Bug Check 0xF5: FLTMGR_FILE_SYSTEM
The FLTMGR_FILE_SYSTEM bug check has a value of 0x000000F5. This indicates that an unrecoverable failure occurred in the Filter Manager.
Important
This article is for programmers. If you're a customer who has received a blue screen error code while using your computer, see Troubleshoot blue screen errors.
FLTMGR_FILE_SYSTEM Parameters
Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.
| Parameter 1 | Parameter 2 | Parameter 3 | Parameter 4 | Cause of error |
|---|---|---|---|---|
0x66 |
Pointer to the callback data structure for the operation. |
0 |
0 |
The minifilter returned FLT_PREOP_SUCCESS_WITH_CALLBACK or FLT_PREOP_SYNCHRONIZE from a preoperation callback, but did not register a corresponding postoperation callback. |
0x67 |
Pointer to the callback data structure for the operation. |
0 |
Error NTSTATUS code for the operation |
An internal object ran out of space, and the system is unable to allocate new space. |
0x68 |
Reserved |
Address of the FLT_FILE_NAME_INFORMATIONN structure |
Reserved |
A FLT_FILE_NAME_INFORMATION structure was dereferenced too many times. |
0x6A |
File object pointer for the file. |
0 |
0 |
The file-open or file-create request could not be canceled, because one or more handles have been created for the file. |
0x6B |
Frame ID |
0 |
Thread |
Invalid BACKPOCKET IRPCTRL state. |
0x6C |
Frame ID |
BackPocket List |
Thread |
Too many nested PageFaults for BACKPOCKETED IRPCTR. |
0x6D |
Address of the minifilter's context structure |
Address of the CONTEXT_NODE structure |
0 |
The context structure was dereferenced too many times. This means that the reference count on the Filter Manager's CONTEXT_NODE structure went to zero while it was still attached to its associated object. |
0x6E |
Address of the minifilter's context structure |
Address of the CONTEXT_NODE structure |
0 |
The context structure was referenced after being freed. |
Cause
The cause of the problem is indicated by the value of Parameter 1. See the table in the Parameters section.
Resolution
If Parameter 1 equals 0x66, you can debug this problem by verifying that your minifilter driver has registered a post-operation callback for this operation. The current operation can be found in the callback data structure. (See Parameter 2.) Use the !fltkd.cbd debugger extension.
If Parameter 1 equals 0x67, you should verify that you do not have a nonpaged pool leak somewhere in the system.
If Parameter 1 equals 0x6A, make sure that your minifilter driver does not reference this file object (see Parameter 2) to get a handle at any point during your minifilter's processing of this operation.
If Parameter 1 equals 0x6B or 0x6C, then a non-recoverable internal state error has occurred which will cause the operating system to bug check.
If Parameter 1 equals 0x6D, make sure that your minifilter driver does not call FltReleaseContext too many times for the given context (see Parameter 2).
If Parameter 1 equals 0x6E, make sure that your minifilter driver does not call FltReferenceContext after the given context has been deleted (see Parameter 2).