OK I see. Actually we could probably just use a 16 kB buffer since that's the Windows limit.
Ah sure, that's simpler. I elected to put it on stack in the server since I think that's small enough to still be safe for a leaf function, but kept it on heap in ntdll since resolve_reparse_point() recurses.
Note that there's the same issue in resolve_reparse_point().
Doh <facepalm>