| Previous | Next |
| STATUS_PAGE_FAULT_DEMAND_ZERO | STATUS_PAGE_FAULT_GUARD_PAGE |
STATUS_PAGE_FAULT_COPY_ON_WRITE
The shared page became private for the writing process
Copy-on-write mappings let processes initially share physical contents while protecting the page from direct modification. When one process writes, the Memory Manager allocates a private page, copies the original contents, updates the process mapping, and resumes the instruction. The original shared page remains unchanged for other mappings.
The stock description associated with some NTSTATUS tables incorrectly repeats demand-zero wording, so the status name and fault context are important. Frequent copy-on-write faults are common after process creation or when writable image and mapped-section pages are modified; they increase private commit and should not be interpreted as file corruption.
What to inspect
- Inspect the PTE or region type and confirm that copy-on-write protection was active.
- Measure the resulting increase in private committed pages and process working set.
- Identify writes to shared image, fork-like clone, or mapped-section data before attempting to remove the protection.
References
- Microsoft: VirtualProtect
- Microsoft: File mapping
- ReactOS source: NT page-fault resolution
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.