| Previous | Next |
| STATUS_CALLBACK_RETURNED_WHILE_IMPERSONATING | STATUS_PROCESS_IS_PROTECTED |
STATUS_APC_RETURNED_WHILE_IMPERSONATING
The APC left a pooled worker impersonating a client
An APC executes in the context of its target thread and can therefore alter that thread’s impersonation token. When the target is a reusable thread-pool worker, failing to revert before the APC returns leaks the security context into whichever callback the pool dispatches next.
APC code is especially easy to overlook because it is not the ordinary callback body. Cleanup must cover APC exceptions, nested alertable waits, and cancellation paths. The component that queued the APC should not assume the surrounding callback will restore state it did not establish.
What to inspect
- Identify the APC routine, queueing component, target worker, and token state before and after APC delivery.
- Use guaranteed cleanup inside the APC itself to restore impersonation.
- Avoid alertable waits inside impersonating APC routines because nested APC dispatch complicates state ownership.
- Treat a revert failure as a worker-corruption event and prevent that thread from returning to normal pooled work.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: QueueUserAPC
- Microsoft: Asynchronous Procedure Calls
- Microsoft: RevertToSelf
Looking for a different code? Search another status or error code.