[eiz-claude]

Chrome, Edge, Discord and other Chromium/Electron apps go silent once a DAW has started SAR with per-app routing on, until reboot. This is the cluster in #80, #102, #121 and #127. Not closing those issues automatically: the fix is verified with Edge on the test VM, not with each reporter's app.

Cause, confirmed on the test VM

• With application routing on, the driver's registry filter points the MMDeviceEnumerator and ActivateAudioInterfaceWorker COM classes at SarAsio.dll for every process of the host's user.
• Chromium's sandboxed audio service runs with the binary-signature mitigation set to Microsoft-signed only. Code Integrity refuses to load SarAsio.dll there (event 3033), so the audio classes can't be created and the browser has no output at all.
• The filter stays registered until the driver unloads, so this lasts until reboot even after the DAW is closed.
• It also explains why starting the browser before the DAW works (the class is already loaded), and why --disable-features=AudioServiceSandbox works.

The fix skips the redirection for processes whose signature policy allows only Microsoft-, Store- or WHQL-signed images. The driver reads it with ZwQueryInformationProcess(ProcessMitigationPolicy) from the registry callback, which runs in the calling process. Those processes get the system's classes and play to the default device. Per-app routing can't reach them, since no SAR DLL can load inside that sandbox.

Test

New browser scenario group, last in the default run:

1. Register SarAsio's COM classes and start a host with application routing on.
2. Play a 440 Hz Web Audio tone in Edge, launched un-elevated, with Edge's AudioSandboxEnabled policy off and then on.
3. With the new SarTest meter command, require Edge's audio session to reach a peak of 0.01.
4. Record the audio service's mitigations, whether SarAsio.dll is loaded in it, and Code Integrity events naming it.

test VM	audio service	Microsoft-signed only	SarAsio.dll in it	CI event 3033	Edge's peak
sandbox off, without the fix	unsandboxed	OFF	yes	none	0.500
sandbox on, without the fix	audio sandbox	ON	no	yes	0.000 (no session)
sandbox off, with the fix	unsandboxed	OFF	yes	none	0.500
sandbox on, with the fix	audio sandbox	ON	no	none	0.500

The runs without this fix also include #155, the PR below this one. Before that fix, turning routing on bugchecked the VM.

Making the Edge scenario reliable

Edge failed to start in 3 of about 12 full-suite runs. Diagnostics showed Edge was updating itself: only MicrosoftEdgeUpdate.exe and Edge's setup.exe were running, and Edge's chrome_debug.log had one line. To prevent that, the scenario now:

• turns Edge updates off by policy at the start of a run that includes the browser group;
• waits for an Edge installer that's still running;
• checks that Edge's audio service actually started, retrying the launch once and reporting an Edge that never started as error, not as silence.

Two later full runs passed with no waits.

🤖 Generated with Claude Code