We do not handle syscalls output parameters checks this way. If ret_len is not writeable and is being written to in ntdll Unix-side function (like NtQueryInformationThread) that will already result in returning STATUS_ACCESS_VIOLATION to the caller (the fault in syscall will be handled this way by segv_handler).
So something else is going wrong here. Which information class (class parameter) is that which is helped by this patch? I guess most likely one of the following is actually going on: - the class requested is not implemented, thus ret_len is not written and STATUS_NOT_IMPLEMENTED is returned instead of STATUS_ACCESS_VIOLATION. The correct fix would be implementing the missing class or adding some sane semi-stub implementation which will be touching *ret_len; - the class is implemented and STATUS_ACCESS_VIOLATION is correctly returned but before faulting on writing *ret_len NtQueryInformationThread changes some output data which is not supposed to change in this case. The correct fix would be setting *ret_len earlier.
Any of that would need a test added (maybe to dlls/ntdll/tests/info.c or elsewhere depending on which class is that and thus where it fits in most naturally).