Null Reference Exception during command timeout

[m0a0k0s]

Describe the bug

NullReferenceException on timeout instead of SqlException.
I see only couple of them in production for the last month.

ExceptionDetail_HResult -2147467261
ExceptionDetail_Message Object reference not set to an instance of an object.
ExceptionDetail_Source Microsoft.Data.SqlClient
ExceptionDetail_StackTrace
   at Microsoft.Data.SqlClient.TdsParserStateObject.ReadSniSyncOverAsync()
   at Microsoft.Data.SqlClient.TdsParserStateObject.TryPrepareBuffer()
   at Microsoft.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady)
   at Microsoft.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)
   at Microsoft.Data.SqlClient.TdsParser.ProcessAttention(TdsParserStateObject stateObj)
   at Microsoft.Data.SqlClient.TdsParser.ProcessPendingAck(TdsParserStateObject stateObj)
   at Microsoft.Data.SqlClient.TdsParserStateObject.ResetCancelAndProcessAttention()
   at Microsoft.Data.SqlClient.TdsParserStateObject.CloseSession()
   at Microsoft.Data.SqlClient.SqlCommand.EndExecuteNonQueryAsync(IAsyncResult asyncResult)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location ---
   at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteNonQueryAsync(RelationalCommandParameterObject parameterObject, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteNonQueryAsync(RelationalCommandParameterObject parameterObject, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteNonQueryAsync(RelationalCommandParameterObject parameterObject, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.RelationalDatabaseFacadeExtensions.ExecuteSqlRawAsync(DatabaseFacade databaseFacade, String sql, IEnumerable`1 parameters, CancellationToken cancellationToken)
   at ...

ExceptionDetail_TargetSite Void ReadSniSyncOverAsync()
ExceptionDetail_Type System.NullReferenceException
observed_timestamp 1781769665345251900

CommandTimeout	'60'
CommandType	'Text',
EventId_Id	20102
EventId_Name	Microsoft.EntityFrameworkCore.Database.Command.CommandError
commandText	DELETE dbo.SYSException WHERE CreatedOn < @CutoffTime
elapsed		65,002
message_template_text	Failed executing DbCommand ({elapsed}ms) [Parameters=[{parameters}], CommandType='{commandType}', CommandTimeout='{commandTimeout}']{newLine}{commandText}
newLine	
observed_timestamp	1781769665329176300
parameters	@CutoffTime='?' (DbType = DateTime)
scope_name	Microsoft.EntityFrameworkCore.Database.Command

Further technical details

Microsoft.Data.SqlClient version: 6.1.2
EF Core: Microsoft.EntityFrameworkCore.SqlServer 9.0.7
.NET target: .Net 9
SQL Server version: SQL Server 2022
Operating system: Windows Server 2022
multipleactiveresultsets=True

Additional context
Similar to #3720

[cheenamalhotra]

/triage

[github-actions]

Caution

Security scanning requires review for SqlClient Issue Auto-Triage

Details

The threat detection results could not be parsed. The workflow output should be reviewed before merging.

Review the workflow run logs for details.

🔍 Triage Summary (on-demand re-triage)

Check	Result
Issue type	Bug
Environment	All required environment details provided for investigation
Area	Area\Async
Duplicates	Potentially related: #3720 (NullReferenceException in async callback, same SqlClient 6.1.2 / .NET 9, different stack entry point)
Regression	Not indicated

Analysis

When an async command (EndExecuteNonQueryAsync) times out after 65 seconds (60s CommandTimeout), the cleanup path invokes CloseSession() → ResetCancelAndProcessAttention() → ProcessPendingAck() → ProcessAttention() → TdsParser.Run(), which ultimately calls ReadSniSyncOverAsync() where a NullReferenceException is thrown instead of the expected SqlException. MARS is enabled (multipleactiveresultsets=True), which introduces complex concurrent session state management where SNI packet handles or the network packet task source may already be null/disposed when the attention-acknowledgment read is attempted. This is a P2 bug — intermittent in production but results in an unhandled exception that can corrupt connection state.

Next Steps

• Assign this issue to Copilot coding agent to investigate TdsParserStateObject.ReadSniSyncOverAsync() — specifically identify which object reference is null at that point (likely _networkPacketTaskSource, a packet handle, or the SNI session object), and apply a null-guard that converts the NullReferenceException into the appropriate SqlException (timeout) so the connection can be cleanly terminated rather than crashing.
• Investigation should also cover TdsParserStateObject.CloseSession() and TdsParser.ProcessAttention() to understand whether the MARS session teardown interleaves with attention processing, and whether the async timeout cancellation path clears SNI state before ProcessPendingAck has completed its synchronous read.
• Review the fix applied (if any) for related issue Unobserved null reference exception #3720 (ReadAsyncCallback/SniMarsHandle path) to see if the same null-guard pattern can be applied consistently to the sync-over-async path.

Note: This triage summary is auto-generated by an AI agent. The analysis and suggestions above have not been verified by a human maintainer. Please treat as preliminary guidance only.

Generated by SqlClient Issue Auto-Triage for issue #4374 · ● 2.4M · ◷