A few years after
I posted this story,
the security team received something very similar.
If have found that if you call the
(whose last parameter is supposed to be a pointer to a DWORD)
and instead of passing a value pointer to a DWORD,
you pass NULL,
then you can trigger an access violation in the XYZ function.
The XYZ ...