Alexandre Julliard (@julliard) commented about dlls/ntdll/reg.c:
RtlInitUnicodeString(&src, data); res = 0; dst.MaximumLength = 0;
dst.Buffer = NULL;
This should probably be addressed in RtlExpandEnvironmentStrings_U instead of patching the callers.