Explanation of "Status Buffer Overflow" Error

Certain conditions, which can report a network error to the event log, are caused by a non-destructive Server Message Block (SMB) message also known a "Status Message." Most commonly the error reported in the event log is network error event 2012. It is a nondestructive event that should not cause any loss of functionality.

This condition can be caused by a STATUS_BUFFER_OVERFLOW SMB error. The STATUS_BUFFER_OVERFLOW error is normal when reading from named pipes. This occurs when a client has a read request and the requested information exceeds the clients current read buffer size as the client advertised it during the initial read request. The client requests a read of x bytes. The server responds and may set status to STATUS_BUFFER_OVERFLOW to inform the client that there is more data in its buffer than it could put in the packet.

It is a nondestructive event that should not cause any loss of functionality. It is important to verify that the STATUS_BUFFER_OVERFLOW error is seen in the packet capture because event 2012 can be caused by other destructive events, which may impact the network.