Claude Desktop (Electron) causes NTFS NonPaged Pool kernel memory leak on Windows (~0.5GB/min)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Desktop causes Windows kernel NonPaged Pool to grow at ~0.5GB/min while idle
Pool tag NtFC (ntfs.sys Create.c) — 20M+ allocations, near-zero frees
Leak stops immediately when all claude.exe processes are killed
Started after updating to latest version (Cowork update)

What Should Happen?

No leak

Error Messages/Logs

Steps to Reproduce

1. Install Claude Desktop on Windows 11
2. Open the app (no need to chat or do anything)
3. Run: "NonpagedPool: {0:N1} GB" -f ((Get-CimInstance Win32_PerfFormattedData_PerfOS_Memory).PoolNonpagedBytes / 1GB)
4. Wait 5 minutes, run again
5. NonPaged Pool grows ~0.5GB/min even while completely idle
6. Kill all claude.exe processes — growth stops immediately

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.96.

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

What we ruled out:

MCP servers (disabled both, still leaks)
Cloud code execution / VM sandbox (disabled, still leaks)
Google Drive FS driver (uninstalled, still leaks)
FACEIT anti-cheat (stopped, still leaks)
Hyper-V (disabled, still leaks)
Defender (exclusions added, still leaks)
Zombie processes (none found, all processes fresh)
Handle leaks (handles stable, only +7 in 30s)
Clear cache and restart (no effect)

Root cause: Electron's file I/O pattern triggers NTFS kernel-level NtFC allocation leak. Handles open/close normally but kernel tracking entries never free. Only full PC restart clears it.
Evidence: PoolMonX screenshots showing NtFC tag dominating NonPaged Pool.
System: Windows 11, 128GB RAM, RTX 3090

!Image
!Image