Codex command runner triggers Windows kernel crash on Insider Build 26340.9233

What version of the Codex App are you using (From “About Codex” dialog)?

26.818.41509

What subscription do you have?

Plus plan

What platform is your computer?

Microsoft Windows NT 10.0.26340.0 x64

What issue are you seeing?

The Codex desktop app reliably causes a system-level crash when it starts or terminates a local sandboxed command runner. Even a harmless command such as:

cmd.exe /d /c echo CODEX_PROCESS_OK

can immediately produce a black screen followed by a SYSTEM_SERVICE_EXCEPTION bugcheck. The same command works normally when run manually in Windows Terminal.

What steps can reproduce the bug?

Steps to reproduce

1. Open Codex on Windows.
2. Ask Codex to run any local command.
3. Codex initiates its sandboxed command runner.
4. The system crashes, usually as the runner exits and Windows destroys its associated desktop.

Because this causes a full system crash, I cannot safely produce a screen recording or continue reproducing it.

Crash details

• Bugcheck: 0x0000003B — SYSTEM_SERVICE_EXCEPTION
• Exception: 0xC0000005
• Faulting module: win32kfull.sys
• Faulting function: win32kfull!SetMagnificationInputTransform+0x39
• Process: codex-command-runner (shown truncated as codex-command- in my minidump)
• Failure bucket: AV_win32kfull!SetMagnificationInputTransform
• Failure hash: {527223d9-4b8b-e502-e7e6-16fc4649fd38}
• Dump: C:\WINDOWS\Minidump\082226-25750-01.dmp

WinDbg shows a null-pointer dereference while Windows is destroying the command runner’s desktop:

NtTerminateProcess
PspRundownSingleProcess
DestroyDesktop
MagpDecomposeDesktop
CancelMagnificationInputTransform
SetMagnificationInputTransform+0x39

At the faulting instruction, RAX is zero and win32kfull.sys attempts to read [RAX+0x1F0].

Minidump: Minidump_Analysis.txt

Environment

• Windows 11 Insider Preview, Experimental channel
• Build: 26340.9233
• win32kfull.sys: 10.0.26100.9233
• Hyper-V/VBS enabled
• AMD graphics
• Magnifier and graphics overlays disabled
• AMD driver reinstalled without resolving the issue
• Home network
• Codex version: 26.819.11345

What is the expected behavior?

No response

Additional information

I found another report from the same date with the identical Windows build, Codex runner, function offset, call stack, and failure hash. This suggests a reproducible interaction between Codex’s isolated command-runner desktop lifecycle and a regression in this Windows Experimental build (https://techcommunity.microsoft.com/discussions/windowsinsiderprogram/gsodsystem-service-exception-in-win32kfullsetmagnificationinputtransform-when-a-/4549167).

Before this began crashing consistently, Codex also failed to create sandboxed processes with an apply deny-read ACLs error. Reinstalling Codex and clearing its local application/configuration folders did not resolve the underlying sandbox problem.

No repository file or test is named. Start by reviewing the command-runner sandbox and desktop lifecycle entry points, then use the supplied minidump and reproduction details to determine whether the crash can be reproduced safely on Windows build 26340.9233. Done should mean an identified, validated mitigation or a documented boundary when the failure is an external Windows regression.