feat(host/windows): seal the host↔driver channels (frame + gamepad, proto v2)

Frame ring (pf-vdisplay) and both gamepad SHM channels move off named Global\
objects (openable by any sibling LocalService) to UNNAMED sections/events whose
handles the host DuplicateHandles into the driver's verified WUDFHost with least
access — frame delivery over the SYSTEM+admins-only IOCTL_SET_FRAME_CHANNEL,
pads over a 32-byte named bootstrap mailbox (pid + handle value only, DoS-bounded;
HID minidrivers have no control device). Driver-validated pad_index kills
cross-pad redirects; v1↔v2 mixes fail closed with diagnosis logs on both sides.
Sibling-LocalService denial proven empirically (design/idd-push-security.md,
design/gamepad-channel-sealing.md).

Driver-side raw ops now live behind pf-umdf-util (checked shm accessors, the
forbid(unsafe_code) ChannelClient state machine, WDF request tokens) — the pad
drivers' logic is 100% safe Rust; whole drivers workspace clippy-gated in CI.

driver install --gamepad now sweeps SWD\punktfunk phantom devnodes: a re-created
SwDevice REVIVES the old devnode with its previously-bound driver (never
re-ranks), so an upgrade otherwise leaves the old driver serving — or, across
the v1→v2 fence, a dead pad (found live on the RTX box).

On-glass validated on the RTX 4090 box: frame path 7007 frames p50 2.06 ms
cross-machine; DualSense + XUSB "sealed pad channel mapped"/proto=2 attach via
both the test harness and a real streaming session; phantom-sweep repro.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/vdisplay/windows/manager.rs

@@ -39,11 +39,13 @@ pub(crate) enum MonitorKey {
     Session(u64),
 }
 
-/// What a backend's `add_monitor` returns: the REMOVE key + the OS target id + the render LUID.
+/// What a backend's `add_monitor` returns: the REMOVE key + the OS target id + the render LUID + the
+/// driver's WUDFHost pid (the sealed frame channel's handle-duplication target).
 pub(crate) struct AddedMonitor {
     pub key: MonitorKey,
     pub target_id: u32,
     pub luid: LUID,
+    pub wudf_pid: u32,
 }
 
 /// The backend-specific IOCTL surface — the *only* thing that differs between SudoVDA and pf-vdisplay.
@@ -91,6 +93,9 @@ struct Monitor {
     key: MonitorKey,
     target_id: u32,
     luid: LUID,
+    /// The driver's WUDFHost pid (from the ADD reply) — carried into [`WinCaptureTarget`] so the
+    /// IDD-push capturer knows where to duplicate the sealed frame channel's handles.
+    wudf_pid: u32,
     gdi_name: Option<String>,
     mode: Mode,
     stop: Arc<AtomicBool>,
@@ -109,6 +114,7 @@ impl Monitor {
                 adapter_luid: crate::capture::dxgi::pack_luid(self.luid),
                 gdi_name: n,
                 target_id: self.target_id,
+                wudf_pid: self.wudf_pid,
             })
     }
 }
@@ -166,6 +172,14 @@ pub(crate) fn vdm() -> &'static VirtualDisplayManager {
         .expect("VirtualDisplayManager used before a backend initialised it")
 }
 
+/// The live pf-vdisplay control-device handle, for the IDD-push capturer's sealed-channel delivery
+/// (`IOCTL_SET_FRAME_CHANNEL`). Safe to hand out as a bare `HANDLE`: the device lives in a `OnceLock`
+/// that is never cleared or closed for the process lifetime. `None` before the first backend open —
+/// impossible for a capturer, which only exists on a monitor the manager created.
+pub(crate) fn control_device_handle() -> Option<HANDLE> {
+    VDM.get().and_then(VirtualDisplayManager::device_handle)
+}
+
 impl VirtualDisplayManager {
     pub(crate) fn backend_name(&self) -> &'static str {
         self.driver.name()
@@ -436,6 +450,7 @@ impl VirtualDisplayManager {
             key: added.key,
             target_id: added.target_id,
             luid: added.luid,
+            wudf_pid: added.wudf_pid,
             gdi_name,
             mode,
             stop,

crates/punktfunk-host/src/vdisplay/windows/pf_vdisplay.rs

@@ -158,6 +158,33 @@ unsafe fn set_render_adapter(h: HANDLE, luid: LUID) -> Result<()> {
     .context("pf-vdisplay SET_RENDER_ADAPTER")
 }
 
+/// Deliver a monitor's sealed frame channel to the driver: the handle values `req` carries were just
+/// duplicated into the driver's WUDFHost by the IDD-push capturer's broker (`idd_push::ChannelBroker`),
+/// and on IOCTL success the DRIVER owns them. No output buffer. The caller reaps the remote duplicates
+/// on failure (the broker's `DUPLICATE_CLOSE_SOURCE` sweep) so no path leaks WUDFHost handles.
+///
+/// # Safety
+/// `dev` must be a live pf-vdisplay control handle (see [`super::manager::control_device_handle`]).
+pub(crate) unsafe fn send_frame_channel(
+    dev: HANDLE,
+    req: &control::SetFrameChannelRequest,
+) -> Result<()> {
+    let mut none: [u8; 0] = [];
+    // SAFETY: per this fn's contract `dev` is the live control handle. `bytes_of(req)` borrows the
+    // caller's request for the duration of this synchronous call as the input bytes; `none` is empty,
+    // so there is no output buffer.
+    unsafe {
+        ioctl(
+            dev,
+            control::IOCTL_SET_FRAME_CHANNEL,
+            bytemuck::bytes_of(req),
+            &mut none,
+        )
+    }
+    .map(|_| ())
+    .context("pf-vdisplay SET_FRAME_CHANNEL")
+}
+
 unsafe fn open_device() -> Result<HANDLE> {
     let hdev = SetupDiGetClassDevsW(
         Some(&PF_VDISPLAY_INTERFACE),
@@ -354,12 +381,13 @@ impl VdisplayDriver for PfVdisplayDriver {
             HighPart: reply.adapter_luid_high,
         };
         tracing::info!(
-            "pf-vdisplay created {}x{}@{} (target_id={}, adapter_luid={:#x})",
+            "pf-vdisplay created {}x{}@{} (target_id={}, adapter_luid={:#x}, wudf_pid={})",
             mode.width,
             mode.height,
             mode.refresh_hz,
             reply.target_id,
-            luid.LowPart
+            luid.LowPart,
+            reply.wudf_pid
         );
         // Per-client identity diagnostic: did the driver honor the host's preferred (stable) monitor id?
         // A pre-Phase-2 driver leaves resolved_monitor_id=0 (it ignored the field); a current driver echoes
@@ -395,6 +423,7 @@ impl VdisplayDriver for PfVdisplayDriver {
             key: MonitorKey::Session(session_id),
             target_id: reply.target_id,
             luid,
+            wudf_pid: reply.wudf_pid,
         })
     }