Claude Code BSOD Workaround ΓÇö Wof.sys Crash on Windows 11 Build 26200+
Problem
Claude Code triggers BSOD (Blue Screen of Death) on Windows 11 Build 26200+ during normal operation. The crash occurs when multiple Claude Code agents fire concurrent filesystem tool calls (Glob, Grep, Read) with no delay ΓÇö overwhelming Wof.sys (Windows Overlay Filter) or Hyper-V's 9P bridge.
23 BSODs logged since 2026-03-06. Two crash paths, same root cause:
| Path |
Bugcheck |
Faulting module |
Count |
| Windows native |
0x139, 0x3B, 0x1E, 0x50 |
Wof.sys WofPreDirectoryControlCallback |
15 |
WSL /mnt/c/ |
0x20001 |
hvix64.exe (Hyper-V) |
1 |
| Other |
0x14F, 0x10E |
Ntfs.sys, Norton |
7 |
Bug reports:
Root Cause
This is a Windows kernel bug, not a Claude Code bug. When Claude Code agents fire concurrent NtQueryDirectoryFileEx calls on NTFS volumes, the WOF minifilter crashes in its directory control callback. The crash is triggered by concurrency, not data volume:
- 1GB of random files + 5 concurrent agents WITHOUT mutex → BSOD within minutes
- Same data + same agents WITH mutex (serialized I/O) → stable, 381 tool calls, no crash
- Same data + normal tools (no Claude) → stable, no crash
WOF is a critical Windows component ΓÇö it cannot be disabled, detached, or unloaded.
Workaround 1: Mutex Daemon (recommended for multi-agent workloads)
A rate-limiting daemon that serializes all Claude Code tool calls across concurrent agents via a PreToolUse hook. Only one filesystem operation proceeds at a time.
Agent 1 ΓöÇΓöÇΓöÉ
Agent 2 ΓöÇΓöÇΓöñ PreToolUse hook
Agent 3 ──┼──→ curl localhost:9876/acquire ──→ Mutex ──→ delay ──→ allow
Agent 4 ΓöÇΓöÇΓöñ (blocks until released)
Agent 5 ΓöÇΓöÇΓöÿ
Setup
Prerequisites: JBang (runs on any JDK 17+, or installs its own).
Step 1: Start the daemon
# JBang (recommended ΓÇö no compilation needed, works everywhere)
jbang Mutex.jbang.kt
# Custom interval (default 2000ms, use 100-500ms for faster single-agent work)
jbang Mutex.jbang.kt --interval 500
# Run in background
jbang Mutex.jbang.kt &
JBang runs the Kotlin script directly ΓÇö no build step, no IDE required. First run downloads dependencies (~5s), subsequent runs start in ~1s.
Optional: compile to native binary (instant startup, no JVM overhead):
# Requires GraalVM JDK 21+ with native-image
jbang export portable Mutex.jbang.kt
native-image -jar Mutex.jar -o Mutex
./Mutex # ~2MB binary, starts instantly
Step 2: Configure Claude Code hook
Add to ~/.claude/settings.json:
{
"hooks": {
"PreToolUse": [
{
"matcher": "Bash|Read|Glob|Grep|Edit|Write",
"hooks": [
{
"type": "command",
"command": "bash mutex-acquire.sh"
}
]
}
]
}
}
Step 3: Verify
curl http://localhost:9876/status
# mutex port=9876 interval=2000ms acquires=0 uptime=5s
How it works
Each tool call triggers the PreToolUse hook, which calls curl localhost:9876/acquire. The daemon holds a coroutine Mutex ΓÇö only one caller proceeds at a time, with a configurable delay between releases. This serializes all filesystem I/O from all agents to a safe rate.
Fail-open: if the daemon is not running, the hook exits immediately (no impact on single-agent usage).
Endpoints
| Endpoint |
Method |
Description |
/acquire |
GET |
Block until released (rate-limited) |
/status |
GET |
Stats: port, interval, acquire count, uptime |
/health |
GET |
Liveness check (no blocking) |
/stop |
GET |
Graceful shutdown |
| Agents |
Without mutex |
With mutex (2s) |
With mutex (100ms) |
| 1 |
~10 tools/sec |
0.5 tools/sec |
10 tools/sec |
| 5 |
~50 tools/sec |
0.5 tools/sec |
10 tools/sec |
For interactive single-agent work, use --interval 100. For overnight batch runs (where BSODs happen most), --interval 2000 is safest.
Workaround 2: Run Claude Code in WSL
Since the Wof.sys crash happens on NTFS, running Claude Code inside WSL2 (which uses ext4) bypasses the WOF code path for local files.
Note: WSL is NOT safe for multi-agent workloads accessing /mnt/c/ ΓÇö the same concurrent I/O burst can crash the Hyper-V 9P bridge (BSOD 0x20001). Use the mutex daemon even in WSL if running multiple agents.
Setup (5 minutes)
# 1. Install Ubuntu from MS Store (if not already)
wsl --install Ubuntu-24.04
# 2. Install Node.js inside WSL
wsl -d Ubuntu-24.04 -u root -- bash -c '
curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
apt install -y nodejs
'
# 3. Install Claude Code inside WSL
wsl -d Ubuntu-24.04 -u root -- npm install -g @anthropic-ai/claude-code
# 4. Verify
wsl -d Ubuntu-24.04 -u root -- claude --version
Create the wrapper
Create claude.cmd in the same directory as claude.exe (typically %USERPROFILE%\.local\bin\):
@echo off
wsl -d Ubuntu-24.04 -u root -- claude %*
On Windows, .cmd takes priority over .exe in the same directory. Every claude invocation now goes through WSL automatically.
Reverting
When Microsoft patches Wof.sys, simply delete the wrapper:
del %USERPROFILE%\.local\bin\claude.cmd
Reproduction
Step 1: Generate test data
bash gen-repro-data.sh bsod-repro
Creates ~1GB of random word files across 10 subdirectories. This data alone does NOT crash the system ΓÇö it is inert.
Step 2: Open 5 Claude Code windows
cd bsod-repro
claude
Paste one prompt per window:
Window 1 ΓÇö Word Sorter:
Read every .txt file in this directory tree. For each file, read all lines, split into words, sort them alphabetically, and write the sorted output to sorted/. After processing all files, re-scan and repeat.
Window 2 ΓÇö Frequency Counter:
Read every .txt file in this directory tree. Count the frequency of every unique word across all files. Write per-directory frequency reports to freq/. Re-scan every 2 minutes.
Window 3 ΓÇö Duplicate Finder:
Read every .txt file in this directory tree. For each file, compute a hash by reading the full file. Compare all hashes. Write results to dupes/report.tsv. Cross-check by re-reading. Re-scan every 3 minutes.
Window 4 ΓÇö Line Merger:
Read every .txt file in this directory tree. Merge all files within each batch-* subdirectory into merged/. Sort by line. Verify line counts. Re-scan continuously.
Window 5 ΓÇö Cross-Reference Indexer:
Read every .txt file in this directory tree. For each unique word, record which files contain it and on which line numbers. Write to xref/index.tsv. Verify by re-reading. Re-scan every 2 minutes.
Step 3: Wait for BSOD
All 5 agents will fire concurrent Glob/Grep/Read tool calls. Expected crash within minutes on Windows 11 Build 26200+.
Step 4: Verify with mutex (should NOT crash)
Start jbang Mutex.jbang.kt &, configure the hook in settings.json, repeat Step 2. System should remain stable.
Test results (2026-03-14)
WITH mutex: PASS
5 concurrent Sonnet sub-agents, same prompts, same data. Mutex serialized all tool calls.
| Agent |
Task |
Tool calls |
Result |
| 1 |
Word Sorter |
25 |
Completed |
| 2 |
Frequency Counter |
53 |
9.1M words indexed |
| 3 |
Duplicate Finder |
226 |
39 files verified |
| 4 |
Line Merger |
19 |
11 batches merged |
| 5 |
Cross-Reference Indexer |
58 |
78 words, 9126 rows |
Total: 381 tool calls, 112 mutex acquires. No BSOD.
WITHOUT mutex: BSOD
Same system, same session. 2 Sonnet sub-agents launched to read 18 files concurrently ΓÇö BSOD 0x3B at 05:32 (Wof.sys WofPreDirectoryControlCallback). Earlier: 5 agents via WSL ΓÇö BSOD 0x20001 at 04:42 (HYPERVISOR_ERROR).
What doesn't work
| Attempted fix |
Result |
Disable CompactOS (compact /compactos:never) |
Mitigation only ΓÇö reduced frequency, did not eliminate |
| Windows Update (KB5079473) |
Did not update Wof.sys |
| Norton AV exclusions |
Unrelated (separate nllNetHub.sys crash) |
| Disabling WOF service |
DO NOT ΓÇö breaks Windows |
| WSL without mutex |
Crashes Hyper-V instead (0x20001) |
Affected versions
- Windows: Build 26200+ (Windows 11 24H2 Insider/Dev)
- Wof.sys: 10.0.26100.5074 (unchanged across updates)
- Claude Code: All versions (the bug is in the OS, not Claude)
Files
| File |
Description |
Mutex.jbang.kt |
Rate limiter daemon ΓÇö Kotlin, Ktor CIO, coroutine Mutex |
mutex-acquire.sh |
PreToolUse hook script ΓÇö curl blocks until mutex releases |
TestMutex.jbang.kt |
Test suite ΓÇö health, serialization, WireMock hook sim |
gen-repro-data.sh |
1GB random data generator + 5 agent prompts |
Minidump downloads
Timeline
| Date |
Event |
BSODs |
| 2026-03-06 |
First BSODs after Windows upgrade to Build 26200 |
7 |
| 2026-03-09 |
Continued crashes |
1 |
| 2026-03-10 |
Attempted CompactOS disable, WOF disable (broke Windows) |
5 |
| 2026-03-11 |
Norton crash, Ntfs.sys crash identified |
3 |
| 2026-03-12 |
Bug reports filed (Feedback Hub, GitHub, MS Q&A) |
3 |
| 2026-03-14 |
Root cause proven: concurrent I/O. Mutex workaround tested. |
4 |
| Total |
|
23 |
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 82%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETB%3C/text%3E%3C/svg%3E)
