| Previous | Next |
| MAXIMUM_WAIT_OBJECTS_EXCEEDED | NO_USER_MODE_CONTEXT |
MUTEX_LEVEL_NUMBER_VIOLATION
Kernel mutex level ordering violation for MUTEX_LEVEL_NUMBER_VIOLATION
MUTEX_LEVEL_NUMBER_VIOLATION is bug check code 0x0000000D. This bug check points at a lock-ordering rule being broken in kernel synchronization. It is useful when the dump shows mutex, guarded mutex, executive resource, or driver-owned lock paths that can deadlock if acquired in the wrong hierarchy.
How to read it in a dump for MUTEX_LEVEL_NUMBER_VIOLATION
- Use the stack to identify which thread and which driver was acquiring or releasing the lock.
- The important evidence is the lock object and acquisition order, not just the symbolic stop code.
- Do not treat it as a user-mode mutex failure; this is kernel synchronization state.
What to check for MUTEX_LEVEL_NUMBER_VIOLATION
- Review lock hierarchy and driver paths that acquire multiple locks.
- Enable Driver Verifier deadlock detection for suspect drivers in a test reproduction.
- Look for recent changes in cancel, unload, power, or error paths where lock ordering may differ from the normal path.
References for MUTEX_LEVEL_NUMBER_VIOLATION
Dump evidence for MUTEX_LEVEL_NUMBER_VIOLATION
For MUTEX_LEVEL_NUMBER_VIOLATION, preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “MUTEX_LEVEL_NUMBER_VIOLATION”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order for MUTEX_LEVEL_NUMBER_VIOLATION
- Run WinDbg
!analyze -v, then inspect the documented meaning of each MUTEX_LEVEL_NUMBER_VIOLATION parameter instead of relying only on the probably-caused-by line. - For MUTEX_LEVEL_NUMBER_VIOLATION, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with mutex / level / number / violation.
- For MUTEX_LEVEL_NUMBER_VIOLATION, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by MUTEX_LEVEL_NUMBER_VIOLATION before collecting the dump and event logs. For MUTEX_LEVEL_NUMBER_VIOLATION, recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Dump evidence for MUTEX_LEVEL_NUMBER_VIOLATION
For MUTEX_LEVEL_NUMBER_VIOLATION, preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “MUTEX_LEVEL_NUMBER_VIOLATION”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order for MUTEX_LEVEL_NUMBER_VIOLATION
- Run WinDbg
!analyze -v, then inspect the documented meaning of each MUTEX_LEVEL_NUMBER_VIOLATION parameter instead of relying only on the probably-caused-by line. - For MUTEX_LEVEL_NUMBER_VIOLATION, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with mutex / level / number / violation.
- For MUTEX_LEVEL_NUMBER_VIOLATION, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by MUTEX_LEVEL_NUMBER_VIOLATION before collecting the dump and event logs. For MUTEX_LEVEL_NUMBER_VIOLATION, recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Looking for a different code? Search another status or error code.