The handler for IOCTL_MOUNTMGR_QUERY_DHCP_REQUEST_PARAMS allocates the return size on the stack and expects it to be valid after a call to dhcp_request. The current early exits from the dbus and Mac implementations do not always set it, sometimes resulting in using a garbage return size.