Fix STATUS_FLT_MUST_BE_NONPAGED_POOL (0xC01C000C)

You're running Windows 10 or 11 and the machine blue screens with STATUS_FLT_MUST_BE_NONPAGED_POOL and stop code 0xC01C000C. It usually happens right after you install a new antivirus, backup agent, VPN client, or a disk encryption tool. Sometimes it only crashes when you plug in a USB drive, mount a TrueCrypt/VeraCrypt volume, or connect to a network share. The screen flashes, the machine reboots, and every subsequent boot crashes again — often before you even see the desktop.

That last detail is the giveaway. Filter drivers load very early in boot. If a bad one is in the chain, Windows can't finish starting up.

What the error actually means

Windows kernel uses two flavors of memory: paged pool and nonpaged pool. Paged pool can be swapped out to disk when the system is under memory pressure. Nonpaged pool must stay resident in RAM at all times because it can be touched when paging isn't safe — inside a DPC, at DISPATCH_LEVEL, during a page fault itself.

Filter drivers (the minifilter stack that sits between applications and the filesystem) run in exactly those contexts. When a minifilter calls something like FltAllocatePoolAlignedWithTag or ExAllocatePoolWithTag, it has to pass NonPagedPool (or the newer NonPagedPoolNx). If it asks for PagedPool instead, the kernel's filter manager notices and bug-checks with STATUS_FLT_MUST_BE_NONPAGED_POOL.

In plain English: a filter driver broke a memory rule. It's a coding bug in the driver, not something you caused with a setting. You can't fix it by tweaking the registry or adding RAM. You have to remove or update the driver.

Confirm it's a filter driver crash and find the guilty one

First, if the machine won't boot at all, hold Shift while clicking Restart from the power menu (or power-cycle three times in a row) to force the Advanced Startup menu, then pick Troubleshoot → Advanced options → Startup Settings → Restart and press 4 for Safe Mode. You don't need Safe Mode with Networking yet.

Once you're at a desktop, open an elevated Command Prompt (right-click Start, Terminal (Admin) or Command Prompt (Admin)).

Step 1 — Dump the minifilter stack

Run this and copy the output somewhere you can read:

fltmc filters
fltmc instances > %USERPROFILE%\Desktop\fltinstances.txt

You should see a list of every minifilter attached to every volume. Look at the altitudes on the left. Antivirus scanners usually sit around 320000, backup tools around 260000, encryption tools near 140000. Any third-party entry you don't recognize is a candidate.

Step 2 — Read the crash dump

The BSOD already wrote a dump to C:\Windows\Minidump\. Grab the newest .dmp file and open it with WinDbg (free from the Microsoft Store as "WinDbg"). Run:

.bugcheck
!analyze -v
lm kv

Around the STACK_TEXT section, the module name right before the filter manager frames (fltmgr.sys, FltDecodeParameters, etc.) is your culprit. It'll look like myavflt.sys, bdfileflt.sys (Bitdefender), symcfiles.sys (Symantec), klif.sys (Kaspersky), or whatever your vendor ships. Note the exact filename.

Step 3 — Disable the driver

From Safe Mode, disable it. Don't just rename the file — the service registration still tries to load it and you'll get a different error.

In an elevated prompt:

sc query type= driver state= all | findstr /i "flt"
sc config <servicename> start= disabled

If you can't figure out the service name, use Autoruns64.exe from Sysinternals. On the Drivers tab, uncheck the box next to the offending filter. Reboot.

After rebooting normally you should land on the desktop with no crash. If the driver is part of an antivirus, Windows Defender will usually re-engage automatically. That's fine.

Step 4 — Update or uninstall the source

Check the vendor's site for a newer build. This bug shows up most often in older releases — for example, certain versions of ESET Endpoint 7.x, Bitdefender 2020, and some Acronis Cyber Protect builds from 2021 all shipped with this defect and were patched. If there's no update, uninstall the product using its own uninstaller, then run the vendor's removal tool (Bitdefender, ESET, McAfee, and Symantec all publish dedicated cleanup utilities). A plain Add/Remove Programs uninstall often leaves the minifilter registered.

If it still crashes

You've disabled the visible suspect and it still bug-checks. That means either there's a second bad filter, or the file wasn't actually the problem. Try these in order:

Enable Driver Verifier on all drivers except the Microsoft ones. Run verifier /standard /all and reboot. The next crash will point at the real offender with much better stack traces. Turn it off with verifier /reset once you've found it — leaving Verifier on will tank performance.
Check for a filter in the boot-start group. Some drivers register as Boot or System start and won't show up in fltmc filters until later. Look at HKLM\SYSTEM\CurrentControlSet\Services for anything with Group = "FSFilter" or "Boot Bus Extender" and a non-Microsoft ImagePath.
Scan for a corrupted volume filter. Run chkdsk C: /f from Safe Mode if you suspect disk-level damage. Rare, but I've seen it fool people into replacing perfectly good drivers.
Consider Windows RE. If you can't get to Safe Mode at all, boot from install media, choose Repair your computer, and use Command Prompt to edit the registry offline with reg load and disable the service key directly. Tedious but it works.

The bottom line: 0xC01C000C is never a Windows bug. It's always a third-party filter driver that was written wrong. Disable it, boot clean, then update or remove the product. Nine times out of ten you're done in under an hour.