runtime: System.Diagnostics.Eventing.Reader.EventLogRecord throws an InvalidOperationException on Windows 11

Description

On Windows 11, System.Diagnostics.Eventing.Reader.EventLogRecord (version 5.0.1) throws an InvalidOperationException when accessing its Properties:

System.InvalidOperationException: We do not have 18 variants given for the UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventValues flag. (System Properties)

This happens for any event log file and I can reproduce with a very minimal sample program (see [Reproduction Steps]). The issue does not occur when using the same log file on Win10.

The exception occurs on the following call stack:

at System.Diagnostics.Eventing.Reader.NativeWrapper.EvtRenderBufferWithContextSystem(EventLogHandle contextHandle, EventLogHandle eventHandle, EvtRenderFlags flag, SystemProperties systemProperties, Int32 SYSTEM_PROPERTY_COUNT)
at System.Diagnostics.Eventing.Reader.EventLogRecord.PrepareSystemData()
at System.Diagnostics.Eventing.Reader.EventLogRecord.get_Id()
at WinEvent.Program.Main(String[] args) 

The problem is that SYSTEM_PROPERTY_COUNT is hard coded to 18, but propCount is 16 on Win11. See below:

https://github.com/dotnet/runtime/blob/895c99cc502913fd7393b95af7cae5b9e6fbdea3/src/libraries/System.Diagnostics.EventLog/src/System/Diagnostics/Reader/NativeWrapper.cs

      public static void EvtRenderBufferWithContextSystem(EventLogHandle contextHandle, EventLogHandle eventHandle, UnsafeNativeMethods.EvtRenderFlags flag, SystemProperties systemProperties, int SYSTEM_PROPERTY_COUNT)
      {
          IntPtr buffer = IntPtr.Zero;
          IntPtr pointer = IntPtr.Zero;
          int bufferNeeded;
          int propCount;

          try
          {
              bool status = UnsafeNativeMethods.EvtRender(contextHandle, eventHandle, flag, 0, IntPtr.Zero, out bufferNeeded, out propCount);
              if (!status)
              {
                  int error = Marshal.GetLastWin32Error();
                  if (error != UnsafeNativeMethods.ERROR_INSUFFICIENT_BUFFER)
                      EventLogException.Throw(error);
              }

              buffer = Marshal.AllocHGlobal((int)bufferNeeded);
              status = UnsafeNativeMethods.EvtRender(contextHandle, eventHandle, flag, bufferNeeded, buffer, out bufferNeeded, out propCount);
              int win32Error = Marshal.GetLastWin32Error();
              if (!status)
                  EventLogException.Throw(win32Error);

              if (propCount != SYSTEM_PROPERTY_COUNT)  // <<-- Here propCount is 16 in Win11
                  throw new InvalidOperationException("We do not have " + SYSTEM_PROPERTY_COUNT + " variants given for the UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventValues flag. (System Properties)");

https://github.com/dotnet/runtime/blob/57bfe474518ab5b7cfe6bf7424a79ce3af9d6657/src/libraries/System.Diagnostics.EventLog/src/System/Diagnostics/Reader/EventLogRecord.cs

namespace System.Diagnostics.Eventing.Reader
{
    public class EventLogRecord : EventRecord
    {
        private const int SYSTEM_PROPERTY_COUNT = 18;  <<-- 

I’m not sure if this is considered as a Win11’s bug. According to EvtRender, I don’t see any guarantee about PropertyCount.

Note that PowerShell Get-WinEvent is also affected by this because it uses System.Diagnostics.Eventing.Reader.EventLogRecord:

Get-WinEvent : We do not have 18 variants given for the  UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventValues flag. (System Properties)
At line:1 char:1
+ Get-WinEvent -Path "C:\Users\...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-WinEvent], InvalidOperationException
    + FullyQualifiedErrorId : We do not have 18 variants given for the  UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventValues flag. (System Properties),Microsoft.PowerShell.Commands.GetWinEventCommand

__

Reproduction Steps

I can reproduce with the following simple program:

using System;
using System.Diagnostics.Eventing.Reader;

class Program
{
    static void Main(string[] args)
    {
        var file = args[0];
        var query = new EventLogQuery(file, PathType.FilePath, "*");

        using (var reader = new EventLogReader(query))
        {
            EventRecord record;
            while ((record = reader.ReadEvent()) != null)
            {
                Console.WriteLine($"event {record.Id}");
            }
        }
    }
}

Or, as I mentioned, you can see the repro with PowerShell’s Get-WinEvent too.

Expected behavior

EventLogRecord shouldn’t fail with InvalidOperationException even if it’s run on Win11.

Actual behavior

On Windows 11, System.Diagnostics.Eventing.Reader.EventLogRecord (version 5.0.1) throws an InvalidOperationException when accessing its Properties.

Regression?

No response

Known Workarounds

No response

Configuration

I’ve tested with .NET Core (5.0), .NET Framework.

Other information

No response