advapi32: QueryObjectSecurity should return a self-relative security descriptor and not overflow the buffer.