Bug Check Codes

The Windows kernel has always been able to stop itself, and thus the whole of Windows, if something has gone so seriously wrong that execution can’t continue—or just wrong enough to doubt the safety of even trying to continue. The documentation’s description of an “immediate, controlled shutdown” must of course be understood as relative. The system does what it can—and it tends not to be appreciated even nearly enough how much work Microsoft has put in to this—but what can be done cannot be much.

The whole point to stopping is that everything is suspect. Just being able to control the crash is no small feat of planning. For instance, the kernel would ideally save a crash dump for subsequent analysis by “an experienced debugging technician”, but the cause of the crash could be a driver for disk I/O: therefore disk I/O to save a crash dump goes through a separate set of drivers that have been kept out of the way, hopefully safe from corruption, just in case.

Historically, this dire state of having to stop Windows was presented to the user by reverting to the video BIOS’s text mode—again, drivers can’t be trusted—to fill the display with white monotype characters on a blue background which has become known colloquially as the Blue Screen Of Death. The verb phrase blue screen and the acronym BSOD are very common in users’ descriptions.

To get to this state programmatically, one of the kernel’s exported functions KeBugCheck or KeBugCheckEx is called, whether by the kernel itself or by some kernel-mode module such as the HAL or a driver, or the kernel calls directly to some internal routine that is anyway the essence of KeBugCheckEx. The one KeBugCheck argument, which is also the first of the KeBugCheckEx arguments, becomes the defining characteristic. Microsoft’s C-language declarations of the function have always named this as BugCheckCode and so the term bug check code is common, but the term stop code is also common because that’s how it was originally presented to users:

*** STOP: BugCheckCode (BugCheckParameter1, BugCheckParameter2, BugCheckParameter3, BugCheckParameter4)

Each of this line’s placeholders is in C-language hexadecimal notation. Most versions follow with at least some attempt to render the BugCheckCode in something closer to plain language. The earliest versions tend to be brief about this, contenting themselves with the bug check’s symbolic name such as INACCESSIBLE_BOOT_DEVICE or a single-line explanation such as “Mismatched kernel and hal image”, on the way to naming executable modules that look relevant and to showing something of the machine state. Later versions leave such programming details to be recovered from a crash dump and instead get more expansive with a plain-language interpretation and some suggestions for troubleshooting. Users apparently didn’t feel helped either way: the practical history of how Microsoft presents bug checks to users has ever since been one of reducing them to uselessness for everyone.

If too few users ever did have the experience that the technical gibberish on the blue screen actually did get the problem solved, it’s not the fault of the gibberish. To the programmer of a driver whose fault just stopped Windows for a customer, the bug check code and the resolution of a bug check parameter to a relative address within the driver, as read from the display by the customer and relayed over the telephone, will sometimes have sufficed for identifying the fault and fixing it in the next build. Of course, not all programmers of kernel-mode drivers have the luxury of having specialised enough to know their work so well, and not all problems that stop Windows have a cause that’s so immediate that deduction is even possible just from what the kernel can show on the blue screen at the time of detection. Indeed, not all problems that stop Windows are the fault of third-party drivers. A good proportion are coding errors in Microsoft’s own drivers and even in the kernel itself, especially in new functionality. Many bug checks are not understood without very close and lengthy study using specialised tools (a debugger) and highly specialised knowledge. But almost all are understandable with enough skill, experience and attention—and all such analysis starts with the bug check code. Even if it only sometimes ends there too, Microsoft was not wrong to write in the Windows NT 3.51 Resource Kit that

The content of the symbolic string may suggest, to a trained technician, the part of the Kernel that detected the condition from which there was no recourse but to stop.

Documentation Status

Given this early recognition by Microsoft that bug check codes are useful, the natural expectation is that they’ve always been documented. They might even be thought important to document, not just for advanced programmers (who are this website’s intended readers) but for the system administrators and other support staff who will be the first port of call for users who have Windows stop on them. After all, Microsoft’s own words at the end of every blue screen from the first release were:

Restart your computer. If this message reappears, do not restart.
Contact your system administrator or technical support group, and/or
peripheral device vendor.

Quite what Microsoft imagined could result from such contact, back then, is unclear. Definitive documentation is surprisingly hard to pin down for the early versions and I don’t think it’s unfair to say that Microsoft has never given more than the appearance of providing good documentation to work from.

Enumeration

The tables below list every bug check code that is known in any of several ways:

from any BUGCODES.H in a DDK or WDK;
from the message resource in any x86 or x64 kernel;
from known use by a kernel-mode binary, e.g., as the first argument for a call to KeBugCheckEx.

The first two are closely related since the header and the resource look to be generated by the Message Compiler from the same input. Every message resource has a #define in the header, but not conversely. Some message resources are not bug check codes but instead elaborate the description of bug checks, e.g., to suggest options for product support or diagnosis. The third way that bug check codes are known for the tables below is more problematic: discovering bug check codes that are used without being formally defined is, of course, only ever a work in progress.

The Name given for a Value is from the corresponding #define in BUGCODES.H. A Value for which the Name is not in bold is thought to have never been intended as a bug check.

The Versions given for a Value are those that have a definition in BUGCODES.H from the corresponding kit or have a message in the compiled resource from the corresponding kernel. The following shorthands are used for changes that are yet noticed to have occurred within a version:

late 4.0 starts with Windows NT 4.0 SP6;
mid 5.1 starts with Windows XP SP1;
late 5.1 starts with Windows XP SP2;
late 5.2 starts with Windows Server 2003 SP1;
late 6.0 starts with Windows Vista SP1.

The shorthand “all” in the Versions column means version 3.10 and higher. The survey presently reaches to the 1803 release of Windows 10. If you want more up-to-date information, try getting it from Microsoft.

That a bug check is listed as “used by kernel” presently means that the 32-bit kernel in the listed versions has code that would raise the bug check. Other bug checks are specifically 64-bit and many more are raised only by the HAL or by drivers. Enumerating these is left for another time (or may be in progress). It’s very plausible that even more can be raised only in checked builds. These are unlikely ever to be taken up here. The aim is anyway not for an exhaustive list of all use. That a bug check is not listed as used does not mean it is not used, only that I haven’t found where in a more or less mechanical survey. Again, if you want comprehensiveness, try getting it from Microsoft—and, better yet, wonder why getting it from Microsoft, who have just stopped your computer, should be any sort of effort.

The word “all” for versions in the Known Use column is short for all applicable versions (as listed in the Versions column): no case is known (or expected) of a bug check being used before it is defined. Contrast with the many in which a bug check is known to be used before it is documented.

Original

Windows was born with 127 different types of bug check. How many were actually possible is not known. Some may have been intended for portability and never got developed for the i386 (which is the only originally supported processor architecture that this note can be interested in). Many are plainly intended for use by particular drivers or types of driver. Such cases aside, that a bug check code is defined this early likely means that the unrecoverable trouble it signifies is with functionality that’s fundamental. Among the implications is that many of these bug checks can be raised by the kernel in all known versions and are even still among the most frequently encountered in real-world use.

Value	Name	Versions	Known Use	Remarks
0x01	APC_INDEX_MISMATCH	all	kernel in 3.10; kernel in 6.0 and higher
0x02	DEVICE_QUEUE_NOT_BUSY	all
0x03	INVALID_AFFINITY_SET	all	kernel in 3.10 to 5.2
0x04	INVALID_DATA_ACCESS_TRAP	all
0x05	INVALID_PROCESS_ATTACH_ATTEMPT	all	kernel in 4.0 and higher
0x06	INVALID_PROCESS_DETACH_ATTEMPT	all	kernel in 5.0 and higher
0x07	INVALID_SOFTWARE_INTERRUPT	all
0x08	IRQL_NOT_DISPATCH_LEVEL	all
0x09	IRQL_NOT_GREATER_OR_EQUAL	all
0x0A	IRQL_NOT_LESS_OR_EQUAL	all	kernel in all; HAL in 6.0 to 6.1
0x0B	NO_EXCEPTION_HANDLING_SUPPORT	all
0x0C	MAXIMUM_WAIT_OBJECTS_EXCEEDED	all	kernel in all
0x0D	MUTEX_LEVEL_NUMBER_VIOLATION	all	kernel in 3.10
0x0E	NO_USER_MODE_CONTEXT	all	kernel in all
0x0F	SPIN_LOCK_ALREADY_OWNED	all
0x10	SPIN_LOCK_NOT_OWNED	all
0x11	THREAD_NOT_MUTEX_OWNER	all	kernel in 3.10
0x12	TRAP_CAUSE_UNKNOWN	all	kernel in all
0x13	EMPTY_THREAD_REAPER_LIST	all
0x14	CREATE_DELETE_LOCK_NOT_LOCKED	all	kernel in 3.10
0x15	LAST_CHANCE_CALLED_FROM_KMODE	all
0x16	CID_HANDLE_CREATION	all
0x17	CID_HANDLE_DELETION	all	kernel in all
0x18	REFERENCE_BY_POINTER	all	kernel in 3.10 to 3.51; kernel in 6.0 and higher
0x19	BAD_POOL_HEADER	all	kernel in 3.51; kernel in 6.0 and higher
0x1A	MEMORY_MANAGEMENT	all	kernel in all
0x1B	PFN_SHARE_COUNT	all
0x1C	PFN_REFERENCE_COUNT	all
0x1D	NO_SPIN_LOCK_AVAILABLE	all
0x1E	KMODE_EXCEPTION_NOT_HANDLED	all	kernel in all
0x1F	SHARED_RESOURCE_CONV_ERROR	all
0x20	KERNEL_APC_PENDING_DURING_EXIT	all	kernel in all
0x21	QUOTA_UNDERFLOW	all	kernel in 6.0 and higher
0x22	FILE_SYSTEM	all	kernel in all
0x23	FAT_FILE_SYSTEM	all
0x24	NTFS_FILE_SYSTEM	all
0x25	NPFS_FILE_SYSTEM	all
0x26	CDFS_FILE_SYSTEM	all
0x27	RDR_FILE_SYSTEM	all
0x28	CORRUPT_ACCESS_TOKEN	all
0x29	SECURITY_SYSTEM	all	kernel in all
0x2A	INCONSISTENT_IRP	all
0x2B	PANIC_STACK_SWITCH	all
0x2C	PORT_DRIVER_INTERNAL	all
0x2D	SCSI_DISK_DRIVER_INTERNAL	all
0x2E	DATA_BUS_ERROR	all
0x2F	INSTRUCTION_BUS_ERROR	all
0x30	SET_OF_INVALID_CONTEXT	all	kernel in all
0x31	PHASE0_INITIALIZATION_FAILED	all	kernel in all
0x32	PHASE1_INITIALIZATION_FAILED	all	kernel in all
0x33	UNEXPECTED_INITIALIZATION_CALL	all	kernel in all
0x34	CACHE_MANAGER	all	kernel in all
0x35	NO_MORE_IRP_STACK_LOCATIONS	all	kernel in all
0x36	DEVICE_REFERENCE_COUNT_NOT_ZERO	all	kernel in 3.10 to 4.0
0x37	FLOPPY_INTERNAL_ERROR	all
0x38	SERIAL_DRIVER_INTERNAL	all
0x39	SYSTEM_EXIT_OWNED_MUTEX	all	kernel in 6.0 and higher
0x3A	SYSTEM_UNWIND_PREVIOUS_USER	all
0x3B	SYSTEM_SERVICE_EXCEPTION	all
0x3C	INTERRUPT_UNWIND_ATTEMPTED	all
0x3D	INTERRUPT_EXCEPTION_NOT_HANDLED	all
0x3E	MULTIPROCESSOR_CONFIGURATION_NOT_SUPPORTED	all	kernel in all
0x3F	NO_MORE_SYSTEM_PTES	all	kernel in all
0x40	TARGET_MDL_TOO_SMALL	all	kernel in 3.10 to 6.1
0x41	MUST_SUCCEED_POOL_EMPTY	all	kernel in all
0x42	ATDISK_DRIVER_INTERNAL	all
0x43	NO_SUCH_PARTITION	all
0x44	MULTIPLE_IRP_COMPLETE_REQUESTS	all	kernel in all
0x45	INSUFFICIENT_SYSTEM_MAP_REGS	all
0x46	DEREF_UNKNOWN_LOGON_SESSION	all	kernel in all
0x47	REF_UNKNOWN_LOGON_SESSION	all
0x48	CANCEL_STATE_IN_COMPLETED_IRP	all	kernel in all
0x49	PAGE_FAULT_WITH_INTERRUPTS_OFF	all
0x4A	IRQL_GT_ZERO_AT_SYSTEM_SERVICE	all	kernel in 6.0 and higher
0x4B	STREAMS_INTERNAL_ERROR	all
0x4C	FATAL_UNHANDLED_HARD_ERROR	all	kernel in 3.51 and higher
0x4D	NO_PAGES_AVAILABLE	all	kernel in all
0x4E	PFN_LIST_CORRUPT	all	kernel in all
0x4F	NDIS_INTERNAL_ERROR	all
0x50	PAGE_FAULT_IN_NONPAGED_AREA	all	kernel in 3.51 and higher
0x51	REGISTRY_ERROR	all	kernel in all
0x52	MAILSLOT_FILE_SYSTEM	all
0x53	NO_BOOT_DEVICE	all
0x54	LM_SERVER_INTERNAL_ERROR	all
0x55	DATA_COHERENCY_EXCEPTION	all	kernel in 10.0 and higher
0x56	INSTRUCTION_COHERENCY_EXCEPTION	all
0x57	XNS_INTERNAL_ERROR	all
0x58	FTDISK_INTERNAL_ERROR	3.10 to 6.0
0x58	VOLMGRX_INTERNAL_ERROR	6.1 and higher
0x59	PINBALL_FILE_SYSTEM	all
0x5A	CRITICAL_SERVICE_FAILED	all	kernel in 3.10 to 3.50; kernel in 6.2 and higher
0x5B	SET_ENV_VAR_FAILED	all	kernel in 3.10 to 5.2
0x5C	HAL_INITIALIZATION_FAILED	all	kernel in all; HAL in 5.0 and higher
0x5D	HEAP_INITIALIZATION_FAILED	3.10 to 3.50	kernel in 3.10 to 3.50
	undefined	3.51 only
	UNSUPPORTED_PROCESSOR	4.0 and higher	kernel in 4.0 and higher
0x5E	OBJECT_INITIALIZATION_FAILED	all	kernel in all
0x5F	SECURITY_INITIALIZATION_FAILED	all	kernel in all
0x60	PROCESS_INITIALIZATION_FAILED	all	kernel in all
0x61	HAL1_INITIALIZATION_FAILED	all	kernel in all
0x62	OBJECT1_INITIALIZATION_FAILED	all	kernel in all
0x63	SECURITY1_INITIALIZATION_FAILED	all	kernel in all
0x64	SYMBOLIC_INITIALIZATION_FAILED	all	kernel in all
0x65	MEMORY1_INITIALIZATION_FAILED	all	kernel in all
0x66	CACHE_INITIALIZATION_FAILED	all	kernel in all
0x67	CONFIG_INITIALIZATION_FAILED	all	kernel in all
0x68	FILE_INITIALIZATION_FAILED	all	kernel in all
0x69	IO1_INITIALIZATION_FAILED	all	kernel in all
0x6A	LPC_INITIALIZATION_FAILED	all	kernel in all
0x6B	PROCESS1_INITIALIZATION_FAILED	all	kernel in all
0x6C	REFMON_INITIALIZATION_FAILED	all	kernel in all
0x6D	SESSION1_INITIALIZATION_FAILED	all	kernel in all
0x6E	SESSION2_INITIALIZATION_FAILED	3.10 to 6.3	kernel in 3.10 to 6.3
0x6E	BOOTPROC_INITIALIZATION_FAILED	10.0 and higher	kernel in 10.0 and higher
0x6F	SESSION3_INITIALIZATION_FAILED	3.10 to 6.3	kernel in 3.10 to 6.3
0x6F	VSL_INITIALIZATION_FAILED	1607 and higher
0x70	SESSION4_INITIALIZATION_FAILED	3.10 to 6.3	kernel in 3.10 to 6.3
0x70	SOFT_RESTART_FATAL_ERROR	1607 and higher
0x71	SESSION5_INITIALIZATION_FAILED	3.10 to 6.3	kernel in 3.10 to 6.3
0x72	ASSIGN_DRIVE_LETTERS_FAILED	all	HAL in 3.10 to 3.50; kernel in 3.51 to 6.0
0x73	CONFIG_LIST_FAILED	all	kernel in all
0x74	BAD_SYSTEM_CONFIG_INFO	all	kernel in all
0x75	CANNOT_WRITE_CONFIGURATION	all	kernel in 3.10 to 4.0
0x76	PROCESS_HAS_LOCKED_PAGES	all	kernel in 5.0 and higher
0x77	KERNEL_STACK_INPAGE_ERROR	all	kernel in all
0x78	PHASE0_EXCEPTION	all	kernel in all
0x79	MISMATCHED_HAL	all	HAL in all; kernel in 4.0 to 6.2
0x7A	KERNEL_DATA_INPAGE_ERROR	all	kernel in all
0x7B	INACCESSIBLE_BOOT_DEVICE	all	kernel in all
0x7C	BUGCODE_PSS_MESSAGE	3.10 to 5.0		next as 0x40000082
	undefined	5.1 only
	BUGCODE_NDIS_DRIVER	5.2 and higher		see 0xD2 for history
0x7D	INSTALL_MORE_MEMORY	all	kernel in all
0x7E	SYSTEM_THREAD_EXCEPTION_NOT_HANDLED	5.1 and higher	kernel in 5.1 and higher
0x7F	UNEXPECTED_KERNEL_MODE_TRAP	all	kernel in all
0x80	NMI_HARDWARE_FAILURE	all	HAL in 5.0 and higher
0x81	SPIN_LOCK_INIT_FAILURE	all

Bug check 0x09 is among the earliest examples of bug checks whose use is known only in checked builds. It’s also an example of the small confusions that have been the everyday lot of the kernel-mode Windows programmer right from the start (with no sign yet of a stop). The KefAcquireSpinLockAtDpcLevel function, which is what a macro redefines KeAcquireSpinLockAtDpcLevel to, is nowadays documented for use at DISPATCH_LEVEL and higher. Call it with a lower IRQL and checked builds raise IRQL_NOT_GREATER_OR_EQUAL. Go back far enough, however, and though the bug check was always IRQL_NOT_GREATER_OR_EQUAL, what’s tested by the early versions is that the IRQL is not exactly DISPATCH_LEVEL.

For bug check 0x14, the text in the compiled message resource for the kernel in versions 3.10 to 4.0 explains bug check 0x13, presumably by oversight.

Microsoft’s documentation is trivially correct that bug check 0x4C “appears very infrequently.” In version 3.51 and higher, it can be a bug check code as an argument for the KeBugCheck functions but it never can show as a stop code. As a BugCheckCode argument it conveys to the kernel that the bug check is a fallback from a hard error that was intended to show to the user without crashing Windows but could not be so shown. What ends up as the bug check code on the stop screen, and is in some few cases documented as its own bug check code, is not 0x4C but the ErrorStatus from the hard error.

Bug check 0x58 is renamed in BUGCODES.H from the WDK for Windows 7 in 2009 but retains its old name in the documentation even today, 2nd July 2020. Even the name change was late, the bug check code having been carried over from FTDISK.SYS to VOLMGRX.SYS for Windows Vista.

Bug check 0x5D is taken up in detail separately. Here, in a list of bug checks and a survey of their history, what’s remarkable about 0x5D is that it’s the first that was redefined. Indeed, it was for a long time the only redefinition. That the first two versions of the Windows kernel work so closely with the user-mode heap is its own fascinating topic, especially for the archaeology of computer security, but what matters here is that version 3.51 had got far enough out of this game that the kernel surely never would again have a Heap Manager whose initialisation failure is fatal. The corresponding bug check was un-defined for version 3.51, both in BUGCODES.H and in the kernel’s message resource, though it persisted in the Windows NT 3.51 Resource Kit. That version 4.0 repurposes it to complain of not supporting any 80386 will have seemed natural since earlier versions had been (arguably) misusing the neighbouring bug check 0x5C to reject early steppings of the 80386.

Through most of the history of Windows, five points of failure while starting the first user-mode process each have their own bug check: 0x6D to 0x71 inclusive. Version 10.0 collapses them to be five cases of bug check 0x6D, distinguished by the first bug check parameter. Of course, now that Microsoft has simplified the stop screen so that the bug check parameters don’t show, this differentiation may as well be no differentiation at all to anyone who didn’t have the foresight to attach a kernel-mode debugger. Whatever was the purpose—presumably not just for tidiness, else it might have occurred to someone to tidy the bug checks in the documentation too—the redefinitions recovered four codes to reassign to new bug checks. That the numerical value 0x6E is immediately used for an entirely different failure is captured by a new name in BUGCODES.H but not in the documentation. The slightly later repurposing of two more, 0x6F and 0x70, also remains undocumented. Though all three are missed for the documentation, the !analyze command has descriptions such as might have been written as documentation. There’s an example here in microcosm: on causual reading, Microsoft’s documentation of bug checks might look extensive, but close attention reveals that Microsoft takes very little care.

The numerical value 0x7C is the original example of BUGCODES.H defining a symbolic name not for a bug check code but for a message identifier that selects text for framing the presentation of actual bug checks. Originally, the message selected by 0x7C ends all stop screens. Several message IDs soon accumulated among the bug check codes. This mingling looks to have been thought unsatisfactory even before the first version’s formal release, which has the beginnings of defining a separate sequence for message IDs at 0x40000000 (see far below).

Bug check 0x7E is here thought to have been originally left undefined as a side-effect of defining 0x4000007E for a message. There was perhaps a scheme of setting the 0x40000000 bit in message IDs and leaving it clear in bug check codes. If so, it was put aside for version 5.1, which redefines 0x7E for a bug check code despite keeping 0x4000007E as a message ID and defines 0x4000007F to 0x40000083 for messages without fear of collision with what had by then been the long-standing bug checks 0x7F to 0x83.

Added for Windows NT 3.50

Value	Name	Versions	Known Use	Remarks
0x82	DFS_FILE_SYSTEM	3.50 and higher		documented in 4.0 and higher
0x83	OFS_FILE_SYSTEM	3.50 and higher
0x84	RECOM_DRIVER	3.50 and higher
0x85	SETUP_FAILURE	3.50 and higher		documented in 4.0 and higher
0x86	AUDIT_FAILURE	3.50 and higher	kernel in 3.50 to 5.1
0x87 0x88 0x89 0x8A	undefined
0x8B	MBR_CHECKSUM_MISMATCH	3.50 and higher		documented in 4.0 and higher

Bug check 0x86 is superseded by 0xC0000244 (see below, under Miscellany), starting with version 5.2. This new code for the bug check is STATUS_AUDIT_FAILURE, defined not in BUGCODES.H but in NTSTATUS.H. Neither value has ever appeared in the Bug Check Code Reference. This is remarkable because the bug check itself is documented, just not the bug check code. At least as far back as the Windows NT 3.51 Resource Kit, Microsoft documents a registry value named CrashOnAuditFail as available to security-minded administrators to ensure that security-sensitive operations are not possible while the ability to audit them is suspect. If auditing to the Security log ever fails, then “the system will halt and not reboot.” It’s brutal but certain. It evidently did get used, though surely its usefulness was lessened by Microsoft’s leaving administrators with no clear guidance on recognising when a bug check’s occurrence has this particular reason. Some of Microsoft’s difficulty may have come from there being two parts to the implementation: the kernel; and LSASRV.DLL in the LSASS.EXE process. In these versions, the kernel explicitly raises AUDIT_FAILURE as a bug check, but LSASRV raises STATUS_AUDIT_FAILURE as a hard error.

Bug checks 0x87 to 0x8A are here thought to have been left undefined as a side-effect of defining 0x40000087 to 0x40000089 for messages and 0x4000008A for a bug check.

Added for Windows NT 3.51

Value	Name	Versions	Known Use	Remarks
0x8C	BUGCODE_PSS_CRASH_INIT	3.51 to 5.0		next as 0x4000008D
0x8D	BUGCODE_PSS_CRASH_PROGRESS	3.51 to 5.0		next as 0x4000008E
0x8E	BUGCODE_PSS_CRASH_DONE	3.51 to 5.0		next as 0x4000008F
0x8E	KERNEL_MODE_EXCEPTION_NOT_HANDLED	5.1 and higher	kernel in all
0x8F	PP0_INITIALIZATION_FAILED	3.51 and higher	kernel in 4.0 and higher	documented in 4.0 and higher
0x90	PP1_INITIALIZATION_FAILED	3.51 and higher	kernel in 4.0 and higher	documented in 4.0 and higher
0x91	WIN32K_INIT_OR_RIT_FAILURE	3.51 and higher

Added for Windows NT 4.0

Value	Name	Versions	Known Use
0x92	UP_DRIVER_ON_MP_SYSTEM	4.0 and higher	kernel in 4.0 to 5.2
0x93	INVALID_KERNEL_HANDLE	4.0 and higher	kernel in all
0x94	KERNEL_STACK_LOCKED_AT_EXIT	4.0 and higher	kernel in all
0x95	PNP_INTERNAL_ERROR	4.0 and higher
0x96	INVALID_WORK_QUEUE_ITEM	4.0 and higher	kernel in all
0x97	BOUND_IMAGE_UNSUPPORTED	4.0 and higher
0x98	END_OF_NT_EVALUATION_PERIOD	4.0 and higher	kernel in 4.0 to 1607
0x99	INVALID_REGION_OR_SEGMENT	4.0 and higher
0x9A	SYSTEM_LICENSE_VIOLATION	4.0 and higher	kernel in all
0x9B	UDFS_FILE_SYSTEM	4.0 and higher
0x9C	MACHINE_CHECK_EXCEPTION	4.0 and higher	HAL in all

Added for Windows 2000

For reasons not yet understood, version 5.0 skips a code. Indeed, it skipped two but one of these was brought into use for Windows Server 2003 (and got documented for Windows Vista).

The presentation of bug checks changed significantly for Windows 2000. A benefit for programmers is that the bug check shows in the debugger before the kernel disables interrupts and stops other processors, let alone before it attempts to present the bug check as a blue screen and well before any attempt to write a crash dump. It even becomes realistic, if only for simple problems, that the programmer who is skilled at debugging can put things right at this first break to the debugger and recover from the bug check. The significant reworking brought with it a proliferation of bug check codes.

Value	Name	Versions	Known Use	Remarks
0x9D	undefined
0x9E	USER_MODE_HEALTH_MONITOR	5.2 and higher		documented in 6.0 and higher
0x9F	DRIVER_POWER_STATE_FAILURE	5.0 and higher	kernel in all
0xA0	INTERNAL_POWER_ERROR	5.0 and higher	kernel in all	documented in 5.1 and higher
0xA1	PCI_BUS_DRIVER_INTERNAL	5.0 and higher		documented in 5.1 and higher
0xA2	MEMORY_IMAGE_CORRUPT	5.0 and higher		documented in 5.1 and higher
0xA3	ACPI_DRIVER_INTERNAL	5.0 and higher		documented in 5.1 and higher
0xA4	CNSS_FILE_SYSTEM_FILTER	5.0 and higher		documented in 5.1 and higher
0xA5	ACPI_BIOS_ERROR	5.0 and higher	HAL in all	documented in 5.1 and higher
0xA6	FP_EMULATION_ERROR	5.0 and higher
0xA7	BAD_EXHANDLE	5.0 and higher	kernel in 5.0 to 5.1	documented in 5.1 and higher
0xA8	BOOTING_IN_SAFEMODE_MINIMAL	5.0 and higher
0xA9	BOOTING_IN_SAFEMODE_NETWORK	5.0 and higher
0xAA	BOOTING_IN_SAFEMODE_DSREPAIR	5.0 and higher
0xAB	SESSION_HAS_VALID_POOL_ON_EXIT	5.0 and higher	kernel in 5.0 to 6.3	documented in 5.1 and higher
0xAC	HAL_MEMORY_ALLOCATION	5.0 and higher	HAL in all	documented in 5.1 and higher
0xAD	BUGCODE_PSS_MESSAGE_A	5.0 only		see 0x400000AD
0xAE	BUGCODE_PSS_MESSAGE_1E	5.0 only
0xAF	BUGCODE_PSS_MESSAGE_23	5.0 only
0xB0	BUGCODE_PSS_MESSAGE_2E	5.0 only
0xB1	BUGCODE_PSS_MESSAGE_3F	5.0 only
	undefined	5.1 to 6.1
	BGI_DETECTED_VIOLATION	6.2 and higher
0xB2	BUGCODE_PSS_MESSAGE_7B	5.0 only
0xB3	BUGCODE_PSS_MESSAGE_7F	5.0 only
0xB4	VIDEO_DRIVER_INIT_FAILURE	5.0 and higher		documented in 5.1 and higher
0xB5	BOOTLOG_LOADED	5.0 and higher
0xB6	BOOTLOG_NOT_LOADED	5.0 and higher
0xB7	BOOTLOG_ENABLED	5.0 and higher
0xB8	ATTEMPTED_SWITCH_FROM_DPC	5.0 and higher	kernel in all	documented in 5.1 and higher
0xB9	CHIPSET_DETECTED_ERROR	5.0 and higher		documented in 5.1 and higher
0xBA	SESSION_HAS_VALID_VIEWS_ON_EXIT	5.0 and higher	kernel in all	documented in 5.1 and higher
0xBB	NETWORK_BOOT_INITIALIZATION_FAILED	5.0 and higher	kernel in 5.0 to 5.2	documented in 5.1 and higher
0xBC	NETWORK_BOOT_DUPLICATE_ADDRESS	5.0 and higher	kernel in 5.2	documented in 5.1 and higher
0xBD	INVALID_HIBERNATED_STATE	5.0 and higher
0xBE	ATTEMPTED_WRITE_TO_READONLY_MEMORY	5.0 and higher	kernel in all
0xBF	MUTEX_ALREADY_OWNED	5.0 and higher		documented in 5.1 and higher
0xC0	PCI_CONFIG_SPACE_ACCESS_FAILURE	5.0 and higher
0xC1	SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION	5.0 and higher	kernel in all
0xC2	BAD_POOL_CALLER	5.0 and higher	kernel in all
0xC3	BUGCODE_PSS_MESSAGE_SIGNATURE	5.0 to 6.1
0xC3	SYSTEM_IMAGE_BAD_SIGNATURE	6.2 and higher
0xC4	DRIVER_VERIFIER_DETECTED_VIOLATION	5.0 and higher	kernel in all; HAL in 6.0 only
0xC5	DRIVER_CORRUPTED_EXPOOL	5.0 and higher
0xC6	DRIVER_CAUGHT_MODIFYING_FREE_POOL	5.0 and higher	kernel in all
0xC7	TIMER_OR_DPC_INVALID	5.0 and higher	kernel in all
0xC8	IRQL_UNEXPECTED_VALUE	5.0 and higher	HAL in 6.0 and higher; kernel in 6.2 and higher
0xC9	DRIVER_VERIFIER_IOMANAGER_VIOLATION	5.0 and higher	kernel in all
0xCA	PNP_DETECTED_FATAL_ERROR	5.0 and higher	kernel in all
0xCB	DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS	5.0 and higher	kernel in all
0xCC	PAGE_FAULT_IN_FREED_SPECIAL_POOL	5.0 and higher
0xCD	PAGE_FAULT_BEYOND_END_OFALLOCATION	5.0 and higher
0xCE	DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS	5.0 and higher
0xCF	TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE	5.0 and higher
0xD0	DRIVER_CORRUPTED_MMPOOL	5.0 and higher
0xD1	DRIVER_IRQL_NOT_LESS_OR_EQUAL	5.0 and higher	kernel in 1709 and higher
0xD2	BUGCODE_ID_DRIVER	5.0 only		next as 0x40000080
	undefined	5.1 to 6.1
	BUGCODE_ID_DRIVER	6.2 and higher
0xD3	DRIVER_PORTION_MUST_BE_NONPAGED	5.0 and higher
0xD4	SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD	5.0 and higher
0xD5	DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL	5.0 and higher
0xD6	DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION	5.0 and higher
0xD7	DRIVER_UNMAPPING_INVALID_VIEW	5.0 and higher	kernel in all
0xD8	DRIVER_USED_EXCESSIVE_PTES	5.0 and higher	kernel in all
0xD9	LOCKED_PAGES_TRACKER_CORRUPTION	5.0 and higher	kernel in all	documented in 5.1 and higher
0xDA	SYSTEM_PTE_MISUSE	5.0 and higher	kernel in all	documented in 5.1 and higher
0xDB	DRIVER_CORRUPTED_SYSPTES	5.0 and higher
0xDC	DRIVER_INVALID_STACK_ADDRESS	5.0 and higher
0xDD	BUGCODE_PSS_MESSAGE_A5	5.0 only
0xDE	POOL_CORRUPTION_IN_FILE_AREA	late 4.0 and higher	kernel in all
0xDF	IMPERSONATING_WORKER_THREAD	5.0 and higher	kernel in all
0xE0	ACPI_BIOS_FATAL_ERROR	5.0 and higher		documented in 5.1 and higher
0xE1	WORKER_THREAD_RETURNED_AT_BAD_IRQL	5.0 and higher	kernel in all
0xE2	MANUALLY_INITIATED_CRASH	5.0 and higher	kernel in all
0xE3	RESOURCE_NOT_OWNED	5.0 and higher	kernel in all
0xE4	WORKER_INVALID	5.0 and higher	kernel in all

A bug check 0xAD is documented by Microsoft as VIDEO_DRIVER_DEBUG_REPORT_REQUEST, but what’s declared in BUGCODES.H (and understood by VIDEOPRT.SYS) is 0x400000AD.

The point to 0xAD (and to several others) as a message ID in version 5.0 is that if a crash dump is not written, then the kernel has one last breath for telling the user something more about the bug check. As the symbolic names suggest, this elaborates the original scheme of ending all bug check displays with the text from message BUGCODE_PSS_MESSAGE (0x7C). Version 3.51 had already reduced this just to cases where no crash dump is written. Version 5.0 keeps to this but provides for ending with different text for different bug codes. The suggestions in the symbolic names are mostly clear, but note that BUGCODE_PSS_MESSAGE_A is not just for bug check 0x0A but also for 0xC5, 0xD0, 0xD1, 0xD3 and 0xD4, and BUGCODE_PSS_MESSAGE_23 is for both 0x23 and 0x24.

The numerical value 0xD2 presents quite a puzzle, surely to programmers at the time, and certainly to historians. It needs a few paragraphs to explain…

To the version 5.0 kernel, 0xD2 is not a bug check code but is instead the message ID of text with which to flesh out the description of various other bug checks. These others are all new for Windows 2000: 0xBE, 0xCB to 0xCF and 0xD3 to 0xD6. What they have in common is that the kernel interprets a bug check parameter as identifying a faulting driver. Literally. What the lookup of 0xD2 as a message ID adds to the stop screen’s text in the English releases is

This driver may be at fault:
name

The symbolic name BUGCODE_ID_DRIVER for 0xD2 is thus appropriate: it’s in the BUGCODES.H definitions not as a bug check code but to select text for identifying a driver to the user, who perhaps will prefer the directness of finger-pointing by name.

Somehow, the numerical value 0xD2 also gets used in version 5.0 by Microsoft’s NDIS.SYS driver as the bug check code for all unrecoverable NDIS faults, the same as later becomes BUGCODE_NDIS_DRIVER (0x7C).

Bug check 0xDE is here thought to have been back-fitted into version 4.0 for its last service pack, having been intended as new for version 5.0.

Added for Windows XP

Value	Name	Versions	Known Use	Remarks
0xE5	POWER_FAILURE_SIMULATE	5.1 and higher
0xE6	DRIVER_VERIFIER_DMA_VIOLATION	5.1 and higher	kernel in 5.1 to 5.2
0xE6	unknown, see note		HAL in 6.2 and higher; kernel in 10.0 and higher
0xE7	INVALID_FLOATING_POINT_STATE	5.1 and higher	kernel in 5.1 to 6.0
0xE8	INVALID_CANCEL_OF_FILE_OPEN	5.1 and higher	kernel in all
0xE9	ACTIVE_EX_WORKER_THREAD_TERMINATION	5.1 and higher	kernel in all
0xEA	THREAD_STUCK_IN_DEVICE_DRIVER	5.1 and higher
0xEB	DIRTY_MAPPED_PAGES_CONGESTION	5.1 and higher	kernel in all
0xEC	SESSION_HAS_VALID_SPECIAL_POOL_ON_EXIT	5.1 and higher	kernel in 6.0 and higher
0xED	UNMOUNTABLE_BOOT_VOLUME	5.1 and higher	kernel in all
0xEE	undefined
0xEF	CRITICAL_PROCESS_DIED	5.1 and higher	kernel in all
0xF0	STORAGE_MINIPORT_ERROR	1703 and higher
0xF1	SCSI_VERIFIER_DETECTED_VIOLATION	5.1 and higher
0xF2	HARDWARE_INTERRUPT_STORM	5.1 and higher
0xF3	DISORDERLY_SHUTDOWN	5.1 and higher	kernel in 5.1
0xF4	CRITICAL_OBJECT_TERMINATION	5.1 and higher	kernel in all
0xF5	FLTMGR_FILE_SYSTEM	5.1 and higher		documented in late 5.2 and higher
0xF6	PCI_VERIFIER_DETECTED_VIOLATION	5.1 and higher

Though bug check 0xE6 retains its definition as DRIVER_VERIFIER_DMA_VIOLATION, the known use of it by the kernel in version 10.0 does not fill well enough with this name to allow any suggestion of continuity. The kernel’s use of bug check 0xE6 in versions 5.1 and 5.2 is plainly for a Driver Verifier assertion. In version 10.0, even its connection with DMA is slight. The bug check occurs in a defective call to the new KeFlushIoBuffers function, independently of the Driver Verifier. There is a connection with DMA, however, since a non-zero DmaOperation argument is a necessary condition.

Added for Windows Server 2003

Apparently because versions 5.1 and 5.2 were developed in parallel, several bug checks are defined first for version 5.2 but find their way into service packs of version 5.1. Overlap seems to have been anticipated: 0xF7, 0xF8 and 0xF9 are included in the Bug Check Code Reference in the Windows XP DDK even though they are not in the BUGCODES.H from the same DDK. Indeed, two of them aren’t known to the message resource as compiled into the kernel even for Windows XP SP3.

Value	Name	Versions	Known Use	Remarks
0xF7	DRIVER_OVERRAN_STACK_BUFFER	late 5.1 and higher	kernel in late 5.2 and higher; HAL in 6.1 to 6.2
0xF8	RAMDISK_BOOT_INITIALIZATION_FAILED	5.2 and higher	kernel in all
0xF9	DRIVER_RETURNED_STATUS_REPARSE_FOR_VOLUME_OPEN	5.2 and higher	kernel in all
0xFA	HTTP_DRIVER_CORRUPTED	5.2 and higher		documented in late 6.0 and higher
0xFB	RECURSIVE_MACHINE_CHECK	5.2 and higher
0xFC	ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY	late 5.1 and higher	kernel in 6.0 and higher	documented in late 6.0 and higher
0xFD	DIRTY_NOWRITE_PAGES_CONGESTION	5.2 and higher		documented in late 6.0 and higher
0xFE	BUGCODE_USB_DRIVER	mid 5.1 and higher		documented in late 5.2 and higher

Added for Windows Vista

Value	Name	Versions	Known Use	Remarks
0xFF	RESERVE_QUEUE_OVERFLOW	6.0 and higher
0x0100	LOADER_BLOCK_MISMATCH	6.0 and higher	kernel in 6.1 and higher
0x0101	CLOCK_WATCHDOG_TIMEOUT	6.0 and higher	kernel in all; HAL in 6.3 and higher
0x0102	DPC_WATCHDOG_TIMEOUT	6.0 and higher		documented in 1709 and higher
0x0103	MUP_FILE_SYSTEM	6.0 and higher		documented in 6.1 and higher
0x0104	AGP_INVALID_ACCESS	late 5.1, late 5.2 and higher
0x0105	AGP_GART_CORRUPTION	late 5.1, late 5.2 and higher
0x0106	AGP_ILLEGALLY_REPROGRAMMED	late 5.1, late 5.2 and higher
0x0107	KERNEL_EXPAND_STACK_ACTIVE	late 5.2 and higher	kernel in 6.0 and higher
0x0108	THIRD_PARTY_FILE_SYSTEM_FAILURE	late 5.1, late 5.2 and higher
0x0109	CRITICAL_STRUCTURE_CORRUPTION	late 5.2 and higher	kernel in 6.0
0x010A	APP_TAGGING_INITIALIZATION_FAILED	6.0 and higher
0x010B	DFSC_FILE_SYSTEM	6.0 and higher
0x010C	FSRTL_EXTRA_CREATE_PARAMETER_VIOLATION	6.0 and higher	kernel in all
0x010D	WDF_VIOLATION	6.0 and higher
0x010E	VIDEO_MEMORY_MANAGEMENT_INTERNAL	6.0 and higher
0x010F	RESOURCE_MANAGER_EXCEPTION_NOT_HANDLED	6.0 only	kernel in 6.0
0x0110	DRIVER_INVALID_CRUNTIME_PARAMETER	6.0 and higher
0x0111	RECURSIVE_NMI	late 5.2 and higher		documented in late 6.0 and higher
0x0112	MSRPC_STATE_VIOLATION	6.0 and higher
0x0113	VIDEO_DXGKRNL_FATAL_ERROR	6.0 and higher
0x0114	VIDEO_SHADOW_DRIVER_FATAL_ERROR	6.0 and higher
0x0115	AGP_INTERNAL	6.0 and higher
0x0116	VIDEO_TDR_FAILURE	6.0 and higher
0x0117	VIDEO_TDR_TIMEOUT_DETECTED	6.0 and higher
0x0118	NTHV_GUEST_ERROR	6.0 and higher
0x0119	VIDEO_SCHEDULER_INTERNAL_ERROR	6.0 and higher
0x011A	EM_INITIALIZATION_ERROR	6.0 and higher
0x011B	DRIVER_RETURNED_HOLDING_CANCEL_LOCK	6.0 and higher	kernel in 6.2 and higher	documented in late 6.0, and higher
0x011C	ATTEMPTED_WRITE_TO_CM_PROTECTED_STORAGE	6.0 and higher		documented in late 6.0 and higher
0x011D	EVENT_TRACING_FATAL_ERROR	6.0 and higher	kernel in all	documented in late 6.0 and higher
0x011E	TOO_MANY_RECURSIVE_FAULTS	6.0 and higher	kernel in all	documented in 1709 and higher
0x011F	INVALID_DRIVER_HANDLE	6.0 and higher	kernel in all	documented in 1709 and higher
0x0120	BITLOCKER_FATAL_ERROR	6.0 and higher		documented in 1709 and higher
0x0121	DRIVER_VIOLATION	6.0 and higher	kernel in all	documented in late 6.0 and higher
0x0122	WHEA_INTERNAL_ERROR	6.0 and higher	kernel in all	documented in late 6.0 and higher
0x0123	CRYPTO_SELF_TEST_FAILURE	6.0 and higher	kernel in 10.0 and higher	documented in 1709 and higher
0x0124	WHEA_UNCORRECTABLE_ERROR	6.0 and higher	HAL in all; kernel in 6.1 and higher	documented in late 6.0 and higher
0x0125	NMR_INVALID_STATE	6.0 and higher
0x0126	NETIO_INVALID_POOL_CALLER	6.0 and higher
0x0127	PAGE_NOT_ZERO	6.0 and higher	kernel in 6.2 and higher	documented in late 6.0 and higher
0x0128	WORKER_THREAD_RETURNED_WITH_BAD_IO_PRIORITY	6.0 and higher	kernel in all	documented in 1709 and higher
0x0129	WORKER_THREAD_RETURNED_WITH_BAD_PAGING_IO_PRIORITY	6.0 and higher	kernel in all	documented in 1709 and higher
0x012A	MUI_NO_VALID_SYSTEM_LANGUAGE	6.0 and higher	kernel in all	documented in 1709 and higher
0x012B	FAULTY_HARDWARE_CORRUPTED_PAGE	6.0 and higher	kernel in 6.1 and higher	documented in late 6.0 and higher
0x012C	EXFAT_FILE_SYSTEM	late 6.0, and higher

Added for Windows 7

Value	Name	Versions	Known Use	Remarks
0x012D	VOLSNAP_OVERLAPPED_TABLE_ACCESS	6.1 and higher		documented in 1709 and higher
0x012E	INVALID_MDL_RANGE	6.1 and higher	kernel in 6.2 and higher
0x012F	VHD_BOOT_INITIALIZATION_FAILED	6.1 and higher	kernel in all
0x0130	DYNAMIC_ADD_PROCESSOR_MISMATCH	6.1 and higher	kernel in 6.2 to 6.3
0x0131	INVALID_EXTENDED_PROCESSOR_STATE	6.1 and higher	kernel in all
0x0132	RESOURCE_OWNER_POINTER_INVALID	6.1 and higher	kernel in all
0x0133	DPC_WATCHDOG_VIOLATION	6.1 and higher	kernel in all	documented in 6.3 and higher
0x0134	DRIVE_EXTENDER	6.1 and higher
0x0135	REGISTRY_FILTER_DRIVER_EXCEPTION	6.1 and higher	kernel in all
0x0136	VHD_BOOT_HOST_VOLUME_NOT_ENOUGH_SPACE	6.1 and higher		documented in 1709 and higher

Added for Windows 8

Value	Name	Versions	Known Use	Remarks
0x0137	WIN32K_HANDLE_MANAGER	6.2 and higher
0x0138	GPIO_CONTROLLER_DRIVER_ERROR	6.2 and higher		documented in 6.3 and higher
0x0139	KERNEL_SECURITY_CHECK_FAILURE	6.2 and higher	kernel in all	documented in 6.3 and higher
0x013A	KERNEL_MODE_HEAP_CORRUPTION	6.2 and higher	kernel in all
0x013B	PASSIVE_INTERRUPT_ERROR	6.2 and higher	kernel in all	documented in 1709 and higher
0x013C	INVALID_IO_BOOST_STATE	6.2 and higher	kernel in all	documented in 1709 and higher
0x013D	CRITICAL_INITIALIZATION_FAILURE	6.2 and higher
0x013E	ERRATA_WORKAROUND_UNSUCCESSFUL	1511 and higher	kernel in 1511 only
0x013F	undefined
0x0140	STORAGE_DEVICE_ABNORMALITY_DETECTED	6.2 and higher
0x0141	VIDEO_ENGINE_TIMEOUT_DETECTED	6.2 and higher
0x0142	VIDEO_TDR_APPLICATION_BLOCKED	6.2 and higher
0x0143	PROCESSOR_DRIVER_INTERNAL	6.2 and higher
0x0144	BUGCODE_USB3_DRIVER	6.2 and higher
0x0145	SECURE_BOOT_VIOLATION	6.2 and higher	kernel in all	documented in 1709 and higher
0x0146	NDIS_NET_BUFFER_LIST_INFO_ILLEGALLY_TRANSFERRED	6.2 and higher
0x0147	ABNORMAL_RESET_DETECTED	6.2 and higher		documented in 1709 and higher
0x0148	IO_OBJECT_INVALID	6.2 and higher	kernel in all
0x0149	REFS_FILE_SYSTEM	6.2 and higher
0x014A	KERNEL_WMI_INTERNAL	6.2 and higher	kernel in all
0x014B	SOC_SUBSYSTEM_FAILURE	6.2 and higher
0x014C	FATAL_ABNORMAL_RESET_ERROR	6.2 and higher		documented in 1709 and higher
0x014D	EXCEPTION_SCOPE_INVALID	6.2 and higher
0x014E	SOC_CRITICAL_DEVICE_REMOVED	6.2 and higher
0x014F	PDC_WATCHDOG_TIMEOUT	6.2 and higher
0x0150	TCPIP_AOAC_NIC_ACTIVE_REFERENCE_LEAK	6.2 and higher

Added for Windows 8.1

Value	Name	Versions	Known Use	Remarks
0x0151	UNSUPPORTED_INSTRUCTION_MODE	6.3 and higher		documented in 1709 and higher
0x0152	INVALID_PUSH_LOCK_FLAGS	6.3 and higher	kernel in all	documented in 1709 and higher
0x0153	KERNEL_LOCK_ENTRY_LEAKED_ON_THREAD_TERMINATION	6.3 and higher	kernel in all
0x0154	UNEXPECTED_STORE_EXCEPTION	6.3 and higher	kernel in all	documented in 1709 and higher
0x0155	OS_DATA_TAMPERING	6.3 and higher
0x0156	WINSOCK_DETECTED_HUNG_CLOSESOCKET_LIVEDUMP	6.3 and higher		documented in 1709 and higher
0x0157	KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION	6.3 and higher	kernel in all	documented in 1709 and higher
0x0158	ILLEGAL_IOMMU_PAGE_FAULT	6.3 and higher	kernel in all	documented in 1709 and higher
0x0159	HAL_ILLEGAL_IOMMU_PAGE_FAULT	6.3 and higher	HAL in all
0x015A	SDBUS_INTERNAL_ERROR	6.3 and higher		documented in 1709 and higher
0x015B	WORKER_THREAD_RETURNED_WITH_SYSTEM_PAGE_PRIORITY_ACTIVE	6.3 and higher	kernel in all
0x015C	PDC_WATCHDOG_TIMEOUT_LIVEDUMP	6.3 and higher
0x015D	SOC_SUBSYSTEM_FAILURE_LIVEDUMP	6.3 and higher		documented in 10.0 and higher
0x015E	BUGCODE_NDIS_DRIVER_LIVE_DUMP	6.3 and higher
0x015F	CONNECTED_STANDBY_WATCHDOG_TIMEOUT_LIVEDUMP	6.3 and higher	kernel in all
0x0160	WIN32K_ATOMIC_CHECK_FAILURE	6.3 and higher		documented in 1709 and higher
0x0161	LIVE_SYSTEM_DUMP	6.3 and higher
0x0162	KERNEL_AUTO_BOOST_INVALID_LOCK_RELEASE	6.3 and higher	kernel in all	documented in 1709 and higher

Bug check 0x015F is the first known use by the kernel of what is in version 6.3 the new facility for the live capture of a dump file—as if for a crash dump file but without the crash.

Added for Windows 10

Before proceeding to the very many bug checks that are new for Windows 10, note that not even one was documented in the Bug Check Code Reference from the contemporaneous Debugging Tools for Windows.

Value	Name	Versions	Known Use	Remarks
0x0163	WORKER_THREAD_TEST_CONDITION	10.0 and higher	kernel in all	documented in 1709 and higher
0x0164	WIN32K_CRITICAL_FAILURE	10.0 and higher
0x0165	CLUSTER_CSV_STATUS_IO_TIMEOUT_LIVEDUMP	10.0 and higher
0x0166	CLUSTER_RESOURCE_CALL_TIMEOUT_LIVEDUMP	10.0 and higher
0x0167	CLUSTER_CSV_SNAPSHOT_DEVICE_INFO_TIMEOUT_LIVEDUMP	10.0 and higher
0x0168	CLUSTER_CSV_STATE_TRANSITION_TIMEOUT_LIVEDUMP	10.0 and higher
0x0169	CLUSTER_CSV_VOLUME_ARRIVAL_LIVEDUMP	10.0 and higher
0x016A	CLUSTER_CSV_VOLUME_REMOVAL_LIVEDUMP	10.0 and higher
0x016B	CLUSTER_CSV_CLUSTER_WATCHDOG_LIVEDUMP	10.0 and higher
0x016C	INVALID_RUNDOWN_PROTECTION_FLAGS	10.0 and higher
0x016D	INVALID_SLOT_ALLOCATOR_FLAGS	10.0 and higher	kernel in all	documented in 1709 and higher
0x016E	ERESOURCE_INVALID_RELEASE	10.0 and higher	kernel in 1607 and higher	documented in 1709 and higher
0x016F	CLUSTER_CSV_STATE_TRANSITION_INTERVAL_TIMEOUT_LIVEDUMP	10.0 and higher
0x0170	CLUSTER_CSV_CLUSSVC_DISCONNECT_WATCHDOG	10.0 and higher
0x0171	CRYPTO_LIBRARY_INTERNAL_ERROR	10.0 and higher	kernel in all
0x0172	undefined
0x0173	COREMSGCALL_INTERNAL_ERROR	1607 and higher
0x0174	COREMSG_INTERNAL_ERROR	1607 and higher
0x0175	PREVIOUS_FATAL_ABNORMAL_RESET_ERROR	10.0 and higher
0x0176 0x0177	undefined
0x0178	ELAM_DRIVER_DETECTED_FATAL_ERROR	10.0 and higher
0x0179	CLUSTER_CLUSPORT_STATUS_IO_TIMEOUT_LIVEDUMP	1703 and higher
0x017A	undefined
0x017B	PROFILER_CONFIGURATION_ILLEGAL	1709 and higher
0x017C	PDC_LOCK_WATCHDOG_LIVEDUMP	1607 and higher
0x017D	PDC_UNEXPECTED_REVOCATION_LIVEDUMP	1607 and higher
0x017E 0x017F	undefined
0x0180	WVR_LIVEDUMP_REPLICATION_IOCONTEXT_TIMEOUT	10.0 and higher
0x0181	WVR_LIVEDUMP_STATE_TRANSITION_TIMEOUT	10.0 and higher
0x0182	WVR_LIVEDUMP_RECOVERY_IOCONTEXT_TIMEOUT	10.0 and higher
0x0183	WVR_LIVEDUMP_APP_IO_TIMEOUT	10.0 and higher
0x0184	WVR_LIVEDUMP_MANUALLY_INITIATED	10.0 and higher
0x0185	WVR_LIVEDUMP_STATE_FAILURE	10.0 and higher
0x0186	WVR_LIVEDUMP_CRITICAL_ERROR	10.0 and higher
0x0187	VIDEO_DWMINIT_TIMEOUT_FALLBACK_BDD	10.0 and higher
0x0188	CLUSTER_CSVFS_LIVEDUMP	10.0 and higher
0x0189	BAD_OBJECT_HEADER	10.0 and higher	kernel in all
0x018A	SILO_CORRUPT	10.0 and higher
0x018B	SECURE_KERNEL_ERROR	10.0 and higher		documented in 1709 and higher
0x018C	HYPERGUARD_VIOLATION	1511 and higher
0x018D	SECURE_FAULT_UNHANDLED	1703 and higher
0x018E	KERNEL_PARTITION_REFERENCE_VIOLATION	1709 and higher	kernel in all
0x018F	undefined
0x0190	WIN32K_CRITICAL_FAILURE_LIVEDUMP	10.0 and higher		documented in 1709 and higher
0x0191	PF_DETECTED_CORRUPTION	10.0 and higher	kernel in all
0x0192	KERNEL_AUTO_BOOST_LOCK_ACQUISITION_WITH_RAISED_IRQL	10.0 and higher	kernel in all	documented in 1709 and higher
0x0193	VIDEO_DXGKRNL_LIVEDUMP	10.0 and higher
0x0194	see Saver section, below
0x0195	SMB_SERVER_LIVEDUMP	1511 and higher		documented in 1709 and higher
0x0196	LOADER_ROLLBACK_DETECTED	1511 and higher	kernel in all	documented in 1709 and higher
0x0197	WIN32K_SECURITY_FAILURE	1607 and higher
0x0198	UFX_LIVEDUMP	1607 and higher
0x0199	KERNEL_STORAGE_SLOT_IN_USE	1607 and higher	kernel in all	documented in 1709 and higher
0x019A	WORKER_THREAD_RETURNED_WHILE_ATTACHED_TO_SILO	1607 and higher	kernel in all	documented in 1709 and higher
0x019B	TTM_FATAL_ERROR	1607 and higher	kernel in all	documented in 1709 and higher
0x019C	WIN32K_POWER_WATCHDOG_TIMEOUT	1607 and higher		documented in 1709 and higher
0x019D	CLUSTER_SVHDX_LIVEDUMP	1607 and higher		documented in 1709 and higher
0x019E	BUGCODE_NETADAPTER_DRIVER	1703 and higher
0x019F	PDC_PRIVILEGE_CHECK_LIVEDUMP	1703 and higher
0x01A0	TTM_WATCHDOG_TIMEOUT	1703 and higher	kernel in 1709 and higher
0x01A1	WIN32K_CALLOUT_WATCHDOG_LIVEDUMP	1703 and higher	kernel in 1703 and higher
0x01A2	WIN32K_CALLOUT_WATCHDOG_BUGCHECK	1703 and higher
0x01A3	CALL_HAS_NOT_RETURNED_WATCHDOG_TIMEOUT_LIVEDUMP	1709 and higher
0x01A4	DRIPS_SW_HW_DIVERGENCE_LIVEDUMP	1709 and higher	kernel in 1709 and higher
0x01A5	USB_DRIPS_BLOCKER_SURPRISE_REMOVAL_LIVEDUMP	1803 and higher

SOMETHING TO WRITE HERE

Value	Name	Versions	Known Use	Remarks
0x01C4	DRIVER_VERIFIER_DETECTED_VIOLATION_LIVEDUMP	10.0 and higher		documented in 1709 and higher
0x01C5	IO_THREADPOOL_DEADLOCK_LIVEDUMP	1607 and higher	kernel in 1607 and higher	documented in 1709 and higher
0x01C6	FAST_ERESOURCE_PRECONDITION_VIOLATION	1703 and higher	kernel in all
0x01C7	STORE_DATA_STRUCTURE_CORRUPTION	1703 and higher	kernel in all
0x01C8	MANUALLY_INITIATED_POWER_BUTTON_HOLD	1703 and higher	kernel in 1703 and higher
0x01C9	USER_MODE_HEALTH_MONITOR_LIVEDUMP	1703 and higher
0x01CA	HYPERVISOR_WATCHDOG_TIMEOUT	1703 and higher
0x01CB	INVALID_SILO_DETACH	1703 and higher	kernel in all
0x01CC	EXRESOURCE_TIMEOUT_LIVEDUMP	1709 and higher	kernel in 1709 and higher
0x01CD	INVALID_CALLBACK_STACK_ADDRESS	1709 and higher
0x01CE	INVALID_KERNEL_STACK_ADDRESS	1709 and higher
0x01CF	HARDWARE_WATCHDOG_TIMEOUT	1709 and higher
0x01D0	ACPI_FIRMWARE_WATCHDOG_TIMEOUT	1709 and higher
0x01D1	TELEMETRY_ASSERTS_LIVEDUMP	1709 and higher
0x01D2	WORKER_THREAD_INVALID_STATE	1709 and higher	kernel in all
0x01D3	WFP_INVALID_OPERATION	1709 and higher
0x01D4	UCMUCSI_LIVEDUMP	1709 and higher
0x01D5	DRIVER_PNP_WATCHDOG	1803 and higher	kernel in all

Xbox

Though Windows, here considered only in its i386 and amd64 implementations, is not known to make any use of the following, the Windows kernel even in its i386 and amd64 implementations has bug check codes whose names strongly suggest they are specific to the Xbox games console. They can’t have any attention here except to note their existence—and the continuing definition of more of them:

Value	Name	Versions
0x0356	XBOX_ERACTRL_CS_TIMEOUT	1709 and higher
0x0357	XBOX_CORRUPTED_IMAGE	1607 and higher
0x0358	XBOX_INVERTED_FUNCTION_TABLE_OVERFLOW	10.0 and higher
0x0359	XBOX_CORRUPTED_IMAGE_BASE	10.0 and higher
0x0360	XBOX_360_SYSTEM_CRASH	6.2 and higher
0x0420	XBOX_360_SYSTEM_CRASH_RESERVED	6.2 and higher

Blue Tooth

Value	Name	Versions	Remarks
0x0BFE	BC_BLUETOOTH_VERIFIER_FAULT	6.0 and higher
0x0BFF	BC_BTHMINI_VERIFIER_FAULT	6.2 and higher	documented in 1709 and higher

Saver Driver

Apparently there exists a kernel-mode driver named Saver which helps Microsoft’s user-mode programmers during development. It’s not known to be supplied with Windows 10 in any retail release and since it also doesn’t seem to be known very much on the Internet, for what that might be worth, it is perhaps best just to repeat what Microsoft is known to say about it:

Saver is a kernel mode driver that is used to bugcheck the system.
Its intended purpose is to cause a kernel bugcheck and generate a kernel memory dump.
This memory dump can be used to debug the error case for which we bugchecked the system.

The relevant bug check codes look to have been defined first as a driver-specific addition to the normal sequence, then another outside this sequence and one more even further outside before defining a whole new sequence:

Value	Name	Versions	Remarks
0x0194	SAVER_NONRESPONSIVEPROCESS	10.0 and higher	used by modernexecserver.dll
0x0315	SAVER_MTBFCOMMANDTIMEOUT	10.0 and higher
0x8866	SAVER_SICKAPPLICATION	10.0 and higher
0xF000	SAVER_UNSPECIFIED	10.0 and higher
0xF001	undefined	10.0 and higher
0xF002	SAVER_BLANKSCREEN	10.0 and higher
0xF003	SAVER_INPUT	10.0 and higher
0xF004	SAVER_WATCHDOG	10.0 and higher
0xF005	SAVER_STARTNOTVISIBLE	10.0 and higher
0xF006	SAVER_NAVIGATIONMODEL	10.0 and higher
0xF007	SAVER_OUTOFMEMORY	10.0 and higher	used by PsmServiceExtHost.dll
0xF008	SAVER_GRAPHICS	10.0 and higher
0xF009	SAVER_NAVSERVERTIMEOUT	10.0 and higher
0xF00A	SAVER_CHROMEPROCESSCRASH	10.0 and higher
0xF00B	SAVER_NOTIFICATIONDISMISSAL	10.0 and higher
0xF00C	SAVER_SPEECHDISMISSAL	10.0 and higher
0xF00D	SAVER_CALLDISMISSAL	10.0 and higher
0xF00E	SAVER_APPBARDISMISSAL	10.0 and higher
0xF00F	SAVER_RILADAPTATIONCRASH	10.0 and higher
0xF010	SAVER_APPLISTUNREACHABLE	10.0 and higher
0xF011	SAVER_REPORTNOTIFICATIONFAILURE	10.0 and higher
0xF012	SAVER_UNEXPECTEDSHUTDOWN	10.0 and higher
0xF013	SAVER_RPCFAILURE	10.0 and higher
0xF014	SAVER_AUXILIARYFULLDUMP	10.0 and higher
0xF015	SAVER_ACCOUNTPROVSVCINITFAILURE	10.0 and higher
0xF101	SAVER_MTBFCOMMANDHANG	10.0 and higher
0xF102	SAVER_MTBFPASSBUGCHECK	10.0 and higher
0xF103	SAVER_MTBFIOERROR	10.0 and higher
0xF200	SAVER_RENDERTHREADHANG	10.0 and higher
0xF201	SAVER_RENDERMOBILEUIOOM	10.0 and higher
0xF300	SAVER_DEVICEUPDATEUNSPECIFIED	10.0 and higher
0xF400	SAVER_AUDIODRIVERHANG	10.0 and higher
0xF500	SAVER_BATTERYPULLOUT	10.0 and higher
0xF600	SAVER_MEDIACORETESTHANG	10.0 and higher
0xF700	SAVER_RESOURCEMANAGEMENT	10.0 and higher	used by modernexecserver.dll
0xF800	SAVER_CAPTURESERVICE	10.0 and higher
0xF900	SAVER_WAITFORSHELLREADY	10.0 and higher

Hyper-V

Value	Name	Versions
0x00020001	HYPERVISOR_ERROR	late 6.0 and higher

M Suffix

Numerical values in a 0x10000000 sequence are defined in BUGCODES.H but are not in the kernel’s message resource in any version. Four are documented as early as the Windows XP DDK even though they don’t appear in the BUGCODES.H from the same kit. For each of these four, Microsoft’s documentation says just that this high-numbered code “has the same meaning and parameters” as the low-numbered code, i.e., stripped of the 0x10000000.

Value	Name	Versions
0x1000007E	SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M	5.2 and higher
0x1000007F	UNEXPECTED_KERNEL_MODE_TRAP_M	5.2 and higher
0x1000008E	KERNEL_MODE_EXCEPTION_NOT_HANDLED_M	5.2 and higher
0x100000D6	DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION_M	6.0 and higher
0x100000EA	THREAD_STUCK_IN_DEVICE_DRIVER_M	5.2 and higher

Messages Mostly

Numerical values in a 0x40000000 sequence are defined in BUGCODES.H and have corresponding text in the kernel’s message resource. They seem to have been intended as a separate range for messages that do not themselves describe bug checks, but no formal scheme is known that was ever stuck to.

Value	Name	Versions	Remarks
0x4000007E	WINDOWS_NT_BANNER	all
0x4000007F	BUGCHECK_MESSAGE_INTRO	5.1 to 6.1
0x40000080	BUGCODE_ID_DRIVER	5.1 to 6.1	previously 0xD2
0x40000081	PSS_MESSAGE_INTRO	5.1 to 6.1
0x40000082	BUGCODE_PSS_MESSAGE	5.1 to 6.1	previously 0x7C
0x40000083	BUGCODE_TECH_INFO	5.1 to 6.1
0x40000087	WINDOWS_NT_CSD_STRING	3.50 and higher
0x40000088	WINDOWS_NT_INFO_STRING	3.50 and higher
0x40000089	WINDOWS_NT_MP_STRING	3.50 and higher
0x4000008A	THREAD_TERMINATE_HELD_MUTEX	3.50 and higher	used by kernel in all
0x4000008B	BUGCODE_PSS_CRASH_INIT	5.1 to 6.1	previously 0x8C
0x4000008C	BUGCODE_PSS_CRASH_PROGRESS	5.1 to 6.1	previously 0x8D
0x4000008D	BUGCODE_PSS_CRASH_DONE	5.1 to 6.1	previously 0x8E
0x4000009D	WINDOWS_NT_INFO_STRING_PLURAL	4.0 and higher
0x4000009E	WINDOWS_NT_RC_STRING	4.0 and higher
0x400000AD	VIDEO_DRIVER_DEBUG_REPORT_REQUEST	6.0 and higher
0x40010001	HARDWARE_PROFILE_UNDOCKED_STRING	5.0 and higher
0x40010002	HARDWARE_PROFILE_DOCKED_STRING	5.0 and higher
0x40010003	HARDWARE_PROFILE_UNKNOWN_STRING	5.0 and higher

Miscellany

Value	Name	Versions	Remarks
0x00000000			used by HAL in 3.10
0x12345678			used by kernel in 3.10 to 5.0
0x80000000	BUGCHECK_CONTEXT_MODIFIER	10.0 and higher
arbitrary exception code			used by kernel in 3.10 to 5.0
0xC000021A	WINLOGON_FATAL_ERROR	5.2 and higher
0xC0000244			used by kernel in 5.2 and higher
0xDEADDEAD	MANUALLY_INITIATED_CRASH1	5.2 and higher
arbitrary from debugger			used by kernel in 3.51 to 4.0

The HAL in version 3.10 has code that would raise a bug check zero. This is only from an internal routine that symbol files name as HalSaveState. No way is known that this routine can ever execute. It is perhaps intended only for checked builds or even for some processor architecture other than the i386.

Perhaps as a last defence, early versions of the kernel would call KeBugCheck from places that should be unreachable. For example, exiting a thread can involve the kernel in a rare case of scheduling a routine of its own for execution as a user-mode Asynchronous Procedure Call (APC). It’s not intended that the routine can ever execute. If it does execute, something can only have gone seriously wrong. Before version 5.1, the execution is to stop Windows as bug check 0x12345678. Later versions catch it only in the checked builds, and only then as an assertion failure, and then version 6.3 changes the mechanism.

Another example is where ExAllocatePoolWithQuota in version 3.10 charges the pool allocation against the calling process’s quota. It calls PsChargePoolQuota in a Structured Exception Handling block. If the exception handler executes, it’s to present the exception code as a bug check code. However, the exception filter can only return zero and so the exception code as a bug check code is at best theoretical.

Starting with the Windows XP DDK, Microsoft’s documentation lists the status codes 0xC0000218, 0xC000021A and 0xC0000221 as bug check codes. Two of these are not in BUGCODES.H in any known version. The other is, but with the different name shown above.

As STATUS_AUDIT_FAILED, 0xC0000244 might be another stop code that originates as a hard error, raised in this case by LSASRV.DLL in the LSASS.EXE process. It can, however, be explicitly a bug check code. The kernel in version 5.2 and higher passes it to KeBugCheckEx as BugCheckCode exactly where the kernel in versions 3.50 to 5.1 passes AUDIT_FAILED (0x86) to KeBugCheck. The one clearly supersedes the other.

Arbitrary

Already noted above is that any NTSTATUS that has its high two bits set can be presented as a stop code even though the bug check code that was presented to KeBugCheckEx was 0x4C. Early Windows versions also permit that an arbitrary exception code or unsuccessful NTSTATUS can be explicitly given to KeBugCheck as the bug check code.

Versions 3.51 and 4.0 also allow an arbitrary bug check code for the particular pupose of manually crashing Windows from a kernel-mode debugger. This is the earliest known form of what version 5.0 and higher provide through the bug check code MANUALLY_INITIATED_CRASH (0xE2). Given that the kernel is started with debugging enabled, it exchanges packets with a debugger over some transport, which was originally only a serial port. One such packet directs the kernel to raise a bug check and specifies the bug check code. Just like any driver calling KeBugCheck, the debugger might in principle choose anything for the bug check code. What I386KD chooses in practice, for its .crash command, is 0xDEADDEAD.