STATUS_INVALID_VARIANT (0XC0000232) – Variant Structure Corrupt

You're staring at a blue screen with 0xC0000232 – STATUS_INVALID_VARIANT. This isn't a random memory corruption. It's almost always a specific program or driver that passed a malformed VARIANT structure to the COM runtime. The most common real-world trigger: a third-party shell extension (like a cloud sync overlay, archiver context menu, or image editor) that uses .NET interop or old C++ code. I've seen it blow up when opening a file's properties, right-clicking in Explorer, or launching a Visual Studio debug session with a misbehaving add-in.

What's Actually Happening?

A VARIANT is a COM data type that can hold anything – integers, strings, dates, arrays. The flag inside the variant says “I'm a string”, but the actual data block points to garbage. The COM runtime checks this flag against the data, finds a mismatch, and throws STATUS_INVALID_VARIANT. The system then bugchecks because that violation happened in kernel-mode code (often a driver or filter manager).

The culprit is almost always a shell extension that's not properly handling VARIANT marshaling across process boundaries. .NET's interop layer is especially prone to this – if you've got a managed shell extension (like a Dropbox or OneDrive context menu) that references a stale COM object, that's your prime suspect.

The Fix – Step by Step

Skip the sfc /scannow and DISM restorehealth. This isn't a system file corruption. You need to find the bad extension and disable it. Here's how I've done it dozens of times.

1. Grab the crash dump. If you can still boot, open %SystemRoot%\Minidump and copy the most recent .dmp file. On a second machine, install WinDbg (from the Microsoft Store or SDK). Open the dump, run !analyze -v. Look at the MODULE_NAME and IMAGE_NAME lines – that's the driver or DLL that caused the fault. I've seen xxhash64.sys, overlayicon.dll, shellextension64.dll – things like that.
2. Check the Event Viewer. Open Event Viewer → Windows Logs → System. Filter by Event ID 1001 (BugCheck). Look for the process name – usually explorer.exe or svchost.exe. If it's explorer.exe, your problem is a shell extension.
3. Kill the suspect extension. Download ShellExView (it's free, no nonsense). Run it, sort by Type – look for Context Menu entries. Disable any third-party extensions from backup software, cloud sync, or archive tools. Restart Explorer: taskkill /f /im explorer.exe & start explorer.exe.
4. If the crash points to a driver: Open Device Manager, check for yellow exclamation marks. Update or roll back the driver for the device listed in the crash dump. I've seen old Realtek audio drivers and out-of-date Intel GPU drivers cause this. The fix is usually a clean uninstall with DDU, then reinstall the latest driver from the manufacturer's site – not Windows Update.
5. Clean up COM registration. If the crash happens after uninstalling a program (especially a .NET app), leftover COM classes can still be referenced. Run regedit and search for the module name from the crash dump in HKEY_CLASSES_ROOT\CLSID. But honestly, this is a last resort – the registry is fragile. Better to reinstall or repair the offending program.
6. Final test: Once you've disabled the extension or rolled back the driver, reboot and reproduce the scenario that crashed. If it's stable for 15 minutes, you've got it.

Still Crashing? Check These

• Check for known bad software. I've personally fixed this error caused by:
  • NVIDIA Share/Ray tracing overlay (disable via GeForce Experience)
  • Adobe Photoshop CC 2018 context menu handler
  • WinRAR 5.x shell extension (update to 6.x or disable)
  • Outdated Google Drive File Stream (v41 and earlier)
• Boot into Safe Mode with Networking. If the crash stops, the culprit is a third-party service or driver. Run msconfig → Services → hide all Microsoft services → disable everything else. Then re-enable one by one until the crash returns.
• Check for memory corruption. Rare, but possible. Run mdsched.exe and let it do a full pass. If it finds errors, your RAM is bad. But 99% of the time, it's a shell extension.

If none of this works, you're looking at a corrupted COM subsystem. I'd try a repair install of Windows using the Media Creation Tool's “Keep personal files and apps” option. That's overkill but it wipes out bad COM registrations without losing your data. Last resort – clean install. But I've never had to go that far for 0xC0000232.