Windows Stop Code QUOTA_UNDERFLOW (0x00000021): Meaning, Parameters, and Troubleshooting
Quick Answer QUOTA_UNDERFLOW is Windows bug check 0x00000021. Microsoft says it occurs when quota accounting is mishandled: more quota is returned to a parti...
Quick Answer
QUOTA_UNDERFLOW is Windows bug check 0x00000021. Microsoft says it occurs when quota accounting is mishandled: more quota is returned to a particular block than was previously charged. This is an accounting inconsistency in the kernel’s resource handling, not a message that your disk storage quota has run out. Microsoft Learn
The crash dump supplies four useful parameters: the process initially charged if available, the quota type, the initial amount of quota to return, and the amount remaining that was not returned. Use those values and the call stack to trace the operation responsible. Microsoft’s dedicated 0x21 page does not identify a universal faulty driver or a one-step fix. Microsoft Learn
What Does “Quota Underflow” Mean Here?
Windows keeps accounts of certain resources charged to processes or allocations. When the resource is released, code returns the corresponding charge. The amount returned must agree with what was charged.
Bug check 0x21 means that relationship was violated for a particular block: Windows encountered an attempt to return more quota than had previously been charged. An incorrect size, duplicate accounting action, or mismatched allocation and cleanup path are reasonable code-review hypotheses, but the actual cause must be established from the dump and the code involved. Microsoft Learn
This use of “quota” should not be confused with:
- A cloud account’s usage limit.
- A user’s disk quota.
- The amount of free space on a drive.
- A simple instruction to enlarge the page file.
Those settings are not identified as fixes by Microsoft’s 0x21 reference.
QUOTA_UNDERFLOW Parameters
| Parameter | Microsoft’s definition | How to use it |
|---|---|---|
| 1 / Arg1 | The process initially charged, if available. | Identify the process context, but do not assume its application code caused the accounting error. |
| 2 / Arg2 | The quota type. | Interpret it using the applicable Windows Driver Kit Ps.h definitions. |
| 3 / Arg3 | The initial charged amount of quota to return. | Preserve its exact value for the accounting investigation. |
| 4 / Arg4 | The remaining amount of quota that was not returned. | Compare it with the other values and the relevant code path. |
Microsoft directs developers to Ps.h in the Windows Driver Kit for the full list of possible quota-type values. Do not label Arg2 as a specific resource type merely from an unfamiliar numeric value. Microsoft Learn
Why Arg1 does not automatically name the guilty process
Arg1 identifies the process initially charged, when that information is available. A kernel driver can perform operations in a process context. The process shown in Arg1 is therefore useful context, not proof that the user-facing application contains the defect. Trace the kernel call stack and accounting path before assigning responsibility.
Likely Code Paths to Review
Microsoft documents the quota mismatch, but its short 0x21 entry does not enumerate specific programming mistakes. Once the dump points to a relevant component, a developer can check for:
- A duplicate return: Two cleanup paths both return quota for one charge.
- A size mismatch: The returned amount differs from the amount charged for the allocation.
- A failed or partial charge: Cleanup assumes a full charge occurred when the earlier operation failed or only partly completed.
- A lifetime error: State needed to remember the charge is overwritten or reused before cleanup.
These are investigation hypotheses, not a claim that every 0x21 crash has one of these precise causes. Follow the actual stack, values, and source code.
How to Investigate the Crash in WinDbg
1. Confirm the full stop code and preserve the dump
Verify 0x00000021 from the original crash record. Keep the dump produced by the failure. A screenshot of the blue-screen name does not show the quota type or the accounting path.
2. Run the initial analysis
Open the dump in WinDbg and enter:
!analyze -vRecord the four arguments exactly, along with the stack trace and any module named by the debugger. Microsoft’s general bug-check reference recommends !analyze to display available information about a crash. A module name in automated output is a lead to verify, not conclusive proof. learn.microsoft.com
3. Examine the stack
Use a detailed stack display:
kvLook for the operation attempting to return quota and the driver or kernel component that called it. Work backward to determine where the corresponding quota charge occurred. The last routine on the stack may be where Windows detected the inconsistency, while the accounting mistake happened earlier.
4. Interpret the quota type carefully
Use Arg2 with the appropriate WDK Ps.h definitions for the build and development environment. Arg2 is not universally a pool address, a byte count, or a process identifier; Microsoft identifies it as a quota type. Microsoft Learn
5. Trace charge and return as a pair
For the relevant block, establish:
- What amount was originally charged?
- Which process or context received the charge?
- Which paths can return that charge?
- Can a failure, cancellation, or concurrent cleanup path run twice?
- Does the return use the same amount and quota type as the charge?
The goal is to find the first mismatch, rather than changing the point where Windows finally detected it.
Practical Steps for an End User
If you are not developing kernel code, you cannot correct quota bookkeeping through a normal Windows setting. If crashes recur:
- Keep the crash dumps and note when the problem started.
- Record recent driver and device changes.
- Have the dump analysed to identify a relevant driver path.
- Use a vendor-supported update or rollback when the evidence points to that driver.
Do not assume that deleting files, increasing a disk quota, or changing page-file size will address bug check 0x21. Microsoft describes a mismatch in charged and returned quota for a block, and provides no generic end-user fix on the dedicated page. Microsoft Learn
Frequently Asked Questions
What does QUOTA_UNDERFLOW mean?
Windows detected an attempt to return more quota to a particular block than was previously charged. The associated bug-check value is 0x00000021. Microsoft Learn
Does it mean my disk is full?
No. Microsoft describes a kernel quota-accounting inconsistency, not a lack of free disk space. Microsoft Learn
What is Parameter 1?
It is the process initially charged, if available. Its presence does not, by itself, prove the application is faulty. Microsoft Learn
What is Parameter 2?
It is the quota type. Microsoft refers developers to the WDK’s Ps.h header for the possible values. Microsoft Learn
What do Parameters 3 and 4 represent?
Arg3 is the initial charged amount of quota to return. Arg4 is the remaining amount that was not returned. Record both as displayed in the dump. Microsoft Learn
Will increasing a user or disk quota fix it?
The official 0x21 description does not support that as a general fix. Investigate the kernel accounting path in the crash dump. Microsoft Learn
Does the crash stack always show the original mistake?
Not necessarily. The stack can show where the incorrect return was detected. Trace back to the earlier charge and every path that could return it.
Summary
QUOTA_UNDERFLOW (0x00000021) reports a mismatch between quota charged and quota returned for a block. The four parameters identify the charged process when available, quota type, initial amount to return, and amount not returned. The effective debugging approach is to follow the dump’s stack and reconstruct the charge-and-return sequence that produced the mismatch. Microsoft Learn
Sources
Was this guide useful?
Your answer helps us keep BISONKB accurate and practical.