[blirio]

So is unmapped address another way of saying null pointer?

[leeter]

No this is kernelspace, an so while all addresses are 'virtual' an unmapped address is an address that hasn't been mapped in the page tables. Normally critical kernel drivers and data are marked as non-pagable (note: The Linux Kernel doesn't page, NTKernel does a legacy of when it was first written and memory constraints of the time). So if a driver needs to access pagable data it must not be part of the storage flow (and Crowdstrike is almost certainly part of it), and at the correct IRQL (the Interrupt priority level, anything above dispatch, AKA the scheduler, has severe restraints on what can happen there).

So no an unmapped address is a completely different BSOD, usually PAGE_FAULT_IN_UNPAGED_AREA which is a very bad sign

[jkrejcha]

PAGE_FAULT_IN_NONPAGED_AREA[1]... was the BSOD that occurred in this case. That's basically the first sign that it was a bad pointer dereference in the first place.

(DRIVER_)IRQL_NOT_LESS_OR_EQUAL[2][3] is not this case, but it's probably one of the most common reasons drivers crash the system generally. Like you said it's basically attempting to access pageable memory at a time that paging isn't allowed (i.e. when at DISPATCH_LEVEL or higher).

[1]: https://learn.microsoft.com/en-us/windows-hardware/drivers/d...

[2]: https://learn.microsoft.com/en-us/windows-hardware/drivers/d...

[3]: https://learn.microsoft.com/en-us/windows-hardware/drivers/d...

[saagarjha]

It seems unlikely that it's a null pointer: https://twitter.com/taviso/status/1814762302337654829

[loeg]

No; lots of virtual addresses are not mapped. Null is a subset of all unmapped addresses.

[two_handfuls]

It’s an invalid pointer yes, but it doesn’t say whether it’s null specifically.

[cratermoon]

Looks like a null pointer error to me https://www.youtube.com/watch?v=pCxvyIx922A

[blirio]

Oh wait, I just remembered null is normally 0 in C and C++. So probably not that if it is not 0.