I guess I should elaborate on that. You can request any of the four parts of the security descriptor and pass NULL for the SD itself and Windows will return them without anyway to free the memory.
I can see what MSDN says it does, but your tests don't check that calling GetSecurityInfo with a non-null ppsidOwner, ppsidGroup etc. and a null ppSecurityDescriptor is allowed. Because you're not checking it, it looks like a bug. --Juan