If you BSOD with:
STOP: 0x00000076 (P1,P2,P3,P4) PROCESS_HAS_LOCKED_PAGES
an unknown driver is not completely cleaning up after an I/O operation.
P1 - 0
P2 - is the process address.
P3 - is the number of locked pages.
P4 - is a pointer to the driver stacks or a 0 if stacks are disabled.
You can enable stack traces to help identify the problem by using Regedt32 to navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
On the Edit menu, Add Value name TrackLockedPages, as a REG_DWORD data type, and set the data value to 1. Restart your computer.
The next time the unkown driver commits the error, you receive:
STOP: 0x000000CB (P1,P2,P3,P4) DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS
P1 - is the calling address in the driver that locked the pages.
P2 - is the caller of the calling address in the driver that locked the pages.
P3 - is a pointer to the MDL containing the locked pages.
P4 - is the problem driver's name (Unicode string).
After you replace the faulty driver, delete the TrackLockedPages value name from the registry, do NOT just set it to 0.
