[Bug 20862] Write buffer overrun in VARIANT_UserUnmarshal?