What does NTSTATUS 0xC01C0002 (STATUS_FLT_CONTEXT_ALREADY_DEFINED) mean?

 
Previous Next
STATUS_FLT_NO_HANDLER_DEFINED STATUS_FLT_INVALID_ASYNCHRONOUS_REQUEST

STATUS_FLT_CONTEXT_ALREADY_DEFINED

A minifilter context stores state on a file, stream, stream handle, volume, instance, or transaction. This status commonly results from requesting FLT_SET_CONTEXT_KEEP_IF_EXISTS: the target already has a context for this minifilter instance, and Filter Manager deliberately leaves that existing context in place.

It is different from STATUS_FLT_CONTEXT_ALREADY_LINKED. Here the target object already owns the relevant context slot; in the linked case, the new context object is already attached somewhere else. When a caller asks for the old context, it must also obey the documented reference-count ownership rules.

How to handle it

  • Decide whether keeping the first context is the intended race policy or whether replacement is required.
  • Retrieve and validate the existing context instead of allocating duplicate per-object state.
  • Release every acquired context reference on all paths, including this one.

FltSetStreamContext | Managing minifilter contexts | NTSTATUS reference


Looking for a different code? Search another status or error code.