REFERENCE · BLUE SCREENS
Blue screen stop codes and the driver files they name
What each driver-related stop code means in plain words, what Microsoft's documentation says causes it, and the fixes in a safe order, each with a way to undo it. The driver files have their own pages: what the file is, who publishes it and what was read from it on a real Windows 11 PC.
Find your stop code and the file
Microsoft Support says the stop code appears at the bottom of the screen and, when Windows knows it, so does the name of the module that was running: a file ending in .sys. If the screen has gone, Windows kept a record; this lists the last five and changes nothing.
List the stop codes Windows recorded (PowerShell)
Each entry gives the date, the stop code as a hexadecimal number with its four parameters, and where the dump file was saved. On the test PC, Windows 11 build 26300, this ran without administrator rights. An error saying no events were found means Windows recorded none.
PowerShellGet-WinEvent -FilterHashtable @{ LogName='System'; Id=1001; ProviderName='Microsoft-Windows-WER-SystemErrorReporting' } -MaxEvents 5 | Format-List TimeCreated, Message
Microsoft's analysis of the root causes of crashes: 70% third-party driver code, 10% hardware, 5% Microsoft code and 15% unknown. That is why the driver named on the screen is the place to start, and why a newer driver is not always the answer.
Stop codes
A driver tried to use memory that was not available to it at that moment, and Windows stopped rather than let it continue.
The graphics card stopped answering, Windows tried to reset its driver, and the reset did not finish in time.
A driver was asked to change power state, for example to let its device sleep or wake, and did not complete the request.
A driver kept the processor busy at high priority for longer than Windows allows, and a watchdog timer stopped the system.
Windows itself or a driver reached for memory at an invalid address while the system was at a raised interrupt level.
A program asked Windows to do something, and an error happened in the privileged code that handled the request.
A driver got stuck in an endless loop, most likely waiting for its hardware to become ready.
The part of Windows that schedules work for the graphics card found something it could not continue from.
A driver wrote more data into a small working area than it could hold.
Driver Verifier, a testing tool built into Windows, was switched on and caught a driver breaking a rule.
Driver files
- nvlddmkm.sysNVIDIA
nvlddmkm.sys is the kernel-mode part of NVIDIA's graphics driver.
- amdkmdag.sysAMD
amdkmdag.sys is the kernel-mode part of AMD's Radeon graphics driver.
- rtwlane.sysRealtek
rtwlane.sys is a Realtek driver for PCIe network adapters.
- dxgkrnl.sysMicrosoft (part of Windows)
dxgkrnl.sys is Windows' own graphics kernel: the part of Windows that every graphics driver plugs into.
- dxgmms2.sysMicrosoft (part of Windows)
dxgmms2.sys is the part of Windows' graphics kernel that schedules work for the graphics card and manages video memory.
- ndis.sysMicrosoft (part of Windows)
ndis.sys is the Windows library that every network adapter driver is built on.
- tcpip.sysMicrosoft (part of Windows)
tcpip.sys is Windows' TCP/IP protocol driver: the code that carries your network traffic between programs and the network adapter.
- storport.sysMicrosoft (part of Windows)
storport.sys is the Windows storage port driver: the common base that the drivers of disk controllers are built on.
- ntfs.sysMicrosoft (part of Windows)
ntfs.sys is the file system driver that lets Windows read and write NTFS drives, and Microsoft's causes for a crash in it are mostly about the disk and its data.
- wdf01000.sysMicrosoft (part of Windows)
wdf01000.sys is the Kernel-Mode Driver Framework: a Windows library that many device drivers are written on top of.
- usbxhci.sysMicrosoft (part of Windows)
usbxhci.sys is Windows' driver for USB 3 host controllers, the chips your USB ports are wired to.
Stop codes with a full fix guide
What Tweaky Driver can and cannot do about a blue screen
Tweaky Driver does not read crash dumps or stop codes, and it cannot tell you which driver crashed. It helps with the step Microsoft gives once a driver is named: its scan lists every device with the installed driver version and shows whether Windows Update, the Microsoft Update Catalog or a manufacturer package it supports has a newer one, with the source and version shown before anything is installed. It offers no replacement for Windows' own files, and a newer driver is no promise that a blue screen stops.
Pages are added when people search for a code or file and every statement can be sourced. A yellow warning in Device Manager instead of a blue screen? See the Device Manager error codes. For Windows processes and services, see the Windows database.