What does HRESULT 0x00090368 (SEC_I_ASYNC_CALL_PENDING) mean?

SEC_I_ASYNC_CALL_PENDING

Asynchronous SSPI work is pending

SEC_I_ASYNC_CALL_PENDING is HRESULT 590696 (0x00090368) from winerror.h. The documented description is “An asynchronous SSPI routine has been called and the work is pending completion.” The severity bit indicates a nonfailure result, but the value carries a specific condition that must not be collapsed into plain S_OK.

In the SSPI authentication or message-protection state machine, this result means that an asynchronous SSPI routine has been called and the work is pending completion. The high-level request can be considered complete after it only when its documented postcondition has been checked.

Where the status is encountered

• InitializeSecurityContext or AcceptSecurityContext loops; log the exact method and object state instead of interpreting the constant outside that contract.
• Schannel or another security package; log the exact method and object state instead of interpreting the constant outside that contract.
• Message signing, fragmentation, or asynchronous SSPI processing; log the exact method and object state instead of interpreting the constant outside that contract.

What must be true before accepting it

Verify that the callback or completion object remains valid and no caller consumes outputs before the package completes the operation. The verification prevents it from being promoted to broader success than the producing API promised.

Evidence to preserve

• Preserve async call identifier.
• Preserve credential and context handles.
• Preserve input and output SecBuffers.
• Preserve completion callback state.
• Preserve final status and cancellation result.

Difference from nearby results

The nearby-status comparison controls whether outputs are usable and whether more work is expected.

Correct handling and recovery

Keep credentials, context, buffers, and completion state alive. Observe the async completion, handle cancellation once, and use the final security status rather than this interim value.

Retry policy must follow the owning state machine rather than a generic transient-error loop.

Practical scenario

An asynchronous credential operation returns pending. The server retains the context and request buffers, then resumes the handshake from the completion callback.

References

• Microsoft: SSPI status codes — official Microsoft material relevant to this HRESULT.
• Microsoft: SSPI context semantics
• Microsoft: InitializeSecurityContext
• Microsoft: DecryptMessage
• Microsoft: HRESULT values