Sql Server - SqlException: Invalid column name 'Value' in LINQ Contains with Array.All() when array size ≥ 2099

[JaderCM-Kneat]

Bug description

When a LINQ query uses Array.All() with Contains() and the array contains 2099 or more elements, Entity Framework Core generates invalid SQL that results in:

SqlException: Invalid column name 'Value'

Observed Behavior

• Arrays with ≤ 2098 elements: query executes successfully
• Arrays with ≥ 2099 elements: SqlException is thrown due to case-mismatched column references in the generated SQL

Generated SQL (Problematic)

EF Core generates a subquery using OPENJSON but references the column with inconsistent casing:

• Declaration: NOT EXISTS (SELECT 1 FROM OPENJSON(@ids) WITH ([value] int '$') AS [i] (lowercase [value])
• Reference: WHERE [u].[Id] <> [i].[Value] OR [i].[Value] IS NULL (uppercase [Value])

This violates SQL Server's column case sensitivity in certain collation contexts.

Critical Threshold

The issue occurs specifically at the 2099-element boundary, suggesting EF Core switches its SQL translation strategy when exceeding this array size.

Reproduction Steps

1. Create a user array with 2099+ elements
2. Execute LINQ query: context.Users.Where(user => ids.All(id => user.Id == id)
3. SqlException is thrown with "Invalid column name 'Value'"
4. Reduce array to 2098 elements → query succeeds

Environment

• Entity Framework Core 10.0.2
• SQL Server
• Query pattern: Array.All() combined with equality check

Expected Behavior

The generated SQL should use consistent column name casing regardless of array size, allowing queries to execute successfully with any number of elements.

Your code

class User
{
    public int Id { get; init; }
}

var ids = Enumerable.Repeat(1, 2099);

var users = context.Set<User>()
    .Where(user => ids.All(id => user.Id == id))
    .AsQueryable();

Console.WriteLine(users.ToQueryString());

try
{
    var result = await users.ToListAsync();
    Console.WriteLine($"Found {result.Count} users.");
} catch (Exception ex)
{
    Console.WriteLine(ex.Message);
}

Stack traces

Microsoft.Data.SqlClient.SqlException (0x80131904): Invalid column name 'Value'.
Invalid column name 'Value'.
   at Microsoft.Data.SqlClient.SqlCommand.<>c.<ExecuteDbDataReaderAsync>b__195_0(Task`1 result)
   at System.Threading.Tasks.ContinuationResultTaskFromResultTask`2.InnerInvoke()
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
--- End of stack trace from previous location ---
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Threading.Tasks.Task.ExecuteWithThreadLocal(Task& currentTaskSlot, Thread threadPoolThread)
--- End of stack trace from previous location ---
   at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReaderAsync(RelationalCommandParameterObject parameterObject, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReaderAsync(RelationalCommandParameterObject parameterObject, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.AsyncEnumerator.InitializeReaderAsync(AsyncEnumerator enumerator, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.SqlServer.Storage.Internal.SqlServerExecutionStrategy.ExecuteAsync[TState,TResult](TState state, Func`4 operation, Func`4 verifySucceeded, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.Query.Internal.SingleQueryingEnumerable`1.AsyncEnumerator.MoveNextAsync()
   at Microsoft.EntityFrameworkCore.EntityFrameworkQueryableExtensions.ToListAsync[TSource](IQueryable`1 source, CancellationToken cancellationToken)
   at Microsoft.EntityFrameworkCore.EntityFrameworkQueryableExtensions.ToListAsync[TSource](IQueryable`1 source, CancellationToken cancellationToken)
   at Program.<Main>$(String[] args) in C:\Windows\Temp\ConsoleApp1\ConsoleApp1\Program.cs:line 16
ClientConnectionId:40fa6b5a-6066-41a2-941a-5cdb50fabfd2
Error Number:207,State:1,Class:16

Verbose output

EF Core version

10.0.2

Database provider

Microsoft.EntityFrameworkCore.SqlServer

Target framework

.NET 10

Operating system

Windows 11 Pro 25H2

IDE

Visual Studio 2026 18.2.1

[roji]

Confirmed regression in 10.

For the following:

var ids = Enumerable.Repeat(1, 2099);
_ = await context.Users.Where(user => ids.All(id => user.Id == id)).ToListAsync();

We generate the following SQL:

SELECT [u].[Id]
FROM [Users] AS [u]
WHERE NOT EXISTS (
    SELECT 1
    FROM OPENJSON(@ids) WITH ([value] int '$') AS [i]
    WHERE [u].[Id] <> [i].[Value] OR [i].[Value] IS NULL)

Note the case difference between value and Value. This doesn't cause an issue by default, since SQL Server is case-insensitive (also with regards to column names); but the bug is there and probably affects databases explicitly configured with case-sensitive collations.

Minimal repro

await using var context = new BlogContext();
await context.Database.EnsureDeletedAsync();
await context.Database.EnsureCreatedAsync();

var ids = Enumerable.Repeat(1, 2099);
_ = await context.Users.Where(user => ids.All(id => user.Id == id)).ToListAsync();

class BlogContext : DbContext
{
    public DbSet<User> Users { get; set; }
    protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
        => optionsBuilder
            .UseSqlServer(Environment.GetEnvironmentVariable("Test__SqlServer__DefaultConnection"))
            .LogTo(Console.WriteLine, LogLevel.Information)
            .EnableSensitiveDataLogging();
}

class User
{
    public int Id { get; set; }
}