v2: - allocate a buffer instead of checking output buffer, letting it just get access violation in case of invalid output. That will leak the allocated buffer in case of invalid output but simplifies the code and is probably more "idiomatic" for such syscall implementation; - define ProcessId as ULONG_PTR.