| Previous | Next |
| STATUS_PORT_DO_NOT_DISTURB | STATUS_DEVICE_ALREADY_ATTACHED |
STATUS_PORT_DISCONNECTED
The most likely cause of this error is a crash of the user-mode application to which the minifilter driver is connected. The minifilter driver creates a port using the FltCreateCommunicationPort function. User-mode applications connect using the FilterConnectCommunicationPort function. Further, if the application crashes, the driver may receive an error when trying to send a message to the application by calling the FltSendMessage function.
Native status interpretation for STATUS_PORT_DISCONNECTED
STATUS_PORT_DISCONNECTED is 0xC0000037, an NTSTATUS error value. AllStat describes it as “Attempt to send a message to a disconnected communication port.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the network transport or connection state produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Compare the exact port / disconnected operation on a working system and record differences in object lifetime, access token, device state, negotiated protocol, and policy.
- For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with this result.
Recovery considerations
A retry is appropriate only after the owner of this result has changed the state described by “Attempt to send a message to a disconnected communication port.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.