How to Fix Windows Blue Screen Error 0x00000126 (NETIO_INVALID_POOL_CALLER)

Quick Answer

NETIO_INVALID_POOL_CALLER (Bug Check 0x00000126) is a Windows Blue Screen of Death (BSOD) error indicating that an invalid memory-pool request was made to a memory pool managed by the Windows networking I/O subsystem, NETIO.

This error indicates that a kernel-mode component has encountered an invalid memory-pool state or an invalid Memory Descriptor List (MDL). A faulty or incompatible network-related driver is one area worth investigating, although the stop code alone does not identify the responsible driver.

Possible areas of investigation include network adapter drivers, third-party networking software, VPN clients, firewall or antivirus network filters, and other kernel-mode components that interact with Windows networking. These are diagnostic possibilities, not confirmed causes.

To troubleshoot the error safely:

1. Record when the blue screen occurs and whether it started after a driver or software change.
2. Install appropriate Windows updates and check network adapter driver updates.
3. Temporarily remove or roll back recently installed network-related software or drivers.
4. Check Windows crash dump files using WinDbg to identify the failing component.
5. Use Driver Verifier only when necessary and with a recovery plan.

Do not assume that NETIO.sys itself is defective simply because it appears in a crash report. The underlying problem may originate in another driver that interacts with the networking subsystem.

What Is NETIO_INVALID_POOL_CALLER?

NETIO_INVALID_POOL_CALLER is a Windows kernel bug check with the value 0x00000126. Windows generates this stop error when an invalid pool request is made to the NETIO-managed memory pool.

NETIO is part of the Windows networking I/O infrastructure. It supports networking operations and interactions between components in the Windows networking stack.

Kernel-mode drivers use memory-management mechanisms to allocate, access and release memory required for their operations. If a component makes an invalid request involving a NETIO-managed pool, Windows may detect the invalid state and stop the system to prevent further kernel memory corruption.

The error is particularly relevant to developers and technicians investigating network-related kernel-mode drivers. For ordinary users, it appears as a blue screen that causes Windows to stop unexpectedly and may result in an automatic restart.

Understanding the 0x00000126 Bug Check Parameters

Microsoft documents two subtypes for this bug check. The first parameter identifies the subtype, while the remaining parameters contain memory addresses relevant to the detected condition.

Parameter	Description
Parameter 1 = 0x1	Indicates an invalid pool state. Parameter 2 identifies a memory block or MDL, Parameter 3 identifies a page, and Parameter 4 identifies the CPU pool.
Parameter 1 = 0x2	Indicates an invalid MDL state. Parameter 2 identifies the MDL, Parameter 3 identifies the CPU pool, and Parameter 4 identifies the pool header.
Parameters 2, 3 and 4	Contain pointers whose meanings depend on the subtype identified by Parameter 1.

Important: These parameter values are primarily intended for kernel debugging. They are memory addresses, not user-configurable settings or error codes that can be fixed by changing a Windows option.

What Is an MDL?

A Memory Descriptor List (MDL) is a Windows kernel data structure used to describe the physical memory pages associated with a virtual memory buffer. Drivers use MDLs in operations involving memory buffers and I/O processing.

An invalid MDL state can indicate that a kernel-mode component has mishandled a memory descriptor or its associated memory-management operations. Diagnosing this condition generally requires examining the crash dump and relevant driver activity.

Symptoms of NETIO_INVALID_POOL_CALLER

A computer experiencing this bug check may exhibit one or more of the following symptoms:

• A blue screen appears with the stop code NETIO_INVALID_POOL_CALLER.
• Windows displays the stop code 0x00000126.
• The computer restarts unexpectedly after a system crash.
• The error occurs during internet browsing, file transfers or other network activity.
• The system crashes when connecting to a VPN or using network security software.
• Blue screens begin after installing or updating a network-related driver.
• The problem occurs intermittently, making it difficult to identify a consistent trigger.
• Windows creates a memory dump file following the crash, if crash dump collection is configured and succeeds.

These symptoms can help establish a troubleshooting direction, but none of them independently confirms which driver or component is responsible.

Possible Causes of NETIO_INVALID_POOL_CALLER

The official bug check description identifies an invalid request to a NETIO-managed memory pool. It does not provide a definitive list of third-party software or hardware causes. The following are possible areas to investigate based on the networking and kernel-memory context of the error.

1. Faulty or Incompatible Network Adapter Drivers

Network adapter drivers operate in kernel mode and interact with Windows networking components. A defective, outdated or incompatible driver may cause incorrect memory handling or unexpected interactions with other networking components.

Investigate this possibility if the crashes started after installing a network driver update, replacing a network adapter or changing the network configuration.

2. Third-Party VPN Software

VPN applications may install virtual network adapters, filter drivers or other networking components. These components interact with the Windows networking stack to route and process network traffic.

An incompatible VPN driver or a conflict with another network filter is a possible area of investigation, particularly if the crash occurs when establishing or disconnecting a VPN connection.

3. Firewall and Antivirus Network Filters

Some third-party security products install kernel-mode network filtering components to inspect or control network traffic.

Compatibility problems, defective updates or interactions between multiple filtering components may contribute to networking-related system instability.

Security software should not be permanently disabled as a troubleshooting shortcut. If testing is necessary, use the vendor's supported procedure and maintain appropriate protection.

4. Network Filtering and Traffic Management Software

Applications that monitor, redirect, inspect or prioritize network traffic may install additional drivers or filtering components.

Examples include:

• Third-party firewall products.
• VPN and tunnelling applications.
• Network monitoring utilities.
• Traffic shaping and bandwidth management software.
• Virtual networking and packet inspection tools.

These applications are not inherently defective. Their drivers and interactions should be investigated if the crash history suggests a connection.

5. Driver Compatibility Problems After Windows Updates

A Windows update can change operating system components or networking behaviour. A previously installed third-party driver may become incompatible with the updated environment.

If the error first appeared after a Windows update, examine driver compatibility and update history before attempting more disruptive recovery procedures.

6. Kernel Memory Corruption

The bug check directly identifies an invalid memory-pool condition. However, the component that originally corrupted the memory may not be the component that eventually detected the problem.

For example, one driver may damage a memory structure, while NETIO or another component encounters the invalid state later.

This is why a crash dump and driver-level investigation are more reliable than assuming that the module named in the stop code is necessarily responsible.

How to Troubleshoot NETIO_INVALID_POOL_CALLER (0x126)

Follow the procedures below in order. Begin with low-risk checks and proceed to advanced kernel debugging only when necessary.

Step 1: Record the Blue Screen Information

Before changing drivers or uninstalling software, record the information displayed on the blue screen.

• Stop code: NETIO_INVALID_POOL_CALLER.
• Bug check value: 0x00000126.
• Any displayed parameter values.
• The time and circumstances of the crash.
• Whether the error occurs during a specific network operation.

Also determine whether the problem started after installing a Windows update, network driver, VPN client, firewall or other networking application.

This information helps narrow down possible causes and prevents unnecessary changes to a working system.

Step 2: Check Windows Update

Install applicable Windows updates, including relevant quality and security updates. Updates may contain operating system reliability improvements and compatibility fixes.

On Windows 11:

1. Open Settings.
2. Select Windows Update.
3. Click Check for updates.
4. Review the available updates.
5. Install applicable updates and restart the computer if required.

On Windows 10, open Settings > Update & Security > Windows Update and check for available updates.

If the issue started immediately after a particular update, record its KB number and installation date. Do not remove security updates indiscriminately. Investigate whether a known compatibility issue exists before considering rollback.

Step 3: Update or Roll Back the Network Adapter Driver

Because this bug check involves the networking subsystem, the network adapter driver is an important component to investigate.

1. Right-click the Start button.
2. Select Device Manager.
3. Expand Network adapters.
4. Identify the physical network adapter being used.
5. Right-click the adapter and select Properties.
6. Open the Driver tab.
7. Review the driver provider, version and date.

If the problem began after a driver update, check whether the Roll Back Driver option is available. If an older driver resolves the problem, retain the working version while investigating compatibility.

If the driver is outdated or suspected to be defective, obtain a compatible driver from the computer manufacturer or network adapter manufacturer.

Important: Avoid downloading network drivers from unverified third-party driver websites. If the computer has no internet connection, download the correct driver on another device and transfer it using removable storage.

Step 4: Investigate Recently Installed VPN and Network Software

If the crashes began after installing a VPN, firewall, antivirus product or network monitoring utility, investigate that software.

1. Open Settings > Apps > Installed apps on Windows 11, or Settings > Apps > Apps & features on Windows 10.
2. Identify recently installed network-related applications.
3. Check whether the software has a newer compatible version.
4. Review the vendor's support documentation for known driver issues.
5. If appropriate, temporarily uninstall the suspected application using its official uninstallation procedure.
6. Restart Windows and observe whether the crashes continue.

Before removing VPN or security software, ensure that you have the necessary credentials and installation files to restore it. On business systems, obtain approval from the system administrator before changing security or network configurations.

If uninstalling a particular application stops the crashes, this is useful diagnostic evidence, but further investigation may still be necessary to establish the precise faulty component.

Step 5: Inspect the Crash Dump Files

Crash dump analysis is one of the most useful methods of investigating this bug check.

Windows may store crash information in the following locations:

• C:\Windows\Minidump\ - Contains small memory dump files when configured and successfully generated.
• C:\Windows\MEMORY.DMP - Common default location for a kernel or complete memory dump, depending on the configured dump type.

To check the dump configuration:

1. Press Win + R.
2. Enter sysdm.cpl and press Enter.
3. Open the Advanced tab.
4. Under Startup and Recovery, click Settings.
5. Review the Write debugging information setting.
6. Confirm that an appropriate dump type is configured.

For many troubleshooting situations, an automatic memory dump or kernel memory dump provides useful diagnostic information. Small memory dumps may be sufficient for an initial investigation, but they do not contain all kernel memory.

Make sure the system drive has sufficient free space and that the page-file configuration supports the selected dump type.

Step 6: Analyze the Dump Using WinDbg

WinDbg is Microsoft's debugging tool for analyzing Windows crash dumps and kernel-mode failures.

Install WinDbg using the official Windows Debugging documentation.

To examine a crash dump:

1. Open WinDbg.
2. Select the option to open a dump file.
3. Browse to the relevant file in C:\Windows\Minidump\ or the configured dump location.
4. Allow symbols to load.
5. In the debugger command window, execute:

!analyze -v

The command requests a detailed analysis of the bug check.

Review the following information in the output:

• BUGCHECK_CODE - Confirms the bug check value.
• BUGCHECK_P1 through BUGCHECK_P4 - Shows the four bug check parameters.
• MODULE_NAME - Identifies a module associated with the analysis.
• IMAGE_NAME - May identify the image associated with the suspected module.
• FAILURE_BUCKET_ID - Provides a classification useful for grouping similar failures.
• STACK_TEXT - Shows the recorded stack information.

Important: A module name or stack entry is not automatic proof of responsibility. Kernel memory corruption can occur before the actual crash, and the component that detects the corruption may differ from the component that caused it.

For the official bug check description and parameter interpretation, refer to Microsoft's Bug Check 0x126 documentation.

Step 7: Check Network Adapter and System Events

Windows Event Viewer can provide additional information about driver installation failures, device problems and system events around the time of a crash.

1. Press Win + R.
2. Enter eventvwr.msc and press Enter.
3. Open Windows Logs > System.
4. Review events around the crash timestamp.
5. Look for relevant warnings or errors involving network adapters, drivers or device initialization.

Do not assume that every warning or error recorded near the crash caused the bug check. Correlate event timestamps with the crash dump and other diagnostic evidence.

Step 8: Run System File Checker and DISM

If Windows system component corruption is suspected, use the built-in servicing and integrity-checking tools.

Open Windows Terminal or Command Prompt as an administrator.

First, run DISM:

DISM /Online /Cleanup-Image /RestoreHealth

This command checks and repairs the Windows component store using an available repair source, commonly Windows Update. If the system cannot access the required repair source, an appropriate matching Windows installation source may be necessary.

After DISM completes, run System File Checker:

sfc /scannow

SFC checks protected Windows system files and attempts to repair corrupted files using the component store.

Restart the computer if requested and check whether the problem continues.

Note: These tools can repair Windows component corruption, but they do not directly diagnose or repair defective third-party kernel drivers.

Step 9: Perform a Controlled Network Troubleshooting Test

If the error occurs only during network activity, perform controlled tests to identify whether a particular network component or operation is associated with the crashes.

• Test the system with the VPN disconnected, where permitted.
• Compare wired and wireless network operation if both are available.
• Check whether the error occurs with a different supported network adapter.
• Investigate whether a specific security or traffic-filtering application is installed.
• Review whether the crash occurs during connection establishment, disconnection or sustained data transfer.

Change only one relevant variable at a time and record the results. This makes it easier to identify which change affects system stability.

Do not bypass organizational firewall, VPN or endpoint security requirements to perform these tests.

Advanced Troubleshooting for IT Professionals

If the basic procedures do not identify the problem, a more detailed kernel-mode investigation may be required.

1. Examine the Four Bug Check Parameters

Use the values of Parameter 1 through Parameter 4 from the crash dump. First determine whether Parameter 1 is 0x1 or 0x2.

These values determine whether Windows detected an invalid pool state or an invalid MDL state. The remaining parameters are pointers that should be interpreted in the context of the specific subtype.

Do not attempt to use these addresses as ordinary file paths, registry locations or device configuration values.

2. Review the Kernel Stack

Inspect the stack trace produced by !analyze -v. Look for third-party drivers and networking components involved in the recorded call sequence.

Where necessary, use additional WinDbg commands such as:

lm
lmvm drivername
kv

The commands provide information about loaded modules, details about a specified driver module and the current stack trace, respectively.

Replace drivername with the actual module name being investigated. These commands are diagnostic tools; their output must be interpreted with the full dump context.

3. Consider Driver Verifier Carefully

Driver Verifier is a Windows diagnostic utility designed to detect certain illegal driver behaviours. It can be useful when investigating suspected defective kernel-mode drivers.

However, Driver Verifier can intentionally trigger a system crash when it detects a violation. It may also make Windows difficult to start if a verified driver repeatedly fails.

Warning: Do not enable Driver Verifier indiscriminately on a production computer or a system without a recovery plan.

Before using it:

• Back up important data.
• Ensure that Windows Recovery Environment or another recovery method is available.
• Know how to enter Safe Mode.
• Identify the specific third-party drivers that need investigation.
• Avoid verifying all drivers without a clear diagnostic reason.

Driver Verifier can be managed using the following administrative command:

verifier

This opens the Driver Verifier Manager. Select verification options appropriate to the suspected drivers and the diagnostic objective.

To disable Driver Verifier after testing, use:

verifier /reset

Restart Windows for the reset to take effect. If Windows cannot start normally, recovery may require Safe Mode or Windows Recovery Environment, depending on the situation.

For detailed instructions, consult Microsoft's Driver Verifier documentation.

4. Check for Conflicting Network Filter Drivers

Multiple networking products may install filter drivers that interact with the Windows networking stack. An incompatibility between these components is worth investigating when the crash dump or installation history suggests a networking conflict.

Review installed VPN clients, firewall software, packet inspection tools and network monitoring utilities. Use vendor documentation and driver information to identify their associated components.

Do not remove Microsoft networking components or unfamiliar drivers simply because their names appear in a diagnostic listing.

5. Compare Multiple Crash Dumps

If the computer has crashed multiple times, compare the dump files rather than relying on a single incident.

Look for recurring patterns such as:

• The same third-party driver appearing in multiple relevant stack traces.
• Similar bug check parameters.
• Consistent crash circumstances.
• Repeated failures after the same networking operation.
• Changes in the suspected module after a driver update.

Repeated, consistent evidence can strengthen a diagnosis. A single module appearing in one dump is not sufficient proof that it caused the memory corruption.

What Not to Do When Fixing Error 0x126

Several common troubleshooting approaches can create additional problems without identifying the actual cause.

• Do not replace NETIO.sys manually: It is a Windows system component. Downloading replacement copies from unofficial websites is unsafe and does not address the underlying cause.
• Do not delete system drivers: Removing network or Windows kernel drivers without identifying their function can make Windows or networking unusable.
• Do not disable security software permanently: Use controlled diagnostic procedures and restore appropriate protection.
• Do not modify registry settings without evidence: Unrelated registry changes can introduce new problems.
• Do not use random driver updater utilities: Obtain drivers from verified manufacturer sources.
• Do not immediately format or reinstall Windows: Investigate the crash dump and recent driver changes first.
• Do not run Driver Verifier without preparation: It can cause intentional system crashes during testing.

How to Verify Whether the Problem Is Resolved

After applying a corrective change, monitor the computer under the conditions that previously triggered the blue screen.

1. Restart Windows and confirm that the system starts normally.
2. Check the Device Manager for network adapter errors.
3. Reconnect to the network and test normal connectivity.
4. Test the VPN or other relevant networking application, if applicable.
5. Repeat the network activity associated with the original crash.
6. Monitor Windows for further unexpected restarts or blue screens.
7. Review any newly generated crash dumps if the error occurs again.

A single successful restart does not prove that the problem is permanently resolved. Continue monitoring the system during normal operation.

Frequently Asked Questions

1. What does NETIO_INVALID_POOL_CALLER mean?

NETIO_INVALID_POOL_CALLER is Windows bug check 0x00000126. It indicates that an invalid memory-pool request was made to a memory pool managed by the Windows networking I/O subsystem.

2. Is NETIO.sys responsible for the blue screen?

Not necessarily. NETIO.sys is associated with Windows networking infrastructure, but its appearance in a crash report does not establish that the file itself is defective. Another kernel-mode driver may have caused memory corruption that was detected later by the networking subsystem.

3. Can a faulty network driver cause error 0x126?

A defective or incompatible network driver is a reasonable area to investigate because network drivers interact with the networking subsystem. However, the bug check documentation does not identify a particular network adapter driver as the universal cause.

4. Can a VPN application cause NETIO_INVALID_POOL_CALLER?

A VPN application may install virtual network adapters or filtering drivers that interact with Windows networking. If the crashes occur when connecting to or disconnecting from a VPN, investigate its driver compatibility and available updates.

5. Is NETIO_INVALID_POOL_CALLER a hardware problem?

The bug check identifies an invalid memory-pool request, not a confirmed hardware failure. Driver problems and kernel-mode memory corruption should be investigated first when supported by the crash evidence. Hardware stability may also need examination if other symptoms or diagnostic results indicate a hardware issue.

6. How can I identify the driver causing error 0x126?

Examine the Windows crash dump using WinDbg and execute !analyze -v. Review the bug check parameters, stack trace, loaded modules and recurring patterns across multiple dumps. Additional driver debugging may be necessary to identify the component that originally corrupted memory.

7. Should I delete NETIO.sys to fix this error?

No. Do not delete or replace NETIO.sys manually. It is a Windows networking system component. Investigate the underlying driver or kernel-mode memory problem instead.

8. Will reinstalling Windows fix NETIO_INVALID_POOL_CALLER?

Reinstalling Windows may change the software and driver environment, but it is not a guaranteed solution. If the cause is an incompatible third-party driver, the problem may return when that driver or application is reinstalled. Crash dump analysis should be considered before performing a major operating system recovery.

9. What is the difference between Parameter 1 values 0x1 and 0x2?

Parameter 1 value 0x1 identifies an invalid pool state, whereas 0x2 identifies an invalid MDL state. The remaining bug check parameters have different meanings depending on which subtype was reported.

10. When should I contact technical support?

Contact the computer manufacturer, network adapter manufacturer or the vendor of the suspected networking software if the problem continues after driver investigation and software updates. For repeated kernel crashes, provide the relevant dump files and WinDbg analysis to a qualified Windows debugging professional.

Key Takeaways

• 0x00000126 identifies the NETIO_INVALID_POOL_CALLER Windows bug check.
• The error indicates an invalid request to a NETIO-managed memory pool.
• Parameter 1 identifies whether Windows detected an invalid pool state or an invalid MDL state.
• Network adapter drivers, VPN software and third-party network filters are useful areas to investigate, but none is automatically the cause.
• WinDbg and the !analyze -v command provide important crash-dump diagnostic information.
• Driver Verifier should be used cautiously with an appropriate recovery plan.
• Do not replace or delete Windows networking system files as a troubleshooting shortcut.

Official References

1. Microsoft Learn - Bug Check 0x126: NETIO_INVALID_POOL_CALLER - Official description, parameters and resolution guidance.
2. Microsoft Learn - Windows Debugging - Documentation for WinDbg and Windows kernel debugging.
3. Microsoft Learn - Analyzing a Kernel-Mode Dump File with WinDbg - Guidance for investigating kernel-mode crash dumps.
4. Microsoft Learn - Driver Verifier - Official documentation for driver verification and testing.
5. Microsoft Support - Troubleshoot Blue Screen Errors - General Windows blue screen troubleshooting guidance.