What is the difference between IRQL_NOT_LESS_OR_EQUAL (0x0000000A) and DRIVER_IRQL_NOT_LESS_OR_EQUAL (0x000000D1)?

Both stop codes indicate that a kernel component accessed pageable memory at an inappropriately high IRQL. The key difference is specificity: 0x0000000A (IRQL_NOT_LESS_OR_EQUAL) is a general bug check that may involve the Windows kernel itself, a hardware issue, or a driver where Windows could not positively attribute the fault to a single driver. 0x000000D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL) means Windows has specifically identified a driver as the component that performed the illegal memory access, and the BSOD screen will usually name the driver file (e.g., nvlddmkm.sys, netio.sys). Both require the same fundamental troubleshooting process: identify the offending driver via minidump analysis, then update, roll back, or remove it.

Why do I get IRQL_NOT_LESS_OR_EQUAL or DRIVER_IRQL_NOT_LESS_OR_EQUAL when playing games like Fortnite or Valorant?

Gaming BSODs with these stop codes are almost always caused by: (1) An overloaded or faulty GPU driver (nvlddmkm.sys for NVIDIA, amdkmdag.sys for AMD) — perform a clean driver reinstall using DDU; (2) RAM running on an XMP/DOCP overclock profile that becomes unstable under gaming load — disable XMP in BIOS and test at JEDEC speeds; (3) A network driver issue triggered by the anti-cheat software's kernel driver conflicting with ndis.sys or netio.sys; (4) Overheating GPU or CPU causing hardware exceptions. Check temperatures with HWiNFO64, update GPU drivers, and test RAM stability with MemTest86.

The BSOD shows ntoskrnl.exe or ntkrnlmp.exe as the failing module — what does that mean?

When `ntoskrnl.exe` (the Windows kernel) or its multi-processor variant `ntkrnlmp.exe` appears as the faulting module, it usually means Windows could not determine which specific driver caused the illegal memory access — the actual buggy driver has already corrupted memory before handing control to the kernel. It can also indicate: (1) Faulty physical RAM — run MemTest86 for at least 2 full passes; (2) Corrupted system files — run `sfc /scannow` and `DISM /Online /Cleanup-Image /RestoreHealth`; (3) Incompatible or unsigned third-party drivers — use Driver Verifier to expose them. Check your minidump's full stack trace, not just the top module name.

How do I fix DRIVER_IRQL_NOT_LESS_OR_EQUAL caused by network drivers like netio.sys, tcpip.sys, or ndis.sys?

Network stack BSODs (netio.sys, tcpip.sys, ndis.sys) are typically caused by: (1) An outdated NIC or Wi-Fi adapter driver — update from Device Manager or your adapter manufacturer (Intel, Realtek, Qualcomm); (2) A third-party VPN, firewall, or packet filter driver (covpnv64.sys, fwpkclnt.sys, ipeaklwf.sys, fbnetflt.sys) — uninstall the associated VPN or security software; (3) Corrupted Windows networking stack — run `netsh winsock reset` and `netsh int ip reset` from an elevated command prompt, then restart; (4) A malfunctioning NIC — test with the adapter disabled or replaced. If crashes only occur on Wi-Fi, update the wireless adapter driver or switch to a wired connection to confirm.

Can IRQL_NOT_LESS_OR_EQUAL be caused by bad RAM, and how do I tell?

Yes — defective RAM is one of the most common hardware causes of IRQL_NOT_LESS_OR_EQUAL, especially when no consistent driver is named in crashes. Signs that RAM is the cause: crashes happen randomly without a pattern, different driver names appear in each crash, the crash address (parameter 1) is in a low or seemingly random memory range, or crashes started after adding new RAM or enabling an XMP profile. To diagnose: first disable XMP/DOCP in BIOS and test at default speeds. Then run Windows Memory Diagnostic (mdsched.exe) or boot MemTest86 from USB. Test sticks individually if you have multiple modules. Any MemTest86 errors confirm the RAM must be replaced or run at lower/default speeds.

IRQL_NOT_LESS_OR_EQUAL & DRIVER_IRQL_NOT_LESS_OR_EQUAL BSOD: Complete Troubleshooting Guide

Fix IRQL_NOT_LESS_OR_EQUAL (0x0000000A) and DRIVER_IRQL_NOT_LESS_OR_EQUAL (0x000000D1) BSODs with step-by-step driver, RAM, and kernel diagnostics.

Last updated: March 1, 2026

Last verified: March 1, 2026

2,451 words

Key Takeaways

IRQL_NOT_LESS_OR_EQUAL (stop code 0x0000000A) occurs when a kernel-mode process or driver attempts to access pageable memory at an Interrupt Request Level (IRQL) that is too high — most commonly triggered by a faulty, outdated, or incompatible driver.
DRIVER_IRQL_NOT_LESS_OR_EQUAL (stop code 0x000000D1) is a closely related variant where a driver specifically is identified as the offender accessing an invalid memory address; common culprits include nvlddmkm.sys (NVIDIA), netio.sys, tcpip.sys, ndis.sys, dxgmms2.sys, and storage drivers like stornvme.sys or storport.sys.
Quick fix summary: Boot into Safe Mode, use WinDbg or WhoCrashed to identify the offending driver from the minidump, update or roll back that driver, run Windows Memory Diagnostic and SFC /scannow, and disable overclocking or XMP profiles to rule out RAM instability.

Fix Approaches Compared
Method	When to Use	Time	Risk
Update/Roll Back Offending Driver	Driver name shown in BSOD or minidump (e.g., nvlddmkm.sys, netio.sys)	5–15 min	Low
Windows Memory Diagnostic / MemTest86	BSOD occurs randomly with no clear driver, or with irql_not_less_or_equal + RAM keywords	30 min – 8 hrs	None
SFC /scannow + DISM RestoreHealth	System files corrupted (ntoskrnl.exe, ntkrnlmp.exe implicated)	15–45 min	None
Uninstall Antivirus / VPN Drivers	fwpkclnt.sys, covpnv64.sys, fbnetflt.sys, or similar filter drivers in trace	5–10 min	Low
Disable XMP/DOCP RAM Profile	Crashes during gaming or heavy load; RAM running above rated JEDEC speed	2–5 min (BIOS)	None
Clean Driver Reinstall via DDU	GPU driver (nvlddmkm.sys, amdkmdag.sys, igdkmd64.sys) repeatedly implicated	20–30 min	Low
Check for Windows Updates / Hotfixes	Error appeared after a Windows update or on freshly installed Windows	10–30 min	None
Hardware Reseating / Replacement	All software fixes exhausted; possible failing NIC, RAM stick, or NVMe SSD	30–60 min	Medium

Understanding IRQL_NOT_LESS_OR_EQUAL and DRIVER_IRQL_NOT_LESS_OR_EQUAL

Windows uses Interrupt Request Levels (IRQLs) to prioritize kernel-mode operations. Normal user-mode code runs at IRQL 0 (PASSIVE_LEVEL). Device drivers often elevate to IRQL 2 (DISPATCH_LEVEL) to perform time-sensitive work. The bug check 0x0000000A (IRQL_NOT_LESS_OR_EQUAL) fires when any kernel component tries to read or write pageable memory while the processor is at DISPATCH_LEVEL or higher — memory that may have been swapped to disk and is therefore unreachable at that IRQL.

Bug check 0x000000D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL) is a more specific variant where Windows has positively identified a driver as the source of the illegal memory access. The BSOD screen will typically show a filename such as:

nvlddmkm.sys — NVIDIA display driver
amdkmdag.sys — AMD/ATI display driver
igdkmd64.sys — Intel integrated graphics
netio.sys, tcpip.sys, ndis.sys — Windows networking stack
dxgkrnl.sys, dxgmms2.sys — DirectX graphics kernel
stornvme.sys, storport.sys, iastora.sys — Storage drivers
usbxhci.sys, usbport.sys — USB host controller drivers
ntoskrnl.exe / ntkrnlmp.exe — Windows kernel itself (often a symptom of bad RAM or corrupted system files)

The four parameters displayed on the blue screen (visible when the crash occurs or in the minidump) are: (1) Memory address referenced, (2) IRQL at time of reference, (3) Access type (0=read, 1=write, 8=execute), (4) Address of the instruction that caused the fault.

Step 1: Collect the Minidump and Identify the Culprit

Before changing anything, find the crash dump files. Windows writes them to C:\Windows\Minidump\ by default.

Enable minidump logging if not already set:

Right-click This PC → Properties → Advanced system settings → Startup and Recovery → Settings.
Under Write debugging information, select Small memory dump (256 KB).
Confirm the dump directory is %SystemRoot%\Minidump.

Analyze with WinDbg (Windows Debugger): Install WinDbg from the Microsoft Store or the Windows SDK, then open a minidump:

!analyze -v

The !analyze -v output will show the MODULE_NAME, IMAGE_NAME, and FAILURE_BUCKET_ID — these pinpoint the exact driver or module.

Free alternative — WhoCrashed / NirSoft BlueScreenView: Both tools parse minidump files without requiring debugger symbols and display the faulting driver filename, crash address, and stack trace in a readable table.

Step 2: Boot into Safe Mode (If System Won't Stay Stable)

If the system crashes before you can work on it, boot Safe Mode to disable non-essential drivers:

Windows 10/11: Hold Shift and click Restart → Troubleshoot → Advanced Options → Startup Settings → Restart → Press 4 for Safe Mode or 5 for Safe Mode with Networking.
Windows 8/8.1: Same path via PC Settings or hold Shift+F8 at boot.
Windows 7/XP: Press F8 at POST and select Safe Mode.

Step 3: Update, Roll Back, or Uninstall the Offending Driver

Once you know the culprit driver, take one of these actions:

To update a driver:

Open Device Manager (devmgmt.msc) → locate the device → right-click → Update driver → Search automatically, OR download the latest from the manufacturer's website.

To roll back a driver:

Device Manager → right-click device → Properties → Driver tab → Roll Back Driver (grayed out if no previous version is stored).

For GPU drivers specifically (nvlddmkm.sys, amdkmdag.sys, igdkmd64.sys): Use Display Driver Uninstaller (DDU) in Safe Mode for a completely clean removal before reinstalling:

Download DDU from Wagnardsoft.
Boot Safe Mode, run DDU, select your GPU type, click Clean and Restart.
After restart, install the latest stable driver from NVIDIA/AMD/Intel.

For network drivers (netio.sys, ndis.sys, tcpip.sys, netwtw04.sys, netwtw10.sys, rtwlanu.sys, rt640x64.sys):

Update the NIC/Wi-Fi adapter driver via Device Manager or the chipset/adapter manufacturer site.
If a VPN client driver (covpnv64.sys, fbnetflt.sys, ipeaklwf.sys) is implicated, uninstall the VPN software entirely and retest.

For storage drivers (stornvme.sys, storport.sys, nvme.sys, iastora.sys):

Update the chipset driver package from Intel, AMD, or your motherboard vendor.
Update NVMe firmware from the SSD manufacturer's utility.

Step 4: Repair Windows System Files

If ntoskrnl.exe or ntkrnlmp.exe appears in the crash or no driver is named, system file corruption is likely:

# Run from elevated PowerShell or CMD
sfc /scannow

# If SFC finds unrepairable corruption, use DISM first:
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

# Then re-run SFC
sfc /scannow

Step 5: Test RAM

Defective or overclocked RAM is a frequent hidden cause, especially when crashes occur during gaming (Fortnite, Valorant) or heavy workloads:

Disable XMP/DOCP in BIOS: Enter BIOS setup (usually Del or F2 at POST), find the XMP/DOCP profile, and set memory to JEDEC default speed (e.g., 2133 MHz for DDR4). Retest stability.
Windows Memory Diagnostic: Press Win+R → mdsched.exe → Restart now and check for problems. Choose Extended test for thorough coverage.
MemTest86 (recommended): Boot from a USB with MemTest86. Run for at least 2 full passes (ideally overnight). Any errors = replace RAM.
Swap sticks: If you have dual-channel RAM, test each stick individually in the primary slot to isolate a failing module.

Step 6: Check for Windows Updates and Driver Package Updates

Microsoft frequently releases hotfixes for IRQL-related crashes, especially after major feature updates. Go to Settings → Windows Update → Check for Updates and install all available updates including optional driver updates.

Step 7: Virtualization-Specific Fixes (VirtualBox / Hyper-V)

Users seeing irql_not_less_or_equal inside a VirtualBox or Hyper-V guest should:

Update VirtualBox Guest Additions to match the host version.
Ensure the host NIC driver is up to date.
Allocate at least 2 vCPUs to the VM.
Disable nested virtualization if not required.
On Windows 11 hosts, ensure Hyper-V and VirtualBox are not both active simultaneously without proper configuration.

Step 8: Advanced — Check IRQL with Driver Verifier

If the crash is intermittent and the culprit is unclear, enable Driver Verifier to force an immediate crash when any driver violates IRQL rules — making the faulting driver much easier to identify:

:: Enable Driver Verifier on all non-Microsoft drivers
verifier /standard /driver *.sys

:: Or target specific unsigned drivers
verifier /standard /driver drivername.sys

:: To reset Driver Verifier (important — do this after identifying the driver)
verifier /reset

Warning: Driver Verifier may cause the system to crash more frequently while active. Always have a way to boot into Safe Mode to reset it. Once the culprit is identified, disable Driver Verifier and update or remove that driver.

Step 9: Hardware Checks (Last Resort)

If all software fixes fail:

Re-seat RAM sticks, GPU, and NVMe/SATA drives — loose seating causes intermittent errors.
Check GPU and CPU temperatures — use HWiNFO64 or HWMonitor; thermal throttling or overheating can cause IRQL crashes.
Test with a different PSU — an unstable power supply causes memory and bus errors that manifest as IRQL BSODs.
Run chkdsk on the system drive: chkdsk C: /f /r /x — disk errors can corrupt driver data mid-access.

Frequently Asked Questions

powershell

# ============================================================
# IRQL_NOT_LESS_OR_EQUAL / DRIVER_IRQL_NOT_LESS_OR_EQUAL
# Diagnostic & Fix Script
# Run from an elevated PowerShell prompt
# ============================================================

# --- 1. List recent minidump files ---
Write-Host "=== Recent Minidump Files ==="
$dumpPath = "$env:SystemRoot\Minidump"
if (Test-Path $dumpPath) {
    Get-ChildItem $dumpPath -Filter "*.dmp" | Sort-Object LastWriteTime -Descending | Select-Object -First 10 | Format-Table Name, LastWriteTime, Length
} else {
    Write-Host "No minidump folder found. Enable small memory dumps in System Properties."
}

# --- 2. Check Windows Event Log for BugCheck events ---
Write-Host "`n=== BugCheck Events (Last 10) ==="
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001} -MaxEvents 10 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Format-List

# --- 3. Run System File Checker ---
Write-Host "`n=== Running SFC /scannow ==="
sfc /scannow

# --- 4. Run DISM to repair component store ---
Write-Host "`n=== Running DISM RestoreHealth ==="
DISM /Online /Cleanup-Image /RestoreHealth

# --- 5. Reset network stack (helps with netio.sys / tcpip.sys BSODs) ---
Write-Host "`n=== Resetting Network Stack ==="
netsh winsock reset
netsh int ip reset

# --- 6. Check for unsigned / potentially problematic drivers ---
Write-Host "`n=== Unsigned / Non-WHQL Drivers ==="
Get-WmiObject Win32_PnPSignedDriver |
    Where-Object { $_.IsSigned -eq $false -or $_.Signer -eq $null } |
    Select-Object DeviceName, DriverVersion, DriverDate, InfName |
    Format-Table -AutoSize

# --- 7. List all kernel drivers currently loaded ---
Write-Host "`n=== Currently Loaded Kernel Drivers ==="
Get-WmiObject Win32_SystemDriver | Where-Object { $_.State -eq 'Running' } |
    Sort-Object Name | Select-Object Name, PathName, State | Format-Table -AutoSize

# --- 8. Enable Driver Verifier on all third-party drivers (optional -- causes more crashes to identify culprit)
# WARNING: Only run this if crashes are intermittent and driver is unknown.
# RESET with: verifier /reset  (from Safe Mode if needed)
# Uncomment the lines below to enable:
# Write-Host "`n=== Enabling Driver Verifier ==="
# verifier /standard /driver *.sys

# --- 9. Check disk for errors ---
Write-Host "`n=== Scheduling CHKDSK on next boot ==="
# Uncomment to schedule:
# chkdsk C: /f /r /x
Write-Host "To schedule chkdsk, run: chkdsk C: /f /r /x"

# --- 10. Check current RAM XMP/speed (informational) ---
Write-Host "`n=== RAM Speed & Configuration ==="
Get-WmiObject -Class Win32_PhysicalMemory |
    Select-Object DeviceLocator, Capacity, Speed, Manufacturer, PartNumber |
    Format-Table -AutoSize

Write-Host "`n=== Done. Review output above, check minidumps with WinDbg or WhoCrashed for driver details. ==="

Error Medic Editorial

The Error Medic Editorial team is composed of senior DevOps engineers, SRE specialists, and Windows systems administrators with decades of combined experience diagnosing kernel-level crashes, driver conflicts, and hardware failures across enterprise and consumer environments. Our guides are built from real minidump analysis, Microsoft documentation, and community-verified fixes.

Sources

Explore More windows Guides

Acer Aspire Blue Screen of Death Fix: How to Stop BSOD Crashes on Acer Laptops

Fix Acer Aspire Blue Screen of Death errors fast. Step-by-step guide covering driver updates, RAM checks, overheating, and Windows repair commands.

Acer Aspire Blue Screen of Death Fix: Step-by-Step Troubleshooting Guide (BSOD Errors Solved)

Fix Acer Aspire blue screen of death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK and more. Step-by-step commands included.

Acer Aspire Blue Screen of Death Fix: Stop Codes, Causes & Complete Solutions

Fix Acer Aspire Blue Screen of Death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK_FAILURE & more with exact commands.