> It might cause an OOB write though
No, because `RegQueryValueExW` will return ERROR_MORE_DATA and the code bails out on error (also leaking the memory).
1. first call to `RegQueryValueExW` returns a value length of 10
2. length is set to 12
3. external change causes the value to now be 12
4. second call to ``RegQueryValueExW` succeeds, as 12 <= 12, no ERROR_MORE_DATA here; length stays 12
5. length + 1 and length + 2 are now OOB
It might cause an OOB write though, with a data race on the registry key (if the key's value happens to grow in length by a char or two between the calls, time of check time of use yada yada).