| Debugging Tools for Windows |
The KERNEL_APC_PENDING_DURING_EXIT bug check has a value of 0x00000020. This indicates that an asynchronous procedure call (APC) was still pending when a thread exited.
The following parameters are displayed on the blue screen.
| Parameter | Description |
|---|---|
| 1 | The address of the APC found pending during exit |
| 2 | The thread's APC disable count |
| 3 | The current IRQL |
| 4 | Reserved |
The key data item is the thread's APC disable count (Parameter 2). If this is non-zero, it will indicate the source of the problem.
The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, KeWaitForSingleObject, KeWaitForMultipleObjects, KeWaitForMutexObject, or FsRtlEnterFileSystem. The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem.
Since these calls should always be in pairs, this value should be zero when a thread exits. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true.
If you ever see this error, be very suspicious of all drivers installed on the machine — especially unusual or non-standard drivers.
This current IRQL (Parameter 3) should be zero. If it is not, that a driver's cancellation routine may have caused this bug check by returning at an elevated IRQL. In this case, carefully note what was running (and what was closing) at the time of the crash, and note all of the installed drivers at the time of the crash. The cause in this case is usually a severe bug in a driver.