Fix mstscax control instance and TS property-set reference leaks

[Marc-André Moreau (mamoreau-devolutions)]

Summary

This closes the primary root cause of RDMW-24263 / the forum report ("Embedded RDP sessions leak the ActiveX control after the tab is closed"): the wrapped mstscax control instance itself was never released, so every closed embedded session permanently leaked 2 native threads (mstscax!CSND::SND_Main, mstscax!CRCV::RCVMain) and ~100 handles.

It also fixes a refcount-imbalance bug that is a strong suspect for the intermittent native heap-corruption crash (ntdll.dll 0xC0000374) observed during teardown/forced-GC testing on the RDM side.

Bugs fixed

1. CClassFactory::CreateInstance leaked the real control's reference (primary leak).
   IClassFactory::CreateInstance returns the real mstscax control object with refcount 1, owned by the caller. CMsRdpClient's constructor takes its own AddRef() on that pointer, but the factory never released its copy after wrapping — so the real control's refcount never reached 0 when the CMsRdpClient wrapper was later destroyed. Nothing ever drove the control's core shutdown, matching the reported symptom exactly (send/receive threads parked forever in CTSThread::ThreadMsgLoop).

2. CMsRdpClient destructor released its wrapper objects after the control interfaces.
   m_pMsRdpExtendedSettings and m_pMsRdpExInstance hold references into control-internal objects whose lifetime is owned by the control. Reordered so wrappers are released first, before the control interfaces.

3. CMsRdpPropertySet released a reference it never took.
   It stored the internal ITSPropertySet pointer (for core/base/transport TS property sets) without an AddRef, but its destructor unconditionally called Release() on it anyway — decrementing a refcount it never incremented, which could prematurely free a control-internal object still referenced elsewhere. Added the missing AddRef() in the constructor to balance the destructor's Release().

Verification

• Full x64 build (Ninja/MSVC).
• ctest — 31/31 passing, including all existing DVC factory / plugin-reference / detached-instance regression tests from Fix ownership of WTS plugin references #189–Fix DVC plugin class factory lifetime after session removal #192.

How to verify the primary leak fix manually

Open and close N embedded RDP sessions, take a full-memory dump, count threads whose stack contains mstscax!CSND::SND_Main. Before this fix: N threads remain. After: 0.

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

[Copilot]

Copilot review overview

🟢 Approval recommended

The changes correctly balance COM ownership and preserve dependent-object lifetimes during teardown.

Review effort: Balanced
Findings: None

What changed in this PR

Fixes COM reference-count imbalances that prevented embedded RDP controls and internal property sets from being released correctly.

Changes:

• Balances CMsRdpPropertySet ownership with AddRef.
• Releases wrapper objects before control interfaces.
• Releases the factory-owned control reference after wrapping.

File	Description
dll/​RdpSettings.cpp	Balances property-set reference ownership.
dll/​MsRdpClient.cpp	Corrects control teardown order and factory reference release.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.