What does NTSTATUS 0xC022001C (STATUS_FWP_NULL_POINTER) mean?

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

A required WFP API pointer or typed value member is null.

Previous	Next
STATUS_FWP_INCOMPATIBLE_SA_STATE	STATUS_FWP_INVALID_ENUMERATOR

STATUS_FWP_NULL_POINTER

A tagged WFP value was declared without the storage required by its type

STATUS_FWP_NULL_POINTER occurs while the Base Filtering Engine validates an API structure before policy is installed or queried. In WFP, several values are tagged unions: the type field selects the union member and, for many members, that selected member is a pointer. A non-null top-level filter pointer does not make the nested value, range, blob, SID, or string pointer valid.

Start from the exact API call and serialize the structure boundary that crossed it. For a filter condition, record the field GUID, match type, FWP_DATA_TYPE, and the selected union member. Replacing a null with an arbitrary empty object can turn a deterministic validation error into a rule that matches traffic differently.

What to inspect

The called Fwpm* function and the first nested structure that can carry a pointer.
The FWP_DATA_TYPE tag alongside the union member actually populated.
Blob size and data pointer, range pointer, SID pointer, and string pointer when those types are used.
Object lifetime: stack storage must remain valid until the synchronous API call finishes.

References

Looking for a different code? Search another status or error code.