https://bugs.winehq.org/show_bug.cgi?id=12401
--- Comment #61 from Indrek Ardel eniw@ardel.eu --- (In reply to Indrek Ardel from comment #60)
After decoding the base64 buffer in the log, you can see that the MountPointReparseBuffer.PathBuffer ends in a backslash and then a NULL terminator. Interestingly SubstituteNameLength and PrintNameLength differ by 2, with latter taking into account the trailing backslash, while the former doesn't. I don't know enough about the struct at the moment to say what's the intended purpose for either.
Correction. PrintNameLength is 0, I was unpacking the struct incorrectly. PrintNameOffset is 2 after SubstituteNameOffset + SubstituteNameLength, leading to the position where the NULL terminator is starting.
Why is the buffer then holding a backslash that is not being accounted for in either name string is beyond me. Safest would be then to just to perform a string copy before returning as described earlier.
I apologize for my rushed analysis from before and the spam.