BSOD 0xFA (HTTP_DRIVER_CORRUPTED): causes and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The HTTP kernel driver (http.sys) reached a corrupted state and can not recover. This means that the HTTP module detected that its private data is corrupted. This usually results in eventual corruption of the thread pool and an access violation.

Previous	Next
DRIVER_RETURNED_STATUS_REPARSE_FOR_VOLUME_OPEN	RECURSIVE_MACHINE_CHECK

HTTP_DRIVER_CORRUPTED

http.sys corruption

HTTP_DRIVER_CORRUPTED is bug check code 0x000000FA. The HTTP kernel driver (http.sys) detected corruption in its private state and could not recover.

This bug check is specific to the kernel-mode HTTP stack, commonly known as http.sys. It indicates that the HTTP driver reached a corrupted internal state, not that a web server returned an HTTP error code.

How to read the parameters

The stack should show whether the crash is in request queue, URL group, connection, cache, SSL binding, or kernel HTTP I/O paths.
The bug check arguments are less useful than the http.sys stack and pool state.
User-mode services such as IIS or HTTP Server API applications may trigger the workload but do not execute in kernel mode.

What to check in the dump

Check http.sys version, cumulative updates, IIS/HTTP Server API workload, kernel pool corruption evidence, and third-party network filters.
Correlate with high connection churn, TLS offload, URL reservations, and request queue lifetime.
Separate this from HTTP status codes; this is a Windows kernel crash code.

References

Looking for a different code? Search another status or error code.