ReadDirectoryChanges's APC callback called with wrong LPOVERLAPPED address

Hello,

I discovered that sometimes completion routines called with ReadDirectoryChangesW (and probably with their NT counterpart) contain an invalid lpOverlapped pointer. However some ReactOS components (especially shell notification that trigger the bug) need to have the correct lpOverlapped structure (and especially hEvent field) to send notification.

Here is attached a revelant part of debuglog where I printed the expected address (02A82FE4), and the one actually received by the _NotificationCompletion callback (02988FE4).