What causes the 0x3B SYSTEM_SERVICE_EXCEPTION blue screen?

Code running on a system thread raised an exception while it was making the transition from non-privileged to privileged code. Microsoft lists a NULL pointer dereference or a random incorrect address as the usual trigger, which in turn comes from memory being freed too early or from data structure corruption.

How do I find what caused a 0x3B crash?

Run !analyze -v, then read Parameter 1, the exception code, with !error, and run .cxr on Parameter 3, the context record, followed by kb to see the stack at the exception. dx KiBugCheckDriver shows the driver Windows named on the blue screen, if there was one.

What do the common 0x3B exception codes mean?

0xC0000005 is STATUS_ACCESS_VIOLATION: the code touched memory it could not read or write. 0x80000003 is STATUS_BREAKPOINT: a breakpoint or ASSERT was hit when no kernel debugger was attached. Other values in Parameter 1 are NTSTATUS codes you can look up with !error.

Windows stop code · 0x0000003B

0x3B SYSTEM_SERVICE_EXCEPTION

What stop code 0x3B SYSTEM_SERVICE_EXCEPTION means, how to read its parameters, and the WinDbg commands that find the exception behind it.

Published 2026-10-26 by PerformanceInsights.ai

Short answer: 0x3B means code on a system thread raised an exception while making the transition from non-privileged to privileged code. Parameter 1 is the exception code (usually 0xC0000005, an access violation), Parameter 2 is the address of the instruction that raised it, and Parameter 3 is the address of the exception's context record: .cxr on Parameter 3 followed by kb shows the stack where it happened. Microsoft's explanation is a NULL pointer dereference or a random incorrect address, caused in turn by memory freed too early or by data structure corruption.

Parameters

Parameter	Meaning
1	The exception that caused the bug check, an NTSTATUS value (defined in `ntstatus.h` in the Windows Driver Kit).
2	The address of the instruction that caused the bug check.
3	The address of the context record for the exception that caused the bug check.
4	`0`, not used.

Common exception codes in Parameter 1:

Value	Name	Meaning
`0xC0000005`	STATUS_ACCESS_VIOLATION	A memory access violation: the instruction referenced memory it could not read or write.
`0x80000003`	STATUS_BREAKPOINT	A breakpoint or ASSERT was hit when no kernel debugger was attached to the system.

Source: Microsoft Learn, Bug Check 0x3B.

Reading the dump

!analyze -v                 # MODULE_NAME / IMAGE_NAME, and the four arguments
!error <Arg1>                  # what the exception code means
dx KiBugCheckDriver         # the driver Windows named on the blue screen, if any
.cxr <Arg3>                 # switch to the context record of the exception
kb                          # stack at the exception
ln <Arg2>                   # function that raised it
u <Arg2>; ub <Arg2>         # the instructions at and just before it
lm t n                      # modules loaded in memory
!memusage                   # general state of system memory
lmvm <driver>               # version and date of the suspect

If several dumps from the same machine are available, compare their STACK_TEXT: code that shows up in all of them is the best lead. !pte and !pool examine specific memory, but they need a kernel or complete memory dump; in a small minidump an error from them means "not in this dump", not "not mapped".

Parameter 1 = 0xC0000005: an access violation. Look at the instruction at Parameter 2 and the registers (r) to see which pointer was NULL or invalid, then trace where that pointer came from.
Parameter 1 = 0x80000003: a breakpoint or ASSERT compiled into the code ran with no debugger attached. The module in the stack is the one that contains it.
A driver named in IMAGE_NAME or KiBugCheckDriver: check its version with lmvm and update it. If the stack shows a Windows module, look further down for the third-party code that called into it.
A pattern of paged pool use: Microsoft notes this error has been linked to excessive paged pool use, which can happen when user-mode graphics drivers pass bad data to kernel code. Driver Verifier's pool options gather more detail.

Typical causes and fixes

Microsoft is explicit that finding the specific cause and writing a code fix takes programming experience and access to the source code of the faulting module. Without that, the practical steps are the general ones for any bug check:

Remove or update recently added device drivers or system services, and work out what changed on the machine before the first crash.
Update the driver named in the dump, and check Device Manager for devices with warnings.
If the named driver keeps changing, run Driver Verifier (verifier) on as few drivers as possible, since it adds overhead. On a production machine, know how to turn it off (verifier /reset from safe mode) before you start.

Common questions

What causes the 0x3B SYSTEM_SERVICE_EXCEPTION blue screen?: Code running on a system thread raised an exception while it was making the transition from non-privileged to privileged code. Microsoft lists a NULL pointer dereference or a random incorrect address as the usual trigger, which in turn comes from memory being freed too early or from data structure corruption.
How do I find what caused a 0x3B crash?: Run !analyze -v, then read Parameter 1, the exception code, with !error, and run .cxr on Parameter 3, the context record, followed by kb to see the stack at the exception. dx KiBugCheckDriver shows the driver Windows named on the blue screen, if there was one.
What do the common 0x3B exception codes mean?: 0xC0000005 is STATUS_ACCESS_VIOLATION: the code touched memory it could not read or write. 0x80000003 is STATUS_BREAKPOINT: a breakpoint or ASSERT was hit when no kernel debugger was attached. Other values in Parameter 1 are NTSTATUS codes you can look up with !error.

Rather not read the dump yourself?

Upload it to DumpTriage. It runs the debugger, reads the output and sends back the faulting module, the stack and a plain-language root cause (how the analysis works). Cases the automated passes can't settle go to an engineer. Free during the pilot.

Create an account