How to Fix Blue Screen “ntoskrnl.exe PAGE_FAULT_IN_NONPAGED_AREA”

The PAGE_FAULT_IN_NONPAGED_AREA bug check (Stop Code 0x00000050) attributed to ntoskrnl.exe occurs when the Windows kernel memory manager (MmAccessFault) attempts to access an invalid virtual memory address within the system’s nonpaged pool. Under Windows NT kernel architecture, the nonpaged pool contains critical system data structures and driver code that must reside in physical RAM at all times and can never be paged out to secondary storage (pagefile.sys).

When an instruction references an unmapped, freed, or corrupted address in this region—particularly while executing at an elevated Interrupt Request Level (IRQL $ge$ DISPATCH_LEVEL) where the OS cannot service a page fault—the processor’s Memory Management Unit (MMU) halts execution, and ntoskrnl.exe initiates an emergency kernel panic to prevent data corruption. Because ntoskrnl.exe is the core kernel binary that handles all hardware exceptions, it is almost always the reporter of the crash rather than the actual root cause.

Quick Diagnostic Matrix

1. Analyze the Minidump to Identify the True Culprit Driver

Because ntoskrnl.exe simply executes the bug check when a fault is caught, analyzing the kernel minidump (.dmp) is the most direct way to expose the third-party driver that actually passed the invalid pointer.

[Crash Occurs] ──► Windows writes minidump to C:WindowsMinidump*.dmp
                         │
                         ▼
             [Open File in WinDbg / WinDbg Preview]
                         │
                         ▼
                  [Run: !analyze -v]
                         │
       ┌─────────────────┴─────────────────┐
       ▼                                   ▼
 [IMAGE_NAME: ntoskrnl.exe]       [IMAGE_NAME: ThirdParty.sys]
 (Points to Memory/Hardware)       (Points to Driver/Software)
  └── Proceed to Sections 2 & 3     └── Proceed to Section 5

1. Download WinDbg from the Microsoft Store (or use BlueScreenView as a lightweight alternative).

2. Launch WinDbg as Administrator, press Ctrl + D, navigate to C:WindowsMinidump, and open the most recent .dmp file.

3. In the command prompt at the bottom of the window, click or type:

   Plaintext

   !analyze -v
   

4. Examine the output:

   • MODULE_NAME & IMAGE_NAME: If this lists a third-party driver (such as vgk.sys for Vanguard, eac_server.sys for EasyAntiCheat, nvlddmkm.sys for NVIDIA, or bedaisy.sys for BattlEye), that specific driver initiated the invalid memory dereference.

   • FAILURE_BUCKET_ID: Check if the bucket points to AV_R (Access Violation Read) or AV_W (Access Violation Write).

   • If IMAGE_NAME remains ntoskrnl.exe or hardware: The memory address was corrupted by a physical DRAM failure, memory timing drift, or disk-level paging degradation.

2. Test Physical RAM and Disable Memory Overclocking (XMP / EXPO)

Bit flips in physical DRAM chips or an unstable Integrated Memory Controller (IMC) inside the CPU will corrupt pointers loaded into the nonpaged pool, making physical memory testing essential.

[DRAM Voltage & Signal Verification]
 BIOS Settings (Del / F2) ──► Extreme Tweaker / OC Menu
   ├── XMP / DOCP / EXPO ──► [Set to DISABLED] (Run JEDEC Base Speeds)
   └── DRAM Voltage      ──► Ensure stable factory default (e.g., 1.20V / 1.35V)

Step A: Disable Memory Profiles in BIOS

1. Restart your PC and tap Del or F2 repeatedly on startup to enter the UEFI BIOS.

2. Locate the memory tuning menu (Ai Tweaker, OC, or Extreme Tweaker).

3. Set XMP (Intel), DOCP, or EXPO (AMD) to Disabled or Auto to force RAM to run at standard JEDEC baseline frequencies (e.g., 2133/2400/4800 MHz) with default voltages.

4. Press F10 to save and reboot. If the BSOD stops, your RAM timings, sub-timings, or SoC voltages were unstable.

Step B: Run Deep Memory Diagnostics

1. Windows Memory Diagnostic: Press Win + R, type mdsched.exe, select Restart now and check for problems, and observe the test during boot.

2. MemTest86 (Recommended Standard):

   • Download the free version of PassMark MemTest86 and use its tool to write the image to a blank USB flash drive.

   • Boot your PC from the USB drive.

   • Run at least 4 full passes through the 13 diagnostic algorithms.

   • Pass/Fail Threshold: If even a single error is detected, the memory is unstable.

3. Physical Isolation: If errors appear, remove all RAM sticks except one in slot A2 (second slot from CPU). Test each stick individually to isolate the specific failing module.

3. Clear and Rebuild the Windows Paging File (pagefile.sys)

If bad sectors or corrupted metadata develop within the physical disk sectors holding pagefile.sys, the kernel memory manager will crash with 0x00000050 when attempting to swap addresses between physical RAM and disk storage.

[Virtual Memory Rebuild Flow]
 Disable Paging File ──► Reboot PC ──► Delete Orphaned pagefile.sys ──► Re-enable Automatic Paging

[System Properties (sysdm.cpl)]
 └── Advanced Tab > Performance [Settings] > Advanced Tab > Virtual Memory [Change]
      ├── [UNCHECK] "Automatically manage paging file size for all drives"
      ├── Select Drive C: > [Select] "No paging file" > Click [Set]
      └── Restart Computer

1. Press Windows Key + R, type sysdm.cpl, and press Enter to open System Properties.

2. Go to the Advanced tab. Under the Performance section, click Settings.

3. In the Performance Options window, switch to the Advanced tab and click Change under Virtual memory.

4. Uncheck the box at the very top: Automatically manage paging file size for all drives.

5. Select drive C:, click the radio button for No paging file, and click the Set button.

6. Acknowledge the Windows warning prompt, click OK, and restart your computer.

   • Mechanism: Rebooting with no paging file forces the Windows kernel to unmount and delete the existing pagefile.sys and its associated allocation tables from the root directory.

7. After rebooting, return to the exact same menu (sysdm.cpl), check Automatically manage paging file size for all drives, click OK, and restart once more to build a pristine swap file.

4. Repair System Files and Component Store (DISM & SFC)

If low-level kernel binaries, storage filter drivers, or HAL files have been corrupted by improper shutdowns or malware, rebuilding the Windows Component Store restores clean system copies.

[Command Prompt (Administrator Execution Sequence)]
 ├── dism /online /cleanup-image /restorehealth
 └── sfc /scannow

1. Press Windows Key + S, type cmd, right-click Command Prompt, and select Run as administrator.

2. Run the Deployment Image Servicing and Management (DISM) tool to pull fresh binary payloads from Windows Update servers:

   DOS

   dism /online /cleanup-image /restorehealth
   

3. Allow the verification percentage to complete to 100%.

4. Once DISM completes, execute the System File Checker to scan and replace corrupted local kernel files:

   DOS

   sfc /scannow
   

5. Interpret the SFC output:

   • “Windows Resource Protection found corrupt files and successfully repaired them”: Restart your PC immediately to bind the newly repaired system files.

   • “Windows Resource Protection did not find any integrity violations”: System files are verified intact; proceed to Step 5.

5. Audit Conflicting Drivers & Run Driver Verifier

Third-party kernel-mode drivers that use deprecated memory management routines or attempt to read paged-out memory while operating at high IRQL frequently trigger this bug check.

[High-Risk Driver Categories]
 ├── Anti-Cheat Engines:       vgk.sys (Vanguard), EasyAntiCheat.sys, BEDaisy.sys
 ├── Kernel Antivirus Shields: epfw.sys (ESET), bdselfpr.sys (Bitdefender), aswSP.sys (Avast)
 ├── Virtual Disk / Emulation: scpvbus.sys, VirtualBox.sys, vmkbd.sys
 └── GPU Display Drivers:      nvlddmkm.sys (NVIDIA), amdkmdag.sys (AMD)

1. Clean-Install GPU Drivers (DDU):

   • Download the latest driver for your GPU along with Display Driver Uninstaller (DDU).

   • Boot Windows into Safe Mode (Hold Shift while selecting Restart > Troubleshoot > Advanced Options > Startup Settings > Restart > press 4).

   • Run DDU, select your GPU vendor, and click Clean and restart.

   • Reinstall the clean GPU driver using the Clean Installation checkbox.

2. Uninstall Ring-0 Anti-Cheat & Antivirus Temporarily:

   • If the BSOD began after installing a specific game (e.g., Valorant, Apex Legends, Call of Duty), uninstall the game and its anti-cheat engine through Windows Installed Apps.

   • If using third-party antivirus, temporarily uninstall it and rely on built-in Microsoft Defender.

3. Use Driver Verifier (Stress Test Kernel Drivers):

   Caution: Driver Verifier will repeatedly blue-screen your PC if it catches a bad driver. Create a System Restore Point before proceeding.

   • Press Win + R, type verifier.exe, and press Enter.

   • Select Create standard settings > click Next.

   • Select Select driver names from a list > click Next.

   • Click the Provider column header to sort, and check all drivers where the provider is NOT Microsoft Corporation.

   • Click Finish and restart your computer.

   • Use the PC normally. If a driver violates memory paging rules, Windows will instantly crash and display the exact culprit file name on the blue screen.

   • To turn off Driver Verifier afterward, open Command Prompt as Administrator and run:

     DOS

     verifier /reset
     

6. Disable Windows Fast Startup

Windows Fast Startup uses hybrid hibernation (hiberfil.sys) to log off user sessions while writing the kernel and driver session to disk. When the system wakes, stale or partially corrupted driver memory states are restored directly into the nonpaged pool without undergoing standard hardware initialization.

[Control Panel (powercfg.cpl)]
 └── Choose what the power buttons do
      └── Change settings that are currently unavailable
           └── [UNCHECK] "Turn on fast startup (recommended)" ──► Save changes

1. Press Windows Key + R, type powercfg.cpl, and hit Enter.

2. Click Choose what the power buttons do on the left menu.

3. Click Change settings that are currently unavailable.

4. Scroll to the bottom under Shutdown settings and uncheck the box next to Turn on fast startup (recommended).

5. Click Save changes.

6. Shut down your computer completely, wait 30 seconds, and turn it back on to force the kernel to load a fresh, un-cached memory environment.

7. Check Storage Controller & NVMe Drive Health

If nonpaged pool structures cannot be accessed because the underlying drive controller drops off the PCIe bus, the memory manager triggers a page fault timeout.

[Command Prompt (Admin)]
 └── chkdsk C: /f /r
      └── Type "Y" to schedule scan on next reboot ──► Restart PC

1. Open Command Prompt as Administrator.

2. Schedule a low-level surface scan:

   DOS

   chkdsk C: /f /r
   

3. Type Y when prompted to run the check on the next system restart, then restart your PC.

4. Inspect NVMe Health via Manufacturer Tool: Download your drive’s official management utility (e.g., Samsung Magician, Crucial Storage Executive, Western Digital Dashboard) or CrystalDiskInfo:

   • Verify that drive health reads Good (above 90%).

   • Check for high numbers of Critical Warnings, Media and Data Integrity Errors, or Available Spare depletion.

   • Update the SSD’s firmware if an update is marked pending.

If the PAGE_FAULT_IN_NONPAGED_AREA stop code persists across clean Windows re-installations, with XMP/EXPO disabled, and after passing individual MemTest86 sweeps on each RAM stick, the failure indicates a hardware fault within the processor or motherboard. Specifically, this points to electrostatic breakdown or silicon degradation in the CPU’s Integrated Memory Controller (IMC), a failing L3 cache parity circuit, or microscopic trace fractures within the motherboard’s multi-layer PCB along the primary memory channel traces, requiring an RMA replacement of the processor or motherboard.