What DRIVER_CORRUPTED_EXPOOL means
Bug check 0xC5 means the system tried to access invalid memory, or pageable memory, at an interrupt request level (IRQL) that was too high. Microsoft states the ultimate cause is almost certainly a driver that corrupted the system memory pool, usually by damaging a small allocation. Larger allocations that are damaged usually raise a different code, DRIVER_CORRUPTED_MMPOOL (0xD0).
Common causes
- A driver that writes outside the memory it was given, often one recently installed or updated
- Software that installed a driver incorrectly or only partly
- An outdated driver that does not match the installed Windows version
- Unstable RAM or memory settings that damage data the driver relies on
How to fix DRIVER_CORRUPTED_EXPOOL
Work through these in order and test after each one. Stopping as soon as the crashes stop tells you which change mattered.
- Undo the most recent change. If the blue screens began after a Windows update, a new driver or new software, remove that change first. Uninstall the update from Settings, Windows Update, Update history, or roll a driver back in Device Manager (right-click the device, Properties, Driver, Roll Back Driver). Microsoft also suggests checking that any new software was installed correctly.
- Note the file name on the blue screen. If the screen shows a line such as "What failed" followed by a .sys file, write it down. Searching that file name shows which driver it belongs to, which tells you what to update or remove. The named file is the code that crashed, which is not always the root cause.
- Install updated drivers from the maker. Check the PC, motherboard or device maker’s support page for newer versions, particularly for network, storage, graphics and security software. Avoid third-party driver-updater tools.
- Return the PC to stock settings. Reset the BIOS to defaults, then leave XMP or EXPO, CPU or GPU overclocks and undervolts (including per-core offsets such as Curve Optimizer) switched off while you test. If the crashes stop, re-enable one setting at a time to find the unstable one.
- Test the memory. Run Windows Memory Diagnostic (search for it in Start) for a quick check, then MemTest86 for several passes if the crashes continue. Any error points to a faulty stick or slot, or to memory settings the hardware cannot run reliably.
Reading the crash evidence for 0xC5
Microsoft’s reference gives the four parameters of 0xC5 as the memory that was referenced, the IRQL at the time, whether the access was a read or a write, and the address of the code that made the reference. The last one is the most useful: it points to the driver that was running when the damage was found.
Pool corruption is often found long after it happens, so the driver named is not always the one that caused it. A debugger’s !analyze -v output and the same driver appearing across several dumps are stronger evidence than any single crash.
| Parameter | What Microsoft says it holds | Why it helps |
|---|---|---|
| First | The memory that was referenced | Shows what was touched |
| Second | The IRQL at the time of the reference | A high value explains why pageable memory could not be used |
| Third | 0 for a read, 1 for a write | Separates reading bad data from writing it |
| Fourth | The address of the code that referenced the memory | Points to the driver that was running |
Source: Microsoft Learn: Bug Check 0xC5 DRIVER_CORRUPTED_EXPOOL ↗
If the same driver keeps appearing, remove that software and test without it. If you want to find an unnamed culprit, a technician can use Driver Verifier’s special pool option, which can make the PC crash more often while it hunts, so only do it with a backup and the knowledge to switch it off with `verifier /reset`.
Not sure this is your code?
The stop code appears as text on the blue screen. If the PC restarted before you could read it, open Event Viewer, then Windows Logs, then System, and look for a BugCheck event with ID 1001. You can also search all stop codes.