| Previous | Next |
| DFSC_FILE_SYSTEM | WDF_VIOLATION |
FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION
Extra Create Parameter contract violation for FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION
FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION is bug check code 0x0000010C. Extra Create Parameters are attached to create/open requests so file systems and filters can pass structured metadata. This bug check indicates that an ECP list or ECP context violated FSRTL ownership, format, lifetime, or usage rules.
How to read it in a dump for FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION
- The failing stack should show a file system, minifilter, legacy filter, or network redirector create path.
- The bad object is likely an ECP list, ECP context, or create IRP state.
- The issue is a kernel file-system contract violation, not a user-mode CreateFile error.
What to check for FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION
- Audit filter create callbacks for ECP allocation, insertion, lookup, and cleanup rules.
- Check whether an ECP is reused after completion or modified by the wrong component.
- Use Driver Verifier and filter-manager diagnostics on the suspected file-system filter.
References for FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION
- Microsoft Extra Create Parameters documentation
- Microsoft Bug Check Code Reference
- Crash dump files and WinDbg
Dump evidence for FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION
For FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION, preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order for FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION
- Run WinDbg
!analyze -v, then inspect the documented meaning of each FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION parameter instead of relying only on the probably-caused-by line. - For FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with fsrtl / extra / create / parameter / violation.
- For FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION before collecting the dump and event logs. For FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION, recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Dump evidence for FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION
For FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION, preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order for FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION
- Run WinDbg
!analyze -v, then inspect the documented meaning of each FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION parameter instead of relying only on the probably-caused-by line. - For FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with fsrtl / extra / create / parameter / violation.
- For FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION before collecting the dump and event logs. For FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION, recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Looking for a different code? Search another status or error code.