| Previous | Next |
| REFERENCE_BY_POINTER | MEMORY_MANAGEMENT |
BAD_POOL_HEADER
The BAD_POOL_HEADER bug check has a value of 0x00000019. This indicates that a pool header is corrupt.
Important
BAD_POOL_HEADER Parameters
Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.
| Parameter 1 | Parameter 2 | Parameter 3 | Parameter 4 | Cause of Error |
|---|---|---|---|---|
0x2 |
The pool entry being checked |
The size of the pool block |
0 |
The special pool pattern check failed. (The owner has likely corrupted the pool block.) |
0x3 |
The pool entry being checked |
The read-back flink freelist value |
The read-back blink freelist value |
The pool freelist is corrupt. (In a healthy list, the values of Parameters 2, 3, and 4 should be identical.) |
0x5 |
One of the pool entries |
Reserved |
The other pool entry |
A pair of adjacent pool entries have headers that contradict each other. At least one of them is corrupt. |
0x6 |
One incorrectly-calculated entry |
Reserved |
The bad entry that caused the miscalculation |
The pool block header's previous size is too large. |
0x7 |
0 |
Reserved |
The bad pool entry |
The pool block header size is corrupt. |
0x8 |
0 |
Reserved |
The bad pool entry |
The pool block header size is zero. |
0x9 |
One incorrectly-calculated entry |
Reserved |
The bad entry that caused the miscalculation |
The pool block header size is corrupted (it is too large). |
0xA |
The pool entry that should have been found |
Reserved |
The virtual address of the page that should have contained the pool entry |
The pool block header size is corrupt. |
0xD, 0xE, 0xF, 0x23, 0x24, 0x25 |
Reserved |
Reserved |
Reserved |
The pool header of a freed block has been modified after it was freed. This is not typically the fault of the prior owner of the freed block; instead it is usually (but not always) due to the block preceding the freed block being overrun. |
0x20 |
The pool entry that should have been found |
The next pool entry |
Reserved |
The pool block header size is corrupt. |
0X21 |
The pool pointer being freed |
The number of bytes allocated for the pool block |
The corrupted value found following the pool block |
The data following the pool block being freed is corrupt. Typically this means the consumer (call stack) has overrun the block. |
0X22 |
The address being freed |
Reserved |
Reserved |
An address being freed does not have a tracking entry. This is usually because the call stack is trying to free a pointer that either has already been freed or was never allocated to begin with. |
Cause
The pool is already corrupted at the time of the current request.
This may or may not be due to the caller.
Resolution
The internal pool links must be walked using the kernel debugger to identify the damaged allocation and its surrounding pool state.
Use Parameter 1 to select the violation type, then correlate the reported pool address, size, and tag with !pool, !poolfind, !analyze -v, and Special Pool or Driver Verifier targeted at the suspect driver. The thread that detects the corrupt header is not necessarily the thread that corrupted it.
Preserve the failing pool tag, allocation/free stacks when available, and whether the corruption is a double free, invalid address, header overwrite, or data overrun. Repeated evidence tied to one tag or driver is more useful than generic memory tests.
Official references
Looking for a different code? Search another status or error code.