Index: dll/win32/msafd/misc/dllmain.c
===================================================================
--- dll/win32/msafd/misc/dllmain.c	(revision 72748)
+++ dll/win32/msafd/misc/dllmain.c	(working copy)
@@ -890,6 +890,8 @@
 
     if(!NT_SUCCESS(Status))
     {
+        if (lpErrno)
+            *lpErrno = WSAEFAULT;
         ERR("NtCreateEvent failed, 0x%08x\n", Status);
         return SOCKET_ERROR;
     }
@@ -2013,7 +2015,8 @@
     switch( dwIoControlCode )
     {
         case FIONBIO:
-            if( cbInBuffer < sizeof(INT) || IS_INTRESOURCE(lpvInBuffer) )
+            *lpcbBytesReturned = sizeof(ULONG);
+            if (cbOutBuffer < sizeof(ULONG) || IS_INTRESOURCE(lpvOutBuffer))
             {
                 *lpErrno = WSAEFAULT;
                 return SOCKET_ERROR;
@@ -2026,7 +2029,8 @@
 			else
 				return NO_ERROR;
         case FIONREAD:
-            if( cbOutBuffer < sizeof(INT) || IS_INTRESOURCE(lpvOutBuffer) )
+            *lpcbBytesReturned = sizeof(ULONG);
+            if (cbOutBuffer < sizeof(ULONG) || IS_INTRESOURCE(lpvOutBuffer))
             {
                 *lpErrno = WSAEFAULT;
                 return SOCKET_ERROR;
@@ -2035,11 +2039,9 @@
 			if (*lpErrno != NO_ERROR)
 				return SOCKET_ERROR;
 			else
-			{
-				*lpcbBytesReturned = sizeof(ULONG);
 				return NO_ERROR;
-			}
         case SIOCATMARK:
+            *lpcbBytesReturned = sizeof(BOOL);
             if (cbOutBuffer < sizeof(BOOL) || IS_INTRESOURCE(lpvOutBuffer))
             {
                 *lpErrno = WSAEFAULT;
@@ -2049,12 +2051,25 @@
             /* FIXME: Return false for now */
             *(BOOL*)lpvOutBuffer = FALSE;
 
-            *lpcbBytesReturned = sizeof(BOOL);
             *lpErrno = NO_ERROR;
             return NO_ERROR;
         case SIO_GET_EXTENSION_FUNCTION_POINTER:
             *lpErrno = WSAEINVAL;
             return SOCKET_ERROR;
+        case SIO_ADDRESS_LIST_QUERY:
+            *lpcbBytesReturned = sizeof(SOCKET_ADDRESS_LIST)+sizeof(Socket->WSLocalAddress);
+            if (cbOutBuffer < (sizeof(SOCKET_ADDRESS_LIST)+sizeof(Socket->WSLocalAddress)) || IS_INTRESOURCE(lpvOutBuffer))
+            {
+                *lpErrno = WSAEFAULT;
+                return SOCKET_ERROR;
+            }
+
+            ((SOCKET_ADDRESS_LIST*)lpvOutBuffer)->iAddressCount = 1;
+            ((SOCKET_ADDRESS_LIST*)lpvOutBuffer)->Address[0].iSockaddrLength = sizeof(Socket->WSLocalAddress);
+            ((SOCKET_ADDRESS_LIST*)lpvOutBuffer)->Address[0].lpSockaddr = &Socket->WSLocalAddress;
+
+            *lpErrno = NO_ERROR;
+            return NO_ERROR;
         default:
 			*lpErrno = Socket->HelperData->WSHIoctl(Socket->HelperContext,
 													Handle,
Index: modules/rostests/winetests/ws2_32/sock.c
===================================================================
--- modules/rostests/winetests/ws2_32/sock.c	(revision 72740)
+++ modules/rostests/winetests/ws2_32/sock.c	(working copy)
@@ -9287,7 +9287,6 @@
     CloseHandle(previous_port);
 }
 
-#if CORE_12000_IS_FIXED /* CORE-12000 */
 /* WSHIoctl is not supported by wshtcpip.dll and crashes. Test should be fixed also! */
 static void test_address_list_query(void)
 {
@@ -9351,7 +9350,6 @@
     HeapFree(GetProcessHeap(), 0, address_list);
     closesocket(s);
 }
-#endif /* CORE-12000 */
 
 static DWORD WINAPI inet_ntoa_thread_proc(void *param)
 {
@@ -9810,9 +9808,7 @@
     test_WSAAsyncGetServByName();
 
     test_completion_port();
-#if CORE_12000_IS_FIXED /* FIXME: CORE-12000 */
     test_address_list_query();
-#endif
 
     /* this is an io heavy test, do it at the end so the kernel doesn't start dropping packets */
     test_send();