Fix 0x00000076 PROCESS_HAS_LOCKED_PAGES in Windows

Quick Answer

PROCESS_HAS_LOCKED_PAGES, bug check 0x00000076, indicates that a driver failed to release locked memory pages after an I/O operation or attempted to unlock pages that were not locked. Parameter 1 distinguishes these two cases. Microsoft Learn

Preserve the crash dump, identify the failure type, and investigate the responsible driver. A targeted driver update or rollback may resolve the underlying defect. Adding RAM does not correct improper page-lock handling.

What Are Locked Memory Pages?

Drivers can lock memory pages so they remain resident while an operation uses them. A memory descriptor list, or MDL, describes the relevant memory.

Microsoft documents that each successful MmProbeAndLockPages operation must have a corresponding MmUnlockPages operation. Correct ownership and cleanup are essential. Microsoft Learn

Bug-Check Parameters

For 0x0, cleanup failed before process termination. For 0x1, investigate unlocking without a successful lock or unlocking twice. Microsoft Learn

Before You Begin

1. Back up important files while Windows remains accessible.
2. Record the crash time and activity, including whether an application was closing.
3. Note recent driver and application changes.
4. Preserve existing crash dumps.
5. Have administrator access available for driver maintenance.

The process named in the dump is not automatically responsible. Investigate the driver activity associated with its memory.

How to Troubleshoot 0x00000076

1. Review recent changes

Determine whether the first crash followed a driver or application update. Record the component and version, then compare subsequent crashes for a consistent trigger.

Microsoft’s general stop-error guidance recommends reviewing recent changes and investigating components supported by crash evidence. An application may expose an underlying driver problem without being the root cause. learn.microsoft.com

2. Roll back an implicated driver

If failures began immediately after a specific device driver update:

1. Open Device Manager.
2. Locate the device and open Properties.
3. Select Driver → Roll Back Driver, if available.
4. Follow the prompts and restart.

Administrator privileges are required. If rollback is unavailable or unsuitable, obtain a compatible replacement through Windows Update or the manufacturer’s official support site. support.microsoft.com

For drivers bundled with an application, use the vendor’s supported update or uninstall procedure. Make one targeted change at a time.

3. Use Safe Mode if normal startup is unstable

From Windows Recovery Environment:

1. Select Troubleshoot → Advanced options → Startup Settings → Restart.
2. Press 4 or F4 for Safe Mode.
3. Perform the relevant rollback if available.

An encrypted device may require its BitLocker recovery key. Safe Mode loads limited drivers and services; stability there narrows the investigation without identifying a particular driver. Restart normally afterward. support.microsoft.com

Analyze the Crash Dump

1. Locate and preserve the dump

Common default locations are:

If necessary, configure Automatic memory dump under Advanced system settings → Advanced → Startup and Recovery → Settings, then restart. A dump exists only if Windows successfully writes it. learn.microsoft.com

2. Run the initial analysis

Open the dump in WinDbg with appropriate symbols configured, then run:

!analyze -v

Record the arguments, stack, and module information. learn.microsoft.com

Interpret Parameter 2 according to Parameter 1. A process pointer and an MDL pointer are different objects.

3. Inspect locked pages when applicable

For the Arg1 = 0 case, use the process address from Arg2:

!lockedpages <process-address-from-Arg2>

Replace the entire placeholder, including angle brackets, with the actual address.

The extension displays driver-locked pages for a specified process. Its usefulness depends on the available tracking information and captured memory. Microsoft Learn

Do not use Arg2 as a process address when Arg1 is 1.

Advanced Diagnostic Option: TrackLockedPages

For unresolved locked-page leaks, Microsoft documents enabling page-lock tracking so a subsequent failure can provide more useful driver information.

Enable tracking

On a controlled troubleshooting system, with administrator access:

1. Open Registry Editor.
2. Navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

3. Record whether TrackLockedPages already exists and its original value.
4. Create or edit TrackLockedPages as a DWORD (32-bit) Value.
5. Set its value to 1.
6. Restart Windows.

Microsoft documents this procedure for the Arg1 = 0 investigation. Microsoft Learn

Understand the expected result

With tracking enabled, a corresponding locked-page leak can produce 0x000000CB — DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS. That dump provides additional tracking information. This setting assists diagnosis; it does not repair the driver. Microsoft Learn

Plan for a possible crash during reproduction and save work beforehand. After collecting the required evidence, restore the original value—or remove only the value you created if it was previously absent—and restart.

Guidance for Driver Developers

Audit normal completion, cancellation, error handling, and process cleanup. Confirm that the component responsible for each successful lock also ensures the appropriate unlock.

Microsoft’s API rules include:

• Match successful MmProbeAndLockPages calls with MmUnlockPages.
• Do not lock an already-locked MDL again before unlocking it.
• Do not use these lock/unlock operations on MDLs built with MmBuildMdlForNonPagedPool or IoBuildPartialMdl.
• Handle exceptions from MmProbeAndLockPages correctly. Microsoft Learn

Test failure and cancellation paths as well as successful I/O.

How to Verify the Fix

1. Restart Windows normally.
2. Confirm the intended driver version is installed.
3. Repeat the operation associated with the crash.
4. Include application closure or process termination if that was the trigger.
5. Preserve any new dump if the failure returns.

Restore temporary diagnostic settings after the investigation. A single successful restart is insufficient evidence for an intermittent defect.

Frequently Asked Questions

Does this mean I need more RAM?

The error concerns incorrect handling of locked pages. More RAM does not repair that logic.

Is the application named in the dump necessarily faulty?

No. A driver may have locked memory associated with that process. Investigate ownership and cleanup before assigning responsibility.

Why did the stop code change to 0xCB?

Locked-page tracking can produce the more informative 0xCB bug check for this type of leak. Preserve the new dump for analysis. Microsoft Learn

Should TrackLockedPages remain enabled permanently?

Use it for the investigation, then restore the original configuration after collecting the necessary evidence.

What should I send to technical support?

Provide the dump, all four arguments, driver versions, Windows build, recent changes, reproduction steps, and whether page-lock tracking was enabled.

Conclusion

For 0x00000076, first distinguish a leaked lock from an invalid unlock. Use the dump and, when necessary, locked-page tracking to identify the responsible driver, then verify the correction against the original trigger.

Sources

• Microsoft Learn — Bug Check 0x76: PROCESS_HAS_LOCKED_PAGES
• Microsoft Learn — Bug Check 0xCB: DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS
• Microsoft Learn — MmProbeAndLockPages function
• Microsoft Learn — !lockedpages debugger extension
• Microsoft Learn — Advanced troubleshooting for stop code errors
• Microsoft Support — Update drivers through Device Manager in Windows
• Microsoft Support — Windows startup settings