What is the difference between IRQL_NOT_LESS_OR_EQUAL (0x0000000A) and DRIVER_IRQL_NOT_LESS_OR_EQUAL (0x000000D1)?

Both stop codes indicate that kernel-mode code attempted to access an invalid or pageable memory address at an elevated IRQL, which Windows cannot safely handle. The key difference is attribution: 0x0000000A (IRQL_NOT_LESS_OR_EQUAL) is a general kernel fault that may not have a specific driver identified, while 0x000000D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL) is specifically attributed to a third-party or system driver, and Windows will display the offending .sys filename on the crash screen under 'What failed'. Both are fixed with the same approach: identify the faulting module via minidump analysis and update, roll back, or remove that driver.

My BSOD says DRIVER_IRQL_NOT_LESS_OR_EQUAL with netio.sys or tcpip.sys — how do I fix it?

netio.sys and tcpip.sys are Windows networking components, but they typically crash because a third-party network filter driver (VPN, firewall, or anti-malware) corrupts a network buffer at the wrong IRQL. Steps: (1) Uninstall any VPN client completely using the vendor's cleanup tool. (2) Temporarily disable or uninstall third-party antivirus. (3) Run 'netsh winsock reset' and 'netsh int ip reset' in an elevated command prompt, then reboot. (4) Update your network adapter driver from the manufacturer's website (Realtek, Intel, Qualcomm). (5) If the crash persists, run SFC /scannow and DISM /RestoreHealth to repair core networking binaries.

I get IRQL_NOT_LESS_OR_EQUAL only when playing games like Fortnite or Valorant — is it a game bug?

Almost never a game bug. Gaming BSODs with this stop code are almost always caused by one of three things: (1) A GPU driver issue — update to the latest stable driver using DDU to cleanly remove the old one first. (2) Anti-cheat kernel driver conflict — Fortnite's Easy Anti-Cheat and Valorant's Vanguard install kernel-mode drivers; ensure all other drivers (especially GPU, chipset, NIC) are up to date and no conflicting kernel software is installed. (3) Overheating or overclocked hardware — stress test your GPU and CPU with HWMonitor running; thermal throttling combined with overclocking can cause memory access violations at the driver level. Also confirm your RAM is running at its rated JEDEC speed, not XMP, as a first diagnostic step.

How do I fix DRIVER_IRQL_NOT_LESS_OR_EQUAL caused by nvlddmkm.sys (NVIDIA GPU driver)?

nvlddmkm.sys is the NVIDIA display kernel driver. Fix steps: (1) Download Display Driver Uninstaller (DDU) from guru3d.com. (2) Boot into Safe Mode (hold Shift while clicking Restart → Troubleshoot → Advanced → Startup Settings → Safe Mode with Networking). (3) Run DDU and select 'Clean and restart' for NVIDIA. (4) After reboot, download and install the latest Game Ready or Studio driver directly from nvidia.com — avoid GeForce Experience auto-updates for troubleshooting. (5) If crashes continue with the latest driver, try an older known-stable driver version, as NVIDIA occasionally ships drivers with regressions. Also check that Hardware-Accelerated GPU Scheduling (HAGS) is disabled via Windows Graphics Settings if you are on an older GPU.

Can bad RAM cause IRQL_NOT_LESS_OR_EQUAL even if the dump blames a driver like ntoskrnl.exe?

Yes, absolutely. When a RAM cell returns incorrect data, the kernel reads garbage values for pointer addresses, leading to an invalid memory access at an elevated IRQL. The crash will often blame ntoskrnl.exe, ntkrnlmp.exe, or appear with all-zero parameters (00000000 00000000). This is because the kernel itself is the entity dereferencing the bad pointer, even though the root cause is memory hardware. Run Memtest86 for at least 2 full passes to rule out RAM. Also check if XMP/DOCP is enabled in BIOS and try disabling it to run RAM at its base JEDEC frequency. If Memtest86 finds errors, test each stick individually to identify the failing module.

IRQL_NOT_LESS_OR_EQUAL / DRIVER_IRQL_NOT_LESS_OR_EQUAL BSOD: Complete Fix Guide (Stop Code 0x0000000A & 0x000000D1)

Fix IRQL_NOT_LESS_OR_EQUAL and DRIVER_IRQL_NOT_LESS_OR_EQUAL BSODs on Windows 10/11. Diagnose faulty drivers, bad RAM, and corrupted files with step-by-step com

Last updated: March 1, 2026

Last verified: March 1, 2026

2,447 words

Key Takeaways

IRQL_NOT_LESS_OR_EQUAL (0x0000000A) occurs when kernel-mode code accesses an invalid memory address at too high an Interrupt Request Level (IRQL), most commonly caused by a buggy or incompatible device driver.
DRIVER_IRQL_NOT_LESS_OR_EQUAL (0x000000D1) is the driver-specific variant; the crash dump's 'What failed' field (e.g., nvlddmkm.sys, netio.sys, tcpip.sys) pinpoints which driver is at fault.
Common root causes include outdated or corrupt drivers (GPU, NIC, USB, storage), defective or incompatible RAM, overclocking instability, and third-party antivirus or VPN kernel filters.
Quick-fix checklist: update or roll back the offending driver, run Windows Memory Diagnostic and Memtest86, execute 'sfc /scannow' and 'DISM /RestoreHealth', then check Event Viewer and WinDbg minidumps for the exact faulting module.
If the BSOD appears only in specific apps (Fortnite, Valorant, VirtualBox), the issue is almost always a driver conflict with anti-cheat software, hypervisor extensions, or GPU driver bugs.

Fix Approaches Compared
Method	When to Use	Time	Risk
Update / Roll Back Driver	Offending .sys file named in dump (e.g., nvlddmkm.sys)	5–15 min	Low
Windows Memory Diagnostic + Memtest86	Random BSODs with no consistent driver, RAM-related parameters in dump	30 min – 8 hrs	None
SFC /scannow + DISM RestoreHealth	ntoskrnl.exe or ntkrnlmp.exe listed as faulting module	10–20 min	None
Uninstall Conflicting Software (VPN, AV, Anti-Cheat)	afd.sys, fwpkclnt.sys, covpnv64.sys, or third-party filter drivers named	5–10 min	Low
Check & Reseat RAM / Disable XMP	BSOD after RAM upgrade, overclocking, or memory_management co-error	15–30 min	Low
Clean OS Reinstall	All else fails; repeated BSODs across multiple drivers	1–3 hrs	High (data loss)
WinDbg Minidump Analysis	Need exact faulting instruction pointer and call stack	15–30 min	None
Disable Hyper-V / VT-x for VirtualBox	BSOD only when running VMs (virtualbox irql_not_less_or_equal)	2–5 min	Low

Understanding IRQL_NOT_LESS_OR_EQUAL and DRIVER_IRQL_NOT_LESS_OR_EQUAL

Windows assigns every CPU thread an Interrupt Request Level (IRQL). Higher IRQLs preempt lower ones, and kernel-mode code must only touch pageable memory while running at IRQL PASSIVE_LEVEL (0) or APC_LEVEL (1). When a driver attempts to access pageable or invalid memory at DISPATCH_LEVEL (2) or above, the kernel cannot safely handle a page fault and issues a bugcheck:

Stop Code 0x0000000A — IRQL_NOT_LESS_OR_EQUAL: The faulting address and IRQL are recorded in the four bugcheck parameters. Parameter 1 is the referenced virtual address; Parameter 2 is the IRQL at time of fault; Parameter 3 indicates read (0) or write (1); Parameter 4 is the instruction that caused the fault.
Stop Code 0x000000D1 — DRIVER_IRQL_NOT_LESS_OR_EQUAL: A driver-attributed variant with identical parameters but explicitly blames a kernel driver. The crash screen shows a 'What failed' filename such as nvlddmkm.sys, netio.sys, or tcpip.sys.

Step 1: Read the Crash Screen and Minidump

When the BSOD appears, note:

The exact stop code (0x0000000A or 0x000000D1).
The 'What failed' filename shown beneath the QR code.
The four parameter values in hexadecimal.

Minidumps are saved to C:\Windows\Minidump\. Open them with WinDbg (Windows Debugger) from the Windows SDK:

!analyze -v

This command outputs the faulting module, symbol stack, and the exact memory address that was illegally referenced.

Step 2: Identify the Offending Driver by .sys Filename

The faulting .sys file tells you exactly where to focus:

.sys File	Component	Fix
nvlddmkm.sys	NVIDIA GPU driver	Update/DDU reinstall GPU driver
amdkmdag.sys / amdppm.sys	AMD GPU / power driver	Update AMD driver or disable Cool'n'Quiet
igdkmd64.sys	Intel integrated graphics	Update Intel graphics driver
netio.sys / tcpip.sys / ndis.sys	Windows TCP/IP stack	Run netsh winsock reset; check VPN/firewall drivers
nvlddmkm.sys + dxgkrnl.sys / dxgmms2.sys	DirectX GPU scheduler	Update GPU driver; disable Hardware-Accelerated GPU Scheduling
usbxhci.sys / usbport.sys	USB xHCI controller	Update chipset/USB drivers; try different USB port
stornvme.sys / storport.sys / iastora.sys / nvme.sys	NVMe/AHCI storage	Update storage controller firmware and driver
ntoskrnl.exe / ntkrnlmp.exe	Windows kernel	Run SFC + DISM; check RAM
afd.sys / fwpkclnt.sys / covpnv64.sys / netwtw04.sys / netwtw10.sys	Network filter / VPN / Wi-Fi	Uninstall VPN, update NIC driver
rtwlanu.sys / rt640x64.sys / rtux64w10.sys / rtf64x64.sys	Realtek NIC/Wi-Fi	Update Realtek driver from manufacturer site
kbdclass.sys	Keyboard class driver	Check for conflicting HID software
wdf01000.sys	Windows Driver Framework	Update Windows; check hardware device drivers
ndu.sys	Windows Network Data Usage	Disable ndu.sys via registry (HKLM\SYSTEM\CurrentControlSet\Services\Ndu, set Start=4)
intelppm.sys	Intel CPU power management	Disable intelppm via Device Manager or registry

Step 3: Update or Roll Back the Identified Driver

To update: Visit the device manufacturer's website (NVIDIA, AMD, Intel, Realtek, etc.) and download the latest driver. Always use Display Driver Uninstaller (DDU) in Safe Mode before reinstalling GPU drivers.

To roll back: Open Device Manager (devmgmt.msc) → find the device → Properties → Driver tab → Roll Back Driver.

To uninstall and let Windows reinstall: Right-click the device → Uninstall device → check 'Delete the driver software for this device' → reboot.

Step 4: Run System File Checker and DISM

Corrupted system files can cause ntoskrnl.exe-attributed IRQL crashes:

:: Run as Administrator
sfc /scannow
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

Reboot after completion and monitor for recurrence.

Step 5: Test RAM

Defective RAM is a leading cause of IRQL_NOT_LESS_OR_EQUAL, especially when no specific driver is listed.

Windows Memory Diagnostic: Press Win+R → type mdsched.exe → choose 'Restart now and check for problems'.
Memtest86: Download from memtest86.com, burn to USB, boot outside Windows, and run at least 2 full passes. Any errors indicate faulty RAM.
XMP/DOCP: If you have RAM running above its rated JEDEC speed (XMP profile), enter BIOS and disable XMP/DOCP or reduce memory frequency to see if crashes stop.
Reseat or remove sticks: Try each RAM stick individually in Slot A2 (check your motherboard manual).

Step 6: Check for Software Conflicts

Antivirus / EDR: Temporarily disable third-party AV or switch to Windows Defender to test. Some EDR products install kernel filter drivers that cause IRQL faults.
VPN clients: Products like CyberGhost (covpnv64.sys), Cisco AnyConnect, and others install TAP/TUN kernel drivers. Uninstall completely using the vendor's cleanup tool.
Anti-cheat engines: Fortnite (Easy Anti-Cheat), Valorant (Vanguard), and similar tools run kernel-level drivers. Ensure your GPU and chipset drivers are fully updated before playing.
VirtualBox / Hyper-V: IRQL BSODs in VirtualBox are often caused by Hyper-V conflicting with VirtualBox's hypervisor. Disable Hyper-V via bcdedit /set hypervisorlaunchtype off or enable VirtualBox's Hyper-V back-end.

Step 7: Check Event Viewer and System Logs

Open Event Viewer (eventvwr.msc) → Windows Logs → System. Filter for Critical and Error events around the crash timestamp. Look for preceding disk errors (Disk, Ntfs sources) or driver load failures that triggered the cascade.

Step 8: Advanced — Analyze Minidump with WinDbg

Install WinDbg from the Microsoft Store or Windows SDK, then:

File → Open Crash Dump → select a .dmp file from C:\Windows\Minidump\.
Set symbol path: .sympath srv*C:\Symbols*https://msdl.microsoft.com/download/symbols
Run !analyze -v to get detailed output including the faulting driver, address, and call stack.

The output will contain lines such as:

BugCheck D1, {fffff80012345678, 2, 0, fffff80012345678}
Probably caused by : nvlddmkm.sys

This definitively identifies the culprit.

Step 9: Last Resort — Clean Windows Reinstall

If BSODs persist across multiple different drivers after all the above steps, the Windows installation itself may be corrupted or hardware may be failing. Back up your data and perform a clean reinstall via the Windows 11/10 Media Creation Tool. If BSODs persist after a clean install, the problem is hardware (usually RAM, SSD, or motherboard).

Frequently Asked Questions

powershell

# ============================================================
# IRQL_NOT_LESS_OR_EQUAL / DRIVER_IRQL_NOT_LESS_OR_EQUAL
# Diagnostic & Fix Script — Run as Administrator
# ============================================================

# --- 1. List recent minidump files ---
Write-Host "`n=== Recent Minidump Files ==="
$dumpPath = "C:\Windows\Minidump"
if (Test-Path $dumpPath) {
    Get-ChildItem $dumpPath -Filter "*.dmp" | Sort-Object LastWriteTime -Descending | Select-Object -First 10 | Format-Table Name, LastWriteTime, @{N="Size(KB)";E={[math]::Round($_.Length/1KB,1)}}
} else {
    Write-Host "No minidump directory found. Enable Small Memory Dump in System Properties."
}

# --- 2. Read most recent bugcheck from Event Log ---
Write-Host "`n=== Last 5 BugCheck Events ==="
Get-WinEvent -LogName System -FilterXPath "*[System[EventID=1001]]" -MaxEvents 5 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Format-List

# --- 3. Run System File Checker ---
Write-Host "`n=== Running SFC (this may take 10-15 minutes) ==="
sfc /scannow

# --- 4. Run DISM to repair Windows image ---
Write-Host "`n=== Running DISM RestoreHealth ==="
DISM /Online /Cleanup-Image /RestoreHealth

# --- 5. Reset TCP/IP stack (fixes netio.sys / tcpip.sys crashes) ---
Write-Host "`n=== Resetting Winsock and TCP/IP ==="
netsh winsock reset
netsh int ip reset
Write-Host "TCP/IP stack reset. Reboot required."

# --- 6. Check driver verifier status ---
Write-Host "`n=== Driver Verifier Status ==="
verifier /query

# --- 7. List third-party kernel drivers (potential culprits) ---
Write-Host "`n=== Third-Party Kernel Drivers Loaded ==="
Get-WmiObject Win32_SystemDriver | Where-Object {
    $_.State -eq 'Running' -and
    $_.PathName -notmatch 'system32\\drivers' -and
    $_.PathName -ne ''
} | Select-Object Name, PathName, StartMode | Format-Table -AutoSize

# --- 8. List all running drivers with their image paths ---
Write-Host "`n=== All Running Kernel Drivers ==="
Get-WmiObject Win32_SystemDriver | Where-Object { $_.State -eq 'Running' } |
    Sort-Object Name | Select-Object Name, PathName | Format-Table -AutoSize

# --- 9. Check for pending Windows Updates ---
Write-Host "`n=== Checking Windows Update (via PowerShell module) ==="
if (Get-Module -ListAvailable -Name PSWindowsUpdate -ErrorAction SilentlyContinue) {
    Get-WindowsUpdate
} else {
    Write-Host "PSWindowsUpdate module not installed. Check Windows Update manually."
    Start-Process ms-settings:windowsupdate
}

# --- 10. Check RAM with Windows Memory Diagnostic (schedules on next reboot) ---
Write-Host "`n=== Scheduling Windows Memory Diagnostic ==="
$scheduleRAMTest = Read-Host "Schedule RAM test on next reboot? (y/n)"
if ($scheduleRAMTest -eq 'y') {
    mdsched.exe
} else {
    Write-Host "Skipped. Run 'mdsched.exe' manually or use Memtest86 for thorough testing."
}

# --- 11. Disable ndu.sys (common IRQL crash with all-zero parameters) ---
Write-Host "`n=== Optionally Disable ndu.sys (Network Data Usage monitor) ==="
$disableNdu = Read-Host "Disable ndu.sys? (y/n)"
if ($disableNdu -eq 'y') {
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Ndu" -Name "Start" -Value 4
    Write-Host "ndu.sys disabled. Reboot required."
}

# --- 12. Enable Driver Verifier for targeted driver testing (ADVANCED — creates deliberate BSODs) ---
Write-Host "`n=== Enable Driver Verifier? (ADVANCED — may cause BSODs to identify bad driver) ==="
$enableVerifier = Read-Host "Enable verifier for all non-Microsoft drivers? (y/n)"
if ($enableVerifier -eq 'y') {
    verifier /standard /all
    Write-Host "Driver Verifier enabled. Reboot. Crashes will now name the exact faulting driver."
    Write-Host "To disable later: verifier /reset"
}

Write-Host "`n=== Script Complete. Please reboot to apply changes. ==="

Error Medic Editorial

The Error Medic Editorial team consists of senior DevOps and SRE engineers with combined decades of experience diagnosing Windows kernel crashes, Linux kernel panics, and cloud infrastructure failures. We specialize in translating cryptic system error codes into actionable, command-line-driven remediation guides for developers, system administrators, and power users. Our content is reviewed against official Microsoft documentation, WinDbg analysis, and real-world crash dump data.

Sources

Explore More windows Guides

Acer Aspire Blue Screen of Death Fix: How to Stop BSOD Crashes on Acer Laptops

Fix Acer Aspire Blue Screen of Death errors fast. Step-by-step guide covering driver updates, RAM checks, overheating, and Windows repair commands.

Acer Aspire Blue Screen of Death Fix: Step-by-Step Troubleshooting Guide (BSOD Errors Solved)

Fix Acer Aspire blue screen of death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK and more. Step-by-step commands included.

Acer Aspire Blue Screen of Death Fix: Stop Codes, Causes & Complete Solutions

Fix Acer Aspire Blue Screen of Death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK_FAILURE & more with exact commands.