| Previous | Next |
| EMPTY_THREAD_REAPER_LIST | LAST_CHANCE_CALLED_FROM_KMODE |
CREATE_DELETE_LOCK_NOT_LOCKED
Object lifetime create/delete lock violation for CREATE_DELETE_LOCK_NOT_LOCKED
CREATE_DELETE_LOCK_NOT_LOCKED is bug check code 0x00000014. This code indicates an internal object-lifetime path was entered without the required protection. It is useful when the dump points at handle, process, thread, or object manager creation/deletion state.
How to read it in a dump
- The important clue is which object type is being created or deleted.
- The stop code alone does not identify a user-mode handle problem; it indicates kernel synchronization around object lifetime.
- Look for stack frames in object manager, process/thread, security, or a third-party callback.
What to check
- Review object callbacks and drivers that participate in process, thread, handle, or image events.
- Check for memory corruption around executive objects.
- Use Driver Verifier on file-system, security, and monitoring drivers involved in object lifetime.
References
Dump evidence
Preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “this result”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order
- Run WinDbg
!analyze -v, then inspect the documented meaning of each parameter instead of relying only on the probably-caused-by line. - find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with create / delete / lock / locked.
- keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by this result before collecting the dump and event logs. Recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Looking for a different code? Search another status or error code.