PFN_LIST_CORRUPT Blue Screen 0x4E: What 8 Parameter 1 Values Mean

PFN_LIST_CORRUPT is Windows stop code 0x0000004E (0x4E). Microsoft's reference says it indicates "that the page frame number (PFN) list is corrupted." The PFN list is the bookkeeping Windows keeps about every page of physical memory, so a corrupt list means the record of which memory is used or free is inconsistent.

Microsoft's Cause section is short and specific: this error is typically caused by a driver passing a bad memory descriptor list, for example one that unlocks the same pages twice.

This page is built from the Microsoft Learn article "Bug Check 0x4E: PFN_LIST_CORRUPT" and, where noted, Microsoft's general page on analysing blue screen data, both read on 13 October 2026 and checked against the Microsoft Docs source files. Microsoft marks the 0x4E page as written for programmers and directs customers to https://www.windows.com/stopcode. Anything taken from the general page rather than the 0x4E page is labelled as such.

What does parameter 1 tell you?

Parameter 1 indicates the type of violation, and the meaning of the other parameters depends on it. As printed in Microsoft's table:

Parameter 1	Cause of error, as Microsoft words it
0x01	The list head was corrupted (parameter 2 is the corrupted ListHead value, parameter 3 the number of pages available)
0x02	A list entry was corrupted (parameter 2 is the entry being removed, parameter 4 its reference count)
0x06	The hardware PTE and/or the prototype PTE data structures have been corrupted; this can be caused by hardware single bit errors, broken DMA transfers, etc.
0x07	A driver has unlocked a certain page more times than it locked it
0x8D	The page-free list is corrupted; this error code most likely indicates a hardware issue
0x8F	The free or zeroed page listhead is corrupted
0x99	A page table entry (PTE) or PFN is corrupted
0x9A	A driver attempted to free a page that is still locked for IO

Eight values, and they fall into two groups: those where Microsoft names a driver doing something wrong (0x07 and 0x9A) and those where it points at corrupted structures or hardware (0x01, 0x02, 0x06, 0x8D, 0x8F, 0x99). Parameter 2 is usually the page frame number or the damaged entry.

Which values point to hardware?

Two of the eight lines mention hardware directly. For 0x06, Microsoft says the corruption "can be caused by hardware single bit errors, broken DMA transfers, etc." For 0x8D it says the page-free list is corrupted and the error code "most likely indicates a hardware issue."

The other values describe driver-side mistakes or damage without naming a cause. So if parameter 1 is 0x06 or 0x8D, the hardware route, a memory test and the manufacturer's diagnostics, is more likely worth trying first than a driver search. The Microsoft page itself does not list customer steps, so this is a reading of its table, not its advice.

How does it relate to 0x19 and 0xC2?

All three stop codes involve memory bookkeeping, and Microsoft's pages for each use a table keyed by parameter 1. Side by side:

Question	0x4E PFN_LIST_CORRUPT	0x19 BAD_POOL_HEADER	0xC2 BAD_POOL_CALLER
What is damaged or misused	The list of physical pages	A pool block header	A pool request
Typical cause named	A driver passing a bad memory descriptor list	Corruption that may or may not be due to the caller	A bad IRQL or double freeing the same allocation
Hardware mentioned	Yes, for 0x06 and 0x8D	Memory diagnostics for inconsistent crashes	Memory diagnostics for pool corruption
Tools Microsoft names	!analyze and the k stack commands	Driver Verifier, Windows Memory Diagnostics	Driver Verifier, Windows Memory Diagnostics

The pool codes (0x19, 0xC2) are about memory that drivers allocate and free; the PFN code is about the pages underneath. A bug in how a driver locks and unlocks pages can show up as the second.

What does the page say about debugging?

If a kernel debugger is available, Microsoft says to examine the stack trace: the !analyze extension displays information about the bug check and can be helpful in determining the root cause, and one of the k (Display Stack Backtrace) commands shows the call stack. It names MmUnlockPages as an example: a driver that called it twice with the same list would cause this error.

What Microsoft tells non-programmers to do

The 0x4E page has no Remarks section with customer steps. What it does give is a diagnosis path for developers, and a general pointer:

• Read parameter 1 and match it to the table above.
• For 0x06 and 0x8D, treat hardware (single bit errors, DMA, free list damage) as a likely cause.
• For 0x07 and 0x9A, suspect a driver that mishandled page locking.
• Use !analyze and a stack trace if a debugger is available.

For general troubleshooting beyond that, the pages for neighbouring pool codes (0x19, 0xC2) are the closest guidance Microsoft gives: Driver Verifier and Windows Memory Diagnostics. This page notes that connection but does not claim Microsoft makes it for 0x4E.

Checklist before changing anything

• The four parameters from the System Log, especially parameter 1
• Whether parameter 1 is a hardware-leaning value (0x06 or 0x8D)
• Result of Windows Memory Diagnostics
• Drivers installed or updated just before the first crash
• Whether the crash repeats with the same parameter 1

How to work through a 0x4E blue screen

• Read parameter 1 from the System Log
• Match it to the table: hardware-leaning or driver-leaning
• Run a memory test and the manufacturer's diagnostics for hardware-leaning values
• Look at recently added drivers for driver-leaning values

Registry edits and paid tools. Microsoft's page does not mention them, so neither does this one.

What do the column names in the parameter table mean?

Microsoft's table uses memory-manager terms without defining them, because the page is written for programmers. The middle column below is the general meaning of each term, not a statement by Microsoft; the right column names the rows where Microsoft actually uses it.

Term	General meaning	Where it appears in the table
Page frame number (PFN)	The index of a physical page of RAM, as the memory manager counts them	Parameter 1 of 0x06, 0x07, 0x8D, 0x99 and 0x9A
ListHead	The head record of a linked list, the entry every walk of that list starts from	Parameter 2 of 0x01
Reference count	How many users of a structure are currently registered, so it is not released early	Parameter 4 of 0x02 and 0x9A
Share count	How many mappings currently share one physical page	Parameter 3 of 0x07
Prototype PTE	A page table entry held by the memory manager rather than by one process's page tables	Parameter 3 of 0x06
Page-free list	The list of physical pages the memory manager treats as available	Named in the cause for 0x8D

Reading the row this way is what turns the four hexadecimal numbers into a sentence. It does not identify the driver: Microsoft is explicit that the usual cause is a driver passing a bad memory descriptor list, and that the stack trace, not the parameters, is where the name comes from.

Every stop code covered here is listed in our Windows blue screen stop code index.

Sources and how to check

• Microsoft Learn, "Bug Check 0x4E: PFN_LIST_CORRUPT" — https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x4e--pfn-list-corrupt. Source file in the MicrosoftDocs/windows-driver-docs repository.
• Microsoft Learn, "Analyze bug check (stop code error) data" — https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/blue-screen-data (general guide).
• Bug check code reference, Microsoft Learn: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2
• Troubleshoot blue screen errors (for regular users): https://www.windows.com/stopcode
• Licence and credit: Microsoft Learn documentation is published under CC BY 4.0. This page selects, rewords and reorders it, adds a plain-language reading, and is not endorsed by Microsoft. The original is linked above.
• Checked as of 13 October 2026.