[Bug 57178] New: toolbar control doesn't forward WM_NOTIFY to it's original parent

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=57178

Bug ID: 57178
           Summary: toolbar control doesn't forward WM_NOTIFY to it's
                    original parent
           Product: Wine
           Version: 9.16
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: comctl32
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: Debian

Created attachment 77077
  --> https://bugs.winehq.org/attachment.cgi?id=77077
foo2.c — test program, compile `x86_64-w64-mingw32-gcc-13 -std=c11 -Wall
-Wextra -Wpedantic -Wno-unused-parameter -O3 -o foo2.exe foo2.c -lcomctl32`

in windows xp professional x64 edition service pack 2 and windows 7 ultimate
service pack 1 and maybe other windowses that I didn't test but not wine

NMDDR nmhdr={
        .hwndFrom=NULL,
        .idFrom=0xfedcba9876543210,
        .code=0xabc
    };
    SendMessageA(
        toolbar,
        WM_NOTIFY,
        0x4444444444444444,
        (LPARAM)nmhdr
    );

does something similar to

NMDDR nmhdr={
        .hwndFrom=NULL,
        .idFrom=0xfedcba9876543210,
        .code=0xabc
    };
    SendMessageA(
        toolbar_original_parent,
        WM_NOTIFY,
        0xfedcba9876543210,
        (LPARAM)nmhdr
    );

except if nmhdr.code is one of 0xfffffc4a, 0xfffffc4b, 0xfffffc4c, 0xfffffc4d,
0xfffffc4e, 0xfffffc4f, 0xfffffc50, 0xfffffc51, 0xfffffc52, 0xfffffc53,
0xfffffc54, 0xfffffc55, 0xfffffc56, 0xfffffc57, 0xfffffc58, 0xfffffc59,
0xfffffc5a, 0xfffffc5b, 0xfffffc5c, 0xfffffc5d, 0xfffffc5e, 0xfffffc5f,
0xfffffc60, 0xfffffc61, 0xfffffc62, 0xfffffc63, 0xfffffc64, 0xfffffc65,
0xfffffc66, 0xfffffc67, 0xfffffc68, 0xfffffc69, 0xfffffc6a, 0xfffffc6b,
0xfffffc6c, 0xfffffc6d, 0xfffffc6e, 0xfffffc6f, 0xfffffc70, 0xfffffc71,
0xfffffc72, 0xfffffc73, 0xfffffc74, 0xfffffc75, 0xfffffc76, 0xfffffc77,
0xfffffc78, 0xfffffc79, 0xfffffc7a, 0xfffffc7b, 0xfffffc7c, 0xfffffcd7,
0xfffffcda, 0xfffffdee

nmhdr.hwndFrom is not accessed and can be inside PAGE_NOACCESS page except if
nmhdr.code is one of 0xfffffcd7, 0xfffffcda (didn't test what happens if
nmhdr.hwndFrom is readable)

nmhdr.code gets overwritten if nhmdr.code is one of 0xfffffcd9, 0xfffffd17,
0xfffffd18, 0xfffffd19, 0xfffffd1a, 0xfffffd30, 0xfffffd31, 0xfffffe34,
0xfffffe35, 0xfffffe36, 0xfffffe37, 0xfffffe38, 0xfffffe39, 0xfffffe3a,
0xfffffe3b, 0xfffffe3c, 0xfffffe3d, 0xfffffe3e, 0xfffffe62, 0xfffffeb7,
0xfffffeb8, 0xfffffeb9, 0xfffffeba, 0xfffffebb, 0xfffffebd, 0xfffffebe,
0xfffffebf, 0xfffffec0, 0xffffff4d, 0xffffff4e, 0xffffff4f, 0xffffff50,
0xffffff51, 0xffffff5d, 0xffffff5f, 0xffffff62 (see foo2.txt)
(toolbar_original_parent gets the message after overwriting nmhdr.code)

note: 0xfedcba9876543210, 0xabc, 0x4444444444444444 are arbitrary garbage
numbers
note: foo2.c code is not very good because I didn't care about non-x64
windowses and first time using windows-specific api
note: toolbar_original_parent is called h1 in foo2.c

I think this bug is reason why pressing enter in 7-zip file manager path input
doesn't work in wine and reactos (
https://old.reddit.com/r/winehq/comments/16ah3ze )