What does Windows error code 556 (ERROR_UNEXPECTED_MM_CREATE_ERR) mean?

ERROR_UNEXPECTED_MM_CREATE_ERR

FsRtl converted an unrecognized memory-manager create error

ERROR_UNEXPECTED_MM_CREATE_ERR is a fallback translation boundary. If the memory manager returns an error that the standard FsRtl filter does not define, Windows converts it to one of the guaranteed filter-visible results. For this value, the failing path is the create side of that boundary. The conversion intentionally loses the original detailed memory-manager status.

What the code does and does not prove

The result does not by itself prove low memory, a corrupt executable, a bad disk, or a defective filter driver. Those can only be established from evidence closer to the original failure. A Win32 caller that sees only this translated code may no longer have the original NTSTATUS.

Diagnostic evidence

• Record the exact API and object being created, file or image path when applicable, requested mapping/section parameters, and the first operation that failed.
• For reproducible failures, trace at the filesystem/filter or kernel boundary so the original memory-manager status can be captured before FsRtl converts it.
• Correlate storage, filesystem, Code Integrity, loader, and memory events only when they occur at the same first-failure timestamp; do not infer a cause from this fallback value alone.

Recovery boundary

Correct the underlying condition identified by the original status and recreate the failed object. Do not continue with a partially created section or mapping, and do not translate this fallback automatically to “out of memory.”

References

• Microsoft: System Error Codes 500–999
• Microsoft: Retrieving the last-error code