What does NTSTATUS 0xC0220101 (STATUS_FWP_INJECT_HANDLE_CLOSING) mean?

STATUS_FWP_INJECT_HANDLE_CLOSING

Packet injection raced with injection-handle shutdown

WFP packet injection uses handles that must outlive the injection operation. This status means another thread is closing that handle while injection is being attempted.

Trace injection-handle shutdown against outstanding injection work. Stop new injections before closing the handle and ensure asynchronous completion paths no longer reference it.

What to inspect

• Serialize injection with handle teardown.
• Stop new injections before closing the handle.
• Check callout unload, flow deletion, and driver stop paths.

References for STATUS_FWP_INJECT_HANDLE_CLOSING

• Microsoft Open Specifications: NTSTATUS values
• Microsoft: Windows Filtering Platform
• Microsoft: WFP error codes

If shutdown is intentional, wait for outstanding injection completions before releasing the final owner. A new operation should create or acquire a live handle rather than race the closing one.