From time to time, a customer support incident for a bugcheck will make its way over to us on the Performance team.  Those of you that have worked with support engineers on the Performance team already know that we generally don’t work with bugcheck issues.  Our Setup / Cluster team has that honor.  However, the STOP 0xC2 error message is BAD_POOL_CALLER, and that word POOL causes administrators and even some support engineers to think “Performance issue” rather than “Bugcheck issue”.  It’s funny how we can sometimes get so hung up on a word or phrase that we develop tunnel vision!  Today we’re going to clear up the confusion behind this Bugcheck …

The STOP 0xC2 message does not indicate resource depletion in the same vein as our old Event ID friends 2019 & 2020.  This bugcheck message means that some Kernel-mode process or driver attempted to perform an invalid memory operation – for example:

  • Allocating a memory pool size of zero bytes
  • Allocating a non-existent memory pool
  • Trying to free a memory pool that has already been freed
  • Allocating a free memory pool at an IRQL that is too high

Now that we know what our bugcheck actually means, how do we troubleshoot it?  The key parameter is the first one – that indicates the type of violation and determines the meaning of the other three parameters.  If you download and install the Debugging Tools for Windows, the Debugger.chm file provided as part of the installation has a Bugcheck Code reference section.  The table below is taken directly from the section on STOP 0xC2 errors and how to interpret the different parameters.

Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x00 0 Pool type Pool tag The current thread requested a zero-byte pool allocation.
0x01, 0x02 or 0x04 Pointer to pool header First part of pool header contents 0 The pool header has been corrupted.
0x06 Reserved Pointer to pool header Pool header contents The current thread attempted to free the pool, which was already freed.
0x07 Reserved Pool header contents Address of the block of pool being freed The current thread attempted to free the pool, which was already freed.
0x08 Current IRQL Pool type Size of allocation, in bytes The current thread attempted to allocate the pool at an invalid IRQL.
0x09 Current IRQL Pool type Address of pool The current thread attempted to free the pool at an invalid IRQL.
0x0A Address of pool Allocator's tag Tag being used in the attempted free The current thread attempted to free pool memory by using the wrong tag.  (The memory might belong to another component.)
0x0B, 0x0C or 0x0D Address of pool Pool allocation's tag Bad quota process pointer The current thread attempted to release a quota on a corrupted pool allocation.
0x40 Starting address Start of system address space 0 The current thread attempted to free the kernel pool at a user-mode address.
0x41 Starting address Physical page frame Highest physical page frame The current thread attempted to free a non-allocated nonpaged pool address.
0x42 or 0x43 Address being freed 0 0 The current thread attempted to free a virtual address that was never in any pool.
0x44 Starting address Reserved 0 The current thread attempted to free a non-allocated nonpaged pool address.
0x46 Starting address 0 0 The current thread attempted to free an invalid pool address.
0x47 Starting address Physical page frame Highest physical page frame The current thread attempted to free a non-allocated nonpaged pool address.
0x48 Starting address Reserved Reserved The current thread attempted to free a non-allocated paged pool address.
0x50 Starting address Start offset, in pages, from beginning of paged pool Size of paged pool, in bytes The current thread attempted to free a non-allocated paged pool address.
0x60 Starting address 0 0 The current thread attempted to free an invalid contiguous memory address.  (The caller of MmFreeContiguousMemory is passing a bad pointer.)
0x99 Address that is being freed 0 0 The current thread attempted to free pool with an invalid address.  (This code can also indicate corruption in the pool header.)
0x9A Pool type Number of bytes requested Pool tag The current thread marked an allocation request MUST_SUCCEED.  (This pool type is no longer supported.)

0x9B Pool type Number of bytes requested Caller's address The current thread attempted to allocate a pool with a tag of 0.  (This would be untrackable, and possibly corrupt the existing tag tables.)
0x9C Pool type Number of bytes requested Caller's address The current thread attempted to allocate a pool with a tag of "BIG".   (This would be untrackable and could possibly corrupt the existing tag tables.)
0x9D Incorrect pool tag used Pool type Caller's address The current thread attempted to allocate a pool with a tag that does not contain any letters or digits. Using such tags makes tracking pool issues difficult.
0x41286 Reserved Reserved Start offset from the beginning of the paged pool, in pages The current thread attempted to free a paged pool address in the middle of an allocation.

As you can see, there are a number of different combinations to consider when dealing with STOP 0xC2 errors, and obviously if you are comfortable with kernel debugging, then this information will mean quite a bit more to you.  For administrators who aren’t as familiar with debugging, there are a number of different troubleshooting options to consider – if the Bugcheck message lists a driver by name, you may need to update (if the driver is old), roll back (if the driver was recently updated) or disable that driver and work with the driver manufacturer for a resolution.  Obviously if there is a hardware component itself that is failing then removing or replacing that component would be the logical course of action.  You should also consider this problem from a software compatibility perspective.  Incompatible drivers, services, anti-virus scanners or backup software packages could all be potential causes for this type of issue – especially in Operating System upgrade scenarios.

There’s a lot of information to digest in this post, but the key takeaway is that the problem with a STOP 0xC2 is not (as is sometimes inferred) Pool Memory resource depletion – it is actually an invalid memory operation.  That’s it for today!  Until next time …

- CC Hameed

Share this post :