We have a lot of unchecked string functions on the DeviceNode fields in io/pnpmgr.c, by the way. I think i've stumbled on four such places so far, but I suspect that the whole thing should be hardened together.
Can you be more specific about this? Which strings? Which places?
I'm wrong that there are a lot, these are the ones I've been bitten by. I think they're the only cases in which a wcscat/wcscpy is called on a possibly empty string.
line 171, DeviceNode->InstancePath.Buffer can be null. line 1059, DeviceNode->InstancePath.Buffer can be null.