Fix 0XC0190017: STATUS_TRANSACTION_INVALID_MARSHALL_BUFFER

This error hits when a transaction buffer is malformed, usually from a database sync or backup tool that corrupts the marshalling. Here's how to fix it.

You're working on a small business server — say Windows Server 2016 or 2019 — and suddenly a database application like SQL Server or a custom CRM tool spits out STATUS_TRANSACTION_INVALID_MARSHALL_BUFFER (0XC0190017). This usually happens during a transaction sync between two systems, or when restoring a backup that includes transaction logs. I had a client last month whose backup software crashed mid-restore, and every subsequent transaction attempt threw this exact error. The error means the buffer passed to NtPushTransaction or NtPullTransaction isn't formatted correctly — the marshalling got scrambled.

Root Cause

At the kernel level, Windows uses the Kernel Transaction Manager (KTM) to handle transactions for files, registry keys, and databases. The marshalling layer serializes transaction state into a buffer for transfer between processes or machines. When that buffer is corrupted — from a partial write, a power loss mid-transaction, or a bug in the application — the KTM checks the buffer's header and finds it invalid. It throws 0XC0190017 to say: "I can't work with this junk."

Common triggers include:

Aborted backup/restore operations on SQL Server or NTFS transactions
Network interruptions during distributed transactions (e.g., MSDTC)
Buggy third-party backup agents that don't properly close transaction handles
Manual edits to transaction log files (don't do that)

The Fix

Skip the application-level fixes — they won't touch the corrupted transaction state. You need to reset the KTM transaction log for the affected volume. This is safe for most apps because transactions are atomically committed or rolled back; the reset clears only incomplete or orphaned transactions.

Identify the volume
Run this command to see which drives have pending transactions:
```
fsutil transaction list
```
Look for the volume where the error occurs (often C:). Write down the volume GUID if shown.
Stop any service using transactions
If it's SQL Server, stop the service via Services.msc or PowerShell. Same for any app that's locking the transaction log. You want no active handles.
Drain pending transactions
Open an elevated Command Prompt. First, try to commit or rollback pending transactions:
```
fsutil transaction commit <TransactionGUID>
```
But if the buffer is invalid, this might fail. Move to resetting the log.
Reset the KTM log
On the affected volume, run:
```
fsutil resource setlog /resets /overwrite /path:C:\
```
Replace C:\ with your drive. This clears the KTM transaction log. Warning: This will abort all uncommitted transactions. Any data that wasn't committed will be lost. In practice, if you're seeing 0XC0190017, that data was already unrecoverable.
Reboot
Restart the server to reload KTM. Then restart your database service.
Test
Try the operation that caused the error. If it's a backup restore, run it again fresh.

If That Still Fails

Sometimes the corruption is in the application's own transaction log, not KTM's. For SQL Server, run DBCC CHECKDB to look for page-level corruption. I've also seen cases where a buggy backup agent left orphaned transaction handles — you can find them with Sysinternal's Handle.exe and kill the owning process. Last resort: restore from a known-good backup. If you don't have one, you're in for some ugly data recovery work. And for heaven's sake, make sure your backup software is compatible with your OS version. Had a client on Server 2022 using an old backup agent that didn't support ReFS — same error every time.