Windows stop code · 0x000000D1

0xD1 DRIVER_IRQL_NOT_LESS_OR_EQUAL

What stop code 0xD1 DRIVER_IRQL_NOT_LESS_OR_EQUAL means, how to read its four parameters, and the WinDbg commands that point at the faulting driver.

Published 2026-10-20 by PerformanceInsights.ai

Short answer: 0xD1 means a kernel driver touched memory it wasn't allowed to touch at a raised IRQL. Usually it's a bad pointer (NULL, freed or garbage), sometimes pageable memory used at DISPATCH_LEVEL or above. Parameter 4 is the instruction that made the access: ln on it names the function and driver. Despite the name, the IRQL is rarely the real problem; the address is.

Parameters

Parameter	Meaning
1	The memory address referenced. A small value like `0x0` or `0x28` means a NULL pointer plus a structure offset.
2	IRQL at the time (2 = `DISPATCH_LEVEL`).
3	The access type: 0 = read, 1 = write, 2 or 8 = execute.
4	The address of the instruction that made the reference.

Source: Microsoft Learn, Bug Check 0xD1.

Reading the dump

!analyze -v                 # MODULE_NAME / IMAGE_NAME, and the four arguments
dx KiBugCheckDriver         # the driver Windows named on the blue screen
ln <Arg4>                   # function that made the access
.trap <address>             # if !analyze shows a TRAP_FRAME, switch to it, then:
kv                          # stack at the faulting instruction
ub <Arg4>                   # the instructions just before the access
!pool <Arg1>                # is the address in pool, and is it freed?
!pte <Arg1>                 # is it mapped at all
lmvm <driver>               # version and date of the suspect

Arg1 near zero means a NULL pointer dereference in the driver at Arg4. It's that driver's bug.
Arg1 in freed pool means use after free. The driver at Arg4 may be the victim of whoever freed the memory; Driver Verifier's special pool catches the culprit.
Arg4 in ndis.sys, tcpip.sys or Wdf01000.sys: look further down the stack for the third-party driver (network adapter, VPN, firewall filter) that passed the bad pointer in.
Arg3 = 2 or 8 (execute) means the CPU jumped to a bad address. That's usually a call through a stale function pointer, e.g. into a driver that was unloaded.

Typical causes and fixes

Network adapter, Wi-Fi, VPN and firewall drivers are frequent offenders. Update the one named in IMAGE_NAME or on the stack.
If the named driver keeps changing, or the crash is in Windows' own code, run Driver Verifier (verifier) on the third-party drivers to catch the real culprit. On a production machine, plan for the extra overhead and possible boot loops; know how to turn it off (verifier /reset from safe mode).
Random 0xD1s alongside other stop codes point to hardware. Test the memory.

Rather not read the dump yourself?

Upload it to DumpTriage. It runs the debugger, reads the output and sends back the faulting module, the stack and a plain-language root cause. Cases the automated passes can't settle go to an engineer. Free during the pilot.

Create an account