Why does MemTotal in /proc/meminfo change?

That should never change. It could be an indication of some faulty locations within RAM. You can diagnose your RAM using Memtest86+.

Other than that the only other way that number would change might be if you were analyzing a virtual machine guest. Perhaps the host the VM guest is running on is adjusting the RAM allocated to the guest.

Edit #1

I did dig up this forum post which discusses the potential leaking of memory by Kernel modules which could lead to the MemTotal changing.

excerpt from: Re: How do you determine the amount of system memory?

On 7/30/08, Bill McGonigle wrote:

On Jul 30, 2008, at 10:03, Thomas Charron wrote:

MemTotal can change. MemTotal doesn't show memory utilized by the kernel binaries themselves in memory, however there are situations where modules can leak memory which also removes from MemTotal. I don't recall the specifics of this happening, but I do know what Paul is talking about now. Well, that's only a bug if you define MemTotal as the physical memory present in a machine. If you view it as total memory available to the kernel, it's performing correctly, right?

Yes, and the 'bug' is when that number goes down, it means somethings leaking, aka, a 'bad kernel'. At least potentially 'bad' (read potentially buggy) kernel modules.

I was not comfortable with having bug in kernel or a module, so I digged further and found out... that MemTotal can regularly change, downwards, or upwards. It is not a constant and this value is definitely modified by kernel code on many places, under various circumstances.

E.g. virtio_balloon kmod can decrease MemTotal as well as increase it back again. Then of course, mm/memory_hotplug.c is exporting [add|remove]_memory, both of which are used by lot of drivers too.