What does BSOD 0x6 (INVALID_PROCESS_DETACH_ATTEMPT) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: A load-image callback misused KeStackAttachProcess/KeUnstackDetachProcess while executing in the target process context.

Could be also:
Constant	Type	OS
ERROR_INVALID_HANDLE	Win32 error	Windows
KERN_RESOURCE_SHORTAGE	Kern return	Mac
ippStsDivByZero	Intel Ipp Status	Any
ENXIO	errno	Any

Previous	Next
INVALID_PROCESS_ATTACH_ATTEMPT	INVALID_SOFTWARE_INTERRUPT

INVALID_PROCESS_DETACH_ATTEMPT

The INVALID_PROCESS_DETACH_ATTEMPT bug check has a value of 0x00000006.

This bug check appears very infrequently. This bug check can be caused by calling the KeStackAttachProcess routine and subsequently calling KeUnstackDetachProcess in the driver's implementation of the PLOAD_IMAGE_NOTIFY_ROUTINE callback function. The callback runs in a thread of the process in which the image loaded.

What to inspect

Find the driver stack at the bug check and identify any use of KeStackAttachProcess and KeUnstackDetachProcess.
Check whether a load-image notification callback changes process-attachment state while already running in the process whose image is being mapped.
Verify that every attach operation is paired exactly once with the matching detach operation on the same thread and control path.
Review cleanup and exception paths for an extra detach or a detach performed after attachment state has already been restored.

Correction

Fix the driver so process attachment and detachment remain strictly paired. In a load-image callback, avoid attaching to the process merely to access the process context that the callback already runs in. Reproduce with Driver Verifier or the original load scenario and confirm that the callback returns without changing the thread's attachment state unexpectedly.

References

Microsoft: Bug Check Code Reference

Looking for a different code? Search another status or error code.