| Previous | Next |
| SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION | SYSTEM_IMAGE_BAD_SIGNATURE |
BAD_POOL_CALLER
The BAD_POOL_CALLER bug check has a value of 0x000000C2. This indicates that the current thread is making a bad pool request.
Important
BAD_POOL_CALLER Parameters
Parameter 1 indicates the type of violation.
| Parameter 1 | Parameter 2 | Parameter 3 | Parameter 4 | Cause of Error |
|---|---|---|---|---|
0x00 |
0 |
Pool type |
Pool tag |
The current thread requested a zero-byte pool allocation. |
0x01, 0x02, 0x04 |
Pointer to pool header |
First part of pool header contents |
0 |
The pool header has been corrupted. |
0x06 |
Reserved |
Pointer to pool header |
Pool header contents |
The current thread attempted to free the pool, which was already freed. |
0x07 |
Reserved |
Pool header contents |
Address of the block of pool being freed |
— |
0x08 |
Current IRQL |
Pool type |
Size of allocation, in bytes |
The current thread attempted to allocate the pool at an invalid IRQL. |
0x09 |
Current IRQL |
Pool type |
Address of pool |
The current thread attempted to free the pool at an invalid IRQL. |
0x0A |
Address of pool |
Allocator's tag |
Tag being used in the attempted free |
The current thread attempted to free pool memory by using the wrong tag. (The memory might belong to another component.) |
0x0B, 0x0C, or 0x0D |
Address of pool |
Pool allocation's tag |
Bad quota process pointer |
The current thread attempted to release a quota on a corrupted pool allocation. |
0x40 |
Starting address |
Start of system address space |
0 |
The current thread attempted to free the kernel pool at a user-mode address. |
0x41 |
Starting address |
Physical page frame |
Highest physical page frame |
The current thread attempted to free a non-allocated nonpaged pool address. |
0x42 or 0x43 |
Address being freed |
0 |
0 |
The current thread attempted to free a virtual address that was never in any pool. |
0x44 |
Starting address |
Reserved |
0 |
— |
0x46 |
Starting address |
0 |
0 |
The current thread attempted to free an invalid pool address. |
0x47 |
Starting address |
Physical page frame |
Highest physical page frame |
— |
0x48 |
Starting address |
Reserved |
Reserved |
The current thread attempted to free a non-allocated paged pool address. |
0x50 |
Starting address |
Start offset, in pages, from beginning of paged pool |
Size of paged pool, in bytes |
— |
0x60 |
Starting address |
0 |
0 |
The current thread attempted to free an invalid contiguous memory address. (The caller of MmFreeContiguousMemory is passing a bad pointer.) |
0x99 |
Address that is being freed |
0 |
0 |
The current thread attempted to free pool with an invalid address. (This code can also indicate corruption in the pool header.) |
0x9A |
Pool type |
Number of bytes requested |
Pool tag |
The current thread marked an allocation request MUST_SUCCEED. (This pool type is no longer supported.) |
0x9B |
Pool type |
Number of bytes requested |
Caller's address |
The current thread attempted to allocate a pool with a tag of 0 (This would be untrackable, and possibly corrupt the existing tag tables.) |
0x9C |
Pool type |
Number of bytes requested |
Caller's address |
The current thread attempted to allocate a pool with a tag of "BIG". (This would be untrackable and could possibly corrupt the existing tag tables.) |
0x9D |
Incorrect pool tag used |
Pool type |
Caller's address |
The current thread attempted to allocate a pool with a tag that does not contain any letters or digits. Using such tags makes tracking pool issues difficult. |
0x41286 |
Reserved |
Reserved |
Start offset from the beginning of the paged pool, in pages |
The current thread attempted to free a paged pool address in the middle of an allocation. |
The _POOL_TYPE codes are enumerated in Ntddk.h. In particular, 0 indicates nonpaged pool and 1 indicates paged pool.
Cause
An invalid pool request has been made by the current thread. Typically this is at a bad IRQL level or double freeing the same memory allocation, etc.
Resolution
Use Parameter 1 to identify the exact pool-contract violation, then interpret the remaining parameters as documented in the table above. Preserve the pool address, tag, current IRQL, allocation size, and freeing or allocating stack before enabling broader instrumentation.
If the evidence points to a driver, use Special Pool or Driver Verifier pool checks for that driver and reproduce the same allocation/free path. A double free, wrong tag, invalid IRQL, and freeing an address that was never allocated are different defects and should not be collapsed into generic memory troubleshooting.
Official references
Looking for a different code? Search another status or error code.