Firefox 154 MFCDM AppContainer launch fails in Standard Isolation (SBIE2112; DLL/driver pipe-name mismatch)

Describe what you noticed and did

Firefox 154.0 x64 is installed only on the host. In Sandboxie Plus 1.18.2 x64:

1. Use a Standard Isolation sandbox with No Admin enabled (DropAdminRights=y).
2. Start the existing host installation of Firefox in that sandbox.
3. Open about:support.
4. Observe SBIE2112 for a path under \Device\NamedPipe\Sessions\1\AppContainerNamedObjects\<redacted-SID>.
5. In the same captured session, observe the MFCDM utility launch with -sandboxingKind 2 fail with err=2; ordinary tab-process launches in the excerpt report err=0.

Expected: opening about:support should not cause Sandboxie to reject the AppContainer named-pipe path, and the related MFCDM child should start.

Actual: Firefox remains running, but the related MFCDM utility child fails before it starts. Sandboxie reports SBIE2112, and the affected CreateProcess path reports err=2.

The main technical conclusion is a byte-exact Sandboxie DLL/driver mismatch. SbieDll's File_GetBoxedPipeName inserts the Sandboxie box prefix after AppContainerNamedObjects\<SID>. SbieDrv then passes the portion after \Device\NamedPipe\ to the head-anchored Box_IsBoxedPath, which recognizes the prefix only at offset zero. The driver rejects the DLL-generated path with STATUS_OBJECT_NAME_NOT_FOUND, producing SBIE2112 and the process-launch failure.

This is a compatibility report, not a vulnerability claim. The responsible naming branch entered source in Sandboxie 1.17.0, but runtime onset was not bisected. The relevant path is unchanged from 1.18.1 to 1.18.2.

Sanitized evidence:

SBIE2112 Object is not accessible: \device\namedpipe\Sessions\1\AppContainerNamedObjects\S-1-15-2-_Sandbox__Session_1, call CreateFile (C0000034) access=001F0006 initialized=1

CreateProcess: ...\firefox.exe (... -win32kLockedDown ... tab); err=0 CreateProcess: ...\firefox.exe (... -sandboxingKind 2 ... utility); err=2

The private trace and full configurations are intentionally not attached. A separate detailed technical appendix and a four-file sanitized support ZIP are prepared locally. The ZIP contains only an unbuilt Option A candidate, a standalone six-test behavioral model, its README, and checksums. Neither Sandboxie nor the candidate was built or run on Windows.

How often did you encounter it so far?

Reproduced in the captured about:support session; also observed while using Instagram and YouTube. No long-run occurrence rate was measured.

Expected behavior

Opening about:support should not produce a Sandboxie object-access denial. When Firefox requests MFCDM capability information, the related utility child should start, and the AppContainer named-pipe path should not be rejected solely because Sandboxie's DLL and driver apply incompatible box-name placement rules.

Affected program

Firefox 154.0 x64 release

Download link

https://archive.mozilla.org/pub/firefox/releases/154.0/win64/en-US/Firefox%20Setup%20154.0.exe

Where is the program located?

The program is installed only outside the sandbox.

Did the program or any related process close unexpectedly?

No, not at all.

Crash dump

No response

What version of Sandboxie are you running now?

Sandboxie Plus 1.18.2 x64

Is it a new installation of Sandboxie?

I just updated Sandboxie from a previous version (I remember which one it is).

Is it a regression from previous versions?

No confirmed runtime bisect. The source branch responsible for this naming shape entered Sandboxie in 1.17.0, but that does not establish runtime onset. The relevant DLL transform and driver matcher are unchanged from 1.18.1 to 1.18.2.

In which sandbox type you have this problem?

In a standard isolation sandbox (yellow sandbox icon).

Can you reproduce this problem on a new empty sandbox?

My sandbox contains existing programs or data.

What is your Windows edition and version?

Windows 11 Pro 25H2 x64, build family 10.0.26200

In which Windows account you have this problem?

A local account (Standard user).

Please mention any installed security software

ESET NOD32 Antivirus™ 19.2.7.0 (HIPS support module 1527.1; Deep Behavioral Inspection support module 1252)

Did you previously enable some security policy settings outside Sandboxie?

Yes. The machine has many effective ADMX-based policies and a customized ESET configuration. Full exports were reviewed locally and are withheld because they contain private host information.

Compatibility-relevant effective settings:

• ESET HIPS is enabled; the exported numeric setting is FilteringMode=18 (reported verbatim because its UI label was not independently mapped).
• ESET Self-Defense, Protected Service, Advanced Memory Scanner, Exploit Blocker, Deep Behavioral Inspection, and Ransomware Shield are enabled.
• There are no custom ESET HIPS rules and no ESET rule or exclusion naming firefox.exe or plugin-container.exe. The one Sandboxie-specific Deep Behavioral Inspection exclusion names SbieDrv.sys; its host path is withheld.
• Windows Exploit Protection system overrides are all NOTSET, and there is no registered per-program mitigation entry for Firefox, plugin-container.exe, or the relevant Sandboxie executables.
• Effective AppLocker policy has no rules. App Control has five enforced Windows system policies and no non-system/custom policy.
• The collected Defender selection contains no ASR rule IDs, actions, or exclusions. Its Controlled Folder Access value was not returned, so no enabled/disabled claim is made for that setting.
• Effective Group Policy contains no configured value naming Firefox, plugin-container.exe, Sandboxie, AppContainerNamedObjects, or a named-pipe path. Other enabled browser-sandbox/code-integrity policies apply to Chromium-based browsers, not Firefox.
• Firefox enterprise policy has Encrypted Media Extensions enabled and locked. Firefox Content Analysis is disabled, including the captured clipboard, download, drag-and-drop, file-upload, and print interception points.

No ESET or Windows policy was changed or disabled for this reproduction or collection.

Trace log

No response

Sandboxie.ini configuration

; Full configuration and section names withheld for privacy.
; Relevant setting in the affected Standard Isolation box:
DropAdminRights=y