Skip to content

[BUG] claude.exe triggers Windows BSOD via Wof.sys during directory listing (NtQueryDirectoryFileEx) #32870

@VRDate

Description

@VRDate

Preflight Checklist

  • I have searched existing issues and this hasn't been reported yet
  • This is a single bug report (please file separate reports for different bugs)
  • I am using the latest version of Claude Code

What's Wrong?

claude.exe (Claude Code CLI) triggers a Windows kernel BSOD (Blue Screen of Death) by performing heavy NtQueryDirectoryFileEx syscalls (standard directory listing). The crash occurs in Wof.sys (Windows Overlay Filter) at WofPreDirectoryControlCallback+0x695 — a CFG (Control Flow Guard) indirect-call guard violation.

This is not an external Windows kernel bug in Wof.sys, but a Claude Code bug, due to Claude Code's intensive directory scanning, no delay in the same instant makes it a reliable trigger. Filing here so Anthropic is aware that Claude Code can crash Windows systems with this specific Wof.sys version, as well as wsl hypervisor.

Crash Statistics (all triggered by claude.exe)

Date BSODs Bugcheck codes
2026-03-06 7 0x139, 0x3B, 0x50, 0x10E, 0x1E, 0x14F
2026-03-09 1 0x139
2026-03-10 5 0x139 (x2), 0x3B (x2), 0x1E (x1)
2026-03-11 1 0x50
Total 14 4 distinct types at same Wof.sys +0x695 offset

All March 9-11 crashes have identical call stack:

NtQueryDirectoryFileEx → FLTMGR → Wof!WofPreDirectoryControlCallback+0x695 → CFG guard violation

4 manifestations of the same bug — the corrupted indirect call target lands in different memory regions:

  1. 0x139 — CFG guard catches invalid target before execution
  2. 0x3B (c0000005) — pointer escapes CFG, hits unmapped memory → access violation
  3. 0x1E (c0000005) — same access violation via different exception path
  4. 0x3B (c000001d) — pointer lands on non-code bytes → illegal instruction
  5. 0x50 — pointer references invalid page in nonpaged pool

Affected Configuration

  • Wof.sys: 10.0.26100.5074 (ships with Windows 11 25H2 build 26200)
  • Compact OS: Enabled increases crash frequency, but crashes also occur with CompactOS disabled
  • WOF minifilter: Attached at altitude 40700, intercepts every NTFS directory IRP

Microsoft Bug Report

Filed on Microsoft Q&A: https://learn.microsoft.com/en-us/answers/questions/5814272/wof-sys-bsod-0x139-kernel-security-check-failure-i

Potential Mitigation

Could Claude Code reduce the frequency/intensity of NtQueryDirectoryFileEx calls, or batch directory listings differently? This wouldn't fix the kernel bug, but might reduce the trigger rate on affected systems.

What Should Happen?

Claude Code should be able to perform directory listings without triggering a Windows BSOD. On systems with Wof.sys 10.0.26100.5074, the high volume of NtQueryDirectoryFileEx calls from claude.exe reliably crashes the kernel.

Ideally:

  1. Claude Code could throttle or batch directory enumeration on Windows to reduce the frequency of NtQueryDirectoryFileEx calls
  2. Or detect the vulnerable Wof.sys version and warn the user to disable Compact OS (compact /CompactOS:never)

Error Messages/Logs

WinDbg !analyze -v output (abbreviated):

KERNEL_SECURITY_CHECK_FAILURE (139)
  Arg1: 000000000000000a — indirect call guard check detected invalid control transfer
FAILURE_BUCKET_ID: 0x139_a_GUARD_ICALL_CHECK_FAILURE_Wof!WofPreDirectoryControlCallback+0x695
FAILURE_ID_HASH: {78ac0991-5393-0281-b23b-ce115373dc6d}

STACK_TEXT:
  nt!KeBugCheckEx
  nt!guard_icall_handler+0x1e
  nt!KscpCfgDispatchUserCallTargetEsSmep+0x11
  Ntfs!FindNextIndexEntry2+0x675
  Ntfs!NtfsContinueIndexEnumeration+0x10e
  Ntfs!NtfsQueryDirectory+0xd32
  FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3fe
  FLTMGR!FltPerformSynchronousIo+0x443
  Wof!WofPreDirectoryControlCallback+0x695    <-- CRASH
  FLTMGR!FltpPerformPreCallbacksWorker+0x58f
  nt!NtQueryDirectoryFileEx+0xd8

PROCESS_NAME: claude.exe
MODULE_NAME: Wof
IMAGE_VERSION: 10.0.26100.5074

Second manifestation (0x3B at the same offset):
SYSTEM_SERVICE_EXCEPTION (3b)
  ExceptionCode: c0000005 (ACCESS_VIOLATION)
FAILURE_BUCKET_ID: AV_Wof!WofPreDirectoryControlCallback+0x695
FAILURE_ID_HASH: {3ae300a6-24ac-569b-3ce2-789a00065d56}

Steps to Reproduce

  1. Run Windows 11 25H2 (build 26200) with Wof.sys 10.0.26100.5074
  2. Optionally enable Compact OS: compact /CompactOS:always (increases frequency but not required)
  3. Run claude in a large directory (e.g., a monorepo with many files/subdirectories)
  4. Claude Code performs intensive directory listings via NtQueryDirectoryFileEx
  5. System BSODs with bugcheck 0x139 (KERNEL_SECURITY_CHECK_FAILURE) or 0x3B (SYSTEM_SERVICE_EXCEPTION)

Workaround: compact /CompactOS:never reduces frequency but does not eliminate the bug.

Environment:

  • Windows 11 25H2 Build 26200.7922
  • 192GB RAM, 32 cores, NVIDIA RTX 5000 Ada
  • 3.8 TB disk
  • Monorepo with ~100K files across nested directories

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

2.1.72 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

Minidumps & Diagnostics

Two ZIP archives with all kernel minidumps and diagnostic outputs:

  1. Original ZIP (Mar 9 dump) — 1x .dmp from 03-09
  2. New ZIP (Mar 10-11 dumps) — 5x .dmp files from 03-10 and 03-11

Contents: 6x .dmp files total, WinDbg analysis, system info, event logs, driver list, triage output.

Hardware Tests Performed (all clean)

  • Windows Memory Diagnostic: PASSED
  • Disk scan: No corruption
  • SFC /scannow: No integrity violations
  • DISM /RestoreHealth: Clean
  • In-place upgrade, repair install from ISO: Completed (replaced all files except Wof.sys)

Why This Is a Wof.sys Bug, Not Hardware

14 crashes at the exact same instruction (WofPreDirectoryControlCallback+0x695) across 6 days, producing 4 different exception types (0x139, 0x3B, 0x1E, 0x50) at the same offset. Random memory corruption wouldn't hit the same instruction deterministically. The 4 different bugcheck codes are expected — the corrupted indirect call target lands in different memory regions each time, producing different CPU exceptions.

Microsoft Q&A Thread

https://learn.microsoft.com/en-us/answers/questions/5814272/wof-sys-bsod-0x139-kernel-security-check-failure-i

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingexternalhas reproHas detailed reproduction stepsplatform:windowsIssue specifically occurs on Windows

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions