What does HRESULT 0x80290207 (TBSIMP_E_INVALID_OUTPUT_POINTER) mean?

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The pointer to the returned handle location was NULL or invalid

Previous	Next
TBSIMP_E_DUPLICATE_VHANDLE	TBSIMP_E_INVALID_PARAMETER

TBSIMP_E_INVALID_OUTPUT_POINTER

Locate the first producer

TBSIMP_E_INVALID_OUTPUT_POINTER (0x80290207) belongs to the public and internal TPM Base Services path. The base What Is page already shows the short Windows message; the additional diagnostic value is that this result marks an internal TBS call chain received no valid location in which to return a handle or result.

Data to retain

Question	Evidence for this HRESULT
What exact state was rejected?	an internal TBS call chain received no valid location in which to return a handle or result
Which layer owns the result?	The TBS client library, local RPC service and command scheduler before or around device execution.
What must be correlated?	public output arguments, RPC stub data, pointer and length pair, process bitness, application verifier evidence, and service event
What is the controlled comparison?	use a minimal caller with stable writable output storage and compare 32-bit and 64-bit behavior only if relevant

Verification sequence

The one-variable check is to use a minimal caller with stable writable output storage and compare 32-bit and 64-bit behavior only if relevant. Record the before/after state that the result command is allowed to change. If the operation can have side effects, use a disposable key, session, counter or NV index rather than production material.

Capture this result and 0x80290207 at the first code-specific return boundary.
Decode the result state: TBS function, context, pointer and buffer contract, service state, command size and nested status.
Run the result controlled comparison once and preserve both binary transcripts.
Verify the expected this result output or state transition instead of relying on absence of a UI message.

Codes that answer different questions

Comparison code	Built-in distinction
`TBSIMP_E_INVALID_PARAMETER`	One or more parameters is invalid — a separate checkpoint when compared with it.
`TBSIMP_E_TPM_ERROR`	An error occurred while communicating with the TPM — a separate checkpoint when compared with it.
`TBSIMP_E_RPC_INIT_FAILED`	The RPC subsystem could not be initialized — a separate checkpoint when compared with it.

It specifically answers whether an internal TBS call chain received no valid location in which to return a handle or result. In contrast, TBS_E_INVALID_OUTPUT_POINTER is the documented public result for this class.

Exit condition for the incident

To remediate it, repair caller memory ownership or service marshalling defects; changing TPM data cannot fix an output address. Do not restart or disable TBS before capturing its service and event data. Most caller-contract errors are reproducible without touching TPM ownership, firmware state or stored keys.

After correcting it, start with a fresh caller context where the protocol requires one, replay the original intended operation, and confirm that hardware-backed policy remains enforced.

Authoritative references

Microsoft: About TPM Base Services — source for the checkpoint.
Microsoft: TBS return codes — source for the checkpoint.
Microsoft: Tbsi_Context_Create — source for the checkpoint.
Microsoft: Tbsip_Submit_Command — source for the checkpoint.

Looking for a different code? Search another status or error code.