Preventing IsoSession relay Ctrl Handler from accessing closed stop-event handle

[Dom Giandinoto (daamenik)]

📖 Description

When running a process through the IsoSession backend's interactive console, MXC creates a Ctrl-handler to handle Ctrl-C and cmd.exe Close via Win32's SetConsoleCtrlHandler(). That ctrl-handler contains the integer payload of a stop-event that MXC's stdin relay to the IsoSession backend listens to. In the rare event in which the stop-event's handle is closed (when it's dropped at the end of create_process) before the ctrl-handler signals it, the handler could be signaling a closed handle, which is not good.

This PR adds a lock for where the stop-event handle is modified to prevent the use-after-free.

🔍 Validation

Added test_ctrl_handler_target_survives_guard_teardown and ensured its passage.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see pull request builds)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See pull request builds.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See pull request builds
for the steps.

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

Shared-event reuse allows delayed callbacks and surviving relay threads to interfere with subsequent executions.

2 open findings

• Stale callback signal stops the next execution's stdin relay · New
• Old stdin relay survives reuse and consumes input alongside the new relay · New

What changed in this PR

This PR prevents IsolationSession console Ctrl handlers from signaling a closed stop-event handle.

Changes:

• Reuses a process-lifetime stop event for interactive executions.
• Preserves per-execution event ownership for non-interactive runs.
• Adds a regression test for signaling after guard teardown.

File	Description
src/​mxc-sdk/​src/​backends/​isolation_session/​common/​manager.rs	Selects stop-event ownership based on interactive mode.
src/​mxc-sdk/​src/​backends/​isolation_session/​common/​console_mode.rs	Adds persistent event initialization, reset, and teardown coverage.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The regression tests bypass the concurrent callback/teardown interaction and would not detect removal of the locking fix.

1 open finding

• Test actual callback and teardown race deterministically · New

2 resolved since last review

• Old stdin relay survives reuse and consumes input alongside the new relay
• Stale callback signal stops the next execution's stdin relay

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Windows callback synchronization needs native validation and final human review despite no identified defects.

0 open findings

1 resolved since last review

• Test actual callback and teardown race deterministically

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Windows console-dispatch lock ordering needs human verification beyond the direct-callback tests.

0 open findings

🧠 Review effort: Balanced