Processing the full MSAA accessibility tree in C# returns nulls and ints

Question

We want to process the complete accessibility tree of another process. Normally we do this in C++ but we would prefer to move to C#.

We successfully start the process using AccessibleObjectFromWindow.

We then successfully get the children of this top-level accessible object using AccessibleChildren.

However, when we recurse these first level children to look for their children, we get the correct child counts (using Accessibility Explorer as our benchmark), but the children are populated with nulls or integers.

Is there a way to cast the integers back to an accessible object?

Code:

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Reflection.Metadata;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Text;
using System.Windows.Forms;
using Accessibility;

public partial class Form1 : Form
{
    [DllImport("oleacc.dll")]
    internal static extern int AccessibleObjectFromWindow(IntPtr hwnd, uint id, ref Guid iid, [In, Out, MarshalAs(UnmanagedType.IUnknown)] ref object ppvObject);

    [DllImport("oleacc.dll")]
    public static extern uint AccessibleChildren(IAccessible paccContainer, uint iChildStart, uint cChildren, [Out] object[] rgvarChildren, out uint pcObtained);

    #region Enumerations

    //Obj ID
    internal enum OBJID : uint
    {
        WINDOW = 0x00000000,
        SYSMENU = 0xFFFFFFFF,
        TITLEBAR = 0xFFFFFFFE,
        MENU = 0xFFFFFFFD,
        CLIENT = 0xFFFFFFFC,
        VSCROLL = 0xFFFFFFFB,
        HSCROLL = 0xFFFFFFFA,
        SIZEGRIP = 0xFFFFFFF9,
        CARET = 0xFFFFFFF8,
        CURSOR = 0xFFFFFFF7,
        ALERT = 0xFFFFFFF6,
        SOUND = 0xFFFFFFF5,
        CHILDID_SELF = 0,
        SELFLAG_TAKEFOCUS = 0x01
    }

    #endregion Enumerations

    IAccessible iAccessible; //interface: Accessibility namespace
    IntPtr handle;

    public Form1()
    {
        InitializeComponent();
    }

    public bool checkHandle()
    {
        Guid guid = new Guid("{618736E0-3C3D-11CF-810C-00AA00389B71}");
        object obj = null;

        // Use any window handle
        handle = (IntPtr)66956;

        int retVal = AccessibleObjectFromWindow(handle, (uint)OBJID.WINDOW, ref guid, ref obj);
        iAccessible = (IAccessible)obj;

        string[] data = new string[1];

        string accWindowName = iAccessible.get_accName(0);
        string accWindowVal = iAccessible.get_accValue(0);

        System.Diagnostics.Debug.WriteLine("IAccessible Name : " + accWindowName);
        System.Diagnostics.Debug.WriteLine("IAccessible value : " + accWindowVal);
        System.Diagnostics.Debug.WriteLine("IAccessible Role is : " + iAccessible.get_accRole(0));

        System.Diagnostics.Debug.WriteLine("IAccessible Type: " + iAccessible.GetType());
        System.Diagnostics.Debug.WriteLine("IAccessible Focus is: " + iAccessible.accFocus);
        System.Diagnostics.Debug.WriteLine("IAccessible Selection is " + iAccessible.get_accState());
        //iAccessible.accSelect((int)OBJID.SELFLAG_TAKEFOCUS, 0);
        //if (!accWindowName.Contains("Mozilla Firefox"))
        //    return false;

        ProcessChildren(iAccessible, false);

        iAccessible = null;
        return false;
    }

    private void ProcessChildren(IAccessible iChild, bool v)
    {
        IAccessible[] childs = new IAccessible[iChild.accChildCount];

        uint obtained = 0;
        uint firstChild = 0;
        uint childcount = (uint)iChild.accChildCount - 1;

        uint ret = AccessibleChildren(iChild, firstChild, childcount, childs, out obtained);
        int i = 0;
        foreach (IAccessible child in childs)
        {

            if (child == null)
                continue;

            if (!Marshal.IsComObject(child)) continue;

            string accWindowName = child.get_accName(0);
            string accWindowVal = child.get_accValue(0);


            ProcessChildren(child, false);

            Marshal.ReleaseComObject(child);
            
        }
    }

    private void button1_Click(object sender, EventArgs e)
    {
        checkHandle();
    }

}

}