Of course (...) in CryptGenRandom() the size comes before the buffer.