| Previous | Next |
| WIN32K_CRITICAL_FAILURE_LIVEDUMP | KERNEL_AUTO_BOOST_LOCK_ACQUISITION_WITH_RAISED_IRQL |
PF_DETECTED_CORRUPTION
Page-file corruption detected for PF_DETECTED_CORRUPTION
PF_DETECTED_CORRUPTION is bug check code 0x00000191. This bug check points at page-file or paging metadata corruption. It is distinct from ordinary low memory: the system detected inconsistent data in a paging path that is required for safe memory management.
How to read it in a dump for PF_DETECTED_CORRUPTION
- Check paging file configuration, disk errors, storage filters, and memory-management state.
- Corruption can originate in storage, memory, or a driver writing to wrong memory.
- A full or kernel dump is more useful than a minidump.
What to check for PF_DETECTED_CORRUPTION
- Run storage diagnostics and memory tests after preserving the dump.
- Check disk, controller, and filter-driver event logs.
- Inspect page-file location and recent changes to paging configuration.
References for PF_DETECTED_CORRUPTION
Dump evidence for PF_DETECTED_CORRUPTION
For PF_DETECTED_CORRUPTION, preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “PF_DETECTED_CORRUPTION”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order for PF_DETECTED_CORRUPTION
- Run WinDbg
!analyze -v, then inspect the documented meaning of each PF_DETECTED_CORRUPTION parameter instead of relying only on the probably-caused-by line. - For PF_DETECTED_CORRUPTION, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with pf / detected / corruption.
- For PF_DETECTED_CORRUPTION, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by PF_DETECTED_CORRUPTION before collecting the dump and event logs. For PF_DETECTED_CORRUPTION, recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Dump evidence for PF_DETECTED_CORRUPTION
For PF_DETECTED_CORRUPTION, preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “PF_DETECTED_CORRUPTION”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order for PF_DETECTED_CORRUPTION
- Run WinDbg
!analyze -v, then inspect the documented meaning of each PF_DETECTED_CORRUPTION parameter instead of relying only on the probably-caused-by line. - For PF_DETECTED_CORRUPTION, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with pf / detected / corruption.
- For PF_DETECTED_CORRUPTION, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by PF_DETECTED_CORRUPTION before collecting the dump and event logs. For PF_DETECTED_CORRUPTION, recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Looking for a different code? Search another status or error code.