When len is zero (to obtain the length needed), nothing is written to `output`, even though the rewrite (correctly) uses WideCharToMultiByte on the output to determine the returned length. But this leads to reading garbage uninitialized values instead of the proper value.