Bug Check 0x0100: LOADER_BLOCK_MISMATCH

Bug Check 0x0100

The LOADER_BLOCK_MISMATCH bug check reports that the loader and kernel disagree about their combination.

Bug Check Code LOADER_BLOCK_MISMATCH
1st Argument major version of loader parameter block
2nd Argument minor version of loader parameter block
3rd Argument size of loader parameter block
4th Argument size of loader parameter extension;
else zero

A LOADER_PARAMETER_BLOCK is received from the loader as the kernel’s one argument for initialisation, and contains a pointer to a separate LOADER_PARAMETER_EXTENSION. Both structures are clearly vital but both vary between Windows versions. This bugcheck means that at least one of the structures does not fit the kernel’s expectations. Probably, the loader and kernel are from different Windows versions or even from different builds. The point to this bugcheck is much reduced, however, since the kernel does not try to validate the loader until it gets round to initialising the executive’s understanding of the boot processor. If the structures truly are mismatched, surely disaster will have struck long before.

This bug check is supported by making a significant change to the previous layout of the LOADER_PARAMETER_BLOCK. Version 6.1 introduces OsMajorVersion, OsMinorVersion and Size members at the beginning, and later versions keep them. Earlier versions begin with a LIST_ENTRY, which is extremely unlikely to fit the version numbers and size by accident. The LOADER_PARAMETER_EXTENSION has long begun with its Size (but lost its own MajorVersion and MinorVersion in version 6.1). The location of the Extension member that points from the one structure to the other varies with the Windows version. If the kernel dislikes what it finds at the beginning of the supposed loader block, it raises this bugcheck with zero for the fourth argument, it being unsafe even to look for the supposed extension.

Conversely, a non-zero fourth argument implies that the block itself has the correct version numbers and size, and the mismatch is with the extension. Before the 1607 release of Windows 10, the extension is checked only for its Size. Later releases also require the correct NTDDI version number in a member that these releases have near the extension’s end and for which Microsoft’s name is not known.

Availability

The LOADER_BLOCK_MISMATCH bug check can occur in version 6.1 and higher. It replaces one case of the much older MISMATCHED_HAL.

Microsoft’s documentation in the Windows Driver Kit (WDK) for Windows 7, dated June 2009, and in the contemporaneous Debugging Tools for Windows, is completely wrong about the arguments, presumably as a cut-and-paste error from documentation of MISMATCHED_HAL.