{"record":{"id":"8063724f25cbcfec","repo":"can1357/oh-my-pi","slug":"truncated-ntquerydirectoryfile-record","errorCode":null,"errorMessage":"truncated NtQueryDirectoryFile record","messagePattern":"truncated NtQueryDirectoryFile record","errorType":"error_code","errorClass":"io::Error","httpStatus":null,"severity":"error","filePath":"crates/pi-walker/src/lib.rs","lineNumber":4153,"sourceCode":"\tfn file_type_from_attributes(attributes: u32) -> Option<FileType> {\n\t\tif attributes & FILE_ATTRIBUTE_REPARSE_POINT != 0 {\n\t\t\tSome(FileType::Symlink)\n\t\t} else if attributes & FILE_ATTRIBUTE_DIRECTORY != 0 {\n\t\t\tSome(FileType::Dir)\n\t\t} else {\n\t\t\tSome(FileType::File)\n\t\t}\n\t}\n\n\tfn mtime_from_filetime(filetime: i64) -> Option<f64> {\n\t\tlet ticks = filetime.checked_sub(UNIX_EPOCH_AS_FILETIME)?;\n\t\tlet seconds = ticks / WINDOWS_TICK;\n\t\tlet nanos = (ticks % WINDOWS_TICK) * 100;\n\t\tmtime_millis(seconds, nanos)\n\t}\n\n\tfn invalid_data(message: &'static str) -> io::Error {\n\t\tio::Error::new(io::ErrorKind::InvalidData, message)\n\t}\n}\n\n#[cfg(not(any(target_os = \"macos\", target_os = \"linux\", target_os = \"windows\")))]\nmod platform {\n\tuse std::{borrow::Cow, io, path::Path};\n\n\tuse super::{FileType, RawDirEntry, ReadDirControl, ReadDirError, WalkDetail, WalkError};\n\n\tpub const CHEAP_SIZE_HINTS: bool = false;\n\n\tpub fn read_dir_entries<F, E>(\n\t\tpath: &Path,\n\t\tdetail: WalkDetail,\n\t\t_buffer: &mut Vec<u8>,\n\t\tmut emit: F,\n\t) -> std::result::Result<ReadDirControl, ReadDirError<E>>\n\twhere","sourceCodeStart":4135,"sourceCodeEnd":4171,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/crates/pi-walker/src/lib.rs#L4135-L4171","documentation":"On Windows, records from NtQueryDirectoryFile (FILE_DIRECTORY_INFORMATION et al.) carry a NextEntryOffset; if a record's declared structure extends past the available buffer, the walker returns InvalidData with this message rather than reading out of bounds. This is a corrupt-buffer guard on the NT syscall contract.","triggerScenarios":"NtQueryDirectoryFile returns a buffer where a record's fixed structure or FileNameLength exceeds the remaining bytes during a directory walk.","commonSituations":"Faulty filesystem/filter drivers, corrupted kernel buffers, unusual network file systems; not a caller-input problem.","solutions":["Retry the directory read once.","Fall back to std::fs::read_dir for the affected directory.","File a report with OS/filesystem details; this violates the NT directory-enumeration contract."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"match fast_walk(dir) {\n  Err(e) if e.kind() == io::ErrorKind::InvalidData && e.to_string().contains(\"NtQueryDirectoryFile\") => std_walk(dir),\n  other => other,\n}","preventionTips":["Use the portable read_dir fallback when NT enumeration reports corrupt records.","Update or remove suspect filesystem filter drivers.","Retry once before falling back."],"tags":["filesystem","windows","invalid-data","truncated-record"],"backgroundTag":"truncated-directory-record","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}