BSOD 28 (PFN_REFERENCE_COUNT): causes and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: PFN_REFERENCE_COUNT

Could be also:
Constant	Type	OS
ERROR_OUT_OF_PAPER	Win32 error	Windows
KERN_INVALID_POLICY	Kern return	Mac
ippStsAffineQuadChanged	Intel Ipp Status	Any
ENOSPC	errno	Any

Previous	Next
SPIN_LOCK_ALREADY_OWNED	QUOTA_UNDERFLOW

PFN_REFERENCE_COUNT

PFN_REFERENCE_COUNT is bug check 0x1C. Microsoft's description is broader than the constant name suggests: it reports a reference-count error that can result from counter overflow, counter underflow, or use of an object after it was freed. Microsoft explicitly notes that this stop is used for multiple reference-count failures and is not necessarily related to Memory Manager page frame numbers.

Do not force the analysis into the PFN database

Parameters 1 through 4 are documented as not used. There is no published PFN index or object address in the bug-check arguments. The stack is the primary clue Microsoft calls out for determining the fault, so the owning subsystem must be established from the execution path rather than inferred from the acronym.

Reference-count questions to ask

Does the stack show an increment/decrement path around a shared kernel object?
Could an error path release a reference twice, omit a matching reference, or continue using an object after final release?
Do repeated dumps point to the same caller or object-lifetime transition?

References

Looking for a different code? Search another status or error code.