead of assuming virtual-address corruption.

References

Looking for a different code? Search another status or error code.