| Previous | Next |
| STATUS_UNEXPECTED_IO_ERROR | STATUS_UNEXPECTED_MM_MAP_ERROR |
STATUS_UNEXPECTED_MM_CREATE_ERR
The original MM exception has already been normalized away
STATUS_UNEXPECTED_MM_CREATE_ERR is a normalization result, so debugging must start from the information-loss boundary. FsRtlNormalizeNtstatus accepts an arbitrary exception and a caller-selected generic status; when the original exception is outside the filter's handled set, the generic status is returned. The three UNEXPECTED_MM_* values therefore act as distinct fallback buckets selected by the calling path.
For the create bucket, focus on section-creation and file/Memory Manager synchronization evidence rather than assuming the visible status is the original fault. The WDK documents file-system callbacks around the Memory Manager acquiring a file before creating a memory-mapped section. SECTION_OBJECT_POINTERS links a file stream to data and image section state, and FltCreateSectionForDataScan exposes an explicit file-backed section creation path for minifilters.
Instrument the exception before normalization when source access is available. Record the original exception code, file object and stream identity, section type/protection, allocation attributes, and pre/post section-synchronization callbacks. Once only STATUS_UNEXPECTED_MM_CREATE_ERR remains, retrying section creation can reproduce the symptom but cannot recover the discarded cause. Compare it with MAP and EXTEND buckets only after preserving the operation path that chose this generic status.
What to inspect
- Log the pre-normalization exception code and the GenericException passed to FsRtlNormalizeNtstatus.
- Capture section-creation parameters and file-stream identity.
- Trace acquire/release callbacks for section synchronization around the failure.
References
- Microsoft WDK: FsRtlNormalizeNtstatus
- Microsoft WDK: FS_FILTER_CALLBACKS
- Microsoft WDK: SECTION_OBJECT_POINTERS
- Microsoft WDK: FltCreateSectionForDataScan
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.