-
Notifications
You must be signed in to change notification settings - Fork 17.8k
[BUG] claude.exe triggers Windows BSOD via Wof.sys during directory listing (NtQueryDirectoryFileEx) #32870
Description
Preflight Checklist
- I have searched existing issues and this hasn't been reported yet
- This is a single bug report (please file separate reports for different bugs)
- I am using the latest version of Claude Code
What's Wrong?
claude.exe (Claude Code CLI) triggers a Windows kernel BSOD (Blue Screen of Death) by performing heavy NtQueryDirectoryFileEx syscalls (standard directory listing). The crash occurs in Wof.sys (Windows Overlay Filter) at WofPreDirectoryControlCallback+0x695 — a CFG (Control Flow Guard) indirect-call guard violation.
This is not an external Windows kernel bug in Wof.sys, but a Claude Code bug, due to Claude Code's intensive directory scanning, no delay in the same instant makes it a reliable trigger. Filing here so Anthropic is aware that Claude Code can crash Windows systems with this specific Wof.sys version, as well as wsl hypervisor.
Crash Statistics (all triggered by claude.exe)
| Date | BSODs | Bugcheck codes |
|---|---|---|
| 2026-03-06 | 7 | 0x139, 0x3B, 0x50, 0x10E, 0x1E, 0x14F |
| 2026-03-09 | 1 | 0x139 |
| 2026-03-10 | 5 | 0x139 (x2), 0x3B (x2), 0x1E (x1) |
| 2026-03-11 | 1 | 0x50 |
| Total | 14 | 4 distinct types at same Wof.sys +0x695 offset |
All March 9-11 crashes have identical call stack:
NtQueryDirectoryFileEx → FLTMGR → Wof!WofPreDirectoryControlCallback+0x695 → CFG guard violation
4 manifestations of the same bug — the corrupted indirect call target lands in different memory regions:
- 0x139 — CFG guard catches invalid target before execution
- 0x3B (
c0000005) — pointer escapes CFG, hits unmapped memory → access violation - 0x1E (
c0000005) — same access violation via different exception path - 0x3B (
c000001d) — pointer lands on non-code bytes → illegal instruction - 0x50 — pointer references invalid page in nonpaged pool
Affected Configuration
- Wof.sys: 10.0.26100.5074 (ships with Windows 11 25H2 build 26200)
- Compact OS: Enabled increases crash frequency, but crashes also occur with CompactOS disabled
- WOF minifilter: Attached at altitude 40700, intercepts every NTFS directory IRP
Microsoft Bug Report
Filed on Microsoft Q&A: https://learn.microsoft.com/en-us/answers/questions/5814272/wof-sys-bsod-0x139-kernel-security-check-failure-i
Potential Mitigation
Could Claude Code reduce the frequency/intensity of NtQueryDirectoryFileEx calls, or batch directory listings differently? This wouldn't fix the kernel bug, but might reduce the trigger rate on affected systems.
What Should Happen?
Claude Code should be able to perform directory listings without triggering a Windows BSOD. On systems with Wof.sys 10.0.26100.5074, the high volume of NtQueryDirectoryFileEx calls from claude.exe reliably crashes the kernel.
Ideally:
- Claude Code could throttle or batch directory enumeration on Windows to reduce the frequency of
NtQueryDirectoryFileExcalls - Or detect the vulnerable Wof.sys version and warn the user to disable Compact OS (
compact /CompactOS:never)
Error Messages/Logs
WinDbg !analyze -v output (abbreviated):
KERNEL_SECURITY_CHECK_FAILURE (139)
Arg1: 000000000000000a — indirect call guard check detected invalid control transfer
FAILURE_BUCKET_ID: 0x139_a_GUARD_ICALL_CHECK_FAILURE_Wof!WofPreDirectoryControlCallback+0x695
FAILURE_ID_HASH: {78ac0991-5393-0281-b23b-ce115373dc6d}
STACK_TEXT:
nt!KeBugCheckEx
nt!guard_icall_handler+0x1e
nt!KscpCfgDispatchUserCallTargetEsSmep+0x11
Ntfs!FindNextIndexEntry2+0x675
Ntfs!NtfsContinueIndexEnumeration+0x10e
Ntfs!NtfsQueryDirectory+0xd32
FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3fe
FLTMGR!FltPerformSynchronousIo+0x443
Wof!WofPreDirectoryControlCallback+0x695 <-- CRASH
FLTMGR!FltpPerformPreCallbacksWorker+0x58f
nt!NtQueryDirectoryFileEx+0xd8
PROCESS_NAME: claude.exe
MODULE_NAME: Wof
IMAGE_VERSION: 10.0.26100.5074
Second manifestation (0x3B at the same offset):
SYSTEM_SERVICE_EXCEPTION (3b)
ExceptionCode: c0000005 (ACCESS_VIOLATION)
FAILURE_BUCKET_ID: AV_Wof!WofPreDirectoryControlCallback+0x695
FAILURE_ID_HASH: {3ae300a6-24ac-569b-3ce2-789a00065d56}Steps to Reproduce
- Run Windows 11 25H2 (build 26200) with Wof.sys 10.0.26100.5074
- Optionally enable Compact OS:
compact /CompactOS:always(increases frequency but not required) - Run
claudein a large directory (e.g., a monorepo with many files/subdirectories) - Claude Code performs intensive directory listings via
NtQueryDirectoryFileEx - System BSODs with bugcheck 0x139 (KERNEL_SECURITY_CHECK_FAILURE) or 0x3B (SYSTEM_SERVICE_EXCEPTION)
Workaround: compact /CompactOS:never reduces frequency but does not eliminate the bug.
Environment:
- Windows 11 25H2 Build 26200.7922
- 192GB RAM, 32 cores, NVIDIA RTX 5000 Ada
- 3.8 TB disk
- Monorepo with ~100K files across nested directories
Claude Model
Opus
Is this a regression?
I don't know
Last Working Version
No response
Claude Code Version
2.1.72 (Claude Code)
Platform
Anthropic API
Operating System
Windows
Terminal/Shell
Windows Terminal
Additional Information
Minidumps & Diagnostics
Two ZIP archives with all kernel minidumps and diagnostic outputs:
- Original ZIP (Mar 9 dump) — 1x
.dmpfrom 03-09 - New ZIP (Mar 10-11 dumps) — 5x
.dmpfiles from 03-10 and 03-11
Contents: 6x .dmp files total, WinDbg analysis, system info, event logs, driver list, triage output.
Hardware Tests Performed (all clean)
- Windows Memory Diagnostic: PASSED
- Disk scan: No corruption
- SFC /scannow: No integrity violations
- DISM /RestoreHealth: Clean
- In-place upgrade, repair install from ISO: Completed (replaced all files except Wof.sys)
Why This Is a Wof.sys Bug, Not Hardware
14 crashes at the exact same instruction (WofPreDirectoryControlCallback+0x695) across 6 days, producing 4 different exception types (0x139, 0x3B, 0x1E, 0x50) at the same offset. Random memory corruption wouldn't hit the same instruction deterministically. The 4 different bugcheck codes are expected — the corrupted indirect call target lands in different memory regions each time, producing different CPU exceptions.