[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M69BMABVMYCKCKR375EMBGGC":3,"skill-same:01M69BMABVMYCKCKR375EMBGGC":51},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":23,"linkOnly":24,"markdownContent":25,"markdownBody":26,"frontMatter":27,"refName":28,"commitSha":29,"skillDirectory":30,"forksCount":31,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":34,"ownerDescription":35,"updatedAt":36,"install":37,"resources":50},"01M69BMABVMYCKCKR375EMBGGC","windbg-kernel-bugcheck-triage",null,"Use when a kernel dump reports a Windows bugcheck; decode parameters and recover exception or trap context before investigating your driver. Not for user-mode process crashes or blaming a module from its name alone.","microsoft\u002Fwin-dev-skills","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M69BM5T5HHSGVF6KZPTNENXK",510,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fwindbg\u002Fskills\u002Fwindbg-kernel-bugcheck-triage\u002FSKILL.md",[],[19,20,21,22],"kernel","triage","windbg kernel bugcheck triage","windows","2026-11-10 10:12:30",false,"---\nname: windbg-kernel-bugcheck-triage\ndescription: 'Use when a kernel dump reports a Windows bugcheck; decode parameters and recover exception or trap context before investigating your driver. Not for user-mode process crashes or blaming a module from its name alone.'\n---\n\n# Kernel Bugcheck Triage\n\n**Load `windbg-diagnostic-method` first** if it is not already loaded in this\nconversation, and apply it throughout for evidence ranking, hypothesis testing,\nconfidence calibration, independent review, and report validation. This skill\nadds the bug-family-specific commands and evidence requirements.\n\n## Scope\n\nUse a kernel crash dump or authorized live kernel session. A process dump\ncaptured after a reboot does not contain the earlier kernel fault. Confirm\nthe dump type with the debugger, not a filename or the user's visible symptom.\nThis skill includes exception-context and trap-frame recovery.\n\n## Workflow\n\n### 1. Establish symbols and bugcheck evidence\n\n```text\n.symfix\n.sympath+ \u003Cyour-vendor-symbol-directory>\n.reload\n!analyze -v\n.bugcheck\nk\n```\n\nReplace the placeholder with the approved symbol location for your own binaries.\nRecord dump type, target architecture\u002Fbuild, bugcheck code and parameters,\nfaulting instruction, and available memory. Public Windows symbols suffice\nfor many investigations; do not require private Windows source or PDBs.\n\n### 2. Decode parameters for the specific code\n\n| Code | Parameter meaning \u002F next step |\n|---|---|\n| `0x1E` | P1 exception code; P2 exception address; P3\u002FP4 exception-specific information. These are not generically a CONTEXT pair. |\n| `0x7E` | P1 exception code; P2 exception address; P3 EXCEPTION_RECORD; P4 CONTEXT. |\n| `0x3B` | P1 exception code; P2 instruction address; P3 CONTEXT; P4 unused. |\n| `0x0A` \u002F `0xD1` | Referenced address, IRQL, access information, instruction address. Decode the access field for that code; these parameters are not generally a trap-frame pointer. |\n| `0x50` | Invalid memory reference; parameter interpretation varies with target version. Consult the code reference. |\n| `0x9F` | P1 selects the power-failure subtype; use its specific parameter table and `windbg-kernel-irp-lifecycle-triage` where applicable. |\n| Verifier-class stop | Use `windbg-kernel-verifier-triage` and the exact code\u002Fsubcode definition. |\n\nDo not reuse a parameter layout across different bugchecks.\n\n### 3. Recover the original faulting context\n\nFor `0x7E`:\n\n```text\n.exr \u003CP3>\n.cxr \u003CP4>\nkb\nr\n```\n\nFor `0x3B`:\n\n```text\n.cxr \u003CP3>\nkb\nr\n```\n\nFor other exception-style bugchecks, locate a valid saved exception\u002Fcontext\nusing the documented code procedure and available analysis output. Do not\nguess `.cxr` arguments from arbitrary P1..P4 values.\n\nWhen `!analyze -v` or verified stack evidence identifies a `TRAP_FRAME`:\n\n```text\n.trap \u003Ctrap-frame-address>\nkb\nr\n```\n\nTrap frames can be partial: some registers may be missing or reconstructed\nincorrectly. Note the debugger's warnings and do not treat unsaved registers as\nreliable evidence. If a frame is missing, malformed, or absent from the dump,\nreport the limitation rather than scanning arbitrary pointers and claiming a\nrecovered context.\n\n### 4. Investigate the driver, not just the detector\n\n```text\n!thread\nlmvm \u003Cdriver-module>\n.frame \u002Fr \u003Cframe-number>\n```\n\nInspect the recovered instruction, register\u002Fobject used, IRQL, ownership,\nand nearby driver frames. A crash in an operating-system routine may result\nfrom prior driver corruption. Conversely, a third-party name in\n`MODULE_NAME` does not establish that the named driver caused the failure.\nVerify vendor build identity against the matching binary\u002FPDB.\n\nFor concurrency or blocked requests use `windbg-kernel-lock-deadlock-triage` or\n`windbg-kernel-irp-lifecycle-triage`. Kernel `~` commands select processors, not the\napplication thread list; use documented thread\u002Fprocess inspection such as\n`!thread` and `!process 0 7`.\n\n## Validation\n\nRecord the decoded parameters, recovered context and its limitations, and the\nevidence connecting the driver's operation to the violated invariant. Test\ncompeting lifetime, bounds, IRQL, and synchronization explanations. Recommend\nan instrumented test\u002Frepro only with approval; route Verifier evidence to\n`windbg-kernel-verifier-triage`. Do not call a guessed module assignment a proven cause.\n\n## References\n\n- [Bugcheck reference](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebugger\u002Fbug-check-code-reference2)\n- [0x3B SYSTEM_SERVICE_EXCEPTION](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebugger\u002Fbug-check-0x3b--system-service-exception)\n- [0x7E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebugger\u002Fbug-check-0x7e--system-thread-exception-not-handled)\n- [Context record](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebuggercmds\u002F-cxr--display-context-record-)\n- [Trap frame](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebuggercmds\u002F-trap--display-trap-frame-)\n\n## Feedback\n\nFollow `FEEDBACK.md` and submit only reviewed, sanitized feedback to\n[WinDbg-Feedback](https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002FWinDbg-Feedback\u002Fissues).\nInclude `windbg-kernel-bugcheck-triage` and the package version from `plugin.json`; no\nautomatic kernel dump, private-symbol, or source upload.\n","# Kernel Bugcheck Triage\n\n**Load `windbg-diagnostic-method` first** if it is not already loaded in this\nconversation, and apply it throughout for evidence ranking, hypothesis testing,\nconfidence calibration, independent review, and report validation. This skill\nadds the bug-family-specific commands and evidence requirements.\n\n## Scope\n\nUse a kernel crash dump or authorized live kernel session. A process dump\ncaptured after a reboot does not contain the earlier kernel fault. Confirm\nthe dump type with the debugger, not a filename or the user's visible symptom.\nThis skill includes exception-context and trap-frame recovery.\n\n## Workflow\n\n### 1. Establish symbols and bugcheck evidence\n\n```text\n.symfix\n.sympath+ \u003Cyour-vendor-symbol-directory>\n.reload\n!analyze -v\n.bugcheck\nk\n```\n\nReplace the placeholder with the approved symbol location for your own binaries.\nRecord dump type, target architecture\u002Fbuild, bugcheck code and parameters,\nfaulting instruction, and available memory. Public Windows symbols suffice\nfor many investigations; do not require private Windows source or PDBs.\n\n### 2. Decode parameters for the specific code\n\n| Code | Parameter meaning \u002F next step |\n|---|---|\n| `0x1E` | P1 exception code; P2 exception address; P3\u002FP4 exception-specific information. These are not generically a CONTEXT pair. |\n| `0x7E` | P1 exception code; P2 exception address; P3 EXCEPTION_RECORD; P4 CONTEXT. |\n| `0x3B` | P1 exception code; P2 instruction address; P3 CONTEXT; P4 unused. |\n| `0x0A` \u002F `0xD1` | Referenced address, IRQL, access information, instruction address. Decode the access field for that code; these parameters are not generally a trap-frame pointer. |\n| `0x50` | Invalid memory reference; parameter interpretation varies with target version. Consult the code reference. |\n| `0x9F` | P1 selects the power-failure subtype; use its specific parameter table and `windbg-kernel-irp-lifecycle-triage` where applicable. |\n| Verifier-class stop | Use `windbg-kernel-verifier-triage` and the exact code\u002Fsubcode definition. |\n\nDo not reuse a parameter layout across different bugchecks.\n\n### 3. Recover the original faulting context\n\nFor `0x7E`:\n\n```text\n.exr \u003CP3>\n.cxr \u003CP4>\nkb\nr\n```\n\nFor `0x3B`:\n\n```text\n.cxr \u003CP3>\nkb\nr\n```\n\nFor other exception-style bugchecks, locate a valid saved exception\u002Fcontext\nusing the documented code procedure and available analysis output. Do not\nguess `.cxr` arguments from arbitrary P1..P4 values.\n\nWhen `!analyze -v` or verified stack evidence identifies a `TRAP_FRAME`:\n\n```text\n.trap \u003Ctrap-frame-address>\nkb\nr\n```\n\nTrap frames can be partial: some registers may be missing or reconstructed\nincorrectly. Note the debugger's warnings and do not treat unsaved registers as\nreliable evidence. If a frame is missing, malformed, or absent from the dump,\nreport the limitation rather than scanning arbitrary pointers and claiming a\nrecovered context.\n\n### 4. Investigate the driver, not just the detector\n\n```text\n!thread\nlmvm \u003Cdriver-module>\n.frame \u002Fr \u003Cframe-number>\n```\n\nInspect the recovered instruction, register\u002Fobject used, IRQL, ownership,\nand nearby driver frames. A crash in an operating-system routine may result\nfrom prior driver corruption. Conversely, a third-party name in\n`MODULE_NAME` does not establish that the named driver caused the failure.\nVerify vendor build identity against the matching binary\u002FPDB.\n\nFor concurrency or blocked requests use `windbg-kernel-lock-deadlock-triage` or\n`windbg-kernel-irp-lifecycle-triage`. Kernel `~` commands select processors, not the\napplication thread list; use documented thread\u002Fprocess inspection such as\n`!thread` and `!process 0 7`.\n\n## Validation\n\nRecord the decoded parameters, recovered context and its limitations, and the\nevidence connecting the driver's operation to the violated invariant. Test\ncompeting lifetime, bounds, IRQL, and synchronization explanations. Recommend\nan instrumented test\u002Frepro only with approval; route Verifier evidence to\n`windbg-kernel-verifier-triage`. Do not call a guessed module assignment a proven cause.\n\n## References\n\n- [Bugcheck reference](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebugger\u002Fbug-check-code-reference2)\n- [0x3B SYSTEM_SERVICE_EXCEPTION](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebugger\u002Fbug-check-0x3b--system-service-exception)\n- [0x7E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebugger\u002Fbug-check-0x7e--system-thread-exception-not-handled)\n- [Context record](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebuggercmds\u002F-cxr--display-context-record-)\n- [Trap frame](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebuggercmds\u002F-trap--display-trap-frame-)\n\n## Feedback\n\nFollow `FEEDBACK.md` and submit only reviewed, sanitized feedback to\n[WinDbg-Feedback](https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002FWinDbg-Feedback\u002Fissues).\nInclude `windbg-kernel-bugcheck-triage` and the package version from `plugin.json`; no\nautomatic kernel dump, private-symbol, or source upload.\n",{"name":5,"description":7},"main","5ce74fa89c49ca353c6ab03bd5889aa519aa9e5e","plugins\u002Fwindbg\u002Fskills\u002Fwindbg-kernel-bugcheck-triage",41,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-11-09 06:27:16",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add microsoft\u002Fwin-dev-skills --skill windbg-kernel-bugcheck-triage",{"tool":43,"command":44},"bunx","bunx skills add microsoft\u002Fwin-dev-skills --skill windbg-kernel-bugcheck-triage",{"tool":46,"command":47},"pnpm","pnpm dlx skills add microsoft\u002Fwin-dev-skills --skill windbg-kernel-bugcheck-triage","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fwindbg\u002Fskills\u002Fwindbg-kernel-bugcheck-triage\u002FSKILL.md",true,[],[52,70,78,88,97,107],{"skillNo":53,"name":54,"nameZh":6,"description":55,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":56,"categories":57,"keywords":66,"publishedAt":23},"01M69BN1YCR77KBJHPBB1KBXAB","sample-skill","Sample skill used to test the catalog tooling. Use when testing CI. Not for real work.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fscripts\u002Ftests\u002Ffixtures\u002Flocal-plugin\u002Fplugins\u002Fsample\u002Fskills\u002Fsample-skill\u002FSKILL.md",[58,63],{"categoryNo":59,"categoryName":60,"taxonomyType":61,"taxonomyTypeDesc":62},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":64,"categoryName":65,"taxonomyType":61,"taxonomyTypeDesc":62},"01JBSEEDCAT000000000000023","Skill与智能体开发",[67,68,69],"sample skill","testing","test",{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":23},"01M69BMZFWAWBRE71DKPHT282F","windbg-user-wait-chain-analysis","Use when an app, service, or user-mode driver host is unresponsive on locks, COM\u002FRPC, I\u002FO, or another process; follow the blocker chain. Not for a crash solely from an exception stack.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fwindbg\u002Fskills\u002Fwindbg-user-wait-chain-analysis\u002FSKILL.md",[],[77],"windbg user wait chain analysis",{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":23},"01M69BMX6T725RH7TZK7RDP8YQ","windbg-user-virtual-memory-exhaustion","Use when a native app, service, or user-mode driver host allocation fails; distinguish VA exhaustion, fragmentation, and commit pressure. Not for managed .NET heap growth, proving a leak from one snapshot, or corruption.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fwindbg\u002Fskills\u002Fwindbg-user-virtual-memory-exhaustion\u002FSKILL.md",[],[85,86,87],"memory","windbg user virtual memory exhaustion","commit",{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":23},"01M69BMTTSCGTJ6W18YNYDWEVE","windbg-user-ttd-reverse-debugging-triage","Use when an app, service, or user-mode driver host TTD recording is available and earlier calls, writes, or lifetimes matter. Not for kernel replay or history from a normal dump.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fwindbg\u002Fskills\u002Fwindbg-user-ttd-reverse-debugging-triage\u002FSKILL.md",[],[20,95,96,19],"debugging","windbg user ttd reverse debugging triage",{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":23},"01M69BMRKH2MF07GD357PK5S4Q","windbg-user-mutex-held-across-co-await","Use when app, service, or user-mode driver C++ coroutine code holds a thread-affine lock across suspension and later hangs or fails. Not for all coroutine crashes or choosing lock performance.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fwindbg\u002Fskills\u002Fwindbg-user-mutex-held-across-co-await\u002FSKILL.md",[],[104,105,106],"windbg user mutex held across co await","performance","code",{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":23},"01M69BMPFX7S3D729F1N89AAP6","windbg-user-heap-corruption-investigation","Use when an app, service, or user-mode driver host heap fails or Application Verifier detects corruption; inspect history and bounds. Not for kernel pool corruption or ordinary OOM.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fwindbg\u002Fskills\u002Fwindbg-user-heap-corruption-investigation\u002FSKILL.md",[],[114,19],"windbg user heap corruption investigation"]