<?xml version="1.0" encoding="UTF-8"?><!-- generator="wordpress/2.3.3" -->
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	>
<channel>
	<title>Comments on: Bugchecks depicted: IRQL_NOT_LESS_OR_EQUAL</title>
	<link>https://www.dumpanalysis.org/blog/index.php/2007/03/06/bugchecks-depicted-irql_not_less_or_equal/</link>
	<description>Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics</description>
	<pubDate>Tue, 05 May 2026 17:08:50 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.3.3</generator>
		<item>
		<title>By: Software Generalist &#187; Blog Archive &#187; Reading Notebook: 06-August-09</title>
		<link>https://www.dumpanalysis.org/blog/index.php/2007/03/06/bugchecks-depicted-irql_not_less_or_equal/#comment-87413</link>
		<dc:creator>Software Generalist &#187; Blog Archive &#187; Reading Notebook: 06-August-09</dc:creator>
		<pubDate>Thu, 06 Aug 2009 16:05:04 +0000</pubDate>
		<guid>https://www.dumpanalysis.org/blog/index.php/2007/03/06/bugchecks-depicted-irql_not_less_or_equal/#comment-87413</guid>
		<description>[...] explanation for IRQL_NOT_LESS_OR_EQUAL (pp. 100 - 101) - a few years ago I was pondering about this and created a UML sequence diagram to convince myself: http://www.dumpanalysis.org/blog/index.php/2007/03/06/bugchecks-depicted-irql_not_less_or_equal/ [...]</description>
		<content:encoded><![CDATA[<p>[&#8230;] explanation for IRQL_NOT_LESS_OR_EQUAL (pp. 100 - 101) - a few years ago I was pondering about this and created a UML sequence diagram to convince myself: <a href="http://www.dumpanalysis.org/blog/index.php/2007/03/06/bugchecks-depicted-irql_not_less_or_equal/" rel="nofollow">http://www.dumpanalysis.org/blog/index.php/2007/03/06/bugchecks-depicted-irql_not_less_or_equal/</a> [&#8230;]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Anvesh</title>
		<link>https://www.dumpanalysis.org/blog/index.php/2007/03/06/bugchecks-depicted-irql_not_less_or_equal/#comment-28146</link>
		<dc:creator>Anvesh</dc:creator>
		<pubDate>Thu, 22 May 2008 23:06:44 +0000</pubDate>
		<guid>https://www.dumpanalysis.org/blog/index.php/2007/03/06/bugchecks-depicted-irql_not_less_or_equal/#comment-28146</guid>
		<description>I have a similar crash dump as follows.....



*** Fatal System Error: 0x0000000a
                       (0xFE920090,0x0000001C,0x00000001,0x80434527)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

Connected to Windows 2000 2195 x86 compatible target, ptr64 FALSE
Loading Kernel Symbols
Loading User Symbols
PEB address is NULL !
Loading unloaded module list
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck A, {fe920090, 1c, 1, 80434527}

Probably caused by : ntkrnlmp.exe ( nt!KiUnwaitThread+d )

Followup: MachineOwner
---------

nt!RtlpBreakWithStatusInstruction:
8045836c cc              int     3
0: kd&#62; !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fe920090, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80434527, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  fe920090 Nonpaged pool

CURRENT_IRQL:  1c

FAULTING_IP: 
nt!KiUnwaitThread+d
80434527 8916            mov     dword ptr [esi],edx

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  eb423e28 -- (.trap 0xffffffffeb423e28)
ErrCode = 00000002
eax=b05f0f28 ebx=fea29560 ecx=fea29560 edx=fe920090 esi=fe920090 edi=fea29650
eip=80434527 esp=eb423e9c ebp=eb423ec0 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
nt!KiUnwaitThread+0xd:
80434527 8916            mov     dword ptr [esi],edx  ds:0023:fe920090=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8042bf7f to 8045836c

STACK_TEXT:  
eb423a50 8042bf7f 00000003 eb423a98 fe920090 nt!RtlpBreakWithStatusInstruction
eb423a80 8042c572 00000003 fe920090 80434527 nt!KiBugCheckDebugBreak+0x31
eb423e0c 8046b1ac 00000000 fe920090 0000001c nt!KeBugCheckEx+0x390
eb423e0c 80434527 00000000 fe920090 0000001c nt!KiTrap0E+0x210
eb423ea0 80434753 00000000 eb423ed8 fea29648 nt!KiUnwaitThread+0xd
eb423ec0 80433af0 0000003d fea29660 eb423fcc nt!KiWaitTest+0xdf
eb423fb0 80433a7a 4bfa3d5c ffdff848 ffdff000 nt!KiTimerListExpire+0x6e
eb423fdc 80467738 80485600 00000000 00008b3d nt!KiTimerExpiration+0xb6
eb423ff4 8046c47b eb41f99c 00000000 00000000 nt!KiRetireDpcList+0x47
eb423ff8 eb41f99c 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2b
WARNING: Frame IP not in any known module. Following frames may be wrong.
8046c47b 00000000 00000008 bb837d75 00000128 0xeb41f99c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiUnwaitThread+d
80434527 8916            mov     dword ptr [esi],edx

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!KiUnwaitThread+d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  45ec3c8f

FAILURE_BUCKET_ID:  0xA_W_VRF_nt!KiUnwaitThread+d

BUCKET_ID:  0xA_W_VRF_nt!KiUnwaitThread+d

Followup: MachineOwner
---------





Could you please explain me how to get rid of this bugcheck
Thanks in Advance.

Anvesh</description>
		<content:encoded><![CDATA[<p>I have a similar crash dump as follows&#8230;..</p>
<p>*** Fatal System Error: 0&#215;0000000a<br />
                       (0xFE920090,0&#215;0000001C,0&#215;00000001,0&#215;80434527)</p>
<p>Break instruction exception - code 80000003 (first chance)</p>
<p>A fatal system error has occurred.<br />
Debugger entered on first try; Bugcheck callbacks have not been invoked.</p>
<p>A fatal system error has occurred.</p>
<p>Connected to Windows 2000 2195 x86 compatible target, ptr64 FALSE<br />
Loading Kernel Symbols<br />
Loading User Symbols<br />
PEB address is NULL !<br />
Loading unloaded module list<br />
*                                                                             *<br />
*                        Bugcheck Analysis                                    *<br />
*                                                                             *</p>
<p>Use !analyze -v to get detailed debugging information.</p>
<p>BugCheck A, {fe920090, 1c, 1, 80434527}</p>
<p>Probably caused by : ntkrnlmp.exe ( nt!KiUnwaitThread+d )</p>
<p>Followup: MachineOwner<br />
&#8212;&#8212;&#8212;</p>
<p>nt!RtlpBreakWithStatusInstruction:<br />
8045836c cc              int     3<br />
0: kd&gt; !analyze -v<br />
*                                                                             *<br />
*                        Bugcheck Analysis                                    *<br />
*                                                                             *</p>
<p>IRQL_NOT_LESS_OR_EQUAL (a)<br />
An attempt was made to access a pageable (or completely invalid) address at an<br />
interrupt request level (IRQL) that is too high.  This is usually<br />
caused by drivers using improper addresses.<br />
If a kernel debugger is available get the stack backtrace.<br />
Arguments:<br />
Arg1: fe920090, memory referenced<br />
Arg2: 0000001c, IRQL<br />
Arg3: 00000001, bitfield :<br />
	bit 0 : value 0 = read operation, 1 = write operation<br />
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)<br />
Arg4: 80434527, address which referenced memory</p>
<p>Debugging Details:<br />
&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;</p>
<p>WRITE_ADDRESS:  fe920090 Nonpaged pool</p>
<p>CURRENT_IRQL:  1c</p>
<p>FAULTING_IP:<br />
nt!KiUnwaitThread+d<br />
80434527 8916            mov     dword ptr [esi],edx</p>
<p>DEFAULT_BUCKET_ID:  DRIVER_FAULT</p>
<p>BUGCHECK_STR:  0xA</p>
<p>PROCESS_NAME:  System</p>
<p>TRAP_FRAME:  eb423e28 &#8212; (.trap 0xffffffffeb423e28)<br />
ErrCode = 00000002<br />
eax=b05f0f28 ebx=fea29560 ecx=fea29560 edx=fe920090 esi=fe920090 edi=fea29650<br />
eip=80434527 esp=eb423e9c ebp=eb423ec0 iopl=0         nv up ei pl nz na pe nc<br />
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206<br />
nt!KiUnwaitThread+0xd:<br />
80434527 8916            mov     dword ptr [esi],edx  ds:0023:fe920090=????????<br />
Resetting default scope</p>
<p>LAST_CONTROL_TRANSFER:  from 8042bf7f to 8045836c</p>
<p>STACK_TEXT:<br />
eb423a50 8042bf7f 00000003 eb423a98 fe920090 nt!RtlpBreakWithStatusInstruction<br />
eb423a80 8042c572 00000003 fe920090 80434527 nt!KiBugCheckDebugBreak+0&#215;31<br />
eb423e0c 8046b1ac 00000000 fe920090 0000001c nt!KeBugCheckEx+0&#215;390<br />
eb423e0c 80434527 00000000 fe920090 0000001c nt!KiTrap0E+0&#215;210<br />
eb423ea0 80434753 00000000 eb423ed8 fea29648 nt!KiUnwaitThread+0xd<br />
eb423ec0 80433af0 0000003d fea29660 eb423fcc nt!KiWaitTest+0xdf<br />
eb423fb0 80433a7a 4bfa3d5c ffdff848 ffdff000 nt!KiTimerListExpire+0&#215;6e<br />
eb423fdc 80467738 80485600 00000000 00008b3d nt!KiTimerExpiration+0xb6<br />
eb423ff4 8046c47b eb41f99c 00000000 00000000 nt!KiRetireDpcList+0&#215;47<br />
eb423ff8 eb41f99c 00000000 00000000 00000000 nt!KiDispatchInterrupt+0&#215;2b<br />
WARNING: Frame IP not in any known module. Following frames may be wrong.<br />
8046c47b 00000000 00000008 bb837d75 00000128 0xeb41f99c</p>
<p>STACK_COMMAND:  kb</p>
<p>FOLLOWUP_IP:<br />
nt!KiUnwaitThread+d<br />
80434527 8916            mov     dword ptr [esi],edx</p>
<p>SYMBOL_STACK_INDEX:  4</p>
<p>SYMBOL_NAME:  nt!KiUnwaitThread+d</p>
<p>FOLLOWUP_NAME:  MachineOwner</p>
<p>MODULE_NAME: nt</p>
<p>IMAGE_NAME:  ntkrnlmp.exe</p>
<p>DEBUG_FLR_IMAGE_TIMESTAMP:  45ec3c8f</p>
<p>FAILURE_BUCKET_ID:  0xA_W_VRF_nt!KiUnwaitThread+d</p>
<p>BUCKET_ID:  0xA_W_VRF_nt!KiUnwaitThread+d</p>
<p>Followup: MachineOwner<br />
&#8212;&#8212;&#8212;</p>
<p>Could you please explain me how to get rid of this bugcheck<br />
Thanks in Advance.</p>
<p>Anvesh</p>
]]></content:encoded>
	</item>
</channel>
</rss>
