Bug Check 0x109: CRITICAL_STRUCTURE_CORRUPTION

The CRITICAL_STRUCTURE_CORRUPTION bug check has a value of 0x00000109. This indicates that the kernel has detected critical kernel code or data corruption.

Important

This article is for programmers. If you're a customer who has received a blue screen error code while using your computer, see Troubleshoot blue screen errors.

CRITICAL_STRUCTURE_CORRUPTION Parameters

Parameter Description

1

Reserved

2

Reserved

3

Reserved

4

The type of the corrupted region. (See the following table later on this page.)

The value of Parameter 4 indicates the type of corrupted region.

Parameter 4 Type of Corrupted Region, Type of Corruption, or Type of Action Taken That Caused the Corruption

0x0

A generic data region

0x1

A function modification

0x2

A processor interrupt dispatch table (IDT)

0x3

A processor global descriptor table (GDT)

0x4

A type-1 process list corruption

0x5

A type-2 process list corruption

0x6

A debug routine modification

0x7

A critical MSR modification

0x8

Object type

0x9

A processor IVT

0xA

Modification of a system service function

0xB

A generic session data region

0xC

Modification of a session function or .pdata

0xD

Modification of an import table

0xE

Modification of a session import table

0xF

Ps Win32 callout modification

0x10

Debug switch routine modification

0x11

IRP allocator modification

0x12

Driver call dispatcher modification

0x13

IRP completion dispatcher modification

0x14

IRP deallocator modification

0x15

A processor control register

0x16

Critical floating point control register modification

0x17

Local APIC modification

0x18

Kernel notification callout modification

0x19

Loaded module list modification

0x1A

Type 3 process list corruption

0x1B

Type 4 process list corruption

0x1C

Driver object corruption

0x1D

Executive callback object modification

0x1E

Modification of module padding

0x1F

Modification of a protected process

0x20

A generic data region

0x21

A page hash mismatch

0x22

A session page hash mismatch

0x23

Load config directory modification

0x24

Inverted function table modification

0x25

Session configuration modification

0x26

An extended processor control register

0x27

Type 1 pool corruption

0x28

Type 2 pool corruption

0x29

Type 3 pool corruption

0x101

General pool corruption

0x102

Modification of win32k.sys

Cause

There are generally three different causes for this bug check:

  1. A driver has inadvertently, or deliberately, modified critical kernel code or data. Microsoft Windows Server 2003 with Service Pack 1 (SP1) and later versions of Windows for x64-based computers do not allow the kernel to be patched except through authorized Microsoft-originated hot patches.

  2. A developer attempted to set a normal kernel breakpoint using a kernel debugger that was not attached when the system was started. Normal breakpoints (bp) can only be set if the debugger is attached at start time. Processor breakpoints (ba) can be set at any time.

  3. A hardware corruption occurred. For example, the kernel code or data could have been stored in memory that failed.

Resolution

The !analyze debug extension displays information about the bug check and can be helpful in determining the root cause.

To start, examine the stack trace using the k, kb, kc, kd, kp, kP, kv (Display Stack Backtrace) command. You can specify the processor number to examine the stacks on all processors.

You can also set a breakpoint in the code leading up to this stop code and attempt to single step forward into the faulting code.

For more information see the following topics:

Crash dump analysis using the Windows debuggers (WinDbg)

If you are not equipped to use the Windows debugger to work on this problem, you can use some basic troubleshooting techniques.

  • Check the System Log in Event Viewer for additional error messages that might help identify the device or driver that is causing this bug check.

  • If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.

  • Run the Windows Memory Diagnostics tool, to test the memory. In the control panel search box, type Memory, and then select Diagnose your computer's memory problems.‌ After the test is run, use Event viewer to view the results under the System log. Look for the MemoryDiagnostics-Results entry to view the results.

  • You can try running the hardware diagnostics supplied by the system manufacturer.

  • Confirm that any new hardware that is installed is compatible with the installed version of Windows. For example, you can get information about required hardware at Windows 10 Specifications.

  • For additional general troubleshooting information, see Blue Screen Data.