ReadEventLog function returning ERROR_NOT_ENOUGH_MEMORY

What does it mean when ReadEventLog returns error code 8 ERROR_NOT_ENOUGH_MEMORY Even though the buffer I pass to it is big enough?

Basically I'm working on some old code that gathers system information and one of the things it does is read the windows event and application logs.

How do I mitigate the error? pretty ugly API that is not well explained.

It's currently written something like this (shortened for clarity... not the actual code which is a bit too long)

hLog = OpenEventLog(NULL, "System");

int bufSize = 8192;
int bytesRead, minBytes;
BYTE* buf = malloc(bufSize);
DWORD flags = EVENTLOG_BACKWARDS_READ | EVENTLOG_SEQUENTIAL_READ;
DWORD status = ERROR_SUCCESS;

while (status == ERROR_SUCCESS) {
    if (ReadEventLog(hLog, flags, 0, buf, bufSize, &bytesRead, &minBytes) == 0) {
       status = GetLastError();
       switch (status) {
          case ERROR_HANDLE_EOF:
             break;

          case ERROR_INSUFFICIENT_BUFFER:
             // resize buf. Set new len. 
             status = ERROR_SUCCESS;
             break;

          default:
             // returns 8 here - insufficient memory reading System event log? :(
             break;

       }
    } else {
       ProcessEntries(buf, bytesRead);
    }
}

To be clear, the real code does a little more. It tries to work out if the events we want to export are too old. It also has a default cap of 1000 entries. Beyond that it won't export them. It exports in reverse, newest to oldest to CSV.

I'm only getting this issue with the System event log. I have granted the app priveleges through UAC prompt. The same code works for Application and Security events.