QueryInterface should set *out to NULL on failure, as it seems to do in many different places.
This seems to be a regression from !888. One old game started to crash on startup with this merge request. I bisected it and it pointed to the commit 131ada052a2dbec66df695ce536ca048a2bd9174.