What does NTSTATUS 0xC0000602 (STATUS_FAIL_FAST_EXCEPTION) mean?

STATUS_FAIL_FAST_EXCEPTION

The process deliberately entered the fail-fast termination path

STATUS_FAIL_FAST_EXCEPTION (0xC0000409) is used for failures that must not continue through ordinary frame-based or vectored exception handling. Windows terminates the process and can invoke Windows Error Reporting. The value was historically associated with security-check failures, but modern applications and runtime libraries use fail-fast for several invariant violations.

The subcode matters

Do not translate every 0xC0000409 into “stack buffer overrun.” Preserve the complete exception record. The first exception parameter normally identifies the fail-fast reason, and additional parameters can carry context defined by the component that raised it.

• Capture a dump at the first fail-fast event together with the exception parameters, faulting thread, stack, module versions, and preceding diagnostic events.
• In WinDbg, inspect the exception record and !analyze -v; then follow the stack to the code that invoked the fail-fast path.
• For application-controlled fail-fast calls, map the subcode or call site back to the violated program invariant rather than treating process termination itself as the root cause.

Recovery

Fix the condition that made continuation unsafe. Restarting the process can restore service temporarily, but catching unrelated exceptions, disabling security checks, or applying Explorer-specific repair steps does not resolve a general fail-fast result.

References

• Microsoft Open Specifications: NTSTATUS values
• Microsoft: RaiseFailFastException