What does NTSTATUS 0xC0000128 (STATUS_FILE_CLOSED) mean?

 
Previous Next
STATUS_MEMBERS_PRIMARY_GROUP STATUS_TOO_MANY_THREADS

STATUS_FILE_CLOSED

The request arrived after the file object was closed

Close and cleanup are distinct stages in kernel file processing, and asynchronous work can outlive the code that initiated it. This status means the operation is no longer valid for that file object, not merely that the pathname is unavailable.

The remedy is lifetime synchronization. Reopening a file inside a completion path can hide the bug and can redirect work to a different object or security context.

What to inspect

  • Track references held by every queued or asynchronous operation.
  • Separate “no new requests” cleanup from final handle and object destruction.
  • Use cancellation and rundown protection so close waits for outstanding work to leave the file object.

References


Looking for a different code? Search another status or error code.