It appears that enumerating data streams (dir /R - for example) fails for files with 3+ data streams. Some wrong memory location is read in FindNextStreamW()