Fix it now
0x0000009F means a driver is in an inconsistent or invalid power state. The most common form has parameter 1 of 0x3 – a device object has been blocking an IRP for too long – and it hands you the physical device object and the blocked request, which makes this one of the more readable bug checks.
!analyze -v
powercfg /a
powercfg /energy
powercfg /devicequery wake_armed
- Establish the pattern first: does it crash on sleep, on hibernate, on shutdown, or on resume? That distinction narrows the field more than anything else.
- Read parameter 1 from the dump. 0x3 means a device object blocked an IRP for too long, with parameter 2 the physical device object and parameter 4 the blocked IRP.
- Update the wireless and Ethernet drivers from the hardware vendor, then USB and chipset drivers from the same source.
- Stop devices sleeping on their own as a test: in Device Manager, open each network adapter and USB Root Hub, go to Power Management, and untick ‘Allow the computer to turn off this device to save power’.
- Turn off Fast Startup as a test. It is in Power Options, under the settings for what the power buttons do, and needs the ‘change settings that are currently unavailable’ link before the checkbox can be cleared.
Reintroduce the power management settings one at a time once the machine is stable. Leaving every device permanently awake fixes the crash by disabling the feature that exposed it, which is not the same as fixing the driver.
If the transition that used to crash now completes, stop here. The next section covers the other parameter 1 values, which point at different drivers entirely.
Why it happens
Power management in Windows is cooperative. When the system changes state, the power manager sends a power IRP to every device stack and waits for each to complete it. Every driver in that stack gets a turn: handle the request, or pass it down and complete it on the way back up. The system cannot proceed until all of them have answered.
A driver that blocks – waiting on hardware that is not responding, or deadlocking against its own worker thread – stops the whole transition. The watchdog exists because the alternative is a machine that hangs forever with a black screen and no diagnostic evidence at all. The crash therefore lands the moment you close the lid, press shutdown, or the machine idles into sleep.
Parameter 1 is what makes this bug check tractable, and different values point at genuinely different drivers. 0x3 is a device object blocking an IRP for too long, with the physical device object of the stack in parameter 2 and the blocked IRP in parameter 4. 0x2 and 0x500 both mean the device object completed the power IRP but did not call PoStartNextPowerIrp, which is a driver bug of a different shape. 0x4 is the power transition timing out waiting to synchronise with the PnP subsystem, and gives you the time-out value and the thread holding the PnP lock.
Two more matter on current hardware. 0x5 means the device failed to complete a directed power transition within the required time, and 0x6 means it did not complete its directed power transition callback successfully, with parameter 3 saying whether it was a power-down or a power-up. Machines using modern standby exercise those paths constantly, which is why laptops see this far more than desktops do.
A network adapter stalls the transition
You have this one if Crashes on sleep or on resume, on a laptop, and the dump names a wireless or Ethernet driver.
- Install the adapter driver from the hardware vendor rather than the one Windows Update selected.
- In Device Manager, open the adapter’s Power Management tab and untick ‘Allow the computer to turn off this device to save power’ as a test.
powercfg /devicequery wake_armedlists the devices allowed to wake the machine – a shorter list is easier to test against.
A USB device or hub does not answer
You have this one if Crashes on shutdown or sleep only when a particular dock, hub or external drive is attached.
- Unplug everything, confirm the transition works, then reconnect one device at a time.
- Install the chipset and USB host controller package from the machine vendor.
- Update firmware for docks, hubs and external enclosures where the manufacturer publishes it.
A filter driver hooks the transition
You have this one if The dump names an endpoint agent, encryption product or backup tool, or fltmc lists a minifilter from a product nobody remembers installing.
fltmcfrom an elevated prompt lists the loaded minifilter drivers.- Uninstall the owning product as a test rather than updating it. An expired agent keeps its driver in the path.
- Reinstall the current supported build once the machine has proved stable without it.
It is a different power bug check
You have this one if 0x000000A0, 0x000000CE, 0x0000010D or 0x000000D4 rather than 0x9F.
- 0x000000A0 INTERNAL_POWER_ERROR: the power policy manager experienced a fatal error. Parameter 1 of 0xD, 0xF, 0xF0 or 0xF1 means the system failed to complete a power transition in a timely manner, with the sleep checkpoint most recently reached in parameter 3.
- 0x0000010D WDF_VIOLATION with parameter 1 of 0x1 is a framework-based driver timing out during a power operation – the same fault, reported by KMDF instead.
- 0x000000CE and 0x000000D4 are both a driver failing to cancel lookaside lists, DPCs or worker threads before unloading. Different fault, same class of careless driver.
Full reference
Parameter 1 for 0x0000009F
| Parameter 1 | Parameter 2 | Parameter 4 | Cause |
|---|---|---|---|
| 0x1 | The device object | Reserved | The device object being freed still has an outstanding power request it has not completed |
| 0x2 | The target device’s device object, if available | The driver object, if available | Completed the power IRP but did not call PoStartNextPowerIrp |
| 0x3 | The physical device object of the stack | The blocked IRP | A device object has been blocking an IRP for too long |
| 0x4 | Time-out value, in seconds | A TRIAGE_9F_PNP structure | The power transition timed out waiting to synchronise with the PnP subsystem |
| 0x5 | Physical device object of the stack | Reserved | The device failed to complete a directed power transition in time |
| 0x6 | The POP_FX_DEVICE object | Reserved | The device did not complete its directed power transition callback successfully |
| 0x500 | Reserved | The device object | Completed the power IRP but did not call PoStartNextPowerIrp |
powercfg, and what each option is for
| Command | What it gives you |
|---|---|
powercfg /a |
Which sleep states the machine supports, and which it does not and why. Run this first |
powercfg /energy |
An energy efficiency report that flags devices and drivers behaving badly around power |
powercfg /sleepstudy |
A modern standby report covering roughly the last three days. Only meaningful on a machine actually using modern standby |
powercfg /devicequery wake_armed |
The devices currently permitted to wake the machine |
Check powercfg /a before running /sleepstudy. On a machine using S3 sleep rather than modern standby there is nothing for the sleep study to report, and an empty report is easily mistaken for a clean one.
The related power and unload bug checks
| Code | Name | What it says |
|---|---|---|
0x0000009F |
DRIVER_POWER_STATE_FAILURE | The driver is in an inconsistent or invalid power state |
0x000000A0 |
INTERNAL_POWER_ERROR | The power policy manager experienced a fatal error |
0x000000CE |
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS | A driver failed to cancel lookaside lists, DPCs or worker threads before unload |
0x0000010D |
WDF_VIOLATION | KMDF found an error in a framework-based driver; parameter 1 of 0x1 is a timeout during a power operation |
0x000000D4 |
SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD | Same failure to cancel, caught when the system accessed the driver’s former location at a raised IRQL |
Isolating it by transition
- Try each transition deliberately – sleep, hibernate, shutdown, restart – and note which ones fail. A fault on shutdown only is a different set of drivers from one on resume only.
- Turn off Fast Startup for the test. It makes shutdown a partial hibernation, so a shutdown fault and a hibernate fault become the same fault with it enabled.
- Disconnect all removable devices and retry the failing transition.
- Reintroduce devices one at a time, using the machine for a few minutes between each.
- Once the device is known, work on its driver and firmware rather than on Windows power settings.
When the dump is not conclusive
- Run
powercfg /energyfor a few minutes of idle and read the errors and warnings sections. It names devices and drivers that behave badly around power without needing a crash. - Check for a system firmware update from the machine vendor. Power transitions run through firmware, and this is one of the bug checks where a BIOS or UEFI update genuinely helps.
- Test with the machine docked and undocked if it is a laptop. A docking station adds an entire device tree to every transition.
- Keep several dumps. A device object that appears in all of them is worth more than the module
!analyzenames in one.
When a licence is the actual fix
Where the dump repeatedly names an endpoint agent’s driver in the power path, the useful question is whether that agent is still supported and still being updated. A lapsed or half-removed security product keeps its kernel driver loaded and keeps participating in every power transition, but it stops receiving the fixes that address exactly this kind of defect – so the machine can crash on shutdown against a driver the vendor patched long ago. Bitdefender GravityZone Business Security is the managed tier that keeps the agent current and lets you push a replacement build or remove it centrally rather than visiting the machine, which matters when the symptom only appears at shutdown and the user is the one who reports it. Be honest about scope, though: most 0x9F crashes are wireless, USB or firmware, and no endpoint licence touches those. Identify the driver from parameter 2 and the dump first, and buy only if the answer is an agent you cannot currently update.
Every code this article covers
| Code | What it points at | Source |
|---|---|---|
0x0000009F |
DRIVER_POWER_STATE_FAILURE: the driver is in an inconsistent or invalid power state. Parameter 1 of 0x3 means a device object has been blocking an IRP for too long, with the physical device object in parameter 2 and the blocked IRP in parameter 4 | Microsoft Learn |
0x000000A0 |
INTERNAL_POWER_ERROR: the power policy manager experienced a fatal error. Parameter 1 identifies the type of violation | Microsoft Learn |
0x000000CE |
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS: a driver failed to cancel lookaside lists, DPCs, worker threads or similar before unload | Microsoft Learn |
0x0000010D |
WDF_VIOLATION: KMDF detected an error in a framework-based driver. Parameter 1 of 0x1 is a framework driver timing out during a power operation | Microsoft Learn |
0x000000D4 |
SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD: a driver did not cancel pending operations before unloading, and the system then accessed its former location at a raised IRQL | Microsoft Learn |
Confirm the fix worked
- The transition that used to crash – sleep, hibernate or shutdown – now completes, several times in a row.
- Resume works as well as suspend. A machine that sleeps cleanly and crashes on wake has not been fixed.
powercfg /energyreports no errors against the device you were chasing.- The fix survives with Fast Startup and the device’s power management setting restored, not only with them disabled.
Questions people ask about this
Is disabling Fast Startup a fix or a workaround?
A test. It changes shutdown from a partial hibernation to a full one, so it tells you whether the fault is in the suspend path. Leaving it off permanently hides the problem rather than solving it, and the driver is still wrong.
Which parameter should I read first?
Parameter 1. It decides everything else: 0x3 gives you the physical device object and the blocked IRP, 0x2 and 0x500 point at a driver that did not call PoStartNextPowerIrp, and 0x4 is a PnP synchronisation timeout. They are different faults in different drivers.
Should I untick ‘allow the computer to turn off this device’ on everything?
For a test, yes. As a permanent configuration, no – you are disabling the feature that exposed the bug rather than fixing it, at a cost in battery life. Put the settings back one at a time once you know which device was responsible.
Why do laptops get this so much more than desktops?
Because they run the transitions constantly, and on modern standby they run directed power transitions as well – which have their own parameter 1 values, 0x5 and 0x6. A desktop that is only ever shut down exercises a fraction of the same code.
