| Previous | Next |
| STATUS_DATA_CHECKSUM_ERROR | STATUS_TRIM_READ_ZERO_NOT_SUPPORTED |
STATUS_INTERMIXED_KERNEL_EA_OPERATION
Kernel EA and normal EA changes were combined in one operation
Windows distinguishes kernel extended attributes from normal EAs. This result prevents a single set request from modifying both classes together, which would blur the security and ownership boundary applied to kernel metadata.
The correct fix is to separate the operations and ensure that the caller is authorized for the kernel EA path. Reordering entries inside one packed list does not change the fact that two metadata classes are mixed.
What to inspect
- Identify which EA names are classified as kernel EAs by the producing component.
- Split kernel and normal updates into separate validated requests.
- Inspect filter-driver transformations that may append EAs after the original caller built the buffer.
References
- Microsoft: ZwSetEaFile
- Microsoft: FILE_FULL_EA_INFORMATION
- NTFS-3G: NTFS attributes, object IDs, DOS names and EAs
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.