| Previous | Next |
| NETIO_INVALID_POOL_CALLER | WORKER_THREAD_RETURNED_WITH_BAD_IO_PRIORITY |
PAGE_NOT_ZERO
Zero-page integrity failure for PAGE_NOT_ZERO
PAGE_NOT_ZERO is bug check code 0x00000127. Windows expects zeroed physical pages for security and correctness when handing memory to new consumers. This bug check suggests memory corruption, bad DMA, faulty RAM, or a driver writing to a page after it should no longer own it.
How to read it in a dump
- The PFN/page frame, pool tag, and recent owner are critical evidence.
- This is stronger than generic memory pressure because the page content violated a zeroing invariant.
- DMA-capable devices and drivers are common suspects when ordinary stacks do not explain the write.
What to check
- Run memory diagnostics after preserving the dump.
- Enable Driver Verifier, DMA verification, and Special Pool for suspect drivers.
- Check for recent storage, network, GPU, or device driver updates that can DMA into memory.
References
- Memory management for Windows drivers
- Driver Verifier
- Microsoft Bug Check Code Reference
- Analyze a kernel-mode dump with WinDbg
Dump evidence
Preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “this result”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order
- Run WinDbg
!analyze -v, then inspect the documented meaning of each parameter instead of relying only on the probably-caused-by line. - find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with page / zero.
- keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by this result before collecting the dump and event logs. Recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Looking for a different code? Search another status or error code.