Stop 0x19 - Corrupt Pool Header - !pool, !poolval, dt nt!_POOL_HEADER

This blog post is going to more of a link to a thread again, but I'm going to quickly explain the fields within the _POOL_HEADER data structure. Please note !pool and !pooval are explained in my Stop 0xC2 blog post.

Stop 0x19 Example - With Stop 0xC5 and Stop 0xC2 

Every pool allocation, has a data structure called the Header, this is used to store information about the pool allocation such as it's size, it's owner and the previous allocation before it within the linked list.

The Block Size means the current size of the pool allocation.

Previous Size contains the size of the previous pool allocation.

Pool Tag is the owner of the pool allocation. You could use the !poolfind extension to find the allocation owned by that pool tag. 

Stop 0x19 - Some Theory About Corrupt Pool Headers

A Stop 0x19 will typically mention that a pool header has become corrupt, so I wanted to explain a little abit about the theory behind what a pool header is and how it is used in the Windows memory allocation system.

A device driver or process will often request a chunk of memory, therefore the Memory Manager will allocate the requested block of memory to the requesting process. Here is where, the header comes in, most Memory Managers will allocate a block of memory which is larger than the requested amount, this extra memory is known as the header. The header will contain useful information such as the size of the allocation and a pool tag. A tag is a form of information used to reference certain objects. 

References:

What is an Object?