UNEXPECTED_KERNEL_MODE_TRAP (bug check 0x7F) means the processor raised a trap, an error signal from the CPU itself, and the Windows kernel couldn’t deal with it. Microsoft describes two kinds: a bound trap, which the kernel isn’t permitted to catch, and a double fault, where a second fault arrives while the first is still being handled. Bug check 0x1000007F (UNEXPECTED_KERNEL_MODE_TRAP_M) has the same meaning and parameters.
Unlike most stop codes, this one leans toward hardware. Microsoft says it typically follows the installation of faulty or mismatched hardware, especially memory, or the failure of a part already in the PC, and overclocking is on its list too. Drivers come second, with one notable exception covered below.
The quickest way to narrow it down is parameter 1, the trap number. A double fault (8) points at hardware or a kernel stack overflow, an invalid opcode (6) usually means memory corruption, and a trap number that changes from one crash to the next points at hardware.
Try these first
- Note parameter 1 (the trap number) from Reliability Monitor and match it in the table below; it decides where to start.
- Turn off any CPU or memory overclock, including XMP or EXPO memory profiles, and retest.
- With trap 8 and two antivirus or endpoint security products, uninstall the one you don’t need before opening the PC; keep backup and encryption tools, and on a work PC ask your security admin first.
- Remove hardware added recently: memory first, then cards, drives and docks.
- Clear dust from vents and fans and check temperatures, especially if crashes come under heavy load.
- Update the BIOS, chipset and storage drivers from your PC maker, after suspending BitLocker.
Start with the trap number
Parameter 1 holds the trap number. The Windows 10 and 11 stop screen doesn’t show it, so read it afterward from Reliability Monitor, Event Viewer or a crash dump; our blue screen of death guide shows where each is. In the Event Viewer System log, the BugCheck event (ID 1001) reads like The bugcheck was: 0x1000007f (0x0000000000000008, …); the first value in brackets is the trap number, here 0x8.
| Parameter 1 | Trap | What Microsoft says it means | Where to look first |
|---|---|---|---|
| 0x0 | Divide by zero | A divide instruction ran with a divisor of zero; memory corruption, other hardware problems or software can cause it | A module that repeats in every dump; if none, memory |
| 0x4, 0x5 | Overflow, bounds check | The processor caught an overflow condition, or an array index outside its allowed range | A repeating third-party driver; if none, hardware |
| 0x6 | Invalid opcode | An invalid instruction, usually from a corrupted instruction pointer; Microsoft names hardware memory corruption as the most common cause | Memory and memory settings |
| 0x8 | Double fault | A fault during the handler for an earlier one; Microsoft’s two common causes are a kernel stack overflow and a hardware problem | Stacked filter drivers (below), then hardware |
| 0xD | General protection fault | An access violation not covered by another exception type | A repeating module; hardware if none repeats |
| 0xA, 0xB, 0xC, other values, or a different number each crash | Less common traps | Microsoft briefly describes some (0xA a corrupted task state segment, 0xB a segment that wasn’t present, 0xC an access beyond a stack’s limits) and refers unlisted numbers to Intel’s processor architecture manual | Hardware: memory, CPU settings, heat, power |
If you can open the dumps, look for trends across several before acting on one, as Microsoft advises for 0x7F: with hardware faults, one dump often names whichever module happened to be running.
Hardware first: check in this order
Microsoft’s troubleshooting for this code starts with hardware, so do these reversible checks before reinstalling drivers or Windows. The exception: with trap 8 and more than one security, backup or encryption product installed, run the filter check in the next section first.
On a Dell, HP or Lenovo business PC, step 1 rarely applies, since these are seldom overclocked; start by unplugging docks and USB devices, then run the maker’s diagnostics in step 5.
- Return everything to stock speed. CPU overclocks, undervolting tools and memory profiles (XMP, or EXPO, DOCP or A-XMP on many AMD boards) all count; Microsoft lists overclocking as a cause of 0x7F. Have your BitLocker recovery key ready first, since some BIOS changes trigger a recovery prompt, and change the individual settings back; if you load defaults instead, first note the storage mode (AHCI, RAID or VMD), Secure Boot and TPM settings, because a full reset can flip the storage mode and leave Windows unable to start with
INACCESSIBLE_BOOT_DEVICE. If the crashes stop, leave them at stock. - Take out what’s new. This is where to start with an unexpected kernel mode trap after RAM upgrade work. Removing recently added hardware is Microsoft’s first hardware step: memory first, then graphics cards, drives, expansion cards, and USB devices or docks. Unplug a desktop before opening it; on a laptop, follow the maker’s service manual for your model, which may say to disconnect the internal battery first. Many thin laptops have soldered memory that can’t be removed.
- Check heat. Crashes during long video calls, exports or games, and never at idle, suggest a processor or memory running too hot. Clean the vents and fans and check temperatures with the PC maker’s tools.
- Test the memory. Microsoft recommends Windows Memory Diagnostic (
mdsched.exe) on all installed memory; it runs at the next restart, before Windows loads. One clean pass doesn’t clear the memory, since intermittent faults can take many passes to show, so if crashes continue, run a bootable tester such as MemTest86 overnight. Our memory management guide covers the Extended test, testing one module at a time, and mixed memory kits. - Run the PC maker’s built-in diagnostics. These also run outside Windows. On many Dell PCs, press F12 at the Dell logo and choose Diagnostics; on many HP PCs, press Esc at power-on and then F2 for HP PC Hardware Diagnostics UEFI. Other makers have similar tools.
- Consider the power supply and motherboard. Microsoft also names a failing power supply and board defects such as a scratched trace; neither is easy to prove at home, but a repair shop can test with a known-good power supply.
Double fault (8): stacked filter drivers
A kernel stack overflow is the one software cause Microsoft singles out for this code. Kernel code runs on a small, fixed-size stack; when it runs out, the processor raises a double fault. Microsoft’s example is two file system filter drivers on the same stack while the file system calls back into itself, and antivirus, backup, encryption and file-sync tools commonly install such filters.
In practice that usually means two products doing the same job, such as an old antivirus left behind by a new one, or a second security or backup agent layered on the first.
- Open Windows Security > Virus & threat protection, and under Who’s protecting me? select Manage providers to see which antivirus is active. Windows normally switches Microsoft Defender Antivirus off, or on some PCs to passive mode, when another antivirus takes over, but nothing stops a second third-party product, or a backup or encryption tool, from adding its own filter.
- In an administrator Command Prompt, run
fltmc filters. It lists the file system minifilter drivers currently loaded. Microsoft’s own entries, such as WdFilter for Defender, are expected; look for names from two different security, backup or encryption vendors. - Remove the product you don’t need with its vendor’s uninstaller or removal tool, restart, and see whether the double faults stop. Keep one antivirus running, and confirm it in Manage providers afterward. Decrypt anything an encryption tool protects before uninstalling it, or you can lose access to it; for a backup tool, update it or ask its vendor rather than go without backups. On a work PC, ask whoever manages security first; tamper protection or company policy may block the removal anyway.
In a dump, Microsoft’s !thread and kb 100 show the stack: a very long one through several third-party filter drivers supports the overflow theory, a short one sends you back to hardware.
Then drivers, firmware and upgrades
Once the hardware and filter checks come up clean, move to software.
- Firmware and controller drivers. Check the PC maker for updates to the BIOS, the storage controller driver and the network adapters. Before a BIOS update, suspend BitLocker, connect a laptop to AC power and don’t interrupt the flash, because a failed update can leave the PC unable to start. Know where your BitLocker recovery key is in case the PC asks for it anyway.
- A driver installed or updated just before the crashes. Roll it back in Device Manager or uninstall it. If the crash happens during startup, use Safe Mode: with your BitLocker recovery key ready, open the Windows Recovery Environment (WinRE) as the blue screen guide describes, choose Troubleshoot > Advanced options > Startup Settings > Restart, then press 4.
- Skip the Last Known Good advice. Microsoft’s reference page still mentions Last Known Good Configuration and the Recovery Console, but Last Known Good isn’t in the Windows 10 or 11 Startup Settings menu, and WinRE replaced the Recovery Console. The nearest modern equivalent is System Restore from WinRE, if System Protection was on and a restore point from before the crashes exists.
- Crashes during a Windows feature upgrade. Microsoft points at incompatible drivers, system services, virus scanners and backup tools. Update them first; if the upgrade still fails, uninstall third-party security and backup software for the upgrade and reinstall it straight afterward (on a work PC, ask whoever manages security first).
- The System log. In Event Viewer under Windows Logs > System, look around each crash time for errors that name a device or driver, and for WHEA-Logger errors, which are errors the hardware itself reported to Windows.
- SFC, DISM and chkdsk come last. They repair Windows files and the file system, not the hardware or driver fault behind a processor trap. Once the crashes stop, especially after replacing faulty memory, run
DISM /Online /Cleanup-Image /RestoreHealth, thensfc /scannow, in an administrator terminal.
Rather have a technician sort it out?
If Windows stays up long enough, a technician can connect with your approval, read the trap number from your crash dumps and check filter drivers, drivers and firmware while you watch. A GoProIT technician can connect remotely, with your permission, and fix it while you watch. $59 per fix, Mon–Fri 8am–8pm ET.
Match the pattern to the cause
| What you notice | Likely cause | What to do |
|---|---|---|
| Started after adding or swapping memory | A faulty new module, or one that doesn’t match the others | Remove it; buy a matched kit from the PC maker’s compatibility list |
| Started after a BIOS update | New firmware, or tuning settings re-applied with it | Check the maker’s notes for a newer release; re-check memory and CPU settings |
| Trap 8, with two security, backup or encryption products installed | Kernel stack overflow from stacked filter drivers | Remove the duplicate antivirus; update backup or encryption tools rather than removing them |
| Trap 6 or 0, and memory test errors | Memory corruption | Replace the failing module; soldered memory means a board repair |
| Only under heavy load, with loud fans or a hot laptop | Heat or power delivery | Clean, check temperatures, test the power supply |
| Desktop with an Intel 13th or 14th Gen Core processor and mixed crashes | Possibly the instability Intel has confirmed in some 13th and 14th Gen desktop chips | Update the BIOS; see our clock watchdog timeout guide |
Several office PCs with 0x7F
One PC with this code is usually that PC’s own problem. Several PCs with it in the same week are not, and the trap number tells you where to look.
- Trap 8 on several models: look for an agent recently added everywhere, such as a new backup, data-loss prevention or endpoint security tool layered on the existing one. Run
fltmc filterson two crashing PCs and one stable PC; a filter the crashing PCs share and the stable one lacks is your lead. - Same model, same week: compare BIOS versions and install dates, since a firmware rollout from the maker’s update tool is a likely common factor.
Stop the spread before more PCs restart into the change: in Intune, pause the driver update policy (which needs Intune plus a Windows license that includes Windows Autopatch, such as Microsoft 365 Business Premium or Windows Enterprise E3/E5) or the update ring, or remove the new agent’s app assignment; elsewhere, pause the deployment in the vendor’s console. Then fix one PC and confirm it stays stable before changing the rest.
When it’s hardware, and when to stop
Treat it as hardware, and stop changing software, when:
- Windows Memory Diagnostic, MemTest86 or the PC maker’s diagnostics report any error.
- The PC crashes in Safe Mode, inside a bootable tester, or while installing Windows from USB, where almost none of your own software is running.
- 0x7F continues at stock settings, with new hardware removed and only one security product installed.
- You notice a burning smell, a swelling laptop battery or signs of liquid damage. Stop using the PC until it’s inspected.
Faulty memory can damage files as they’re written, so until the cause is fixed, save work to a synced or backed-up location and avoid big jobs such as firmware updates and Windows upgrades.
Reading the dumps, finding a filter-driver conflict, removing a duplicate security product and updating drivers is a typical $59 remote fix, as long as Windows stays up long enough to connect. Hands-on work such as swapping memory, cleaning a fan or replacing a power supply isn’t part of a remote fix; an on-site visit can be arranged through vetted local partner technicians as a separate paid add-on, where available, with parts extra. Every session needs your approval and you can end it at any time; see how our remote support works.
Common questions
Is unexpected kernel mode trap always a hardware problem?
No, but hardware is the first place to look. Microsoft ties this stop code mainly to faulty or mismatched memory, failing parts and overclocking. The main software exception is a kernel stack overflow, usually from too many file system filter drivers, and outdated firmware or drivers can also trigger it. If crashes continue at stock settings with new parts removed, test the hardware outside Windows.
What does 0x00000008 mean with UNEXPECTED_KERNEL_MODE_TRAP?
It’s trap 8, a double fault: the processor hit a second fault while still handling the first, a situation Windows always treats as fatal. The two usual explanations are a kernel stack overflow and failing hardware. A PC running two antivirus or backup products leans toward the first; memory test errors, heat or an overclock lean toward the second.
Can overheating cause unexpected kernel mode trap?
It can. A processor or memory that runs too hot can produce errors the kernel can’t handle, and the crash often appears only under sustained load such as video calls, exports or games. Clean the vents and fans, keep a laptop off soft surfaces, and check temperatures with the PC maker’s tools. If the crashes stop once the PC runs cooler, heat was the trigger.
Will reinstalling Windows fix unexpected kernel mode trap?
Rarely, because this code usually comes from hardware, overclock settings or third-party drivers you would install again afterward. A clean install only helps when a stubborn driver or security product can’t be removed any other way. Before considering it, return settings to stock, remove new hardware, test memory and check for duplicate security software, and back up your files either way.
Why do I get unexpected kernel mode trap after upgrading RAM?
Either the new module is defective or the combination doesn’t work together, and Microsoft names mismatched memory as a cause of this code. Take the new module out and use the PC for a day or two. If the crashes stop, return or replace it, ideally with a complete matched kit listed for your PC model instead of adding a single stick to old memory.
Can a graphics card or power supply cause unexpected kernel mode trap?
Yes. Microsoft names a failing power supply as a cause of this code, and a newly fitted graphics card falls under its remove-recent-hardware step. A power supply that can’t keep up often shows as crashes only in games, renders or other heavy work. Test with the card removed, using the processor’s built-in graphics if it has them, or with a known-good power supply. If the dumps name the graphics driver instead, update or reinstall that driver.