diff --git a/dlls/ntdll/reg.c b/dlls/ntdll/reg.c
index 044bf32f460..3cbd055f367 100644
--- a/dlls/ntdll/reg.c
+++ b/dlls/ntdll/reg.c
@@ -311,7 +311,12 @@ static NTSTATUS RTL_ReportRegistryValue(PKEY_VALUE_FULL_INFORMATION pInfo,
             if (str->Buffer == NULL)
                 RtlCreateUnicodeString(str, (WCHAR*)(((CHAR*)pInfo) + pInfo->DataOffset));
             else
-                RtlAppendUnicodeToString(str, (WCHAR*)(((CHAR*)pInfo) + pInfo->DataOffset));
+            {
+                if (str->MaximumLength < len)
+                    return STATUS_BUFFER_TOO_SMALL;
+                memcpy(str->Buffer, (char*)pInfo + pInfo->DataOffset, len);
+                str->Length = len - sizeof(WCHAR);
+            }
             break;
 
         case REG_MULTI_SZ:
diff --git a/dlls/ntdll/tests/reg.c b/dlls/ntdll/tests/reg.c
index b6763e6e1d2..14227db755c 100644
--- a/dlls/ntdll/tests/reg.c
+++ b/dlls/ntdll/tests/reg.c
@@ -2673,6 +2673,11 @@ static struct query_reg_values_test query_reg_values_tests[] =
         {{ NULL, RTL_QUERY_REGISTRY_DIRECT, (WCHAR*)L"WindowsDrive", &query_reg_values_direct_str }},
         STATUS_SUCCESS, 0, 0, REG_SZ, L"C:"
     },
+    {
+        {{ NULL, RTL_QUERY_REGISTRY_DIRECT | RTL_QUERY_REGISTRY_NOEXPAND, (WCHAR*)L"WindowsDrive",
+           &query_reg_values_direct_str }},
+        STATUS_SUCCESS, 0, 0, REG_SZ, L"%SYSTEMDRIVE%"
+    },
     /* DIRECT on a multi-string crashes on Windows without NOEXPAND */
     /* {
         {{ NULL, RTL_QUERY_REGISTRY_DIRECT, (WCHAR*)L"CapitalsOfEurope", &query_reg_values_direct_str }},