BSOD 295 (PAGE_NOT_ZERO): causes and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The memory manager found a page that was expected to be zeroed but was not.

Could be also:
Constant	Type	OS
STATUS_INTERRUPT_VECTOR_ALREADY_CONNECTED	NTSTATUS	Windows

Previous	Next
NETIO_INVALID_POOL_CALLER	WORKER_THREAD_RETURNED_WITH_BAD_IO_PRIORITY

PAGE_NOT_ZERO

Zero-page integrity failure for PAGE_NOT_ZERO

PAGE_NOT_ZERO is bug check code 0x00000127. Windows expects zeroed physical pages for security and correctness when handing memory to new consumers. This bug check suggests memory corruption, bad DMA, faulty RAM, or a driver writing to a page after it should no longer own it.

How to read it in a dump

The PFN/page frame, pool tag, and recent owner are critical evidence.
This is stronger than generic memory pressure because the page content violated a zeroing invariant.
DMA-capable devices and drivers are common suspects when ordinary stacks do not explain the write.

What to check

Run memory diagnostics after preserving the dump.
Enable Driver Verifier, DMA verification, and Special Pool for suspect drivers.
Check for recent storage, network, GPU, or device driver updates that can DMA into memory.

References

Dump evidence

Preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “this result”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.

Analysis order

Run WinDbg !analyze -v, then inspect the documented meaning of each parameter instead of relying only on the probably-caused-by line.
find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with page / zero.
keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.

Do not repeatedly reboot a machine affected by this result before collecting the dump and event logs. Recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.

Looking for a different code? Search another status or error code.