[MC-311526] Smart App Control prevents the game from launching on Windows

Summary

Smart App Control blocks unsigned LWJGL 3.4.3+4 native libraries, preventing the
game from launching on Windows 11

Description

The LWJGL native libraries shipped with 26.3-snapshot-10 are unsigned. On Windows 11
systems with Smart App Control enabled, Windows Code Integrity blocks them from
loading once their cached cloud reputation expires, and the game crashes during
native library bootstrap before a window is ever created.

Because the DLLs carry no Authenticode signature, Smart App Control has nothing to
validate them against except cloud reputation. When the cached reputation entry
expires, Windows queries the Defender cloud, receives no reputation record for the
hash, and fails closed. The game becomes unlaunchable.

This is not a malware detection. The Code Integrity event data explicitly records no
threat name, and the file is not flagged as unfriendly. It is purely the absence of a
reputation record on an unsigned binary.

Steps to reproduce

Use a Windows 11 installation with Smart App Control enabled (Settings > Privacy &
security > Windows Security > App & browser control > Smart App Control = On).
Install and launch 26.3-snapshot-10 through the official Minecraft Launcher.
Launch repeatedly over several days, until the cached reputation for the freshly
downloaded natives expires.

Expected result

The game launches.

Actual result

The game crashes during startup with:

Description: Loading library vma
java.lang.UnsatisfiedLinkError: ...\lwjgl\3.4.3+4\x64\lwjgl_vma.dll:
An Application Control policy has blocked this file

at java.base/jdk.internal.loader.NativeLibraries.load(Native Method)
at org.lwjgl.system.Library.loadSystem(Library.java:192)
at org.lwjgl.util.vma.LibVma.<clinit>(LibVma.java:17)
at com.mojang.blaze3d.platform.NativeLibrariesBootstrap.loadVma(NativeLibrariesBootstrap.java:333)
at com.mojang.blaze3d.platform.NativeLibrariesBootstrap.loadLibrary(NativeLibrariesBootstrap.java:199)
at com.mojang.blaze3d.platform.NativeLibrariesBootstrap.loadLibraries(NativeLibrariesBootstrap.java:103)
at net.minecraft.client.main.Main.main(Main.java:142)

Windows simultaneously raises a Windows Security notification stating that it blocked
the OpenJDK application because it could not verify the publisher of lwjgl_vma.dll.

Which library fails varies between launch attempts, because each DLL has its own
independent reputation cache expiry. Observed across ten consecutive crashes in one
session: lwjgl_vma.dll, then freetype.dll, then lwjgl_vma.dll again. An earlier crash
two days prior failed on lwjgl.dll instead.

Technical detail

Windows 11, build 26200.9168. Bundled runtime: Microsoft OpenJDK 25.0.1 (javaw.exe).
Smart App Control enforcing.

Code Integrity events raised per crash: 3033, 3077 and 3118 in the
Microsoft-Windows-CodeIntegrity/Operational log. The 3118 event ("Smart App Control
Block Details") records, on every occurrence:

TTLValid = false (cached reputation expired)
DefenderCloudCallRequested = true
DefenderMadeCloudCall = true (HTTP 200)
DefenderTrust = 0xFF000000 (no reputation record)
IsUnfriendlyFile = false
DefenderThreatName = <empty>
DefenderStatusCode = 0x0
RequestedPolicy = 2 (Enterprise)
ValidatedPolicy = 1 (Unsigned)

On later repeat attempts DefenderMadeCloudCall becomes false and the cloud is no
longer queried at all, so the block is served straight from the cached miss.

All ten natives in the 3.4.3+4 set return "NotSigned" from Get-AuthenticodeSignature.
The three blocked so far, with SHA-256:

lwjgl_vma.dll F3CE5DEEE44AB20304E29AFFA8E1E755FF70BAFDAE21C10827764B39D609C055
lwjgl.dll 15B82B77F3A584B8DF9E95899A908FB825CFAC80A3EBD78ACE0EB473A1069121
freetype.dll FCAC5B5A9A8977F1BC76ECCEA5E71F6C57250CA5AB8605F06906377E91B6E6B7

The remaining seven (jemalloc.dll, lwjgl_opengl.dll, lwjgl_stb.dll, OpenAL.dll,
SDL3.dll, shaderc.dll, spirv-cross.dll) are equally unsigned and equally exposed as
their own cache entries expire.

The older LWJGL 3.4.1+2 and 3.4.1-snapshot native sets have never been blocked, which
is consistent with them having accumulated established reputation. Each new LWJGL
version ships a fresh batch of unsigned binaries with no reputation, so the problem
recurs on every LWJGL bump.

Suggested fix

Authenticode-sign the native libraries distributed by the launcher. A valid publisher
signature removes the dependency on cloud reputation entirely and resolves this
permanently for all affected users.

Submitting the hashes to Microsoft as false positives only mints reputation for this
specific build, and the issue returns with the next LWJGL update.

Impact

The game cannot be launched at all. There is no in-game workaround, and Smart App
Control provides no per-file or per-folder allow-list mechanism, so affected users
must either wait for reputation to appear or disable Smart App Control entirely,
which on Windows 11 cannot be re-enabled without resetting or reinstalling the
operating system.