The RPC runtime could use some of the parameters, expecting them to be 
initialised.

svchost: Add a FIXME for an undocumented function (SvchostPushServiceGlobals) that some native services expect to be called by native svchost.

ole32: Determine the destination for the COM call and initialise the necessary parameters in ClientRpcChannelBuffer_GetBuffer instead of ClientRpcChannelBuffer_SendReceive.

The parameters are then freed in the matching 
ClientRpcChannelBuffer_FreeBuffer function.

widl: Make the offset of conformant string types point to the start of the conformant string format chars, not the pointer type.

Otherwise, writing a type at top-level could cause the pointer format 
string to be used in non-top-level places which may cause memory 
corruption during freeing.