| Previous | Next |
| STATUS_NDIS_INDICATION_REQUIRED | STATUS_DATATYPE_MISALIGNMENT |
STATUS_GUARD_PAGE_VIOLATION
A one-shot guard-page alarm was triggered
PAGE_GUARD is a protection modifier used as a one-shot alarm. The first access raises this exception and Windows clears the guard modifier for that page. Stacks use guard pages to detect growth, but applications can also create them around dynamic regions, so the presence of this code does not by itself prove a stack overflow.
The next access might succeed because the guard bit has already been removed. A handler that wants continued monitoring must deliberately restore PAGE_GUARD after making the underlying operation safe. If the page belongs to a thread stack, the useful question is whether the operating system committed the next page and moved the guard boundary, or whether the reserve was exhausted and the event progressed to STATUS_STACK_OVERFLOW.
What to inspect
- Inspect the faulting address and whether the operation was a read, write, or execute access.
- Check whether the page belongs to a stack or to an application-defined guarded region.
- Remember that PAGE_GUARD is cleared after the first access.
- Do not blindly continue execution if the address is outside the intended allocation.
References
- Microsoft Learn: Creating Guard Pages
- Microsoft Learn: EXCEPTION_RECORD
- Microsoft Learn: Exception Dispatching
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.