Fix 0x00000048 CANCEL_STATE_IN_COMPLETED_IRP in Windows

Quick Answer

CANCEL_STATE_IN_COMPLETED_IRP, bug check 0x00000048, means an I/O request packet (IRP) was completed and subsequently canceled. Microsoft documents two possible causes: a driver completed the request and then attempted cancellation, or two drivers accessed the same request improperly. The second bug-check parameter identifies the cancellation routine and can help locate the involved driver or driver stack. Microsoft Learn

Start by reviewing recent driver changes. Roll back a relevant update or install a compatible replacement from the manufacturer. If crashes continue, preserve a crash dump for analysis.

What Does This Error Mean?

An IRP represents an input/output request being processed by Windows drivers. For this stop code, the request had a cancellation routine registered, completed normally, and then had that cancellation routine called afterward. This indicates incorrect handling of the request’s lifetime. Microsoft Learn

Bug-check parameters

These values come from the crash record or debugger output. They are diagnostic addresses, not settings to change. Microsoft Learn

Before You Begin

1. Back up important files while Windows is accessible.
2. Record the crash time, stop code, and activity immediately before the failure.
3. Note recently installed drivers, hardware, and software that includes drivers.
4. Preserve existing crash dumps before making changes.
5. Have administrator access available for driver maintenance.

Keep a short change log. Applying one targeted change at a time makes the outcome easier to interpret.

How to Troubleshoot 0x00000048

1. Review changes made before the first crash

Build a timeline covering the first failure and any recent installations or updates.

If the crash follows a repeatable action, record the details: which device was active, which application was running, and whether an operation was starting, stopping, or being canceled. These observations guide investigation; they do not identify the faulty driver by themselves.

Microsoft recommends reviewing recent hardware or software changes and contacting the relevant vendor when crash evidence points to a driver. Microsoft Learn

2. Roll back a relevant driver update

If failures began immediately after a particular device driver update:

1. Open Device Manager.
2. Locate the relevant device.
3. Right-click it and select Properties.
4. Open the Driver tab.
5. Select Roll Back Driver, if available.
6. Complete the prompts and restart.

Administrator privileges are required. If rollback is unavailable, Windows may not have a previous driver package to restore. Obtain a compatible version from the device manufacturer. Microsoft Support

Record the original and replacement versions so that the change can be reversed if necessary.

3. Update the implicated component

When a rollback is unsuitable, obtain a compatible driver through Windows Update or the manufacturer’s official support site. Match the package to the device model and Windows version. Avoid third-party driver download sites. Microsoft Support

If evidence identifies a driver installed with an application, use that application’s supported update or uninstall process. Do not manually delete its driver files.

4. Use Safe Mode if normal startup is unstable

From Windows Recovery Environment:

1. Select Troubleshoot → Advanced options → Startup Settings → Restart.
2. Press 4 or F4 to start Safe Mode.
3. Perform the relevant driver rollback if available.

An encrypted device may require its BitLocker recovery key. Safe Mode loads a limited set of drivers and services; stability there helps narrow the investigation but does not prove which driver caused the crash. Restart normally afterward. Microsoft Support

Advanced Troubleshooting with WinDbg

1. Locate and preserve the dump

Common default locations are:

A dump exists only if Windows was configured and able to write one. If needed, open Advanced system settings → Advanced → Startup and Recovery → Settings, select Automatic memory dump, and restart after saving the setting. Microsoft Learn

2. Run the initial analysis

Open the dump in WinDbg with appropriate symbols configured, then run:

!analyze -v

Record the bug-check arguments and stack information. Microsoft Learn

3. Resolve the cancellation routine

Use the address from Arg2:

ln <address-from-Arg2>

Replace the entire placeholder, including angle brackets, with the actual hexadecimal address.

The ln command shows symbols at or near an address. Use its output to investigate the module containing the cancellation routine. Nearby symbols require interpretation; they are not an automatic verdict about responsibility. Microsoft Learn

4. Inspect the affected IRP

Use the address from Arg1:

!irp <address-from-Arg1> 1

The detailed output includes IRP status, owning thread, and I/O stack information when the required memory is available. Compare this information with the cancellation routine and crash stack. Microsoft Learn

If WinDbg cannot read the IRP, record that limitation. Do not infer the request’s contents from unavailable memory.

Guidance for Driver Developers

Review ownership and synchronization across normal completion, cancellation, and queue removal. Investigate whether competing paths can continue acting on the same request after ownership has changed.

For drivers implementing their own IRP queues, Microsoft recommends the cancel-safe IRP queue framework. Its IoCsqXxx routines handle queue synchronization and cancellation logic, reducing the race conditions associated with manually implemented cancellation routines. Microsoft Learn

Validate any correction against the original reproduction steps, including relevant cancellation and cleanup paths.

How to Verify the Fix

1. Restart Windows normally.
2. Confirm the intended driver version is installed.
3. Repeat the previously affected workflow using noncritical data.
4. Observe several sessions if the problem was intermittent.
5. Preserve a new dump if another crash occurs.

A single successful restart is insufficient evidence that an intermittent fault has been resolved.

Frequently Asked Questions

Does this mean I clicked Cancel incorrectly?

No. An ordinary cancellation action may expose a driver defect, but this error concerns driver handling of an I/O request.

Which parameter is most useful for identifying the driver?

Parameter 2 contains the cancellation routine address. Parameter 1 provides the IRP address for inspecting the request and its driver stack. Microsoft Learn

Should I replace hardware immediately?

The stop code alone does not justify hardware replacement. Begin with the driver history and crash evidence.

What if driver rollback is unavailable?

Check the manufacturer’s support site for an appropriate driver package, or contact its support team for a supported recovery procedure.

What should I provide to technical support?

Provide the dump, Windows version, affected device details, driver versions, recent changes, and reproduction steps. Include the !analyze -v output and the results of examining Arg1 and Arg2.

Conclusion

For 0x00000048, focus on identifying the driver involved in request cancellation. Preserve the crash evidence, make targeted driver changes, and verify the result against the activity that previously triggered the failure.

Sources

• Microsoft Learn — Bug Check 0x48: CANCEL_STATE_IN_COMPLETED_IRP
• Microsoft Learn — Advanced troubleshooting for stop code errors
• Microsoft Support — Update drivers through Device Manager in Windows
• Microsoft Support — Windows startup settings
• Microsoft Learn — ln: List Nearest Symbols
• Microsoft Learn — !irp debugger extension
• Microsoft Learn — Cancel-Safe IRP Queues