Bugcheck 1a (41790) - used page table entry counter underflow

[muhahaa]

The MEMORY_MANAGEMENT / 0x1a (0x41790) bugchecks seem to be quite common according to Google search results. It means that the used page table entry count is above or equal to 0x200 (512). Usually it has underflowed (0xffff = -1 = 65535).

What kind of bug can cause this? I suppose it's some sort of double free. Can driver verifier catch it?

 

[Vir Gnarus]

Not quite. Though that is one possible subcode for the 0x1A bugcheck. Often times, however, the subcode (Arg1 of the bugcheck) shown is something not revealed to the public. This makes analyzing 0x1A bugchecks quite difficult. If you're lucky to get a subcode that is actually documented in the Windbg Help Manual, great! Otherwise, it's not worth bothering with as you may not get anything worthwhile from that crashdump.

I'm not quite sure Driver Verifier may assist on this, though there is a possibility, especially if there's corruption involving paged pool. Gflags can also assist with heap-related switches. But I am not aware of anything directly related to paging operations for Driver Verifier.