Do not over-read the labelMicrosoft names the NTSTATUS STATUS_STACK_BUFFER_OVERRUN, but applications also use this exception code for non-buffer Fail Fast conditions. The first exception parameter carries the subcode.

First identify what terminated.

node.exeDSH Host or Node child

Use PID lineage, native module, stack, and last durable Session sequence.

pwsh.exeTool child

One command should fail without converting the child crash into Host exit.

wrapper.exeDesktop owner

Record wrapper and child Host exits separately; the window title is not process identity.

no WER eventControlled exit

Route CLI, lifecycle, or usage failure before native-crash analysis.

Capture one bounded foreground run.

Get-Command dsh,node,npm,pnpm,pwsh -All |
  Select Name,CommandType,Source,Version

$started = Get-Date
dsh web --no-open 1> stdout.log 2> stderr.log
'0x{0:X8}' -f [uint32]$LASTEXITCODE

Preserve command resolution, exact versions, timestamps, PID/parent PID, standard streams, and the first error. Redact credentials, signed URLs, prompts, and private paths before sharing.

Correlate three evidence planes.

Process treeWho owned the exit?

Executable path, PID, parent PID, creation time, non-secret argument shape.

Windows Error ReportingWhat failed natively?

Faulting application/module, exception, report id, subcode, and stack.

Harness durabilityWhat committed first?

Last Session sequence and whether tool admission, execution, or result persistence crossed its boundary.

One-variable A/BWhat changes the outcome?

Node, DSH artifact, profile, plugin, or action—change one, keep the rest fixed.

A dump is evidence and sensitive data.

procdump.exe -accepteula -ma -e <confirmed-pid> <private-dump-dir>
Attach only to the confirmed process.

Use an approved Microsoft Sysinternals binary. Keep dumps encrypted and access-controlled; they can contain API keys, prompts, files, environment values, registry data, and network material. Never upload them publicly.

Twelve gates before claiming a cause.

statusDecimal + hex.

Preserve unsigned eight-digit representation.

identityExact executables.

Prove dsh, Node, package manager, shell, and wrapper resolution.

lineagePID + parent PID.

Name the process that actually terminated.

WEROne correlated event.

Match timestamp, application, module, exception, and report id.

dumpSubcode + stack.

Do not infer either from the numeric status.

A/BOne changed variable.

Do not reinstall or reset several ownership layers together.

Primary evidence.

Route the crash before repairing it.

The canonical Windows guide includes the complete process, WER, dump, privacy, A/B, persistence, and reporting contract.

Read the full Windows runbook