Windows error 324 (ERROR_INTERMIXED_KERNEL_EA

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: One request attempted to modify both kernel and normal extended attributes.

Could be also:
Constant	Type	OS
BUGCODE_USB3_DRIVER	BugCheck Code	Windows

Previous	Next
ERROR_DATA_CHECKSUM_ERROR	ERROR_FILE_LEVEL_TRIM_NOT_SUPPORTED

ERROR_INTERMIXED_KERNEL_EA_OPERATION

Kernel and normal EAs cannot be changed together

ERROR_INTERMIXED_KERNEL_EA_OPERATION is a Win32 result associated with low-level filesystem metadata updates. When ERROR_INTERMIXED_KERNEL_EA_OPERATION is returned, diagnosis should begin with the exact API, target object, and operation that produced it rather than with the message text alone.

What the result means

One request attempted to modify both kernel and normal extended attributes. For ERROR_INTERMIXED_KERNEL_EA_OPERATION, the practical meaning depends on the caller and on whether the affected object is local, remote, removable, policy-managed, or handled asynchronously. Diagnostics for ERROR_INTERMIXED_KERNEL_EA_OPERATION should retain its symbolic name, numeric value, and the operation name together.

What to check

Separate kernel-managed attributes from application-managed attributes.
Inspect the constructed EA list and classify each namespace correctly.
Use the documented API path for each attribute type.
Treat this as a caller contract error rather than a transient filesystem failure.

Recommended handling

Split the update into supported operations while preserving required ordering and rollback behavior. Do not simply remove unfamiliar kernel attributes from the request.

Developer notes

Code handling ERROR_INTERMIXED_KERNEL_EA_OPERATION should capture the failing API, resolved path or device identity, requested access, process identity, and the first observed error. After a call that reports ERROR_INTERMIXED_KERNEL_EA_OPERATION, read GetLastError() immediately because later cleanup or logging can overwrite the value. Retry ERROR_INTERMIXED_KERNEL_EA_OPERATION only when the specific condition is documented as transient, using a bounded delay and cancellation support.

References

Looking for a different code? Search another status or error code.