[PATCH 3/3] user32: Fix the pointer to custom dialog control data.