JSI Tip 0809. Event ID 2012.

The STATUS_BUFFER_OVERFLOW is a non-destructive SMB error messeage (Status Message) which is normal when reading named pipes. If the client issues a read request and the information returned exceeds the clients current read buffer size, the Status Message is generated. The client may requests nnn bytes of data and the server responds that there is nnn+ bytes of data required to satisfy the request.

While this is normal, you have probably noticed it occurs almost exclusively with non-Windows NT clients.

Not all Event ID 2012 messages are STATUS_BUFFER_OVERFLOW. An Event ID 2012 can be generated by destructive messages.