diff --git a/base/system/services/controlset.c b/base/system/services/controlset.c
index e9ac8ddc7e2..1eb0facd545 100644
--- a/base/system/services/controlset.c
+++ b/base/system/services/controlset.c
@@ -174,9 +174,10 @@ ScmCopyTree(
             return ERROR_NOT_ENOUGH_MEMORY;
         }
 
+        /* RegSetValueExW tries to read behind the maximum length, so give it space for that */
         lpDataBuffer = HeapAlloc(GetProcessHeap(),
-                                 0,
-                                 dwMaxValueLength);
+                                 HEAP_ZERO_MEMORY,
+                                 dwMaxValueLength + sizeof(WCHAR));
         if (lpDataBuffer == NULL)
         {
             DPRINT1("Buffer allocation failed\n");