[BUG] Claude Desktop App (Windows): Extreme "Other" I/O rate causes kernel nonpaged pool exhaustion

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

bug_report_claude_desktop_io.md

What Should Happen?

bug_report_claude_desktop_io.md

Error Messages/Logs

# Claude Desktop App (Windows): Extreme "Other" I/O rate causes kernel nonpaged pool exhaustion

## Summary

The Claude Desktop App main process generates ~111,000 "Other" I/O operations per second on Windows, which triggers an ntfs.sys kernel bug (NtFC pool tag CCB leak) when any minifilter driver is in the I/O path. This causes the nonpaged pool to grow at ~6 GB/hour, leading to system resource exhaustion and eventual BSOD or freeze within ~8 hours.

## Environment

- **Claude Desktop App**: v1.569.0.0 (Windows Store / MSIX, Electron)
  - Path: `C:\Program Files\WindowsApps\Claude_1.569.0.0_x64__pzs8sxrjxfjjc\app\Claude.exe`
- **Claude Code CLI**: v2.1.92 (NOT the offender — verified separately)
- **OS**: Windows 11 Pro for Workstations, Build 26200 (64-bit)
- **Hardware**: Lenovo ThinkPad P16 Gen 1, Intel i9-12900HX, 64 GB RAM
- **Security**: Bitdefender Endpoint Security Tools (6 minifilters: BdDci4, Gemma, atc, Trufos, Mrvmdk, Mrvdp)

## Reproduction

1. Install Claude Desktop App from Microsoft Store
2. Launch it (no conversation needed — idle is sufficient)
3. Have ANY minifilter-based security product active (Bitdefender, Windows Defender, CrowdStrike, etc.)
4. Monitor nonpaged pool: `(Get-Counter '\Memory\Pool Nonpaged Bytes').CounterSamples[0].CookedValue/1GB`
5. Pool grows at ~6 GB/hour until system exhaustion (~8-9 hours)

## Evidence

### The offending process

The main Electron process (PID spawned by explorer.exe) generates the I/O storm. Child processes are normal:

| Process | PID | Other ops (cumulative, ~40 min) | Role |
|---------|-----|--------------------------------|------|
| Claude.exe (Desktop, main) | 6656 | **237,501,804** | **Offender — 111K ops/sec** |
| Claude.exe (Desktop, child) | 18804 | 177,836 | Normal |
| claude.exe (CLI session) | 30448 | 28,369 | Normal |

### I/O rate measurement (10-second sample)


claude.exe PID 6656:
  Other ops/sec:  111,217
  Read ops/sec:   4
  Write ops/sec:  1


The "Other" operations are likely IPC (named pipes, memory-mapped files, or similar) — they don't show as Read or Write. The rate is ~100x higher than any other process on the system.

### Kernel pool leak

Each "Other" I/O operation triggers an NTFS CCB (Context Control Block) allocation via IRP_MJ_CREATE. When a minifilter intercepts these at high rates, ntfs.sys fails to free the CCBs, causing pool tag `NtFC` to grow unboundedly:


Tag          NP Used MB    Outstanding
--------------------------------------------
NtFC             2050.8       19200524     ← 19.2 million leaked CCBs
GVM_              131.1             47
ConT              102.0            590


### Pool leak rate


Start:  3.25 GB
End:    3.27 GB
Delta:  17.7 MB in 10s
Rate:   6.23 GB/hour


### Historical measurements

The leak rate correlates directly with claude.exe I/O throughput — fewer minifilters = less latency = faster I/O = MORE leaks:

| Configuration | Minifilters | Leak Rate |
|--------------|------------|-----------|
| Bitdefender (6 filters) | 6 BD filters | 6-12 GB/hr |
| BD uninstalled, Defender only | WdFilter only | **24.8 GB/hr** |
| BD reinstalled (current) | 6 BD filters | 6.23 GB/hr |

## Root cause analysis

There are **two bugs** interacting:

1. **Claude Desktop App** (this report): The main Electron process generates ~111K "Other" I/O operations per second. This is abnormally high and is the trigger. Normal Electron apps do not produce this I/O pattern. The operations appear to be internal IPC (not user-visible file I/O).

2. **ntfs.sys kernel bug** (to be filed with Microsoft): NTFS CCBs from IRP_MJ_CREATE are not freed when minifilter drivers intercept the I/O path at high rates. Pool tag `NtFC` grows without bound. This is a kernel defect but only manifests under extreme I/O rates that Claude Desktop uniquely produces.

## Impact

- **System becomes unusable** after ~8 hours (nonpaged pool exhaustion → Event 2004 Resource Exhaustion)
- **Affects ALL Windows users** with ANY minifilter-based security software (virtually everyone in enterprise)
- Workaround: periodic reboots or not running the Desktop App
- The Claude Code CLI (`~/.local/bin/claude.exe`) does NOT exhibit this behavior

## Requested action

Investigate why the main Electron process generates ~111K "Other" I/O operations per second. Possible causes:
- Excessive IPC between Electron main and renderer processes
- Polling loop or tight event loop generating named pipe operations
- File watcher or filesystem polling at abnormal frequency
- Memory-mapped file operations for state synchronization

Reducing the "Other" ops/sec to normal levels (~1K-5K/sec for a typical Electron app) would eliminate the kernel pool leak as a side effect.

## Diagnostic commands


# Quick nonpaged pool check
(Get-Counter '\Memory\Pool Nonpaged Bytes').CounterSamples[0].CookedValue/1GB

# 30-second leak rate measurement
$v1 = (Get-Counter '\Memory\Pool Nonpaged Bytes').CounterSamples[0].CookedValue
Start-Sleep 30
$v2 = (Get-Counter '\Memory\Pool Nonpaged Bytes').CounterSamples[0].CookedValue
"Rate: {0:N2} GB/hour" -f (($v2-$v1)/1MB/30*3600/1024)

# Per-process I/O via WMI (cumulative "Other" ops)
Get-CimInstance Win32_Process -Filter "Name LIKE 'claude%'" |
    Sort-Object OtherOperationCount -Descending |
    Select-Object Name, ProcessId, OtherOperationCount | Format-Table

# Pool tag analysis (requires admin — shows NtFC leak)
# Use poolmon.exe or NtQuerySystemInformation(SystemPoolTagInformation = 22)

# Minifilter list
fltmc

Steps to Reproduce

bug_report_claude_desktop_io.md

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.92

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

bug_report_claude_desktop_io.md