REFERENCE_BY_POINTER
Code: 0x18 (24)
As HRESULT:- S: 0 (Success)
- C: 0 (Microsoft-defined)
- N: 0 (Not an NTSTATUS value)
- Facility: 0x000 (FACILITY_NULL: Default)
- Code: 0x0018 (24)
- Sev: 0 (STATUS_SEVERITY_SUCCESS)
- C: 0 (Microsoft-defined)
- Facility: 0x000 (Default)
- Code: 0x0018 (24)
Parameters
| Parameter | Description |
|---|---|
| 1 | Object type of the object whose reference count is being lowered. |
| 2 | Object whose reference count is being lowered. |
| 3 | Reserved |
| 4 | Reserved |
Description
The REFERENCE_BY_POINTER bug check has a value of 0x00000018. This indicates that the reference count of an object is illegal for the current state of the object.
Important
This article is for programmers. If you're a customer who has received a blue screen error code while using your computer, see Troubleshoot blue screen errors.
Cause
The reference count of an object is illegal for the current state of the object. Each time a driver uses a pointer to an object, the driver calls a kernel routine to increase the reference count of the object by one. When the driver is done with the pointer, the driver calls another kernel routine to decrease the reference count by one.
Drivers must match calls to the routines that increase (reference) and decrease (dereference) the reference count. This bug check is caused by an inconsistency in the object's reference count. Typically, the inconsistency is caused by a driver that decreases the reference count of an object too many times, making extra calls that dereference the object. This bug check can occur because an object's reference count goes to zero while there are still open handles to the object. It might also occur when the object's reference count drops below zero, whether or not there are open handles to the object.
Resolution
Make sure that the driver matches calls to the routines that increase and decrease the reference count of the object. Make sure that your driver does not make extra calls to routines that dereference the object (see Parameter 2).
You can use a debugger to help analyze this problem. For more information, see Crash dump analysis using the Windows debuggers (WinDbg). The !analyze debug extension displays information about the bug check and can be helpful in determining the root cause.
To find the handle and pointer count on the object, use the !object debugger command.
kd> !object address
Where address is the address of the object given in Parameter 2.
You can also set a breakpoint in the code leading up to this stop code and attempt to single step forward into the faulting code.
If you are not equipped to use the Windows debugger to work on this problem, you can use some basic troubleshooting techniques.
- Check the System Log in Event Viewer for additional error messages that might help identify the device or driver that is causing this bug check.
- If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.
- Confirm that any new hardware that is installed is compatible with the installed version of Windows. For example, you can get information about required hardware at Windows 10 Specifications.
- For additional general troubleshooting information, see Analyze Bug Check Blue Screen Data.
Article text from the Windows driver documentation (opens in a new tab), by Microsoft, under the CC BY 4.0 (opens in a new tab) licence.
Associated Modules
| Module | Code | Found in | Description |
|---|---|---|---|
| EventCreate.exe | 0x18 | 78.11011 | %1 |
| KernelBase.dll | 0x18 | 78.1 | The program issued a command but the command length is incorrect. |
| NetTCPIP.dll | 0x18 | 1011 | Properties %1 and %2 should have values at the same time |
| VSSVC.exe | 0x18 | 1011 | Volume Shadow Copy Service Warning: The Volume Shadow Copy Service is shutting down and is experiencing delay while waiting for in-progress calls to complete. %1 |
| WinMgmtR.dll | 0x18 | 1011 | Event provider %1 attempted to register query "%2" whose target class "%3" in %4 namespace does not exist. The query will be ignored. |
| WinSAT.exe | 0x18 | 1011 | Cannot complete the requested formal assessment. |
| cipher.exe | 0x18 | 78.11011 | %1 |
| compact.exe | 0x18 | 78.11011 | to 1 |
| cscui.dll | 0x18 | 1011 | Synchronization on computer suspend failed with error %1. |
| dsreg.dll | 0x18 | 1011 | Automatic registration failed at authentication phase. Unable to acquire access token. Exit code: %1 Tenant Name: %4 Tenant Type: %3 Server error: %2 |
| dssec.dll | 0x18 | 78.11011 | web information |
| ehepgres.dll | 0x18 | 7 | %1 |
| findstr.exe | 0x18 | 11 | %1: Warning - input is in Unicode format. |
| finger.exe | 0x18 | 78.1 | Received packet with unexpected block number. Block number = %1!d! |
| fontview.exe | 0x18 | 78.11011 | %1Outlines |
| ftp.exe | 0x18 | 78.1 | Received packet with unexpected block number. Block number = %1!d! |
| hostname.exe | 0x18 | 78.1 | Received packet with unexpected block number. Block number = %1!d! |
| kernel32.dll | 0x18 | 78.11011 | The program issued a command but the command length is incorrect. |
| msprivs.dll | 0x18 | 78.11011 | Force shutdown from a remote system |
| netcfg.exe | 0x18 | 1011 | Failed while searching the instance reference of component %1. |
| netdacim.dll | 0x18 | 8.11011 | None of the specified entry point ranges match the entry point IP address. |
| netnccim.dll | 0x18 | 8.11011 | None of the specified entry point ranges match the entry point IP address. |
| netttcim.dll | 0x18 | 8.11011 | None of the specified entry point ranges match the entry point IP address. |
| nslookup.exe | 0x18 | 78.11011 | Mail List Requests & Errors |
| powershell.exe | 0x18 | 78.11011 | Invalid registry key value. Value for registry key %1!ls!\%2!ls! must be REG_SZ. |
| reagentc.exe | 0x18 | 8.11011 | %1: Unable to update configuration file. |
| sstpsvc.dll | 0x18 | 1011 | The certificates bound to the HTTPS listener for IPv4 and IPv6 do not match. For SSTP connections, certificates should be configured for 0.0.0.0:Port for IPv4, and [::]:Port for IPv6. The port is the listener port configured to be used with SSTP. The default listener port is 443. |
| tpm.sys | 0x18 | 1011 | The Trusted Platform Module (TPM) status: %1 and %2. |
| w32time.dll | 0x18 | 1011 | Time Provider NtpClient: No valid response has been received from domain controller %1 after 8 attempts to contact it. This domain controller will be discarded as a time source and NtpClient will attempt to discover a new domain controller from which to synchronize. The error was: %2 |
| webservices.dll | 0x18 | 78.11011 | The operation could not be completed because the metadata object is in a faulted state. |
| wecutil.exe | 0x18 | 78.11011 | Invalid option %1!s!. Option is specified more than once. |
| wevtutil.exe | 0x18 | 78.11011 | Failed to load resource %1!s!. |
| wfascim.dll | 0x18 | 1011 | The protocol is invalid. |
| whealogr.dll | 0x18 | 71011 | A fatal hardware error has occurred. Component: PCI/PCI-X Bus Error Source: %1 Error Type: %5 Segment:Bus: %7:%6 The details view of this entry contains further information. |
| win32k.sys | 0x18 | 8.1 | MouseMonitorEscapeSpeed |
| wininit.exe | 0x18 | 11 | Boot App Anti-Rollback: Timer start completed with status: Win32Error: %1 Start time: %2 Grace period: %3 Due time: %4 |
| winsrv.dll | 0x18 | 78.11011 | is trying to connect to this computer. If you allow, you will be disconnected, but you can resume later. Do you want to allow this connection? |
| winsrvext.dll | 0x18 | 11 | is trying to connect to this computer. If you allow, you will be disconnected, but you can resume later. Do you want to allow this connection? |
| wuaueng.dll | 0x18 | 1011 | Uninstallation Failure: Windows failed to uninstall the following update with error %1: %2 |
| wuauengcore.dll | 0x18 | 11 | Uninstallation Failure: Windows failed to uninstall the following update with error %1: %2 |
| 40 entries | |||