From 24ee80d04b9203a1b709b9c980b09fbad6f2dd59 Mon Sep 17 00:00:00 2001
From: mikhailm-coder <mikhail@flamingo.cx>
Date: Mon, 5 Oct 2026 19:08:47 +0200
Subject: [PATCH] fix(windows): report the WMI error code and warn on an empty
 os_version

CreateWmiRequest failures now end with the HRESULT, and the code that ends
the result enumeration is kept instead of being dropped. os_version warns
when its Win32_OperatingSystem query returns nothing, with that code when
reading the results failed.

Logging only, no table output or control flow changes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 osquery/core/windows/wmi.cpp                 | 30 ++++++++++++++++----
 osquery/core/windows/wmi.h                   |  6 ++++
 osquery/tables/system/windows/os_version.cpp |  8 ++++++
 3 files changed, 38 insertions(+), 6 deletions(-)

diff --git a/osquery/core/windows/wmi.cpp b/osquery/core/windows/wmi.cpp
index 89c821a97d0..5b3aeefa887 100644
--- a/osquery/core/windows/wmi.cpp
+++ b/osquery/core/windows/wmi.cpp
@@ -8,6 +8,7 @@
  */
 
 #include <locale>
+#include <sstream>
 #include <string>
 
 #include <osquery/core/windows/wmi.h>
@@ -16,6 +17,16 @@
 
 namespace osquery {
 
+namespace {
+
+std::string hresultToHex(HRESULT hr) {
+  std::ostringstream stream;
+  stream << "0x" << std::hex << hr;
+  return stream.str();
+}
+
+} // namespace
+
 WmiMethodArgs::WmiMethodArgs(WmiMethodArgs&& src) {
   std::swap(arguments, src.arguments);
 }
@@ -375,7 +386,8 @@ Expected<WmiRequest, WmiError> WmiRequest::CreateWmiRequest(
                           (LPVOID*)&locator);
   if (hr != S_OK) {
     return createError(WmiError::ConstructionError)
-           << "WmiRequest creation failed after CoCreateInstance";
+           << "WmiRequest creation failed after CoCreateInstance: "
+           << hresultToHex(hr);
   }
   WmiRequest wmi_request;
   wmi_request.locator_.reset(locator);
@@ -399,7 +411,8 @@ Expected<WmiRequest, WmiError> WmiRequest::CreateWmiRequest(
 
   if (hr != S_OK) {
     return createError(WmiError::ConstructionError)
-           << "WmiRequest creation failed to connect to server";
+           << "WmiRequest creation failed to connect to server: "
+           << hresultToHex(hr);
   }
 
   // We need to set specific authentication information on the IWbemServices
@@ -410,7 +423,8 @@ Expected<WmiRequest, WmiError> WmiRequest::CreateWmiRequest(
   hr = services->QueryInterface(IID_IClientSecurity, (LPVOID*)&pSecurity);
   if (FAILED(hr) || !pSecurity) {
     return createError(WmiError::ConstructionError)
-           << "WmiRequest creation failed in IClientSecurity interface query";
+           << "WmiRequest creation failed in IClientSecurity interface query: "
+           << hresultToHex(hr);
   }
 
   // Querying the current authentication information
@@ -435,7 +449,8 @@ Expected<WmiRequest, WmiError> WmiRequest::CreateWmiRequest(
     pSecurity->Release();
 
     return createError(WmiError::ConstructionError)
-           << "WmiRequest creation failed in QueryBlanket call";
+           << "WmiRequest creation failed in QueryBlanket call: "
+           << hresultToHex(hr);
   }
 
   // Setting authentication information on proxy interface
@@ -452,7 +467,8 @@ Expected<WmiRequest, WmiError> WmiRequest::CreateWmiRequest(
 
   if (FAILED(hr)) {
     return createError(WmiError::ConstructionError)
-           << "WmiRequest creation failed in SetBlanket call";
+           << "WmiRequest creation failed in SetBlanket call: "
+           << hresultToHex(hr);
   }
 
   wmi_request.services_.reset(services);
@@ -479,7 +495,8 @@ Expected<WmiRequest, WmiError> WmiRequest::CreateWmiRequest(
   SysFreeString(language_str);
   if (hr != S_OK) {
     return createError(WmiError::ConstructionError)
-           << "WmiRequest creation failed in ExecQuery";
+           << "WmiRequest creation failed in ExecQuery: "
+           << hresultToHex(hr);
   }
 
   wmi_request.enum_.reset(wbem_enum);
@@ -494,6 +511,7 @@ Expected<WmiRequest, WmiError> WmiRequest::CreateWmiRequest(
       wmi_request.results_.emplace_back(result);
     }
   }
+  wmi_request.enum_result_ = hr;
 
   wmi_request.status_ = Status(0);
   return wmi_request;
diff --git a/osquery/core/windows/wmi.h b/osquery/core/windows/wmi.h
index 6237c945952..a7fd28a50e3 100644
--- a/osquery/core/windows/wmi.h
+++ b/osquery/core/windows/wmi.h
@@ -247,6 +247,11 @@ class WmiRequest {
     return status_;
   }
 
+  /// Code that ended result enumeration; WBEM_S_FALSE when all rows were read.
+  HRESULT getEnumerationResult() const {
+    return enum_result_;
+  }
+
   /**
    * @brief Windows WMI Helper function to execute a WMI method call on
    * the given object (wrapped in a result)
@@ -261,6 +266,7 @@ class WmiRequest {
  private:
   WmiRequest() = default;
   Status status_;
+  HRESULT enum_result_{S_OK};
   std::vector<WmiResultItem> results_;
 
   std::unique_ptr<IEnumWbemClassObject, impl::WmiObjectDeleter> enum_{nullptr};
diff --git a/osquery/tables/system/windows/os_version.cpp b/osquery/tables/system/windows/os_version.cpp
index d8438146132..ad389893082 100644
--- a/osquery/tables/system/windows/os_version.cpp
+++ b/osquery/tables/system/windows/os_version.cpp
@@ -37,6 +37,14 @@ QueryData genOSVersion(QueryContext& context) {
   const std::vector<WmiResultItem>& wmiResults = wmiRequest->results();
 
   if (wmiResults.empty()) {
+    const auto enumResult = wmiRequest->getEnumerationResult();
+    if (FAILED(enumResult)) {
+      LOG(WARNING) << "WMI query on Win32_OperatingSystem failed while "
+                      "reading results: 0x"
+                   << std::hex << enumResult;
+    } else {
+      LOG(WARNING) << "WMI query on Win32_OperatingSystem returned no results";
+    }
     return {};
   }