Fix ERROR_FLOATED_SECTION (0x1ABE): I/O on floated section object

What's Actually Happening Here

The error 0x00001ABE — ERROR_FLOATED_SECTION — means your program tried to read or write a memory-mapped file (a section object in NT kernel speak) that got "floated" because the transaction it belonged to ended. When a transaction commits or rolls back, the kernel detaches any section objects created under that transaction. Any subsequent I/O to those detached mappings fails with this error.

I've hit this most often with apps using Transactional NTFS (TxF) or Kernel Transaction Manager (KTM) — think SQL Server, custom logging systems, or backup tools that map files inside a transaction scope. The fix is never random: you either closed the transaction too early, opened the wrong handle, or a driver did something stupid.

Cause #1: Stale Mapped View After Transaction Commit

This is the most common cause — and the one you can fix without touching the kernel. Here's the typical scenario:

1. Your app opens a file with CreateFile using FILE_FLAG_TRANSACTED.
2. It creates a file mapping with CreateFileMapping using that handle.
3. It maps a view with MapViewOfFile.
4. It does some reads/writes inside the transaction.
5. It calls CommitTransaction or RollbackTransaction.
6. It then tries to read or write through the same mapped view — boom, error 0x1ABE.

The real fix: You must unmap the view before the transaction ends. The kernel detaches the section as part of the commit/rollback sequence. If you need data after the transaction, copy it out first.

// Correct order:
// 1. Unmap view
UnmapViewOfFile(pView);

// 2. Close mapping handle
CloseHandle(hMapping);

// 3. Commit transaction
CommitTransaction(hTransaction);

// 4. Now safe to close file handle
CloseHandle(hFile);

If you get this error in a third-party app, close and reopen the file after the transaction finishes. The app shouldn't hold mapped views across transaction boundaries — if it does, that's a bug in the app, and you should file a report.

Cause #2: Cross-Transaction File Access

Less common but nasty. Some apps try to open a file that's already inside a transaction from another process or another handle without proper transaction isolation. Example: Process A has a transaction on fileC:\data\log.txf, maps it, and writes. Process B opens the same file without FILE_FLAG_TRANSACTED and tries to create its own mapping. When Process A commits, Windows flushes the section — but Process B's mapping points to the now-floated section.

What's actually happening: The kernel ties the section object to the transaction's isolated view of the file. A non-transacted handle sees the file differently (the committed or rolled-back version). The moment the transaction ends, the kernel dissociates the section from the transaction's log — and any stray mapping referencing that section gets the floating error.

The fix: Make sure all handles to a transacted file use the same transaction, or don't mix transacted and non-transacted access on the same file. If you need cross-process sharing, either use named transactions (via OpenTransaction) or avoid TxF entirely and use a simpler lock file scheme.

// Wrong:
HANDLE hFile = CreateFile(L"log.dat", GENERIC_READ, FILE_SHARE_READ,
    NULL, OPEN_EXISTING, FILE_FLAG_TRANSACTED, NULL);
// ... later, another thread does:
HANDLE hFile2 = CreateFile(L"log.dat", GENERIC_READ, 0, // no transacted flag
    NULL, OPEN_EXISTING, 0, NULL);
// This second handle won't see the transaction's modifications,
// and mapping it creates a section that may be invalidated.

If you can't control the other process (e.g., antivirus scanning your transacted file), your only option is to ensure the transaction is short-lived. Commit quickly, release all mappings, then let the other process have its turn.

Cause #3: Driver or Filter Manager Holding Old Section References

This is the advanced case and the rarest. A file system filter driver (like anti-malware, backup drivers, or encryption filters) might cache a reference to a section object during a transaction's lifetime. When the transaction ends, the driver's reference becomes stale. Then the driver tries to complete an I/O operation on that section — and generates ERROR_FLOATED_SECTION to your app.

You'll know this is the problem because:

• The error happens asynchronously — after your app has already cleaned up its own handles.
• Event Viewer shows filter manager or fltmgr warnings around the same time.
• The app works on some machines (without the filter) but fails on others (with it).

The fix: First, check which filter drivers are loaded with fltmc instances at an admin command prompt. Look for anything related to backup, antivirus, or encryption. Temporarily disable the filter (uninstall the driver or stop the service) to confirm it's the cause. If it is, contact the filter vendor — they need to update their driver to handle section flushing correctly. There's nothing your app can do about a buggy kernel driver except work around it by avoiding mapped I/O with transactions.

fltmc instances

# Look for lines like:
# 99999999 mini-filter        NameOfDriver       Altitude    Instance
# If you see something like "Symantec", "McAfee", "VeraCrypt", try disabling it.

If the driver is necessary, your only workaround is to not use memory-mapped files with transactions. Use ReadFile/WriteFile instead. Those go through the I/O manager properly and don't leave dangling section references.

Quick-Reference Summary

The takeaway: ERROR_FLOATED_SECTION isn't random. It's a contract violation — your app or a driver held a reference to a section past the transaction's lifetime. Fix the ordering, fix the isolation, or fix the driver. One of those three will kill it.