Nikolay Sivov (@nsivov) commented about dlls/combase/usrmarshal.c:
WCHAR data[];} buf;struct {+#ifdef _WIN64
ULONG pad;+#endif
HSTRING str;};- };
+}; +#pragma pack(pop)
+/******************************************************************************
HSTRING_UserSize (combase.@)- */
+ULONG __RPC_USER HSTRING_UserSize(ULONG *flags, ULONG start, HSTRING *str)
It's not a 'start', it's current buffer 'size', where you're appending HSTRING argument.