What does NTSTATUS 0xC00000B9 (STATUS_COULD_NOT_INTERPRET) mean?

STATUS_COULD_NOT_INTERPRET

The ACL is too incomplete for the consumer to interpret safely

STATUS_COULD_NOT_INTERPRET is the opposite boundary problem from an ACL carrying unexpected excess information: the ACL does not contain the minimum information required by the parser. Because ACLs are variable-length binary objects, a truncated header or ACE can make fields such as revision, total size, ACE count, type, or ACE length unavailable or inconsistent.

The Windows ACL structure supplies the total byte count and number of ACEs, while every ACE begins with an ACE_HEADER containing an AceSize. Microsoft recommends treating the ACL as opaque and using access-control routines to manipulate it. IsValidAcl is a useful first validation step, but the failing operation may require additional semantic data beyond the minimum checked by the generic validator.

For diagnosis, capture the raw buffer and the exact byte length supplied to the security routine. Verify that the ACL header itself is present, that AclSize does not exceed the available buffer, and that each complete ACE fits before reading type-specific fields. If the ACL crossed a process, RPC, file, or custom serialization boundary, inspect that boundary first. Rebuilding the ACL from known ACE inputs is safer than trying to patch offsets in a truncated byte stream.

What to inspect

• Validate the outer buffer length before reading AclSize or beginning an ACE walk.
• Check every AceSize against the remaining bytes before interpreting an ACE-specific structure.
• Trace where the binary descriptor was serialized, copied, or truncated; a generic permissions reset can hide the producer defect.

References

• Microsoft: ACL structure
• Microsoft: ACE_HEADER structure
• Microsoft: IsValidAcl
• Microsoft: Access control lists
• Microsoft Open Specifications: NTSTATUS values

Looking for a different code? Search another status or error code.