KB5132061: DDEML server no longer receives XTYP_CONNECT when DDEMLMom is subclassed with SetWindowLongPtrA

After installing KB5132061 (Windows 11 25H2, OS build 26200.9974), our 32-bit DDEML server stopped accepting

DDE conversations. Uninstalling the KB fixes it.

We narrowed it down to one condition: the server's hidden DDEMLMom window is subclassed through the ANSI API.

That happens automatically in any MBCS (non-Unicode) MFC application that calls DdeInitialize after its first window

exists, because MFC's CBT hook subclasses new top-level windows and forwards messages with CallWindowProcA.

Is this a known issue in KB5132061, and is a fix planned?

Observed behavior with KB5132061

• SetWindowLongPtrA(DDEMLMom, GWLP_WNDPROC, ...) returns an A/W handle (0xFFFFxxxx), as documented.
• Our subclass procedure receives WM_DDE_INITIATE and forwards it with CallWindowProcA(previousProc, ...). The call returns 0, but the DDEML callback never receives XTYP_CONNECT.
• The client's DdeConnect fails with DMLERR_NO_CONV_ESTABLISHED. No other error is reported.
• With SetWindowLongPtrW / CallWindowProcW the same server works on the same machine.
• On build 26200.9711 (without KB5132061), both variants work.

| | With KB5132061 (26200.9974) | Without KB5132061 (26200.9711) |

| server A (SetWindowLongPtrA + CallWindowProcA) | FAILED | CONNECTED |

| server W (SetWindowLongPtrW + CallWindowProcW) | CONNECTED | CONNECTED |

Server and client run as the same user, in the same session, at the same integrity level.

Minimal repro (about 80 lines, plain Win32, no MFC)

Build as 32-bit from a "x86 Native Tools Command Prompt for VS 2022":

cl /nologo /W3 DdeMinRepro.cpp user32.lib

Console 1: DdeMinRepro server A

Console 2: DdeMinRepro client

Then repeat with DdeMinRepro server W.

   
// DdeMinRepro.cpp - build (x86, MBCS): cl /nologo /W3 DdeMinRepro.cpp user32.lib
//   DdeMinRepro server A   subclass DDEMLMom with SetWindowLongPtrA / CallWindowProcA
//   DdeMinRepro server W   subclass DDEMLMom with SetWindowLongPtrW / CallWindowProcW
//   DdeMinRepro client     DdeConnect to service "MinRepro", topic "System"
#include <windows.h>
#include <ddeml.h>
#include <stdio.h>
#include <string.h>
static WNDPROC g_old;
static BOOL g_w;
static HDDEDATA CALLBACK Callback(UINT type, UINT, HCONV, HSZ, HSZ, HDDEDATA, ULONG_PTR, ULONG_PTR)
{
	if (type == XTYP_CONNECT) {
		printf("  XTYP_CONNECT received\n");
		return (HDDEDATA)TRUE;
	}
	return NULL;
}
static LRESULT CALLBACK SubProc(HWND h, UINT m, WPARAM wp, LPARAM lp)
{
	if (m == WM_DDE_INITIATE)
		printf("WM_DDE_INITIATE -> CallWindowProc%c(%p)\n", g_w ? 'W' : 'A', g_old);
	return g_w ? CallWindowProcW(g_old, h, m, wp, lp) : CallWindowProcA(g_old, h, m, wp, lp);
}
static BOOL CALLBACK FindMom(HWND h, LPARAM lp)
{
	char cls[32];
	if (GetClassNameA(h, cls, sizeof(cls)) && strcmp(cls, "DDEMLMom") == 0) {
		*(HWND *)lp = h;
		return FALSE;
	}
	return TRUE;
}
int main(int argc, char **argv)
{
	DWORD inst = 0;
	setvbuf(stdout, NULL, _IONBF, 0);
	if (argc >= 3 && strcmp(argv[1], "server") == 0) {
		g_w = (argv[2][0] == 'W' || argv[2][0] == 'w');
		if (DdeInitializeA(&inst, Callback, APPCLASS_STANDARD | CBF_SKIP_ALLNOTIFICATIONS, 0) != DMLERR_NO_ERROR)
			return printf("DdeInitialize failed\n"), 1;
		HWND mom = NULL;
		EnumThreadWindows(GetCurrentThreadId(), FindMom, (LPARAM)&mom);
		if (!mom)
			return printf("DDEMLMom not found\n"), 1;
		g_old = g_w ? (WNDPROC)SetWindowLongPtrW(mom, GWLP_WNDPROC, (LONG_PTR)SubProc)
		            : (WNDPROC)SetWindowLongPtrA(mom, GWLP_WNDPROC, (LONG_PTR)SubProc);
		printf("DDEMLMom %p subclassed with SetWindowLongPtr%c, previous proc %p\n", mom, g_w ? 'W' : 'A', g_old);
		HSZ svc = DdeCreateStringHandleA(inst, "MinRepro", CP_WINANSI);
		DdeNameService(inst, svc, NULL, DNS_REGISTER);
		printf("Service \"MinRepro\" registered. Run \"DdeMinRepro client\" in another console.\n");
		MSG msg;
		while (GetMessage(&msg, NULL, 0, 0) > 0)
			DispatchMessage(&msg);
		return 0;
	}
	if (argc >= 2 && strcmp(argv[1], "client") == 0) {
		DdeInitializeA(&inst, Callback, APPCMD_CLIENTONLY, 0);
		HSZ svc = DdeCreateStringHandleA(inst, "MinRepro", CP_WINANSI);
		HSZ top = DdeCreateStringHandleA(inst, "System", CP_WINANSI);
		HCONV conv = DdeConnect(inst, svc, top, NULL);
		UINT err = DdeGetLastError(inst);
		printf(conv ? "CONNECTED\n" : "FAILED, DdeGetLastError = 0x%04X\n", err);
		if (conv)
			DdeDisconnect(conv);
		DdeUninitialize(inst);
		return conv ? 0 : 1;
	}
	printf("usage: DdeMinRepro server A | server W | client\n");
	return 2;
}

Output with KB5132061

server Aclient: FAILED, DdeGetLastError = 0x400A (DMLERR_NO_CONV_ESTABLISHED)

server Wclient: CONNECTED

Output without KB5132061 (26200.9711)

server A:

DDEMLMom 002C0972 subclassed with SetWindowLongPtrA, previous proc FFFF0C97

Service "MinRepro" registered. Run "DdeMinRepro client" in another console.

WM_DDE_INITIATE -> CallWindowProcA(FFFF0C97)

  XTYP_CONNECT received

Client: CONNECTED

Workaround we use

Right after DdeInitialize, put the class window procedure back on the DDEML windows of the thread:

SetWindowLongPtrW(hwnd, GWLP_WNDPROC, GetClassLongPtrW(hwnd, GCLP_WNDPROC)).

If the new behavior is intentional, what is the supported way for an ANSI application to subclass a window

of a Unicode class and still forward WM_DDE_INITIATE?