In practice this never led to any issues due to implementation details of bstr_sanitize_utf8_latin1, but there's no guarantee that a bstr is correctly null-terminated.