| Debugging Tools for Windows |
The FLTMGR_FILE_SYSTEM bug check has a value of 0x000000F5. This indicates that an unrecoverable failure occurred in the Filter Manager.
The following parameters are displayed on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.
| Parameter 1 | Parameter 2 | Parameter 3 | Parameter 4 | Cause of error |
|---|---|---|---|---|
| 0x66 | Pointer to the callback data structure for the operation. | 0 | 0 | The minifilter returned FLT_PREOP_SUCCESS_WITH_CALLBACK or FLT_PREOP_SYNCHRONIZE from a preoperation callback, but did not register a corresponding postoperation callback. |
| 0x67 | Pointer to the callback data structure for the operation. | 0 | Error NTSTATUS code for the operation | An internal object ran out of space, and the system is unable to allocate new space. |
| 0x68 | Handle for the object. | 0 | NTSTATUS code returned by ObReferenceObjectByHandle | Unexpected failure referencing an object. |
| 0x6A | File object pointer for the file. | 0 | 0 | The file-open or file-create request could not be canceled, because one or more handles have been created for the file. |
| 0x6B | Frame ID | 0 | Thread | Invalid BACKPOCKET IRPCTRL state. |
| 0x6C | Frame ID | BackPocket List | Thread | Too many nested PageFaults for BACKPOCKETED IRPCTR. |
| 0x6D | Address of the minifilter's context structure | Address of the CONTEXT_NODE structure | 0 | The context structure was dereferenced too many times. This means that the reference count on the Filter Manager's CONTEXT_NODE structure went to zero while it was still attached to its associated object. |
| 0x6E | Address of the minifilter's context structure | Address of the CONTEXT_NODE structure | 0 | The context structure was referenced after being freed. |
The cause of the problem is indicated by the value of Parameter 1. See the table in the Parameters section.
If Parameter 1 equals 0x66, you can debug this problem by verifying that your minifilter driver has registered a post-operation callback for this operation. The current operation can be found in the callback data structure. (See Parameter 2.) Use the !fltkd.cbd debugger extension.
If Parameter 1 equals 0x67, you should verify that you do not have a nonpaged pool leak somewhere in the system.
If Parameter 1 equals 0x6A, make sure that your minifilter driver does not reference this file object (see Parameter 2) to get a handle at any point during your minifilter's processing of this operation.
If Parameter 1 equals 0x6B or 0x6C, then a non-recoverable internal state error has occurred which will cause the operating system to bug check.
If Parameter 1 equals 0x6D, make sure that your minifilter driver does not call FltReleaseContext too many times for the given context (see Parameter 2).
If Parameter 1 equals 0x6E, make sure that your minifilter driver does not call FltReferenceContext after the given context has been deleted (see Parameter 2).