[Bug 20862] New: Write buffer overrun in VARIANT_UserUnmarshal?