[BUG] Claude Code sessions cause Windows kernel BSODs (0x139, 0x1E, 0x50) — not application crashes, full OS crashes requiring hard reboot

Workaround: Run Claude Code in WSL to avoid Wof.sys BSOD

Full writeup: https://gist.github.com/VRDate/862268b57dd197b8775f893a7be1e548

---

Claude Code BSOD Workaround — Wof.sys Crash on Windows 11 Build 26200+

Problem

Claude Code triggers BSOD (Blue Screen of Death) on Windows 11 Build 26200+ during normal operation. The crash occurs in Wof.sys (Windows Overlay Filter) when Claude's filesystem operations call NtQueryDirectoryFileEx, which passes through the WOF minifilter and hits a CFG (Control Flow Guard) violation.

Bugcheck codes: 0x139 (KERNEL_SECURITY_CHECK_FAILURE), 0x3B, 0x1E, 0x50

Faulting module: Wof.sys 10.0.26100.5074 at WofPreDirectoryControlCallback+0x695

Trigger: Any filesystem-heavy operation — directory listing, file search, glob patterns — the kind of thing Claude Code does constantly.

Bug reports:

• Feedback Hub
• claude-code #32870 — "Claude Code triggers Wof.sys BSOD on Windows 11 Build 26200"
• claude-code #30137
• MS Q&A #5814272

Root Cause

This is a Windows kernel bug, not a Claude Code bug. Wof.sys (Windows Overlay Filter) handles WIM-backed files and CompactOS compression. When Claude Code (or any process) makes rapid NtQueryDirectoryFileEx calls on NTFS volumes, the WOF minifilter crashes in its directory control callback. CompactOS ON/OFF makes no difference — the bug is in the minifilter code path itself.

WOF is a critical Windows component — it cannot be disabled, detached, or unloaded without breaking Windows.

Workaround: Run Claude Code in WSL

Since the crash only happens on NTFS (Windows filesystem), running Claude Code inside WSL2 (which uses ext4) completely bypasses the Wof.sys code path.

Setup (5 minutes)

Prerequisites: WSL2 with Ubuntu (from Microsoft Store).

# 1. Install Ubuntu from MS Store (if not already)
wsl --install Ubuntu-24.04

# 2. Install Node.js inside WSL
wsl -d Ubuntu-24.04 -u root -- bash -c '
  curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
  apt install -y nodejs
'

# 3. Install Claude Code inside WSL
wsl -d Ubuntu-24.04 -u root -- npm install -g @anthropic-ai/claude-code

# 4. Verify
wsl -d Ubuntu-24.04 -u root -- claude --version

Create the wrapper

Create claude.cmd in the same directory as claude.exe (typically %USERPROFILE%\.local\bin\):

@echo off
wsl -d Ubuntu-24.04 -u root -- claude %*

On Windows, .cmd takes priority over .exe in the same directory. Every claude invocation from cmd.exe, PowerShell, or Windows Terminal now goes through WSL automatically.

How it works

BEFORE (crashes):
  Windows cmd/terminal
    → claude.exe (Windows native)
      → NtQueryDirectoryFileEx on NTFS
        → Wof.sys minifilter → BSOD

AFTER (safe):
  Windows cmd/terminal
    → claude.cmd (wrapper)
      → wsl -- claude (runs in WSL)
        → ext4 filesystem (no Wof.sys)
        → /mnt/c/ for Windows files (read/write, no WOF callback)

Your project files stay on C:\ — Claude in WSL accesses them via /mnt/c/. Your IDE (VS Code, IntelliJ, etc.) runs on Windows watching the same files. No file duplication needed.

Reverting

When Microsoft patches Wof.sys, simply delete the wrapper:

del %USERPROFILE%\.local\bin\claude.cmd

Claude will fall back to claude.exe (Windows native).

What doesn't work

| Attempted fix | Result |
|---------------|--------|
| Disable CompactOS (compact /compactos:never) | Still crashes |
| Windows Update (KB5079473) | Did not update Wof.sys |
| Norton AV exclusions | Unrelated (separate nllNetHub.sys crash) |
| Disabling WOF service | DO NOT — breaks Windows |

Affected versions

• Windows: Build 26200+ (Windows 11 24H2 Insider/Dev)
• Wof.sys: 10.0.26100.5074 (unchanged across updates)
• Claude Code: All versions (the bug is in the OS, not Claude)
• Also affects: Any process making rapid filesystem directory queries (not Claude-specific)

Timeline

| Date | Event |
|------|-------|
| 2026-03-06 | First BSODs after Windows upgrade to Build 26200 |
| 2026-03-06 | 7 crashes in one day |
| 2026-03-12 | Feedback Hub report filed, GitHub issues opened |
| 2026-03-14 | WSL workaround deployed, 21 total crashes logged |
| TBD | Microsoft Wof.sys patch |

Update from issue #32870 — root cause proven, workaround available

Root cause: concurrent unthrottled filesystem tool calls from multiple Claude Code agents overwhelm Wof.sys WofPreDirectoryControlCallback on Windows 11 Build 26200+. 23 BSODs logged.

Workaround: a "traffic light" server (JBang Kotlin) that serializes agent tool calls via a PreToolUse hook. Tested: 5 agents with traffic light = stable (381 tool calls). Without = BSOD in minutes.

Full writeup + code + repro kit: https://gist.github.com/VRDate/862268b57dd197b8775f893a7be1e548

Minidumps + proof: https://drive.google.com/file/d/1bnn5LPNy_ygehdc2zy2QayZ0dyt-pKqc/view?usp=sharing

Experienced a complete system deadlock on Windows 10 with Claude Code v2.1.76 (Opus 4.6, 1M context).

Symptoms:

• System did not BSOD — no crash, no blue screen
• Windows stayed visually responsive — could switch between windows
• Keyboard completely stopped working — no input accepted anywhere
• Could not reboot gracefully — Ctrl+Alt+Del, Start menu, nothing responded to keyboard
• Only recovery: hard power-off (holding power button)

Environment:

• Windows 10 Home 10.0.19045
• Claude Code v2.1.76, Opus 4.6 with 1M context (just enabled)
• GoLand IDE with Claude Code plugin
• 40 GB RAM, WD SN740 512GB SSD

Context:

• This is a recurring issue — we first reported it in December 2025 as #14674 (system freeze with 2+ GoLand instances + Claude Code), which was auto-closed and locked by the bot
• Had not occurred for several weeks, but returned on v2.1.76 with 1M context enabled
• The freeze pattern is different from BSOD (#30137, #32870) — it's a deadlock, not a kernel crash

Previously reported: #14674 (closed/locked by bot without any team response)
Related root cause analysis: #33949

Update from #32870 — 25 BSODs, root cause reframed

Not a Wof.sys bug — Claude Code CLI misuse of the OS. The model fires parallel filesystem tool calls (Glob, Grep, Read, Bash find) with zero backpressure. 6 operations in 1 second against a 200K-file monorepo = instant BSOD.

Proof: I built a rate-limiting mutex daemon (PreToolUse hook, serializes calls with 15-100ms delay). Ran stable for 3 days with 0 BSODs. Took daemon offline for v2 development → 2 BSODs within hours.

The fix: Claude Code needs a built-in 15-100ms delay between filesystem tool calls. This is a CLI architecture issue, not a Windows kernel bug. Sub-agents spawned via the Agent tool also bypass PreToolUse hooks entirely — structural gap.

25 BSODs in 12 days. Full details + workaround: https://gist.github.com/VRDate/862268b57dd197b8775f893a7be1e548

Also relevant to @kolkov's system deadlock above — same root cause (unthrottled parallel I/O), different symptom.

Fix submitted: PR #35710

This is the same root cause as #32870 — parallel filesystem tool calls overwhelming Wof.sys.

A tool-mutex plugin fix has been submitted as PR #35710. The plugin adds a file-based counting semaphore that serializes concurrent filesystem operations, preventing the kernel driver overload that causes BSOD.

See #32870 for full crash analysis (27 BSODs, 9 bugcheck types, memory dump analysis).

Closing for now — inactive for too long. Please open a new issue if this is still relevant.

Closed?!

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.