| Previous | Next |
| STATUS_BAD_DESCRIPTOR_FORMAT | STATUS_UNEXPECTED_IO_ERROR |
STATUS_INVALID_USER_BUFFER
User pointers remain a live memory-safety contract across the kernel boundary
STATUS_INVALID_USER_BUFFER is associated with failure to access a caller-supplied user buffer at a point where the kernel or driver expects such access to be recoverable and reported as status. It should direct diagnostics toward the transfer method, requestor mode, address lifetime, and exception-handling path rather than toward the payload format alone.
With METHOD_NEITHER, the I/O manager passes original user virtual addresses and performs no validation for IOCTL/FSCTL buffers. Microsoft requires drivers that touch such addresses to probe where required and protect subsequent accesses with structured exception handling. A successful probe is not a lifetime guarantee: another thread can alter mappings or protections, which is why later accesses still require protection. Filter Manager documentation gives the same warning for neither-I/O and Fast I/O user buffers.
Capture the IRP major/minor code, buffering method, requestor mode, pointer and length, current process/thread context, and the exception that led to the status. Do not cache a raw user pointer for deferred work without locking or copying it through the documented mechanism. Also verify integer arithmetic around pointer-plus-length checks; a superficially valid base address does not make an overflowing range safe.
What to inspect
- Identify whether the request uses buffered, direct, or neither I/O and where the pointer originated.
- Keep probing and every user-buffer access inside the required exception-handling discipline.
- For deferred processing, lock, map, or copy the data using the framework/DDI mechanism instead of retaining a raw address.
References
- Microsoft: Errors in referencing user-space addresses
- Microsoft: Using neither buffered nor direct I/O
- Microsoft: File-system buffer handling
- Microsoft: FLT_PARAMETERS for device control
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.