MEMORY_MANAGEMENT
Code: 0x1a (26)
As HRESULT:- S: 0 (Success)
- C: 0 (Microsoft-defined)
- N: 0 (Not an NTSTATUS value)
- Facility: 0x000 (FACILITY_NULL: Default)
- Code: 0x001a (26)
- Sev: 0 (STATUS_SEVERITY_SUCCESS)
- C: 0 (Microsoft-defined)
- Facility: 0x000 (Default)
- Code: 0x001a (26)
Parameters
| Parameter | Description |
|---|---|
| 0x31 | The image relocation fix-up table or code stream has been corrupted. The error probably is a hardware error. |
| 0x3f | An inpage operation failed with a cyclic redundancy check (CRC) error. Parameter 2 contains the pagefile offset. Parameter 3 contains the page CRC value. Parameter 4 contains the expected CRC value. |
| 0x403 | The page table and page frame numbers (PFNs) are out of sync. The error probably is a hardware error, especially if parameters 3 and 4 differ by only one bit. |
| 0x404 | In the process of deleting a system page, an inconsistency between the PFN and the current page table entry (PTE) pointer was found. Parameter 2 is the expected PTE. Parameter 3 is the PTE contents. Parameter 4 is the PFN’s PTE. |
| 0x411 | A PTE has been corrupted. Parameter 2 is the address of the PTE. |
| 0x1010 | The caller is unlocking a pageable section that's not currently locked. (This section was either never locked or it's being unlocked twice.) |
| 0x1233 | A driver tried to map a physical memory page that wasn't locked. This action is illegal because the contents or attributes of the page can change at any time. A bug in the code made the mapping call. Parameter 2 is the PFN of the physical page that the driver attempted to map. |
| 0x1234 | The caller is trying to lock a nonexistent pageable section. |
| 0x1235 | The caller is trying to protect an MDL with an invalid mapping. |
| 0x1236 | The caller specified an MDL that contains an unlocked (or invalid) physical page. Parameter 2 contains a pointer to the MDL. Parameter 3 contains a pointer to the invalid PFN. Parameter 4 contains the invalid PFN value. |
| 0x1240 | It's illegal for callers to build an MDL for a virtual address range that isn't resident. Parameter 2 is the MDL. Parameter 3 is the PTE pointer. |
| 0x3300 | During a write action, the referenced virtual address is mistakenly marked as "copy on write". Parameter 2 is the value for FaultingAddress. Parameter 3 is the PTE contents. Parameter 4 indicates the virtual address space type. |
| 0x3451 | The PTEs of a kernel thread stack that has been swapped out are corrupted. |
| 0x3453 | Not all the page table pages of an exited process could be deleted because of outstanding references. This error typically indicates corrupted process page table structures. |
| 0x3470 | A cached kernel stack was corrupted while it was on the free list. This memory corruption indicates a serious problem, and the calling stack might be either a victim or a culprit. Parameter 2 is the virtual address. Parameter 3 is the virtual address cookie. |
| 0x4477 | A driver tried to write to an unallocated address in the user space of the system process. Parameter 2 contains the address of the attempted write. |
| 0x5100 | The allocation bitmap is corrupted. The memory manager is about to overwrite a virtual address that was already in use. |
| 0x5305 | The caller is specifying an invalid pool address (parameter 2) to free. Parameter 2 is the virtual address that's being evaluated. Parameter 3 is the region size. |
| 0x6001 | The memory store component’s private memory range is corrupted, so it has become inaccessible. Parameter 2 is the returned status. Parameter 3 is the virtual address in the store's private memory range. Parameter 4 is the MDL. |
| 0x88860x8887 | (Windows 7 and later). Two pages on the standby list that were supposed to have identical page priority values don't have identical page priority values. The differing values are captured in parameter 4. |
| 0x88880x8889 | Internal memory management structures are corrupted. |
| 0x888A | Internal memory management structures (likely the PTE or PFN) are corrupted. |
| 0x9696 | A PFN (parameter 2) was encountered with a corrupted linkage that's no longer connected to its top-level process. This error indicates corrupted PFN structures. |
| 0x15000 | The caller is either supplying the wrong address or calling this routine in the wrong process context. Both actions are illegal because we can't unsecure a range that we can't find due to this error. Parameter 2 is the virtual address that's being evaluated. |
| 0x15001 | An error occurred in the process of unsecuring memory that previously was secured. This error might happen if the caller mistakenly invoked MmUnsecureVirtualMemory in the wrong process context. |
| 0x41202 | In the process of determining the page protection of a non-zero PTE, it was determined that the PTE is corrupted. Parameter 2 is the PTE pointer. Parameter 3 is the PTE contents. Parameter 4 is the virtual address descriptor. |
| 0x41286 | The caller is trying to free an invalid pool address. |
| 0x41785 | The working set list is corrupted. |
| 0x41287 | An illegal page fault occurred while holding working set synchronization. Parameter 2 contains the referenced virtual address. |
| 0x41790 | A page table page has been corrupted. On a 64-bit version of Windows, parameter 2 contains the address of the PFN for the corrupted page table page. On a 32-bit version of Windows, parameter 2 contains a pointer to the number of used PTEs, and parameter 3 contains the number of used PTEs. |
| 0x41792 | A corrupted PTE has been detected. Parameter 2 contains the address of the PTE. Parameters 3 and 4 contain the low and high parts of the PTE. |
| 0x61941 | The paging hierarchy is corrupted. Parameter 2 is a pointer to the virtual address that caused the fault. |
| 0x61948 | In the process of decrementing the reference counts for an I/O space region, the region's accounting node couldn't be found. Typically, this error means that the argument range was never locked or that it's already been unlocked. Parameter 2 is the base I/O frame. Parameter 3 is the number of pages in the region. Parameter 4 is the specific I/O frame for which a node couldn't be found. |
| 0x61949 | The IoPageFrameNode value is null. Parameter 2 is PageFrameIndex. |
| 0x6194A | An error occurred while decrementing the reference counts on I/O space physical pages that are being unmapped. An entry that isn't currently referenced is being dereferenced. Parameters 2 and 3 describe the caller's I/O space range that's being unmapped. Parameter 4 is the I/O space physical page that's expected to be referenced, but which isn't referenced. |
| 0x03030308 | The range to remove (or truncate) is in use by the loader. It can't be safely removed, so the system must issue a stop code. Parameter 2 is HighestPhysicalPage. |
Description
The MEMORY_MANAGEMENT bug check has a value of 0x0000001A. The bug check indicates that a severe memory management error occurred.
Important
This article is for programmers. If you're a Microsoft customer and your computer displays a blue screen error code, see Troubleshoot blue screen errors.
Resolution
The !analyze debug extension displays information about the bug check. The information in the debug extension might help you identify the root cause.
You also might find it helpful to run the Windows Memory Diagnostic tool to check for problems that affect physical memory modules.
See also
Article text from the Windows driver documentation (opens in a new tab), by Microsoft, under the CC BY 4.0 (opens in a new tab) licence.
Associated Modules
| Module | Code | Found in | Description |
|---|---|---|---|
| EventCreate.exe | 0x1a | 78.11011 | %1 |
| KernelBase.dll | 0x1a | 78.1 | The specified disk or diskette cannot be accessed. |
| NetTCPIP.dll | 0x1a | 1011 | When property %1 is %2!lu!, %3 and %4 can not be set |
| VSSVC.exe | 0x1a | 1011 | This machine is a Domain Controller with the Active Directory service (NTDS) stopped. Backup cannot be performed, nor can shadow copies be managed in this case. Either the NTDS must be started (net start ntds), or reboot in DSRM to enumerate shadow copies/providers/writers only. %1 |
| WinSAT.exe | 0x1a | 1011 | Unused |
| cipher.exe | 0x1a | 78.11011 | to 1 |
| compact.exe | 0x1a | 78.11011 | %1: The file system does not support compression or the cluster size of the volume is larger than 4096 bytes. |
| cscui.dll | 0x1a | 1011 | Errors occured while encrypting the Offline Files cache. Increase the Offline Files event logging level policy to level 2 or greater to log failure events for individual files. |
| dsreg.dll | 0x1a | 1011 | The existing NGC user ID key was successfully deleted. Key name: %1. |
| dssec.dll | 0x1a | 78.11011 | Replication synchronization |
| ehepgres.dll | 0x1a | 7 | %1 |
| finger.exe | 0x1a | 78.1 | Bad transfer mode '%1' specified |
| fontview.exe | 0x1a | 78.11011 | %1, Multiple Master |
| ftp.exe | 0x1a | 78.1 | Bad transfer mode '%1' specified |
| hostname.exe | 0x1a | 78.1 | Bad transfer mode '%1' specified |
| hvloader.dll | 0x1a | 11 | Hypervisor launch failed; the hypervisor boot loader's internal logic failed (BalStatus %1, sub-status %2). |
| hvservice.sys | 0x1a | 10 | Hypervisor launch failed; the hypervisor boot loader's internal logic failed (BalStatus %1, sub-status %2). |
| kernel32.dll | 0x1a | 78.11011 | The specified disk or diskette cannot be accessed. |
| microsoft-windows-kernel-processor-power-events.dll | 0x1a | 1011 | Hyper-V logical processor %2 exposes the following: %3 idle state(s) %4 performance state(s) %5 throttle state(s) |
| msprivs.dll | 0x1a | 78.11011 | Synchronize directory service data |
| netdacim.dll | 0x1a | 8.11011 | Entry point override has been restricted by your domain administrator. |
| netnccim.dll | 0x1a | 8.11011 | Entry point override has been restricted by your domain administrator. |
| netttcim.dll | 0x1a | 8.11011 | Entry point override has been restricted by your domain administrator. |
| nslookup.exe | 0x1a | 78.11011 | User ID |
| powershell.exe | 0x1a | 78.11011 | Windows PowerShell console file "%1!ls!" extension is not psc1. Windows PowerShell console file extension must be psc1. |
| reagentc.exe | 0x1a | 8.11011 | %1: Unable to update Boot Configuration Data. |
| tpm.sys | 0x1a | 1011 | Creation of provisioning event has failed. |
| w32time.dll | 0x1a | 1011 | Time Provider NtpClient: The response received from domain controller %1 has a bad signature. The response may have been tampered with and will be ignored. |
| webservices.dll | 0x1a | 78.11011 | The operation could not be completed because the metadata object is in the resolved state. |
| wecutil.exe | 0x1a | 78.11011 | Invalid option %1!s!. Option value is not specified. |
| wevtsvc.dll | 0x1a | 1011 | The event logging service encountered a log file for channel %1 which is an unsupported version. The log was renamed with a .UnsupportedVer extension. |
| wevtutil.exe | 0x1a | 78.11011 | Failed to enumerate event metadata for publisher %1!s!. |
| wfascim.dll | 0x1a | 1011 | The default object %1 is not present in the current store. To find this object, execute the query against the %2. |
| whealogr.dll | 0x1a | 71011 | A fatal hardware error has occurred. Component: PCI/PCI-X Device Error Source: %1 Error Type: %5 Segment:Bus:Device:Function: %12:%11:%10:%9 Vendor ID:Device ID: %6:%7 Class Code: %8 The details view of this entry contains further information. |
| win32kbase.sys | 0x1a | 1011 | PenArbitrationType |
| wininit.exe | 0x1a | 11 | Boot App Anti-Rollback: Boot.stl Enforcement completed with status: HRESULT: %1 Boot Stl Enforced Successfully: %2 WNF Published with result: %3 |
| winsrv.dll | 0x1a | 78.11011 | CriticalAppShutdownCleanupTimeout |
| winsrvext.dll | 0x1a | 11 | CriticalAppShutdownCleanupTimeout |
| 38 entries | |||