{"record":{"id":"2b2cffd9a8e228f1","repo":"wavetermdev/waveterm","slug":"procinfo-process32next-w","errorCode":null,"errorMessage":"procinfo: Process32Next: %w","messagePattern":"procinfo: Process32Next: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/util/procinfo/procinfo_windows.go","lineNumber":72,"sourceCode":"\n\tvar entry windows.ProcessEntry32\n\tentry.Size = uint32(unsafe.Sizeof(entry))\n\n\tif err := windows.Process32First(snap, &entry); err != nil {\n\t\treturn nil, fmt.Errorf(\"procinfo: Process32First: %w\", err)\n\t}\n\tfor {\n\t\tpid := int32(entry.ProcessID)\n\t\tprocs[pid] = &snapInfo{\n\t\t\tppid:       entry.ParentProcessID,\n\t\t\tnumThreads: entry.Threads,\n\t\t\texeName:    windows.UTF16ToString(entry.ExeFile[:]),\n\t\t}\n\t\tif err := windows.Process32Next(snap, &entry); err != nil {\n\t\t\tif errors.Is(err, windows.ERROR_NO_MORE_FILES) {\n\t\t\t\tbreak\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"procinfo: Process32Next: %w\", err)\n\t\t}\n\t}\n\n\treturn &windowsSnapshot{procs: procs}, nil\n}\n\n// GetProcInfo returns a ProcInfo for the given pid.\n// snap must be a non-nil value returned by MakeGlobalSnapshot.\n// Returns nil, nil if the pid is not present in the snapshot.\nfunc GetProcInfo(_ context.Context, snap any, pid int32) (*ProcInfo, error) {\n\tif snap == nil {\n\t\treturn nil, fmt.Errorf(\"procinfo: GetProcInfo requires a snapshot on windows\")\n\t}\n\tws, ok := snap.(*windowsSnapshot)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"procinfo: invalid snapshot type\")\n\t}\n\tsi, found := ws.procs[pid]","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/wavetermdev/waveterm/blob/a4447c1563b2df285ab89e76c82f91e1a1a49c1e/pkg/util/procinfo/procinfo_windows.go#L54-L90","documentation":"During snapshot iteration, Process32Next advances to the next process entry; ERROR_NO_MORE_FILES is the expected clean end of iteration and breaks the loop, but any other error is wrapped in this error. It means iteration aborted mid-scan and the returned snapshot would be incomplete, so it is discarded.","triggerScenarios":"MakeGlobalSnapshot when windows.Process32Next returns an error other than windows.ERROR_NO_MORE_FILES — typically ERROR_ACCESS_DENIED from EDR/AV interference or a corrupted snapshot handle mid-iteration.","commonSituations":"Security software terminating snapshot enumeration; processes churning so fast the snapshot handle becomes invalid; handle corruption in long-running services making thousands of snapshots.","solutions":["Confirm the wrapped error is not ERROR_NO_MORE_FILES (library already filters that as normal termination)","Retry MakeGlobalSnapshot — most mid-iteration failures are transient","Check EDR/AV logs for interference with toolhelp32 APIs and whitelist the binary","Close other snapshot handles promptly; avoid holding many snapshots concurrently"],"exampleFix":"// after (caller tolerance for partial failures)\nsnap, err := procinfo.MakeGlobalSnapshot()\nif err != nil {\n\tif strings.Contains(err.Error(), \"Process32Next\") {\n\t\tlog.Warn(\"partial snapshot failure, retrying\", \"err\", err)\n\t\tsnap, err = procinfo.MakeGlobalSnapshot()\n\t}\n\tif err != nil {\n\t\treturn err\n\t}\n}","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"snap, err := procinfo.MakeGlobalSnapshot()\nif err != nil {\n\tif strings.Contains(err.Error(), \"Process32Next\") {\n\t\tsnap, err = procinfo.MakeGlobalSnapshot()\n\t}\n\tif err != nil { return err }\n}","preventionTips":["Whitelist your binary with EDR/AV products that hook toolhelp APIs","Retry enumeration when mid-iteration errors occur","Close snapshots promptly; avoid holding many concurrently","Log the wrapped error code to distinguish access-denied from corruption"],"tags":["windows","syscall","process-enumeration"],"backgroundTag":"toolhelp-snapshot-failed","analyzedSha":"a4447c1563b2df285ab89e76c82f91e1a1a49c1e","analyzedAt":"2026-09-01T15:26:23.972Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}