Windows Stop Code KERNEL_APC_PENDING_DURING_EXIT (0x00000020): Meaning, Parameters, and Troubleshooting
Quick Answer KERNEL_APC_PENDING_DURING_EXIT is Windows bug check 0x00000020. It means Windows found an asynchronous procedure call (APC) still pending when a...
Quick Answer
KERNEL_APC_PENDING_DURING_EXIT is Windows bug check 0x00000020. It means Windows found an asynchronous procedure call (APC) still pending when a thread exited. The most useful values are Parameter 2, the exiting thread’s APC disable count, and Parameter 3, its current IRQL. Microsoft Learn
A nonzero APC disable count often indicates that a driver’s calls to enter and leave a critical region, enter and exit file-system processing, or acquire and release a mutex were not balanced. If the IRQL is nonzero, Microsoft says a driver cancellation routine may have returned while IRQL was still elevated. Inspect the crash dump and thread’s stack before naming a driver. Microsoft Learn
What Is a Kernel APC?
An asynchronous procedure call, or APC, is work associated with a particular thread. Kernel code can temporarily prevent certain APCs from being delivered while it performs an operation that must not be interrupted in that way.
Windows tracks part of this state with an APC disable count. A driver changes the count when it enters or leaves particular protected regions or acquires and releases a mutex. Those operations must be paired correctly so the count returns to its expected value before the thread exits. Microsoft says the count should be zero at thread exit for this bug check. Microsoft Learn
Bug Check 0x20 Parameters
| Parameter | Meaning | What to inspect |
|---|---|---|
| 1 / Arg1 | Address of the APC found pending during thread exit | Preserve the address for dump analysis. |
| 2 / Arg2 | The thread’s APC disable count | Check whether it is zero, negative, or positive. |
| 3 / Arg3 | Current IRQL | Microsoft says it should be zero here. |
| 4 / Arg4 | Reserved | Do not assign it a diagnostic meaning. |
These definitions are from Microsoft’s dedicated 0x20 reference. Microsoft Learn
How to Interpret the APC Disable Count
Parameter 2 is the key starting point. Microsoft documents the following changes to the count:
| Operation | Effect on APC disable count |
|---|---|
KeEnterCriticalRegion |
Decrements it |
FsRtlEnterFileSystem |
Decrements it |
| Acquiring a mutex | Decrements it |
KeLeaveCriticalRegion |
Increments it |
FsRtlExitFileSystem |
Increments it |
KeReleaseMutex |
Increments it |
The calls should balance by the time the thread exits. A negative value indicates that APC delivery was disabled without being re-enabled. A positive value indicates the reverse imbalance. The count tells you the direction of the mismatch; the stack and driver code are needed to locate the exact missing or extra call. Microsoft Learn
Example: Missing exit call
A driver calls KeEnterCriticalRegion, takes an error path, and exits without calling the matching KeLeaveCriticalRegion. This is an illustrative programming pattern, not proof that a particular crash followed it. The resulting imbalance is the kind of condition Microsoft directs developers to investigate.
Example: Extra release call
A cleanup path calls KeReleaseMutex despite a different path having already released the mutex. That could move the count in the opposite direction. Confirm the actual sequence and ownership in the driver’s code rather than fixing the number by adding an arbitrary call.
Why Parameter 3 Matters
Microsoft says the current IRQL in Parameter 3 should be zero. If it is not, a driver’s cancellation routine may have returned at an elevated IRQL. Microsoft recommends noting what was running, what was closing, and which drivers were installed at the time of the crash. Microsoft Learn
A nonzero IRQL is a separate, important lead. Do not focus solely on the APC disable count while overlooking it.
How to Investigate the Crash with WinDbg
1. Preserve the crash dump
Keep the dump produced by the affected system. The stop-code name alone cannot show the APC address, count, current IRQL, or relevant stack.
2. Run the initial analysis
Open the dump in WinDbg and enter:
!analyze -vRecord all four arguments. Microsoft specifically recommends !analyze for information that can help determine the root cause of bug check 0x20. Microsoft Learn
3. Interpret Arg2 and Arg3 first
- Arg2 negative: Look for an unmatched operation that disabled APC delivery, such as entering a critical region without leaving it.
- Arg2 positive: Look for the opposite imbalance, including an extra leave or release operation.
- Arg3 nonzero: Investigate code that may have returned at an elevated IRQL, particularly a cancellation path indicated by the stack.
These interpretations follow Microsoft’s cause guidance; they identify areas to inspect, not the guilty driver by themselves. Microsoft Learn
4. Examine the exiting thread’s stack
Display the stack in more detail:
kvLook for the driver’s thread-exit, cleanup, close, cancellation, file-system, or mutex path. Trace earlier branches through the code, since the final stack may show where the imbalance was detected rather than the instruction that first created it.
5. Compare other crashes and recent changes
If the computer has several dumps, compare their APC counts, IRQLs, and driver paths. Note which operation was closing when each crash occurred and whether a recently installed or updated driver appears in the relevant path.
Guidance for Driver Developers
Review each code path that enters a critical region, enters file-system processing, or acquires a mutex. Pair it with the appropriate exit or release operation on every success, error, cancellation, and cleanup path.
A useful review table is:
| Entry or acquisition | Matching exit or release |
|---|---|
KeEnterCriticalRegion |
KeLeaveCriticalRegion |
FsRtlEnterFileSystem |
FsRtlExitFileSystem |
| Mutex acquisition | Appropriate mutex release |
Also inspect cancellation routines when Arg3 is nonzero. Verify that an elevated IRQL is restored as required before a routine returns. Microsoft specifically identifies a cancellation routine returning at elevated IRQL as a possible explanation in that case. Microsoft Learn
Guidance for End Users
An end user cannot repair an APC count directly with a Windows setting. If crashes repeat, save the dumps, record what application or device was closing at the time, and note recent driver installations. If dump analysis consistently identifies a third-party driver, seek a supported update or rollback from its vendor.
Microsoft advises particular suspicion of unusual or nonstandard installed drivers for this error. That is a reason to investigate them, not to remove every driver indiscriminately. Microsoft Learn
Frequently Asked Questions
What does KERNEL_APC_PENDING_DURING_EXIT mean?
A kernel APC was still pending when a thread exited. Windows reports this as bug check 0x00000020. Microsoft Learn
Which parameter is most important?
Start with Parameter 2, the APC disable count. Also check Parameter 3, the current IRQL. Microsoft Learn
What does a negative APC disable count mean?
Microsoft says it indicates that a driver disabled APC calls without re-enabling them. Investigate unmatched entry, acquisition, and cleanup paths. Microsoft Learn
What does a positive count mean?
It indicates the reverse imbalance. Look for an extra leave or release call, while confirming the actual path in the dump and source code. Microsoft Learn
Should Parameter 3 be zero?
Yes. Microsoft says the current IRQL should be zero; a nonzero value may point to a cancellation routine returning at elevated IRQL. Microsoft Learn
Does this prove the application I closed is faulty?
No. The operation being closed provides context, but the underlying imbalance may lie in a kernel driver. Examine the dump before assigning responsibility.
What does Parameter 4 mean?
Microsoft marks it reserved. Do not interpret it as a driver address or status code merely from its value. Microsoft Learn
Summary
KERNEL_APC_PENDING_DURING_EXIT (0x00000020) occurs when a thread exits with an APC still pending. Arg2 shows the APC disable-count imbalance; Arg3 shows whether IRQL was unexpectedly elevated. Trace the exiting thread’s driver path for unmatched critical-region, file-system, or mutex calls and, where applicable, an incorrect cancellation routine. Microsoft Learn
Sources
Was this guide useful?
Your answer helps us keep BISONKB accurate and practical.