I am still seeing the identical behavior whether I null terminate the string or set the length explicitly. Are you sure you are setting the length correctly?
If I change my sample program to use:
move "c:\temp\*" to pattern-text
move 9 to pattern-len
move 2 to scan-attrib
move 2 to scan-flags
I still get the "C:\temp\." and "C:\temp\.." directories as the first ones returned.
Can you try my test program and see if you get the same behavior?