BSOD 350 (BUGCODE_NDIS_DRIVER_LIVE_DUMP): causes and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: NDIS captured a live kernel dump for a network-driver problem without bug checking the system.

Could be also:
Constant	Type	OS
ERROR_FAIL_NOACTION_REBOOT	Win32 error	Windows

Previous	Next
SOC_SUBSYSTEM_FAILURE_LIVEDUMP	CONNECTED_STANDBY_WATCHDOG_TIMEOUT_LIVEDUMP

BUGCODE_NDIS_DRIVER_LIVE_DUMP

NDIS network-driver live dump for BUGCODE_NDIS_DRIVER_LIVE_DUMP

BUGCODE_NDIS_DRIVER_LIVE_DUMP is bug check code 0x0000015E. This value identifies a live dump, not a normal fatal stop. NDIS captured state because it detected a serious network-driver condition such as a stuck NET_BUFFER_LIST or driver-model violation, but NDIS did not itself crash the system.

How to read it in a dump for BUGCODE_NDIS_DRIVER_LIVE_DUMP

Parameter 1 is the NDIS live-dump reason code.
Microsoft documents this as a live dump: NDIS captures a kernel dump and does not generate a bug check in this situation.
The dump is still valuable because it contains NDIS and driver state at the time of the network fault.

What to check for BUGCODE_NDIS_DRIVER_LIVE_DUMP

Analyze the NDIS reason code and the miniport/filter/protocol driver on the stack.
Check VPN, firewall, virtual switch, packet capture, NIC offload, and team/bonding drivers.
Use NDIS verifier for reproducible driver-model violations.

References for BUGCODE_NDIS_DRIVER_LIVE_DUMP

Dump evidence for BUGCODE_NDIS_DRIVER_LIVE_DUMP

For BUGCODE_NDIS_DRIVER_LIVE_DUMP, preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “BUGCODE_NDIS_DRIVER_LIVE_DUMP”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.

Analysis order for BUGCODE_NDIS_DRIVER_LIVE_DUMP

Run WinDbg !analyze -v, then inspect the documented meaning of each BUGCODE_NDIS_DRIVER_LIVE_DUMP parameter instead of relying only on the probably-caused-by line.
For BUGCODE_NDIS_DRIVER_LIVE_DUMP, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with bugcode / ndis / driver / live / dump.
For BUGCODE_NDIS_DRIVER_LIVE_DUMP, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.

Do not repeatedly reboot a machine affected by BUGCODE_NDIS_DRIVER_LIVE_DUMP before collecting the dump and event logs. For BUGCODE_NDIS_DRIVER_LIVE_DUMP, recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.

Dump evidence for BUGCODE_NDIS_DRIVER_LIVE_DUMP

Analysis order for BUGCODE_NDIS_DRIVER_LIVE_DUMP

Run WinDbg !analyze -v, then inspect the documented meaning of each BUGCODE_NDIS_DRIVER_LIVE_DUMP parameter instead of relying only on the probably-caused-by line.
For BUGCODE_NDIS_DRIVER_LIVE_DUMP, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with bugcode / ndis / driver / live / dump.
For BUGCODE_NDIS_DRIVER_LIVE_DUMP, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.

Looking for a different code? Search another status or error code.