FLTMGR_FILE_SYSTEM bug check (0xF5) with code 0x6D

NTFSD
1

Hi. I’m getting this bugcheck on Vista. There is not documentation
anywhere as to what the particular code code (it goes up to 0x6C, but
there is no 0x6D).
Anyone know?

–
King regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.

2

I grabbed this information out of the debugger documentation:

Bug Check 0x6D: SESSION1_INITIALIZATION_FAILED
The SESSION1_INITIALIZATION_FAILED bug check has a value of 0x0000006D.
This indicates that the Windows initialization failed.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description
1 The NT status code that caused the initialization failure
2 0
3 0
4 0

Neal Christiansen
Microsoft NTFS Development Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
Sent: Monday, January 29, 2007 10:12 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FLTMGR_FILE_SYSTEM bug check (0xF5) with code 0x6D

Hi. I’m getting this bugcheck on Vista. There is not documentation
anywhere as to what the particular code code (it goes up to 0x6C, but
there is no 0x6D).
Anyone know?

–
King regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Hmm, I think I made that easy to misinterpret. The bugcheck is 0xF5, and
parameter 1 is 0x6D.

Neal Christiansen wrote:

I grabbed this information out of the debugger documentation:

Bug Check 0x6D: SESSION1_INITIALIZATION_FAILED
The SESSION1_INITIALIZATION_FAILED bug check has a value of 0x0000006D.
This indicates that the Windows initialization failed.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description
1 The NT status code that caused the initialization failure
2 0
3 0
4 0

Neal Christiansen
Microsoft NTFS Development Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
Sent: Monday, January 29, 2007 10:12 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FLTMGR_FILE_SYSTEM bug check (0xF5) with code 0x6D

Hi. I’m getting this bugcheck on Vista. There is not documentation
anywhere as to what the particular code code (it goes up to 0x6C, but
there is no 0x6D).
Anyone know?

–
King regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
King regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.

4

I see this has not been added to the docs. I will file a doc bug on
this.

The name of this failure is: FLTMGR_BUG_CHECK_CONTEXT_ILLEGAL_RELEASE.
This occurs because you are doing a release of a context and the
reference count went to zero so we are trying to free it but the object
is still linked to its associate object. This occurs because someone is
doing an over dereference of the context.
P1 = 0x6d
P2 = minifilters context address
P3 = filter managers internal CONTEXT_NODE structure address
P4 = 0

While I am at it let me document reason code 0x6E which also not yet
documented.

The name of this is: FLTMGR_BUG_CHECK_CONTEXT_ILLEGAL_REFERENCE. This
occurs when someone tries to reference a context whose reference count
has already gone to zero and they are moving it back to one. This means
someone is trying to reference a context which is in the process of
being freed or more likely already free.
P1 = 0x6e
P2 = minifilters context address
P3 = filter managers internal CONTEXT_NODE structure address
P4 = 0

Both of these are new to Vista.

Neal Christiansen
Microsoft NTFS Development Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
Sent: Friday, February 02, 2007 12:24 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] FLTMGR_FILE_SYSTEM bug check (0xF5) with code 0x6D

Hmm, I think I made that easy to misinterpret. The bugcheck is 0xF5,
and
parameter 1 is 0x6D.

Neal Christiansen wrote:

I grabbed this information out of the debugger documentation:

Bug Check 0x6D: SESSION1_INITIALIZATION_FAILED
The SESSION1_INITIALIZATION_FAILED bug check has a value of
0x0000006D.
This indicates that the Windows initialization failed.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description
1 The NT status code that caused the initialization failure
2 0
3 0
4 0

Neal Christiansen
Microsoft NTFS Development Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan
Maksimovic
Sent: Monday, January 29, 2007 10:12 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FLTMGR_FILE_SYSTEM bug check (0xF5) with code 0x6D

Hi. I’m getting this bugcheck on Vista. There is not documentation
anywhere as to what the particular code code (it goes up to 0x6C, but
there is no 0x6D).
Anyone know?

–
King regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
King regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Thanks, I assumed as much, from the stack trace. This used to bugcheck in
ExFreePool on XP; nice addition.

Neal Christiansen wrote:

I see this has not been added to the docs. I will file a doc bug on
this.

The name of this failure is: FLTMGR_BUG_CHECK_CONTEXT_ILLEGAL_RELEASE.
This occurs because you are doing a release of a context and the
reference count went to zero so we are trying to free it but the object
is still linked to its associate object. This occurs because someone is
doing an over dereference of the context.
P1 = 0x6d
P2 = minifilters context address
P3 = filter managers internal CONTEXT_NODE structure address
P4 = 0

While I am at it let me document reason code 0x6E which also not yet
documented.

The name of this is: FLTMGR_BUG_CHECK_CONTEXT_ILLEGAL_REFERENCE. This
occurs when someone tries to reference a context whose reference count
has already gone to zero and they are moving it back to one. This means
someone is trying to reference a context which is in the process of
being freed or more likely already free.
P1 = 0x6e
P2 = minifilters context address
P3 = filter managers internal CONTEXT_NODE structure address
P4 = 0

Both of these are new to Vista.

Neal Christiansen
Microsoft NTFS Development Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
Sent: Friday, February 02, 2007 12:24 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] FLTMGR_FILE_SYSTEM bug check (0xF5) with code 0x6D

Hmm, I think I made that easy to misinterpret. The bugcheck is 0xF5,
and
parameter 1 is 0x6D.

Neal Christiansen wrote:

> I grabbed this information out of the debugger documentation:
>
> Bug Check 0x6D: SESSION1_INITIALIZATION_FAILED
> The SESSION1_INITIALIZATION_FAILED bug check has a value of
0x0000006D.
> This indicates that the Windows initialization failed.
>
> Parameters
> The following parameters are displayed on the blue screen.
>
> Parameter Description
> 1 The NT status code that caused the initialization failure
> 2 0
> 3 0
> 4 0
>
> Neal Christiansen
> Microsoft NTFS Development Lead
> This posting is provided “AS IS” with no warranties, and confers no
> Rights
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Dejan
Maksimovic
> Sent: Monday, January 29, 2007 10:12 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] FLTMGR_FILE_SYSTEM bug check (0xF5) with code 0x6D
>
> Hi. I’m getting this bugcheck on Vista. There is not documentation
> anywhere as to what the particular code code (it goes up to 0x6C, but
> there is no 0x6D).
> Anyone know?
>
> –
> King regards, Dejan
> http://www.alfasp.com
> File system audit, security and encryption kits.
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag
argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com

–
King regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
King regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.

6

Neal,

I made this same mistake when first looking at this issue. The bugcheck
is 0xF5 and the first parameter is 0x6D. It is this combination that is
not documented.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com