shadow1ng/fscan · error

mssql: truncated done token

Error message

mssql: truncated done token

What it means

Guard in mssqlParseLoginTokens while walking a TDS DONE/DONEPROC/DONEINPROC token: the remaining payload is shorter than the 12 bytes a done token requires (pos+12 exceeds the buffer). The truncated login response cannot be scored for success/error status bits.

Source

Thrown at plugins/services/mssql_raw.go:322

				return false, err
			}
			pos = next
		case tdsTokenEnvChange:
			next, err := mssqlSkipLen16(payload, pos)
			if err != nil {
				return false, err
			}
			pos = next
		case tdsTokenLoginAck:
			next, err := mssqlSkipLen16(payload, pos)
			if err != nil {
				return false, err
			}
			result.sawLoginAck = true
			pos = next
		case tdsTokenDone, tdsTokenDoneProc, tdsTokenDoneInProc:
			if pos+12 > len(payload) {
				return false, fmt.Errorf("mssql: truncated done token")
			}
			status := binary.LittleEndian.Uint16(payload[pos : pos+2])
			return status&(tdsDoneError|tdsDoneSrvError) == 0, nil
		default:
			return false, fmt.Errorf("mssql: unexpected login token 0x%02x", token)
		}
	}
	return false, nil
}

func mssqlParseErrorToken(payload []byte, pos int) (mssqlRawError, int, error) {
	if pos+2 > len(payload) {
		return mssqlRawError{}, pos, fmt.Errorf("mssql: truncated error token")
	}
	size := int(binary.LittleEndian.Uint16(payload[pos : pos+2]))
	end := pos + 2 + size
	if size < 6 || end > len(payload) || pos+8 > len(payload) {
		return mssqlRawError{}, pos, fmt.Errorf("mssql: invalid error token size")

View on GitHub (pinned to 95cc12e753)

Solutions

1. Retry the login to rule out a transient truncation.
2. Capture packets to determine whether the server closed early (TCP FIN/RST mid-token).
3. Check for middleboxes limiting response size or idle-timeout kills.
4. If persistent, test the same server with go-mssqldb to see whether a full driver also fails.

When it happens

Trigger: mssqlParseLoginTokens hits token 0xFD/0xFE/0xFF with pos+12 > len(payload) — the login response payload ended mid-Done-token.

Common situations: Truncated login responses due to network resets or proxies; server that aborted the connection while writing the final token; fuzzed/invalid TDS streams.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• mssql: invalid prelogin option table
• mssql: truncated prelogin option
• mssql: invalid prelogin option bounds
• mssql: unexpected login response packet type %d
• mssql: unexpected login token 0x%02x

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/07d45b3bab1f3deb. Report an issue: GitHub.