[Bug][Windows] MAUI has a chance to fail with 0xC0000409 crash in InputStateManager.dll when processing tap input #31476
Description
Description
The application crashes with a fail-fast exception (0xC0000409) coming from InputStateManager.dll, specifically in InProcInputHandler::PopulateContactInFrame. This has a chance to occur when the application receives tap input. The frequency scales with the strength of the computer. Strong computers require extreme rapid tapping to reproduce, weaker computers will crash very quickly from rapid tapping, and even have a small chance to crash on single taps. Issue is reproducible on a basically blank new maui application
This issue appears to be a regression in recent MAUI versions — it does not reproduce in 9.0.50, but is easy to reproduce in any version after this
Repository
https://github.com/BMS-Malcolm/basic-maui-app
Continuously rapidly tapping the app launched with this repo will, after a random amount of time, crash with NO exception caught by the program or propagated through the debugger or program at all with an entry in EventViewer that reads
this
Faulting application name: Blank_Maui_App.exe, version: 1.0.0.0, time stamp: 0x68760000 Faulting module name: Microsoft.InputStateManager.dll, version: 10.0.26107.1011, time stamp: 0x0bb886ad Exception code: 0xc0000409 Fault offset: 0x0000000000012848 Faulting process id: 0x7244 Faulting application start time: 0x1DC1DB1DCE859BA Faulting application path: C:\Users\user\source\repos\Blank_Maui_App\Blank_Maui_App\bin\Debug\net9.0-windows10.0.19041.0\win10-x64\Blank_Maui_App.exe Faulting module path: C:\Users\user\source\repos\Blank_Maui_App\Blank_Maui_App\bin\Debug\net9.0-windows10.0.19041.0\win10-x64\Microsoft.InputStateManager.dll Report Id: 3f63e5c4-0acc-462e-a35d-84093532cdc2 Faulting package full name: Faulting package-relative application ID:Steps to Reproduce
Create a simple MAUI app with a Page in it
Tap the screen very quickly (clicks do not seem to work -- but that could be due to clicks not being very fast)
Observe crash after some time of tapping
Observed Behavior
App crashes without exception stack trace
No catchable exception — crash is a native fail-fast (0xC0000409)
Only trace is in Event Viewer and .dmp file and it is purely native code in that stack trace
Crash is deterministic with rapid taps on recent MAUI versions
Crash Details
ExceptionCode: 0xC0000409 (Security check failure or stack buffer overrun)
ExceptionAddress: Microsoft_InputStateManager!InProcInputHandler::PopulateContactInFrame+0x5a4
Subcode: 0x7 FAST_FAIL_FATAL_APP_EXIT
WinDbg Analysis of .dmp:
!gle
LastErrorValue: 0x12a (298) - Too many posts were made to a semaphore.
!error 0x80070578 → Invalid window handle
Expected Behavior
App should not crash during UI updates or rapid user input
Input system should gracefully ignore or defer events during layout changes
Actual Behavior
App crashes with native fail-fast (0xC0000409) from InputStateManager.dll
No managed exception is visible
Affects production users intermittently, more common on older hardware
Version with bug
Anything over 9.0.50
Is this a regression from previous behavior?
Presumably, as I cannot reproduce this on my machine anymore with 9.0.50. After we backported our application to this version our clients reported far fewer crashes due to this but it did not fix it 100% for them
Last version that worked well
9.0.50
Affected platforms
Windows
Workarounds Tested
✅ Downgrading to MAUI 9.0.50 eliminates crash in rapid tap tests on our development machines, and appears to substantially help on lower end Windows based tablets among our clients, but did not eliminate it in entirety on the lower end tablets
❌ No full fix without changing MAUI version (hard-setting the windows SDK version to lower than 1.7.x but keeping the maui version up to date does not work either)
Additional Notes
Has been occurring for quite some time, first report of this issue from users comes from early April of this year
Based on the errors being received, my best guess is that the input reception channels are not being cleared and/or cleaned up when an element on the screen is modified in memory, resulting in it being possible that a touch input is sent through the input processing channel for a element that has changed in memory since the event was first queued up, and so the stack pointers in that processing channel are no longer valid as the underlying element is now using a new section of memory. This explains the error codes (Invalid window handle, Buffer overrun), it explains why this error has a random chance to occur on tap rather than being deterministic and how this issue scales with machine strength (faster machines will process element changes more quickly, thus the window of time in which this can occur becomes small enough to be almost impossible to hit)
Workaround Update: For anyone else experiencing this issue, adding both of these two things to your csproj file
<MauiVersion>9.0.50</MauiVersion>
<ItemGroup>
<PackageReference Include="Microsoft.WindowsAppSDK" Version="[1.6.250205002,1.7)" />
</ItemGroup>
Seems to help