Windows app repeatedly spawns \git ls-files --others --exclude-standard -z`; `ntfs.sys` `NtFC` nonpaged pool grows continuously`

What version of the Codex App are you using (From “About Codex” dialog)?

26.325.31654 (1272)

What subscription do you have?

pro

What platform is your computer?

Microsoft Windows 11 Pro 10.0.26200 x64

What issue are you seeing?

I traced a Windows nonpaged pool growth problem to Codex Desktop repeatedly spawning child git.exe processes during normal app use.

In this environment, the user-mode trigger was Codex repeatedly launching:

git ls-files --others --exclude-standard -z

The kernel-side memory growth showed up under ntfs.sys pool tag NtFC.

I am reporting this here because the reproducible trigger appears to be Codex Desktop behavior, even if part of the retention/cleanup problem may also involve Windows NTFS or Microsoft Defender.

Observed evidence from the same affected session:

• System nonpaged pool was growing while process-level nonpaged pool remained tiny, which pointed to kernel-side growth rather than a normal user-mode process pool leak.
• Direct pool-tag sampling showed NtFC dominating and increasing.
• After deleting all temporary trace files I created for diagnosis, NtFC still increased from 4984.46 MB to 5072.56 MB in 30 seconds (+88.10 MB).
• NtFC ownership was confirmed locally by matching the tag string inside C:\Windows\System32\drivers\ntfs.sys.
• During that same window, Codex.exe kept spawning child git.exe processes with the exact command:<br>git ls-files --others --exclude-standard -z
• New child git.exe pairs were observed at local times 2026-04-04 22:16:23, 22:16:26, 22:16:49, and 22:16:58, all parented by Codex.exe.
• A short Procmon capture showed git.exe generating the most filesystem activity by a large margin (131,169 file events in about 3 seconds).
• MsMpEng.exe was also highly active in the same capture (10,736 file events), which suggests Microsoft Defender amplifies the I/O pressure once Codex starts the scans.

What I ruled out in the same session:

• This was not explained by process-local nonpaged pool usage.
• High-handle but low-file-activity processes did not match the growth pattern.

What steps can reproduce the bug?

1. On Windows 11 Pro 26200 x64, launch Codex Desktop 26.325.31654 (1272).
2. Open a local workspace under the user profile.<br>In my affected session, the active thread cwd was C:\Users\JW\Documents\playground.
3. Leave the app open and use it normally, or keep the session open long enough for background repo/status activity to happen.
4. Observe the process tree from elevated PowerShell / Process Explorer:

• Codex.exe repeatedly spawns git.exe
• the command line repeats as git ls-files --others --exclude-standard -z

1. In parallel, sample Windows nonpaged pool / pool tags.
2. Observe ntfs.sys NtFC nonpaged pool continuing to increase while those repeated git scans are occurring.

Repro status:

• This reproduced multiple times in the same affected session.
• I have not yet reduced it to a fully minimal deterministic repro outside the affected environment.

What is the expected behavior?

• Codex Desktop should not repeatedly spawn unbounded background git ls-files --others --exclude-standard -z scans during normal or idle app use.
• Repo scanning should stay scoped to the active workspace roots and should be debounced/cached appropriately.
• Codex should not act as a user-mode trigger that drives continuously growing NTFS nonpaged pool on Windows.

Additional information

I understand the ultimate pool-retention bug may also involve Windows NTFS or Microsoft Defender, but the reproducible user-mode trigger in this environment was Codex repeatedly spawning git.exe.

Directionally related Codex reports:

• openai/codex#13717 runaway rg processes with high CPU/RAM
• openai/codex#13809 long git diffs create lag in Codex App
• openai/codex#14469 Windows app lag from oversized git-origins / Git-worktree scans

If useful, I can provide follow-up artifacts from the affected machine, including:

• process tree snapshots showing repeated Codex.exe -> git.exe
• pool tag samples showing NtFC growth over time
• Procmon summaries showing git.exe as the top filesystem event source