The freeze on context change is the lock/login rendering on a PHYSICAL monitor
instead of the captured SudoVDA display. Root cause: the legacy isolate_displays
(EnumDisplayDevices + ChangeDisplaySettings) found NOTHING to detach on this hybrid
box (4090 + AMD iGPU) — an iGPU-attached monitor isn't flagged ATTACHED_TO_DESKTOP
in the GDI enum, so it's never detached and the secure desktop lands on it while the
virtual output freezes. (Log: isolate ran, logged zero "detaching" lines.)
Add CCD-based isolation (QueryDisplayConfig(QDC_ONLY_ACTIVE_PATHS) + SetDisplayConfig)
— the API Apollo uses, which sees every active path. Deactivate all active paths
except the SudoVDA target's, leaving the virtual display the sole desktop so ALL
content (incl. Winlogon) renders to it. Runs alongside the legacy pass (now a no-op
fallback); the original topology is saved and restored on teardown before REMOVE.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
enricobuehler
2ac1014e8e