| Previous | Next |
| THIRD_PARTY_FILE_SYSTEM_FAILURE | APP_TAGGING_INITIALIZATION_FAILED |
CRITICAL_STRUCTURE_CORRUPTION
Protected kernel structure corruption
CRITICAL_STRUCTURE_CORRUPTION is bug check code 0x00000109. The built-in table identifies it as Modification of system code or a critical data structure was detected.
; the useful diagnostic question is what Windows component raised the stop and which invariant failed.
This bug check usually means that something changed memory that Windows treats as critical: kernel code, dispatch tables, process lists, driver objects, pool metadata, protected process state, or similar structures.
How to read the parameters
- Parameter 4 is the most useful discriminator; it identifies the corrupted region or action class.
- Values can point to function modification, IDT/GDT changes, module list corruption, IRP allocator/dispatcher modification, protected process modification, pool corruption, or page hash mismatch.
- The first three parameters are reserved in the public documentation and should not be overinterpreted.
What to check in the dump
- Start with !analyze -v, then examine the stack and recently loaded kernel drivers.
- If Parameter 4 indicates pool corruption, use pool tracking, Driver Verifier, and special pool to catch the writer earlier.
- If it indicates code or table modification, check unsigned drivers, kernel patching, security software, rootkit-like behavior, and hardware memory corruption.
References
Looking for a different code? Search another status or error code.