Regression between v9 and v10: System.InvalidCastException when query parameter is IEnumerable

[nlriverty]

Bug description

In version 9 if an IEnumerable is used as part of the query it succeeds. In version 10 it fails with an exception. The workaround is to materialize it to an array.

Your code

namespace BugRepro.Entities;

public class Attachment
{
    public int Id { get; set; }
    public MalwareStatus MalwareStatus { get; set; }
}
[Flags]
public enum MalwareStatus
{
    Clean = 1,
    Malware = 2
}

namespace BugRepro.ViewModel;

[Flags]
public enum MalwareStatus
{
    Clean = 1,
    Malware = 2
}

var filter = new[] { BugRepro.ViewModel.MalwareStatus.Malware }.Cast<MalwareStatus>(); // ToArray() fixes it
var fromDb = db.Attachments.Where(a => filter.Any(f => (f & a.MalwareStatus) != 0))
    .Select(a => new
    {
        Status = (BugRepro.ViewModel.MalwareStatus)a.MalwareStatus
    })
    .AsAsyncEnumerable();

await foreach (var item in fromDb)
{
    Console.WriteLine(item);
}

Stack traces

System.InvalidCastException: Invalid cast from 'BugRepro.ViewModel.MalwareStatus' to 'BugRepro.Entities.MalwareStatus'.
   at System.Convert.DefaultToType(IConvertible value, Type targetType, IFormatProvider provider)
   at Microsoft.EntityFrameworkCore.Storage.ValueConversion.ValueConverter`2.Sanitize[T](Object value)
   at Microsoft.EntityFrameworkCore.Storage.ValueConversion.ValueConverter`2.<>c__DisplayClass2_0`2.<SanitizeConverter>b__1(Object v)
   at Microsoft.EntityFrameworkCore.Storage.RelationalTypeMapping.CreateParameter(DbCommand command, String name, Object value, Nullable`1 nullable, ParameterDirection direction)
   at Microsoft.EntityFrameworkCore.Storage.Internal.TypeMappedRelationalParameter.AddDbParameter(DbCommand command, Object value)
   at Microsoft.EntityFrameworkCore.Storage.Internal.RelationalParameterBase.AddDbParameter(DbCommand command, IReadOnlyDictionary`2 parameterValues)
   at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.CreateDbCommand(RelationalCommandParameterObject parameterObject, Guid commandId, DbCommandMethod commandMethod)
   at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReaderAsync(RelationalCommandParameterObject parameterObject, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.AsyncEnumerator.InitializeReaderAsync(AsyncEnumerator enumerator, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.SqlServer.Storage.Internal.SqlServerExecutionStrategy.ExecuteAsync[TState,TResult](TState state, Func`4 operation, Func`4 verifySucceeded, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.AsyncEnumerator.MoveNextAsync()
   at Program.<Main>$(String[] args) in C:\git\efcore-10-bug-repro\BugRepro\BugRepro\Program.cs:line 34
   at Program.<Main>$(String[] args) in C:\git\efcore-10-bug-repro\BugRepro\BugRepro\Program.cs:line 34
   at Program.<Main>$(String[] args) in C:\git\efcore-10-bug-repro\BugRepro\BugRepro\Program.cs:line 34
   at Program.<Main>(String[] args)

Verbose output

EF Core version

10.0.5

Database provider

SqlServer

Target framework

.NET 10

Operating system

Windows

IDE

Rider

[roji]

AI Triage

The below is an AI-generated analysis and may contain inaccuracies.

Classification

Type: Bug (regression)
Area: area-query — primitive collection parameter expansion

Summary

This is a confirmed regression introduced in EF Core 10.0.0-preview.7. When an IEnumerable<TEnum> produced by Enumerable.Cast<TEnum>() (lazy, not materialized) is used as a query parameter for a primitive collection, the query fails with InvalidCastException.

Root Cause

PR #36157 ("Handle primitive collections as multiple parameters") and the follow-up #36358 changed the default ParameterTranslationMode to MultipleParameters. In this mode, EF Core expands collection parameters into individual SQL parameters (instead of serializing the entire collection to JSON/OPENJSON).

When the collection values are extracted in SqlNullabilityProcessor.cs (line 122):

var values = ((IEnumerable?)queryParameters[valuesParameter.Name])?.Cast<object?>().ToList() ?? [];

…the resulting boxed values retain their original runtime type (ViewModelMalwareStatus), even though Cast<EntityMalwareStatus>() was applied. This is because .NET's Enumerable.Cast<T>() succeeds at runtime for enums with the same underlying type, but boxing the result preserves the original enum type identity.

Later, when each value is used to create a SQL parameter, it flows through ValueConverter.Sanitize<T>():

private static T Sanitize<T>(object value)
{
    var unwrappedType = typeof(T).UnwrapNullableType();
    return (T)(!unwrappedType.IsInstanceOfType(value)
        ? Convert.ChangeType(value, unwrappedType)
        : value);
}

IsInstanceOfType returns false (different enum types), and Convert.ChangeType cannot convert between different enum types, so it throws InvalidCastException.

In EF Core 9 and EF Core 10 previews (before preview.7), the default was the OPENJSON/JSON path, which serialized the collection to JSON (extracting the underlying integer values), so this issue didn't arise.

Regression Range

Version	Result
9.0.14	✅ Works
10.0.0-preview.3 through preview.6	✅ Works
10.0.0-preview.7	❌ Fails
10.0.0-rc.1 through 10.0.5	❌ Fails
main (current)	❌ Fails

Workarounds

1. Materialize the collection before using it in the query: .Cast<EntityEnum>().ToArray() (as the reporter noted)
2. Switch to the OPENJSON parameter mode:

   optionsBuilder.UseSqlServer(connectionString,
       o => o.UseParameterizedCollectionMode(ParameterTranslationMode.Parameter));

Possible Duplicates

No duplicates found.

Minimal repro

Project file (efcore-repro.csproj):

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net10.0</TargetFramework>
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.5" />
  </ItemGroup>
</Project>

Program (Program.cs):

using System;
using System.Linq;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Logging;

await using var context = new TestContext();
await context.Database.EnsureDeletedAsync();
await context.Database.EnsureCreatedAsync();

context.Attachments.Add(new Attachment { MalwareStatus = EntityMalwareStatus.Malware });
await context.SaveChangesAsync();

// Cast<EntityMalwareStatus>() returns a lazy IEnumerable; the actual boxed values
// retain the ViewModelMalwareStatus runtime type. ToArray() would fix it.
var filter = new[] { ViewModelMalwareStatus.Malware }.Cast<EntityMalwareStatus>();
var fromDb = context.Attachments.Where(a => filter.Any(f => (f & a.MalwareStatus) != 0))
    .Select(a => new { Status = (ViewModelMalwareStatus)a.MalwareStatus })
    .AsAsyncEnumerable();

await foreach (var item in fromDb)
{
    Console.WriteLine(item);
}

public class TestContext : DbContext
{
    public DbSet<Attachment> Attachments { get; set; }

    protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
        => optionsBuilder
            .UseSqlServer(Environment.GetEnvironmentVariable("Test__SqlServer__DefaultConnection"))
            .LogTo(Console.WriteLine, LogLevel.Information)
            .EnableSensitiveDataLogging();
}

public class Attachment
{
    public int Id { get; set; }
    public EntityMalwareStatus MalwareStatus { get; set; }
}

[Flags]
public enum EntityMalwareStatus
{
    Clean = 1,
    Malware = 2
}

[Flags]
public enum ViewModelMalwareStatus
{
    Clean = 1,
    Malware = 2
}

Expected: Query succeeds (as it does on EF Core 9)
Actual: System.InvalidCastException: Invalid cast from 'ViewModelMalwareStatus' to 'EntityMalwareStatus'

[roji]

/cc @cincuranet

[cincuranet]

Similar to #37537. Will be fixed together.

[roji]

@cincuranet OK, will assign to you. I had copilot open #38021, will leave that open and assigned to you in case it's helpful (feel free to close if not).