›_ Codex Issues
Codex Issues / #40119

Codex command runner triggers Windows kernel crash on Insider Build 26340.9233

Open 💬 3 comments Opened Aug 22, 2026 by AEMaxim

What version of the Codex App are you using (From “About Codex” dialog)?

26.818.41509

What subscription do you have?

Plus plan

What platform is your computer?

Microsoft Windows NT 10.0.26340.0 x64

What issue are you seeing?

The Codex desktop app reliably causes a system-level crash when it starts or terminates a local sandboxed command runner. Even a harmless command such as:

cmd.exe /d /c echo CODEX_PROCESS_OK

can immediately produce a black screen followed by a SYSTEM_SERVICE_EXCEPTION bugcheck. The same command works normally when run manually in Windows Terminal.

What steps can reproduce the bug?

Steps to reproduce

  1. Open Codex on Windows.
  2. Ask Codex to run any local command.
  3. Codex initiates its sandboxed command runner.
  4. The system crashes, usually as the runner exits and Windows destroys its associated desktop.

Because this causes a full system crash, I cannot safely produce a screen recording or continue reproducing it.

Crash details

  • Bugcheck: 0x0000003B — SYSTEM_SERVICE_EXCEPTION
  • Exception: 0xC0000005
  • Faulting module: win32kfull.sys
  • Faulting function: win32kfull!SetMagnificationInputTransform+0x39
  • Process: codex-command-runner (shown truncated as codex-command- in my minidump)
  • Failure bucket: AV_win32kfull!SetMagnificationInputTransform
  • Failure hash: {527223d9-4b8b-e502-e7e6-16fc4649fd38}
  • Dump: C:\WINDOWS\Minidump\082226-25750-01.dmp

WinDbg shows a null-pointer dereference while Windows is destroying the command runner’s desktop:

NtTerminateProcess
PspRundownSingleProcess
DestroyDesktop
MagpDecomposeDesktop
CancelMagnificationInputTransform
SetMagnificationInputTransform+0x39

At the faulting instruction, RAX is zero and win32kfull.sys attempts to read [RAX+0x1F0].

Minidump: Minidump_Analysis.txt

Environment

  • Windows 11 Insider Preview, Experimental channel
  • Build: 26340.9233
  • win32kfull.sys: 10.0.26100.9233
  • Hyper-V/VBS enabled
  • AMD graphics
  • Magnifier and graphics overlays disabled
  • AMD driver reinstalled without resolving the issue
  • Home network
  • Codex version: 26.819.11345

What is the expected behavior?

_No response_

Additional information

I found another report from the same date with the identical Windows build, Codex runner, function offset, call stack, and failure hash. This suggests a reproducible interaction between Codex’s isolated command-runner desktop lifecycle and a regression in this Windows Experimental build (https://techcommunity.microsoft.com/discussions/windowsinsiderprogram/gsodsystem-service-exception-in-win32kfullsetmagnificationinputtransform-when-a-/4549167).

Before this began crashing consistently, Codex also failed to create sandboxed processes with an apply deny-read ACLs error. Reinstalling Codex and clearing its local application/configuration folders did not resolve the underlying sandbox problem.

View original on GitHub ↗

3 Comments

quarrel · 4 days ago

I can confirm the same issue.

This occurred in ChatGPT Work locally, rather than from an explicit Codex coding task. I asked Work to inspect files in C:\Windows\Temp; the machine bugchecked when the native command runner exited.

Environment

  • Windows 11 Insider Experimental: 26340.9233
  • ChatGPT package: OpenAI.Codex 26.818.5229.0
  • Runner: codex-command-runner-0.149.0-alpha.4.1.exe
  • Hyper-V/VBS enabled

Dump findings

  • Bugcheck: 0x3B — SYSTEM_SERVICE_EXCEPTION
  • Exception: 0xC0000005
  • Current process: codex-command-runner-0.149.0-alpha.4.1.exe
  • Faulting module: win32kfull.sys
  • Faulting RVA: win32kfull.sys+0x23c941
  • Captured stack addresses resolve predominantly to win32kfull.sys, win32kbase.sys, and win32k.sys

The module RVA matches the reported win32kfull!SetMagnificationInputTransform+0x39 fault exactly. This appears to be another instance of the runner-exit/isolated-desktop cleanup path described above; the contents of C:\Windows\Temp appear incidental.

After reboot, the ChatGPT desktop app also hangs on startup with a blank window.

I've also (prior to this, but not yet approved at time of posting this) left a comment on the same techcommunity.microsoft.com thread as OP.

x0rzavi · 4 days ago

This is an acknowledged bug on this particular version of insider build

https://www.reddit.com/r/Windows11/comments/1vumejs/comment/p583les/

josemtella · 3 days ago

Windows 11 Insider Experimental build 26340.9233 reproducibly crashes on sign-out/restart with SYSTEM_SERVICE_EXCEPTION 0x3B.
WinDbg bucket: AV_win32kfull!SetMagnificationInputTransform
Faulting function: win32kfull!SetMagnificationInputTransform+0x39
Failure hash: {527223d9-4b8b-e502-e7e6-16fc4649fd38}
The crash occurs during desktop teardown:
DestroyDesktop -> MagpDecomposeDesktop -> MagpRevokeInputTransfrom -> CancelMagnificationInputTransform -> SetMagnificationInputTransform
Workaround found and reproduced on two physical machines:
vivetool /enable /id:27829265
vivetool /enable /id:61457898
Feature 61457898 is FindMyMouse_Prototype; 27829265 is the prerequisite mouse pointer/crosshair feature.
Important: the first restart after enabling 61457898 still crashes, because the current session was apparently created with the old state. After that reboot, subsequent sign-outs and restarts no longer crash.
A/B confirmation:
vivetool /reset /id:61457898 -> crash returns on sign-out/restart.
vivetool /enable /id:61457898 -> after one crashing reboot, subsequent sign-outs/restarts are stable.
This has been reproduced on two separate physical machines. Some other physical headless machines do not reproduce the crash even with 61457898 undefined, so the feature appears to be a workaround rather than the sole trigger.