Huw Davies (@huw) commented about server/registry.c:
memcpy( filename, req_data, req_data_len ); filename[req_data_len] = 0;
load_registry( key, filename );release_object( key );
if (req->flags & REG_APP_HIVE){load_app_registry( key, filename );if (!get_error())reply->hkey = alloc_handle( current->process, key, req->access, objattr->attributes );}elseload_registry( key, filename );if (get_error())delete_key(key, 0);
This is changing the non `REG_APP_HIVE` path too.