Nikolay Sivov (@nsivov) commented about dlls/propsys/propvar.c:
{
- FIXME("propvar %p, bstr %p.\n", propvar, bstr);
 
- WCHAR *str;
 - HRESULT hr;
 - TRACE("propvar %p, propvar->vt %#x, bstr %p.\n",
 propvar, propvar ? propvar->vt : 0, bstr);- if (FAILED(hr = PropVariantToStringAlloc(propvar, &str)))
 return hr;- *bstr = SysAllocString(str);
 - CoTaskMemFree(str);
 
- return E_NOTIMPL;
 
- return S_OK;
 
The problem here is that WCHAR* and BSTR are potentially different, BSTR can support embedded nulls. What should happen if you have VT_BSTR propvar as input?