Azure Attestation SDK incompatible with VBS STRICT_MEMORY --- confirmed native memory access violation
We have isolated a reproducible incompatibility in Microsoft.Attestation.Client 1.1.133870390-preview.
In two otherwise identical signed VBS enclaves:
STRICT_MEMORY enabled: att_create_session returns 0x80010018.
STRICT_MEMORY disabled: att_create_session returns ATT_OK (0x00010000).
The failure originates in AzureAttest.dll at RVA 0x797BD (mov rcx, qword ptr [rdx]), which directly reads host memory.
Copying the input into enclave memory does not resolve the issue: the SDK rejects the internal pointer with 0x80010009.
We have a minimal native C++ reproducer and A/B test logs.
Question: Is there a supported Microsoft Attestation SDK version compatible with VBS IMAGE_ENCLAVE_POLICY_STRICT_MEMORY, or a supported alternative integration path?
Disabling STRICT_MEMORY is not acceptable for our production security requirements.
Could a Microsoft Azure Attestation engineer confirm whether this is a known limitation and advise on a supported solution?
We can provide a minimal C++ reproducer and sanitized A/B test logs upon request.
Thank you.
Best, Lutz Engelland