Bug Check 0x109: CRITICAL_STRUCTURE_CORRUPTION
The CRITICAL_STRUCTURE_CORRUPTION bug check has a value of 0x00000109. This indicates that the kernel has detected critical kernel code or data corruption.
Important
This article is for programmers. If you're a customer who has received a blue screen error code while using your computer, see Troubleshoot blue screen errors.
CRITICAL_STRUCTURE_CORRUPTION Parameters
| Parameter | Description |
|---|---|
1 |
Reserved |
2 |
Reserved |
3 |
Reserved |
4 |
The type of the corrupted region. (See the following table later on this page.) |
The value of Parameter 4 indicates the type of corrupted region.
| Parameter 4 | Type of Corrupted Region, Type of Corruption, or Type of Action Taken That Caused the Corruption |
|---|---|
0x0 |
A generic data region |
0x1 |
A function modification |
0x2 |
A processor interrupt dispatch table (IDT) |
0x3 |
A processor global descriptor table (GDT) |
0x4 |
A type-1 process list corruption |
0x5 |
A type-2 process list corruption |
0x6 |
A debug routine modification |
0x7 |
A critical MSR modification |
0x8 |
Object type |
0x9 |
A processor IVT |
0xA |
Modification of a system service function |
0xB |
A generic session data region |
0xC |
Modification of a session function or .pdata |
0xD |
Modification of an import table |
0xE |
Modification of a session import table |
0xF |
Ps Win32 callout modification |
0x10 |
Debug switch routine modification |
0x11 |
IRP allocator modification |
0x12 |
Driver call dispatcher modification |
0x13 |
IRP completion dispatcher modification |
0x14 |
IRP deallocator modification |
0x15 |
A processor control register |
0x16 |
Critical floating point control register modification |
0x17 |
Local APIC modification |
0x18 |
Kernel notification callout modification |
0x19 |
Loaded module list modification |
0x1A |
Type 3 process list corruption |
0x1B |
Type 4 process list corruption |
0x1C |
Driver object corruption |
0x1D |
Executive callback object modification |
0x1E |
Modification of module padding |
0x1F |
Modification of a protected process |
0x20 |
A generic data region |
0x21 |
A page hash mismatch |
0x22 |
A session page hash mismatch |
0x23 |
Load config directory modification |
0x24 |
Inverted function table modification |
0x25 |
Session configuration modification |
0x26 |
An extended processor control register |
0x27 |
Type 1 pool corruption |
0x28 |
Type 2 pool corruption |
0x29 |
Type 3 pool corruption |
0x101 |
General pool corruption |
0x102 |
Modification of win32k.sys |
Cause
There are generally three different causes for this bug check:
A driver has inadvertently, or deliberately, modified critical kernel code or data. Microsoft Windows Server 2003 with Service Pack 1 (SP1) and later versions of Windows for x64-based computers do not allow the kernel to be patched except through authorized Microsoft-originated hot patches.
A developer attempted to set a normal kernel breakpoint using a kernel debugger that was not attached when the system was started. Normal breakpoints (bp) can only be set if the debugger is attached at start time. Processor breakpoints (ba) can be set at any time.
A hardware corruption occurred. For example, the kernel code or data could have been stored in memory that failed.
Resolution
The !analyze debug extension displays information about the bug check and can be helpful in determining the root cause.
To start, examine the stack trace using the k, kb, kc, kd, kp, kP, kv (Display Stack Backtrace) command. You can specify the processor number to examine the stacks on all processors.
You can also set a breakpoint in the code leading up to this stop code and attempt to single step forward into the faulting code.
For more information see the following topics:
Crash dump analysis using the Windows debuggers (WinDbg)
If you are not equipped to use the Windows debugger to work on this problem, you can use some basic troubleshooting techniques.
Check the System Log in Event Viewer for additional error messages that might help identify the device or driver that is causing this bug check.
If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.
Run the Windows Memory Diagnostics tool, to test the memory. In the control panel search box, type Memory, and then select Diagnose your computer's memory problems. After the test is run, use Event viewer to view the results under the System log. Look for the MemoryDiagnostics-Results entry to view the results.
You can try running the hardware diagnostics supplied by the system manufacturer.
Confirm that any new hardware that is installed is compatible with the installed version of Windows. For example, you can get information about required hardware at Windows 10 Specifications.
For additional general troubleshooting information, see Analyze Bug Check Blue Screen Data.