Mark Jansen (@learn-more) commented about dlls/comctl32/edit.c:
EDIT_UpdateScrollInfo(es);
} if (dx && !(es->flags & EF_HSCROLL_TRACK))
EDIT_NOTIFY_PARENT(es, EN_HSCROLL);
if (dy && !(es->flags & EF_VSCROLL_TRACK))notify_parent(es, EN_HSCROLL);
Here you are reading `es` after returning from a notification, should this be guarded?