What does HRESULT 0x00090364 (SEC_I_MESSAGE_FRAGMENT) mean?

SEC_I_MESSAGE_FRAGMENT

SSPI returned only a fragment of the message

SEC_I_MESSAGE_FRAGMENT is HRESULT 590692 (0x00090364) from winerror.h. The documented description is “The returned buffer is only a fragment of the message; More fragments need to be returned.” The severity bit indicates a nonfailure result, but the value carries a specific condition that must not be collapsed into plain S_OK.

In the SSPI authentication or message-protection state machine, this result means that the returned buffer is only a fragment of the message; More fragments need to be returned. The application should preserve it until it has validated the exact condition represented by this return value.

Where the status is encountered

• InitializeSecurityContext or AcceptSecurityContext loops; log the exact method and object state instead of interpreting the constant outside that contract.
• Schannel or another security package; log the exact method and object state instead of interpreting the constant outside that contract.
• Message signing, fragmentation, or asynchronous SSPI processing; log the exact method and object state instead of interpreting the constant outside that contract.

Evidence to preserve

• Preserve fragment length and offset.
• Preserve expected framing or total length.
• Preserve SecBuffer types.
• Preserve conversation and sequence identifiers.
• Preserve assembly timeout and maximum size.

What must be true before accepting it

Verify that the caller accumulates fragments according to the package framing contract without parsing incomplete data as a full token. The documented condition must be demonstrated so it is not mistaken for an unrelated success state.

Any state transition preceding it must be included in rollback, continuation, and retry planning.

Correct handling and recovery

Retain the fragment, obtain additional input or output, and call the documented SSPI routine again. Enforce size and timeout limits while assembling the complete message.

Use the code-specific next action; avoid treating all informational HRESULT values as retry signals.

Difference from nearby results

Practical scenario

A datagram security handshake yields one token fragment. The transport stores it with the conversation ID, obtains the remaining fragment, and only then advances the handshake.

References

• Microsoft: SSPI status codes — official Microsoft material relevant to this HRESULT.
• Microsoft: SSPI context semantics
• Microsoft: InitializeSecurityContext
• Microsoft: DecryptMessage
• Microsoft: HRESULT values