So native also has that null-deref length_is clause? I guess that's a bug in native, then. Better do the same, wouldn't be the first blatant bug Wine reproduces.
That's what RemoteNext is for. RPC doesn't let that be NULL, but the API does. See IEnumShellItems_Next_Proxy() in dlls/actxprxy/usrmarshal.c. This merge request will need to essentially copy-paste that implementation in the same file.
RemoteNext() isn't exactly a real method and doesn't need to be implemented per se. It's basically the internal RPC version of Next() that has RPC-friendly parameters.