| Previous | Next |
| STATUS_FWP_INJECT_HANDLE_STALE | STATUS_FWP_DROP_NOICMP |
STATUS_FWP_CANNOT_PEND
The callout attempted to pend a classify that must complete inline
These status values come from the Windows Filtering Platform path. For STATUS_FWP_CANNOT_PEND, wFP classifies traffic through layers, filters, provider contexts, sublayers, and callouts; IPsec policy is also configured through WFP at IKE/AuthIP-related layers.
Some classify paths allow asynchronous pend/complete processing and others do not. This status means the callout attempted to defer a classification that WFP requires to finish synchronously.
For STATUS_FWP_CANNOT_PEND, for diagnostics, keep the failing API call, layer or sublayer key, provider context type, filter condition set, callout id, engine state, and whether the Base Filtering Engine, IKEEXT, TCP/IP stack, or L2 path was ready.
What to inspect
- Check the layer and classify contract before pending.
- Use inline permit/block when pending is not allowed.
- Do not treat this as packet loss; it is a callout contract violation.
References for STATUS_FWP_CANNOT_PEND
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: Windows Filtering Platform
- Microsoft: WFP error codes
Looking for a different code? Search another status or error code.