FailFast crash (0xc000027b) releasing StorageFile/DataPackage during rapid drag on WinUI 3 GridView

Nobody has claimed this yet.

### Describe the bug

When a GridView drag sets DataPackage.SetStorageItems(storageFiles) in DragItemsStarting (i.e. a StorageFileDrag feature enabled), performing rapid/repeated drag operations causes a process-wide FailFast crash. The crash happens inside the XAML render tick's cleanup of DragItemsStartingEventArgs → CDataPackage → CBitmapFormat, during the cross-apartment COM release of the StorageFile reference (RemoteReleaseRifRef / ReleaseMarshalObjRef). Disabling SetStorageItems (using only an in-memory SetBitmap stream) eliminates the crash.

### Why is this important?

This is a hard process crash (FailFast, no catchable exception) that aborts the whole app with no recovery. Any app that lets users drag image/grid items out to external targets (e.g. chat apps like QQ, file explorers, input boxes) or internal targets (e.g. reordering items within a GridView/ListView, dragging items between categories), and enables StorageFile drag-out will randomly lose all user work during normal, repeated drag usage

### Steps to reproduce the bug

A full reproducible app (WinUI 3, real-world meme manager) is available at **https://github.com/shuiping233/MemeManager**. The crash trigger is enabling a "StorageFile drag-out" feature that calls `DataPackage.SetStorageItems(storageFiles)` inside `GridView.DragItemsStarting`, then performing rapid/repeated drags. Source references (pinned to the reproducing commit `d055cdd`):

- `MainWindow.xaml` (GridView + drag wiring): https://github.com/shuiping233/MemeManager/blob/d055cddd0decab3dfae912fdc90f44741e7dbe06/MainWindow.xaml
- `MainWindow.xaml.cs` (drag handlers): https://github.com/shuiping233/MemeManager/blob/d055cddd0decab3dfae912fdc90f44741e7dbe06/MainWindow.xaml.cs
- `MemeViewModel.cs` (item model bound to the grid): https://github.com/shuiping233/MemeManager/blob/d055cddd0decab3dfae912fdc90f44741e7dbe06/MemeViewModel.cs

**Steps to reproduce (using the repo above):**
1. Clone https://github.com/shuiping233/MemeManager and open in Visual Studio.
2. Enable the "StorageFile 支持" (StorageFile drag) toggle in settings — this sets `App.DataEngine.Config.StorageFileDrag = true`, which makes the drag handler call `e.Data.SetStorageItems(files)`.
3. Build & run on **Windows 10**.
4. In the main window, rapidly drag image items out of the right-side `MemeGridView` (e.g. onto an external app like QQ, or just repeat drag gestures).
5. The process FailFasts non-deterministically. The dump stack shows framework cleanup of `DragItemsStartingEventArgs` / `CDataPackage` / `CBitmapFormat` with a cross-apartment `StorageFile` COM release.

**Generic repro (any WinUI 3 app):**
1. Create a WinUI 3 project with a `GridView` (`CanDragItems="True"`).
2. In `DragItemsStarting`, obtain `StorageFile`(s) (e.g. via `StorageFile.GetFileFromPathAsync(path).AsTask().Result`) and call `e.Data.SetStorageItems(files)`.
3. Run on Windows 10/11, perform rapid/repeated drags (especially dragging out to an external app).
4. Crash occurs non-deterministically; call stack shows framework cleanup of `DragItemsStartingEventArgs` / `CDataPackage` / `CBitmapFormat` with cross-apartment `StorageFile` release.
5. (Using only `SetBitmap` with an in-memory stream instead does **not** crash.)

Relevant code excerpts
MainWindow.xaml — the image container (MemeGridView) and its drag wiring (lines 114–170):
Full file: https://github.com/shuiping233/MemeManager/blob/d055cddd0decab3dfae912fdc90f44741e7dbe06/MainWindow.xaml#L114–L170
```xaml

```
MainWindow.xaml.cs — MemeGridView_DragItemsStarting (the crash trigger: SetStorageItems when StorageFileDrag is on). Lines 1088–1202,
Full file: https://github.com/shuiping233/MemeManager/blob/d055cddd0decab3dfae912fdc90f44741e7dbe06/MainWindow.xaml.cs#L1088-L1202
key part:
```cs
private void MemeGridView_DragItemsStarting(object sender, DragItemsStartingEventArgs e)
{
HidePreviewPopup(immediate: true, "starting drug");
_previewTimer.Stop(); // mitigates a related reentrancy crash, not this one

var draggedVms = e.Items.Cast().ToList();
if (draggedVms.Count == 0) return;
// ... resolves _draggingMemes / _dragAnchorFileName ...

try
{
var valid = group
.Where(v => !string.IsNullOrEmpty(v.LocalPath) && File.Exists(v.LocalPath))
.ToList();
if (valid.Count == 0) { /* log, skip */ }
else if (App.DataEngine.Config.StorageFileDrag)
{
// CRASH TRIGGER: writing StorageFile into the DataPackage.
// Cross-apartment release of these StorageFiles during the render
// tick cleanup causes the 0xc000027b FailFast on Windows 10.
var files = valid
.Select(v => StorageFile.GetFileFromPathAsync(v.LocalPath!).AsTask().Result)
.ToArray();
e.Data.SetStorageItems(files);

bool isGif = files.Length == 1 &&
string.Equals(Path.GetExtension(files[0].Path), ".gif", StringComparison.OrdinalIgnoreCase);
if (files.Length == 1 && !isGif)
{
// also sets an in-memory bitmap stream for non-GIF single drags
// (this part alone does NOT crash)
...
}
}
else
{
// Stable path: only in-memory SetBitmap stream -> no crash.
if (valid.Count == 1) { ... e.Data.SetBitmap(...); }
}
}
catch (Exception ex) { Log(...); }

e.Data.RequestedOperation = DataPackageOperation.Move | DataPackageOperation.Copy;
}
```

MemeViewModel.cs — the item bound into the grid (the ImageSource / Model used by DragItemsStarting)
Full file: https://github.com/shuiping233/MemeManager/blob/d055cddd0decab3dfae912fdc90f44741e7dbe06/MemeViewModel.cs#L10-L56
key part:
```cs
public class MemeViewModel : INotifyPropertyChanged
{
private MemeModel _model;
public MemeModel Model { get => _model; private set => _model = value; }

public string Hash => _model.Hash;
public string LocalPath => _model.LocalPath; // used to build StorageFile
public string Category => _model.Category;
public string FileName => _model.FileName;

private BitmapImage? _imageSource;
public BitmapImage ImageSource
{
get
{
if (_imagesCleared) return new BitmapImage();
if (_imageSource == null && File.Exists(LocalPath))
{
_imageSource = new BitmapImage();
_imageSource.DecodePixelWidth = 120;
_imageSource.UriSource = new Uri(LocalPath);
LiveBitmapImageCount++;
}
return _imageSource ?? new BitmapImage();
}
}
// ...
}
```

### Actual behavior

Process terminates with FailFast. Exception is 0x8000ffff (E_UNEXPECTED) with stowed 0xc000027b. Faulting frame: Microsoft_UI_Xaml!CXcpDispatcher::OnReentrancyProtectedWindowMessage → DirectUI::UIAffinityReleaseQueue::DoCleanup destroying DragItemsStartingEventArgs.

Key stack frames:
```
KERNELBASE!RaiseFailFastException
Microsoft_UI_Xaml!FailFastWithStowedExceptions
Microsoft_UI_Xaml!CXcpDispatcher::OnReentrancyProtectedWindowMessage
Microsoft_UI_Xaml!DirectUI::UIAffinityReleaseQueue::DoCleanup
Microsoft_UI_Xaml!DirectUI::DragItemsStartingEventArgs::~DragItemsStartingEventArgs
windows_applicationmodel_datatransfer!CDataPackage::~CDataPackage
windows_applicationmodel_datatransfer!CBitmapFormat::~CBitmapFormat
windows_storage!CFTMCrossProcClientImpl::~CFTMCrossProcClientImpl
combase!RemoteReleaseRifRef / ReleaseMarshalObjRef
```

Raw Stack info:
```
0:000> !analyze -v
CLRMAReleaseInstance
ClrmaManagedAnalysis::AssociateClient
AssociateClient trying managed CLRMA
AssociateClient got managed CLRMA service
AssociateClient trying DAC CLRMA
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

ClrmaManagedAnalysis::GetThread 9244
ClrmaThread::Initialize 9244
~ClrmaThread
ClrmaManagedAnalysis::get_ProviderName
ClrmaManagedAnalysis::GetThread ffffffff
ClrmaThread::Initialize 9244
ClrmaThread::get_CurrentException
ClrmaThread::get_NestedExceptionCount
~ClrmaThread
DEBUG_FLR_EXCEPTION_CODE(8000ffff) and the ".exr -1" ExceptionCode(c000027b) don't match

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 1375

Key : Analysis.Elapsed.mSec
Value: 2979

Key : Analysis.IO.Other.Mb
Value: 21

Key : Analysis.IO.Read.Mb
Value: 3

Key : Analysis.IO.Write.Mb
Value: 36

Key : Analysis.Init.CPU.mSec
Value: 4296

Key : Analysis.Init.Elapsed.mSec
Value: 196040

Key : Analysis.Memory.CommitPeak.Mb
Value: 672

Key : Analysis.Version.DbgEng
Value: 10.0.29617.1000

Key : Analysis.Version.Description
Value: 10.2604.29.1 amd64fre

Key : Analysis.Version.Ext
Value: 1.2604.29.1

Key : CLR.Engine
Value: CORECLR

Key : CLR.Version
Value: 10.0.1026.32716

Key : Failure.Bucket
Value: STOWED_EXCEPTION_8000ffff_Microsoft.UI.Xaml.dll!CXcpDispatcher::OnReentrancyProtectedWindowMessage

Key : Failure.Exception.Code
Value: 0x8000ffff

Key : Failure.Exception.IP.Address
Value: 0x7ffc774b9c5d

Key : Failure.Exception.IP.Module
Value: Microsoft_UI_Xaml

Key : Failure.Exception.IP.Offset
Value: 0x3a9c5d

Key : Failure.Hash
Value: {04176e88-ce33-3d4d-8bb0-7e3796c1ffce}

Key : Failure.ProblemClass.Primary
Value: STOWED_EXCEPTION

Key : Failure.Source.FileLine
Value: 669

Key : Failure.Source.FilePath
Value: C:\__w\1\s\dxaml\xcp\win\shared\xcpwindow.cpp

Key : Failure.Source.SourceServerCommand
Value: powershell -command "Invoke-WebRequest 'raw.githubusercontent.com/microsoft/microsoft-ui-xaml/a97562621a1d1ea397a38a3f512c9eef99db52d8/src/dxaml/xcp/win/shared/xcpwindow.cpp' -OutFile '"C:\ProgramData\Dbg\src\TFS_COMMIT\e943729a\src\dxaml\xcp\win\shared\xcpwindow.cpp"'"

Key : Faulting.IP.Type
Value: Paged

Key : Timeline.OS.Boot.DeltaSec
Value: 40449

Key : Timeline.Process.Start.DeltaSec
Value: 107

Key : WER.OS.Branch
Value: ge_release

Key : WER.OS.Version
Value: 10.0.26100.1

Key : WER.Process.Version
Value: 1.0.0.0

FILE_IN_CAB: MemeManager.exe.10816.dmp

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

CONTEXT: (.ecxr)
rax=000000ab6cd7b080 rbx=000000ab6cd7b660 rcx=000000ab6cd7b080
rdx=000000ab6cd7b530 rsi=000001d8789bfc01 rdi=000000ab6cd7b080
rip=00007ffdc8519ce8 rsp=000000ab6cd7afa0 rbp=000000ab6cd7b0a0
r8=0000000000000000 r9=000000ab6cd7b4e0 r10=00007ffdc89a0000
r11=00007ffdc8a8df4f r12=0000000000000485 r13=0000000080070057
r14=0000000000000001 r15=0000000000000002
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000204
KERNELBASE!RaiseFailFastException+0x188:
00007ffd`c8519ce8 0f1f440000 nop dword ptr [rax+rax]
Resetting default scope

EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffc774b9c5d (Microsoft_UI_Xaml!FailFastWithStowedExceptions+0x0000000000000061)
ExceptionCode: c000027b
ExceptionFlags: 00000001
NumberParameters: 2
Parameter[0]: 000001d8789bfcf0
Parameter[1]: 0000000000000001

PROCESS_NAME: MemeManager.dll

ERROR_CODE: (NTSTATUS) 0xc000027b -

EXCEPTION_CODE_STR: 8000ffff

EXCEPTION_PARAMETER1: 000001d8789bfcf0

EXCEPTION_PARAMETER2: 0000000000000001

FAULTING_THREAD: ffffffff

STACK_TEXT:
000001d8`76de7e00 00007ffc`77419287 Microsoft_UI_Xaml!CXcpDispatcher::OnReentrancyProtectedWindowMessage+0x20b083
000001d8`76de7e08 00007ffc`7720d804 Microsoft_UI_Xaml!CXcpDispatcher::MessageTimerCallback+0x74
000001d8`76de7e10 00007ffc`7730f2fd Microsoft_UI_Xaml!Microsoft::WRL::Details::DelegateArgTraits,IInspectable *>::*)(ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *,IInspectable *)>::DelegateInvokeHelper,ABI::Windows::Foundation::ITypedEventHandler,Microsoft::WRL::FtmBase>,`CXcpDispatcher::Init'::`46':: &,1,ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *,IInspectable *>::Invoke+0xd
000001d8`76de7e18 00007ffc`d8ff9917 CoreMessagingXP!Microsoft::WRL::Details::DelegateArgTraits,IInspectable * __ptr64>::*)(Microsoft::UI::Dispatching::IDispatcherQueueTimer * __ptr64,IInspectable * __ptr64) __ptr64>::DelegateInvokeHelper,Windows::Foundation::ITypedEventHandler,Microsoft::WRL::FtmBase>,,-1,Microsoft::UI::Dispatching::IDispatcherQueueTimer * __ptr64,IInspectable * __ptr64>::Invoke+0x87
000001d8`76de7e20 00007ffc`d8ff9701 CoreMessagingXP!Microsoft::WRL::EventSource,Microsoft::WRL::InvokeModeOptions<1> >::InvokeAll+0xad
000001d8`76de7e28 00007ffc`d8ff9d43 CoreMessagingXP!Microsoft::UI::Dispatching::DispatcherQueueTimer::TimerCallback+0x83
000001d8`76de7e30 00007ffc`d8fa12fd CoreMessagingXP!CFlat::SehSafe::Execute< >+0x21
000001d8`76de7e38 00007ffc`d8fa5406 CoreMessagingXP!Microsoft::CoreUI::ActionCallback::ImportAdapter$+0x66
000001d8`76de7e40 00007ffc`d8f90e49 CoreMessagingXP!Microsoft::CoreUI::Dispatch::TimeoutManager::Callback_OnDispatch+0x1a9
000001d8`76de7e48 00007ffc`d8f7c910 CoreMessagingXP!Microsoft::CoreUI::Dispatch::Dispatcher::Callback_DispatchNextItem+0x1bc
000001d8`76de7e50 00007ffc`d8f7c67d CoreMessagingXP!Microsoft::CoreUI::Dispatch::Dispatcher::Callback_DispatchLoop+0x1b9
000001d8`76de7e58 00007ffc`d8f6fdd0 CoreMessagingXP!Microsoft::CoreUI::Dispatch::EventLoop::Callback_RunCoreLoop+0x164
000001d8`76de7e60 00007ffc`d8f72cf6 CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::DrainCoreMessagingQueue+0x15a
000001d8`76de7e68 00007ffc`d8f7306c CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::OnUserDispatch+0x98
000001d8`76de7e70 00007ffc`d8fb5583 CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::DoWork+0xa7
000001d8`76de7e78 00007ffc`d8fb5716 CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::HandleDispatchNotifyMessage+0x132
000001d8`76de7e80 00007ffc`d8fb5c8e CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::WindowProc+0x5e
000001d8`76de7e88 00007ffd`ca4ac396 user32!UserCallWinProcCheckWow+0x356
000001d8`76de7e90 00007ffd`ca4abc1c user32!DispatchClientMessage+0x9c
000001d8`76de7e98 00007ffd`ca4e0a53 user32!_fnDWORD+0x33
000001d8`76de7ea0 00007ffd`cb124084 ntdll!KiUserCallbackDispatcherContinue+0x0
000001d8`76de7ea8 00007ffd`c88b12e4 win32u!NtUserPeekMessage+0x14
000001d8`76de7eb0 00007ffd`ca4b38ef user32!_PeekMessage+0x3f
000001d8`76de7eb8 00007ffd`ca4b3878 user32!PeekMessageW+0x168
000001d8`76de7ec0 00007ffd`c8d89707 combase!CCliModalLoop::MyPeekMessage+0x53
000001d8`76de7ec8 00007ffd`c8d89680 combase!CCliModalLoop::PeekRPCAndDDEMessage+0x5c
000001d8`76de7ed0 00007ffd`c8d88417 combase!CCliModalLoop::BlockFn+0x1a3
000001d8`76de7ed8 00007ffd`c8d88041 combase!ModalLoop+0xb9
000001d8`76de7ee0 00007ffd`c8e0027f combase!ClassicSTAThreadDispatchCrossApartmentCall+0x5f
000001d8`76de7ee8 00007ffd`c8d3dc8e combase!CSyncClientCall::SendReceive2+0x193e
000001d8`76de7ef0 00007ffd`c8d86e42 combase!ClassicSTAThreadSendReceive+0x1a2
000001d8`76de7ef8 00007ffd`c8d36559 combase!CSyncClientCall::SendReceive+0x509
000001d8`76de7f00 00007ffd`c8d83143 combase!NdrExtpProxySendReceive+0xb3
000001d8`76de7f08 00007ffd`c93a7a91 rpcrt4!NdrpClientCall3+0x431
000001d8`76de7f10 00007ffd`c8dda5c6 combase!ObjectStublessClient+0x146
000001d8`76de7f18 00007ffd`c8f40c42 combase!ObjectStubless+0x42
000001d8`76de7f20 00007ffd`c8d38214 combase!RemoteReleaseRifRefHelper+0x80
000001d8`76de7f28 00007ffd`c8e298d9 combase!RemoteReleaseRifRef+0x1cd
000001d8`76de7f30 00007ffd`c8e90522 combase!ReleaseInterfaceReferences+0x8a
000001d8`76de7f38 00007ffd`c8e61edf combase!ReleaseMarshalObjRef+0x44f
000001d8`76de7f40 00007ffd`c8e0e0b3 combase!CAgileReferenceMarshaled::~CAgileReferenceMarshaled+0x77
000001d8`76de7f48 00007ffd`c8e0e014 combase!CAgileReferenceMarshaled::`scalar deleting destructor'+0x14
000001d8`76de7f50 00007ffd`c8d047b1 combase!Microsoft::WRL::Details::RuntimeClassImpl,1,0,0,IAgileReference,Microsoft::WRL::FtmBase>::Release+0x81
000001d8`76de7f58 00007ffd`c5cc6aef windows_storage!::~+0x1f
000001d8`76de7f60 00007ffd`c5ea91b7 windows_storage!CFTMCrossProcClientImpl::~CFTMCrossProcClientImpl+0x1b
000001d8`76de7f68 00007ffd`c5ecb1c4 windows_storage!Microsoft::WRL::RuntimeClass >::`vector deleting destructor'+0x14
000001d8`76de7f70 00007ffd`c5dbc01c windows_storage!Microsoft::WRL::Details::RuntimeClassImpl,1,1,0,Microsoft::WRL::Implements >::Release+0x4c
000001d8`76de7f78 00007ffd`c14714e5 WinTypes!ObjectVector<1>::`scalar deleting destructor'+0xc5
000001d8`76de7f80 00007ffd`c14816bf WinTypes!Microsoft::WRL::Details::RuntimeClassImpl,1,1,0,ObjectVectorBase,Windows::Foundation::Collections::Internal::IVersionedVector,Microsoft::WRL::FtmBase>::Release+0x5f
000001d8`76de7f88 00007ffd`7fb37cab windows_applicationmodel_datatransfer!CBitmapFormat::~CBitmapFormat+0x23
000001d8`76de7f90 00007ffd`7fb3d314 windows_applicationmodel_datatransfer!CBitmapFormat::`vector deleting destructor'+0x14
000001d8`76de7f98 00007ffd`7fb37d36 windows_applicationmodel_datatransfer!CDataFormatStore::~CDataFormatStore+0x42
000001d8`76de7fa0 00007ffd`7fb37fbb windows_applicationmodel_datatransfer!CDataPackage::~CDataPackage+0x1e7
000001d8`76de7fa8 00007ffd`7fb3d3d4 windows_applicationmodel_datatransfer!CDataPackage::`vector deleting destructor'+0x14
000001d8`76de7fb0 00007ffd`7fb696ea windows_applicationmodel_datatransfer!CDataPackage::Release+0xfa
000001d8`76de7fb8 00007ffc`77189a31 Microsoft_UI_Xaml!DirectUI::TrackerTargetReference::Clear+0x1d1
000001d8`76de7fc0 00007ffc`7762dea0 Microsoft_UI_Xaml!DirectUI::DragItemsStartingEventArgs::~DragItemsStartingEventArgs+0x1c
000001d8`76de7fc8 00007ffc`7762ecb0 Microsoft_UI_Xaml!ctl::ComObject::`scalar deleting destructor'+0x18
000001d8`76de7fd0 00007ffc`77274d04 Microsoft_UI_Xaml!ctl::ComBase::ReleaseImpl+0x84
000001d8`76de7fd8 00007ffc`77900bd7 Microsoft_UI_Xaml!DirectUI::UIAffinityReleaseQueue::DoCleanup+0x27f
000001d8`76de7fe0 00007ffc`7790092e Microsoft_UI_Xaml!DirectUI::UIAffinityReleaseQueue::BuildTree+0x1e
000001d8`76de7fe8 00007ffc`77253d8d Microsoft_UI_Xaml!DirectUI::BuildTreeService::BuildTrees+0xf9
000001d8`76de7ff0 00007ffc`77253bcf Microsoft_UI_Xaml!AgCoreCallbacks::FrameworkCallbacks_PhasedWorkDistributor_PerformWork+0x5b
000001d8`76de7ff8 00007ffc`77220384 Microsoft_UI_Xaml!CCoreServices::NWDrawTree+0x304
000001d8`76de8000 00007ffc`7721abb9 Microsoft_UI_Xaml!CCoreServices::NWDrawMainTree+0xd5
000001d8`76de8008 00007ffc`7721aa98 Microsoft_UI_Xaml!CWindowRenderTarget::Draw+0x7c
000001d8`76de8010 00007ffc`7721a9c8 Microsoft_UI_Xaml!CXcpBrowserHost::OnTick+0x58
000001d8`76de8018 00007ffc`7720e6ce Microsoft_UI_Xaml!CXcpDispatcher::Tick+0x8e
000001d8`76de8020 00007ffc`7720e2b5 Microsoft_UI_Xaml!CXcpDispatcher::OnReentrancyProtectedWindowMessage+0xb1
000001d8`76de8028 00007ffc`7720d804 Microsoft_UI_Xaml!CXcpDispatcher::MessageTimerCallback+0x74
000001d8`76de8030 00007ffc`7730f2fd Microsoft_UI_Xaml!Microsoft::WRL::Details::DelegateArgTraits,IInspectable *>::*)(ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *,IInspectable *)>::DelegateInvokeHelper,ABI::Windows::Foundation::ITypedEventHandler,Microsoft::WRL::FtmBase>,`CXcpDispatcher::Init'::`46':: &,1,ABI::Microsoft::UI::Dispatching::IDispatcherQueueTimer *,IInspectable *>::Invoke+0xd
000001d8`76de8038 00007ffc`d8ff9917 CoreMessagingXP!Microsoft::WRL::Details::DelegateArgTraits,IInspectable * __ptr64>::*)(Microsoft::UI::Dispatching::IDispatcherQueueTimer * __ptr64,IInspectable * __ptr64) __ptr64>::DelegateInvokeHelper,Windows::Foundation::ITypedEventHandler,Microsoft::WRL::FtmBase>,,-1,Microsoft::UI::Dispatching::IDispatcherQueueTimer * __ptr64,IInspectable * __ptr64>::Invoke+0x87
000001d8`76de8040 00007ffc`d8ff9701 CoreMessagingXP!Microsoft::WRL::EventSource,Microsoft::WRL::InvokeModeOptions<1> >::InvokeAll+0xad
000001d8`76de8048 00007ffc`d8ff9d43 CoreMessagingXP!Microsoft::UI::Dispatching::DispatcherQueueTimer::TimerCallback+0x83
000001d8`76de8050 00007ffc`d8fa12fd CoreMessagingXP!CFlat::SehSafe::Execute< >+0x21
000001d8`76de8058 00007ffc`d8fa5406 CoreMessagingXP!Microsoft::CoreUI::ActionCallback::ImportAdapter$+0x66
000001d8`76de8060 00007ffc`d8f90e49 CoreMessagingXP!Microsoft::CoreUI::Dispatch::TimeoutManager::Callback_OnDispatch+0x1a9
000001d8`76de8068 00007ffc`d8f7c910 CoreMessagingXP!Microsoft::CoreUI::Dispatch::Dispatcher::Callback_DispatchNextItem+0x1bc
000001d8`76de8070 00007ffc`d8f7c67d CoreMessagingXP!Microsoft::CoreUI::Dispatch::Dispatcher::Callback_DispatchLoop+0x1b9
000001d8`76de8078 00007ffc`d8f6fdd0 CoreMessagingXP!Microsoft::CoreUI::Dispatch::EventLoop::Callback_RunCoreLoop+0x164
000001d8`76de8080 00007ffc`d8f72cf6 CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::DrainCoreMessagingQueue+0x15a
000001d8`76de8088 00007ffc`d8f7306c CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::OnUserDispatch+0x98
000001d8`76de8090 00007ffc`d8fb5583 CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::DoWork+0xa7
000001d8`76de8098 00007ffc`d8fb5716 CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::HandleDispatchNotifyMessage+0x132
000001d8`76de80a0 00007ffc`d8fb5c8e CoreMessagingXP!Microsoft::CoreUI::Dispatch::UserAdapter::WindowProc+0x5e
000001d8`76de80a8 00007ffd`ca4ac396 user32!UserCallWinProcCheckWow+0x356
000001d8`76de80b0 00007ffd`ca4abc1c user32!DispatchClientMessage+0x9c
000001d8`76de8

STACK_COMMAND: dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; .echo *** Stowed Exception v2 ***; .exr -1; dpp 0x1d8789bfcf0 L0x1; dt 0x1d876de8e20 combase!STOWED_EXCEPTION_INFORMATION_V2 -r; dps 0x1d876de7e00 L0x5f ; ** Pseudo Context ** StowedPseu

IP_IN_PAGED_CODE:
Microsoft_UI_Xaml!FailFastWithStowedExceptions+61 [C:\__w\1\s\dxaml\xcp\components\base\ErrorContext.cpp @ 1508]
00007ffc`774b9c5d 488b5c2430 mov rbx,qword ptr [rsp+30h]

FAULTING_SOURCE_LINE: C:\__w\1\s\dxaml\xcp\win\shared\xcpwindow.cpp

FAULTING_SOURCE_FILE: C:\__w\1\s\dxaml\xcp\win\shared\xcpwindow.cpp

FAULTING_SOURCE_LINE_NUMBER: 669

FAULTING_SOURCE_SRV_COMMAND: powershell -command "Invoke-WebRequest 'https://raw.githubusercontent.com/microsoft/microsoft-ui-xaml/a97562621a1d1ea397a38a3f512c9eef99db52d8/src/dxaml/xcp/win/shared/xcpwindow.cpp' -OutFile '"C:\ProgramData\Dbg\src\TFS_COMMIT\e943729a\src\dxaml\xcp\win\shared\xcpwindow.cpp"'"

FAULTING_SOURCE_CODE:
No source found for 'C:\__w\1\s\dxaml\xcp\win\shared\xcpwindow.cpp'

SYMBOL_NAME: Microsoft_UI_Xaml!CXcpDispatcher::OnReentrancyProtectedWindowMessage+20b083

MODULE_NAME: Microsoft_UI_Xaml

IMAGE_NAME: Microsoft.UI.Xaml.dll

FAILURE_BUCKET_ID: STOWED_EXCEPTION_8000ffff_Microsoft.UI.Xaml.dll!CXcpDispatcher::OnReentrancyProtectedWindowMessage

OS_VERSION: 10.0.26100.1

BUILDLAB_STR: ge_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

IMAGE_VERSION: 3.2.3.0

FAILURE_ID_HASH: {04176e88-ce33-3d4d-8bb0-7e3796c1ffce}

Followup: MachineOwner
---------
```

### Expected behavior

Rapid drags with SetStorageItems should not crash the process. The cross-apartment StorageFile reference release should be deferred off the render/cleanup path (or otherwise made safe) so the app survives normal repeated drag usage.

### Screenshots

none
carsh dumps only

[MemeManager.exe.10816.zip](https://1drv.ms/u/c/CE7E82FD652E9576/IQAt1zx4WqgkTb05TV1B--7OASLETOuVWc1te0po_8-vViY?e=2sDl6Z)
[MemeManager.pdb.zip](https://1drv.ms/u/c/CE7E82FD652E9576/IQDRmswJKR1uSaNNGUUCipRzAUw57ub21RJr8auPH94eatA?e=VkhSTc)

### NuGet package version

Microsoft.UI.Xaml 3.2.3.0

### Windows version

Windows 11 (25H2): Build 26200

### Additional context

_No response_

Start by running the linked MemeManager reproduction on Windows 10 with StorageFile drag enabled, then inspect MainWindow.xaml and MainWindow.xaml.cs, especially MemeGridView_DragItemsStarting. Compare the SetStorageItems path with the stable SetBitmap path and use the reported DragItemsStartingEventArgs/CDataPackage cleanup stack as the investigation entry point. Done means rapid repeated drags no longer produce the framework FailFast crash.

Written by the indexing model from the issue text.