Sysmon on Windows rare bug

Start with the Windows Process Create event and compare its raw UTF-16 command line with the output of the reported ascii_to_wide conversion on Windows 10.0.26200. Determine whether the missing closing quote originates in SysmonCommon or in the caller's conversion, then reproduce or document the result with a focused regression test if the project provides one.

Exactly on one host of ours (out of thousands), we have a command line from the Process Create event that do not have closing ", like this:

"C:\<scrubbed>\<scrubbed_file>.exe  -dummy -command -line -scrubbed -too

e.g. there is opening " and not closing one, bur rather .

This is in 15.15 (going to test soon the new version in Windows Insiders). On my side I convert the UTF-16 string to ASCII, like this (so maybe my fault):

// 20127 us-ascii US-ASCII (7-bit)
// from https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
enum
{
        CP_20127_UI_ASCII_7 = 20127,
};

std::wstring ascii_to_wide( const std::string &s )
{
        const auto len{ MultiByteToWideChar( CP_20127_UI_ASCII_7, 0, s.c_str(), -1, nullptr, 0 ) };
        std::wstring wide;
        if ( len > 0 )
        {
                wide.resize( len - 1 );
                MultiByteToWideChar( CP_20127_UI_ASCII_7, 0, s.c_str(), -1, wide.data(), len - 1 );
        }
        return wide;
}

The machine where this happens is 10.0.26200 a 48 core with 256GB AMD Ryzen Threadripper PRO 7965WX 24-Cores (if that matters at all). We have plenty others like it, so I assume the machine must've got into bad state, and would reboot it at some point. Just weird