I can confirm the same behaviour if I try the following on a content process in a debugger: * When the content process starts up, I make the debugger break when `ntmarta` is loaded; * In the debugger, I changed the NTSTATUS return code from STATUS_SUCCESS to STATUS_ACCESS_DENIED; * Walking up the call stack, I end up with error code 127 being returned from SetEntriedInAclW. So I guess the next question is, what is it about the RDD process sandbox policy that is blocking this delayloaded DLL?
Bug 1535704 Comment 4 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I can confirm the same behaviour if I try the following on a content process in a debugger: * When the content process starts up, I make the debugger break when `ntmarta` is loaded via delayload from `SetEntriesInAclW`; * In the debugger, I changed the `NTSTATUS` return code from `STATUS_SUCCESS` to `STATUS_ACCESS_DENIED`; * Walking up the call stack, I end up with error code 127 being returned from `SetEntriesInAclW`. So I guess the next question is, what is it about the RDD process sandbox policy that is blocking this delayloaded DLL?