| Previous | Next |
| RECURSIVE_NMI | VIDEO_DXGKRNL_FATAL_ERROR |
MSRPC_STATE_VIOLATION
Microsoft RPC state violation for MSRPC_STATE_VIOLATION
MSRPC_STATE_VIOLATION is bug check code 0x00000112. This bug check points to an RPC state-machine violation severe enough to stop the system. It is most relevant when the stack shows RPC runtime, ALPC/LPC, service-control, or driver code using RPC-related kernel communication paths.
How to read it in a dump
- Use the stack to determine whether the violation is in RPC runtime, ALPC/LPC transport, service hosting, or a driver callback path.
- The symbolic name is about state transition, not network connectivity by itself.
- Parameters are less useful without symbols and the failing RPC/ALPC context.
What to check
- Check service-hosting components, security products, RPC filters, and drivers that participate in RPC/ALPC control paths.
- Correlate with service crashes, endpoint registration, shutdown, or session changes.
- Preserve a full dump when possible because cross-process communication state may be required.
References
Dump evidence
Preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “this result”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order
- Run WinDbg
!analyze -v, then inspect the documented meaning of each parameter instead of relying only on the probably-caused-by line. - find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with msrpc / state / violation.
- keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by this result before collecting the dump and event logs. Recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Looking for a different code? Search another status or error code.