Nikolay Sivov (@nsivov) commented about dlls/ntdll/sec.c:
+ { + return STATUS_INVALID_PARAMETER; + } + + service_sid_length = RtlLengthRequiredSid( 1 + ARRAY_SIZE(hash) ); + too_small = *pServiceSidLength < service_sid_length; + *pServiceSidLength = service_sid_length; + if (too_small) + { + return STATUS_BUFFER_TOO_SMALL; + } + + ((SID*)pServiceSid)->Revision = SID_REVISION; + ((SID*)pServiceSid)->IdentifierAuthority = nt_authority; + ((SID*)pServiceSid)->SubAuthorityCount = 1 + ARRAY_SIZE(hash); + ((SID*)pServiceSid)->SubAuthority[0] = SECURITY_SERVICE_ID_BASE_RID; It's not very important but this part could be using RtlInitializeSid() or RtlInitializeSidEx() to set all the fields, but we don't have that one yet.
-- https://gitlab.winehq.org/wine/wine/-/merge_requests/7682#note_99291