STATUS_INSUFFICIENT_RESOURCES (0XC000009A) Fix

The 30-Second Fix: Reboot and Check for a Known Driver

If you just saw error 0xC000009A — whether it's a crash, a failed application launch, or a file copy that bombed — the fastest thing to try is a full reboot. Not a shutdown with fast startup (that's a hybrid shutdown), but a real restart. Go to Start > Power > Restart. Hold Shift while clicking Restart to force a full boot if you're paranoid.

What's actually happening here is that the non-paged pool — a region of kernel memory that can't be written to disk — has been exhausted. Rebooting clears it entirely. If the error doesn't come back for hours, you're probably fine. But if it returns within minutes, you've got a leak.

Common culprits that trigger this fast: Broadcom network drivers (especially the old b57nd60x.sys), certain Realtek audio drivers, and Killer Networking drivers. If you see Event ID 2019 in the System log (Event Viewer > Windows Logs > System), that's a dead giveaway for a non-paged pool leak.

The 5-Minute Fix: Identify the Leaking Driver with Poolmon

Skip the generic advice about closing browser tabs — that's paged pool, not non-paged. The real fix is finding what driver is eating kernel memory. Here's how:

1. Download Poolmon from Microsoft Sysinternals (part of the Windows Sysinternals Suite). You can get poolmon.exe alone if you want.
2. Run Command Prompt as Administrator.
3. Navigate to where you put poolmon.exe and run: poolmon.exe /b /p /n

This shows the non-paged pool (the /n flag) sorted by bytes used (/b), paused so you can read it (/p). You'll see columns like Tag, Bytes, Allocs, Frees. The Diff column is key — a positive number means allocations aren't being freed. That's your leak.

The reason step 3 works is that pool tags are 4-character identifiers assigned by driver developers. For example, CM25 is common from Conexant audio drivers, MmLd is memory manager load, NtFs is file system. If you see a tag growing without bound, google that tag + "pool leak" to find the exact driver.

Write down the tag name. Then run poolmon.exe /c [tag] to filter on just that tag and watch it grow in real time.

Once you know the tag, open Device Manager, find devices by manufacturer that match, and update or roll back the driver. For instance, if the tag is CM25, look for anything Conexant under Sound, video and game controllers. Right-click > Properties > Driver > Update driver or Roll Back driver.

The 15+ Minute Fix: Manual Pool Usage Analysis and Registry Tweak

If poolmon didn't catch it, or the leak is intermittent, you need to dig deeper. This is the advanced path — don't do this unless you're comfortable with kernel debugging or registry editing.

Step 1: Enable Pool Tagging

By default, Windows only tracks pool tags when driver verifier or pool tagging is on. To make poolmon show useful data for leaked memory:

1. Open Command Prompt as Administrator.
2. Run gflags.exe /p /enable * /full — this enables pool tagging globally. Yes, this will slow down your system slightly because every allocation gets tagged.
3. Restart.
4. Reproduce the issue, then run poolmon again as described above.

If you don't want the full performance hit, target specific processes: gflags.exe /p /enable notepad.exe /full but you probably don't know the process. Stick with global for troubleshooting.

Step 2: Increase Non-Paged Pool Size (Last Resort)

This doesn't fix the leak, but it buys time. Non-paged pool is limited by physical RAM and system commit limit. On 64-bit systems, the default max is 75% of physical RAM. You can bump it via registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

Create a DWORD (32-bit) called PoolUsageMaximum and set it to 80 (decimal) — that's 80% instead of the default 60%. Then create PagedPoolSize as a DWORD with value 0xFFFFFFFF to set it to auto-calculated max. Restart.

What's actually happening here is you're telling the memory manager to allow more kernel allocations before failing. The risk: if a driver has an unbounded leak, you'll eventually crash from pool exhaustion anyway. This is a band-aid, not a cure.

Step 3: Driver Verifier for Persistent Leaks

If the error keeps coming back even after updating all drivers, use Driver Verifier to force crash on pool violation:

1. Run verifier.exe as Administrator.
2. Select Create custom settings (for code developers) > Next.
3. Check Special pool and Pool tracking.
4. Select Select driver names from a list.
5. Sort by provider — start with 3rd-party drivers (not Microsoft). Select 3-5 suspect ones.
6. Finish, restart.

Now when the system hits the leak, it'll bugcheck (BSOD) with a stop code like DRIVER_POOL_HEADER, and the crash dump will point to the exact driver. Analyze with WinDbg or BlueScreenView.

Remember: after you finish, disable Driver Verifier by running verifier.exe /reset and restart. Leaving it on permanently kills performance.

What If None of This Works?

If you've done all three and the error still appears, the problem is either hardware (faulty RAM — run MemTest86 for 8+ passes) or a corrupted system file. Run sfc /scannow then dism /online /cleanup-image /restorehealth in that order. If that doesn't help, consider a repair install using Windows Media Creation Tool — it replaces system files without touching your apps.

One last thing: some antivirus software (especially McAfee and certain versions of Norton) hook kernel-level callbacks and can eat non-paged pool. Temporarily uninstall, not disable, to test.