STOP CODE · 0xD1
DRIVER_
A driver tried to use memory that was not available to it at that moment, and Windows stopped rather than let it continue. Microsoft describes it as a driver fault, and when Windows can identify the driver, the screen names its file.
WHAT MICROSOFT SAYS
Microsoft's reference says this bug check "indicates that a kernel-mode driver attempted to access pageable memory" while the interrupt request level (IRQL) was too high, and that it "is usually caused by drivers that have used improper memory addresses". If the driver responsible can be identified, its name is printed on the blue screen.
From Microsoft's documentation, linked under Sources. Microsoft wrote its page for this code for programmers; the steps below are the ones it gives everyone else.
TECHNICAL SUMMARY
| Stop code | DRIVER_IRQL_NOT_LESS_OR_EQUAL |
|---|---|
| Value | 0x000000D1 (0xD1) |
| Where you see it | At the bottom of the stop screen, and in the System event log after the restart |
| In Tweaky Driver | Stop codes are not read; driver versions are checked |
What causes DRIVER_
- A driver used a bad pointer, such as one that is empty or already freed, while running at a raised interrupt level.
- A driver touched pageable data, or ran pageable code, at that level.
- A driver called a function in another driver that had already been unloaded.
- Microsoft adds that in most cases the problem is not the interrupt level itself but the memory being accessed.
How to fix DRIVER_
The steps come from Microsoft's guidance, with the reversible ones first. Each one says how to put back what it changed. If Windows cannot start normally, Microsoft's basic steps say to start in safe mode and continue from there.
Write down the stop code and the file the screen names
Microsoft Support says the stop code appears at the bottom of the screen and, when Windows knows it, so does the name of the module that was running. If the screen went by too fast, the command under Check it yourself lists the stop codes Windows recorded, and Event Viewer > Windows Logs > System shows the errors logged around the restart.
To undo: Nothing to undo: this only reads information.
Before you change anything: note the driver and make a restore point
Open the device's Properties > Driver tab and write down the driver provider, date and version. Then select Start, type Create a restore point, open it, and on the System Protection tab choose Create. Microsoft notes that System Protection is not turned on by default; if Create is greyed out, choose Configure and turn it on for the system drive first.
To undo: A restore point changes nothing by itself. To go back later, run System Restore and pick it: Microsoft says it reverts system files, the registry and installed programs, and leaves your personal files alone.
Update the driver the screen names
Microsoft's advice when a driver is identified in the bug check message is to disable the driver or check with the manufacturer for driver updates. In Device Manager, right-click the device and choose Update driver, or install the current package from the manufacturer's support page for your exact model. The file name on the screen tells you which device it is: the pages linked below cover files this code is searched with.
To undo: Open the device's Properties > Driver tab and choose Roll Back Driver, or apply the restore point.
If it started after a driver update, roll the driver back
In Device Manager, right-click the device, choose Properties, open the Driver tab and select Roll Back Driver, then give a reason and confirm. Microsoft notes that you need administrator rights, and that going back to the previous driver often fixes a problem that appeared after an update. The button is greyed out when Windows kept no earlier driver for the device.
To undo: Rolling back is the undo for the update. To return to the newer driver, install it again with Update driver or from the manufacturer's package.
Take out what you added just before it started
Microsoft's first basic step for a stop code that keeps coming back is to remove new hardware: shut the PC down, disconnect the device and start again. Its bug check pages say the same about drivers and system services added recently: remove or update them, and work out what changed just before the first crash.
To undo: Reconnect the hardware, or install the program or driver again.
Install the latest Windows updates
Select Start > Settings > Windows Update and choose Check for updates. It is one of Microsoft's basic steps for a stop code that keeps returning, and it is how new versions of Windows' own drivers arrive.
To undo: If the crashes get worse after an update, apply the restore point from the earlier step.
If nothing helps, go back to a restore point
Microsoft's last basic step is to restore Windows from a system restore point made before the crashes began, or to use one of its other recovery options.
To undo: System Restore leaves personal files alone; programs and drivers installed after that restore point have to be installed again.
Check it yourself
List the stop codes Windows recorded (PowerShell)
Each entry gives the date, the stop code as a hexadecimal number with its four parameters, and where the dump file was saved. On the test PC, Windows 11 build 26300, this ran without administrator rights. An error saying no events were found means Windows recorded none. This stop code appears there as 0x000000d1.
PowerShellGet-WinEvent -FilterHashtable @{ LogName='System'; Id=1001; ProviderName='Microsoft-Windows-WER-SystemErrorReporting' } -MaxEvents 5 | Format-List TimeCreated, MessageList the driver packages installed on the PC
Shows every third-party driver package with its provider, class, version and date, so you can see what was installed around the first crash. Nothing is changed.
cmdpnputil /enum-drivers
What Tweaky Driver can and cannot do here
Driver version checkTweaky Driver does not read crash dumps or stop codes, so it cannot tell you which driver caused this screen. It helps with the step that comes after Windows names a driver: its scan lists every device with the installed driver version and shows whether Windows Update, the Microsoft Update Catalog or a manufacturer package it supports has a newer one, with the source and version in front of you before anything is installed. For this code that is the useful question, because Microsoft describes it as a driver fault. A newer driver is no promise that the blue screen stops: the same code can come from hardware or from Windows itself.
Tweaky Driver, the driver checker that shows its sources — free for Windows 10 and 11.
Common questions
What does DRIVER_IRQL_NOT_LESS_OR_EQUAL mean?
A kernel-mode driver tried to reach memory it could not use while the system was at a raised interrupt level. Microsoft says the code is usually caused by drivers that used improper memory addresses.
What does "What failed" followed by a .sys file mean?
It is the driver Windows identified as responsible. Microsoft's reference says the driver's name is printed on the blue screen when it can be identified. Look the file up to see which device it belongs to, then update or roll back that device's driver.
Is DRIVER_IRQL_NOT_LESS_OR_EQUAL caused by hardware?
Microsoft's page for this code describes driver causes only. Its relative IRQL_NOT_LESS_OR_EQUAL (0xA) is wider: Microsoft says that one usually appears after a faulty driver, system service or BIOS, and gives steps for failing hardware too.
Will updating drivers fix DRIVER_IRQL_NOT_LESS_OR_EQUAL?
It is the fix Microsoft points to when a driver is named: check with the manufacturer for an update, or disable the driver. If the crashes began right after a driver update, rolling that driver back is the faster test.