| Previous | Next |
| SOC_SUBSYSTEM_FAILURE_LIVEDUMP | CONNECTED_STANDBY_WATCHDOG_TIMEOUT_LIVEDUMP |
BUGCODE_NDIS_DRIVER_LIVE_DUMP
NDIS network-driver live dump for BUGCODE_NDIS_DRIVER_LIVE_DUMP
BUGCODE_NDIS_DRIVER_LIVE_DUMP is bug check code 0x0000015E. This value identifies a live dump, not a normal fatal stop. NDIS captured state because it detected a serious network-driver condition such as a stuck NET_BUFFER_LIST or driver-model violation, but NDIS did not itself crash the system.
How to read it in a dump for BUGCODE_NDIS_DRIVER_LIVE_DUMP
- Parameter 1 is the NDIS live-dump reason code.
- Microsoft documents this as a live dump: NDIS captures a kernel dump and does not generate a bug check in this situation.
- The dump is still valuable because it contains NDIS and driver state at the time of the network fault.
What to check for BUGCODE_NDIS_DRIVER_LIVE_DUMP
- Analyze the NDIS reason code and the miniport/filter/protocol driver on the stack.
- Check VPN, firewall, virtual switch, packet capture, NIC offload, and team/bonding drivers.
- Use NDIS verifier for reproducible driver-model violations.
References for BUGCODE_NDIS_DRIVER_LIVE_DUMP
- Microsoft NDIS documentation
- Microsoft NDIS documentation
- Microsoft Bug Check Code Reference
- Crash dump files and WinDbg
Dump evidence for BUGCODE_NDIS_DRIVER_LIVE_DUMP
For BUGCODE_NDIS_DRIVER_LIVE_DUMP, preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “BUGCODE_NDIS_DRIVER_LIVE_DUMP”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order for BUGCODE_NDIS_DRIVER_LIVE_DUMP
- Run WinDbg
!analyze -v, then inspect the documented meaning of each BUGCODE_NDIS_DRIVER_LIVE_DUMP parameter instead of relying only on the probably-caused-by line. - For BUGCODE_NDIS_DRIVER_LIVE_DUMP, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with bugcode / ndis / driver / live / dump.
- For BUGCODE_NDIS_DRIVER_LIVE_DUMP, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by BUGCODE_NDIS_DRIVER_LIVE_DUMP before collecting the dump and event logs. For BUGCODE_NDIS_DRIVER_LIVE_DUMP, recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Dump evidence for BUGCODE_NDIS_DRIVER_LIVE_DUMP
For BUGCODE_NDIS_DRIVER_LIVE_DUMP, preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “BUGCODE_NDIS_DRIVER_LIVE_DUMP”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.
Analysis order for BUGCODE_NDIS_DRIVER_LIVE_DUMP
- Run WinDbg
!analyze -v, then inspect the documented meaning of each BUGCODE_NDIS_DRIVER_LIVE_DUMP parameter instead of relying only on the probably-caused-by line. - For BUGCODE_NDIS_DRIVER_LIVE_DUMP, find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with bugcode / ndis / driver / live / dump.
- For BUGCODE_NDIS_DRIVER_LIVE_DUMP, keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.
Do not repeatedly reboot a machine affected by BUGCODE_NDIS_DRIVER_LIVE_DUMP before collecting the dump and event logs. For BUGCODE_NDIS_DRIVER_LIVE_DUMP, recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.
Looking for a different code? Search another status or error code.