| Previous | Next |
| CID_HANDLE_CREATION | REFERENCE_BY_POINTER |
CID_HANDLE_DELETION
Process/thread client ID handle deletion failure for CID_HANDLE_DELETION
CID_HANDLE_DELETION is bug check code 0x00000017. This is the teardown-side partner of CID handle creation. It points at inconsistent process or thread identity cleanup, stale references, or corruption around handle/object lifetime.
How to read it in a dump
- Look at the terminating process or thread and the handle table involved.
- A driver that retained references, altered callback state, or corrupted pool can be the real source.
- The stack should decide whether the failure is process teardown, thread teardown, or global object cleanup.
What to check
- Check kernel callbacks registered by security, monitoring, sandbox, and endpoint agents.
- Look for pool corruption before the failing teardown path.
- Compare creation and deletion dumps if both codes appear on the same machine.
References
Dump evidence
Preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “this result”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order
- Run WinDbg
!analyze -v, then inspect the documented meaning of each parameter instead of relying only on the probably-caused-by line. - find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with cid / handle / deletion.
- keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by this result before collecting the dump and event logs. Recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Looking for a different code? Search another status or error code.