| Previous | Next |
| TBS_E_BAD_PARAMETER | TBS_E_INVALID_CONTEXT |
TBS_E_INVALID_OUTPUT_POINTER
Interpret the boundary first
TBS_E_INVALID_OUTPUT_POINTER (0x80284003) belongs to the public and internal TPM Base Services path. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks the public TBS call cannot write its required result because an output pointer is null, invalid or not writable.
The first producer to identify for it is the TBS client library, local RPC service and command scheduler before or around device execution. TBS centralizes TPM access through a local RPC service. A failure can therefore occur in the caller contract, RPC/service startup, scheduling, buffer handling or TPM submission, and each layer requires different evidence.
Build the command transcript
| Question | Evidence for it |
|---|---|
| What exact state was rejected? | the public TBS call cannot write its required result because an output pointer is null, invalid or not writable |
| Which layer owns the result? | The TBS client library, local RPC service and command scheduler before or around device execution. |
| What must be correlated? | function signature, pointer value, caller buffer lifetime, pcbResult or size pointer, process bitness, and exception or verifier data |
| What is the controlled comparison? | use a stack or heap buffer with explicit lifetime and a valid size variable in a minimal call |
Separate caller data from platform state. The result caller data includes the command, structures, lengths, handles and flags; platform state includes TPM generation, provisioning, locality, lockout, resource inventory, firmware and the TBS service lifecycle. This result is actionable only after the rejected side is identified.
Test one hypothesis
Use the following verification sequence:
- Capture the unmodified failing input and
0x80284003. - Use a stack or heap buffer with explicit lifetime and a valid size variable in a minimal call.
- Compare the first result divergent field or state transition.
- Repeat this result only after restoring the same baseline, with a bounded retry policy where the specification permits retry.
Do not merge these conditions
| Other code | Why a different remedy follows |
|---|---|
TBS_E_INVALID_CONTEXT | The specified context handle does not refer to a valid context — a separate checkpoint when compared with this result. |
TBS_E_BAD_PARAMETER | One or more input parameters is bad — a separate checkpoint when compared with it. |
TBS_E_INSUFFICIENT_BUFFER | A specified output buffer is too small — a separate checkpoint when compared with it. |
TBS_E_INSUFFICIENT_BUFFER means the output pointer is usable but its capacity is too small. The result difference determines whether to change serialization, authorization, resource lifetime, firmware/PPI state, command policy or only retry timing.
A safe recovery path
Correct the original boundary by choosing this direction: repair pointer ownership and writable buffer lifetime; no TPM reset can correct an invalid caller address. Do not restart or disable TBS before capturing its service and event data. Most caller-contract errors are reproducible without touching TPM ownership, firmware state or stored keys.
A successful it outcome preserves the intended hardware trust boundary, passes the original request, and produces verifiable output. Masking it, swallowing this HRESULT or switching silently to a software provider is not remediation.
References used for this checkpoint
- Microsoft: About TPM Base Services — source for the checkpoint.
- Microsoft: TBS return codes — source for the checkpoint.
- Microsoft: Tbsi_Context_Create — source for the checkpoint.
- Microsoft: Tbsip_Submit_Command — source for the checkpoint.
Looking for a different code? Search another status or error code.