browseui: Return interface pointer from QI instead of impl pointer.

dlls/browseui/aclmulti.c

@@ -100,7 +100,7 @@ static HRESULT WINAPI ACLMulti_QueryInterface(IEnumString *iface, REFIID iid, LP
 
     if (IsEqualIID(iid, &IID_IUnknown) || IsEqualIID(iid, &IID_IEnumString))
     {
-        *ppvOut = This;
+        *ppvOut = &This->IEnumString_iface;
     }
     else if (IsEqualIID(iid, &IID_IACList))
     {

dlls/browseui/aclsource.c

@@ -67,7 +67,7 @@ static HRESULT WINAPI ACLShellSource_QueryInterface(IACList2 *iface, REFIID iid,
     if (IsEqualIID(iid, &IID_IUnknown) || IsEqualIID(iid, &IID_IACList2) ||
         IsEqualIID(iid, &IID_IACList))
     {
-        *ppvOut = This;
+        *ppvOut = &This->IACList2_iface;
     }
 
     if (*ppvOut)

dlls/browseui/browseui_main.c

@@ -152,7 +152,7 @@ static HRESULT ClassFactory_Constructor(LPFNCONSTRUCTOR ctor, LPVOID *ppvOut)
     This->IClassFactory_iface.lpVtbl = &ClassFactoryVtbl;
     This->ref = 1;
     This->ctor = ctor;
-    *ppvOut = This;
+    *ppvOut = &This->IClassFactory_iface;
     TRACE("Created class factory %p\n", This);
     InterlockedIncrement(&BROWSEUI_refCount);
     return S_OK;

dlls/browseui/compcatcachedaemon.c

@@ -70,7 +70,7 @@ static HRESULT WINAPI CompCatCacheDaemon_QueryInterface(IRunnableTask *iface, RE
 
     if (IsEqualIID(iid, &IID_IRunnableTask) || IsEqualIID(iid, &IID_IUnknown))
     {
-        *ppvOut = This;
+        *ppvOut = &This->IRunnableTask_iface;
     }
 
     if (*ppvOut)