- Status
- Offline
- Joined
- Mar 3, 2026
- Messages
- 247
- Reaction score
- 7
Anyone else hitting a wall with memory dumps on Win11 25H2?
Lately, I have been trying to debug a kernel-mode driver project and ran into a massive headache with the newer builds (26100.x). The exact same dev environment worked flawlessly on 23H2, but ever since I pushed to 25H2, my crash dumps are basically useless.
The Situation:
I suspect Microsoft tightened up the handle protection or changed how the system manages the bugcheck callback in this build, possibly to break manual dump parsing or further restrict kernel debugging access.
Has anyone managed to get a reliable stack trace on these newer builds, or are we looking at a permanent change in how the OS handles kernel-mode reporting? If anyone has a workaround or a specific flag to force the debugger data block to persist, please drop it below. I am stuck until I can actually read what is causing the panic.
Lately, I have been trying to debug a kernel-mode driver project and ran into a massive headache with the newer builds (26100.x). The exact same dev environment worked flawlessly on 23H2, but ever since I pushed to 25H2, my crash dumps are basically useless.
The Situation:
- Settings: CrashDumpEnabled is set to 1, AlwaysKeepMemoryDump is active, and I have a 128GB pagefile ready to go.
- Behavior: MEMORY.DMP generates, but WinDbg is throwing a fit. It reports "Dump failed with error code (0x0)" and shows 0% completion.
- Empty Folders: No minidumps are hitting C:\Windows\Minidump\ either. I can see the bugcheck code on the BSOD screen, but without symbols or a stack trace, I am flying blind.
- Debugger Error: KdDebuggerDataBlock is consistently unreadable or missing.
I suspect Microsoft tightened up the handle protection or changed how the system manages the bugcheck callback in this build, possibly to break manual dump parsing or further restrict kernel debugging access.
Has anyone managed to get a reliable stack trace on these newer builds, or are we looking at a permanent change in how the OS handles kernel-mode reporting? If anyone has a workaround or a specific flag to force the debugger data block to persist, please drop it below. I am stuck until I can actually read what is causing the panic.
