BSOD 0x5 (INVALID_PROCESS_ATTACH_ATTEMPT): causes and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: INVALID_PROCESS_ATTACH_ATTEMPT means a thread attempted a process attachment in a context where that attachment is not allowed.

Could be also:
Constant	Type	OS
ERROR_ACCESS_DENIED	Win32 error	Windows
KERN_FAILURE	Kern return	Mac
ippStsEvenMedianMaskSize	Intel Ipp Status	Any
EIO	errno	Any

Previous	Next
INVALID_DATA_ACCESS_TRAP	INVALID_PROCESS_DETACH_ATTEMPT

INVALID_PROCESS_ATTACH_ATTEMPT

This bug check appears very infrequently.

INVALID_PROCESS_ATTACH_ATTEMPT Parameters

Parameter	Description
1	The pointer to the dispatcher object for the target process, or if the thread is already attached, the pointer to the object for the original process.
2	The pointer to the dispatcher object of the process that the current thread is currently attached to.
3	The value of the thread's APC state index.
4	A non-zero value indicates that a DPC is running on the current processor.

Remarks for INVALID_PROCESS_ATTACH_ATTEMPT

For INVALID_PROCESS_ATTACH_ATTEMPT, The !analyze debug extension displays information about the bug check and can be helpful in determining the root cause.

This bug check can occur if the driver calls the KeAttachProcess function and the thread is already attached to another process. It is better to use the KeStackAttachProcess function. If the current thread was already attached to another process, the KeStackAttachProcess function saves the current APC state before it attaches the current thread to the new process. Calling KeStackAttachProcess incorrectly can also cause this bug check, for example if a DPC is running on the current processor.

For general information about this area, see working with Windows Kernel-Mode Process and Thread Manager and Introduction to Kernel Dispatcher Objects.

Looking for a different code? Search another status or error code.