diff --git a/channels/ainput/server/ainput_main.c b/channels/ainput/server/ainput_main.c
index 4da1655ed..e5895fe80 100644
--- a/channels/ainput/server/ainput_main.c
+++ b/channels/ainput/server/ainput_main.c
@@ -177,7 +177,7 @@ static UINT ainput_server_send_version(ainput_server* ainput)
 	Stream_Write_UINT32(s, AINPUT_VERSION_MINOR); /* Version (4 bytes) */
 
 	WINPR_ASSERT(Stream_GetPosition(s) <= UINT32_MAX);
-	if (!WTSVirtualChannelWrite(ainput->ainput_channel, (PCHAR)Stream_Buffer(s),
+	if (!WTSVirtualChannelWrite(ainput->ainput_channel, Stream_BufferAs(s, char),
 	                            (ULONG)Stream_GetPosition(s), &written))
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelWrite failed!");
@@ -467,7 +467,7 @@ static UINT ainput_process_message(ainput_server* ainput)
 		goto out;
 	}
 
-	if (WTSVirtualChannelRead(ainput->ainput_channel, 0, (PCHAR)Stream_Buffer(s),
+	if (WTSVirtualChannelRead(ainput->ainput_channel, 0, Stream_BufferAs(s, char),
 	                          (ULONG)Stream_Capacity(s), &ActualBytesReturned) == FALSE)
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelRead failed!");
diff --git a/channels/audin/server/audin.c b/channels/audin/server/audin.c
index d2da95abc..91387268e 100644
--- a/channels/audin/server/audin.c
+++ b/channels/audin/server/audin.c
@@ -379,7 +379,7 @@ static DWORD WINAPI audin_server_thread_func(LPVOID arg)
 			break;
 
 		WINPR_ASSERT(Stream_Capacity(s) <= UINT32_MAX);
-		if (WTSVirtualChannelRead(audin->audin_channel, 0, (PCHAR)Stream_Buffer(s),
+		if (WTSVirtualChannelRead(audin->audin_channel, 0, Stream_BufferAs(s, char),
 		                          (ULONG)Stream_Capacity(s), &BytesReturned) == FALSE)
 		{
 			WLog_Print(audin->log, WLOG_ERROR, "WTSVirtualChannelRead failed!");
@@ -572,7 +572,7 @@ static UINT audin_server_packet_send(audin_server_context* context, wStream* s)
 	if (pos > UINT32_MAX)
 		return ERROR_INVALID_PARAMETER;
 
-	if (!WTSVirtualChannelWrite(audin->audin_channel, (PCHAR)Stream_Buffer(s), (UINT32)pos,
+	if (!WTSVirtualChannelWrite(audin->audin_channel, Stream_BufferAs(s, char), (UINT32)pos,
 	                            &written))
 	{
 		WLog_Print(audin->log, WLOG_ERROR, "WTSVirtualChannelWrite failed!");
diff --git a/channels/cliprdr/server/cliprdr_main.c b/channels/cliprdr/server/cliprdr_main.c
index df885ddba..e46410fea 100644
--- a/channels/cliprdr/server/cliprdr_main.c
+++ b/channels/cliprdr/server/cliprdr_main.c
@@ -78,24 +78,32 @@
  */
 static UINT cliprdr_server_packet_send(CliprdrServerPrivate* cliprdr, wStream* s)
 {
-	UINT rc = ERROR_INTERNAL_ERROR;
+	UINT rc = 0;
+	size_t pos = 0;
+	BOOL status = 0;
+	UINT32 dataLen = 0;
+	ULONG written = 0;
 
 	WINPR_ASSERT(cliprdr);
 
-	const size_t pos = Stream_GetPosition(s);
+	pos = Stream_GetPosition(s);
 	if ((pos < 8) || (pos > UINT32_MAX))
 	{
 		rc = ERROR_NO_DATA;
 		goto fail;
 	}
 
-	const UINT32 dataLen = (UINT32)(pos - 8);
+	dataLen = (UINT32)(pos - 8);
 	Stream_SetPosition(s, 4);
 	Stream_Write_UINT32(s, dataLen);
+	if (pos > UINT32_MAX)
+	{
+		rc = ERROR_INVALID_DATA;
+		goto fail;
+	}
 
-	ULONG written = 0;
-	const BOOL status = WTSVirtualChannelWrite(cliprdr->ChannelHandle, (PCHAR)Stream_Buffer(s),
-	                                           (UINT32)pos, &written);
+	status = WTSVirtualChannelWrite(cliprdr->ChannelHandle, Stream_BufferAs(s, char), (UINT32)pos,
+	                                &written);
 	rc = status ? CHANNEL_RC_OK : ERROR_INTERNAL_ERROR;
 fail:
 	Stream_Free(s, TRUE);
diff --git a/channels/disp/server/disp_main.c b/channels/disp/server/disp_main.c
index 31d88bf9b..297c80d1b 100644
--- a/channels/disp/server/disp_main.c
+++ b/channels/disp/server/disp_main.c
@@ -315,7 +315,7 @@ static UINT disp_server_handle_messages(DispServerContext* context)
 	if (cap > UINT32_MAX)
 		return CHANNEL_RC_NO_BUFFER;
 
-	if (WTSVirtualChannelRead(priv->disp_channel, 0, (PCHAR)Stream_Buffer(s), (ULONG)cap,
+	if (WTSVirtualChannelRead(priv->disp_channel, 0, Stream_BufferAs(s, char), (ULONG)cap,
 	                          &BytesReturned) == FALSE)
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelRead failed!");
@@ -499,7 +499,7 @@ static UINT disp_server_packet_send(DispServerContext* context, wStream* s)
 		goto out;
 	}
 
-	if (!WTSVirtualChannelWrite(context->priv->disp_channel, (PCHAR)Stream_Buffer(s), pos,
+	if (!WTSVirtualChannelWrite(context->priv->disp_channel, Stream_BufferAs(s, char), pos,
 	                            &written))
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelWrite failed!");
diff --git a/channels/echo/server/echo_main.c b/channels/echo/server/echo_main.c
index 52a4fa678..346a7ab4a 100644
--- a/channels/echo/server/echo_main.c
+++ b/channels/echo/server/echo_main.c
@@ -256,7 +256,7 @@ static DWORD WINAPI echo_server_thread_func(LPVOID arg)
 			break;
 		}
 
-		if (WTSVirtualChannelRead(echo->echo_channel, 0, (PCHAR)Stream_Buffer(s),
+		if (WTSVirtualChannelRead(echo->echo_channel, 0, Stream_BufferAs(s, char),
 		                          (ULONG)Stream_Capacity(s), &BytesReturned) == FALSE)
 		{
 			WLog_ERR(TAG, "WTSVirtualChannelRead failed!");
diff --git a/channels/encomsp/server/encomsp_main.c b/channels/encomsp/server/encomsp_main.c
index 956d72250..e1874f832 100644
--- a/channels/encomsp/server/encomsp_main.c
+++ b/channels/encomsp/server/encomsp_main.c
@@ -251,7 +251,7 @@ static DWORD WINAPI encomsp_server_thread(LPVOID arg)
 
 		const size_t cap = Stream_Capacity(s);
 		if ((cap > UINT32_MAX) ||
-		    !WTSVirtualChannelRead(context->priv->ChannelHandle, 0, (PCHAR)Stream_Buffer(s),
+		    !WTSVirtualChannelRead(context->priv->ChannelHandle, 0, Stream_BufferAs(s, char),
 		                           (ULONG)cap, &BytesReturned))
 		{
 			WLog_ERR(TAG, "WTSVirtualChannelRead failed!");
diff --git a/channels/location/server/location_main.c b/channels/location/server/location_main.c
index 524b8b219..6186eb512 100644
--- a/channels/location/server/location_main.c
+++ b/channels/location/server/location_main.c
@@ -296,7 +296,7 @@ static UINT location_process_message(location_server* location)
 		goto out;
 	}
 
-	if (WTSVirtualChannelRead(location->location_channel, 0, (PCHAR)Stream_Buffer(s),
+	if (WTSVirtualChannelRead(location->location_channel, 0, Stream_BufferAs(s, char),
 	                          (ULONG)Stream_Capacity(s), &BytesReturned) == FALSE)
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelRead failed!");
@@ -544,7 +544,7 @@ static UINT location_server_packet_send(LocationServerContext* context, wStream*
 	const size_t pos = Stream_GetPosition(s);
 	if (pos > UINT32_MAX)
 		return ERROR_OUTOFMEMORY;
-	if (!WTSVirtualChannelWrite(location->location_channel, (PCHAR)Stream_Buffer(s), (ULONG)pos,
+	if (!WTSVirtualChannelWrite(location->location_channel, Stream_BufferAs(s, char), (ULONG)pos,
 	                            &written))
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelWrite failed!");
diff --git a/channels/rail/server/rail_main.c b/channels/rail/server/rail_main.c
index 428178db6..299451e54 100644
--- a/channels/rail/server/rail_main.c
+++ b/channels/rail/server/rail_main.c
@@ -46,7 +46,7 @@ static UINT rail_send(RailServerContext* context, wStream* s, ULONG length)
 	if (!context)
 		return CHANNEL_RC_BAD_INIT_HANDLE;
 
-	if (!WTSVirtualChannelWrite(context->priv->rail_channel, (PCHAR)Stream_Buffer(s), length,
+	if (!WTSVirtualChannelWrite(context->priv->rail_channel, Stream_BufferAs(s, char), length,
 	                            &written))
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelWrite failed!");
diff --git a/channels/rdpdr/server/rdpdr_main.c b/channels/rdpdr/server/rdpdr_main.c
index 8742996f0..806624bf9 100644
--- a/channels/rdpdr/server/rdpdr_main.c
+++ b/channels/rdpdr/server/rdpdr_main.c
@@ -230,7 +230,7 @@ static UINT rdpdr_seal_send_free_request(RdpdrServerContext* context, wStream* s
 		           rdpdr_packetid_string(header.PacketId), header.PacketId);
 	}
 	winpr_HexLogDump(context->priv->log, WLOG_DEBUG, Stream_Buffer(s), Stream_Length(s));
-	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, (PCHAR)Stream_Buffer(s),
+	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, Stream_BufferAs(s, char),
 	                                (ULONG)length, &written);
 	Stream_Free(s, TRUE);
 	return status ? CHANNEL_RC_OK : ERROR_INTERNAL_ERROR;
@@ -2078,7 +2078,7 @@ static DWORD WINAPI rdpdr_server_thread(LPVOID arg)
 		}
 
 		capacity = MIN(Stream_Capacity(s), UINT32_MAX);
-		if (!WTSVirtualChannelRead(context->priv->ChannelHandle, 0, (PCHAR)Stream_Buffer(s),
+		if (!WTSVirtualChannelRead(context->priv->ChannelHandle, 0, Stream_BufferAs(s, char),
 		                           (ULONG)capacity, &BytesReturned))
 		{
 			WLog_Print(context->priv->log, WLOG_ERROR, "WTSVirtualChannelRead failed!");
diff --git a/channels/rdpecam/server/camera_device_enumerator_main.c b/channels/rdpecam/server/camera_device_enumerator_main.c
index 57e6c61d5..3fac4f47a 100644
--- a/channels/rdpecam/server/camera_device_enumerator_main.c
+++ b/channels/rdpecam/server/camera_device_enumerator_main.c
@@ -287,7 +287,7 @@ static UINT enumerator_process_message(enumerator_server* enumerator)
 		goto out;
 	}
 
-	if (WTSVirtualChannelRead(enumerator->enumerator_channel, 0, (PCHAR)Stream_Buffer(s),
+	if (WTSVirtualChannelRead(enumerator->enumerator_channel, 0, Stream_BufferAs(s, char),
 	                          (ULONG)Stream_Capacity(s), &BytesReturned) == FALSE)
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelRead failed!");
@@ -531,7 +531,7 @@ static UINT enumerator_server_packet_send(CamDevEnumServerContext* context, wStr
 	UINT error = CHANNEL_RC_OK;
 	ULONG written = 0;
 
-	if (!WTSVirtualChannelWrite(enumerator->enumerator_channel, (PCHAR)Stream_Buffer(s),
+	if (!WTSVirtualChannelWrite(enumerator->enumerator_channel, Stream_BufferAs(s, char),
 	                            Stream_GetPosition(s), &written))
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelWrite failed!");
diff --git a/channels/rdpecam/server/camera_device_main.c b/channels/rdpecam/server/camera_device_main.c
index 555c39a3f..8a33172ce 100644
--- a/channels/rdpecam/server/camera_device_main.c
+++ b/channels/rdpecam/server/camera_device_main.c
@@ -426,7 +426,7 @@ static UINT device_process_message(device_server* device)
 		goto out;
 	}
 
-	if (WTSVirtualChannelRead(device->device_channel, 0, (PCHAR)Stream_Buffer(s),
+	if (WTSVirtualChannelRead(device->device_channel, 0, Stream_BufferAs(s, char),
 	                          (ULONG)Stream_Capacity(s), &BytesReturned) == FALSE)
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelRead failed!");
@@ -704,7 +704,7 @@ static UINT device_server_packet_send(CameraDeviceServerContext* context, wStrea
 	WINPR_ASSERT(context);
 	WINPR_ASSERT(s);
 
-	if (!WTSVirtualChannelWrite(device->device_channel, (PCHAR)Stream_Buffer(s),
+	if (!WTSVirtualChannelWrite(device->device_channel, Stream_BufferAs(s, char),
 	                            Stream_GetPosition(s), &written))
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelWrite failed!");
diff --git a/channels/rdpemsc/server/mouse_cursor_main.c b/channels/rdpemsc/server/mouse_cursor_main.c
index f05524e21..8d7e55787 100644
--- a/channels/rdpemsc/server/mouse_cursor_main.c
+++ b/channels/rdpemsc/server/mouse_cursor_main.c
@@ -252,7 +252,7 @@ static UINT mouse_cursor_process_message(mouse_cursor_server* mouse_cursor)
 		goto out;
 	}
 
-	if (WTSVirtualChannelRead(mouse_cursor->mouse_cursor_channel, 0, (PCHAR)Stream_Buffer(s),
+	if (WTSVirtualChannelRead(mouse_cursor->mouse_cursor_channel, 0, Stream_BufferAs(s, char),
 	                          (ULONG)Stream_Capacity(s), &BytesReturned) == FALSE)
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelRead failed!");
@@ -514,7 +514,7 @@ static UINT mouse_cursor_server_packet_send(MouseCursorServerContext* context, w
 	const size_t pos = Stream_GetPosition(s);
 	if (pos > UINT32_MAX)
 		return ERROR_OUTOFMEMORY;
-	if (!WTSVirtualChannelWrite(mouse_cursor->mouse_cursor_channel, (PCHAR)Stream_Buffer(s),
+	if (!WTSVirtualChannelWrite(mouse_cursor->mouse_cursor_channel, Stream_BufferAs(s, char),
 	                            (ULONG)pos, &written))
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelWrite failed!");
diff --git a/channels/rdpgfx/server/rdpgfx_main.c b/channels/rdpgfx/server/rdpgfx_main.c
index 2dc76b6cf..b7b84b295 100644
--- a/channels/rdpgfx/server/rdpgfx_main.c
+++ b/channels/rdpgfx/server/rdpgfx_main.c
@@ -1836,7 +1836,7 @@ UINT rdpgfx_server_handle_messages(RdpgfxServerContext* context)
 			return CHANNEL_RC_NO_MEMORY;
 		}
 
-		if (WTSVirtualChannelRead(priv->rdpgfx_channel, 0, (PCHAR)Stream_Buffer(s),
+		if (WTSVirtualChannelRead(priv->rdpgfx_channel, 0, Stream_BufferAs(s, char),
 		                          Stream_Capacity(s), &BytesReturned) == FALSE)
 		{
 			WLog_Print(context->priv->log, WLOG_ERROR, "WTSVirtualChannelRead failed!");
diff --git a/channels/rdpsnd/server/rdpsnd_main.c b/channels/rdpsnd/server/rdpsnd_main.c
index 436060e84..e3682a10b 100644
--- a/channels/rdpsnd/server/rdpsnd_main.c
+++ b/channels/rdpsnd/server/rdpsnd_main.c
@@ -87,7 +87,7 @@ static UINT rdpsnd_server_send_formats(RdpsndServerContext* context)
 	Stream_SetPosition(s, pos);
 
 	WINPR_ASSERT(context->priv);
-	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, (PCHAR)Stream_Buffer(s),
+	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, Stream_BufferAs(s, char),
 	                                Stream_GetPosition(s), &written);
 	Stream_SetPosition(s, 0);
 fail:
@@ -456,7 +456,7 @@ static UINT rdpsnd_server_training(RdpsndServerContext* context, UINT16 timestam
 	Stream_SetPosition(s, 2);
 	Stream_Write_UINT16(s, end - 4);
 
-	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, (PCHAR)Stream_Buffer(s), end,
+	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, Stream_BufferAs(s, char), end,
 	                                &written);
 
 	Stream_SetPosition(s, 0);
@@ -537,7 +537,7 @@ static UINT rdpsnd_server_send_wave_pdu(RdpsndServerContext* context, UINT16 wTi
 		Stream_Write_UINT16(s, end - start + 8);
 		Stream_SetPosition(s, end);
 
-		if (!WTSVirtualChannelWrite(context->priv->ChannelHandle, (PCHAR)Stream_Buffer(s),
+		if (!WTSVirtualChannelWrite(context->priv->ChannelHandle, Stream_BufferAs(s, char),
 		                            start + 4, &written))
 		{
 			WLog_ERR(TAG, "WTSVirtualChannelWrite failed!");
@@ -637,7 +637,7 @@ static UINT rdpsnd_server_send_wave2_pdu(RdpsndServerContext* context, UINT16 fo
 	Stream_SetPosition(s, 2);
 	Stream_Write_UINT16(s, end - 4);
 
-	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, (PCHAR)Stream_Buffer(s), end,
+	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, Stream_BufferAs(s, char), end,
 	                                &written);
 
 	if (!status || (end != written))
@@ -776,7 +776,7 @@ static UINT rdpsnd_server_set_volume(RdpsndServerContext* context, UINT16 left,
 	Stream_Write_UINT16(s, right);
 	len = Stream_GetPosition(s);
 
-	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, (PCHAR)Stream_Buffer(s),
+	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, Stream_BufferAs(s, char),
 	                                (ULONG)len, &written);
 	Stream_SetPosition(s, 0);
 	return status ? CHANNEL_RC_OK : ERROR_INTERNAL_ERROR;
@@ -827,7 +827,7 @@ static UINT rdpsnd_server_close(RdpsndServerContext* context)
 	Stream_SetPosition(s, 2);
 	Stream_Write_UINT16(s, pos - 4);
 	Stream_SetPosition(s, pos);
-	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, (PCHAR)Stream_Buffer(s),
+	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, Stream_BufferAs(s, char),
 	                                Stream_GetPosition(s), &written);
 	Stream_SetPosition(s, 0);
 	return status ? CHANNEL_RC_OK : ERROR_INTERNAL_ERROR;
diff --git a/channels/remdesk/server/remdesk_main.c b/channels/remdesk/server/remdesk_main.c
index 4c876819f..3e2404f3e 100644
--- a/channels/remdesk/server/remdesk_main.c
+++ b/channels/remdesk/server/remdesk_main.c
@@ -38,7 +38,7 @@ static UINT remdesk_virtual_channel_write(RemdeskServerContext* context, wStream
 {
 	BOOL status = 0;
 	ULONG BytesWritten = 0;
-	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, (PCHAR)Stream_Buffer(s),
+	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, Stream_BufferAs(s, char),
 	                                Stream_Length(s), &BytesWritten);
 	return (status) ? CHANNEL_RC_OK : ERROR_INTERNAL_ERROR;
 }
@@ -595,7 +595,7 @@ static DWORD WINAPI remdesk_server_thread(LPVOID arg)
 			break;
 		}
 
-		if (WTSVirtualChannelRead(context->priv->ChannelHandle, 0, (PCHAR)Stream_Buffer(s),
+		if (WTSVirtualChannelRead(context->priv->ChannelHandle, 0, Stream_BufferAs(s, char),
 		                          Stream_Capacity(s), &BytesReturned))
 		{
 			if (BytesReturned)
diff --git a/channels/telemetry/server/telemetry_main.c b/channels/telemetry/server/telemetry_main.c
index ae099f0f4..cf5fa1a55 100644
--- a/channels/telemetry/server/telemetry_main.c
+++ b/channels/telemetry/server/telemetry_main.c
@@ -174,7 +174,7 @@ static UINT telemetry_process_message(telemetry_server* telemetry)
 		goto out;
 	}
 
-	if (WTSVirtualChannelRead(telemetry->telemetry_channel, 0, (PCHAR)Stream_Buffer(s),
+	if (WTSVirtualChannelRead(telemetry->telemetry_channel, 0, Stream_BufferAs(s, char),
 	                          (ULONG)Stream_Capacity(s), &BytesReturned) == FALSE)
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelRead failed!");
diff --git a/libfreerdp/core/server.c b/libfreerdp/core/server.c
index bb96a3b81..6370e4180 100644
--- a/libfreerdp/core/server.c
+++ b/libfreerdp/core/server.c
@@ -1411,7 +1411,7 @@ HANDLE WINAPI FreeRDP_WTSVirtualChannelOpenEx(DWORD SessionId, LPSTR pVirtualNam
 	if (!wts_write_drdynvc_create_request(s, channel->channelId, pVirtualName))
 		goto fail;
 
-	if (!WTSVirtualChannelWrite(vcm->drdynvc_channel, (PCHAR)Stream_Buffer(s),
+	if (!WTSVirtualChannelWrite(vcm->drdynvc_channel, Stream_BufferAs(s, char),
 	                            Stream_GetPosition(s), &written))
 		goto fail;
 
@@ -1469,7 +1469,7 @@ BOOL WINAPI FreeRDP_WTSVirtualChannelClose(HANDLE hChannelHandle)
 				else
 				{
 					wts_write_drdynvc_header(s, CLOSE_REQUEST_PDU, channel->channelId);
-					ret = WTSVirtualChannelWrite(vcm->drdynvc_channel, (PCHAR)Stream_Buffer(s),
+					ret = WTSVirtualChannelWrite(vcm->drdynvc_channel, Stream_BufferAs(s, char),
 					                             Stream_GetPosition(s), &written);
 					Stream_Free(s, TRUE);
 				}
diff --git a/server/Sample/sfreerdp.c b/server/Sample/sfreerdp.c
index d466c1241..c8193b17a 100644
--- a/server/Sample/sfreerdp.c
+++ b/server/Sample/sfreerdp.c
@@ -653,7 +653,7 @@ static DWORD WINAPI tf_debug_channel_thread_func(LPVOID arg)
 
 		Stream_SetPosition(s, 0);
 
-		if (WTSVirtualChannelRead(context->debug_channel, 0, (PCHAR)Stream_Buffer(s),
+		if (WTSVirtualChannelRead(context->debug_channel, 0, Stream_BufferAs(s, char),
 		                          (ULONG)Stream_Capacity(s), &BytesReturned) == FALSE)
 		{
 			if (BytesReturned == 0)
@@ -662,7 +662,7 @@ static DWORD WINAPI tf_debug_channel_thread_func(LPVOID arg)
 			if (!Stream_EnsureRemainingCapacity(s, BytesReturned))
 				break;
 
-			if (WTSVirtualChannelRead(context->debug_channel, 0, (PCHAR)Stream_Buffer(s),
+			if (WTSVirtualChannelRead(context->debug_channel, 0, Stream_BufferAs(s, char),
 			                          (ULONG)Stream_Capacity(s), &BytesReturned) == FALSE)
 			{
 				/* should not happen */