user32: Return result through NtCallbackReturn for the copy image callback.

dlls/user32/user_main.c

@@ -100,10 +100,12 @@ static void dpiaware_init(void)
     }
 }
 
-static NTSTATUS WINAPI User32CopyImage( const struct copy_image_params *params, ULONG size )
+static NTSTATUS WINAPI User32CopyImage( void *args, ULONG size )
 {
+    const struct copy_image_params *params = args;
     HANDLE ret = CopyImage( params->hwnd, params->type, params->dx, params->dy, params->flags );
-    return HandleToUlong( ret );
+    if (!ret) return STATUS_NO_MEMORY;
+    return NtCallbackReturn( &ret, sizeof(ret), STATUS_SUCCESS );
 }
 
 static NTSTATUS WINAPI User32DrawNonClientButton( const struct draw_non_client_button_params *params, ULONG size )

dlls/win32u/cursoricon.c

@@ -718,7 +718,8 @@ HANDLE WINAPI CopyImage( HANDLE hwnd, UINT type, INT dx, INT dy, UINT flags )
         { .hwnd = hwnd, .type = type, .dx = dx, .dy = dy, .flags = flags };
 
     ret = KeUserModeCallback( NtUserCopyImage, &params, sizeof(params), &ret_ptr, &ret_len );
-    return UlongToHandle( ret );
+    if (!ret && ret_len == sizeof(HANDLE)) return *(HANDLE *)ret_ptr;
+    return 0;
 }
 
 /******************************************************************************

dlls/wow64win/user.c

@@ -1163,6 +1163,9 @@ static NTSTATUS WINAPI wow64_NtUserCallWindowsHook( void *arg, ULONG size )
 static NTSTATUS WINAPI wow64_NtUserCopyImage( void *arg, ULONG size )
 {
     struct copy_image_params *params = arg;
+    void *ret_ptr;
+    ULONG ret_len;
+    NTSTATUS status;
     struct
     {
         ULONG hwnd;
@@ -1177,7 +1180,14 @@ static NTSTATUS WINAPI wow64_NtUserCopyImage( void *arg, ULONG size )
     params32.dx = params->dx;
     params32.dy = params->dy;
     params32.flags = params->flags;
-    return dispatch_callback( NtUserCopyImage, &params32, sizeof(params32) );
+    status = Wow64KiUserCallbackDispatcher( NtUserCopyImage, &params32, sizeof(params32),
+                                            &ret_ptr, &ret_len );
+    if (!status && ret_len == sizeof(ULONG))
+    {
+        HANDLE handle = ULongToHandle( *(ULONG *)ret_ptr );
+        return NtCallbackReturn( &handle, sizeof(handle), status );
+    }
+    return status;
 }
 
 static NTSTATUS WINAPI wow64_NtUserDrawNonClientButton( void *arg, ULONG size )