Just to be precise, the bug isn’t about invalid use of an API. The software uses uninitialized values on the stack, which under older Windows versions happen to

Just to be precise, the bug isn’t about invalid use of an API. The software uses uninitialized values on the stack, which under older Windows versions happen to be preserved from earlier calls to the same application-level function, despite intermediate calls to other functions, which happen to also involve Windows API calls. In newer Windows versions, these latter functions happen to use more stack space, leading to the old values not being preserved on the stack anymore. I won’t argue about your other point, as there are arguments either way. I just don’t think this particular example makes a good case, and I suspect that it wouldn’t have been made if the full workings of the bug had been properly understood.