Bug Check 0x76: PROCESS_HAS_LOCKED_PAGES
The PROCESS_HAS_LOCKED_PAGES bug check has a value of 0x00000076. This bug check indicates that a driver failed to release locked pages after an I/O operation, or that it attempted to unlock pages that were already unlocked.
Important
This article is for programmers. If you're a customer who has received a blue screen error code while using your computer, see Troubleshoot blue screen errors.
PROCESS_HAS_LOCKED_PAGES Parameters
| Parameter 1 | Parameter 2 | Parameter 3 | Parameter 4 | Cause of error |
|---|---|---|---|---|
0x00 |
The pointer to the process object |
The number of locked pages |
The pointer to driver stacks (if they are enabled). Otherwise, this parameter is zero. |
The process being terminated has locked memory pages. The driver must unlock any memory that it might have locked in a process, before the process terminates. |
0x01 |
MDL specified by the driver |
Current number of locked memory pages in that process |
A pointer to driver stacks for that process (if they are enabled). Otherwise, this parameter is zero. |
The driver is attempting to unlock process memory pages that are not locked. |
Cause
The driver either failed to unlock pages that it locked (parameter 1 value is 0x0), or the driver is attempting to unlock pages that have not been locked or that have already been unlocked (parameter 1 value is 0x1).
Resolution
The !analyze debug extension displays information about the bug check and can be helpful in determining the root cause.
If the parameter 1 value is 0x0
First use the !search extension on the current process pointer throughout all of physical memory. This extension might find at least one memory descriptor list (MDL) that points to the current process. Next, use !search on each MDL that you find to obtain the I/O request packet (IRP) that points to the current process. From this IRP, you can identify which driver is leaking the pages.
Otherwise, you can detect which driver caused the error by editing the registry:
In the \\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management registry key, create or edit the TrackLockedPages value, and then set it equal to DWORD 1.
Restart the computer.
The system then saves stack traces, so you can easily identify the driver that caused the problem. If the driver causes the same error again, bug check 0xCB (DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS) is issued, and the name of the driver that causes this error is displayed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
If the parameter 1 value is 0x1
Examine the driver source code that locks and unlocks memory, and try to locate an instance where memory is unlocked without first being locked.